summaryrefslogtreecommitdiffstats
path: root/extensions
Commit message (Collapse)AuthorAgeFilesLines
* extensions: libebt_ip{, 6}: Drop pointless error checkingPhil Sutter2018-09-242-8/+0
| | | | | | | | | Since info->protocol is of type __u8, its value will never become -1. Apart from that, xtables_parse_protocol() calls xt_params->exit_err() in case of error, so this code is dead anyway. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxt_time: Drop initialization of variable 'year'Phil Sutter2018-09-241-4/+4
| | | | | | | | | The variable is not read before being assigned the return value of strtoul(), thefore the initialization is useless. And since after this change parameter 'end' becomes unused, drop it as well. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxt_ipvs: Avoid potential buffer overrunPhil Sutter2018-09-241-10/+12
| | | | | | | | | Just like with libxt_conntrack, get rid of the temporary buffer. The comment even states that it was copied from there, so just make them identical again. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxt_conntrack: Avoid potential buffer overrunPhil Sutter2018-09-241-7/+7
| | | | | | | | | | In print_addr(), a resolved hostname is written into a buffer without size check. Since BUFSIZ is typically 8192 bytes, this shouldn't be an issue, though covscan complained about it. Fix the code by using conntrack_dump_addr() as an example. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxt_conntrack: Version 0 does not support XT_CONNTRACK_DIRECTIONPhil Sutter2018-09-241-8/+0
| | | | | | | | | | Since sinfo->flags is only 8 bytes large, checking for XT_CONNTRACK_DIRECTION bit (which has value 1 << 12) will always return false, so drop this dead code. Fixes: c7fc1dae1e8f8 ("libxt_conntrack: dump ctdir") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxt_LED: Avoid string overrun while parsing led-trigger-idPhil Sutter2018-09-241-2/+1
| | | | | | | | Instead of using strcat() and assuming the name will fit, print into the buffer using snprintf() which truncates the string as needed. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Mark fall through cases in switch() statementsPhil Sutter2018-09-242-15/+18
| | | | | | | | | | | | Typical covscan complaint, non-empty fall throughs should be marked as such. There was but a single case which should break instead, namely in libebt_log.c: It is not critical, since the next case merely asserts 'invert' being zero (which can't be as it was checked before). But while being at it, introduce log_chk_inv() to consolidate the semantically equal cases for the various log types. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: Integrate getethertype.c from xtables corePhil Sutter2018-09-242-142/+2
| | | | | | | | | | | | | | This moves getethertype.c into libxtables so that both extensions and xtables-nft-multi may use the implementations therein. New users are libebt_arp and libebt_vlan which drop their own duplicated implementations of getethertypebyname() for the shared one. This change originated from a covscan report of extensions' implementations not checking fopen() return value which should be implicitly fixed by this as well. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxt_string: Fix array out of bounds checkPhil Sutter2018-09-181-2/+4
| | | | | | | | | | | | | | | | | | Commit 56d7ab42f3782 ("libxt_string: Avoid potential array out of bounds access") tried to fix parse_hex_string() for overlong strings but the change still allowed for 'sindex' to become XT_STRING_MAX_PATTERN_SIZE which leads to access of first byte after info->pattern. This is not really a problem because it merely overwrites info->patlen before calling xtables_error() later, but covscan still detects it so it's still worth fixing. The crucial bit here is that 'sindex' has to be incremented at end of the last iteration since its value is used for info->patlen. Hence just move the overflow check to the beginning of the loop. Fixes: 56d7ab42f3782 ("libxt_string: Avoid potential array out of bounds access") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: add cgroup revision 2Pablo Neira Ayuso2018-09-181-0/+76
| | | | | | Just like revision v1, but cgroup path field is smaller. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: REJECT: Merge reject tablesPhil Sutter2018-09-132-111/+112
| | | | | | | | | | | | Initial motivation for this was a covscan report for potential array out of bounds access in REJECT_xlate (a false-positive, because all possible values of reject->with occur in reject_table_xlate). Use reject types as array indices of reject_table so that reject->with serves as array index. Also merge reject_table_xlate into it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxt_string: Avoid potential array out of bounds accessPhil Sutter2018-09-131-2/+1
| | | | | | | | | | | The pattern index variable 'sindex' is bounds checked before incrementing it, which means in the next loop iteration it might already match the bounds check condition but is used anyway. Fix this by incrementing the index before performing the bounds check. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Improve layout of u32 instructionsJoseph C. Sible2018-09-101-10/+15
| | | | | | | | Make it more clear where the instruction ends, and where what it does begins. Signed-off-by: Joseph C. Sible <josephcsible@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* ip6tables-translate: Fix libip6t_mh.txlate testPhil Sutter2018-08-241-2/+2
| | | | | | | | | Layer 4 protocol name "mobility-header" is not known by nft, so it's neither printed nor accepted on input. Hence fix the test instead of code. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-translate: Fix for libebt_limit.txlatePhil Sutter2018-08-241-1/+9
| | | | | | | | | The xlate function sharing here does not quite work since in ebtables-translate, extensions are supposed to append whitespace. Fix this by introducing a simple wrapper. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libebt_mark: Drop mark_supplied checkPhil Sutter2018-08-241-7/+0
| | | | | | | | | | | | | | | | Use of this static variable causes trouble as it affects all instances of this target. So calling xs_init_target() for one instance invalidates all the others. Moving the variable into target private data seems not possible since that would change the target's size and therefore it wouldn't match anymore with what kernel expects. So just get rid of it entirely. If a user "forgets" to set a mark value, the default value of zero applies. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: AUDIT: Provide translationPhil Sutter2018-08-242-0/+19
| | | | | | | | | With audit logging being supported by nftables as a simple (fake) log level, translating AUDIT target is easy. Especially since xt_AUDIT in kernel doesn't quite care about --type parameter. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix for segfault when registering hashlimit extensionHeena Sirwani2018-08-211-0/+1
| | | | | | | | | | | | This patch fixes the crash when registering the hashlimit extension with xtables during init_extensions(when built with static libs) . The option validation function xtables_option_metavalidate has a loop termination condition of the entry name being NULL. The loop does not terminate when validating hashlimit_mt_opts_v2 which causes a crash on derefencing an invalid entry. Signed-off-by: Heena Sirwani <heenasirwani@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Drop extensions/libxt_mangle.cPhil Sutter2018-08-161-396/+0
| | | | | | | This was merely an outdated duplicate of extensions/libarpt_mangle.c. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Merge libebt_limit.c into libxt_limit.cPhil Sutter2018-08-162-219/+88
| | | | | | | | | | | | | | | | | Both extensions were very similar already, but now that they both are translated into native nftables code, their actual difference (i.e. match size) doesn't matter anymore. This change comes with one caveat: Since ebtables limit match is not in its own file anymore, match preloading automatically also loads the NFPROTO_UNSPEC limit match. This is not a problem per se since match lookup will prefer the family-specific one, but when parsing unknown options, a match without 'parse' callback is encountered. Therefore do_commandeb() has to check existence of that callback prior to dereferencing it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables: Fix for trailing spaces in outputPhil Sutter2018-08-041-24/+16
| | | | | | | | | | | | This changes mangle target to print whitespace before each option, not afterwards. This fixes any cases of trailing or double whitespace in arptables output. While being at it, introduce ipaddr_to() helper in libarpt_mangle.c to simplify arpmangle_print() a bit. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Consolidate DEBUGP macrosPhil Sutter2018-08-042-10/+2
| | | | | | | | | | | | | | | | | | This debug printing macro was defined in various places, always identical. Move it into xshared.h and drop it from sources including that header. There are a few exceptions: * iptables-xml.c did not include xshared.h, which this patch changes. * Sources in extensions and libiptc mostly left alone since they don't include xshared.h (and maybe shouldn't). Only libxt_set.h does, so it's converted, too. This also converts DEBUG define use in libip6t_hbh.c to avoid a compiler warning. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: don't bother to build libebt/libarp extensions if nft backend ↵Florian Westphal2018-07-101-2/+2
| | | | | | | | was disabled Reported-by: Thomas Deutschmann <whissi@gentoo.org> Tested-by: Thomas Deutschmann <whissi@gentoo.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: add stp matchFlorian Westphal2018-07-021-0/+391
| | | | | | Unfortunately no nft translation available so far. Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Fix spelling error in hashlimit sectionMajor Hayden2018-06-261-1/+1
| | | | | Signed-off-by: Major Hayden <major@mhtx.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: add arp match extensionFlorian Westphal2018-05-211-0/+490
| | | | | | no translation yet, might be doable with raw payload expressions though. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add redirect match extensionFlorian Westphal2018-05-211-0/+109
| | | | | | | | | | No translation. The kernel match will alter packet type (meta set pkttype), but also replace dst mac with the bridges' mac address, however nft currently doesn't allow to retrieve this at runtime. So just add this without the xlate part for now. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add nat match extensionsFlorian Westphal2018-05-214-0/+298
| | | | | | | | adds snat and dnat. Translation for snat isn't complete, the --snat-arp switch isn't supported so far. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: extend generic tests for masks and wildcardsFlorian Westphal2018-05-151-0/+15
| | | | | | This uncovered broken translation of ethernet + mask. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ip6table-save: fix save of ip6 address masksFlorian Westphal2018-05-111-0/+2
| | | | | | | | ip6tables-save didn't include the masks. Furhermore, mask decoding used the ipv4 struct which caused it to write into parts of ipv6 saddr. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-translate: suppress redundant protocolsFlorian Westphal2018-05-105-26/+26
| | | | | | | | | | | kernel would reject ip, ip6 etc. without -p ip, -p ip6. So add it. On reverse, search the match list to decide if -p has to be translated or not. Also, icmp and icmpv6 also imply l3 protocol, so no need to translate that either. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libip6t_srh.t: Add test cases for psid, nsid, and lsidAhmed Abdelsalam2018-05-091-0/+2
| | | | | | | | This patch add some testcases for psid, nsid, and lsid matches into libip6t_srh.t Signed-off-by: Ahmed Abdelsalam <amsalam20@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_CONNMARK: incorrect translation after v2Pablo Neira Ayuso2018-05-081-3/+3
| | | | | | | | | src: iptables-translate -t mangle -A PREROUTING -j CONNMARK --set-mark 0 exp: nft add rule ip mangle PREROUTING counter ct mark set 0x0 res: nft add rule ip mangle PREROUTING counter ct mark set ct mark and 0x0 Fixes: db7b4e0de960 ("extensions: libxt_CONNMARK: Support bit-shifting for --restore,set and save-mark") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_CONNMARK: Support bit-shifting for --restore,set and save-markJack Ma2018-05-081-13/+279
| | | | | | | | | | | | | | | This patch adds a new feature to iptables that allow bitshifting for --restore,set and save-mark operations. This allows existing logic operators (and, or and xor) and mask to co-operate with new bitshift operations. The intention is to provide uses with more fexible uses of skb->mark and ct->mark. For example, users can save extra bits in skb->mark: skb->mark = ct->mark << 8; Reviewed-by: Florian Westphal <fw@strlen.de> Signed-off-by: Jack Ma <jack.ma@alliedtelesis.co.nz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_srh: support matching previous, next and last SIDAhmed Abdelsalam2018-05-081-14/+273
| | | | | | | | This patch extends the libip6t_srh shared library to support matching previous SID, next SID, and last SID. Signed-off-by: Ahmed Abdelsalam <amsalam20@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_DNAT: tests added for shifted portmap rangeThierry Du Tre2018-05-082-0/+10
| | | | | | | | I added and verified these tests after applying Florian's fixed wrt. nf_nat_range2 size for rev2. Signed-off-by: Thierry Du Tre <thierry@dtsystems.be> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_DNAT: use size of nf_nat_range2 for rev2Florian Westphal2018-05-072-4/+4
| | | | | | | | DNAT tests fail on nf-next.git, kernel complains about target size mismatch (40 vs 48), this fixes this for me. Fixes: 36976c4b5406 ("extensions: libipt_DNAT: support shifted portmap ranges") Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: add xlate test for ipables -fFlorian Westphal2018-05-051-0/+6
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libipt_DNAT: support shifted portmap rangesThierry Du Tre2018-04-292-51/+408
| | | | | | | | | | | | | | | | | | | | | | | | | | This is a proposal patch for iptables DNAT extension to support shifted portmap ranges. It is related to the kernel patch proposed in earlier message '[PATCH v5] netfilter : add NAT support for shifted portmap ranges'. A new struct nf_nat_range2 was added as extension for existing struct nf_nat_range and is used by new revisions (2) for the DNAT target. Current DNAT revisions for Ipv4 (rev 0) and IPv6 (rev 1) are kept so functionality with older kernels is not impacted. The syntax for shifted portmaps uses an extra value in '--to-destination' for setting the base port which determines the offset in the redirect port range for incoming connections. i.e. : iptables -t nat -A zone_wan_prerouting -p tcp -m tcp --dport 5000:5100 -j DNAT --to-destination '192.168.1.2:2000-2100/5000' The base port value is totally optional, so current behavior is not impacted in any way. The use of slash '/' as separator is an arbitrary choice, all other suggestions are valid of course (original proposal used semicolon but this was not practical for commandline use) Another approach using an additional option seems also possible (i.e. '--base-port 5000'). However, that would mean more parsing logic with extra lines of code and thus increased risk for regression. Signed-off-by: Thierry Du Tre <thierry@dtsystems.be> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Introduce and use common function to print val[/mask] argumentsSerhey Popovych2018-04-274-64/+19
| | | | | | | | | | | | | | | | There are number of places where argument is in val[/mask] format printed in extensions and some of them may print corresponding symbolic name. By introducing common function for this task we eliminate custom code parts in extensions to perform printing of arguments in required formats. Use xtables_print_mark_mask() helper for extensions without symbolic name for val[/mask]. Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Introduce and use common function to parse val[/mask] argumentsSerhey Popovych2018-04-272-51/+13
| | | | | | | | | | | | | | There are a couple of places in both core and extensions where arguments in the form of val[/mask] is parsed (see XTTYPE_MARKMASK32). In some cases symbolic name might be used which is mapped in code to numeric value. Introduce common function to handle both cases where value given is either val[/mask] or symbolic name. Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Initialize linear mapping of symbols in _init() of extensionSerhey Popovych2018-04-272-21/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | libxt_devgroup and libipt_realm currently unable to display symbolic names in save/print commands because linear mapping is not initialized. It looks bit confusing as linear mapping initialization is done in init() of extension, which is expected to be called before any other function of extension. However init is called only when '-m' option specified on command line, that is true only for insert, append, replace and destroy iptables commands. Move initialization to extension _init() function before calling any function in extension. Before: ------- ... src-group 0x1 dst-group 0x2 ... src-group 0x2 dst-group 0x1 After: ------ ... src-group grp1 dst-group grp2 ... src-group grp2 dst-group grp1 Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: ULOG: remove testFlorian Westphal2018-04-271-19/+0
| | | | | | ULOG target was removed in 3.17, so this always fails now. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add 'vlan' match extensionFlorian Westphal2018-04-222-0/+237
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add 'pkttype' match extensionFlorian Westphal2018-04-222-0/+139
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add 'ip6' match extensionFlorian Westphal2018-04-192-0/+665
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* libebt_ip: fix translations for tos and icmpFlorian Westphal2018-04-192-7/+7
| | | | | | | tos translation to dscp yielded incorrect value. icmp inserted extra "ip" keyword, remove it. Signed-off-by: Florian Westphal <fw@strlen.de>
* libebt_ip: add icmp supportFlorian Westphal2018-04-192-2/+304
| | | | | | Was added to ebtables recently, so backport this to ebt-compat. Signed-off-by: Florian Westphal <fw@strlen.de>
* xt-translate: quote interface names in translated outputFlorian Westphal2018-04-199-29/+29
| | | | | | | it its good practice as interface names can be virtually any identifier and could clash with nft keywords. Signed-off-by: Florian Westphal <fw@strlen.de>
* icmp: split icmp type printing to header fileFlorian Westphal2018-04-193-58/+35
| | | | | | | | | | | libebt_ip will get icmp support soon, unify icmp name mapping a bit so we can re-use this code from libebt_ip.c. It doesn't seem to be too useful to move to libxtables (as its icmp specific), so add a hedaer file for this to reduce copy & paste needs. Signed-off-by: Florian Westphal <fw@strlen.de>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-01 07:26:43 +0000