summaryrefslogtreecommitdiffstats
path: root/extensions
Commit message (Collapse)AuthorAgeFilesLines
* extensions: libxt_conntrack: Drop extra whitespace in xlatePhil Sutter2022-11-293-4/+3
| | | | | | | | No point in having this. Interestingly, other test cases even made up for it. Fixes: 0afd957f6bc03 ("extensions: libxt_state: add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Leverage xlate auto-spacingPhil Sutter2022-11-299-79/+42
| | | | | | Drop code which is used explicitly to deal with spacing. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xt_xlate_add() to take care of spacingPhil Sutter2022-11-296-12/+11
| | | | | | | | | | | | | | | | | | Try to eliminate most of the whitespace issues by separating strings from separate xt_xlate_add() calls by whitespace if needed. Cover the common case of consecutive range, list or MAC/IP address printing by inserting whitespace only if the string to be appended starts with an alphanumeric character or a brace. The latter helps to make spacing in anonymous sets consistent. Provide *_nospc() variants which disable the auto-spacing for the mandatory exception to the rule. Make things round by dropping any trailing whitespace before returning the buffer via xt_xlate_get(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ipcomp: Add comment to clarify xlate callbackPhil Sutter2022-11-242-3/+2
| | | | | | | | | | Kernel ignores 'hdrres' field, this matching on reserved field value was never effective. While being at it, drop its description from man page. Continue to parse and print it for compatibility reasons, but avoid attracting new users. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: frag: Add comment to clarify xlate callbackPhil Sutter2022-11-241-0/+2
| | | | | | | Matching on fragmentation header length is ineffective in kernel, xlate callback correctly ignores it. Add a comment as a hint for reviewers. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_log: Add comment to clarify xlate callbackPhil Sutter2022-11-241-0/+2
| | | | | | | Several log flags are ignored by the function. Add a comment explaining why this is correct. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: tcp: Translate TCP option matchPhil Sutter2022-11-242-3/+12
| | | | | | A simple task since 'tcp option' expression exists. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ecn: Sanitize xlate callbackPhil Sutter2022-11-241-0/+2
| | | | | | | Catch unexpected values in einfo->ip_ect. Fixes: ca42442093d3d ("iptables: extensions: libxt_ecn: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: TOS: Fix v1 xlate callbackPhil Sutter2022-11-242-13/+29
| | | | | | | Translation entirely ignored tos_mask field. Fixes: b669e18489709 ("extensions: libxt_TOS: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: TCPMSS: Use xlate callback for IPv6, tooPhil Sutter2022-11-241-0/+1
| | | | | | | Data structures are identical and the translation is layer3-agnostic. Fixes: bebce197adb42 ("iptables: iptables-compat translation for TCPMSS") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: MARK: Sanitize MARK_xlate()Phil Sutter2022-11-241-0/+2
| | | | | | | | Since markinfo->mode might contain unexpected values, add a default case returning zero. Fixes: afefc7a134ca0 ("extensions: libxt_MARK: Add translation for revision 1 to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: CONNMARK: Fix xlate callbackPhil Sutter2022-11-242-5/+13
| | | | | | | | | | | | | Bail out if nfmask != ctmask with XT_CONNMARK_SAVE and XT_CONNMARK_RESTORE. Looks like this needs a similar implementation to the one for XT_CONNMARK_SET. Fix shift mark translation: xt_connmark_shift_ops does not contain useful strings for nftables. Also add needed braces around the term being shifted. Fixes: db7b4e0de960c ("extensions: libxt_CONNMARK: Support bit-shifting for --restore,set and save-mark") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libipt_ttl: Sanitize xlate callbackPhil Sutter2022-11-241-2/+2
| | | | | | | Catch unexpected values in info->mode, also fix indenting. Fixes: 1b320a1a1dc1f ("extensions: libipt_ttl: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_redirect: Fix xlate return codePhil Sutter2022-11-241-1/+1
| | | | | | | The callback is supposed to return 1 on success, not 0. Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_mark: Fix xlate test casePhil Sutter2022-11-242-11/+11
| | | | | | | | | | The false suffix effectively disabled this test file, but it also has problems: Apart from brmark_xlate() printing 'meta mark' instead of just 'mark', target is printed in the wrong position (like with any other target-possessing extension. Fixes: e67c08880961f ("ebtables-translate: add initial test cases") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_mark: Fix mark target xlatePhil Sutter2022-11-241-1/+1
| | | | | | | | Target value is constructed setting all non-target bits to one instead of zero. Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: mark: Test double bitwise in a rulePhil Sutter2022-11-161-0/+1
| | | | | | | In v1.8.8, the second bitwise changed the first one, messing iptables-nft-save output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Drop extra newline from xtables_error() callsPhil Sutter2022-11-1512-61/+49
| | | | | | | | | | Since basic_exit_err() appends a newline to the message itself, drop explicit ones. While being at it, fix indentation and join texts split over multiple lines. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Unify ICMP parser into libxt_icmp.hPhil Sutter2022-11-155-260/+131
| | | | | | Merge all four copies of the ICMP/ICMPv6/IGMP parameter parsing code. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Collate ICMP types/codes in libxt_icmp.hPhil Sutter2022-11-155-206/+107
| | | | | | | | Put the most extensive version of icmp_codes, icmpv6_codes and igmp_codes into the header. Have to rename the function xt_print_icmp_types's parameter to avoid a compiler warning. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_arp, libebt_ip: Use xtables_ipparse_any()Phil Sutter2022-11-153-157/+21
| | | | | | | The libxtables function covers all formerly supported inputs (and more). The extended libebt_arp.t passes before and after this patch. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_ip: Include kernel headerPhil Sutter2022-11-151-31/+1
| | | | | | | Update the local copy of linux/netfilter_bridge/ebt_ip.h and include it instead of keeping the local copy of struct ebt_ip_info et al. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libip*t_LOG: Merge extensionsPhil Sutter2022-11-152-350/+58
| | | | | | | | | | | Data structures were identical already, make use of the names in xt_LOG.h and merge all code into a single extension of family NFPROTO_UNSPEC. While being at it, define SYSLOG_NAMES and use the array in syslog.h instead of dragging along an own level->name mapping two times. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADEPhil Sutter2022-11-1110-954/+163
| | | | | | | | | REDIRECT was already merged into DNAT. Given the callback generator and generalized inner parsing routines, merging the other "flavors" is relatively simple. Rename the extension into "libxt_NAT.so" while doing so and turn the old DSOs into symlinks. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: DNAT: Rename some symbolsPhil Sutter2022-11-111-14/+14
| | | | | | | No functional change intended, just a more generic name for some symbols which won't be DNAT-specific soon. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: DNAT: Generate print, save and xlate callbacksPhil Sutter2022-11-111-180/+86
| | | | | | | | | | | Each extension's callbacks follow the same scheme so introduce a generator which accepts the specifics as parameter - including the method to transform from per-extension data into struct nf_nat_range2. Also move the different parser frontends and fcheck callbacks in one spot for clarity. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: DNAT: Use __DNAT_xlate for REDIRECT, tooPhil Sutter2022-11-111-22/+11
| | | | | | | Make the common function a bit more versatile and give it a more generic name, then use it for REDIRECT target, too. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: *NAT: Drop NF_NAT_RANGE_PROTO_RANDOM* flag checksPhil Sutter2022-11-115-49/+19
| | | | | | | | | | | | | | | SNAT, DNAT and REDIRECT extensions tried to prevent NF_NAT_RANGE_PROTO_RANDOM flag from being set if no port or address was also given. With SNAT and DNAT, this is not possible as the respective --to-destination or --to-source parameters are mandatory anyway. Looking at the kernel code, doing so with REDIRECT seems harmless. Moreover, nftables supports 'redirect random' without specifying a port-range. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: DNAT: Fix bad IP address error reportingPhil Sutter2022-11-111-1/+1
| | | | | | | | When introducing 'start' variable to cover for IPv6 addresses enclosed in brackets, this single spot was missed. Fixes: 14d77c8aa29a7 ("extensions: Merge IPv4 and IPv6 DNAT targets") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: *.t: Add missing all-one's netmasks to expected outputPhil Sutter2022-10-264-8/+8
| | | | Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libxt_connlimit.t: Add missing default valuesPhil Sutter2022-10-261-6/+6
| | | | | | | This extension always prints --connlimit-mask and (the default) --connlimit-saddr options. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libebt_vlan.t: Drop trailing whitespace from rulesPhil Sutter2022-10-261-2/+2
| | | | | | | | Fast iptables-test.py mode is picky and it has to: Plain redirect target prints a trailing whitespace, generally stripping the rules in test cases won't work therefore. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libxt_tos.t, libxt_TOS.t: Add missing masks in outputPhil Sutter2022-10-262-10/+10
| | | | | | | Mask differs between numeric --set-tos values and symbolic ones, make sure it is covered by the tests. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libxt_recent.t: Add missing default valuesPhil Sutter2022-10-261-2/+2
| | | | Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libxt_length.t: Fix odd use-case outputPhil Sutter2022-10-261-1/+1
| | | | | | | Specifying the lower boundary suffixed by colon is an undocumented feature. Explicitly printing the upper boundary in that case seems sane. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libebt_redirect.t: Plain redirect prints with trailing whitespacePhil Sutter2022-10-261-1/+1
| | | | Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: *.t: Fix for hexadecimal outputPhil Sutter2022-10-265-6/+6
| | | | | | | Use hex input to avoid having to specify an expected output in trivial cases. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: *.t: Fix expected output for simple callsPhil Sutter2022-10-265-5/+5
| | | | | | | These minimal extension uses print in more detailed form. Track this, the output is desired. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: NFQUEUE: Document queue-balance limitationPhil Sutter2022-10-263-4/+5
| | | | | | | | | | | The range is not communicated as "min and max queue number", but "first queue number and count" instead. With 16bits for each value, it is not possible to balance between all 65536 possible queues. Although probably never used in practice, point this detail out in man page and make the parser complain instead of the cryptic "xt_NFQUEUE: number of total queues is 0" emitted by the kernel module. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libebt_stp.t: Drop duplicate whitespacePhil Sutter2022-10-061-1/+1
| | | | | | Code was fixed but the testcase adjustment slipped through. Fixes: 262dff31a998e ("extensions: libebt_stp: Eliminate duplicate space in output")
* tests: IDLETIMER.t: Fix syntax, support for restore inputPhil Sutter2022-10-051-1/+1
| | | | | | | | | Expected output was wrong in the last OK test, probably defeating rule search check. Also use a different label, otherwise the kernel will reject the second idletimer with same label but different type if both rules are added at once. Fixes: 85b9ec8615428 ("extensions: IDLETIMER: Add alarm timer option")
* extensions: libebt_log: Avoid empty log-prefix in outputPhil Sutter2022-10-052-5/+6
| | | | | Just like iptables LOG target, omit --log-prefix from output if the string is empty.
* extensions: TCPOPTSTRIP: Do not print empty optionsPhil Sutter2022-10-021-0/+13
| | | | | | | No point in printing anything if none of the bits are set. Fixes: aef4c1e727563 ("libxt_TCPOPTSTRIP") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libip6t_dst: Fix output for empty optionsPhil Sutter2022-10-021-3/+3
| | | | | | | | If no --dst-opts were given, print_options() would print just a whitespace. Fixes: 73866357e4a7a ("iptables: do not print trailing whitespaces") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_stp: Eliminate duplicate space in outputPhil Sutter2022-10-021-2/+2
| | | | | | | | No need for print_range() to print a trailing whitespace, caller does this already. Fixes: fd8d7d7e5d911 ("ebtables-nft: add stp match") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: among: Fix for use with ebtables-restorePhil Sutter2022-10-011-8/+6
| | | | | | | | | | When restoring multiple rules which use among match, new size may be smaller than the old one which caused invalid writes by the memcpy() call. Expect this and realloc the match only if it needs to grow. Also use realloc instead of freeing and allocating from scratch. Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: among: Remove pointless fall throughPhil Sutter2022-10-011-3/+2
| | | | | | | | | This seems to be a leftover from an earlier version of the switch(). This fall through is never effective as the next case's code will never apply. So just break instead. Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Support '-p Length'Phil Sutter2022-09-282-2/+10
| | | | | | | | | | | | | | | | | | To match on Ethernet frames using the etherproto field as length value, ebtables accepts the special protocol name "LENGTH". Implement this in ebtables-nft using a native match for 'ether type < 0x0600'. Since extension 802_3 matches are valid only with such Ethernet frames, add a local add_match() wrapper which complains if the extension is used without '-p Length' parameter. Legacy ebtables does this within the extension's final_check callback, but it's not possible here due for lack of fw->bitmask field access. While being at it, add xlate support, adjust tests and make ebtables-nft print the case-insensitive argument with capital 'L' like legacy ebtables does. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libxt_pkttype: support otherhostFlorian Westphal2022-09-081-1/+1
| | | | | | | | | | Makes no sense for iptables/ip6tables but it does make sense for ebtables. Classic ebtables uses libebt_pkttype which isn't compatible, but iptables-nft can use the libxt_pkttype version when printing native 'meta pkttype'. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* extensions: libxt_conntrack: remove always-false conditionalsFlorian Westphal2022-07-231-12/+0
| | | | | | | libxt_conntrack.c:1292: warning: the comparison will always evaluate as false for the address of origsrc_addr will never be NULL [-Waddress] Signed-off-by: Florian Westphal <fw@strlen.de>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 16:21:09 +0000