summaryrefslogtreecommitdiffstats
path: root/extensions
Commit message (Collapse)AuthorAgeFilesLines
* ebtables: fix over-eager -o checks on custom chainsFlorian Westphal2019-09-121-0/+17
| | | | | | | | | | | | | | | | Arturo reports ebtables-nft reports an error when -o is used in custom chains: -A MYCHAIN -o someif makes ebtables-nft exit with an error: "Use -o only in OUTPUT, FORWARD and POSTROUTING chains." Problem is that all the "-o" checks expect <= NF_BR_POST_ROUTING to mean "builtin", so -1 mistakenly leads to the checks being active. Reported-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1347 Signed-off-by: Florian Westphal <fw@strlen.de>
* netfilter: hashlimit: prefer PRIu64 to avoid warnings on 32bit platformsDuncan Roe2019-09-121-1/+1
| | | | | | | I found this patch attached to an older BZ, apply this finally... Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1107 Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Note REDIRECT case of no IP addressJoseph C. Sible2019-08-211-1/+2
| | | | | | | | | | If an IP packet comes in on an interface that lacks a corresponding IP address (which happens on, e.g., the veth's that Project Calico creates), attempting to use REDIRECT on it will cause it to be dropped. Take note of this in REDIRECT's documentation. Signed-off-by: Joseph C. Sible <josephcsible@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: nfacct: Fix alignment mismatch in xt_nfacct_match_infoJuliana Rodrigueiro2019-08-201-12/+28
| | | | | | | | | | | | | | | | When running a 64-bit kernel with a 32-bit iptables binary, the size of the xt_nfacct_match_info struct diverges. kernel: sizeof(struct xt_nfacct_match_info) : 40 iptables: sizeof(struct xt_nfacct_match_info)) : 36 This patch is the userspace fix of the memory misalignment. It introduces a v1 ABI with the correct alignment and stays compatible with unfixed revision 0 kernels. Signed-off-by: Juliana Rodrigueiro <juliana.rodrigueiro@intra2net.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions/libxt_MASQUERADE.man: random and random-fully are now identicalFlorian Westphal2019-07-111-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libxt_owner: Add supplementary groups optionLukasz Pawelczyk2019-06-193-7/+25
| | | | | | | | The --suppl-groups option causes GIDs specified with --gid-owner to be also checked in the supplementary groups of a process. Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@samsung.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: SYNPROXY: should not be needed anymore on current kernelsFlorian Westphal2019-05-081-0/+2
| | | | | | | SYN packets do not require taking the listener socket lock anymore as of 4.4 kernel, i.e. this target should not be needed anymore. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libxt_osf.: Typo in manpageSam Banks2019-04-051-1/+1
| | | | | Signed-off-by: Sam Banks <sam.banks.nz@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: Install symlinks as suchPhil Sutter2019-04-031-4/+11
| | | | | | | | | | | | Fake shared objects which are actually symlinks to others are installed using 'install' tool which follows them and therefore installs a copy of the file they point at. Fix this by introducing special handling for them in install target. Reported-by: Wenle Chen <solachenclever@hotmail.com> Fixes: 269655d54e22f ("build: remove symlink-only extensions from static object list") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: connlabel: Fallback on missing connlabel.confPhil Sutter2019-03-083-32/+48
| | | | | | | | | | | | If connlabel.conf was not found, fall back to manually parsing arguments as plain numbers. If nfct_labelmap_new() has failed, nfct_labelmap_get_name() segfaults. Therefore make sure it is not called in connlabel_get_name() if that's the case. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Add testcase for libxt_ipvsPhil Sutter2019-02-221-0/+20
| | | | | | | Given that it is fixed now, make it stay. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Fix ipvs vproto option printingPhil Sutter2019-02-221-1/+1
| | | | | | | | | This was broken since day 1: vproto option was printed as 'proto' which in turn iptables wouldn't accept anymore. Fixes: c36d05e424069 ("libxt_ipvs: user-space lib for netfilter matcher xt_ipvs") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Fix ipvs vproto parsingPhil Sutter2019-02-221-4/+1
| | | | | | | | | | | | | | This was broken by integration into guided option parser: * Make 'vproto' option XTTYPE_PROTOCOL, otherwise its arguments are parsed as garbage only. * Drop O_VPROTO case from ipvs_mt_parse(), due to XTOPT_POINTER() and above change there is nothing to do for it in there. Fixes: 372203af4c70f ("libxt_ipvs: use guided option parser") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: AUDIT: Document ineffective --type optionPhil Sutter2019-02-221-2/+4
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Revert "ebtables: use extrapositioned negation consistently"Phil Sutter2019-02-0516-67/+59
| | | | | | | | | | | | | | | | | | | | | | | This reverts commit 5f508b76a0cebaf91965ffa678089222e2d47964. While attempts at unifying syntax between arp-, eb- and iptables-nft increase the opportunity for more code-sharing, they are problematic when it comes to compatibility. Accepting the old syntax on input helps, but due to the fact that neither arptables nor ebtables support --check command we must expect for users to test existence of a rule by comparing input with output. If that happens in a script, deviating from the old syntax in output has a high chance of breaking it. Therefore revert Florian's patch changing inversion character position in output and review the old code for consistency - the only thing changed on top of the actual revert is ebtables' own copy of print_iface() to make it adhere to the intrapositioned negation scheme used throughout ebtables. Added extension tests by the reverted commit have been kept. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Fix arptables extension testsPhil Sutter2019-02-014-10/+10
| | | | | | | | | | | With changes to arptables-nft output, many of these tests fail because rules are not printed as expected anymore. Since most of the tests with explicitly defined output did so just because of added --h-length and --h-type options, adjust input a little more (typically reordering of arguments) to make output match input. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Fix CLASSIFY target printingPhil Sutter2019-01-311-13/+46
| | | | | | | | | In legacy arptables, CLASSIFY target is not printed with fixed hex number lengths. Counter this by introducing a dedicated target definition for NFPROTO_ARP only having own print/save callbacks. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Fix MARK target parsing and printingPhil Sutter2019-01-311-0/+95
| | | | | | | | | | | | | Legacy arptables parses mark values in hex no matter if prefixed with '0x' or not. Sadly, this is not easily achievable with guided option parser. Hence fall back to the old 'parse' callback. The introduced target definition is valid only for revision 2, but that's consistent with legacy arptables. When printing, use --set-mark option instead of --set-xmark. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: TRACE: Point at xtables-monitor in documentationPhil Sutter2018-12-181-7/+14
| | | | | | | | With iptables-nft, logging of trace events is different from legacy. Explain why and hint at how to receive events in this case. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libipt_realm: Document allowed realm valuesPhil Sutter2018-12-031-0/+2
| | | | | | | | | Older versions of iptables allowed for negative realm values by accident (they would be cast to unsigned). While this was clearly a bug, document the fixed behaviour. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Don't use native nftables commentsPhil Sutter2018-11-271-0/+2
| | | | | | | | | | | | | | | The problem with converting libxt_comment into nftables comment is that rules change when parsing from kernel due to comment match being moved to the end of the match list. And since match ordering matters, the rule may not be found anymore when checking or deleting. Apart from that, iptables-nft didn't support multiple comments per rule anymore. This is a compatibility issue without technical reason. Leave conversion from nftables comment to libxt_comment in place so we don't break running systems during an update. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_mh: fix bogus translation errorPablo Neira Ayuso2018-11-191-2/+2
| | | | | | | | | libip6t_mh.txlate: Fail src: ip6tables-translate -A INPUT -p mh --mh-type 1 -j ACCEPT exp: nft add rule ip6 filter INPUT meta l4proto 135 mh type 1 counter accept res: nft add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter accept Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-nft: use generic expression parsing functionFlorian Westphal2018-11-181-2/+2
| | | | | | | | | | | | | | | | | since commit d9c6a5d0977a6d8bbe772dbc31a2c4f58eec1708 ("xtables: merge {ip,arp}tables_command_state structs") arptables uses the shared representation. With only minor changes (e.g., use generic counters in command_state), in print/save functions we can use the shared nftnl expression parser too. arptables-legacy prints (-L) the jump target first, i.e.: -j MARK -d 0.0.0.0/8 --h-length 6 ... ... so keep that here too. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: format-security fixes in libip[6]t_icmpAdam Gołębiowski2018-11-142-3/+3
| | | | | | | | | | | commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add") introduced support for gcc feature to check format string against passed argument. This commit adds missing bits to extenstions's libipt_icmp.c and libip6t_icmp6.c that were causing build to fail. Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add") Signed-off-by: Adam Gołębiowski <adamg@pld-linux.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: vlan: fix userspace/kernel headers collisionBaruch Siach2018-11-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | Build with musl libc fails because of conflicting struct ethhdr definitions: In file included from .../sysroot/usr/include/net/ethernet.h:10:0, from ../iptables/nft-bridge.h:8, from libebt_vlan.c:18: .../sysroot/usr/include/netinet/if_ether.h:107:8: error: redefinition of ‘struct ethhdr’ struct ethhdr { ^~~~~~ In file included from libebt_vlan.c:16:0: .../sysroot/usr/include/linux/if_ether.h:160:8: note: originally defined here struct ethhdr { ^~~~~~ Include the userspace header first for the definition suppression logic to do the right thing. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add 'printf' attribute to xlate_addFlorian Westphal2018-11-124-13/+13
| | | | | | | | | | | | | | This allows gcc to check format string vs. passed arguments. Fix the fallout from this as well, typical warning produced is: libebt_mark_m.c:112:28: warning: format '%x' expects argument of type 'unsigned int', but argument 3 has type 'long unsigned int' [-Wformat=] xt_xlate_add(xl, "and 0x%x %s0 ", info->mask, ... ~^ ~~~~~~~~~~ so add the required casts or fixup format strings as needed. libxt_conntrack also passed an unneeded argument (port), so remove that. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: add test casesFlorian Westphal2018-11-124-0/+27
| | | | | | | | | | | | | | | | Unicast being shown as '00:00:00:00:00:00/01:00:00:00:00:00' looks like broken output, however, arptables classic did not pretty-print either. Also add test cases for all targets supported by the original arptables tool: -j CLASSIFY -j MARK -j mangle [ yes, mangle target is lower-case 8-( ] Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: use ->save for arptables-save, like xtablesFlorian Westphal2018-11-122-34/+19
| | | | | | | | | | | | | arptables-save will show -A OUTPUT --h-length 6 --h-type 1 -j MARK --set-xmark 0x1/0xffffffff as --h-length 6 --h-type Ethernet -j MARK MARK set 0x1 Because it uses ->print() instead of ->save(). Switch it to use ->save, we can then also drop special handling of CLASSIFY target. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: test protocol and interface negationFlorian Westphal2018-11-122-0/+5
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: use extrapositioned negation consistentlyFlorian Westphal2018-11-1216-49/+79
| | | | | | | | | | | | | | in the iptables universe, we enforce extrapositioned negation: ! -i foo "-i ! foo" is not even supported anymore. At least make sure that ebtables prints the former syntax everywhere as well so we don't have a mix of both ways. Parsing of --option ! 42 will still work for backwards compat reasons. Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: add and use mac print helpersFlorian Westphal2018-11-0711-74/+21
| | | | | | | | | | | | This changes ebtables-nft to consistently print mac address with two characters, i.e. 00:01:02:03:04:0a, not 0:1:2:3:4:a. Will require another bump of vcurrent/vage. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libebt_ip: fix tos negationFlorian Westphal2018-11-052-3/+7
| | | | | | | | passing ->tos as uintmax_t will clear adjacent fields in the structure, including invflags. Fixes: 49479aa12a15 ("ebtables-compat: add 'ip' match extension") Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libebt_ip6: fix ip6-dport negationFlorian Westphal2018-11-052-1/+2
| | | | | Fixes: 5c8ce9c6aede0 ("ebtables-compat: add 'ip6' match extension") Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-tests: add % to run iptables commandsPablo Neira Ayuso2018-11-031-4/+4
| | | | | | | Lines starting by % allows you to run iptables commands, use it for rateest test. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-nft: add arpreply targetFlorian Westphal2018-11-032-0/+110
| | | | | | Unfortunately no nft translation available so far. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: add redirect test caseFlorian Westphal2018-11-032-1/+5
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: add test casesFlorian Westphal2018-11-0311-0/+89
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: relax -t table restriction, add snat/dnat test casesFlorian Westphal2018-11-032-0/+9
| | | | | | | | | | | | | | Its artificial and prevents test cases that need to add rules to a different table from working. The test script generates: -A PREROUTING -t nat ... which works fine for iptables and ip6tables. Just accept it for ebtables too and add test cases for snat and dnat. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: fix -j CONTINUE handling for add/deleteFlorian Westphal2018-11-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -j CONTINUE can be added, but it can't be removed: extensions/libebt_standard.t: ERROR: line 5 (cannot find: ebtables -I INPUT -d de:ad:be:ef:00:00 -j CONTINUE) This problem stems from silly ambiguity in ebtables-nft vs. iptables. In iptables, you can do iptables -A INPUT (no -j) in ebtables, you can do either ebtables -A INPUT or ebtables -A INPUT -j CONTINUE both are *supposed* to be the same (and they do the same even in ebtables-nft on netlink side). However, the temprary binary representation within ebtables-nft is not the same: when parsing -j CONTINUE, we add a standard target, then omit it later in _add_target(). When translating netlink representation to ebt binary one, we do not add a standard target and instead just print '-j CONTINUE' when listing rules. So when doing -I INPUT -j CONTINUE -D INPUT -j CONTINUE the -D operation fails because it has a standard target in the binary representation, whereas the rule we obtained from translating nftables netlink back to ebtables' binary represenation doesn't. Fix it by ignoring 'CONTINUE' on parser side. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add basic ebtables test supportFlorian Westphal2018-11-031-0/+6
| | | | | | | now that we have ebtables-save, lets add test cases for ebtables-nft as well. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-nft: fix bogus handling of zero saddr/daddrFlorian Westphal2018-11-032-0/+9
| | | | | | | | | | | | | rule for 0.0.0.0/8 is added as 0.0.0.0/0, because we did not check mask (or negation, for that matter). Fix this and add test cases too. This also revealed an ip6tables-nft-save bug, it would print ' !-d', not '! -d'. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1287 Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for matching rules with wildcard interfacesPhil Sutter2018-11-011-0/+4
| | | | | | | | | | | | | | Due to xtables_parse_interface() and parse_ifname() being misaligned regarding interface mask setting, rules containing a wildcard interface added with iptables-nft could neither be checked nor deleted. As suggested, introduce extensions/iptables.t to hold checks for built-in selectors. This file is picked up by iptables-test.py as-is. The only limitation is that iptables is being used for it, so no ip6tables-specific things can be tested with it (for now). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: limit: unbreak build without libnftnlFlorian Westphal2018-10-241-1/+0
| | | | | | | | | | Lars Wendler reported 1.8.1 build failure when trying to build without nft backend: In file included from ../iptables/nft.h:5, from libxt_limit.c:18: libnftnl/rule.h: No such file or directory Reported-by: Lars Wendler <polynomial-c@gentoo.org> Fixes: 02b80972c43 ("ebtables: Merge libebt_limit.c into libxt_limit.c") Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: expose new etherdb lookup function through libxtables APIPablo Neira Ayuso2018-10-202-3/+2
| | | | | | | | | | This is used from extensions and included in libxtables, so we have to make them public. Fixes: 31f1434dfe37 ("libxtables: Integrate getethertype.c from xtables core") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc>
* libxtables: prefix exported new functions for etherdb lookupsPablo Neira Ayuso2018-10-202-5/+5
| | | | | | | | | | To avoid symbol pollution, place them under the xt_ and xtables_ prefix name. Fixes: 31f1434dfe37 ("libxtables: Integrate getethertype.c from xtables core") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc>
* Revert "extensions: libxt_quota: Allow setting the remaining quota"Pablo Neira Ayuso2018-10-191-23/+2
| | | | | | | This reverts commit 0a8f2bcadff157489a737f8cc8846adcb750b91f. Google folks are reporting some issues with 32-bits arch, let's revert this until we have a new version for this.
* extensions: cgroup: fix option parsing for v2Pablo Neira Ayuso2018-10-091-1/+19
| | | | | | | | Structure layout is different, therefore a new struct xt_option_entry is needed. Fixes: f9efc8cb79c0 ("extensions: add cgroup revision 2") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_quota: Allow setting the remaining quotaChenbo Feng2018-10-091-2/+23
| | | | | | | | | | | | | | | | The current xt_quota module cannot track the current remaining quota of a specific rule. Everytime an unrelated rule is updated in the same iptables table, the quota will be reset. This is not a very useful function for iptables that get changed at run time. This patch fixes the above problem by adding a new field in the struct that records the current remaining quota. Fixed a print out bug in verbose print out wrt. inversion. Signed-off-by: Chenbo Feng <fengc@google.com> Suggested-by: Maciej Żenczykowski <maze@google.com> Reviewed-by: Maciej Żenczykowski <maze@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libebt_ip{, 6}: Drop pointless error checkingPhil Sutter2018-09-242-8/+0
| | | | | | | | | Since info->protocol is of type __u8, its value will never become -1. Apart from that, xtables_parse_protocol() calls xt_params->exit_err() in case of error, so this code is dead anyway. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxt_time: Drop initialization of variable 'year'Phil Sutter2018-09-241-4/+4
| | | | | | | | | The variable is not read before being assigned the return value of strtoul(), thefore the initialization is useless. And since after this change parameter 'end' becomes unused, drop it as well. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-14 17:35:38 +0000