summaryrefslogtreecommitdiffstats
path: root/extensions
Commit message (Collapse)AuthorAgeFilesLines
* build: Fix for failing 'make uninstall'Phil Sutter2020-06-091-1/+14
| | | | | | | | | | | | | | | | | | | | | Support for uninstalling is severely broken: - extensions/GNUmakefile.in defines an 'install' target but lacks a respective 'uninstall' one, causing 'make uninstall' abort with an error message. - iptables/Makefile.am defines an 'install-exec-hook' to create the binary symlinks which are left in place after 'make uninstall'. Fix these problems by defining respective targets containing code copied from automake-generated uninstall targets. While being at it, add a few more uninstall-hooks removing custom directories created by 'make install' if they are empty afterwards. Reported-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Tested-by: Richard Guy Briggs <rgb@redhat.com>
* doc: document danger of applying REJECT to INVALID CTsJan Engelhardt2020-06-082-0/+40
| | | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: libxt_MARK: OUTPUT chain is fine, tooPhil Sutter2020-05-271-2/+2
| | | | | | | | | In order to route packets originating from the host itself based on fwmark, mangle table's OUTPUT chain must be used. Mention this chain as alternative to PREROUTING. Fixes: c9be7f153f7bf ("doc: libxt_MARK: no longer restricted to mangle table") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libip6t_srh.t: switch to lowercase, add /128 suffix, require successMaciej Żenczykowski2020-05-141-2/+2
| | | | | | | | | | | | | | | | | | | | | | This looks like an oversight which is easy to fix. Furthermore: git grep ';;OK' does not find any other matches, so this is the last unverified test case. Test: [root@f32vm IPT]# uname -r 5.6.10-300.fc32.x86_64 [root@f32vm IPT]# md5sum extensions/libip6t_srh.t b98864bdd6c39a0dd96022c47e652edb extensions/libip6t_srh.t [root@f32vm IPT]# ./iptables-test.py extensions/libip6t_srh.t extensions/libip6t_srh.t: OK 1 test files, 27 unit tests, 27 passed Signed-off-by: Maciej Żenczykowski <maze@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-test: Don't choke on empty linesPhil Sutter2020-05-111-1/+0
| | | | | | | | | | | | | | | | | | | | The script code wasn't expecting empty lines: | Traceback (most recent call last): | File "./iptables-test.py", line 380, in <module> | main() | File "./iptables-test.py", line 370, in main | file_tests, file_passed = run_test_file(filename, args.netns) | File "./iptables-test.py", line 265, in run_test_file | if item[1] == "=": | IndexError: list index out of range Fix this by ignoring empty lines or those consisting of whitespace only. While being at it, remove the empty line from libxt_IDLETIMER.t which exposed the problem. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxt_IDLETIMER: fix target v1 help alignment and docMaciej Żenczykowski2020-04-281-1/+1
| | | | | Signed-off-by: Maciej Żenczykowski <maze@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: include strings.h for the definition of ffs()Maciej Żenczykowski2020-04-282-0/+2
| | | | | | | | | | | | | | | | | | This resolves clang compiler warnings: extensions/libext4_srcs/gen/gensrcs/external/iptables/extensions/libipt_ULOG.c:89:32: error: implicit declaration of function 'ffs' is invalid in C99 [-Werror,-Wimplicit-function-declaration] printf(" --ulog-nlgroup %d", ffs(loginfo->nl_group)); ^ extensions/libext4_srcs/gen/gensrcs/external/iptables/extensions/libipt_ULOG.c:105:9: error: implicit declaration of function 'ffs' is invalid in C99 [-Werror,-Wimplicit-function-declaration] ffs(loginfo->nl_group)); ^ extensions/libext_srcs/gen/gensrcs/external/iptables/extensions/libxt_addrtype.c:263:14: error: implicit declaration of function 'ffs' is invalid in C99 [-Werror,-Wimplicit-function-declaration] int first = ffs(val); ^ Test: builds with less warnings Signed-off-by: Maciej Żenczykowski <maze@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: IDLETIMER: Add alarm timer optionManoj Basapathi2020-04-162-13/+88
| | | | | | | | | | | | | | Introduce "--alarm" option for idletimer rule. If it is present, hardidle-timer is used, else default timer. The default idletimer starts a deferrable timer or in other words the timer will cease to run when cpu is in suspended state. This change introduces the option to start a non-deferrable or alarm timer which will continue to run even when the cpu is in suspended state. Signed-off-by: Manoj Basapathi <manojbm@codeaurora.org> Signed-off-by: Sauvik Saha <ssaha@codeaurora.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-shared: skip check for jumpto if cs->target is unsetPablo Neira Ayuso2020-04-151-2/+1
| | | | | | | | | The command_jump() function leaves cs->target unset if the target is not found. Let's check if the jumpto string mismatches only in this case. https://bugzilla.netfilter.org/show_bug.cgi?id=1422 Tested-by: Etienne Champetier <etienne.champetier@anevia.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_CT: add translation for NOTRACKPablo Neira Ayuso2020-04-152-0/+18
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: open eBPF programs in read only modeMaciej Żenczykowski2020-04-151-7/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adjust the mode eBPF programs are opened in so 0400 pinned bpf programs work without requiring CAP_DAC_OVERRIDE. This matches Linux 5.2's: commit e547ff3f803e779a3898f1f48447b29f43c54085 Author: Chenbo Feng <fengc@google.com> Date: Tue May 14 19:42:57 2019 -0700 bpf: relax inode permission check for retrieving bpf program For iptable module to load a bpf program from a pinned location, it only retrieve a loaded program and cannot change the program content so requiring a write permission for it might not be necessary. Also when adding or removing an unrelated iptable rule, it might need to flush and reload the xt_bpf related rules as well and triggers the inode permission check. It might be better to remove the write premission check for the inode so we won't need to grant write access to all the processes that flush and restore iptables rules. kernel/bpf/inode.c: - int ret = inode_permission(inode, MAY_READ | MAY_WRITE); + int ret = inode_permission(inode, MAY_READ); In practice, AFAICT, the xt_bpf match .fd field isn't even used by new kernels, but I believe it might be needed for compatibility with old ones (though I'm pretty sure table modifications on them will outright fail). Test: builds, passes Android test suite (albeit on an older iptables base), git grep bpf_obj_get - finds no other users Cc: Chenbo Feng <fengc@google.com> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Willem de Bruijn <willemb@google.com> Signed-off-by: Maciej Żenczykowski <maze@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* connlabel: Allow numeric labels even if connlabel.conf existsPhil Sutter2020-03-061-5/+2
| | | | | | | | | | | | | | | | | | Existing code is a bit quirky: If no connlabel.conf was found, the local function connlabel_value_parse() is called which tries to interpret given label as a number. If the config exists though, nfct_labelmap_get_bit() is called instead which doesn't care about "undefined" connlabel names. So unless installed connlabel.conf contains entries for all possible numeric labels, rules added by users may stop working if a connlabel.conf is created. Related man page snippet states: "Using a number always overrides connlabel.conf", so try numeric parsing and fall back to nfct only if that failed. Fixes: 51340f7b6a110 ("extensions: libxt_connlabel: use libnetfilter_conntrack") Fixes: 3a3bb480a738a ("extensions: connlabel: Fallback on missing connlabel.conf") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: among: Support mixed MAC and MAC/IP entriesPhil Sutter2020-02-182-6/+2
| | | | | | | | | | | | | | Powered by Stefano's support for concatenated ranges, a full among match replacement can be implemented. The trick is to add MAC-only elements as a concatenation of MAC and zero-length prefix, i.e. a range from 0.0.0.0 till 255.255.255.255. Although not quite needed, detection of pure MAC-only matches is left in place. For those, no implicit 'meta protocol' match is added (which is required otherwise at least to keep nft output correct) and no concat type is used for the set. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Fix for iface++Phil Sutter2020-02-141-0/+4
| | | | | | | | | In legacy iptables, only the last plus sign remains special, any previous ones are taken literally. Therefore xtables-translate must not replace all of them with asterisk but just the last one. Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Fix for interface name corner-casesPhil Sutter2020-02-111-0/+12
| | | | | | | | | | | | | | | | | | There are two special situations xlate_ifname() didn't cover for: * Interface name containing '*': This went unchanged, creating a command nft wouldn't accept. Instead translate into '\*' which doesn't change semantics. * Interface name being '+': Can't translate into nft wildcard character as nft doesn't accept asterisk-only interface names. Instead decide what to do based on 'invert' value: Skip match creation if false, match against an invalid interface name if true. Also add a test to make sure future changes to this behaviour are noticed. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: time: add translation and testsJose M. Guisado Gomez2020-02-042-0/+98
| | | | | | | | | | | | | | | | | | | | Translation capabilities for xtables time match. Different time values (hour and datetime) are translated into ranges. These time match options can be translated now --timestart value --timestop value [!] --weekdays listofdays --datestart date --datestop date The option --monthdays can't be translated into nft as of now. Examples can be found inside libxt_time.txlate Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* Fixed some man pages typos ('This modules' -> 'This module')Álvaro Santos2020-01-163-3/+3
| | | | | Signed-off-by: Álvaro Santos <aa.santos@campus.fct.unl.pt> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: AUDIT: fix man-page typo.Jeremy Sowden2019-12-301-1/+1
| | | | | | | | | | A recent commit fixed uses of "allows to" in man-pages. There was one instance where the "to" was removed but the "allows" was left behind. Remove that as well. Fixes: 3b9b515618c6 ("iptables: cleanup "allows to" usage") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: among: Check call to fstat()Phil Sutter2019-12-061-1/+5
| | | | | | If this fails, a bogus length value may be passed to mmap(). Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support")
* extensions: cluster: Avoid undefined shiftPhil Sutter2019-12-061-1/+1
| | | | | | | Value 1 is signed by default and left-shifting by 31 is undefined for those. Fix this by marking the value as unsigned. Fixes: 64a0e09894e52 ("extensions: libxt_cluster: Add translation to nft")
* extensions: time: Avoid undefined shiftPhil Sutter2019-12-061-1/+1
| | | | | | | Value 1 is signed by default and left-shifting by 31 is undefined for those. Fix this by marking the value as unsigned. Fixes: ad326ef9f734a ("Add the libxt_time iptables match")
* extensions: libxt_sctp: add manpage descriptionLaurence J. Lane2019-12-051-0/+1
| | | | | | | | | | | | Add manpage description. Arturo says: This patch is forwarded from the iptables Debian package, where it has been around for many years now. Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: manpages: cleanup hyphensLaurence J. Lane2019-12-059-10/+10
| | | | | | | | | | | | Cleanup, scape hyphens so they are not interpreted by the manpage generator. Arturo says: This patch is forwarded from the iptables Debian package, where it has been around for many years now. Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: cleanup "allows to" usageLaurence J. Lane2019-12-057-7/+7
| | | | | | | | | | | | Gramatical cleanup. Arturo says: This patch is forwarded from the iptables Debian package, where it has been around for many years now. Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: CLUSTERIP: Mark as deprecated in man pagePhil Sutter2019-12-041-0/+3
| | | | | | | Kernel even warns if being used, reflect its state in man page, too. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: bridge: Rudimental among extension supportPhil Sutter2019-11-252-0/+259
| | | | | | | | | Support among match as far as possible given the limitations of nftables sets, namely limited to homogeneous MAC address only or MAC and IP address only matches. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_SYNPROXY: add xlate methodJose M. Guisado Gomez2019-10-012-0/+25
| | | | | | | | This adds translation capabilities when encountering SYNPROXY inside iptables rules. Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: fix iptables-{nft,translate} with conntrack EXPECTEDQuentin Armitage2019-09-202-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | iptables-translate -A INPUT -m conntrack --ctstatus EXPECTED,ASSURED outputs: nft add rule ip filter INPUT ct status expected,assured counter and iptables-nft -A INPUT -m conntrack --ctstatus EXPECTED,ASSURED produces nft list output: chain INPUT { ct status expected,assured counter packets 0 bytes 0 accept } which are correct. However, iptables-translate -A INPUT -m conntrack --ctstatus EXPECTED outputs: nft # -A INPUT -m conntrack --ctstatus EXPECTED and iptables-nft -A INPUT -m conntrack --ctstatus EXPECTED produces nft list output: chain INPUT { counter packets 0 bytes 0 accept } neither of which is what is desired. Commit 6223ead0d - "extensions: libxt_conntrack: Add translation to nft" included the following code in _conntrack3_mt_xlate(): if (sinfo->match_flags & XT_CONNTRACK_STATUS) { if (sinfo->status_mask == 1) return 0; ... If the intention had been not to produce output when status_mask == 1, it would have been written as: if (sinfo->status_mask == IPS_EXPECTED) return 0; so it looks as though this is debugging code accidently left in the original patch. Removing the lines: if (sinfo->status_mask == 1) return 0; resolves the problems, and iptables-translate -A INPUT -m conntrack --ctstatus EXPECTED outputs: nft add rule ip filter INPUT ct status expected counter and iptables-nft -A INPUT -m conntrack --ctstatus EXPECTED produces nft list output: chain INPUT { ct status expected counter packets 0 bytes 0 accept } This commit also includes an additional txlate test to check when only the status EXPECTED is specified. Fixes: 6223ead0d06b ("extensions: libxt_conntrack: Add translation to nft") Signed-off-by: Quentin Armitage <quentin@armitage.org.uk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: fix over-eager -o checks on custom chainsFlorian Westphal2019-09-121-0/+17
| | | | | | | | | | | | | | | | Arturo reports ebtables-nft reports an error when -o is used in custom chains: -A MYCHAIN -o someif makes ebtables-nft exit with an error: "Use -o only in OUTPUT, FORWARD and POSTROUTING chains." Problem is that all the "-o" checks expect <= NF_BR_POST_ROUTING to mean "builtin", so -1 mistakenly leads to the checks being active. Reported-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1347 Signed-off-by: Florian Westphal <fw@strlen.de>
* netfilter: hashlimit: prefer PRIu64 to avoid warnings on 32bit platformsDuncan Roe2019-09-121-1/+1
| | | | | | | I found this patch attached to an older BZ, apply this finally... Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1107 Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Note REDIRECT case of no IP addressJoseph C. Sible2019-08-211-1/+2
| | | | | | | | | | If an IP packet comes in on an interface that lacks a corresponding IP address (which happens on, e.g., the veth's that Project Calico creates), attempting to use REDIRECT on it will cause it to be dropped. Take note of this in REDIRECT's documentation. Signed-off-by: Joseph C. Sible <josephcsible@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: nfacct: Fix alignment mismatch in xt_nfacct_match_infoJuliana Rodrigueiro2019-08-201-12/+28
| | | | | | | | | | | | | | | | When running a 64-bit kernel with a 32-bit iptables binary, the size of the xt_nfacct_match_info struct diverges. kernel: sizeof(struct xt_nfacct_match_info) : 40 iptables: sizeof(struct xt_nfacct_match_info)) : 36 This patch is the userspace fix of the memory misalignment. It introduces a v1 ABI with the correct alignment and stays compatible with unfixed revision 0 kernels. Signed-off-by: Juliana Rodrigueiro <juliana.rodrigueiro@intra2net.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions/libxt_MASQUERADE.man: random and random-fully are now identicalFlorian Westphal2019-07-111-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libxt_owner: Add supplementary groups optionLukasz Pawelczyk2019-06-193-7/+25
| | | | | | | | The --suppl-groups option causes GIDs specified with --gid-owner to be also checked in the supplementary groups of a process. Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@samsung.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: SYNPROXY: should not be needed anymore on current kernelsFlorian Westphal2019-05-081-0/+2
| | | | | | | SYN packets do not require taking the listener socket lock anymore as of 4.4 kernel, i.e. this target should not be needed anymore. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libxt_osf.: Typo in manpageSam Banks2019-04-051-1/+1
| | | | | Signed-off-by: Sam Banks <sam.banks.nz@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: Install symlinks as suchPhil Sutter2019-04-031-4/+11
| | | | | | | | | | | | Fake shared objects which are actually symlinks to others are installed using 'install' tool which follows them and therefore installs a copy of the file they point at. Fix this by introducing special handling for them in install target. Reported-by: Wenle Chen <solachenclever@hotmail.com> Fixes: 269655d54e22f ("build: remove symlink-only extensions from static object list") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: connlabel: Fallback on missing connlabel.confPhil Sutter2019-03-083-32/+48
| | | | | | | | | | | | If connlabel.conf was not found, fall back to manually parsing arguments as plain numbers. If nfct_labelmap_new() has failed, nfct_labelmap_get_name() segfaults. Therefore make sure it is not called in connlabel_get_name() if that's the case. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Add testcase for libxt_ipvsPhil Sutter2019-02-221-0/+20
| | | | | | | Given that it is fixed now, make it stay. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Fix ipvs vproto option printingPhil Sutter2019-02-221-1/+1
| | | | | | | | | This was broken since day 1: vproto option was printed as 'proto' which in turn iptables wouldn't accept anymore. Fixes: c36d05e424069 ("libxt_ipvs: user-space lib for netfilter matcher xt_ipvs") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Fix ipvs vproto parsingPhil Sutter2019-02-221-4/+1
| | | | | | | | | | | | | | This was broken by integration into guided option parser: * Make 'vproto' option XTTYPE_PROTOCOL, otherwise its arguments are parsed as garbage only. * Drop O_VPROTO case from ipvs_mt_parse(), due to XTOPT_POINTER() and above change there is nothing to do for it in there. Fixes: 372203af4c70f ("libxt_ipvs: use guided option parser") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: AUDIT: Document ineffective --type optionPhil Sutter2019-02-221-2/+4
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Revert "ebtables: use extrapositioned negation consistently"Phil Sutter2019-02-0516-67/+59
| | | | | | | | | | | | | | | | | | | | | | | This reverts commit 5f508b76a0cebaf91965ffa678089222e2d47964. While attempts at unifying syntax between arp-, eb- and iptables-nft increase the opportunity for more code-sharing, they are problematic when it comes to compatibility. Accepting the old syntax on input helps, but due to the fact that neither arptables nor ebtables support --check command we must expect for users to test existence of a rule by comparing input with output. If that happens in a script, deviating from the old syntax in output has a high chance of breaking it. Therefore revert Florian's patch changing inversion character position in output and review the old code for consistency - the only thing changed on top of the actual revert is ebtables' own copy of print_iface() to make it adhere to the intrapositioned negation scheme used throughout ebtables. Added extension tests by the reverted commit have been kept. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Fix arptables extension testsPhil Sutter2019-02-014-10/+10
| | | | | | | | | | | With changes to arptables-nft output, many of these tests fail because rules are not printed as expected anymore. Since most of the tests with explicitly defined output did so just because of added --h-length and --h-type options, adjust input a little more (typically reordering of arguments) to make output match input. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Fix CLASSIFY target printingPhil Sutter2019-01-311-13/+46
| | | | | | | | | In legacy arptables, CLASSIFY target is not printed with fixed hex number lengths. Counter this by introducing a dedicated target definition for NFPROTO_ARP only having own print/save callbacks. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Fix MARK target parsing and printingPhil Sutter2019-01-311-0/+95
| | | | | | | | | | | | | Legacy arptables parses mark values in hex no matter if prefixed with '0x' or not. Sadly, this is not easily achievable with guided option parser. Hence fall back to the old 'parse' callback. The introduced target definition is valid only for revision 2, but that's consistent with legacy arptables. When printing, use --set-mark option instead of --set-xmark. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: TRACE: Point at xtables-monitor in documentationPhil Sutter2018-12-181-7/+14
| | | | | | | | With iptables-nft, logging of trace events is different from legacy. Explain why and hint at how to receive events in this case. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libipt_realm: Document allowed realm valuesPhil Sutter2018-12-031-0/+2
| | | | | | | | | Older versions of iptables allowed for negative realm values by accident (they would be cast to unsigned). While this was clearly a bug, document the fixed behaviour. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Don't use native nftables commentsPhil Sutter2018-11-271-0/+2
| | | | | | | | | | | | | | | The problem with converting libxt_comment into nftables comment is that rules change when parsing from kernel due to comment match being moved to the end of the match list. And since match ordering matters, the rule may not be found anymore when checking or deleting. Apart from that, iptables-nft didn't support multiple comments per rule anymore. This is a compatibility issue without technical reason. Leave conversion from nftables comment to libxt_comment in place so we don't break running systems during an update. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_mh: fix bogus translation errorPablo Neira Ayuso2018-11-191-2/+2
| | | | | | | | | libip6t_mh.txlate: Fail src: ip6tables-translate -A INPUT -p mh --mh-type 1 -j ACCEPT exp: nft add rule ip6 filter INPUT meta l4proto 135 mh type 1 counter accept res: nft add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter accept Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-14 17:21:39 +0000