summaryrefslogtreecommitdiffstats
path: root/extensions
Commit message (Collapse)AuthorAgeFilesLines
* nft: Fix for useless meta expressions in rulePhil Sutter2023-09-143-0/+9
| | | | | | | | | | | | | | | | | | | A relict of legacy iptables' mandatory matching on interfaces and IP addresses is support for the '-i +' notation, basically a "match any input interface". Trying to make things better than its predecessor, iptables-nft boldly optimizes that nop away - not entirely though, the meta expression loading the interface name was left in place. While not a problem (apart from pointless overhead) in current HEAD, v1.8.7 would trip over this as a following cmp expression (for another match) was incorrectly linked to that stale meta expression, loading strange values into the respective interface name field. While being at it, merge and generalize the functions into a common one for use with ebtables' NFT_META_BRI_(I|O)IFNAME matches, too. Fixes: 0a8635183edd0 ("xtables-compat: ignore '+' interface name") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1702 Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Fix checking of conntrack --ctproto 0Quentin Armitage2023-09-142-9/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are three issues in the code: 1) the check (sinfo->invflags & XT_INV_PROTO) is using the wrong mask 2) in conntrack_mt_parse it is testing (info->invert_flags & XT_INV_PROTO) before the invert bit has been set. 3) the sense of the error message is the wrong way round 1) To get the error, ! -ctstatus XXX has to be specified, since XT_INV_PROTO == XT_CONNTRACK_STATUS e.g. | iptables -I CHAIN -m conntrack ! --ctstatus ASSURED --ctproto 0 ... 3) Unlike --proto 0 (where 0 means all protocols), in the conntrack match --ctproto 0 appears to mean protocol 0, which can never be. Therefore --ctproto 0 could never match and ! --ctproto 0 will always match. Both of these should be rejected, since the user clearly cannot be intending what was specified. The attached patch resolves the issue, and also produces an error message if --ctproto 0 is specified (as well as ! --ctproto 0 ), since --ctproto 0 will never match, and ! --ctproto 0 will always match. [Phil: - Added Fixes: tag - it's a day 1 bug - Copied patch description from Bugzilla - Reorganized changes to reduce diff - Added test cases] Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=874 Fixes: 5054e85be3068 ("general conntrack match module userspace support files") Signed-off-by: Quentin Armitage <quentin@armitage.org.uk> Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: fix example of xt_cpuVictor Julien2023-08-291-2/+2
| | | | | | | | | REDIRECT uses --to-ports instead of --to-port. Fixes: 2d59208943a3 ("extension: add xt_cpu match") Signed-off-by: Victor Julien <victor@inliniac.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* Use SOCK_CLOEXEC/O_CLOEXEC where availablePhil Sutter2023-08-101-7/+1
| | | | | | | | | | | | No need for the explicit fcntl() call, request the behaviour when opening the descriptor. One fcntl() call setting FD_CLOEXEC remains in extensions/libxt_bpf.c, the indirect syscall seems not to support passing the flag directly. Reported-by: Gaurav Gupta <g.gupta@samsung.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1104 Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libip6t_icmp: Add names for mld-listener typesPhil Sutter2023-08-052-0/+11
| | | | | | | Add the three names (plus one alias) just as in nftables. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1250 Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: Use HTTPS for links to netfilter.orgPhil Sutter2023-08-051-1/+1
| | | | | | | The browser is redirected there anyway, but who cares about such minor details nowadays. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libipt_icmp.t: Enable tests with numeric outputPhil Sutter2023-08-041-6/+3
| | | | | | | | | | Unrelated to the question whether numeric (save) output is desired or not, enable the tests and expect the known format. Using --list without --numeric prints the names, BTW. Fixes: 49d5b7277c7f2 ("extensions: libipt_icmp: add unit test") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libipt_icmp: Fix confusion between 255/255 and anyPhil Sutter2023-08-042-1/+4
| | | | | | | | | | | | | | | | Per definition, ICMP type "any" is type 255 and the full range of codes (0-255). Save callback though ignored the actual code values, printing "any" for every type 255 match. This at least confuses users as they can't find their rule added as '--icmp-type 255/255' anymore. It is not entirely clear what the fixed commit was trying to establish, but the save output is certainly not correct (especially since print callback gets things right). Reported-by: Amelia Downs <adowns@vmware.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1600 Fixes: fc9237da4e845 ("Fix '-p icmp -m icmp' issue (Closes: #37)") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: string: document BM false negativesJeremy Sowden2023-06-161-0/+15
| | | | | | | | | | For non-linear skb's there's a possibility that the kernel's Boyer-Moore text-search implementation may miss matches. There's a warning about this in the kernel source. Include that warning in the man-page. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1390 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix parsing of option arguments in same wordPhil Sutter2023-04-282-0/+5
| | | | | | | | | | | | | | | | When merging commandline parsers, a decision between 'argv[optind - 1]' and 'optarg' had to be made in some spots. While the implementation of check_inverse() required the former, use of the latter allows for the common syntax of '--opt=arg' or even '-oarg' as 'optarg' will point at the suffix while 'argv[optind - 1]' will just point at the following option. Fix the mess by making check_inverse() update optarg pointer if needed so calling code may refer to and always correct 'optarg'. Fixes: 0af80a91b0a98 ("nft: Merge xtables-arp-standalone.c into xtables-standalone.c") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1677 Signed-off-by: Phil Sutter <phil@nwl.cc>
* xt_sctp: add the missing chunk types in sctp_helpXin Long2023-02-211-1/+1
| | | | | | | | | | | | | Add the missing chunk types in sctp_help(), so that the help cmd can display these chunk types as below: # iptables -p sctp --help chunktypes - ... I_DATA RE_CONFIG PAD ... I_FORWARD_TSN ALL NONE Fixes: 6b04d9c34e25 ("xt_sctp: support a couple of new chunk types") Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Support insert with indexPhil Sutter2023-02-171-1/+1
| | | | | | | | | Translation is pretty simple due to nft's 'insert rule ... index' support. Testing the translation is sadly not: index 1 vanishes (as it should), higher indexes are rejected in replay mode since no rules previously exist. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_ip: Translation has to match on ether typePhil Sutter2023-02-172-3/+24
| | | | | | | | | | | | | | On one hand, nft refuses th expression in bridge family if layer3 protocol has not been assured by a previous match. On the other, ebt_ip kernel module will only match on IPv4 packets, so there might be a functional change in the translation versus the original. Instead of just always emitting an 'ether type' match, decide whether it's actually needed - explicit "ip <something>" payload matches (or icmp ones) cause implicit creation of a match on IPv4 by nft. Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_ip: Do not use 'ip dscp' for translationPhil Sutter2023-02-172-3/+3
| | | | | | | | | Converting from TOS field match to DSCP one is irreversible, so replay testing is not possible. Use a raw payload expression to produce something that translates 1:1 back into an 'ip' match. Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_redirect: Fix for wrong syntax in translationPhil Sutter2023-02-172-4/+4
| | | | | | | Meta key comes before 'set' in meta statement. Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_redirect: Fix target translationPhil Sutter2023-02-172-1/+9
| | | | | | | | | While EBT_ACCEPT is the default verdict for ebtables targets, omitting it from translation implicitly converts it into 'continue'. Omit the non-default EBT_CONTINUE instead. Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: CLUSTERIP: Drop test filePhil Sutter2023-02-171-4/+0
| | | | | | | The extension was removed from kernel, do not test for it anymore. Keep the code alive though, to not break existing setups. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Refuse unselected targets' optionsPhil Sutter2023-01-315-18/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | Unlike legacy, ebtables-nft would allow e.g.: | -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be While the result is correct, it may mislead users into believing multiple targets are possible per rule. Better follow legacy's behaviour and reject target options unless they have been "enabled" by a previous '-j' option. To achieve this, one needs to distinguish targets from watchers also attached to 'xtables_targets' and otherwise behaving like regular matches. Introduce XTABLES_EXT_WATCHER to mark the two. The above works already, but error messages are misleading when using the now unsupported syntax since target options have been merged already. Solve this by not pre-loading the targets at all, code will just fall back to loading ad '-j' parsing time as iptables does. Note how this also fixes for 'counter' statement being in wrong position of ebtables-translate output. Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: NAT: Fix for -Werror=format-securityPhil Sutter2023-01-121-1/+1
| | | | | | | Have to pass either a string literal or format string to xt_xlate_add(). Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE") Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Replace brace expansionPhil Sutter2023-01-101-2/+3
| | | | | | | | | According to bash(1), it is not supported by "historical versions of sh". Dash seems to be such a historical version. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Fixes: 3822a992bc277 ("Makefile: Fix for 'make distcheck'") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Reject tcp/udp extension without proper protocol matchPhil Sutter2022-12-222-0/+6
| | | | | | | | | Internally, 'th' expression is used, which works but matches both protocols. Since users won't expect '-m tcp --dport 1' to match UDP packets, catch missing/wrong '-p' argument. Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Fix for 'make distcheck'Phil Sutter2022-12-141-1/+14
| | | | | | | | | Since extensions/ directory does not use automake, some targets have to be added manually. Apart from that, several Makefiles either missed to specify relevant files or did not specify them correctly for 'make dist' to add them to the tarball. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Makefile: Merge initext targetsPhil Sutter2022-12-141-92/+14
| | | | | | | Abstract initext*.c and .initext*.dd stamp file recipes so a single one serves for all variants. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Fix MAC address match translationPhil Sutter2022-12-021-1/+1
| | | | | | | If a mask was present, ebtables-translate would emit illegal syntax. Fixes: 5e2b473a64bc7 ("xtables-compat: extend generic tests for masks and wildcards") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Fix for interfaces with asterisk mid-stringPhil Sutter2022-12-021-7/+7
| | | | | | | | | | | | | For nft, asterisk is special at end of the interface name only. Escaping it mid-string makes the escape char part of the interface name, so avoid this. In the test case, also drop the ticks around interface names in *-translate command - since there's no shell involved which would eat them, they become part of the interface name. Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: add xt_statistics random mode translationFlorian Westphal2022-12-012-2/+8
| | | | | | | Use meta random and bitops to replicate what xt_statistics is doing. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: change expected output for new formatFlorian Westphal2022-11-3081-402/+402
| | | | | | | | Now that xtables-translate encloses the entire command line in ', update the test cases accordingly. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xlate: get rid of escape_quotesFlorian Westphal2022-11-306-38/+13
| | | | | | | | | | | | | | | | Its not necessary to escape " characters, we can let xtables-translate print the entire translation/command enclosed in '' chracters, i.e. nft 'add rule ...', this also takes care of [, { and other special characters that some shells might parse otherwise (when copy-pasting translated output). The escape_quotes struct member is retained to avoid an ABI breakage. This breaks all xlate test cases, fixup in followup patches. v3: no need to escape ', replace strcmp(x, "") with x[0] (Phil Sutter) Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: xlate: Format sets consistentlyPhil Sutter2022-11-294-14/+10
| | | | | | Print a space after separating commas. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libxt_conntrack: Drop extra whitespace in xlatePhil Sutter2022-11-293-4/+3
| | | | | | | | No point in having this. Interestingly, other test cases even made up for it. Fixes: 0afd957f6bc03 ("extensions: libxt_state: add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Leverage xlate auto-spacingPhil Sutter2022-11-299-79/+42
| | | | | | Drop code which is used explicitly to deal with spacing. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xt_xlate_add() to take care of spacingPhil Sutter2022-11-296-12/+11
| | | | | | | | | | | | | | | | | | Try to eliminate most of the whitespace issues by separating strings from separate xt_xlate_add() calls by whitespace if needed. Cover the common case of consecutive range, list or MAC/IP address printing by inserting whitespace only if the string to be appended starts with an alphanumeric character or a brace. The latter helps to make spacing in anonymous sets consistent. Provide *_nospc() variants which disable the auto-spacing for the mandatory exception to the rule. Make things round by dropping any trailing whitespace before returning the buffer via xt_xlate_get(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ipcomp: Add comment to clarify xlate callbackPhil Sutter2022-11-242-3/+2
| | | | | | | | | | Kernel ignores 'hdrres' field, this matching on reserved field value was never effective. While being at it, drop its description from man page. Continue to parse and print it for compatibility reasons, but avoid attracting new users. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: frag: Add comment to clarify xlate callbackPhil Sutter2022-11-241-0/+2
| | | | | | | Matching on fragmentation header length is ineffective in kernel, xlate callback correctly ignores it. Add a comment as a hint for reviewers. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_log: Add comment to clarify xlate callbackPhil Sutter2022-11-241-0/+2
| | | | | | | Several log flags are ignored by the function. Add a comment explaining why this is correct. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: tcp: Translate TCP option matchPhil Sutter2022-11-242-3/+12
| | | | | | A simple task since 'tcp option' expression exists. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ecn: Sanitize xlate callbackPhil Sutter2022-11-241-0/+2
| | | | | | | Catch unexpected values in einfo->ip_ect. Fixes: ca42442093d3d ("iptables: extensions: libxt_ecn: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: TOS: Fix v1 xlate callbackPhil Sutter2022-11-242-13/+29
| | | | | | | Translation entirely ignored tos_mask field. Fixes: b669e18489709 ("extensions: libxt_TOS: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: TCPMSS: Use xlate callback for IPv6, tooPhil Sutter2022-11-241-0/+1
| | | | | | | Data structures are identical and the translation is layer3-agnostic. Fixes: bebce197adb42 ("iptables: iptables-compat translation for TCPMSS") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: MARK: Sanitize MARK_xlate()Phil Sutter2022-11-241-0/+2
| | | | | | | | Since markinfo->mode might contain unexpected values, add a default case returning zero. Fixes: afefc7a134ca0 ("extensions: libxt_MARK: Add translation for revision 1 to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: CONNMARK: Fix xlate callbackPhil Sutter2022-11-242-5/+13
| | | | | | | | | | | | | Bail out if nfmask != ctmask with XT_CONNMARK_SAVE and XT_CONNMARK_RESTORE. Looks like this needs a similar implementation to the one for XT_CONNMARK_SET. Fix shift mark translation: xt_connmark_shift_ops does not contain useful strings for nftables. Also add needed braces around the term being shifted. Fixes: db7b4e0de960c ("extensions: libxt_CONNMARK: Support bit-shifting for --restore,set and save-mark") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libipt_ttl: Sanitize xlate callbackPhil Sutter2022-11-241-2/+2
| | | | | | | Catch unexpected values in info->mode, also fix indenting. Fixes: 1b320a1a1dc1f ("extensions: libipt_ttl: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_redirect: Fix xlate return codePhil Sutter2022-11-241-1/+1
| | | | | | | The callback is supposed to return 1 on success, not 0. Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_mark: Fix xlate test casePhil Sutter2022-11-242-11/+11
| | | | | | | | | | The false suffix effectively disabled this test file, but it also has problems: Apart from brmark_xlate() printing 'meta mark' instead of just 'mark', target is printed in the wrong position (like with any other target-possessing extension. Fixes: e67c08880961f ("ebtables-translate: add initial test cases") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_mark: Fix mark target xlatePhil Sutter2022-11-241-1/+1
| | | | | | | | Target value is constructed setting all non-target bits to one instead of zero. Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: mark: Test double bitwise in a rulePhil Sutter2022-11-161-0/+1
| | | | | | | In v1.8.8, the second bitwise changed the first one, messing iptables-nft-save output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Drop extra newline from xtables_error() callsPhil Sutter2022-11-1512-61/+49
| | | | | | | | | | Since basic_exit_err() appends a newline to the message itself, drop explicit ones. While being at it, fix indentation and join texts split over multiple lines. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Unify ICMP parser into libxt_icmp.hPhil Sutter2022-11-155-260/+131
| | | | | | Merge all four copies of the ICMP/ICMPv6/IGMP parameter parsing code. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Collate ICMP types/codes in libxt_icmp.hPhil Sutter2022-11-155-206/+107
| | | | | | | | Put the most extensive version of icmp_codes, icmpv6_codes and igmp_codes into the header. Have to rename the function xt_print_icmp_types's parameter to avoid a compiler warning. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_arp, libebt_ip: Use xtables_ipparse_any()Phil Sutter2022-11-153-157/+21
| | | | | | | The libxtables function covers all formerly supported inputs (and more). The extended libebt_arp.t passes before and after this patch. Signed-off-by: Phil Sutter <phil@nwl.cc>