summaryrefslogtreecommitdiffstats
path: root/iptables/iptables-restore.c
Commit message (Collapse)AuthorAgeFilesLines
* libxtables: Introduce xtables_fini()Phil Sutter2020-05-111-4/+10
| | | | | | | | | | | | Record handles of loaded shared objects in a linked list and dlclose() them from the newly introduced function. While functionally not necessary, this clears up valgrind's memcheck output when also displaying reachable memory. Since this is an extra function that doesn't change the existing API, increment both current and age. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables: flush stdout after every verbose log.Maciej ┼╗enczykowski2020-05-111-1/+3
| | | | | | | | | | | | | | | | | | | | | Ensures that each logged line is flushed to stdout after it's written, and not held in any buffer. Places to modify found via: git grep -C5 'fputs[(]buffer, stdout[)];' On Android iptables-restore -v is run as netd daemon's child process and fed actions via pipe. '#PING' is used to verify the child is still responsive, and thus needs to be unbuffered. Luckily if you're running iptables-restore in verbose mode you probably either don't care about performance or - like Android - actually need this. Test: builds, required on Android for ip6?tables-restore netd subprocess health monitoring. Signed-off-by: Maciej ┼╗enczykowski <maze@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xshared: Introduce struct argv_storePhil Sutter2019-10-241-15/+13
| | | | | | | | | | | | The use of global variables in code around add_argv() is error-prone and hard to follow. Replace them by a struct which functions will modify instead of causing side-effects. Given the lack of static variables, this effectively makes argv construction code reentrant. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* iptables-restore: Constify struct iptables_restore_cbPhil Sutter2019-10-181-4/+5
| | | | | | | | Just like with xtables-restore, these callbacks don't change at run-time. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Introduce rule counter tokenizer functionPhil Sutter2019-10-181-31/+4
| | | | | | | | | | | | | | The same piece of code appears three times, introduce a function to take care of tokenizing and error reporting. Pass buffer pointer via reference so it can be updated to point to after the counters (if found). While being at it, drop pointless casting when passing pcnt/bcnt to add_argv(). Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables_error() does not returnPhil Sutter2019-09-251-12/+6
| | | | | | | | | It's a define which resolves into a callback which in turn is declared with noreturn attribute. It will never return, therefore drop all explicit exit() calls or other dead code immediately following it. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* ipables: xtables-restore: output filename option in help textFlorian Westphal2019-09-161-1/+1
| | | | | Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1341 Signed-off-by: Florian Westphal <fw@strlen.de>
* src: replace IPTABLES_VERSION by PACKAGE_VERSIONJan Engelhardt2019-05-301-2/+2
| | | | | | | | | | | | | The IPTABLES_VERSION C macro replicates the PACKAGE_VERSION C macro (both have the same definition, "@PACKAGE_VERSION@"). Since IPTABLES_VERSION, being located in internal.h, is not exposed to downstream users in any way, it can just be replaced by PACKAGE_VERSION, which saves a configure-time file substitution. This goes towards eliminating unnecessary rebuilds after rerunning ./configure. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* ip6tables-restore: Merge into iptables-restore.cPhil Sutter2018-11-131-44/+110
| | | | | | | | Introduce struct iptables_restore_cb and merge ip6tables-restore with iptables-restore. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Fix a few cases of pointless assignmentsPhil Sutter2018-09-241-2/+2
| | | | | | | | This gets rid of a number of assignments which are either redundant or not used afterwards. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ip{, 6}tables-restore: Fix for uninitialized array 'curtable'Phil Sutter2018-09-241-1/+1
| | | | | | | | | | When reading sufficiently malformed input, parser might hit end of loop without having written the current table name into curtable and therefore calling strcmp() with uninitialized buffer. Avoid this by setting curtable to zero upon declaration. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Consolidate argv construction routinesPhil Sutter2018-08-041-103/+7
| | | | | | | | | | | | | | | | | | | | | Implementations were equal in {ip,ip6,x}tables-restore.c. The one in iptables-xml.c differed slightly. For now, collect all features together. Maybe it would make sense to migrate iptables-xml.c to using add_param_to_argv() at some point and therefore extend the latter to store whether a given parameter was quoted or not. While being at it, a few improvements were done: * free_argv() now also resets 'newargc' variable, so users don't have to do that anymore. * Indenting level in add_param_to_argv() was reduced a bit. * That long error message is put into a single line to aid in grepping for it. * Explicit call to exit() after xtables_error() is removed since the latter does not return anyway. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Consolidate parse_counters()Phil Sutter2018-08-041-11/+0
| | | | | | | | | Move this helper function into xshared. While being at it, drop the need for temporary variables and take over null pointer tolerance from the implementation in iptables-xml.c. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Consolidate DEBUGP macrosPhil Sutter2018-08-041-6/+0
| | | | | | | | | | | | | | | | | | This debug printing macro was defined in various places, always identical. Move it into xshared.h and drop it from sources including that header. There are a few exceptions: * iptables-xml.c did not include xshared.h, which this patch changes. * Sources in extensions and libiptc mostly left alone since they don't include xshared.h (and maybe shouldn't). Only libxt_set.h does, so it's converted, too. This also converts DEBUG define use in libip6t_hbh.c to avoid a compiler warning. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-restore: free the table lock when skipping a tableJoel Goguen2018-07-261-1/+6
| | | | | | | | | | | | | | | | | | | Currently, when running `iptables-restore --table=X`, where `X` is not the first table in the rules dump, the restore will fail when parsing the second table: - a lock is acquird when parsing the first table name - the table name does not match the parameter to `--table` so processing continues until the next table - when processing the next table a lock is acquired, which fails because a lock is already held Another app is currently holding the xtables lock. Perhaps you want to use the -w option? This will release the lock as soon as it's decided the current table won't be used. Signed-off-by: Joel Goguen <contact+netfilter@jgoguen.ca> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: replace memset by c99-style initializersPhil Sutter2018-07-191-4/+1
| | | | | | | | This cleans up a few obvious cases identified by grepping the source code for 'memset'. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: add nf_tables vs. legacy postfix to version stringsFlorian Westphal2018-06-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | -V now yields: arptables vlibxtables.so.12 (nf_tables) ebtables 1.6.2 (nf_tables) ip6tables v1.6.2 (legacy) ip6tables v1.6.2 (nf_tables) ip6tables-restore v1.6.2 (nf_tables) ip6tables-save v1.6.2 (nf_tables) ip6tables-restore v1.6.2 (legacy) ip6tables-restore-translate v1.6.2 ip6tables-save v1.6.2 (legacy) ip6tables-translate v1.6.2 (nf_tables) iptables v1.6.2 (legacy) iptables v1.6.2 (nf_tables) iptables-restore v1.6.2 (nf_tables) iptables-save v1.6.2 (nf_tables) iptables-restore v1.6.2 (legacy) iptables-restore-translate v1.6.2 iptables-save v1.6.2 (legacy) iptables-translate v1.6.2 (nf_tables) This allows to see wheter "iptables" is using old set/getsockopt or new nf_tables infrastructure. Suggested-by: Harald Welte <laforge@gnumonks.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* ip{,6}tables-restore: Don't accept wait-interval without waitPhil Sutter2017-10-041-0/+5
| | | | | | | | If -W <val> was given, error out if -w wasn't since that doesn't make sense. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Fix crash on malformed iptables-restoreOliver Ford2017-05-291-2/+5
| | | | | | | | | | | | | | | | | | | | Fixes the crash reported in Bugzilla #1131 where a malformed parameter that specifies the table option during a restore can create an invalid pointer. It was discovered during fuzz testing that options like '-ftf' can cause a segfault. A parameter that includes a 't' is not currently filtered correctly. Improves the filtering to: Filter a beginning '-' followed by a character other than '-' and then a 't' anywhere in the parameter. This filters parameters like '-ftf'. Filter '--t'. Filter '--table', stopping when the parameter length is reached. Because the getopt_long function allows abbreviations, any unique abbreviation of '--table' will be treated as '--table'. This filters parameters like '--t', '--ta', but not '--ttl' or '--target'. Signed-off-by: Oliver Ford <ojford@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: insist that the lock is held.Lorenzo Colitti2017-05-291-6/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, iptables programs will exit with an error if the iptables lock cannot be acquired, but will silently continue if the lock cannot be opened at all. This can cause unexpected failures (with unhelpful error messages) in the presence of concurrent updates, which can be very difficult to find in a complex or multi-administrator system. Instead, refuse to do anything if the lock cannot be acquired. The behaviour is not affected by command-line flags because: 1. In order to reliably avoid concurrent modification, all invocations of iptables commands must follow this behaviour. 2. Whether or not the lock can be opened is typically not a run-time condition but is likely to be a configuration error. Existing systems that depended on things working mostly correctly even if there was no lock might be affected by this change. However, that is arguably a configuration error, and now that the iptables lock is configurable, it is trivial to provide a lock file that is always accessible: if nothing else, the iptables binary itself can be used. The lock does not have to be writable, only readable. Tested by configuring the system to use an xtables.lock file in a non-existent directory and observing that all commands failed. Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-restore/save: exit when given an unknown optionVincent Bernat2017-04-191-5/+5
| | | | | | | | | | | | When an unknown option is given, iptables-restore should exit instead of continue its operation. For example, if `--table` was misspelled, this could lead to an unwanted change. Moreover, exit with a status code of 1. Make the same change for iptables-save. OTOH, exit with a status code of 0 when requesting help. Signed-off-by: Vincent Bernat <vincent@bernat.im> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-restore/ip6tables-restore: add --version/-V argumentDan Williams2017-04-141-2/+8
| | | | | | | Prints program version just like iptables/ip6tables. Signed-off-by: Dan Williams <dcbw@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Remove explicit static variables initalization.Varsha Rao2017-04-061-1/+1
| | | | | | | | Static variables are initialized to zero by default, so remove explicit initalization. This patch fixes the checkpatch issue. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-restore: support acquiring the lock.Lorenzo Colitti2017-03-211-12/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, ip[6]tables-restore does not perform any locking, so it is not safe to use concurrently with ip[6]tables. This patch makes ip[6]tables-restore wait for the lock if -w was specified. Arguments to -w and -W are supported in the same was as they are in ip[6]tables. The lock is not acquired on startup. Instead, it is acquired when a new table handle is created (on encountering '*') and released when the table is committed (COMMIT). This makes it possible to keep long-running iptables-restore processes in the background (for example, reading commands from a pipe opened by a system management daemon) and simultaneously run iptables commands. If -w is not specified, then the command proceeds without taking the lock. Tested as follows: 1. Run iptables-restore -w, and check that iptables commands work with or without -w. 2. Type "*filter" into the iptables-restore input. Verify that a) ip[6]tables commands without -w fail with "another app is currently holding the xtables lock...". b) ip[6]tables commands with "-w 2" fail after 2 seconds. c) ip[6]tables commands with "-w" hang until "COMMIT" is typed into the iptables-restore window. 3. With the lock held by an ip6tables-restore process: strace -e flock /tmp/iptables/sbin/iptables-restore -w 1 -W 100000 shows 11 calls to flock and fails. 4. Run an iptables-restore with -w and one without -w, and check: a) Type "*filter" in the first and then the second, and the second exits with an error. b) Type "*filter" in the second and "*filter" "-S" "COMMIT" into the first. The rules are listed only when the first copy sees "COMMIT". Signed-off-by: Narayan Kamath <narayan@google.com> Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-restore: add missing arguments to usage messageBrian Haley2016-08-231-2/+2
| | | | | | | | | iptables-restore was missing -n, -T and -M from the usage message, added them to match the man page. Cleaned-up other *restore files as well. Signed-off-by: Brian Haley <brian.haley@hpe.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* consistently use <errno.h>Felix Janda2015-05-021-1/+1
| | | | | | | | | On glibc, <sys/errno.h> is a synomym for <errno.h>. <errno.h> is specified by POSIX, so use that. Fixes compilation error with musl libc Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-{save,restore}: warn that -b/--binary isn't implementedJiri Popelka2014-03-171-5/+3
| | | | | | see also 296dca39be Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip{6}tables-restore: fix breakage due to new locking approachPablo Neira Ayuso2013-07-081-1/+1
| | | | | | | | | | | | | | | | Since (93587a0 ip[6]tables: Add locking to prevent concurrent instances), ip{6}tables-restore does not work anymore: iptables-restore < x Another app is currently holding the xtables lock. Perhaps you want to use the -w option? do_command{6}(...) is called from ip{6}tables-restore for every iptables command contained in the rule-set file. Thus, hitting the lock error after the second command. Fix it by bypassing the locking in the ip{6}tables-restore path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip[6]tables-restore: cleanup to reduce one level of indentationPablo Neira Ayuso2012-08-031-69/+65
| | | | | | | This patch moves the parameter parsing to one function to reduce one level of indentation. Jan Engelhardt likes this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-restore: warn about -t in rule linesJan Engelhardt2012-07-311-2/+4
| | | | | | | save-restore syntax uses *table, not -t table. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-restore: fix parameter parsing (shows up with gcc-4.7)Pablo Neira Ayuso2012-07-301-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes parameter parsing in iptables-restore since time ago. The problem has shown up with gcc-4.7. This version of gcc seem to perform more agressive memory management than previous. Peter Lekensteyn provided the following sample code similar to the one in iptables-restore: int i = 0; for (;;) { char x[5]; x[i] = '0' + i; if (++i == 4) { x[i] = '\0'; /* terminate string with null byte */ printf("%s\n", x); break; } } Many may expect 0123 as output. But GCC 4.7 does not do that when compiling with optimization enabled (-O1 and higher). It instead puts random data in the first bytes of the character array, which becomes: | 0 | 1 | 2 | 3 | 4 | | RANDOM | '3' | '\0' | Since the array is declared inside the scope of loop's body, you can think of it as of a new array being allocated in the automatic storage area for each loop iteration. The correct code should be: char x[5]; for (;;) { x[i] = '0' + i; if (++i == 4) { x[i] = '\0'; /* terminate string with null byte */ printf("%s\n", x); break; } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "iptables-restore: move code to add_param_to_argv, cleanup (fix gcc-4.7)"Pablo Neira Ayuso2012-07-301-65/+68
| | | | | | | | This reverts commit 44191bdbd71e685fba9eab864b9df25e63905220. Apply instead a patch that really clarifies the bug in iptables-restore. This should be good for the record (specifically, for distributors so they can find the fix by googling).
* iptables-restore: move code to add_param_to_argv, cleanup (fix gcc-4.7)Pablo Neira Ayuso2012-07-251-68/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch seems to be a mere cleanup that moves the parameter parsing code to add_param_to_argv. But, in reality, it also fixes iptables when compiled with gcc-4.7. Moving param_buffer declaration out of the loop seems to resolve the issue. gcc-4.7 seems to be generating bad code regarding param_buffer. @@ -380,9 +380,9 @@ quote_open = 0; escaped = 0; param_len = 0; + char param_buffer[1024]; for (curchar = parsestart; *curchar; curchar++) { - char param_buffer[1024]; if (quote_open) { if (escaped) { But I have hard time to apply this patch in such a way. Instead, I came up with the idea of this cleanup, which does not harm after all (and fixes the issue for us). Someone in: https://bugzilla.redhat.com/show_bug.cgi?id=82579 put some light on this: "Yes, I ran into this too. The issue is that the gcc optimizer is optimizing out the code that collects quoted strings in iptables-restore.c at line 396. If inside a quotemark and it hasn't seen another one yet, it executes param_buffer[param_len++] = *curchar; continue; At -O1 or higher, the write to param_buffer[] never happens. It just increments param_len and continues. Moving the definition of char param_buffer[1024]; outside the loop fixes it. Why, I'm not sure. Defining the param_buffer[] inside the loop should simply restrict its scope to inside the loop." Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip(6)tables-restore: make sure argv is NULL terminatedFlorian Westphal2012-05-141-1/+1
| | | | | | | | | | Else, argv[argc] may point to free'd memory. Some extensions, e.g. rateest, may fail to parse valid input because argv[optind] (with optind == argc) is not NULL. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip6tables-restore: make code look alike with iptables-restoreJan Engelhardt2011-09-111-14/+15
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: resolve old macro names that are indirectionsJan Engelhardt2011-09-111-7/+6
| | | | | | | | | | | Command used: git grep -f <(pcregrep -hior '(?<=#define\s)IP6?(T_\w+)(?=\s+X\1)' include/) and then fix all occurrences. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libiptc: combine common types: _handleJan Engelhardt2011-09-111-3/+3
| | | | | | | No real API/ABI change incurred, since the definition of the structs' types is not visible anyhow. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: remove unused IPTABLES_MULTI defineJan Engelhardt2011-08-261-5/+0
| | | | | | This dead code has been lingering around since commit v1.4.5~7. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: Coverity: REVERSE_INULLJiri Popelka2011-06-221-2/+1
| | | | | | | | | | | | | | ip6tables-restore.c:186: deref_ptr_in_call: Dereferencing pointer "in". ip6tables-restore.c:463: check_after_deref: Dereferencing "in" before a null check. iptables-restore.c:192: deref_ptr_in_call: Dereferencing pointer "in". iptables-restore.c:468: check_after_deref: Dereferencing "in" before a null check. iptables-xml.c:671: deref_ptr_in_call: Dereferencing pointer "in". iptables-xml.c:873: check_after_deref: Dereferencing "in" before a null check. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: move all iptables pieces into a separate directoryJan Engelhardt2011-06-071-0/+471
(Unclutter top-level dir) Signed-off-by: Jan Engelhardt <jengelh@medozas.de>