summaryrefslogtreecommitdiffstats
path: root/iptables/nft-ipv4.c
Commit message (Collapse)AuthorAgeFilesLines
* xlate: Improve redundant l4proto match avoidancePhil Sutter2024-04-091-12/+11
| | | | | | | | | | | | | | | xtables-translate tries to avoid 'ip protocol'/'meta l4proto' matches if following expressions add this as dependency anyway. E.g.: | # iptables-translate -A FOO -p tcp -m tcp --dport 22 -j ACCEPT | nft 'add rule ip filter FOO tcp dport 22 counter accept' This worked by searching protocol name in loaded matches, but that approach is flawed as the protocol name and corresponding extension may differ ("mobility-header" vs. "mh"). Improve this by searching for all names (cached or resolved) for a given protocol number. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Leverage stored protocol namesPhil Sutter2024-02-291-14/+10
| | | | | | | | | | | Align output of ip(6)tables-translate for --protocol arguments with that of ip(6)tables -L/-S by calling proto_to_name() from xshared.c. The latter will consult xtables_chain_protos list first to make sure (the right) names are used for "common" protocol values and otherwise falls back to getprotobynumber() which it replaces here. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1738 Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce print_help callback (again)Phil Sutter2023-12-051-0/+1
| | | | | | | | Prep work for ebtables parser to use do_parse(). Adding more special casing to xtables_printhelp() causes a mess, so work with a callback again. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Turn command_default() into a callbackPhil Sutter2023-12-051-0/+1
| | | | | | | | Ebtables' variant is pretty different since all extensions are loaded up front and some targets serve as "watcher" extensions, so let variants specify the function to call for extension parameters. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Entirely ignore interface masks when saving rulesPhil Sutter2023-11-291-2/+1
| | | | | | | Rule printing code does this for more than 20 years now, assume it's safe to rely upon the wildcard interface name to contain a '+' suffix. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce xt_cmd_parse_ops::option_invertPhil Sutter2023-11-291-0/+1
| | | | | | | | | Replace the awkward inverse_for_options array with basically a few switch() statements clearly identifying the relation between option and inverse values and relieve callers from having to find the option flag bit's position. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce xt_cmd_parse_ops::option_namePhil Sutter2023-11-291-0/+1
| | | | | | | | | | | | The old opt2char() function was flawed: Since not every field in optflags contains a printable character, typical use of its return value in print statements could lead to garbage on screen. Replace this by a mechanism to retrieve an option's long name which supports family-specific overrides. and get rid of optflags field altogether and define NUMBER_OF_OPT similar to NUMBER_OF_CMD. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix for useless meta expressions in rulePhil Sutter2023-09-141-2/+2
| | | | | | | | | | | | | | | | | | | A relict of legacy iptables' mandatory matching on interfaces and IP addresses is support for the '-i +' notation, basically a "match any input interface". Trying to make things better than its predecessor, iptables-nft boldly optimizes that nop away - not entirely though, the meta expression loading the interface name was left in place. While not a problem (apart from pointless overhead) in current HEAD, v1.8.7 would trip over this as a following cmp expression (for another match) was incorrectly linked to that stale meta expression, loading strange values into the respective interface name field. While being at it, merge and generalize the functions into a common one for use with ebtables' NFT_META_BRI_(I|O)IFNAME matches, too. Fixes: 0a8635183edd0 ("xtables-compat: ignore '+' interface name") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1702 Signed-off-by: Phil Sutter <phil@nwl.cc>
* Revert --compat option related commitsPhil Sutter2023-09-011-1/+1
| | | | | | | | | | | | | | | | | | | This reverts the following commits: b14c971db6db0 ("tests: Test compat mode") 11c464ed015b5 ("Add --compat option to *tables-nft and *-nft-restore commands") ca709b5784c98 ("nft: Introduce and use bool nft_handle::compat") 402b9b3c07c81 ("nft: Pass nft_handle to add_{target,action}()") This implementation of a compatibility mode implements rules using xtables extensions if possible and thus relies upon existence of those in kernel space. Assuming no viable replacement for the internal mechanics of this mode will be found in foreseeable future, it will effectively block attempts at deprecating and removing of these xtables extensions in favor of nftables expressions and thus hinder upstream's future plans for iptables. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Pass nft_handle to add_{target,action}()Phil Sutter2023-08-111-1/+1
| | | | | | Prepare for varying rule content based on a global flag. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-bridge: pass context structure to ops->add() to improve anonymous set ↵Pablo Neira Ayuso2023-07-121-3/+3
| | | | | | | | | | | | | | | | | support Add context structure to improve bridge among support which creates an anonymous set. This context structure specifies the command and it allows to optionally store a anonymous set. Use this context to generate native bytecode only if this is an add/insert/replace command. This fixes a dangling anonymous set that is created on rule removal. Fixes: 26753888720d ("nft: bridge: Rudimental among extension support") Reported-and-tested-by: Igor Raits <igor@gooddata.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: use payload matching for layer 4 protocolPablo Neira Ayuso2023-06-161-1/+2
| | | | | | | | | This is an IPv4 header, which does not require the special handling as in IPv6, use the payload matching instead of meta l4proto which is slightly faster in this case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: check for source and destination address in first placePablo Neira Ayuso2023-06-021-14/+16
| | | | | | | | | | | | | | | | | | | | | | When generating bytecode, check for source and destination address in first place, then, check for the input and output device. In general, the first expression in the rule is the most evaluated during the evaluation process. These selectors are likely to show more variability in rulesets. # iptables-nft -vv -I INPUT -s 1.2.3.4 -p tcp tcp opt -- in * out * 1.2.3.4 -> 0.0.0.0/0 table filter ip flags 0 use 0 handle 0 ip filter INPUT use 0 type filter hook input prio 0 policy accept packets 0 bytes 0 ip filter INPUT [ payload load 4b @ network header + 12 => reg 1 ] [ cmp eq reg 1 0x04030201 ] [ meta load l4proto => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ counter pkts 0 bytes 0 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: ruleparse: Create family-specific source filesPhil Sutter2023-05-031-108/+0
| | | | | | | Extract the remaining nftnl rule parsing code from nft-<family>.c sources into dedicated ones to complete the separation. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Extract rule parsing callbacks from nft_family_opsPhil Sutter2023-05-031-3/+7
| | | | | | | Introduce struct nft_ruleparse_ops holding the family-specific expression parsers and integrate it into nft_family_ops for now. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-nft: remove unused function argumentFlorian Westphal2023-03-151-1/+1
| | | | | | Not used, all callers pass NULL. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: Increase rule parser strictnessPhil Sutter2022-12-201-1/+3
| | | | | | Catch more unexpected conditions. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Introduce xtables_clear_iptables_command_state()Phil Sutter2022-12-021-2/+2
| | | | | | | | | | This is nft_clear_iptables_command_state() but in a location reachable by legacy iptables, too. Changes callers in non-family-specific code to use clear_cs callback instead of directly calling it - ebtables still has a custom variant. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: check for unknown meta keysFlorian Westphal2022-11-231-2/+5
| | | | | | | | | | | | | Set ->errmsg when the meta key isn't supported by iptables-nft instead of pretending everything is fine. The old code is good enough to handle rules added by iptables-nft, but its not enough to handle rules added by native nft. At least make sure that there is a an error message telling that iptables-nft could not decode the entire ruleset. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: track each register individuallyFlorian Westphal2022-09-281-26/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of assuming only one register is used, track all 16 regs individually. This avoids need for the 'PREV_PAYLOAD' hack and also avoids the need to clear out old flags: When we see that register 'x' will be written to, that register state is reset automatically. Existing dissector decodes ip saddr 1.2.3.4 meta l4proto tcp ... as -s 6.0.0.0 -p tcp iptables-nft -s 1.2.3.4 -p tcp is decoded correctly because the expressions are ordered like: meta l4proto tcp ip saddr 1.2.3.4 | ... and 'meta l4proto' did clear the PAYLOAD flag. The simpler fix is: ctx->flags &= ~NFT_XT_CTX_PAYLOAD; in nft_parse_cmp(), but that breaks dissection of '1-42', because the second compare ('cmp lte 42') will not find the payload expression anymore. Link: https://lore.kernel.org/netfilter-devel/20220922143544.GA22541@breakpoint.cc/T/#t Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: support ttl/hoplimit dissectionFlorian Westphal2022-09-131-0/+3
| | | | | | | xlate raw "nft ... ttl eq 1" and so on to the ttl/hl matches. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: prepare for dynamic register allocationPablo Neira Ayuso2022-05-021-3/+5
| | | | | | | | | Store the register that has been allocated and pass it on to the next expression. NFT_REG_1 is still used. No functional changes are expected. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: pass handle to helper functions to build netlink payloadPablo Neira Ayuso2022-05-021-6/+6
| | | | | | | Pass struct nft_handle to helper functions in preparation for the dynamic register allocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: pass struct nft_xt_ctx to parse_meta()Pablo Neira Ayuso2022-05-021-1/+1
| | | | | | In preparation for native mark match support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Don't pass command state opaque to family ops callbacksPhil Sutter2022-03-101-17/+11
| | | | | | | | | | | There are no family-specific versions of struct iptables_command_state anymore, so no need to hide it behind void pointer. Pass the type as-is and save a few casts. While at it, drop unused callbacks parse_bitwise and parse_cmp. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Simplify immediate parsingPhil Sutter2022-03-101-9/+3
| | | | | | | | | | Implementations of parse_immediate callback are mostly trivial, the only relevant part is access to family-specific parts of struct iptables_command_state when setting goto flag for iptables and ip6tables. Refactor them into simple set_goto_flag callbacks. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Move proto_parse and post_parse callbacks to xsharedPhil Sutter2022-01-121-57/+2
| | | | | | | They are not nft-variant-specific and may therefore be shared with legacy. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Do not pass nft_handle to do_parse()Phil Sutter2022-01-121-2/+4
| | | | | | | | | Make it fit for sharing with legacy iptables, drop nft-specific parameter. This requires to mirror proto_parse and post_parse callbacks from family_ops somewhere reachable - use xt_cmd_parse, it holds other "parser setup data" as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share print_fragment() with legacyPhil Sutter2021-11-231-14/+1
| | | | | | | | | | | Also add a fake mode to make it suitable for ip6tables. This is required because IPT_F_FRAG value clashes with IP6T_F_PROTO, so ip6tables rules might seem to have IPT_F_FRAG bit set. While being at it, drop the local variable 'flags' from print_firewall(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share print_rule_details() with legacyPhil Sutter2021-11-231-2/+2
| | | | | | | | | | Have to pass pointer to counters directly since different fields are being used for some reason. Since proto_to_name() is not used outside of xshared.c anymore, make it static. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share save_ipv{4,6}_addr() with legacyPhil Sutter2021-11-231-41/+2
| | | | | | | While being at it, make save_ipv4_addr() accept an in_addr* as mask - mask_to_str() needs it anyway. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share save_rule_details() with legacyPhil Sutter2021-11-231-9/+4
| | | | | | | | | | The function combines printing of input and output interfaces and protocol parameter, all being IP family independent. Extend the function to print fragment option ('-f'), too if requested. While being at it, drop unused iptables_command_state parameter and reorder the remaining ones a bit. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Change whitespace printing in save_rule callbackPhil Sutter2021-11-231-3/+3
| | | | | | | This aligns whitespace printing with legacy iptables' print_rule4() in order to prepare for further code-sharing. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Add family ops callbacks wrapping different nft_cmd_* functionsPhil Sutter2021-10-201-0/+93
| | | | | | | | | | Commands supporting multiple source/destination addresses need to iterate over them and call the respective nft_cmd_* function multiple times. These loops are family-specific though as each family uses a different data structure within struct iptables_command_state to store the addresses. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Avoid buffer size warnings copying iface namesPhil Sutter2021-06-071-2/+2
| | | | | | | | | The call to strncpy() is actually not needed: source buffer is only IFNAMSIZ bytes large and guaranteed to be null-terminated. Use this to avoid compiler warnings due to size parameter matching the destination buffer size by performing the copy using (dumb) memcpy() instead. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Eliminate inet_aton() and inet_ntoa()Phil Sutter2021-04-301-9/+14
| | | | | | | Both functions are obsolete, replace them by equivalent calls to inet_pton() and inet_ntop(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Fix translation of odd netmasksPhil Sutter2021-03-091-12/+30
| | | | | | | | | Iptables supports netmasks which are not prefixes to match on (or ignore) arbitrary bits in an address. Yet nftables' prefix notation is available for real prefixes only, so translation is not as trivial - print bitmask syntax for those cases. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Optimize masked MAC address matchesPhil Sutter2020-11-041-2/+4
| | | | | | | | | | Just like with class-based prefix matches in iptables-nft, optimize masked MAC address matches if the mask is on a byte-boundary. To reuse the logic in add_addr(), extend it to accept the payload base value via parameter. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Optimize class-based IP prefix matchesPhil Sutter2020-11-041-2/+4
| | | | | | | Payload expression works on byte-boundaries, leverage this with suitable prefix lengths. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Drop save_counters callback from family_opsPhil Sutter2020-05-181-1/+0
| | | | | | | All families use the same callback function, just fold it into the sole place it's called. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Merge nft_*_rule_find() functionsPhil Sutter2020-05-181-1/+0
| | | | | | | | | Both ebtables and arptables are fine with using nft_ipv46_rule_find() instead of their own implementations. Take the chance and move the former into nft.c as a static helper since it is used in a single place, only. Then get rid of the callback from family_ops. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Use clear_cs() instead of open codingPhil Sutter2020-05-111-1/+1
| | | | | | | | In a few places, initialized struct iptables_command_state was not fully deinitialized. Change them to call nft_clear_iptables_command_state() which does it properly. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: family_ops: Pass nft_handle to 'rule_to_cs' callbackPhil Sutter2019-11-251-1/+1
| | | | | | | | | | | This is the actual callback used to parse nftables rules. Pass nft_handle to it so it can access the cache (and possible sets therein). Having to pass nft_handle to nft_rule_print_save() allows to simplify it a bit since no family ops lookup has to be done anymore. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'print_rule' callbackPhil Sutter2019-11-251-2/+2
| | | | | | | | Prepare for 'rule_to_cs' callback to receive nft_handle pointer so it is able to access cache for set lookups. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'add' callbackPhil Sutter2019-11-251-2/+2
| | | | | | | | | In order for add_match() to create anonymous sets when converting xtables matches it needs access to nft handle. So pass it along from callers of family ops' add callback. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Don't use native nftables commentsPhil Sutter2018-11-271-11/+3
| | | | | | | | | | | | | | | The problem with converting libxt_comment into nftables comment is that rules change when parsing from kernel due to comment match being moved to the end of the match list. And since match ordering matters, the rule may not be found anymore when checking or deleting. Apart from that, iptables-nft didn't support multiple comments per rule anymore. This is a compatibility issue without technical reason. Leave conversion from nftables comment to libxt_comment in place so we don't break running systems during an update. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-nft: fix -f fragment optionFlorian Westphal2018-11-111-1/+1
| | | | | | | | This needs to be passed in network byte order. Reported-by: Arno van Amersfoort <arnova@rocky.eld.leidenuniv.nl> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1292 Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-nft: fix bogus handling of zero saddr/daddrFlorian Westphal2018-11-031-2/+2
| | | | | | | | | | | | | rule for 0.0.0.0/8 is added as 0.0.0.0/0, because we did not check mask (or negation, for that matter). Fix this and add test cases too. This also revealed an ip6tables-nft-save bug, it would print ' !-d', not '! -d'. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1287 Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Don't read garbage in nft_ipv4_parse_payload()Phil Sutter2018-09-241-0/+1
| | | | | | | | | The problem here is that get_frag() does not set 'inv' in any case, so when later checking its value, garbage may be read. Sanitize this case by setting 'inv' to false before calling get_frag(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Share print_ipv{4,6}_addr() from xtablesPhil Sutter2018-09-241-31/+1
| | | | | | | | | | | | | | | | These functions contain code which occurs in legacy's print_firewall() functions, so use them there. Rename them to at least make clear they print more than a single address. Also introduce ipv{4,6}_addr_to_string() which take care of converting an address/netmask pair into string representation in a way which doesn't upset covscan (since that didn't detect that 'buf' may not be exceeded by the strings written into it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>