summaryrefslogtreecommitdiffstats
path: root/iptables/xtables-translate.c
Commit message (Collapse)AuthorAgeFilesLines
* xtables-translate: Use proper clear_cs functionPhil Sutter2020-06-161-1/+1
| | | | | | | Avoid memleaks by performing a full free of any allocated data in local iptables_command_state variable. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: don't fail if help was requestedArturo Borrero Gonzalez2020-06-161-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | If the user called `iptables-translate -h` then we have CMD_NONE and we should gracefully handle this case in do_command_xlate(). Before this patch, you would see: user@debian:~$ sudo iptables-translate -h [..] nft Unsupported command? user@debian:~$ echo $? 1 After this patch: user@debian:~$ sudo iptables-translate -h [..] user@debian:~$ echo $? 0 Fixes: d4409d449c10fa ("nft: Don't exit early after printing help texts") Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
* libxtables: Introduce xtables_fini()Phil Sutter2020-05-111-0/+2
| | | | | | | | | | | | Record handles of loaded shared objects in a linked list and dlclose() them from the newly introduced function. While functionally not necessary, this clears up valgrind's memcheck output when also displaying reachable memory. Since this is an extra function that doesn't change the existing API, increment both current and age. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Review nft_init()Phil Sutter2020-02-241-1/+1
| | | | | | | | | | | | | | | | | Move common code into nft_init(), such as: * initial zeroing nft_handle fields * family ops lookup and assignment to 'ops' field * setting of 'family' field This requires minor adjustments in xtables_restore_main() so extra field initialization doesn't happen before nft_init() call. As a side-effect, this fixes segfaulting xtables-monitor binary when printing rules for trace event as in that code-path 'ops' field wasn't initialized. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Fix for iface++Phil Sutter2020-02-141-3/+3
| | | | | | | | | In legacy iptables, only the last plus sign remains special, any previous ones are taken literally. Therefore xtables-translate must not replace all of them with asterisk but just the last one. Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Fix for interface name corner-casesPhil Sutter2020-02-111-5/+28
| | | | | | | | | | | | | | | | | | There are two special situations xlate_ifname() didn't cover for: * Interface name containing '*': This went unchanged, creating a command nft wouldn't accept. Instead translate into '\*' which doesn't change semantics. * Interface name being '+': Can't translate into nft wildcard character as nft doesn't accept asterisk-only interface names. Instead decide what to do based on 'invert' value: Skip match creation if false, match against an invalid interface name if true. Also add a test to make sure future changes to this behaviour are noticed. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Guard strcpy() call in xlate_ifname()Phil Sutter2019-12-061-3/+2
| | | | | | | | The function potentially fed overlong strings to strcpy(). Given that everything needed to avoid this is there, reorder code a bit to prevent those inputs, too. Fixes: 0ddd663e9c167 ("iptables-translate: add in/out ifname wildcard match translation to nft")
* xtables-restore: Integrate restore callbacks into struct nft_xt_restore_parsePhil Sutter2019-11-061-2/+4
| | | | | | | | There's really no point in passing those as separate parameter. While being at it, make them static const everywhere. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Constify struct nft_xt_restore_cbPhil Sutter2019-10-181-1/+1
| | | | | | | | There is no need for dynamic callback mangling, so make all instances static const. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Use xt_params->program_namePhil Sutter2019-10-181-1/+1
| | | | | | | | | | | Instead of setting newargv[0] to argv[0]'s value, just use whatever xt_params->program_name contains. The latter is arbitrarily defined, but may still be more correct than real argv[0] which may simply be for instance xtables-nft-multi. Either way, there is no practical significance since newargv[0] is used exclusively in debug output. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace IPTABLES_VERSION by PACKAGE_VERSIONJan Engelhardt2019-05-301-5/+5
| | | | | | | | | | | | | The IPTABLES_VERSION C macro replicates the PACKAGE_VERSION C macro (both have the same definition, "@PACKAGE_VERSION@"). Since IPTABLES_VERSION, being located in internal.h, is not exposed to downstream users in any way, it can just be replaced by PACKAGE_VERSION, which saves a configure-time file substitution. This goes towards eliminating unnecessary rebuilds after rerunning ./configure. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: unify user chain add/flush for restore caseFlorian Westphal2019-04-271-3/+3
| | | | | | | | | | | | The idea here is to move the 'flush' decision into the core, rather than have the decision in the frontend. This will be required later when "generation id" is passed to kernel. In this case, we might have to add the flush when re-trying the transaction. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: constify struct builtin_table and struct builtin_chainPablo Neira Ayuso2018-11-191-1/+1
| | | | | | These definitions should be const, propagate this to all existing users. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix for spurious errors from iptables-translatePhil Sutter2018-10-231-0/+1
| | | | | | | | | | | | When aligning iptables-nft error messages with legacy ones, I missed that translate tools shouldn't check for missing or duplicated chains. Introduce a boolean in struct nft_xt_cmd_parse indicating we're "just" translating and do_parse() should skip the checks. Fixes: b6a06c1a215f8 ("xtables: Align return codes with legacy iptables") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add nf_tables vs. legacy postfix to version stringsFlorian Westphal2018-06-181-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | -V now yields: arptables vlibxtables.so.12 (nf_tables) ebtables 1.6.2 (nf_tables) ip6tables v1.6.2 (legacy) ip6tables v1.6.2 (nf_tables) ip6tables-restore v1.6.2 (nf_tables) ip6tables-save v1.6.2 (nf_tables) ip6tables-restore v1.6.2 (legacy) ip6tables-restore-translate v1.6.2 ip6tables-save v1.6.2 (legacy) ip6tables-translate v1.6.2 (nf_tables) iptables v1.6.2 (legacy) iptables v1.6.2 (nf_tables) iptables-restore v1.6.2 (nf_tables) iptables-save v1.6.2 (nf_tables) iptables-restore v1.6.2 (legacy) iptables-restore-translate v1.6.2 iptables-save v1.6.2 (legacy) iptables-translate v1.6.2 (nf_tables) This allows to see wheter "iptables" is using old set/getsockopt or new nf_tables infrastructure. Suggested-by: Harald Welte <laforge@gnumonks.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: pass correct table skeletonFlorian Westphal2018-05-101-1/+17
| | | | | | | | This always uses xtables_ipv4 (which is same as _ipv6). Pass the correct skeleton instead, this is needed to handle ebtables correctly from xt-translate, as it doesn't use ip/ip6 tables. Signed-off-by: Florian Westphal <fw@strlen.de>
* xt-translate: quote interface names in translated outputFlorian Westphal2018-04-191-1/+1
| | | | | | | it its good practice as interface names can be virtually any identifier and could clash with nft keywords. Signed-off-by: Florian Westphal <fw@strlen.de>
* xlate-translate: split common parts into helperFlorian Westphal2018-04-131-33/+26
|
* xtables-translate: rm duplicate includesFlorian Westphal2018-04-131-5/+0
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat-restore: use correct hook prioritiesFlorian Westphal2018-02-171-5/+31
| | | | | | | Currently defaulted to 0, it should reflect the one from xtables to get the right ordering. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat-restore: fix translation of mangle's OUTPUTLouis Sautier2017-09-101-0/+2
| | | | | | This chain should be translated as a route chain, not as a filter chain. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate: fix double space before commentPablo M. Bermudo Garay2017-06-061-5/+6
| | | | | | | | | | | | When a comment translation immediately follows a counter statement, two spaces are printed between "counter" and "comment" keywords. The counter statement is almost always followed by a target, so we need to move the space following "counter" to the beginning of the target translation. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Remove unnecessary braces.Varsha Rao2017-04-061-4/+2
| | | | | | | | | | | | | | | | | Remove braces which are not required, to fix the check patch issue. The following coccinelle script was used to fix this issue. @@ expression e; expression e1; @@ if(e) -{ e1; -} Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: print nft iff there are more expanded rules to printPablo Neira Ayuso2017-03-091-1/+1
| | | | | | | | | | | | | | | $ iptables-translate -I INPUT -s yahoo.com nft insert rule ip filter INPUT ip saddr 98.139.183.24 counter nft insert rule ip filter INPUT ip saddr 206.190.36.45 counter nft insert rule ip filter INPUT ip saddr 98.138.253.109 counter nft This extra 'nft' print is incorrect, just print it if there are more rules to be printed. Reported-by: Alexander Alemayhu <alexander@alemayhu.com> Tested-by: Alexander Alemayhu <alexander@alemayhu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: print nft command for each expand rules via dns namesPablo Neira Ayuso2017-03-081-0/+2
| | | | | | | | | | | | | | | | | | | | We have to print nft at the very beginning for each rule that rules from the expansion, otherwise the output is not correct: # iptables-translate -I INPUT -s yahoo.com nft insert rule ip filter INPUT ip saddr 206.190.36.45 counter insert rule ip filter INPUT ip saddr 98.138.253.109 counter insert rule ip filter INPUT ip saddr 98.139.183.24 counter After this patch: # iptables-translate -I INPUT -s yahoo.com nft insert rule ip filter INPUT ip saddr 206.190.36.45 counter nft insert rule ip filter INPUT ip saddr 98.138.253.109 counter nft insert rule ip filter INPUT ip saddr 98.139.183.24 counter Reported-by: Alexander Alemayhu <alexander@alemayhu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate: Avoid querying the kernelPhil Sutter2017-03-081-0/+10
| | | | | | | | | | | | | | | This originally came up when accidentally calling iptables-translate as unprivileged user - nft_compatible_revision() then fails every time, making the translator fall back to using revision 0 only which often leads to failed translations (due to missing xlate callback). The bottom line is there is no need to check what revision of a given iptables match the kernel supports when it is only to be translated into an nftables equivalent. So just assign a dummy callback returning good for any revision being asked for. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate: Fix chain type when translating nat tablePhil Sutter2016-11-291-6/+12
| | | | | | | | | | | | | | | | | | | | | | | This makes the type of translated chains in nat table to be of type 'nat' instead of 'filter' which is incorrect. Verified like so: | $ iptables-restore-translate -f /dev/stdin <<EOF | *nat | :POSTROUTING ACCEPT [0:0] | [0:0] -A POSTROUTING -j MASQUERADE | COMMIT | EOF | # Translated by ./install/sbin/iptables-restore-translate v1.6.0 on Mon Nov 28 12:11:30 2016 | add table ip nat | add chain ip nat POSTROUTING { type nat hook postrouting priority 0; policy accept; } | add rule ip nat POSTROUTING counter masquerade Ditto for ip6tables-restore-translate. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate: Support setting standard chain policyPhil Sutter2016-11-291-5/+11
| | | | | | | | | Looks like this bit was simply forgotten when implementing xlate_chain_set() as everything needed was there to just print the desired policy along with the chain definition. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate-restore: do not escape quotesPablo M. Bermudo Garay2016-09-051-2/+4
| | | | | | | | If quotes are escaped, nft -f is unable to parse and load the translated ruleset. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: add in/out ifname wildcard match translation to nftLiping Zhang2016-08-011-0/+17
| | | | | | | | | | | | | | | In iptables, "-i eth+" means match all in ifname with the prefix "eth". But in nftables, this was changed to "iifname eth*". So we should handle this subtle difference. Apply this patch, translation will become: # iptables-translate -A INPUT -i eth+ nft add rule ip filter INPUT iifname eth* counter # ip6tables-translate -A OUTPUT ! -o eth+ nft add rule ip6 filter OUTPUT oifname != eth* counter Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate: fix issue with quotesPablo M. Bermudo Garay2016-07-271-0/+2
| | | | | | | | | | | | | | | | | | | | | Some translations included escaped quotes when they were called from nft: $ sudo nft list ruleset table ip mangle { chain FORWARD { type filter hook forward priority -150; policy accept; ct helper \"ftp\" counter packets 0 bytes 0 ^^ ^^ } } This behavior is only correct when xlate functions are called from a xtables-translate command. This patch solves that issue using a new parameter (escape_quotes) in the xlate functions. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce struct xt_xlate_{mt,tg}_paramsPablo Neira Ayuso2016-07-251-5/+15
| | | | | | | | This structure is an extensible containers of parameters, so we don't need to propagate interface updates in every extension file in case we need to add new parameters in the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate: fix multiple spaces issuePablo M. Bermudo Garay2016-07-091-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a multiple spaces issue. The problem arises when a rule set loaded through iptables-compat-restore is listed in nft. Before this commit, two spaces were printed after every match translation: $ sudo iptables-save *filter :INPUT ACCEPT [0:0] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m multiport --dports 80:85 -m ttl --ttl-gt 5 -j ACCEPT COMMIT $ sudo iptables-compat-restore iptables-save $ sudo nft list ruleset table ip filter { chain INPUT { type filter hook input priority 0; policy accept; ct state related,established counter packets 0 bytes 0 accept ^^ ip protocol tcp tcp dport 80-85 ip ttl gt 5 counter packets 0 bytes 0 accept ^^ ^^ } } Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: Don't print "nft" in iptables-restore-translate commandGuruswamy Basavaiah2016-04-271-1/+3
| | | | | | | | No need to print "nft" in function do_command_xlate, if the function is called from iptables-restore-translate command. Signed-off-by: Guruswamy Basavaiah <guru2018@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: Printing the table name before chain name.Guruswamy Basavaiah2016-04-271-1/+1
| | | | | | | | | | | | | | | Command ./iptables-restore-translate, was printing table name before the chain name for user added chains. This is breaking ./nft -f command. Before fix, output of "./iptables-restore-translate" add chain ip OUTPUT_direct raw After fix: add chain ip raw OUTPUT_direct Signed-off-by: Guruswamy Basavaiah <guru2018@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: translate iptables --flushGuruswamy Basavaiah2016-03-221-0/+8
| | | | | | | | | | | | | translation for iptables --flush Examples: $ sudo iptables-translate -F INPUT nft flush chain ip filter INPUT $ sudo iptables-translate -F -t nat nft flush table ip nat Signed-off-by: Guruswamy Basavaiah <guru2018@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: pass ipt_entry and ip6t_entry to ->xlate()Pablo Neira Ayuso2016-03-091-2/+4
| | | | | | | The multiport match needs it, this basically leaves ->xlate() indirection with almost the same interface as ->print(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: extensions: iptables-translate prints extra "nft" after printing ↵Guruswamy Basavaiah2016-03-011-1/+1
| | | | | | | | | | | | | | | | | | | | any error Output of command "./iptables-translate junk" is Bad argument `junk' Try `iptables-translate -h' or 'iptables-translate --help' for more information. nft Output of command "./iptables-translate -B" is iptables-translate v1.6.0: unknown option "-B" Try `iptables-translate -h' or 'iptables-translate --help' for more information. nft nft should have not been printed in both the cases. Moving the printf call after the do_parse function call Signed-off-by: Guruswamy Basavaiah <guru2018@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: rename xt_buf to xt_xlatePablo Neira Ayuso2016-02-161-15/+15
| | | | | | | Use a more generic name for this object to prepare the introduction of other translation specific fields. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: xtables: add the infrastructure to translate from iptables to nftPablo Neira Ayuso2016-02-161-0/+463
This patch provides the infrastructure and two new utilities to translate iptables commands to nft, they are: 1) iptables-restore-translate which basically takes a file that contains the ruleset in iptables-restore format and converts it to the nft syntax, eg. % iptables-restore-translate -f ipt-ruleset > nft-ruleset % cat nft-ruleset # Translated by iptables-restore-translate v1.4.21 on Mon Apr 14 12:18:14 2014 add table ip filter add chain ip filter INPUT { type filter hook input priority 0; } add chain ip filter FORWARD { type filter hook forward priority 0; } add chain ip filter OUTPUT { type filter hook output priority 0; } add rule ip filter INPUT iifname lo counter accept # -t filter -A INPUT -m state --state INVALID -j LOG --log-prefix invalid: ... The rules that cannot be translated are left commented. Users should be able to run this to track down the nft progress to see at what point it can fully replace iptables and their filtering policy. 2) iptables-translate which suggests a translation for an iptables command: $ iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT nft add rule filter OUTPUT ip protocol udp ip dst 8.8.8.8 counter accept Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>