summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* xtables: do not proceed if nft_init failsPablo Neira Ayuso2013-12-304-4/+26
| | | | | | | Fix a crash if nft_init fails, it happens if nfnetlink support is not available in your Linux kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix another memleak in nft_rule_list_cbGiuseppe Longo2013-12-301-0/+1
| | | | | Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: print counter issuesGiuseppe Longo2013-12-301-4/+12
| | | | | | | | The patch fixes the counter print, missing line, and delete warnings. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: break loop after found matching chainGiuseppe Longo2013-12-301-0/+7
| | | | | | | | This patch breaks looping in nft_chain_user_del, nft_chain_zero_counters and nft_rule_flush after the chain is found. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: nft: remove lots of useless debugging messagesPablo Neira Ayuso2013-12-301-109/+43
| | | | | | While at it, fix several memleaks of list objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: remove bogus comment on chain renamePablo Neira Ayuso2013-12-301-1/+0
| | | | | | | No longer true since Patrick added the chain rename approach back in September 2012. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: allow to zero chains via -ZGiuseppe Longo2013-12-303-20/+71
| | | | | Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix leaks in nft_xtables_config_loadPablo Neira Ayuso2013-12-301-0/+9
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix leak of chain iterator in nft_rule_listGiuseppe Longo2013-12-301-0/+1
| | | | | Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix leak of rule and chain iteratorsGiuseppe Longo2013-12-301-0/+4
| | | | | | | This patch fixes the leak of chain and rule iterators. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: fix -p protocolPablo Neira Ayuso2013-12-302-3/+9
| | | | | | | | The protocol field in both IPv4 and IPv6 headers are 8 bits long, so we have to compare 8 bits. Reported-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: output the same error message that iptables-restore usesPablo Neira Ayuso2013-12-302-14/+3
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: don't call nft_init in nft_xtables_config_loadPablo Neira Ayuso2013-12-302-2/+2
| | | | | | Otherwise we keep initializing the handle over and over again. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: fix compilation due to missing autogenerated headerPablo Neira Ayuso2013-12-301-1/+1
| | | | | | | | | | | | Fix compilation: nft.c:51:35: fatal error: xtables-config-parser.h: File or directory doesn't exist xtables-config-parser.h was generated after compiling nft.c. Reported-by: Giuseppe Longo <giuseppelng@gmail.com> Tested-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: policy can be changed only on builtin chainTomasz Bursztyka2013-12-301-9/+2
| | | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: initialize xtables defaults even on listing rulesTomasz Bursztyka2013-12-301-0/+4
| | | | | | | Output of the tool should be the same as for iptables. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: remove unused leftover definitionsPablo Neira Ayuso2013-12-301-16/+0
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add new nft_ops->post_parse hookPablo Neira Ayuso2013-12-304-131/+139
| | | | | | | Move specific layer 3 protocol post argument parsing code to the respective nft-ipv[4|6].c files. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add new container xtables_args structurePablo Neira Ayuso2013-12-302-136/+145
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: update .gitignorePablo Neira Ayuso2013-12-301-0/+3
| | | | | | Ignore xtables-config-* generated by flex and bison. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-config-parser: fix compilation warningPablo Neira Ayuso2013-12-301-1/+1
| | | | | | | xtables-config-parser.y: In function ‘xtables_config_parse’: xtables-config-parser.y:216:4: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: fix missing protocol and invflagsPablo Neira Ayuso2013-12-304-1/+6
| | | | | | | | xtables -I INPUT -p tcp --dport 22 -j ACCEPT iptables: Target problem. Run `dmesg' for more information x_tables: ip_tables: tcp match: only valid for protocol Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: fix compilation when lib[mnl|nftables] are not in standard pathNicolas Dichtel2013-12-301-2/+2
| | | | | | | | | | There was several problems: a typo in the configure option a typo in CFLAGS addon for libmnl and libnftables paths to lib were missing on link Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-config: fix off by one in parsed strings from /etc/xtables.confPablo Neira Ayuso2013-12-301-5/+5
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: support family in /etc/xtables.conf filePablo Neira Ayuso2013-12-302-1/+32
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: load tables and chains based on /etc/xtables.confPablo Neira Ayuso2013-12-303-75/+112
| | | | | | | | | If /etc/xtables.conf is available, use the configuration there to autoload the xtables built-in table and chain so you can define custom configurations. Otherwise, rely on default common table/chain configuration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-config: priority has to be per-chain to supportPablo Neira Ayuso2013-12-302-8/+10
| | | | | | | To support NAT table chain configuration appropriately. Modify example configuration file as well. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-standalone: fix error messagePablo Neira Ayuso2013-12-301-3/+3
| | | | | | | | xtables -m tcp -h (nil) v1.4.15: ... ^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: fix missing xtables_exit_error definitionPablo Neira Ayuso2013-12-301-2/+22
| | | | | | | iptables_exit_error is defined in iptables/iptables.c, that symbol cannot be used by iptables/xtables.c Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: remove license for header filePablo Neira Ayuso2013-12-301-20/+0
| | | | | | | No tradition in the project to include the header file in .h file. This one is also internal - not exported. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-save: add -4 and -6 supportPablo Neira Ayuso2013-12-301-1/+9
| | | | | | | | | | Now you can specify: xtables-save -6 > my-ip6tables-ruleset to dump the IPv6 rule-set. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: add -4 and -6 supportPablo Neira Ayuso2013-12-303-3/+14
| | | | | | | | | | Now you can specify: xtables-restore -6 < my-ip6tables-ruleset to restore the IPv6 rule-set. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Split nft core to become family independantTomasz Bursztyka2013-12-308-893/+1077
| | | | | | | | | | | | This makes nft core code independant from the family. Each family needs to implement and provide a struct nft_family_ops {}. This split will ease the future support of bridge and arp rules manipulations. [ updated header files and rebased upon the current tree --pablo ] Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add xtables-eventsPablo Neira Ayuso2013-12-306-7/+234
| | | | | | | | | | | | | | Add new program to listen to rule updates: shell$ xtables-events -A INPUT -m state --state ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -D INPUT -p tcp -m tcp --dport 22 -j ACCEPT -D INPUT -m state --state ESTABLISHED -j ACCEPT You can use `-c' option to display counters. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: ipv6: fix -D with -pPablo Neira Ayuso2013-12-301-0/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: ipv6: add missing break in nft_parse_payload_ipv6Pablo Neira Ayuso2013-12-301-0/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: ipv6: fix wrong error if -p is usedPablo Neira Ayuso2013-12-301-4/+0
| | | | | | | | shell$ xtables -6 -I INPUT -p tcp --dport 22 -j ACCEPT xtables v1.4.15: -f is not valid on IPv6 Try `xtables -h' or 'xtables --help' for more information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix crash if TRACE is usedPablo Neira Ayuso2013-12-301-2/+4
| | | | | | And any other match and target with no save function defined. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: support test option `-t'Pablo Neira Ayuso2013-12-301-2/+8
| | | | | | You can now test if a rule-set is correct. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: nft: add protocol and flags for xtables over nf_tablesPablo Neira Ayuso2013-12-301-0/+8
| | | | | | Add protocol and flags for the compatibility layer. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: support atomic commitPablo Neira Ayuso2013-12-304-5/+82
| | | | | | | | | | | | | Use new services in nf_tables to support atomic commit. Commit per table, although we support global commit at once, call commit for each table to emulate iptables-restore behaviour by now. Keep table dormant/wake up code in iptables/nft.c as it can be used in the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: purge out user-define chains from the kernelPablo Neira Ayuso2013-12-303-13/+76
| | | | | | | xtables-restore has to purge out user-defined chains that are not defined in the configuration file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: fix compilation warningPablo Neira Ayuso2013-12-301-0/+3
| | | | | | | xtables-standalone.c: In function ‘xtables_main’: xtables-standalone.c:64:2: warning: implicit declaration of function ‘do_commandx’ [-Wimplicit-function-declaration] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: fix custom user chain restorationPablo Neira Ayuso2013-12-301-11/+20
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add IPv6 supportTomasz Bursztyka2013-12-305-292/+772
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary of changes to add IPv6 support to the xtables utility: * modify all commands (add, delete, replace, check and listing) to support IPv6 addresses. And for the internal nft library: * add family to struct nft_handle and modify all caller to use this family instead of the hardcoded AF_INET. * move code that we can re-use for IPv4 and IPv6 into helper functions. * add IPv6 rule printing support. * add support to parse IPv6 address. Pablo added several improvements to this patch: * added basic xtables-save and xtables-restore support (so it defaults to IPv4) * fixed a couple of bugs found while testing * added reference when -f is used to point to -m frag (until we can make this consistent with IPv4). Note that we use one single xtables binary utility for IPv4 and IPv6. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: fix crash due to using wrong globalsPablo Neira Ayuso2013-12-301-5/+5
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: adapt chain rename to recent Patrick's updatesPablo Neira Ayuso2013-12-301-3/+52
| | | | | | | This patch gets existing code in sync with Patrick's chain renaming new approach. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: add support for dormant tablesPablo Neira Ayuso2013-12-303-4/+61
| | | | | | This patch adds support for dormant tables for xtables-restore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: use chain typesPablo Neira Ayuso2013-12-301-3/+49
| | | | | | We use the new special chain types defined in the kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: use 64-bits handlePablo Neira Ayuso2013-12-302-5/+6
| | | | | | Now that we use that in kernel space and in libnftables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>