summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* tests: shell: Test delinearization of native nftables expressionsPhil Sutter2022-09-221-0/+26
| | | | | | | | Even if iptables-nft doesn't generate them anymore, it should continue to correctly parse them. Make sure this is tested for. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Revert "nft: prefer payload to ttl/hl module"/'meta pkttype' match.Florian Westphal2022-09-221-65/+0
| | | | | | | | | | | | | | | | This reverts commit 8acaccf69c22fb195a0b88e28489792304728245. This reverts commit 793caef9076cceb24336b6cbb8f55107de49f269. As per ongoing discussion, keep the dissection side but keep using nft_compat mode for now until we've figured out how to handle backwards compatibility with older iptables-nft binaries dumping the ruleset. Furthermore, "nft: prefer native 'meta pkttype' instead of xt match" broke ebtables: it has its own, incompatible pkttype match and needs special handling. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: un-break among match with concatenationFlorian Westphal2022-09-221-1/+1
| | | | | | | | | | The kernel commit 88cccd908d51 ("netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags") breaks ebtables-nft 'among' emulation, it sets NFTA_SET_ELEM_KEY_END but doesn't set the CONCAT flag. Update uapi header and also set CONCAT. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: prefer payload to ttl/hl moduleFlorian Westphal2022-09-131-0/+43
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: support ttl/hoplimit dissectionFlorian Westphal2022-09-134-0/+76
| | | | | | | xlate raw "nft ... ttl eq 1" and so on to the ttl/hl matches. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: prefer native 'meta pkttype' instead of xt matchFlorian Westphal2022-09-081-0/+22
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: support dissection of meta pkktype modeFlorian Westphal2022-09-081-0/+25
| | | | | | | Makes iptables-nft-save dump 'nft meta pkttype' rules. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: Expand extended error reporting to nft_cmd, tooPhil Sutter2022-08-264-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce the same embedded 'error' struct in nft_cmd and initialize it with the current value from nft_handle. Then in preparation phase, update nft_handle's error.lineno with the value from the current nft_cmd. This serves two purposes: * Allocated batch objects (obj_update) get the right lineno value instead of the COMMIT one. * Any error during preparation may be reported with line number. Do this and change the relevant fprintf() call to use nft_handle's lineno instead of the global 'line' variable. With this change, cryptic iptables-nft-restore error messages should finally be gone: | # iptables-nft-restore <<EOF | *filter | -A nonexist | COMMIT | EOF | iptables-nft-restore: line 2 failed: No chain/target/match by that name. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-restore: Extend failure error messagePhil Sutter2022-08-261-1/+4
| | | | | | | | | | | | | | | If a line causes zero 'ret' value and errno is set, call nft_strerror() for a more detailed error message. While not perfect, it helps with debugging ominous "line NN failed" messages pointing at COMMIT: | # iptables-nft-restore <<EOF | *filter | -A nonexist | COMMIT | EOF | iptables-nft-restore: line 3 failed: No chain/target/match by that name. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: add ebtables among testcaseYi Chen2022-08-031-0/+98
| | | | | | Validate that matching works as expected. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: fix ebtables among match when mac+ip addresses are usedFlorian Westphal2022-08-021-2/+2
| | | | | | | | | | | When matching mac and ip addresses, the ip address needs to be placed into then 2nd 32bit register, the switch to dynamic register allocation instead re-uses reg1, this partially clobbers the mac address, so set lookup comes up empty even though it should find a match. Fixes: 7e38890c6b4fb ("nft: prepare for dynamic register allocation") Reported-by: Yi Chen <yiche@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Print protocol numbers if --numeric was givenPhil Sutter2022-07-294-11/+11
| | | | | | | | | | This is much trickier than expected: On one hand, proto_to_name() is used to lookup protocol extensions so must resolve despite FMT_NUMERIC being set. On the other, --verbose implies --numeric but changing the output there is probably a bad idea. Luckily the latter situation is identified by FMT_NOTABLE bit. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix for missing space after 'prot' columnPhil Sutter2022-07-292-3/+3
| | | | | | | Format string ensured a minimum field width of five characters, but allowed for longer strings to eat the column delimiting white space. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix testcases for changed ip6tables opts outputPhil Sutter2022-07-292-11/+11
| | | | | | | | Adjust captured output, ip6tables prints '--' instead of spaces since the commit in Fixes: tag. Fixes: 6e41c2d8747b2 ("iptables: xshared: Ouptut '--' in the opt field in ipv6's fake mode") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables: xshared: Ouptut '--' in the opt field in ipv6's fake modeErik Skultety2022-07-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fact that the 'opt' table field reports spaces instead of '--' for IPv6 as it would have been the case with IPv4 has a bit of an unfortunate side effect that it completely confuses the 'jc' JSON formatter tool (which has an iptables formatter module). Consider: # ip6tables -L test Chain test (0 references) target prot opt source destination ACCEPT all a:b:c:: anywhere MAC01:02:03:04:05:06 Then: # ip6tables -L test | jc --iptables [{"chain":"test", "rules":[ {"target":"ACCEPT", "prot":"all", "opt":"a:b:c::", "source":"anywhere", "destination":"MAC01:02:03:04:05:06" }] }] which as you can see is wrong simply because whitespaces are considered as a column delimiter. [ Florian: added 'Link' for more background info. The '--' difference exists for > 20 years, but changing it appears to be least intrusive option. ] Link: https://lore.kernel.org/netfilter-devel/bb391c763171f0c5511f73e383e1b2e6a53e2014.1658322396.git.eskultet@redhat.com/t/#u Signed-off-by: Erik Skultety <eskultet@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: Define XT_OPTION_OFFSET_SCALE in xtables.hPhil Sutter2022-06-231-4/+0
| | | | | | | | This is the last symbol in xshared.h used by libxtables, move it over. Again, treat this as "implementation detail" and hence put it behind XTABLES_INTERNAL-curtains. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Move struct xtables_afinfo into xtables.hPhil Sutter2022-06-231-22/+0
| | | | | | | | | | | | | The library "owns" this structure and maintains 'afinfo' pointer to instances of it. With libxt_set, there's even an extension making use of the data. To avoid impact on library users, guard it by XTABLES_INTERNAL. To eliminate the xshared.h include by libxt_set, DEBUGP has to be redefined. Other extensions have similar defines, fix this later. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-monitor: add missing spaces in printed strAnton Luka Šijanec2022-06-231-2/+2
| | | | | | | | | | when printing the ID and OPTs in iptables/xtables-monitor.c, a space is missing after the string, thereby concatenating the number with the next item in the printed PACKET line. Fixes: d26c538b9a549 ("xtables: add xtables-monitor") Signed-off-by: Anton Luka Šijanec <anton@sijanec.eu> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Exit if nftnl_alloc_expr failsPhil Sutter2022-06-211-15/+16
| | | | | | | | | | In some code-paths, 'reg' pointer remaining uninitialized is used later so at least minimal error checking is necessary. Given that a call to nftnl_alloc_expr() with sane argument should never fail, complain and exit if it happens. Fixes: 7e38890c6b4fb ("nft: prepare for dynamic register allocation") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables.8: mention that iptables exits when setuidFlorian Westphal2022-06-171-0/+5
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-restore: Deny --init-tablePhil Sutter2022-06-111-0/+3
| | | | | | | Allowing this segfaults the program. The deny is in line with legacy ebtables, so no point in implementing support for that. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Extend zero counters test a bit furtherPhil Sutter2022-06-111-0/+15
| | | | | | Test zeroing a single rule's counters as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Extend iptables-xml test a bitPhil Sutter2022-06-111-9/+1
| | | | | | | | Call with --combine as well, even though output doesn't differ. Also there's no need to skip for xtables-nft-multi, it provides the same functionality. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Add some more rules to 0002-verbose-output_0Phil Sutter2022-06-111-0/+15
| | | | | | This increases coverage of function print_match() from 0 to 86.6%. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Add --enable-profiling configure optionPhil Sutter2022-06-111-0/+1
| | | | | | A little convenience to prepare a build for analysis with gcov/gprof. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Make some functions staticPhil Sutter2022-06-102-34/+17
| | | | | | | | With all ip(6)tables variants using the same do_parse() function, quite a bunch of functions are not used outside of xshared.c anymore. Make them static. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-legacy: Drop redundant include of xtables-multi.hPhil Sutter2022-06-101-4/+0
| | | | | | | | The header is included unconditionally first, so no point in doing it a second time of ENABLE_NFTABLES is defined. Fixes: be70918eab26e ("xtables: rename xt-multi binaries to -nft, -legacy") Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables: Support -x/--exact flagPhil Sutter2022-06-081-1/+1
| | | | | | | | | | Legacy arptables accepts but ignores the flag. Yet there are remains of the functionality in sources, like OPT_EXPANDED define and a print_num() function which acts on FMT_KILOMEGAGIGA flag being set or not. So instead of mimicking legacy behaviour by explicitly ignoring -x flag for arptables, just enable the feature for it. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Check overhead in iptables-save and -restorePhil Sutter2022-06-021-0/+37
| | | | | | | Some repeated calls have been reduced recently, assert this in a test evaluating strace output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* treewide: use uint* instead of u_int*Nick Hainke2022-05-182-2/+2
| | | | | | | | | | | | | | | | | | | | Gcc complains about missing types. Some commits introduced u_int* instead of uint*. Use uint treewide. Fixes errors in the form of: In file included from xtables-legacy-multi.c:5: xshared.h:83:56: error: unknown type name 'u_int16_t'; did you mean 'uint16_t'? 83 | set_option(unsigned int *options, unsigned int option, u_int16_t *invflg, | ^~~~~~~~~ | uint16_t make[6]: *** [Makefile:712: xtables_legacy_multi-xtables-legacy-multi.o] Error 1 Avoid libipq API breakage by adjusting libipq.h include accordingly. For arpt_mangle.h kernel uAPI header, apply same change as in kernel commit e91ded8db5747 ("uapi: netfilter_arp: use __u8 instead of u_int8_t"). Signed-off-by: Nick Hainke <vincent@systemli.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix build for -Werror=format-securityPhil Sutter2022-05-131-1/+1
| | | | | | Gcc complains about the omitted format string. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix EPERM handling for extensions without rev 0Phil Sutter2022-05-112-4/+13
| | | | | | | | | | Treating revision 0 as compatible in EPERM case works fine as long as there is a revision 0 of that extension defined in DSO. Fix the code for others: Extend the EPERM handling to all revisions and keep the existing warning for revision 0. Fixes: 17534cb18ed0a ("Improve error messages for unsupported extensions") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Drop xtables_globals 'optstring' fieldPhil Sutter2022-05-117-7/+20
| | | | | | | | | | | Define the different optstrings in xshared.h instead, they are not relevant for other libxtables users. This is a partial revert of commit 65b150ae382a8 ("xshared: Store optstring in xtables_globals") to avoid breaking libxtables' ABI compatibility. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Extend xtables_printhelp() for arptablesPhil Sutter2022-05-116-118/+43
| | | | | | | | | | | | | | | | | | | | | | | | The function checks afinfo->family already to cover ip6tables specifics, doing the same for arptables does not make things much worse. This changes arptables-nft help output slightly: * List possible negations extrapositioned, which is preferred anyway (arptables-nft supports both) * List --out-interface option at lexically sorted position * Print --wait option, it's ignored just like with iptables * Restore default target option printing as with legacy arptables (not sure if arptables-nft ever did this) by explicitly loading them. While being at it, add --set-counters short option '-c' to help output for ip(6)tables. This effectively removes the need for (and all users of) xtables_global's 'print_help' callback, thus effectively reverts commit fe83b12fc910e ("libxtables: Introduce xtables_globals print_help callback") which broke libxtables' ABI compatibility. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Move arp_opcodes into shared spacePhil Sutter2022-05-117-28/+21
| | | | | | | It will be referenced by xtables_printhelp() if printing for arptables and therefore must be present in legacy as well even if unused. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: split gen_payload() to allocate register and initialize expressionPablo Neira Ayuso2022-05-021-4/+14
| | | | | | Add __gen_payload(), in preparation for the dynamic register allocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: prepare for dynamic register allocationPablo Neira Ayuso2022-05-026-94/+137
| | | | | | | | | Store the register that has been allocated and pass it on to the next expression. NFT_REG_1 is still used. No functional changes are expected. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: pass handle to helper functions to build netlink payloadPablo Neira Ayuso2022-05-027-66/+73
| | | | | | | Pass struct nft_handle to helper functions in preparation for the dynamic register allocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: native mark matching supportPablo Neira Ayuso2022-05-022-0/+59
| | | | | | Use meta mark + bitwise + cmp instead of nft_compat mark match. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: pass struct nft_xt_ctx to parse_meta()Pablo Neira Ayuso2022-05-026-10/+10
| | | | | | In preparation for native mark match support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-shared: update context register for bitwise expressionPablo Neira Ayuso2022-05-021-0/+2
| | | | | | | | Update the destination register, otherwise nft_parse_cmp() gives up on interpreting the cmp expression when bitwise sreg != dreg. Fixes: 2c4a34c30cb4 ("iptables-compat: fix address prefix") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: Boost rule target checks by announcing chain namesPhil Sutter2022-03-172-0/+2
| | | | | | | | | | | | | | | | | When restoring a ruleset, feed libxtables with chain names from respective lines to avoid an extension search. While the user's intention is clear, this effectively disables the sanity check for clashes with target extensions. But: * The check yielded only a warning and the clashing chain was finally accepted. * Users crafting iptables dumps for feeding into iptables-restore likely know what they're doing. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Reject standard targets as chain names when restoringPhil Sutter2022-03-173-7/+4
| | | | | | | | | | | | | Reuse parse_chain() called from do_parse() for '-N' and rename it for a better description of what it does. Note that by itself, this patch will likely kill iptables-restore performance for big rulesets due to the extra extension lookup for chain lines. A following patch announcing those chains to libxtables will alleviate that. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Florian Westphal <fw@strlen.de>
* tests: shell: Fix 0004-return-codes_0 for static buildsPhil Sutter2022-03-151-1/+1
| | | | | | | In static builds, xtables_find_match() returns a slightly different error message if not found - make grep accept both. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Review static extension loadingPhil Sutter2022-03-154-16/+13
| | | | | | | | Combine the init_extensions() call common to all families, do not load IPv6 extensions for iptables and vice versa, drop the outdated comment about "same table". Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Call init_extensions{,a,b}() for static buildsEtienne Champetier2022-03-157-3/+26
| | | | | | | | | | Add calls to arp- and ebtables-specific extension loaders where missing. Also consistently call init_extensions() for them, as some extensions (ebtables 'limit' and arptables 'CLASSIFY' and 'MARK') live in libxt_* files. Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Simplify static build extension loadingPhil Sutter2022-03-1511-29/+0
| | | | | | | | | | Instead of guarding all calls to init_extensions*(), define stubs if not used. While at it, also add the missing prototypes for arp- and ebtables extension initializers. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Don't pass command state opaque to family ops callbacksPhil Sutter2022-03-108-102/+84
| | | | | | | | | | | There are no family-specific versions of struct iptables_command_state anymore, so no need to hide it behind void pointer. Pass the type as-is and save a few casts. While at it, drop unused callbacks parse_bitwise and parse_cmp. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* xshared: Prefer xtables_chain_protos lookup over getprotoentPhil Sutter2022-03-101-4/+4
| | | | | | | | | | | | | | | | | | | | | | | When dumping a large ruleset, common protocol matches such as for TCP port number significantly slow down rule printing due to repeated calls for getprotobynumber(). The latter does not involve any caching, so /etc/protocols is consulted over and over again. As a simple countermeasure, make functions converting between proto number and name prefer the built-in list of "well-known" protocols. This is not a perfect solution, repeated rules for protocol names libxtables does not cache (e.g. igmp or dccp) will still be slow. Implementing getprotoent() result caching could solve this. As a side-effect, explicit check for pseudo-protocol "all" may be dropped as it is contained in the built-in list and therefore immutable. Also update xtables_chain_protos entries a bit to align with typical /etc/protocols contents. The testsuite assumes those names, so the preferred ones prior to this patch are indeed uncommon nowadays. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Speed up immediate parsingPhil Sutter2022-03-102-19/+19
| | | | | | | | | | | | | | | | | | | | | | | | | Parsing of rules which jump to a chain pointlessly causes a call to xtables_find_target() despite the code already knowing the outcome. Avoid the significant delay for rulesets with many chain jumps by performing the (standard) target lookup only for accept/drop/return verdicts. From a biased test-case on my VM: | # iptables-nft-save | grep -c -- '-j' | 133943 | # time ./old/iptables-nft-save >/dev/null | real 0m45.566s | user 0m1.308s | sys 0m8.430s | # time ./new/iptables-nft-save >/dev/null | real 0m3.547s | user 0m0.762s | sys 0m2.476s Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>