summaryrefslogtreecommitdiffstats
path: root/xtables.c
Commit message (Collapse)AuthorAgeFilesLines
* Don't load ip6?_tables module when already loadedMaciej Zenczykowski2011-04-191-5/+33
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge branch 'opts' of git://dev.medozas.de/iptablesPatrick McHardy2011-04-121-19/+6
|\
| * libxtables: guided option parserJan Engelhardt2011-04-061-19/+6
| | | | | | | | | | | | | | | | | | | | | | This patchset seeks to drastically reduce the code in the individual extensions by centralizing their argument parsing (breakdown of strings), validation, and in part, assignment. As a secondary goal, this reduces the number of static storage duration variables in flight. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | move 'int line' definition from ip6?tables.c into xtables.cMaciej Zenczykowski2011-04-051-0/+6
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | xtables: delay (statically built) match/target initializationMaciej Zenczykowski2011-04-041-5/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Matches and targets built into the iptables static binary will always be registered as the binary starts up, this may potentially (as a result of kernel version support checking) result in modules being autoloaded. This is undesirable (for example it may cause CONNMARK target to load and thus cause the kernel to load the conntrack module, which isn't a no-op). Transition to a system where matches and targets are registered into a pending list, from whence they get fully registered only when required. Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | xtables_ip6addr_to_numeric: fix typo in commentMaciej Zenczykowski2011-04-041-1/+1
|/ | | | | | | | | | An IPv6 address consists of eight hexadecimal 16-bit values seperated by colons, or alternatively, six (not five) of these followed by a colon and an IPv4 address in standard dotted decimal quad notation (for IPv4 mapped addresses and the like). Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* mark newly opened fds as FD_CLOEXEC (close on exec)Maciej Zenczykowski2011-04-041-0/+11
| | | | | | | (This is iptables-1.4.3.1-cloexec.patch from RedHat iptables.src.rpm) Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* xtables: use all IPv6 addresses resolved from a hostnameWes Campaigne2011-02-271-17/+12
| | | | | | | | | | | | | | Fixes a long-standing issue where host_to_ip6addr would only ever examine/return the first item of the address chain returned by getaddrinfo, instead of traversing the chain and copying each of them. This has always been how host_to_ip6addr behaves, and all of the other related IPv6 code is already written to handle multiple possible addresses. [Style fixups. Removal of redundant i<*naddrs check. -j.eng] Signed-off-by: Wes Campaigne <westacular@gmail.com>
* xtables: fix the broken detection/removal of redundant addressesWes Campaigne2011-02-271-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [To observe this issue, populate a hostname (DNS or local db) with multiple adresses across multiple subnets (cf. prefixlen below) # e.g. /etc/hosts 127.0.0.2 lo-x 127.0.0.3 lo-x 127.0.1.4 lo-x 127.0.1.5 lo-x 127.0.2.6 lo-x Then invoke xtables_ipparse_any by e.g. `-m conntrack --ctorigsrc lo-x/24`. -j.eng] This same block of code, apparently to detect if addresses are identical after applying the mask, and to skip the duplicates and the ones made redundant by the mask, has been present and unchanged from as far back as I could find (circa iptables 1.2). By inspection, it was wrong, and always has been: once the code finds a duplicate, it will drop the rest of the array one by one as it re-detects the same duplicate over and over. When the addresses came from a single hostname lookup, and their order was random, then this created unpredictable behaviour by iptables, which seem to ignore some of those addresses at random times. I suspect the original idea also involved a swap between the duplicate and the address from the (current) end of the array, but a line of code to do that seems to have never existed. I have finally added it. (Well, as much as is needed: there does not need to be a full swap, because we are just going to ignore the duplicate, pretend the array is one shorter, and never look at the contents of the end again. So, we can get away with just copying from the end.) [Reword comment about shuffle: replace by mentioning tail copy to replace dup. -j.eng] Signed-off-by: Wes Campaigne <westacular@gmail.com>
* xtables: fix excessive memory allocation in host_to_ipaddrWes Campaigne2011-02-261-1/+1
| | | | | | | host_to_ipaddr was unnecessarily asking for an array of length n^2 to store just n addresses. Signed-off-by: Wes Campaigne <westacular@gmail.com>
* libxtables: avoid confusing use of ai_protocol=IPPROTO_IPV6Wes Campaigne2011-02-221-2/+0
| | | | | | | | | | | | | [Split hunk from Wes's submission. Added commit message. -j.eng] ai_protocol normally specifies the L4 protocol one wants to specifically inquire about when a service (2nd parameter to getaddrinfo) is specified. Such a service lookup would potentially yield nothing, because there just is not any "mytunnel 2222/ipv6" in /etc/services, since IPPROTO_IPV6 itself is not a protocol with a concept of (port-based) services to begin with. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: fix memory scribble beyond end of arrayJan Engelhardt2011-02-211-2/+2
| | | | | | | | | | | | | | | When using -s "", the "n" variable in the code remains uninitialized and usually scribbes beyond the end of the array. Furthermore, "n" is just as big as entries in the last host lookup. When specifying more than one item to -s, e.g. "-s host,host", "n" is less than "count", and we are not masking the addresses at all (leaving them at addr/32 resp. addr/128). The issue goes back to the initial code from v1.4.5~21. References: http://bugs.debian.org/611990 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: use strspn() to check if string needs to be quotedMax Kellerman2011-02-171-1/+1
| | | | | | | | | | | | | | | | | | | | Problem: the call xtables_save_string("'") prints just a single quote, not enclosed in double quoted and not escaped. Steps to reproduce: $ iptables -A foo -m comment --comment "'" -j ACCEPT $ iptables-multi save|grep foo -A foo -m comment --comment ' -j ACCEPT The cause was the use of strcspn() to locate the first character which justified quoting the string in double quotes. That however was wrong, because the way strcspn() was called, it returned a pointer to the first character that was not to be escaped, which did the right thing most of the time, but not for strings consisting only of quote characters. This patch changes strcspn() to strspn(). Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: do not print trailing whitespacesJan Engelhardt2011-01-311-3/+3
| | | | | | | | | | | | | | | | | Due to the use of printf("foobar "), iptables emits spaces at the end-of-line, which looks odd to some users because it causes the terminal to wrap even if there is seemingly nothing to print. It may also have other points of annoyance, such as mailers interpreting a trailing space as an indicator that the paragraph continues when format=flowed is also on. And git highlights trailing spaces in red, so let's avoid :) Preexisting inconsistencies in outputting spaces in the right spot are also addressed right away. References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=429579 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: set custom opts to NULL on freeJan Engelhardt2011-01-311-1/+3
| | | | | | | | | When inside ip6tables-restore, xtables_free_opts can be called multiple times, especially when trying to exit with an error message from outside do_command. So set it to NULL so that we do not attempt to free a dangling pointer. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: improve error reporting with extension loading troublesJan Engelhardt2011-01-311-26/+27
| | | | | | | | | | | ip6tables v1.4.8: Could not load match "osf": /usr/lib/xtables/libip6t_osf.so: cannot open shared object file: No such file or directory Given that libxt_osf.so exists, a better error is now emitted. References: http://bugzilla.netfilter.org/show_bug.cgi?id=637 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: fix typo in error message of xtables_register_match()Li Yewang2011-01-091-1/+1
| | | | | Signed-off-by: Li Yewang <lyw@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: do some option structure checkingJan Engelhardt2011-01-081-0/+17
| | | | | | | libxt_recent's use of numeric values >200 always looked worrisome. Now here is a validation routine for such. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* ip[6]tables: only call match's parse function when option char is in rangeJan Engelhardt2011-01-081-2/+2
| | | | | | | | | | | | | | | | | Normally, extensions use a "default:" case in switch(c) to just return if they do not handle c. Apparently, libip6t_hl does that too late and checks for hl-specific parsing state before it has established that c refers to one of its own options. Also affected: libipt_ttl, libxt_ipvs, libxt_policy, libxt_statistic. One way to fix this is to move the flags checks into case '2', '3', '4'. Doing this replication feels bad, so as an alternative, let's just free extensions from having to deal with other extension's options passing thru. References: http://marc.info/?l=netfilter-devel&m=129444759532377&w=2 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: reorder num_old substraction for clarityJan Engelhardt2011-01-081-4/+7
| | | | | | | | When going over this again, I noticed we happen to malloc too much. That is no problem, but I felt moving the num_old adjustment upwards makes things more clear, and also addresses the allocation. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: use C99/POSIX typesJan Engelhardt2011-01-081-5/+5
| | | | | | "u_int" was a non-standardized extension predating C99 on some platforms. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: do not emit orig_opts twiceJan Engelhardt2010-11-281-0/+4
| | | | | | | This just happened to cross my eye; there was no error, but fixing this up saves a pitfall, and some memory. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix longopt reecognition and workaround getopt(3) behaviorJan Engelhardt2010-11-151-1/+2
| | | | | | | | | | | | | | | | | | | * On the first call to getopt, opts was NULL, so long options would not be recognized until a match/target was loaded. Whacky getopt behavior: * If the longopts parameter is NULL, getopt fails to recognize unknown options, such that `iptables-multi main --append` will print a garbage help message ("main needs an argument"). * If the longopts parameter is NULL on the first call, but not on subsequent calls, it completely screws up option parsing, taking the --dport in `iptables-multi main -A INPUT -p tcp --dport 1000` as --destination instead, but not accepting "--destination 1.2.3.4" either. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: change option precedence order to be intuitiveJan Engelhardt2010-10-291-22/+28
| | | | | | | | | | | | | When using `-m mark --mark 2 -m connmark --mark 2`, the user currently gets an error about the (libxt_mark) --mark option being used twice. This is because libxt_connmark's option table does not override any previous options. This patch changes this behavior, since the current behavior does not allow connmark's option to be used at all, which is illogical. Cc: Florian Westphal <fw@strlen.de> Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* xtables: remove unnecessary castJan Engelhardt2010-08-031-1/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: remove xtables_set_revision functionJan Engelhardt2010-06-071-8/+0
| | | | | | | | Since iptables uses its own copies of the header files anyway where the revision field is exposed, there is no reach to access name[] beyond its size. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: another try at chain name length checkingJan Engelhardt2010-06-071-6/+4
| | | | | | | Since XT_EXTENSION_MAXNAMELEN is now available, make use of it and clear the confusion. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: fix compilation when debugging is enabledPatrick McHardy2010-05-201-1/+1
| | | | | | Reported by yang.xuhui@jfsys.com. Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: correctly check for too-long chain/target/match namesJan Engelhardt2010-03-161-0/+5
| | | | | | | | | * iptables-restore was not checking for chain name length * iptables was not checking for match name length * target length was checked against 32, not 29. References: http://bugzilla.netfilter.org/show_bug.cgi?id=641 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Lift restrictions on interface namesJan Engelhardt2010-02-091-6/+5
| | | | | | | The kernel has few restrictions. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxtables: hand argv to xtables_check_inverseJan Engelhardt2009-11-031-1/+2
| | | | | | | | | In going to fix NF bug #611, "argv" is needed in xtables_check_inverse to set "optarg" to the right spot in case of an intrapositional negation. References: http://bugzilla.netfilter.org/show_bug.cgi?id=611 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* style: reduce indent in xtables_check_inverseJan Engelhardt2009-10-291-16/+16
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: restore --disable-ipv6 functionality on system w/o v6 headersOlaf Rempel2009-10-291-1/+2
| | | | | | | | | Commit 332e4acc (iptables: accept multiple IP address specifications for -s, d) broke the --disable-ipv6 configure option. > ./.libs/libxtables.so: undefined reference to `in6addr_any' Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Support for nommu archesJan Engelhardt2009-10-251-1/+1
| | | | | | | | | | Linux systems that lack a MMU cannot call fork(). Fortunately, the only place in iptables that uses fork() follows it by an exec(), so we can easily convert the code to vfork(). References: http://bugzilla.netfilter.org/show_bug.cgi?id=614 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: warn of missing version identifier in extensionsJan Engelhardt2009-06-261-0/+10
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: add multi-registration functionsJan Engelhardt2009-06-261-0/+14
| | | | | | Similar to the ones that are present in the kernel. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: accept multiple IP address specifications for -s, -dMichael Granzow2009-06-261-0/+175
| | | | | | | | | | | | | | libiptc already supports adding and deleting multiple rules with different addresses, so it only needs to be wired up to the options. # ip6tables -I INPUT -s 2001:db8::d,2001:db8::e -j DROP References: http://marc.info/?l=netfilter-devel&m=123929790719202&w=2 Adjustments made: syntax, removal of unneeded variables, manpage adjustment, soversion bump. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: fix segfault if incorrect protocol name is usedPablo Neira Ayuso2009-05-121-0/+3
| | | | | | | | | | | | | | | | This patch fixes a segfault that can be triggered if you use an incorrect protocol, e.g. # iptables -I PREROUTING -t nat -p lalala --dport 21 -j DNAT --to 192.168.1.2:21 Segmentation fault With this patch: # iptables -I PREROUTING -t nat -p lalala --dport 21 -j DNAT --to 192.168.1.2:21 iptables v1.4.3.2: unknown protocol `lala' specified Try `iptables -h' or 'iptables --help' for more information Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: provide IPv6 zero address variableJan Engelhardt2009-04-031-1/+2
| | | | | | | | µClibc may not provide the in6addr_any variable when IPv6 is disabled. So just provide it ourselves. Reference: http://bugzilla.netfilter.org/show_bug.cgi?id=569 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: fix compile error due to incomplete changePeter Volkov2009-03-241-1/+1
| | | | | | | | Commit 2338efd8f799d8373dc196c797bda9690283b698 forgot to update the constant in one place, and the compile error triggered only when -DNO_SHARED_LIBS (configure --disable-shared) was in effect. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: add missing limits.h includeJan Engelhardt2009-02-211-0/+1
| | | | | | Thanks to Stephen Hemminger for noticing. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: inline and remove unused OPTION_OFFSET macroJan Engelhardt2009-02-211-1/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: general follow-up cleanupJamal Hadi Salim2009-02-131-15/+12
| | | | | | Kill program_name, program_version and xtables_program_name. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
* libxtables: consolidate init calls into one functionJamal Hadi Salim2009-02-131-25/+32
| | | | | | | | | | | Introduce xtables_init_all() which hides three calls xtables_init(), xtables_set_nfproto(), and xtables_set_params(). Make ip[6]tables-restore, ip[6]tables-save and ip[6]tables-standalone use it. I moved xtables_set_params around for readability reasons. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
* libxtables: consolidate merge_options into xtables_merge_optionsJamal Hadi Salim2009-02-131-0/+31
| | | | | | | | Introduce xtables_merge_options() for re-use reasons. Apps can use it instead of each defining their own merge_options(). Made iptables and ip6tables use the new shared interface. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
* libxtables: make iptables and ip6tables use xtables_free_optsJamal Hadi Salim2009-02-121-5/+4
| | | | | | | | The patch modifies xtables_globals to introduce orig_opts and xtables_free_opts() to emulate what free_opts used to do. We also get rid of the copies of free_opts() that iptables and ip6tables keep. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
* libxtables: add xtables_set_revisionJamal Hadi Salim2009-02-121-0/+8
| | | | | | Introduce xtables_set_revision() and make iptables and ip6tables use it. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
* libxtables: flush before forkJan Engelhardt2009-02-121-0/+6
| | | | | Reference: http://bugs.debian.org/514869 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2009-02-121-0/+22
|\
| * libxtables: move compat defines to xtables.cJan Engelhardt2009-02-101-0/+9
| | | | | | | | | | | | | | Addendum to commit v1.4.3-rc1-41-g77f48c2 where the macro users got moved. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-01 03:45:50 +0000