summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* configure: bump version for 1.8.6 releasev1.8.6Pablo Neira Ayuso2020-10-311-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Improve concurrent noflush restore test a bitPhil Sutter2020-10-271-0/+14
| | | | | | | | | | | | The described issue happens only if chain FOO does not exist at program start so flush the ruleset after each iteration to make sure this is the case. Sadly the bug is still not 100% reproducible on my testing VM. While being at it, add a paragraph describing what exact situation the test is trying to provoke. Fixes: dac904bdcd9a1 ("nft: Fix for concurrent noflush restore calls") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix for concurrent noflush restore callsPhil Sutter2020-10-132-28/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Transaction refresh was broken with regards to nft_chain_restore(): It created a rule flush batch object only if the chain was found in cache and a chain add object only if the chain was not found. Yet with concurrent ruleset updates, one has to expect both situations: * If a chain vanishes, the rule flush job must be skipped and instead the chain add job become active. * If a chain appears, the chain add job must be skipped and instead rules flushed. Change the code accordingly: Create both batch objects and set their 'skip' field depending on the situation in cache and adjust both in nft_refresh_transaction(). As a side-effect, the implicit rule flush becomes explicit and all handling of implicit batch jobs is dropped along with the related field indicating such. Reuse the 'implicit' parameter of __nft_rule_flush() to control the initial 'skip' field value instead. A subtle caveat is vanishing of existing chains: Creating the chain add job based on the chain in cache causes a netlink message containing that chain's handle which the kernel dislikes. Therefore unset the chain's handle in that case. Fixes: 58d7de0181f61 ("xtables: handle concurrent ruleset modifications") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libiptc: Avoid gcc-10 zero-length array warningPhil Sutter2020-10-121-1/+1
| | | | | | | | | | | | | | | | Gcc-10 doesn't like the use of zero-length arrays as last struct member to denote variable sized objects. The suggested alternative, namely to use a flexible array member as defined by C99, is problematic as that doesn't allow for said struct to be embedded into others. With the relevant structs being part of kernel UAPI, this can't be precluded though. The call to memcpy() which triggers the warning copies data from one struct xt_counters to another. Since this struct is flat and merely contains two u64 fields, One can use direct assignment instead which avoids the warning. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-nft: fix basechain policy configurationPablo Neira Ayuso2020-10-082-1/+34
| | | | | | | | | | Previous to this patch, the basechain policy could not be properly configured if it wasn't explictly set when loading the ruleset, leading to iptables-nft-restore (and ip6tables-nft-restore) trying to send an invalid ruleset to the kernel. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Fix error reporting for refreshed transactionsPhil Sutter2020-10-071-2/+3
| | | | | | | | | | | | | | When preparing a batch from the list of batch objects in nft_action(), the sequence number used for each object is stored within that object for later matching against returned error messages. Though if the transaction has to be refreshed, some of those objects may be skipped, other objects take over their sequence number and errors are matched to skipped objects. Avoid this by resetting the skipped object's sequence number to zero. Fixes: 58d7de0181f61 ("xtables: handle concurrent ruleset modifications") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Florian Westphal <fw@strlen.de>
* nft: Make batch_add_chain() return the added batch objectPhil Sutter2020-10-071-18/+17
| | | | | | | | | | Do this so in a later patch the 'skip' field can be adjusted. While being at it, simplify a few callers and eliminate the need for a 'ret' variable. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Florian Westphal <fw@strlen.de>
* libxtables: Register multiple extensions in ascending orderPhil Sutter2020-10-071-6/+8
| | | | | | | | | The newly introduced ordered insert algorithm in xtables_register_{match,target}() works best if extensions of same name are passed in ascending revisions. Since this is the case in about all extensions' arrays, iterate over them from beginning to end. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Simplify pending extension registrationPhil Sutter2020-10-071-95/+33
| | | | | | | | | | | | | | | | | | | | Assuming that pending extensions are sorted by first name and family, then descending revision, the decision where to insert a newly registered extension may be simplified by memorizing the previous registration (which obviously is of same name and family and higher revision). As a side-effect, fix for unsupported old extension revisions lingering in pending extension list forever and being retried with every use of the given extension. Any revision being rejected by the kernel may safely be dropped iff a previous (read: higher) revision was accepted already. Yet another side-effect of this change is the removal of an unwanted recursion by xtables_fully_register_pending_*() into itself via xtables_find_*(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Make sure extensions register in revision orderPhil Sutter2020-10-071-7/+64
| | | | | | | | | | | | Insert extensions into pending lists in ordered fashion: Group by extension name (and, for matches, family) and order groups by descending revision number. This allows to simplify the later full registration considerably. Since that involves kernel compatibility checks, the extra cycles here pay off eventually. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libipt_icmp: Fix translation of type 'any'Phil Sutter2020-10-062-0/+8
| | | | | | | | | | | | | By itself, '-m icmp --icmp-type any' is a noop, it matches any icmp types. Yet nft_ipv4_xlate() does not emit an 'ip protocol' match if there's an extension with same name present in the rule. Luckily, legacy iptables demands icmp match to be prepended by '-p icmp', so we can assume this is present and just emit the 'ip protocol' match from icmp xlate callback. Fixes: aa158ca0fda65 ("extensions: libipt_icmp: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Florian Westphal <fw@strlen.de>
* nft: Fix for broken address mask match detectionPhil Sutter2020-09-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Trying to decide whether a bitwise expression is needed to match parts of a source or destination address only, add_addr() checks if all bytes in 'mask' are 0xff or not. The check is apparently broken though as each byte in 'mask' is cast to a signed char before comparing against 0xff, therefore the bitwise is always added: | # ./bad/iptables-nft -A foo -s 10.0.0.1 -j ACCEPT | # ./good/iptables-nft -A foo -s 10.0.0.2 -j ACCEPT | # nft --debug=netlink list chain ip filter foo | ip filter foo 5 | [ payload load 4b @ network header + 12 => reg 1 ] | [ bitwise reg 1 = (reg=1 & 0xffffffff ) ^ 0x00000000 ] | [ cmp eq reg 1 0x0100000a ] | [ counter pkts 0 bytes 0 ] | [ immediate reg 0 accept ] | | ip filter foo 6 5 | [ payload load 4b @ network header + 12 => reg 1 ] | [ cmp eq reg 1 0x0200000a ] | [ counter pkts 0 bytes 0 ] | [ immediate reg 0 accept ] | | table ip filter { | chain foo { | ip saddr 10.0.0.1 counter packets 0 bytes 0 accept | ip saddr 10.0.0.2 counter packets 0 bytes 0 accept | } | } Fix the cast, safe an extra op and gain 100% performance in ideal cases. Fixes: 56859380eb328 ("xtables-compat: avoid unneeded bitwise ops") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Use nft_chain_find() in nft_chain_builtin_init()Phil Sutter2020-08-211-12/+4
| | | | | | The replaced code is basically identical to nft_chain_find()'s body. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fold nftnl_rule_list_chain_save() into callerPhil Sutter2020-08-211-24/+7
| | | | | | | | | | | Existence of this function was mostly code-duplication: Caller already branches depending on whether 'chain' is NULL or not and even does the chain list lookup. While being at it, simplify __nftnl_rule_list_chain_save function name a bit now that the non-prefixed name is gone. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Extend use of nftnl_chain_list_foreach()Phil Sutter2020-08-211-77/+86
| | | | | | | | | | | | | Make use of the callback-based iterator in nft_rule_list(), nft_rule_list_save(), nft_rule_flush() and nft_rule_save(). Callback code for nft_rule_list() and nft_rule_list_save is pretty similar, so introduce and use a common callback function. For nft_rule_save(), turn nft_chain_save_rules() into a callback - it is not used anywhere else, anyway. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: cache: Check consistency with NFT_CL_FAKE, tooPhil Sutter2020-08-211-2/+2
| | | | | | | | Athough this cache level fetches table names only, it shouldn't skip the consistency check. Fixes: f42bfb344af82 ("nft: cache: Re-establish cache consistency check") Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Add missing man pages to CLEANFILESPhil Sutter2020-08-171-0/+4
| | | | | | | The list of man pages to remove along with 'make clean' was missing a few built ones, add them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix for ruleset flush while restoringPhil Sutter2020-08-143-14/+25
| | | | | | | | | | | | | | | | | | If ruleset is flushed while an instance of iptables-nft-restore is running and has seen a COMMIT line once, it doesn't notice the disappeared table while handling the next COMMIT. This is due to table existence being tracked via 'initialized' boolean which is only reset by nft_table_flush(). To fix this, drop the dedicated 'initialized' boolean and switch users to the recently introduced 'exists' one. As a side-effect, this causes base chain existence being checked for each command calling nft_xt_builtin_init() as the old 'initialized' bit was used to track if that function has been called before or not. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-monitor: Fix ip6tables rule printingPhil Sutter2020-08-141-0/+2
| | | | | | | | | | | | | | When printing an ip6tables rule event, false family ops are used as they are initially looked up for AF_INET and reused no matter the current rule's family. In practice, this means that nft_rule_print_save() calls the wrong rule_to_cs, save_rule and clear_cs callbacks. Therefore, if a rule specifies a source or destination address, the address is not printed. Fix this by performing a family lookup each time rule_cb is called. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Merge and extend return codes testPhil Sutter2020-08-142-91/+61
| | | | | | | | | | Merge scripts for iptables and ip6tables, they were widely identical. Also extend the test by one check (removing a non-existent rule with valid chain and target) and quote the error messages where differences are deliberately ignored. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Fix command name in ip6tables error messagePhil Sutter2020-08-141-8/+4
| | | | | | | | | | | Upon errors, ip6tables-nft would prefix its error messages with 'iptables:' instead of 'ip6tables:'. Turns out the command name was hard-coded, use 'progname' variable instead. While being at it, merge the two mostly identical fprintf() calls into one. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Eliminate table list from cachePhil Sutter2020-07-314-105/+34
| | | | | | | | | | | | | | The full list of tables in kernel is not relevant, only those used by iptables-nft and for those, knowing if they exist or not is sufficient. For holding that information, the already existing 'table' array in nft_cache suits well. Consequently, nft_table_find() merely checks if the new 'exists' boolean is true or not and nft_for_each_table() iterates over the builtin_table array in nft_handle, additionally checking the boolean in cache for whether to skip the entry or not. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables: replace libnftnl table list by linux listPablo Neira Ayuso2020-07-274-81/+77
| | | | | | | | This patch removes the libnftnl table list by linux list. This comes with an extra memory allocation to store the nft_table object. Probably, there is no need to cache the entire nftnl_table in the near future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Reorder enum nft_table_typePhil Sutter2020-07-241-3/+3
| | | | | | | | | This list of table types is used internally only, the actual values don't matter that much. Reorder them to match the order in which iptables-legacy-save prints them (if present). As a consequence, entries in builtin_table array 'xtables_ipv4' are correctly sorted as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Use nft_chain_find() in two more placesPhil Sutter2020-07-241-15/+14
| | | | | | | This doesn't really increase functions' readability but prepares for later changes. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Turn nft_chain_save() into a foreach-callbackPhil Sutter2020-07-243-37/+14
| | | | | | | | Let nftnl_chain_list_foreach() do the chain list iterating instead of open-coding it. While being at it, simplify the policy value selection code as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Drop pointless nft_xt_builtin_init() callPhil Sutter2020-07-241-2/+0
| | | | | | | When renaming a chain, either everything is in place already or the command will bail anyway. So just drop this superfluous call. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: cache: Drop duplicate chain checkPhil Sutter2020-07-241-6/+1
| | | | | | | | | When fetching chains from kernel, checking for duplicate chain names is not needed: Nftables doesn't support them in the first place. This is merely a leftover from when multiple cache fetches could happen and so a bit of sanity checking was in order. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Be lazy when flushingPhil Sutter2020-07-241-2/+4
| | | | | | | | If neither chain nor verbose flag was specified and the table to flush doesn't exist yet, no action is needed (as there is nothing to flush anyway). Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Make table creation purely implicitPhil Sutter2020-07-244-24/+3
| | | | | | | | | | | | | | | | | | | While asserting a required builtin chain exists, its table is created implicitly if missing. Exploit this from xtables-restore, too: The only actions which need adjustment are chain_new and chain_restore, i.e. when restoring (either builtin or custom) chains. Note: The call to nft_table_builtin_add() wasn't sufficient as it doesn't set the table as initialized and therefore a following call to nft_xt_builtin_init() would override non-default base chain policies. Note2: The 'table_new' callback in 'nft_xt_restore_cb' is left in place as xtables-translate uses it to print an explicit 'add table' command. Note3: nft_table_new() function was already unused since a7f1e208cdf9c ("nft: split parsing from netlink commands"). Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libxt_conntrack: provide translation for DNAT and SNAT --ctstatePablo Neira Ayuso2020-07-242-5/+20
| | | | | | | iptables-translate -t filter -A INPUT -m conntrack --ctstate DNAT -j ACCEPT nft add rule ip filter INPUT ct status dnat counter accept Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: accept lock file name at runtimeGiuseppe Scrivano2020-07-243-3/+17
| | | | | | | | | | | | | | | allow users to override at runtime the lock file to use through the XTABLES_LOCKFILE environment variable. It allows to use iptables when the user has granted enough capabilities (e.g. a user+network namespace) to configure the network but that lacks access to the XT_LOCK_NAME (by default placed under /run). $ XTABLES_LOCKFILE=/tmp/xtables unshare -rn iptables ... Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Add help output to run-tests.shPhil Sutter2020-07-061-0/+19
| | | | | | | The script has quite a few options nowadays, so add a bit of help text also. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: compiler warning fixes for NO_SHARED_LIBSMaciej Żenczykowski2020-06-301-0/+4
| | | | | | | | | | | | Fixes two issues with NO_SHARED_LIBS: - #include <dlfcn.h> is ifdef'ed out and thus dlclose() triggers an undeclared function compiler warning - dlreg_add() is unused and thus triggers an unused function warning Test: builds without warnings Signed-off-by: Maciej Żenczykowski <maze@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate: Use proper clear_cs functionPhil Sutter2020-06-161-1/+1
| | | | | | | Avoid memleaks by performing a full free of any allocated data in local iptables_command_state variable. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: don't fail if help was requestedArturo Borrero Gonzalez2020-06-161-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | If the user called `iptables-translate -h` then we have CMD_NONE and we should gracefully handle this case in do_command_xlate(). Before this patch, you would see: user@debian:~$ sudo iptables-translate -h [..] nft Unsupported command? user@debian:~$ echo $? 1 After this patch: user@debian:~$ sudo iptables-translate -h [..] user@debian:~$ echo $? 0 Fixes: d4409d449c10fa ("nft: Don't exit early after printing help texts") Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
* build: Fix for failing 'make uninstall'Phil Sutter2020-06-094-1/+47
| | | | | | | | | | | | | | | | | | | | | Support for uninstalling is severely broken: - extensions/GNUmakefile.in defines an 'install' target but lacks a respective 'uninstall' one, causing 'make uninstall' abort with an error message. - iptables/Makefile.am defines an 'install-exec-hook' to create the binary symlinks which are left in place after 'make uninstall'. Fix these problems by defining respective targets containing code copied from automake-generated uninstall targets. While being at it, add a few more uninstall-hooks removing custom directories created by 'make install' if they are empty afterwards. Reported-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Tested-by: Richard Guy Briggs <rgb@redhat.com>
* xtables-restore: Fix verbose mode table flushingPhil Sutter2020-06-096-6/+88
| | | | | | | | | | When called with --verbose mode, iptables-nft-restore did not print anything when flushing the table. Fix this by adding a "manual" mode to nft_cmd_table_flush(), turning it into a wrapper around '-F' and '-X' commands, which is exactly what iptables-legacy-restore does to flush a table. This though requires a real cache, so don't set NFT_CL_FAKE then. Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: resolve iptables-apply not getting installedJan Engelhardt2020-06-081-1/+1
| | | | | | | | | | | | | | | ip6tables-apply gets installed but iptables-apply does not. That is wrong. » make install DESTDIR=$PWD/r » find r -name "*app*" r/usr/local/sbin/ip6tables-apply r/usr/local/share/man/man8/iptables-apply.8 r/usr/local/share/man/man8/ip6tables-apply.8 Fixes: v1.8.5~87 Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: document danger of applying REJECT to INVALID CTsJan Engelhardt2020-06-082-0/+40
| | | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure: bump version for 1.8.5 releasev1.8.5Pablo Neira Ayuso2020-06-031-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: bump dependency on libnftnlPhil Sutter2020-06-031-1/+1
| | | | | | | | | Recently added full among match support depends on concatenated ranges in nftables sets, a feature which was not available in libnftnl before version 1.1.6. Fixes: c33bae9c6c7a4 ("ebtables: among: Support mixed MAC and MAC/IP entries") Signed-off-by: Phil Sutter <phil@nwl.cc>
* include: Avoid undefined left-shift in xt_sctp.hPhil Sutter2020-05-291-3/+3
| | | | | | | | | | | | | Pull the fix in kernel commit 164166558aace ("netfilter: uapi: Avoid undefined left-shift in xt_sctp.h") into iptables repository. The original description is: With 'bytes(__u32)' being 32, a left-shift of 31 may happen which is undefined for the signed 32-bit value 1. Avoid this by declaring 1 as unsigned. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Fix syntax in ipt-restore/0010-noflush-new-chain_0Phil Sutter2020-05-291-0/+1
| | | | | | | | The here-doc statement missed the final delimiter. Worked anyways because end-of-file would do the trick. Fixes: a103fbfadf4c1 ("xtables-restore: Fix parser feed from line buffer") Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: libxt_MARK: OUTPUT chain is fine, tooPhil Sutter2020-05-271-2/+2
| | | | | | | | | In order to route packets originating from the host itself based on fwmark, mangle table's OUTPUT chain must be used. Mention this chain as alternative to PREROUTING. Fixes: c9be7f153f7bf ("doc: libxt_MARK: no longer restricted to mangle table") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Drop save_counters callback from family_opsPhil Sutter2020-05-187-16/+3
| | | | | | | All families use the same callback function, just fold it into the sole place it's called. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Merge nft_*_rule_find() functionsPhil Sutter2020-05-187-112/+40
| | | | | | | | | Both ebtables and arptables are fine with using nft_ipv46_rule_find() instead of their own implementations. Take the chance and move the former into nft.c as a static helper since it is used in a single place, only. Then get rid of the callback from family_ops. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nfnl_osf: Improve error handlingPhil Sutter2020-05-181-5/+10
| | | | | | | | | | | | | | | | | | | | | | For some error cases, no log message was created - hence apart from the return code there was no indication of failing execution. If a line load fails, don't abort but continue with the remaining file contents. The current pf.os file in this repository serves as proof-of-concept: Lines 700 and 701: Duplicates of lines 698 and 699 because 'W*' and 'W0' parse into the same data. Line 704: Duplicate of line 702 because apart from 'W*' and 'W0', only the first three fields on right-hand side are sent to the kernel. When loading, these dups are ignored (they would bounce if NLM_F_EXCL was given). Upon deletion, they cause ENOENT response from kernel. In order to align duplicate-tolerance in both modes, just ignore that ENOENT. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nfnl_osf: Fix broken conversion to nfnl_query()Phil Sutter2020-05-181-2/+4
| | | | | | | | | | | | | Due to missing NLM_F_ACK flag in request, nfnetlink code in kernel didn't create an own ACK message but left it upon subsystem to ACK or not. Since nfnetlink_osf doesn't ACK by itself, nfnl_query() got stuck waiting for a reply. Whoever did the conversion from deprecated nfnl_talk() obviously didn't even test basic functionality of the tool. Fixes: 52aa15098ebd6 ("nfnl_osf: Replace deprecated nfnl_talk() by nfnl_query()") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libip6t_srh.t: switch to lowercase, add /128 suffix, require successMaciej Żenczykowski2020-05-141-2/+2
| | | | | | | | | | | | | | | | | | | | | | This looks like an oversight which is easy to fix. Furthermore: git grep ';;OK' does not find any other matches, so this is the last unverified test case. Test: [root@f32vm IPT]# uname -r 5.6.10-300.fc32.x86_64 [root@f32vm IPT]# md5sum extensions/libip6t_srh.t b98864bdd6c39a0dd96022c47e652edb extensions/libip6t_srh.t [root@f32vm IPT]# ./iptables-test.py extensions/libip6t_srh.t extensions/libip6t_srh.t: OK 1 test files, 27 unit tests, 27 passed Signed-off-by: Maciej Żenczykowski <maze@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>