summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* extensions: libxt_connlabel: add unit testLiping Zhang2016-07-231-0/+18
| | | | | | | | | | Add some unit tests for connlabel match extension: # ./iptables-test.py extensions/libxt_connlabel.t extensions/libxt_connlabel.t: OK 1 test files, 7 unit tests, 7 passed Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_NFLOG: add unit test to cover nflog-size with zeroLiping Zhang2016-07-201-0/+1
| | | | | | | | "--nflog-size 0" is valid and we must display it appropriately. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_NFLOG: translate to nft log snaplen if nflog-size is specifiedLiping Zhang2016-07-191-1/+1
| | | | | | | | | | | | | The nflog-size was introduced by commit 7070b1f3c88a ("extensions: libxt_NFLOG: nflog-range does not truncate packets"). Then make the nflog-range become deprecated, because it has no effect from the beginning. So when we do translation, nft log snaplen is translated only if the nflog-size is specified. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_NFLOG: display nflog-size even if it is zeroLiping Zhang2016-07-191-1/+1
| | | | | | | | | | | | | | The following iptables rules have the different semantics: # iptables -A INPUT -j NFLOG # iptables -A INPUT -j NFLOG --nflog-size 0 But they are all displayed as "-A INPUT -j NFLOG", so if the user input the following commands, the original semantics will be broken. # iptables-save | iptables-restore Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_connlabel: Add translation to nftLiping Zhang2016-07-161-0/+22
| | | | | | | | | | | | | | | Add translation for connlabel to nftables. For examples: # iptables-translate -A INPUT -m connlabel --label bit40 nft add rule ip filter INPUT ct label bit40 counter # iptables-translate -A INPUT -m connlabel ! --label bit40 --set nft add rule ip filter INPUT ct label set bit40 ct label and bit40 != bit40 counter Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_connlabel: fix crash when connlabel.conf is emptyLiping Zhang2016-07-161-3/+10
| | | | | | | | | | | | | | When connlabel.conf is empty, nfct_labelmap_new will return NULL and set errno to 0. So we will miss to check this situation, and cause NULL deference in nfct_labelmap_get_bit. Input the following commands will reproduce this crash: # echo > /etc/xtables/connlabel.conf # iptables -A INPUT -m connlabel --label abc Segmentation fault (core dumped) Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-translate: fix multiple spaces issuePablo M. Bermudo Garay2016-07-0933-146/+185
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a multiple spaces issue. The problem arises when a rule set loaded through iptables-compat-restore is listed in nft. Before this commit, two spaces were printed after every match translation: $ sudo iptables-save *filter :INPUT ACCEPT [0:0] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m multiport --dports 80:85 -m ttl --ttl-gt 5 -j ACCEPT COMMIT $ sudo iptables-compat-restore iptables-save $ sudo nft list ruleset table ip filter { chain INPUT { type filter hook input priority 0; policy accept; ct state related,established counter packets 0 bytes 0 accept ^^ ip protocol tcp tcp dport 80-85 ip ttl gt 5 counter packets 0 bytes 0 accept ^^ ^^ } } Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Add an interval option for xtables lock waitSubash Abhinov Kasiviswanathan2016-07-036-17/+149
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ip[6]tables currently waits for 1 second for the xtables lock to be freed if the -w option is used. We have seen that the lock is held much less than that resulting in unnecessary delay when trying to acquire the lock. This problem is even severe in case of latency sensitive applications. Introduce a new option 'W' to specify the wait interval in microseconds. If this option is not specified, the command sleeps for 1 second by default. v1->v2: Change behavior to take millisecond sleep as an argument to -w as suggested by Pablo. Also maintain current behavior for -w to sleep for 1 second as mentioned by Liping. v2->v3: Move the millisecond behavior to a new option as suggested by Pablo. v3->v4: Use select instead of usleep. Sleep every iteration for the time specified in the "-W" argument. Update man page. v4->v5: Fix compilation error when enabling nftables v5->v6: Simplify -W so it only takes the interval wait in microseconds. Bail out if -W is specific but -w is not. Joint work with Pablo Neira. Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: Replace gethostbyname() with getaddrinfo()Arpan Kapoor2016-07-031-9/+23
| | | | | | | | Make the function host_to_ipaddr() similar to host_to_ip6addr(), using getaddrinfo() instead of the obsoleted gethostbyname(). Signed-off-by: Arpan Kapoor <rpnkpr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: added AR substitutionJordan Yelloz2016-07-011-0/+1
| | | | | | | | | | | | This is to ensure that the correct AR is run in cross-compile jobs. Often a cross-compile build will succeed without this change but it fails on my Gentoo Linux system when I have binutils installed with the "multitarget" USE flag. This change substitues AR with the autotools-supplied AR for the extensions subdirectory. Signed-off-by: Jordan Yelloz <jordan@yelloz.me> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_NFLOG: nflog-range does not truncate packetsVishwanath Pai2016-07-014-4/+36
| | | | | | | | | | | | | | | | | | | | The option --nflog-range has never worked, but we cannot just fix this because users might be using this feature option and their behavior would change. Instead add a new option --nflog-size. This option works the same way nflog-range should have, and both of them are mutually exclusive. When someone uses --nflog-range we print a warning message informing them that this feature has no effect. To indicate the kernel that the user has set --nflog-size we have to pass a new flag XT_NFLOG_F_COPY_LEN. Also updated the man page to reflect the new option and added tests to extensions/libxt_NFLOG.t Reported-by: Joe Dollard <jdollard@akamai.com> Reviewed-by: Josh Hunt <johunt@akamai.com> Signed-off-by: Vishwanath Pai <vpai@akamai.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_realm: fix order of mask and id when do nft translationLiping Zhang2016-07-011-2/+2
| | | | | | | | | | | | | | Before: # iptables-translate -A INPUT -m realm --realm 1/0xf nft add rule ip filter INPUT rtclassid and 0x1 == 0xf counter Apply this patch: # iptables-translate -A INPUT -m realm --realm 1/0xf nft add rule ip filter INPUT rtclassid and 0xf == 0x1 counter Cc: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: extensions: libxt_ecn: Add translation to nftRoberto García2016-07-011-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add translation of the ecn match to nftables. Examples: # iptables-translate -A INPUT -m ecn --ecn-ip-ect 0 nft add rule ip filter INPUT ip ecn not-ect counter # iptables-translate -A INPUT -m ecn --ecn-ip-ect 1 nft add rule ip filter INPUT ip ecn ect1 counter # iptables-translate -A INPUT -m ecn --ecn-ip-ect 2 nft add rule ip filter INPUT ip ecn ect0 counter # iptables-translate -A INPUT -m ecn --ecn-ip-ect 3 nft add rule ip filter INPUT ip ecn ce counter # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 0 nft add rule ip filter INPUT ip ecn != not-ect counter # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 1 nft add rule ip filter INPUT ip ecn != ect1 counter # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 2 nft add rule ip filter INPUT ip ecn != ect0 counter # iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 3 nft add rule ip filter INPUT ip ecn != ce counter Signed-off-by: Roberto García <rodanber@gmail.com> Reviewed-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure: Fix assignment statementShivani Bhardwaj2016-06-231-1/+1
| | | | | | | | | | | | The assignment statement was interpreted as executing enable_connlabel command with the argument "no". This was due to the whitespaces in the assignment. Fixes the trivial bug introduced in commit 3b7a227 (configure: Show support for connlabel) Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-compat: use nft built-in comments supportPablo M. Bermudo Garay2016-06-224-4/+49
| | | | | | | | | | | After this patch, iptables-compat uses nft built-in comments support instead of comment match. This change simplifies the treatment of comments in nft after load a rule set through iptables-compat-restore. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_conntrack: Add translation to nftLaura Garcia Liebana2016-06-221-0/+197
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add translation of conntrack to nftables. Examples: $ sudo iptables-translate -t filter -A INPUT -m conntrack --ctstate NEW,RELATED -j ACCEPT nft add rule ip filter INPUT ct state new,related counter accept $ sudo ip6tables-translate -t filter -A INPUT -m conntrack ! --ctstate NEW,RELATED -j ACCEPT nft add rule ip6 filter INPUT ct state != new,related counter accept $ sudo iptables-translate -t filter -A INPUT -m conntrack --ctproto UDP -j ACCEPT nft add rule ip filter INPUT ct proto 17 counter accept $ sudo iptables-translate -t filter -A INPUT -m conntrack ! --ctproto UDP -j ACCEPT nft add rule ip filter INPUT ct proto != 17 counter accept $ sudo iptables-translate -t filter -A INPUT -m conntrack --ctorigsrc 10.100.2.131 -j ACCEPT nft add rule ip filter INPUT ct original saddr 10.100.2.131 counter accept $ sudo iptables-translate -t filter -A INPUT -m conntrack --ctorigsrc 10.100.0.0/255.255.0.0 -j ACCEPT nft add rule ip filter INPUT ct original saddr 10.100.0.0/16 counter accept $ sudo iptables-translate -t filter -A INPUT -m conntrack --ctorigdst 10.100.2.131 -j ACCEPT nft add rule ip filter INPUT ct original daddr 10.100.2.131 counter accept $ sudo iptables-translate -t filter -A INPUT -m conntrack --ctreplsrc 10.100.2.131 -j ACCEPT nft add rule ip filter INPUT ct reply saddr 10.100.2.131 counter accept $ sudo iptables-translate -t filter -A INPUT -m conntrack --ctrepldst 10.100.2.131 -j ACCEPT nft add rule ip filter INPUT ct reply daddr 10.100.2.131 counter accept $ sudo iptables-translate -t filter -A INPUT -m conntrack --ctproto tcp --ctorigsrcport 443:444 -j ACCEPT nft add rule ip filter INPUT ct original protocol 6 ct original proto-src 443-444 counter accept $ sudo iptables-translate -t filter -A INPUT -m conntrack ! --ctstatus CONFIRMED -j ACCEPT nft add rule ip filter INPUT ct status != confirmed counter accept $ sudo iptables-translate -t filter -A INPUT -m conntrack --ctexpire 3 -j ACCEPT nft add rule ip filter INPUT ct expiration 3 counter accept $ sudo iptables-translate -t filter -A INPUT -m conntrack --ctdir ORIGINAL -j ACCEPT nft add rule ip filter INPUT ct direction original counter accept Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: iprange: remove extra space in translationPablo M. Bermudo Garay2016-06-221-12/+12
| | | | | | | | | | | | | Extra space was printed by iprange_xlate: # iptables-translate -A INPUT -m iprange --src-range \ 192.168.25.149-192.168.25.151 -j ACCEPT nft add rule ip filter INPUT ip saddr 192.168.25.149-192.168.25... ^^ Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: extensions: libxt_MARK: Fix translation of --set-xmark optionRoberto García2016-06-221-2/+2
| | | | | | | | | | | | | | | | | Fix translation of MARK target's --set-xmark option. Before: #iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf nft add rule ip mangle PREROUTING counter meta mark set mark xor 0x64 and 0xaf After: # iptables-translate -t mangle -A PREROUTING -j MARK --set-xmark 0x64/0xaf nft add rule ip mangle PREROUTING counter meta mark set mark and 0xffffff50 \ xor 0x64 Signed-off-by: Roberto García <rodanber@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_CONNMARK: Add translation to nftRoberto García2016-06-221-0/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add translation for the CONNMARK target to nftables. The following options have no available translation: --save-mark [--nfmask nfmask] [--ctmask ctmask] --restore-mark [--nfmask nfmask] [--ctmask ctmask] Examples: # iptables-translate -t mangle -A PREROUTING -j CONNMARK --set-mark 0x16 nft add rule ip mangle PREROUTING counter ct mark set 0x16 # iptables-translate -t mangle -A PREROUTING -j CONNMARK --set-xmark 0x16/0x12 nft add rule ip mangle PREROUTING counter ct mark set ct mark xor 0x16 and 0xffffffed # iptables-translate -t mangle -A PREROUTING -j CONNMARK --and-mark 0x16 nft add rule ip mangle PREROUTING counter ct mark set ct mark and 0x16 # iptables-translate -t mangle -A PREROUTING -j CONNMARK --or-mark 0x16 nft add rule ip mangle PREROUTING counter ct mark set ct mark or 0x16 # iptables-translate -t mangle -A PREROUTING -j CONNMARK --save-mark nft add rule ip mangle PREROUTING counter ct mark set mark # iptables-translate -t mangle -A PREROUTING -j CONNMARK --save-mark \ --mask 0x12 nft add rule ip mangle PREROUTING counter ct mark set mark and 0x12 # iptables-translate -t mangle -A PREROUTING -j CONNMARK --restore-mark nft add rule ip mangle PREROUTING counter meta mark set ct mark # iptables-translate -t mangle -A PREROUTING -j CONNMARK --restore-mark \ --mask 0x12 nft add rule ip mangle PREROUTING counter meta mark set ct mark and 0x12 Signed-off-by: Roberto García <rodanber@gmail.com> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_MARK: Add translation for revision 1 to nftRoberto García2016-06-221-2/+26
| | | | | | | | | | | | | | | | | | | Add translation for revision 1 of the MARK target to nft. Examples: # iptables-translate -t mangle -A PREROUTING -j MARK --set-mark 0x64 nft add rule ip mangle PREROUTING counter meta mark set 0x64 # iptables-translate -t mangle -A PREROUTING -j MARK --and-mark 0x64 nft add rule ip mangle PREROUTING counter meta mark set mark and 0x64 # iptables-translate -t mangle -A PREROUTING -j MARK --or-mark 0x64 nft add rule ip mangle PREROUTING counter meta mark set mark or 0x64 Signed-off-by: Roberto García <rodanber@gmail.com> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure: Remove flex check warningShivani Bhardwaj2016-06-221-15/+0
| | | | | | | | | Remove the warning about outdated version of flex as it is not needed anymore. This check was introduced back in 2008 to skip a broken flex version that doesn't seem to be packaged by any distribution anymore. Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: NETMAP: fix iptables-save outputFlorian Westphal2016-06-172-8/+22
| | | | | | | | | | | | | | | NETMAP_print is also used by its .save hook so this change broke iptables-save output. Revert the patch, rename NETMAP_print to __NETMAP_print and use that as the workhorse for both xtables -L and xtables-save. The addition of the 'to' prefix is done in the .print hook only. Reported-by: Shivani Bhardwaj <shivanib134@gmail.com> Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Fixes: 90becf12bd5823b6d59d32d ("extensions: NETMAP: add ' to:' prefix when printing NETMAP target") Signed-off-by: Florian Westphal <fw@strlen.de>
* ip6tables: Warn about use of DROP in nat tableThomas Woerner2016-06-151-0/+7
| | | | | | | Clone of 1eada72b with 9bb76094 and e0390bee on top. Signed-off-by: Thomas Woerner <twoerner@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_MARK: Add translation to nftRoberto García2016-06-141-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | Add translation for the MARK target to nftables. Examples: $ sudo iptables-translate -t mangle -A OUTPUT -j MARK --set-mark 64 nft add rule ip mangle OUTPUT counter meta mark set 0x40 $ sudo iptables-translate -t mangle -A OUTPUT -j MARK --set-xmark 0x40/0x32 nft add rule ip mangle OUTPUT counter meta mark set mark xor 0x40 and 0x32 $ sudo iptables-translate -t mangle -A OUTPUT -j MARK --or-mark 64 nft add rule ip mangle OUTPUT counter meta mark set mark or 0x40 $ sudo iptables-translate -t mangle -A OUTPUT -j MARK --and-mark 64 nft add rule ip mangle OUTPUT counter meta mark set mark and 0x40 $ sudo iptables-translate -t mangle -A OUTPUT -j MARK --xor-mark 64 nft add rule ip mangle OUTPUT counter meta mark set mark xor 0x40 Signed-off-by: Roberto García <rodanber@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_cgroup: Add translation to nftLaura Garcia Liebana2016-06-141-0/+28
| | | | | | | | | | | | | | | | Add translation for cgroup to nft. Path parameter not supported in nft yet. Examples: $ sudo iptables-translate -t filter -A INPUT -m cgroup --cgroup 0 -j ACCEPT nft add rule ip filter INPUT meta cgroup 0 counter accept $ sudo iptables-translate -t filter -A INPUT -m cgroup ! --cgroup 0 -j ACCEPT nft add rule ip filter INPUT meta cgroup != 0 counter accept Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_frag: Add translation to nftLaura Garcia Liebana2016-06-141-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add translation for frag to nftables. According to the --fraglen code: case O_FRAGLEN: /* * As of Linux 3.0, the kernel does not check for * fraglen at all. */ In addition, the kernel code doesn't show any reference to the flag IP6T_FRAG_LEN, so this option is deprecated and won't be translated to nft. Examples: $ sudo iptables-translate -t filter -A INPUT -m frag --fragid 100:200 -j ACCEPT nft add rule ip6 filter INPUT frag id 100-200 counter accept $ sudo iptables-translate -t filter -A INPUT -m frag --fragid 100 --fragres --fragmore -j ACCEPT nft add rule ip6 filter INPUT frag id 100 frag reserved 1 frag more-fragments 1 counter accept $ sudo iptables-translate -t filter -A INPUT -m frag ! --fragid 100:200 -j ACCEPT nft add rule ip6 filter INPUT frag id != 100-200 counter accept $ sudo iptables-translate -t filter -A INPUT -m frag --fragid 100:200 --fraglast -j ACCEPT nft add rule ip6 filter INPUT frag id 100-200 frag more-fragments 0 counter accept $ sudo iptables-translate -t filter -A INPUT -m frag --fragid 100:200 --fragfirst -j ACCEPT nft add rule ip6 filter INPUT frag id 100-200 frag frag-off 0 counter accept $ sudo iptables-translate -t filter -A INPUT -m frag --fraglast -j ACCEPT nft add rule ip6 filter INPUT frag more-fragments 0 counter accept Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_TRACE: Add translation to nftLiping Zhang2016-06-081-0/+8
| | | | | | | | | | For example: # iptables-translate -t raw -A PREROUTING -j TRACE nft add rule ip raw PREROUTING counter nftrace set 1 Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_dscp: Add translation to nftLaura Garcia Liebana2016-06-071-13/+58
| | | | | | | | | | | | | | | Add translation for dscp to nftables, for both ipv4 and ipv6. Examples: $ sudo iptables-translate -t filter -A INPUT -m dscp --dscp 0x32 -j ACCEPT nft add rule ip filter INPUT ip dscp 0x32 counter accept $ sudo ip6tables-translate -t filter -A INPUT -m dscp ! --dscp 0x32 -j ACCEPT nft add rule ip6 filter INPUT ip6 dscp != 0x32 counter accept Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_multiport: Add translation to nftLaura Garcia Liebana2016-06-061-0/+115
| | | | | | | | | | | | | | | | | | Add translation for multiport to nftables, which it's supported natively. Examples: $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80,81 -j ACCEPT nft add rule ip filter INPUT ip protocol tcp tcp dport { 80,81} counter accept $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80:88 -j ACCEPT nft add rule ip filter INPUT ip protocol tcp tcp dport 80-88 counter accept $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport ! --dports 80:88 -j ACCEPT nft add rule ip filter INPUT ip protocol tcp tcp dport != 80-88 counter accept Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_devgroup: Fix order of mask and idShivani Bhardwaj2016-06-021-2/+2
| | | | | | | | | The order of mask and id in the translated code is not apt so fix it. This patch follows commit 8548dd by Liping Zhang. Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_hbh: Add translation to nftLaura Garcia Liebana2016-06-021-0/+17
| | | | | | | | | | | | | | Add translation for Hop-By-Hop header to nftables. Hbh options are not supported yet in nft. $ sudo ip6tables-translate -t filter -A INPUT -m hbh --hbh-len 22 nft add rule ip6 filter INPUT hbh hdrlength 22 counter $ sudo ip6tables-translate -t filter -A INPUT -m hbh ! --hbh-len 22 nft add rule ip6 filter INPUT hbh hdrlength != 22 counter Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_connmark: Fix order of mask and markShivani Bhardwaj2016-06-021-2/+2
| | | | | | | | | | The order of mask and mark in the output is wrong. This has been pointed out: http://git.netfilter.org/iptables/commit/?id=8548dd253833027c68ac6400c3118ef788fabe5d by Liping Zhang <liping.zhang@spreadtrum.com>. This patch fixes the same issue with connmark. Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_ipcomp: Add translation to nftLaura Garcia Liebana2016-06-011-0/+13
| | | | | | | | | | | | | | | | | | Add translation of ipcomp to nftables. First value of the parameter 'ipcompspi' will be translated to 'cpi' parameter in nftables. Parameter 'compres' is not supported in nftables. Examples: $ sudo iptables-translate -t filter -A INPUT -m ipcomp --ipcompspi 0x12 -j ACCEPT nft add rule ip filter INPUT comp cpi 18 counter accept $ sudo iptables-translate -t filter -A INPUT -m ipcomp ! --ipcompspi 0x12 -j ACCEPT nft add rule ip filter INPUT comp cpi != 18 counter accept Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_mark: fix a wrong translation to nft when mask is specifiedLiping Zhang2016-06-011-2/+2
| | | | | | | | | | | | | | | The mask and mark's order is reversed, so when we specify the mask, we will get the wrong translation result: # iptables-translate -A INPUT -m mark --mark 0x1/0xff nft add rule ip filter INPUT mark and 0x1 == 0xff counter Apply this patch, translation will become: # iptables-translate -A INPUT -m mark --mark 0x1/0xff nft add rule ip filter INPUT mark and 0xff == 0x1 counter Cc: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: NETMAP: add ' to:' prefix when printing NETMAP targetFlorian Westphal2016-06-012-2/+2
| | | | | | | | | | | | | | | | NETMAP .print function doesn't insert the ' ' character needed to seperate earlier output from the target network, i.e. iptables -L prints something like 2.2.2.5-2.2.2.103.3.3.64/28 instead of 2.2.2.5-2.2.2.10 3.3.3.64/28 Add a ' to:' prefix just like we do for S/DNAT targets. Closes https://bugzilla.netfilter.org/show_bug.cgi?id=1070. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libxt_limit: fix a wrong translation to nft ruleLiping Zhang2016-05-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The default burst value is 5 in iptables limit extension while it is 0 in nft limit expression, if the burst value is default, it will not be displayed when we dump the rules. But when we do translation from iptables rules to nft rules, we should keep the limit burst value unchanged, even if it is not displayed in iptables rules. And now, if the limit-burst value in the iptables rule is 5 or 0, they are all translated to nft rule without burst, this is wrong: $ sudo iptables-translate -A INPUT -m limit --limit 10/s --limit-burst 5 nft add rule ip filter INPUT limit rate 10/second counter $ sudo iptables-translate -A INPUT -m limit --limit 10/s --limit-burst 0 nft add rule ip filter INPUT limit rate 10/second burst 0 packets counter Apply this patch, translation will become: $ sudo iptables-translate -A INPUT -m limit --limit 10/s --limit-burst 5 nft add rule ip filter INPUT limit rate 10/second burst 5 packets counter $ sudo iptables-translate -A INPUT -m limit --limit 10/s --limit-burst 0 nft add rule ip filter INPUT limit rate 10/second counter Fixes: a8dfbe3a3acb ("extensions: libxt_limit: Add translation to nft") Cc: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: update pf.osXose Vazquez Perez2016-05-051-9/+28
| | | | | | | | | | | | Sync with latest *BSD release: https://gitweb.dragonflybsd.org/dragonfly.git/blob_plain/HEAD:/etc/pf.os Changelog: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os Cc: Evgeniy Polyakov <johnpol@2ka.mxt.ru> Cc: Jan Engelhardt <jengelh@medozas.de> Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: netfilter-devel <netfilter-devel@vger.kernel.org> Signed-off-by: Xose Vazquez Perez <xose.vazquez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_NFQUEUE: Add missing testsShivani Bhardwaj2016-04-291-0/+4
| | | | | | | Add missing tests for NFQUEUE. Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* configure: make libmnl and libnftnl hard requirementsGiuseppe Longo2016-04-271-0/+18
| | | | | | | | | | | Iptables building is broken if either libmnl or libnftnl is not installed on the system. Configure script actually checks if libmnl and libnftnl are installed, but doesn't exit if they are not. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_NFQUEUE: Unstack different versionsShivani Bhardwaj2016-04-271-12/+92
| | | | | | | | | Remove the stacking of older version into the newer one by adding the appropriate code corresponding to each version. Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_NFQUEUE: Fix bug with order of fanout and bypassShivani Bhardwaj2016-04-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | NFQUEUE had a bug with the ordering of fanout and bypass options which was arising due to same and odd values for flags and bypass when used together. Because of this, during bitwise ANDing of flags and NFQ_FLAG_CPU_FANOUT, the value always evaluated to false (since NFQ_FLAG_CPU_FANOUT=0x02) and led to skipping of fanout option whenever it was used before bypass because then flags would be 1. Before this patch, $ sudo iptables -A FORWARD -j NFQUEUE -p TCP --sport 80 --queue-balance 0:3 --queue-cpu-fanout --queue-bypass Chain FORWARD (policy ACCEPT) target prot opt source destination NFQUEUE tcp -- anywhere anywhere tcp spt:http NFQUEUE balance 0:3 bypass After this patch, Chain FORWARD (policy ACCEPT) target prot opt source destination NFQUEUE tcp -- anywhere anywhere tcp spt:http NFQUEUE balance 0:3 bypass cpu-fanout Closes bugzilla entry: http://bugzilla.netfilter.org/show_bug.cgi?id=939 Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: Don't print "nft" in iptables-restore-translate commandGuruswamy Basavaiah2016-04-271-1/+3
| | | | | | | | No need to print "nft" in function do_command_xlate, if the function is called from iptables-restore-translate command. Signed-off-by: Guruswamy Basavaiah <guru2018@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: Printing the table name before chain name.Guruswamy Basavaiah2016-04-271-1/+1
| | | | | | | | | | | | | | | Command ./iptables-restore-translate, was printing table name before the chain name for user added chains. This is breaking ./nft -f command. Before fix, output of "./iptables-restore-translate" add chain ip OUTPUT_direct raw After fix: add chain ip raw OUTPUT_direct Signed-off-by: Guruswamy Basavaiah <guru2018@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables.8: nat table has four builtin chainsFlorian Westphal2016-04-261-2/+3
| | | | | | | | SNAT section in iptables-extensions(8) already mentions this but the main section did not. Reported-by: Lion Yang <lion@aosc.io> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions/libxt_tcp: fix nftables translate flags value, 'none' vs '0x0'Arturo Borrero2016-04-071-1/+1
| | | | | | | | | | | | | | | | The iptables command: -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE should translate to: tcp flags & fin|syn|rst|psh|ack|urg == 0x0 instead of: tcp flags & fin|syn|rst|psh|ack|urg == none Reported-by: Vadim A. Misbakh-Soloviov <netfilter@mva.name> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Tested-by: Vadim A. Misbakh-Soloviov <netfilter@mva.name> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: extensions: libxt_TEE: Add translation to nftRoberto García2016-03-281-0/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add translation for TEE target to nft. However, there is a problem with the output when using ip6tables-translate. I couldn't find a fix for that. Examples: $ iptables-translate -t mangle -A PREROUTING \ -j TEE --gateway 192.168.0.2 --oif eth0 nft add rule ip mangle PREROUTING counter dup to 192.168.0.2 device eth0 $ iptables-translate -t mangle -A PREROUTING \ -j TEE --gateway 192.168.0.2 nft add rule ip mangle PREROUTING counter dup to 192.168.0.2 $ ip6tables-translate -t mangle -A PREROUTING \ -j TEE --gateway ab12:00a1:1112:acba:: nft add rule ip6 mangle PREROUTING counter dup to ab12:a1:1112:acba:: $ ip6tables-translate -t mangle -A PREROUTING \ -j TEE --gateway ab12:00a1:1112:acba:: --oif eth0 nft add rule ip6 mangle PREROUTING counter dup to ab12:a1:1112:acba:: device eth0 Signed-off-by: Roberto García <rodanber@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: missing comment initialization in xt_xlate_alloc()Pablo Neira Ayuso2016-03-251-0/+1
| | | | | | Initialize comment buffer when allocation the xt translation structure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure: Show support for connlabelShivani Bhardwaj2016-03-221-9/+22
| | | | | | | | | | | | | | | | | | | | | Add the --disable-connlabel option and the appropriate functionality associated with it. After this patch, iptables configuration shows up as: Iptables Configuration: IPv4 support: yes IPv6 support: yes Devel support: yes IPQ support: no Large file support: yes BPF utils support: no nfsynproxy util support: no nftables support: yes connlabel support: yes Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: translate iptables --flushGuruswamy Basavaiah2016-03-221-0/+8
| | | | | | | | | | | | | translation for iptables --flush Examples: $ sudo iptables-translate -F INPUT nft flush chain ip filter INPUT $ sudo iptables-translate -F -t nat nft flush table ip nat Signed-off-by: Guruswamy Basavaiah <guru2018@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_REJECT: Avoid to print the default reject with value in ↵Laura Garcia Liebana2016-03-171-1/+4
| | | | | | | | | | | | | | | | | | | | the translation Avoid to print the reject with value in the translation when the value is the default. Before this patch: $ sudo ip6tables-translate -A FORWARD -p TCP --dport 22 -j REJECT nft add rule ip6 filter FORWARD tcp dport 22 counter reject with icmpv6 type port-unreachable After this patch: $ sudo ip6tables-translate -A FORWARD -p TCP --dport 22 -j REJECT nft add rule ip6 filter FORWARD tcp dport 22 counter reject Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>