summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* headers: Make nf_tables.h up to dateTomasz Bursztyka2013-12-301-0/+2
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* iptables: nft: add -f supportPablo Neira Ayuso2013-12-301-0/+90
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rework automatic creation of built-in table and chainsPablo Neira Ayuso2013-12-301-93/+112
| | | | | | | | | | | | | | | This patch reworks the automatic creation of built-in table and chains. Now it initializes all built-in chains belonging a table at once. This happens with commands: -P, -A, -I, -N Note that xtables skips chain initialization if it notices that the table already exists in the kernel. Thanks to Tomasz Bursztyka for spotting problems with -N. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* automatic creation of built-in table and chainsPablo Neira Ayuso2013-12-301-38/+105
| | | | | | | | | | | | | | | | | | | | | In order to emulate the iptables behaviour, this patch changes the current behaviour to: 1st) check if the table and chains are built-in. 2nd) If they don't exists, create them. If they exists, don't touch them. The automatic creation happens in the -I and -P paths. We should provide a new command to allow to delete (unregister) built-in tables and chains. It would be similar to unloading the iptable_X module that registers the custom table. This is not done for other commands like -C or -D since they will fail while trying to find the rule in the kernel if such combination of chain and table does not exists. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* use nf_tables and nf_tables compatibility interfacePablo Neira Ayuso2013-12-3023-5/+5723
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the following utilities: * xtables * xtables-restore * xtables-save * xtables-config They all use Patrick's nf_tables infrastructure plus my compatibility layer. xtables, xtables-restore and xtables-save are syntax compatible with ip[6]tables, ip[6]tables-restore and ip[6]tables-save. Semantics aims to be similar, still the main exception is that there is no commit operation. Thus, we incrementally add/delete rules without entire table locking. The following options are also not yet implemented: -Z (this requires adding expr->ops->reset(...) so nft_counters can reset internal state of expressions while dumping it) -R and -E (this requires adding this feature to nf_tables) -f (can be implemented with expressions: payload 6 (2-bytes) + bitwise a&b^!b + cmp neq 0) -IPv6 support. But those are a matter of time to get them done. A new utility, xtables-config, is available to register tables and chains. By default there is a configuration file that adds backward compatible tables and chains under iptables/etc/xtables.conf. You have to call this utility first to register tables and chains. However, it would be possible to automagically register tables and chains while using xtables and xtables-restore to get similar operation than with iptables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-save: remove dlfcn.h includeGustavo Zacarias2013-11-282-8/+0
| | | | | | | | It's not required and breaks on static-only uClibc builds which don't have the header file. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Florian Westphal <fw@strlen.de>
* Merge branch 'stable-1.4.20'Florian Westphal2013-11-232-6/+4
|\ | | | | | | | | | | | | | | | | | | | | | | ... to get 76e230e ('iptables: link against libnetfilter_conntrack'), else static build doesn't work. Conflicts: extensions/GNUmakefile.in [ CPPFLAGS was added in master, so keep it ] Reported-By: Gustavo Zacarias <gustavo@zacarias.com.ar>
| * iptables: link against libnetfilter_conntrackJan Engelhardt2013-08-232-6/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linking currently fails in --enable-static case: ../extensions/libext.a(libxt_connlabel.o): In function `connlabel_get_name': iptables/extensions/libxt_connlabel.c:57: undefined reference to `nfct_labelmap_get_name' [..] It's libxtables.la(libxt_connlabel.o) using libnetfilter_conntrack. If libnetfilter_conntrack is not found, @libnetfilter_conntrack_CFLAGS@ and @libnetfilter_conntrack_LIBS@ (and their ${} ones) should be empty, therefore producing no harm to include unconditionally. Reported-and-tested-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Florian Westphal <fw@strlen.de>
* | iptables 1.4.21 releasev1.4.21Pablo Neira Ayuso2013-11-221-1/+1
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | utils: nfsynproxy: fix error while compiling the BPF filterPablo Neira Ayuso2013-11-181-8/+8
| | | | | | | | | | | | | | | | | | | | | | Fix the following error while running nfsynproxy here: pcap_compile: not-yet-activated pcap_t passed to pcap_compile According to what I have read, we have to compile the filter once the pcap_t handle has been activated. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | extensions: libxt_set, libxt_SET: check the set family tooJozsef Kadlecsik2013-11-182-4/+57
| | | | | | | | | | | | | | | | | | | | | | Do not accept silently sets with wrong protocol family but reject them with an error message. It makes straightforward to catch user errors. [ Use afinfo instead to avoid a binary interface update --pablo ] Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | utils: add nfsynproxy toolPatrick McHardy2013-11-183-2/+240
| | | | | | | | | | | | | | | | | | [ Originally synconf, but Jesper D. Brouer suggested to change the name to avoid a possible filename clash. I also include nfsynproxy in the final configure report --pablo ] Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | extensions: add SYNPROXY extensionPatrick McHardy2013-11-182-0/+143
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* | extensions: libxt_cluster: add note on arptables-jfPablo Neira Ayuso2013-11-041-0/+5
| | | | | | | | | | | | | | | | | | Gao feng reported problems while getting the cluster match working with arptables. This patch adds a note in the manpage to warn about the arptables-jf syntax, which is different from mainstream arptables. Reported-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | ip6tables: Use consistent exit code for EAGAINKevin Cernekee2013-11-031-0/+2
| | | | | | | | | | | | | | | | | | | | | | As of commit 056564f6a (Add new exit value to indicate concurrency issues), the IPv4 iptables binary returns exit status 4 to indicate that the kernel returned EAGAIN when trying to update a table. But ip6tables still returns exit status 1 under the same circumstances. Update ip6tables to bring it in line with iptables behavior. Signed-off-by: Kevin Cernekee <cernekee@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: spurious error in load_extensionPhil Oester2013-11-031-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In commit 927385017047d (iptables: improve error reporting with extension loading troubles), a new error message was added in an attempt to handle the case where a match does not support a particular protocol family. For instance, attempting to use the osf match on IPv6. Unfortunately, this error message now triggers when creating a new chain which has the same name as a match extension, because iptables calls xtables_find_target with the name of the new chain to verify it does not clash with an existing target. For example: # iptables -N tcp /usr/lib/xtables/libxt_tcp.so: no "tcp" extension found for this protocol I attempted to resolve this by adding a new XTF flag, but that required changes in many different places (including -j handling). It seems easiest just to remove this warning and stick with the original error message of ENOENT, even if less than precise. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: improve chain name validationPhil Oester2013-11-032-26/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | As pointed out by Andrew Domaszek, iptables allows whitespace to be included in chain names. This causes issues with iptables-restore, and later iptables actions on the chain. Attached patch disallows whitespace, and also consolidates all chain name checking into a new function. This closes netfilter bugzilla #855. [ Included ip6tables changed as well --pablo ] Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: extensions/GNUMakefile.in use CPPFLAGSLaurence J. Lane2013-09-271-1/+1
| | | | | | | | | | | | | | | | | | | | "All other Makefiles add CPPFLAGS to ${COMPILE} (automake), but GNUmakefile.in doesn't set it." http://bugs.debian.org/665286 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | extensions: libxt_LOG: use generic syslog reference in manpageLaurence J. Lane2013-09-271-4/+2
| | | | | | | | | | | | | | | | | | | | | | Fedora, ArchLinux, Ubuntu, and Debian, at the least, use alternative syslog daemons by default these days. Let's make the syslog reference generic. Reference: http://bugs.debian.org/567564 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | libxtables: xtables_ipmask_to_numeric incorrect with non-CIDR masksPhil Oester2013-09-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | As pointed out by Peter Hoelsken, rules created with non-standard masks such as 0.255.0.0, 0.0.255.0, etc. are displayed when output with iptables -L in CIDR notation as -1. This is because the cidr variable in xtables_ipmask_to_numeric is unsigned, and the return value of -1 from xtables_ipmask_to_cidr is therefore converted to UINT_MAX. Add a cast to workaround the issue. This closes netfilter bugzilla #854. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: libxt_string.man add examplesLaurence J. Lane2013-08-241-0/+10
| | | | | | | | | | | | | | | | Add usage examples for string and hex string patterns. References: http://bugs.debian.org/699904 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* | iptables: libxt_recent.{c,man} dead URLLaurence J. Lane2013-08-242-4/+1
| | | | | | | | | | | | | | Remove it. Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* | build: add software version to manpage first line at configure stagePablo Neira Ayuso2013-08-225-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | This patch adds the software version to the first line of the following manpages: iptables-save.8 iptables-restore.8 iptables-apply.8 iptables-xml.1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: iptables-xm1.1 correct man sectionLaurence J. Lane2013-08-221-1/+1
| | | | | | | | | | | | | | iptables-xml.8 was moved to iptables-xm1.1. Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: libip(6)t_REJECT.man default icmp typesLaurence J. Lane2013-08-222-7/+6
| | | | | | | | | | | | | | | | | | | | | | | | The extension man page shows "port-unreach" and "port-unreachable" as default icmpv6 and icomp reject-with types. Either and variations work fine for writing rules, but they are displayed as "icmp6-port-unreachable" and "icmp-port-unreachable". Let's make that consistent. http://bugs.debian.org/644819 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: libxt_conntrack.man extraneous commasLaurence J. Lane2013-08-221-2/+2
| | | | | | | | | | | | | | | | | | | | | | The first might work. The second doesn't. (The other corrections in the bug report are already implemented.) http://bugs.debian.org/654983 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: libxt_hashlimit.man: correct addressLaurence J. Lane2013-08-221-1/+1
| | | | | | | | | | | | | | | | | | Corrects an example address with subnet mask. http://bugs.debian.org/698393 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | ip[6]tables: fix incorrect alignment in commands_v_optionsPablo Neira Ayuso2013-08-142-2/+2
| | | | | | | | | | | | | | | | | | | | CMD_ZERO_NUM is 14, so it has to be defined in position 15 in the commands_v_options array. This does not manifests easily since commands from 9 to 14 have a very similar pattern in such array. Based on this patch: http://patchwork.ozlabs.org/patch/188153/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge branch 'stable-1.4.20'Pablo Neira Ayuso2013-08-081-0/+6
|\| | | | | | | | | | | To retrieve: iptables: state match incompatibilty across versions
| * iptables: state match incompatibilty across versionsPhil Oester2013-08-081-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As reported in Debian bug #718810 [1], state match rules added in < 1.4.16 iptables versions are incorrectly displayed by >= 1.4.16 iptables versions. Issue bisected to commit 0d701631 (libxt_state: replace as an alias to xt_conntrack). Fix this by adding the missing .print and .save functions for state match aliases in the conntrack match. [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718810 Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge branch 'stable-1.4.20'Pablo Neira Ayuso2013-08-081-1/+1
|\| | | | | | | | | | | To retrieve: iptables: correctly reference generated file
| * iptables: correctly reference generated fileLutz Jaenicke2013-08-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | Since (14bca55 iptables: use autoconf to process .in man pages), the file "iptables-extensions.8.tmpl" is generated from "iptables-extensions.8.tmpl.in" and is consequently no longer found in ${srcdir} but in the build directory. (Becomes visible with builddir != srcdir) Signed-off-by: Lutz Jaenicke <ljaenicke@innominate.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | xtables: trivial spelling fixstephen hemminger2013-08-071-2/+2
| | | | | | | | | | Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | doc: merge ip6table man pages into ipv4 onesFlorian Westphal2013-08-0710-610/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | a couple of improvements to the iptables man page never made it into ip6tables version. The number of differences between these two files is so small that it seems preferable to alias the ipv6 man pages to their ipv4 counterpart and change iptables man page to specifically document differences (e.g. lack of ip6tables -f, etc). Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | doc: add libnetfilter_queue pointer to libxt_NFQUEUE.manFlorian Westphal2013-08-062-19/+12
| | | | | | | | | | | | | | | | ... and remove the QUEUE snippets from ip(6)tables man page, the queue target was replaced by nfqueue years ago. Fix up a couple of needless differences in ip(6)tables.8, too. Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: libxt_socket: update man pageFlorian Westphal2013-08-061-2/+19
| | | | | | | | | | | | | | | | | | | | | | Document --nowildcard option and its implications when using -m socket to intercept packets. While at it, update man page with Balazs Scheidlers comments from nf_tproxy_core.h in kernel tree to better explain how lookup is performed. Cc: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* | xt_socket: add --nowildcard flagEric Dumazet2013-08-062-0/+69
|/ | | | | | | | | | | | | | | | | | | | | xt_socket module can be a nice replacement to conntrack module in some cases (SYN filtering for example) But it lacks the ability to match the 3rd packet of TCP handshake (ACK coming from the client). Add a XT_SOCKET_NOWILDCARD flag to disable the wildcard mechanism The wildcard is the legacy socket match behavior, that ignores LISTEN sockets bound to INADDR_ANY (or ipv6 equivalent) iptables -I INPUT -p tcp --syn -j SYN_CHAIN iptables -I INPUT -m socket -j ACCEPT Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Patrick McHardy <kaber@trash.net> Cc: Jesper Dangaard Brouer <brouer@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables 1.4.20 releasev1.4.20Pablo Neira Ayuso2013-08-061-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-xml: fix parameter parsing (similar to 2165f38)Pablo Neira Ayuso2013-07-261-1/+1
| | | | | | | | Similar to (2165f38 iptables-restore: fix parameter parsing (shows up with gcc-4.7)), make sure iptables-xml doesn't hit the same problem. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: iptables-xml: Fix various parsing bugsPhil Oester2013-07-261-6/+13
| | | | | | | | | | | | | There are two bugs in iptables-xml do_rule_part parsing corrected by this patch: 1) Ignore "-A <chain>" instead of just "-A" 2) When checking to see if we need a <match> tag, inversion needs to be taken into account This closes netfilter bugzilla #679. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: fail in configure on missing dependency with --enable-bpf-compilerWillem de Bruijn2013-07-261-0/+4
| | | | | | | | | | | The build of utils/nfbpf_compile depends on libpcap. If configure is run with --enable-bpf-compiler, the script succeeds, but make fails. This small patch adds a test for the dependency (libpcap) in configure and fails hard if not found. Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: additional include path required after UAPI changesPhil Oester2013-07-241-2/+2
| | | | | | | | | | | | | | After kernel commit 607ca46e (UAPI: (Scripted) Disintegrate include/linux), using the "--with-kernel" argument to build iptables stopped working due to the missing #ifdefs in the original files. We need to make sure the UAPI include dir is listed before the original location. Leaving both allows support for old and new kernels. This fixes bug #833. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxt_CT: Add the "NOTRACK" aliasJozsef Kadlecsik2013-07-243-3/+54
| | | | | | | Available since Linux kernel 3.8. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libip6t_LOG: target output is different to libipt_LOGPhil Oester2013-07-241-2/+4
| | | | | | | | | libipt_LOG is using the xtables_save_string func, which escapes unsafe characters as needed. libip6t_LOG should do the same. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxt_recent: restore minimum value for --secondsPablo Neira Ayuso2013-07-241-1/+1
| | | | | | | This checking was accidentally removed in (74ded72 libxt_recent: add --mask netmask). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_connlabel: use libnetfilter_conntrackFlorian Westphal2013-07-166-127/+45
| | | | | | | | | | | | | | | | | Pablo suggested to make it depend on lnf-conntrack, and get rid of the example config file as well. The problem is that the file must be in a fixed path, /etc/xtables/connlabel.conf, else userspace needs to "guess-the-right-file" when translating names to their bit values (and vice versa). Originally "make install" did put an example file into /etc/xtables/, but distributors complained about iptables ignoring the sysconfdir. So rather remove the example file, the man-page explains the format, and connlabels are inherently system-specific anyway. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libipt_ULOG: man page should mention NFLOG as replacementFlorian Westphal2013-07-151-1/+2
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* libxt_recent: restore reap functionality to recent moduleRussell Senior2013-07-151-0/+2
| | | | | | | | | | | | The reap functionality appears to have been accidentally disabled by (74ded72 libxt_recent: add --mask netmask) since iptables 1.4.15 and later. This adds a patch to restore reap functionality for recent_opts_v1. Patch obtained via: http://patchwork.openwrt.org/patch/3812/ Signed-off-by: Russell Senior <russell@personaltelco.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip{6}tables-restore: fix breakage due to new locking approachPablo Neira Ayuso2013-07-088-10/+22
| | | | | | | | | | | | | | | | Since (93587a0 ip[6]tables: Add locking to prevent concurrent instances), ip{6}tables-restore does not work anymore: iptables-restore < x Another app is currently holding the xtables lock. Perhaps you want to use the -w option? do_command{6}(...) is called from ip{6}tables-restore for every iptables command contained in the rule-set file. Thus, hitting the lock error after the second command. Fix it by bypassing the locking in the ip{6}tables-restore path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip6tables: don't print out /128Phil Oester2013-07-081-1/+5
| | | | | | | | Similar to how iptables does not print /32 on IPv4 addresses, ip6tables should not print out /128 on IPv6 addresses. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>