summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* xtables: nft: add protocol and flags for xtables over nf_tablesPablo Neira Ayuso2013-12-302-0/+22
| | | | | | Add protocol and flags for the compatibility layer. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: support atomic commitPablo Neira Ayuso2013-12-305-5/+90
| | | | | | | | | | | | | Use new services in nf_tables to support atomic commit. Commit per table, although we support global commit at once, call commit for each table to emulate iptables-restore behaviour by now. Keep table dormant/wake up code in iptables/nft.c as it can be used in the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: purge out user-define chains from the kernelPablo Neira Ayuso2013-12-303-13/+76
| | | | | | | xtables-restore has to purge out user-defined chains that are not defined in the configuration file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: fix compilation warningPablo Neira Ayuso2013-12-301-0/+3
| | | | | | | xtables-standalone.c: In function ‘xtables_main’: xtables-standalone.c:64:2: warning: implicit declaration of function ‘do_commandx’ [-Wimplicit-function-declaration] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: fix custom user chain restorationPablo Neira Ayuso2013-12-301-11/+20
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add IPv6 supportTomasz Bursztyka2013-12-305-292/+772
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary of changes to add IPv6 support to the xtables utility: * modify all commands (add, delete, replace, check and listing) to support IPv6 addresses. And for the internal nft library: * add family to struct nft_handle and modify all caller to use this family instead of the hardcoded AF_INET. * move code that we can re-use for IPv4 and IPv6 into helper functions. * add IPv6 rule printing support. * add support to parse IPv6 address. Pablo added several improvements to this patch: * added basic xtables-save and xtables-restore support (so it defaults to IPv4) * fixed a couple of bugs found while testing * added reference when -f is used to point to -m frag (until we can make this consistent with IPv4). Note that we use one single xtables binary utility for IPv4 and IPv6. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: fix crash due to using wrong globalsPablo Neira Ayuso2013-12-301-5/+5
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: adapt chain rename to recent Patrick's updatesPablo Neira Ayuso2013-12-302-4/+54
| | | | | | | This patch gets existing code in sync with Patrick's chain renaming new approach. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: add support for dormant tablesPablo Neira Ayuso2013-12-304-4/+71
| | | | | | This patch adds support for dormant tables for xtables-restore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: use chain typesPablo Neira Ayuso2013-12-301-3/+49
| | | | | | We use the new special chain types defined in the kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: use 64-bits handlePablo Neira Ayuso2013-12-302-5/+6
| | | | | | Now that we use that in kernel space and in libnftables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: remove __nft_check_rulePablo Neira Ayuso2013-12-301-38/+104
| | | | | | | Rework code to remove __nft_check_rule and split it into logical fragments. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: move priority to chain instead of tablePablo Neira Ayuso2013-12-301-34/+43
| | | | | | | NAT table uses different chain priorities, adapt the existing code to allow this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* headers: remove unused compatibility definitionsPablo Neira Ayuso2013-12-301-18/+0
| | | | | | They belong to nf_tables_compat.h Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix missing rule listing in custom chains with -LPablo Neira Ayuso2013-12-301-5/+1
| | | | | Reported-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: Add support for -R optionTomasz Bursztyka2013-12-303-12/+21
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* iptables: nft: Refactor __nft_rule_check to return rule handle when relevantTomasz Bursztyka2013-12-301-6/+9
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* iptables: nft: Fix -D chain rulenum optionTomasz Bursztyka2013-12-301-3/+4
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* nft: Add support for chain rename options (-E)Tomasz Bursztyka2013-12-302-5/+29
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* headers: Make nf_tables.h up to dateTomasz Bursztyka2013-12-301-0/+2
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* iptables: nft: add -f supportPablo Neira Ayuso2013-12-301-0/+90
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rework automatic creation of built-in table and chainsPablo Neira Ayuso2013-12-301-93/+112
| | | | | | | | | | | | | | | This patch reworks the automatic creation of built-in table and chains. Now it initializes all built-in chains belonging a table at once. This happens with commands: -P, -A, -I, -N Note that xtables skips chain initialization if it notices that the table already exists in the kernel. Thanks to Tomasz Bursztyka for spotting problems with -N. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* automatic creation of built-in table and chainsPablo Neira Ayuso2013-12-301-38/+105
| | | | | | | | | | | | | | | | | | | | | In order to emulate the iptables behaviour, this patch changes the current behaviour to: 1st) check if the table and chains are built-in. 2nd) If they don't exists, create them. If they exists, don't touch them. The automatic creation happens in the -I and -P paths. We should provide a new command to allow to delete (unregister) built-in tables and chains. It would be similar to unloading the iptable_X module that registers the custom table. This is not done for other commands like -C or -D since they will fail while trying to find the rule in the kernel if such combination of chain and table does not exists. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* use nf_tables and nf_tables compatibility interfacePablo Neira Ayuso2013-12-3023-5/+5723
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the following utilities: * xtables * xtables-restore * xtables-save * xtables-config They all use Patrick's nf_tables infrastructure plus my compatibility layer. xtables, xtables-restore and xtables-save are syntax compatible with ip[6]tables, ip[6]tables-restore and ip[6]tables-save. Semantics aims to be similar, still the main exception is that there is no commit operation. Thus, we incrementally add/delete rules without entire table locking. The following options are also not yet implemented: -Z (this requires adding expr->ops->reset(...) so nft_counters can reset internal state of expressions while dumping it) -R and -E (this requires adding this feature to nf_tables) -f (can be implemented with expressions: payload 6 (2-bytes) + bitwise a&b^!b + cmp neq 0) -IPv6 support. But those are a matter of time to get them done. A new utility, xtables-config, is available to register tables and chains. By default there is a configuration file that adds backward compatible tables and chains under iptables/etc/xtables.conf. You have to call this utility first to register tables and chains. However, it would be possible to automagically register tables and chains while using xtables and xtables-restore to get similar operation than with iptables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-save: remove dlfcn.h includeGustavo Zacarias2013-11-282-8/+0
| | | | | | | | It's not required and breaks on static-only uClibc builds which don't have the header file. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Florian Westphal <fw@strlen.de>
* Merge branch 'stable-1.4.20'Florian Westphal2013-11-232-6/+4
|\ | | | | | | | | | | | | | | | | | | | | | | ... to get 76e230e ('iptables: link against libnetfilter_conntrack'), else static build doesn't work. Conflicts: extensions/GNUmakefile.in [ CPPFLAGS was added in master, so keep it ] Reported-By: Gustavo Zacarias <gustavo@zacarias.com.ar>
| * iptables: link against libnetfilter_conntrackJan Engelhardt2013-08-232-6/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linking currently fails in --enable-static case: ../extensions/libext.a(libxt_connlabel.o): In function `connlabel_get_name': iptables/extensions/libxt_connlabel.c:57: undefined reference to `nfct_labelmap_get_name' [..] It's libxtables.la(libxt_connlabel.o) using libnetfilter_conntrack. If libnetfilter_conntrack is not found, @libnetfilter_conntrack_CFLAGS@ and @libnetfilter_conntrack_LIBS@ (and their ${} ones) should be empty, therefore producing no harm to include unconditionally. Reported-and-tested-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Florian Westphal <fw@strlen.de>
* | iptables 1.4.21 releasev1.4.21Pablo Neira Ayuso2013-11-221-1/+1
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | utils: nfsynproxy: fix error while compiling the BPF filterPablo Neira Ayuso2013-11-181-8/+8
| | | | | | | | | | | | | | | | | | | | | | Fix the following error while running nfsynproxy here: pcap_compile: not-yet-activated pcap_t passed to pcap_compile According to what I have read, we have to compile the filter once the pcap_t handle has been activated. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | extensions: libxt_set, libxt_SET: check the set family tooJozsef Kadlecsik2013-11-182-4/+57
| | | | | | | | | | | | | | | | | | | | | | Do not accept silently sets with wrong protocol family but reject them with an error message. It makes straightforward to catch user errors. [ Use afinfo instead to avoid a binary interface update --pablo ] Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | utils: add nfsynproxy toolPatrick McHardy2013-11-183-2/+240
| | | | | | | | | | | | | | | | | | [ Originally synconf, but Jesper D. Brouer suggested to change the name to avoid a possible filename clash. I also include nfsynproxy in the final configure report --pablo ] Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | extensions: add SYNPROXY extensionPatrick McHardy2013-11-182-0/+143
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* | extensions: libxt_cluster: add note on arptables-jfPablo Neira Ayuso2013-11-041-0/+5
| | | | | | | | | | | | | | | | | | Gao feng reported problems while getting the cluster match working with arptables. This patch adds a note in the manpage to warn about the arptables-jf syntax, which is different from mainstream arptables. Reported-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | ip6tables: Use consistent exit code for EAGAINKevin Cernekee2013-11-031-0/+2
| | | | | | | | | | | | | | | | | | | | | | As of commit 056564f6a (Add new exit value to indicate concurrency issues), the IPv4 iptables binary returns exit status 4 to indicate that the kernel returned EAGAIN when trying to update a table. But ip6tables still returns exit status 1 under the same circumstances. Update ip6tables to bring it in line with iptables behavior. Signed-off-by: Kevin Cernekee <cernekee@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: spurious error in load_extensionPhil Oester2013-11-031-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In commit 927385017047d (iptables: improve error reporting with extension loading troubles), a new error message was added in an attempt to handle the case where a match does not support a particular protocol family. For instance, attempting to use the osf match on IPv6. Unfortunately, this error message now triggers when creating a new chain which has the same name as a match extension, because iptables calls xtables_find_target with the name of the new chain to verify it does not clash with an existing target. For example: # iptables -N tcp /usr/lib/xtables/libxt_tcp.so: no "tcp" extension found for this protocol I attempted to resolve this by adding a new XTF flag, but that required changes in many different places (including -j handling). It seems easiest just to remove this warning and stick with the original error message of ENOENT, even if less than precise. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: improve chain name validationPhil Oester2013-11-032-26/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | As pointed out by Andrew Domaszek, iptables allows whitespace to be included in chain names. This causes issues with iptables-restore, and later iptables actions on the chain. Attached patch disallows whitespace, and also consolidates all chain name checking into a new function. This closes netfilter bugzilla #855. [ Included ip6tables changed as well --pablo ] Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: extensions/GNUMakefile.in use CPPFLAGSLaurence J. Lane2013-09-271-1/+1
| | | | | | | | | | | | | | | | | | | | "All other Makefiles add CPPFLAGS to ${COMPILE} (automake), but GNUmakefile.in doesn't set it." http://bugs.debian.org/665286 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | extensions: libxt_LOG: use generic syslog reference in manpageLaurence J. Lane2013-09-271-4/+2
| | | | | | | | | | | | | | | | | | | | | | Fedora, ArchLinux, Ubuntu, and Debian, at the least, use alternative syslog daemons by default these days. Let's make the syslog reference generic. Reference: http://bugs.debian.org/567564 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | libxtables: xtables_ipmask_to_numeric incorrect with non-CIDR masksPhil Oester2013-09-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | As pointed out by Peter Hoelsken, rules created with non-standard masks such as 0.255.0.0, 0.0.255.0, etc. are displayed when output with iptables -L in CIDR notation as -1. This is because the cidr variable in xtables_ipmask_to_numeric is unsigned, and the return value of -1 from xtables_ipmask_to_cidr is therefore converted to UINT_MAX. Add a cast to workaround the issue. This closes netfilter bugzilla #854. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: libxt_string.man add examplesLaurence J. Lane2013-08-241-0/+10
| | | | | | | | | | | | | | | | Add usage examples for string and hex string patterns. References: http://bugs.debian.org/699904 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* | iptables: libxt_recent.{c,man} dead URLLaurence J. Lane2013-08-242-4/+1
| | | | | | | | | | | | | | Remove it. Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* | build: add software version to manpage first line at configure stagePablo Neira Ayuso2013-08-225-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | This patch adds the software version to the first line of the following manpages: iptables-save.8 iptables-restore.8 iptables-apply.8 iptables-xml.1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: iptables-xm1.1 correct man sectionLaurence J. Lane2013-08-221-1/+1
| | | | | | | | | | | | | | iptables-xml.8 was moved to iptables-xm1.1. Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: libip(6)t_REJECT.man default icmp typesLaurence J. Lane2013-08-222-7/+6
| | | | | | | | | | | | | | | | | | | | | | | | The extension man page shows "port-unreach" and "port-unreachable" as default icmpv6 and icomp reject-with types. Either and variations work fine for writing rules, but they are displayed as "icmp6-port-unreachable" and "icmp-port-unreachable". Let's make that consistent. http://bugs.debian.org/644819 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: libxt_conntrack.man extraneous commasLaurence J. Lane2013-08-221-2/+2
| | | | | | | | | | | | | | | | | | | | | | The first might work. The second doesn't. (The other corrections in the bug report are already implemented.) http://bugs.debian.org/654983 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: libxt_hashlimit.man: correct addressLaurence J. Lane2013-08-221-1/+1
| | | | | | | | | | | | | | | | | | Corrects an example address with subnet mask. http://bugs.debian.org/698393 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | ip[6]tables: fix incorrect alignment in commands_v_optionsPablo Neira Ayuso2013-08-142-2/+2
| | | | | | | | | | | | | | | | | | | | CMD_ZERO_NUM is 14, so it has to be defined in position 15 in the commands_v_options array. This does not manifests easily since commands from 9 to 14 have a very similar pattern in such array. Based on this patch: http://patchwork.ozlabs.org/patch/188153/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge branch 'stable-1.4.20'Pablo Neira Ayuso2013-08-081-0/+6
|\| | | | | | | | | | | To retrieve: iptables: state match incompatibilty across versions
| * iptables: state match incompatibilty across versionsPhil Oester2013-08-081-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As reported in Debian bug #718810 [1], state match rules added in < 1.4.16 iptables versions are incorrectly displayed by >= 1.4.16 iptables versions. Issue bisected to commit 0d701631 (libxt_state: replace as an alias to xt_conntrack). Fix this by adding the missing .print and .save functions for state match aliases in the conntrack match. [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718810 Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge branch 'stable-1.4.20'Pablo Neira Ayuso2013-08-081-1/+1
|\| | | | | | | | | | | To retrieve: iptables: correctly reference generated file