summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* iptables-compat: use new symbols in libnftnlPablo Neira Ayuso2015-09-1615-643/+643
| | | | | | | | | Adapt this code to use the new symbols in libnftnl. This patch contains quite some renaming to reserve the nft_ prefix for our high level library. Explicitly request libnftnl 1.0.5 at configure stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: fix several test errorsPablo Neira Ayuso2015-09-164-5/+3
| | | | | | | | | | extensions/libxt_esp.t: ERROR: line 7 (should fail: iptables -A INPUT -p esp -m esp) extensions/libip6t_rt.t: ERROR: line 5 (should fail: ip6tables -A INPUT -m rt) extensions/libip6t_ah.t: ERROR: line 15 (should fail: ip6tables -A INPUT -m ah) extensions/libipt_ah.t: ERROR: line 13 (should fail: iptables -A INPUT -p ah -m ah) Fixes: 4264de1f270a ("extensions: restore matching any SPI id by default") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: icmp6: added missing icmpv6 dest-unreach codesAndreas Herz2015-09-141-0/+3
| | | | | | | | | | | | | | | | | | | | | | https://tools.ietf.org/html/rfc4443 says: ICMPv6 Fields: Type 1 Code 0 - No route to destination 1 - Communication with destination administratively prohibited 2 - Beyond scope of source address 3 - Address unreachable 4 - Port unreachable 5 - Source address failed ingress/egress policy 6 - Reject route to destination Add missing code 2, 5 and 6. Signed-off-by: Andreas Herz <andi@geekosphere.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Spelling fixesVille Skyttä2015-09-076-23/+29
| | | | | | | While at it, update comment format for the respective blocks. Signed-off-by: Ville Skyttä <ville.skytta@iki.fi> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: update gitignore listMike Frysinger2015-08-261-0/+3
| | | | | Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libiptc: fix fortify errors in debug codeMike Frysinger2015-08-261-3/+3
| | | | | | | | When using open(O_CREAT), you must supply the mode bits, otherwise the func will pull random garbage off the stack. Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: add finer module blacklistingMike Frysinger2015-08-262-7/+23
| | | | | | | | | | | Newer extensions require libnftnl in order to build, but there are no configure or build checks for it, which leads to a bunch of modules failing when libnftnl isn't installed. Add finer grained blacklisting so we can disable modules for specific parts rather than all of them. e.g. We want to blacklist libebt_limit, but not libxt_limit. Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure: fix 3rd arg w/AC_ARG_ENABLEMike Frysinger2015-08-181-2/+2
| | | | | | | | The 3rd arg is used when --{enable,disable}-foo are passed in, not when the feature is enabled. Use the existing $enableval instead. Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: restore matching any SPI id by defaultJan Engelhardt2015-08-128-0/+37
| | | | | | | | | | | This is the same as commit v1.4.15-12-g8a988f6. If no id option is given, the extensions only match packets with a zero-valued identification field. This behavior deviates from what it used to do back in v1.4.10-273-g6944f2c^. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: Increase rule number only for the selected table and chainThomas Woerner2015-07-231-7/+7
| | | | | | | | | This patch fixes the rule number handling in nft_rule_find and __nft_rule_list. The rule number is only valid in the selected table and chain and therefore may not be increased for other tables or chains. Signed-off-by: Thomas Woerner <twoerner@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: Allow to insert into rule_count+1 positionThomas Woerner2015-07-231-0/+11
| | | | | | | | iptables allows to insert a rule into the next non existing rule number but iptables-compat does not allow to do this Signed-off-by: Thomas Woerner <twoerner@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extension: libip6t_ipv6header: fix wrong headername in ipv6header for protocolsAndreas Herz2015-07-202-3/+3
| | | | | | | | | In the --help output and manpage for ipv6header the name for upper layer protocol headers was "proto", while in the code itself it's "prot" for the short form. Fixed by changing manpage and help output. Signed-off-by: Andreas Herz <andi@geekosphere.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_socket: update man pages and tests for --restore-skmarkHarout Hedeshian2015-07-152-0/+18
| | | | | | | | | | | Update the man pages for libxt_socket with a description and example usage of the --restore-skmark option. Also added tests for libxt_socket with various combinations of --restore-skmark and the existing options. Signed-off-by: Harout Hedeshian <harouth@codeaurora.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: resolve build error involving libnftnlJan Engelhardt2015-07-151-1/+1
| | | | | | | | | | | | | | make[2]: Entering directory '/home/jengelh/code/iptables/extensions' CC libebt_limit.oo In file included from ../iptables/nft.h:5:0, from libebt_limit.c:21: ../iptables/nft-shared.h:6:27: fatal error: libnftnl/rule.h: No such file or directory #include <libnftnl/rule.h> ^ compilation terminated. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_socket: add --restore-skmark optionHarout Hedeshian2015-06-302-0/+79
| | | | | | | | | | | | | | | | | | | | | | | | | xt_socket is useful for matching sockets with IP_TRANSPARENT and taking some action on the matching packets. However, it lacks the ability to match only a small subset of transparent sockets. Suppose there are 2 applications, each with its own set of transparent sockets. The first application wants all matching packets dropped, while the second application wants them forwarded somewhere else. Add the ability to retore the skb->mark from the sk_mark. The mark is only restored if a matching socket is found and the transparent / nowildcard conditions are satisfied. Now the 2 hypothetical applications can differentiate their sockets based on a mark value set with SO_MARK. iptables -t mangle -I PREROUTING -m socket --transparent \ --restore-skmark -j action iptables -t mangle -A action -m mark --mark 10 -j action2 iptables -t mangle -A action -m mark --mark 11 -j action3 Signed-off-by: Harout Hedeshian <harouth@codeaurora.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Sync with upstream kernel headersFelix Janda2015-06-262-17/+20
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include Use <stdint.h> types from xtables.hFelix Janda2015-06-261-10/+10
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Sync with ethernetdb.h from ebtablesFelix Janda2015-06-261-6/+5
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: remove libc5 support codeFelix Janda2015-05-081-12/+0
| | | | | | | | | Current code makes the assumption that !defined(__GLIBC__) means libc5 which is very unlikely the case nowadays. Fixes compile error because of conflict between kernel and musl headers. Signed-off-by: Florian Westphal <fw@strlen.de>
* consistently use <errno.h>Felix Janda2015-05-027-7/+7
| | | | | | | | | On glibc, <sys/errno.h> is a synomym for <errno.h>. <errno.h> is specified by POSIX, so use that. Fixes compilation error with musl libc Signed-off-by: Florian Westphal <fw@strlen.de>
* Merge branch 'ipset-next'Pablo Neira Ayuso2015-04-283-10/+207
|\ | | | | | | | | | | | | | | Get this patch into master: "Alignment problem between 64bit kernel 32bit userspace" As Jozsef requests.
| * Alignment problem between 64bit kernel 32bit userspaceJozsef Kadlecsik2014-11-063-10/+207
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sven-Haegar Koch reported the issue: sims:~# iptables -A OUTPUT -m set --match-set testset src -j ACCEPT iptables: Invalid argument. Run `dmesg' for more information. In syslog: x_tables: ip_tables: set.3 match: invalid size 48 (kernel) != (user) 32 which was introduced by the counter extension in ipset. The patch fixes the alignment issue with introducing a new set match revision with the fixed underlying 'struct ip_set_counter_match' structure. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* | libxtables: find extensions based on family tooArturo Borrero2015-04-091-5/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When using libxtables with an external program (nft) which switches family contexts (using xtables_set_nfproto()), the xtables_find_{match,target} functions need to compare the family too. We want to avoid this situation: 1) user first sets afinfo to IPv6 2) xtables_find_target() finds & load ip6t_REJECT and uses it 3) afinfo change to IPv4 4) user then tries to use ipt_REJECT 5) xtables_find_target() finds ip6t_REJECT instead (same target name) 6) using ip6t_REJECT as ipt_REJECT can cause a lot of troubles Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | list: fix prefetch dummyArturo Borrero2015-04-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | linux_list.h:381:59: warning: right-hand operand of comma expression has no effect [-Wunused-value] for (pos = list_entry((head)->next, typeof(*pos), member), \ ^ libiptc.c:552:2: note: in expansion of macro 'list_for_each_entry' list_for_each_entry(c, &h->chains, list) { ^ [ Patch copied from one similar of Patrick McHardy on libnftnl ] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* | ebtables-compat: fix misplaced function attribute on ebt_print_error()Arturo Borrero Gonzalez2015-04-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | xtables-eb.c:305:1: warning: empty declaration } __attribute__((noreturn, format(printf,2,3))); ^ xtables-eb.c:311:2: warning: initialization makes '__attribute__((noreturn))' qualified function pointer from unqualified .exit_err = ebt_print_error, ^ Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | cgroup, man: improve man-page bitsDaniel Borkmann2015-04-081-5/+13
| | | | | | | | | | | | | | | | Document limitations when in use with INPUT until we found a better solution. Also fix up indent in the example section. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | libxt_tcp: manpage correctionJiri Popelka2015-03-161-1/+0
| | | | | | | | | | | | | | | | | | | | $ iptables -A INPUT -m tcp --sport 6500:6400 -j ACCEPT iptables v1.4.21: invalid portrange (min > max) Error message added with d15fb34c Signed-off-by: Jiri Popelka <jpopelka@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* | ebtables-compat: fix rule deleting with -D in rules with no targetArturo Borrero2015-03-131-1/+1
| | | | | | | | | | | | | | | | Before this patch, rule deleting with -D produces segfault in rules with no target. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | ebtables-compat: add a bridge-specific exit_error functionArturo Borrero2015-03-131-2/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previous to this patch, error reporting in ebtables-compat was like: % ebtables-compat xxx (null) v1.4.21: Bad argument : 'xxx' Try `(null) -h' or '(null) --help' for more information. While the original ebtables was: % ebtables xxx Bad argument : 'xxx'. With this patch, we switch to: % ebtables-compat xxx Bad argument : 'xxx'. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | ebtables-compat: add support for limit extensionArturo Borrero2015-03-132-0/+180
| | | | | | | | | | | | Add support for the ebtables limit extension (match), Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* | man: using physdev match in OUTPUT is not supported anymoreFlorian Westphal2015-03-061-11/+3
| | | | | | | | | | | | | | | | kernels 2.6.20 and later reject -m physdev in OUTPUT with "using --physdev-out in the OUTPUT, FORWARD and POSTROUTING chains for non-bridged traffic is not supported anymore" error in dmesg. Signed-off-by: Florian Westphal <fw@strlen.de>
* | arptables-compat: delete extra space in target printingArturo Borrero2015-03-051-1/+1
| | | | | | | | | | | | | | This is an extra space, let's get rid of it. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | arptables-compat: add support for the CLASSIFY targetArturo Borrero2015-03-051-12/+32
| | | | | | | | | | | | | | This patch adds support to arptables-compat for the CLASSIFY target. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | ebtables-compat: support nflog extensionArturo Borrero2015-03-043-1/+147
| | | | | | | | | | | | | | Let's give support for the nflog extension (a watcher). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | libxt_quota: fix _save() invert syntaxArturo Borrero2015-02-232-6/+3
| | | | | | | | | | | | | | Space is misplaced. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables-compat: unset context flags in netlink delinearize stepPablo Neira Ayuso2015-02-224-18/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Once the data that the compare expression provides have been digested. For example: -A INPUT -i noexist -p udplite -s 10.10.10.10/32 -d 10.0.0.10/32 -j ACCEPT doesn't show anymore the following broken output via iptables-compat-save: -A INPUT -i +t -p udplite -s 10.10.10.10/32 -d 10.0.0.10/32 -j ACCEPT Reported-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* | tests: remove old test casesFlorian Westphal2015-02-197-307/+0
| | | | | | | | | | | | | | Obsoleted by iptables-test.py in project root directory, see extensions/*.t for the new test cases. Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: libip6t_dst: make inversion workFlorian Westphal2015-02-192-0/+3
| | | | | | | | | | | | The inversion flag wasn't set in the match struct. Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions/libxt_recent.t: add test case for 3.19 regressionFlorian Westphal2015-02-191-2/+6
| | | | | | | | | | | | fail with vanilla 3.19. Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: SNPT,DNPT: fix save/print outputFlorian Westphal2015-02-194-8/+10
| | | | | | | | | | | | | | wrong placement of ' ', i.e. we get -j SNPT--src-pfx dead::/64 --dst-pfx 1c3::/64 Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: add more test cases for iptables-test.pyFlorian Westphal2015-02-1942-0/+231
| | | | | | | | | | | | | | | | | | | | Instead of using iptables-save-formatted files in the tests/ dir, lets use the iptables-test.py framework for all matches/targets. This obsoletes tests/ completely, will be removed in followup patch. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: remove 'unclean' matchFlorian Westphal2015-02-192-17/+0
| | | | | | | | | | | | removed from kernel in 2003. Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: remove SAME targetFlorian Westphal2015-02-193-223/+0
| | | | | | | | | | | | removed from the kernel December 2007. Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: remove MIRRORFlorian Westphal2015-02-192-27/+0
| | | | | | | | | | | | removed from the kernel back in 2003. Signed-off-by: Florian Westphal <fw@strlen.de>
* | xtables-compat: remove unused fields from bridge and arp familiesPablo Neira Ayuso2015-02-181-10/+3
| | | | | | | | | | | | | | | | | | These two families only work under nft compat, so leave unset the fields that we don't use. Basically, we need neither the module autoload code nor the native get/setsockopt() revision infrastructure since we use the one that nft_compat provides through nfnetlink. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | arptables-compat: add mangle target extensionArturo Borrero2015-02-186-45/+282
| | | | | | | | | | | | | | | | This patch adds support to use the mangle target extensions, along with the required changes in the surrounding code. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | xshared: calm down compilation warningPablo Neira Ayuso2015-02-181-0/+1
| | | | | | | | | | | | | | xshared.c: In function ‘xtables_lock’: xshared.c:255:3: warning: implicit declaration of function ‘flock’ [-Wimplicit-function-declaration] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | tests: add test case for xt_recent regressionFlorian Westphal2015-02-131-0/+3
| | | | | | | | | | | | | | fails on 3.19 kernel: xt_recent: hitcount (8) is larger than packets to be remembered (8) for table foo Signed-off-by: Florian Westphal <fw@strlen.de>
* | tests: split into family and table specific filesFlorian Westphal2015-02-138-69/+107
| | | | | | | | | | | | | | also add simple script to restore/save them. run_qa.sh passes on standard-distro kernels. Signed-off-by: Florian Westphal <fw@strlen.de>
* | Merge branch 'ebtables-compat'Pablo Neira Ayuso2015-02-1130-33/+3825
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ebtables-compat branch provides the compatibility layer to run ebtables extensions. Currently, only the following matches / targets / watchers are supported: * 802_3 * ip * mark_m and mark * log The remaining ones should be easy to port them to on top of libxtables, they will follow up later.