summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Alignment problem between 64bit kernel 32bit userspaceJozsef Kadlecsik2014-11-063-10/+207
| | | | | | | | | | | | | | | | | | Sven-Haegar Koch reported the issue: sims:~# iptables -A OUTPUT -m set --match-set testset src -j ACCEPT iptables: Invalid argument. Run `dmesg' for more information. In syslog: x_tables: ip_tables: set.3 match: invalid size 48 (kernel) != (user) 32 which was introduced by the counter extension in ipset. The patch fixes the alignment issue with introducing a new set match revision with the fixed underlying 'struct ip_set_counter_match' structure. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Merge branch 'ipset'Pablo Neira Ayuso2014-11-054-5/+229
|\ | | | | | | | | | | This provides the ipset skbinfo extension. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * xtables: SET target: Add mapping of meta informations (skbinfo ipset extension)Anton Danilov2014-09-144-5/+229
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This feature add support of mapping metainformation to packets like nftables maps or ipfw tables. Currently we can map firewall mark, tc priority and hardware NIC queue. Usage of this functionality allowed only from mangle table. We can map tc priority only in OUTPUT/FORWARD/POSTROUTING chains because it rewrite by route decision. If entry doesn't exist in the set nothing of fields changed. Example of classify by destination address: iptables -t mangle -A POSTROUTING -o eth0 -j SET --map-set DST2CLASS dst --map-prio Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* | extensions: devgroup: fix showing and saving of dst-groupAna Rey2014-11-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Closes bugzilla: https://bugzilla.netfilter.org/show_bug.cgi?id=985 The --dst-group parameter in devgroup extensions lists and saves incorrectly its value. --dst-group always shows "0x0/0x0". This is an example: # iptables -I FORWARD -m devgroup --dst-group 200 -j ACCEPT # iptables -L FORWARD Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere src-group 0x64 dst-group 0x0/0x0 # iptables -S FORWARD -P FORWARD ACCEPT -A FORWARD -m devgroup --dst-group 0x0/0x0 -j ACCEPT Reporte-by: Axinchan <axinchan@cnrouter.com> Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables-compat: homogenize error messagesAna Rey2014-10-301-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are some differences between error messages in iptables and iptables-compat: # iptables -C INPUT -s 192.168.2.102 -j ACCEPT iptables: Bad rule (does a matching rule exist in that chain?). # iptables-compat -C INPUT -s 192.168.2.102 -j ACCEPT iptables: No chain/target/match by that name. # iptables -N new_chain # iptables -N new_chain iptables: Chain already exists. # iptables-compat -N new_chain # iptables-compat -N new_chain iptables: File exists. Now, iptables-compat shows the same error messages than iptables in those cases. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | libxtables: move some code to avoid cautions in vfork man pageDan Wilder2014-10-251-10/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Running iptables-restore on an embedded platform containing no modprobe program, the following lines in xtables.c lead to corrupted stack frame: 357 switch (vfork()) { 358 case 0: 359 argv[0] = (char *)modprobe; 360 argv[1] = (char *)modname; 361 if (quiet) { 362 argv[2] = "-q"; 363 argv[3] = NULL; 364 } else { 365 argv[2] = NULL; 366 argv[3] = NULL; 367 } 368 execv(argv[0], argv); 369 370 /* not usually reached */ 371 exit(1); modprobe pointed to a non-existant program /sbin/modprobe, so execv() always failed. Not a problem in itself on our platform, as the kernel modules are pre-loaded before iptables-restore is run, but it took a bit of headscratching to track this down, as a stack frame was corrupted, leading to failures quite a while after the function containing this code had returned! Relevant caution in man 2 vfork: "The vfork() function has the same effect as fork(2), except that the behavior is undefined if the process created by vfork() either modifies any data ... or calls any other function before successfully calling _exit(2) or one of the exec(3) family of functions." Apparently this has not been a problem for us in earlier versions of glibc, maybe because vfork was more like fork, maybe because the stack corruption was innocuous. Ours is a corner case anyway, as it might not have been a problem had modprobe existed or had modprobe been a symlink to /bin/true. But it seems odd to disregard man page cautions, and our problem goes away if they are heeded. Signed-off-by: Florian Westphal <fw@strlen.de>
* | iptables-compat: fix empty chains after first invocation of iptables-compat -LPablo Neira Ayuso2014-10-241-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # iptables-compat -L # iptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Note that the second (and follow up) invocations after the first one display the chains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables-compat: assume chain policy NF_ACCEPT when creating built-in chainsPablo Neira Ayuso2014-10-241-22/+13
| | | | | | | | | | | | | | | | Newly created (emulated) xt built-in chain have to use NF_ACCEPT. Remove extra unused chain parameter and rename nft_chain_builtin_init to nft_xt_builtin_init too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables-compat: statify unused built-in table/chain functionsPablo Neira Ayuso2014-10-242-13/+8
| | | | | | | | | | | | | | The functions that allows you to create built-in table and chains are required out of the scope of nft.c Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables-compat: fix chain policy reset with iptables -L -nPablo Neira Ayuso2014-10-241-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | Initialize built-in tables/chains if they don't exists, otherwise simply skip. This avoids the chain policy reset to NF_ACCEPT by when you call iptables -L -n. Reported-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Ana Rey <anarey@gmail.com>
* | nft-ipv46: replace offset var with ctx->payload.offsetGiuseppe Longo2014-10-182-2/+2
| | | | | | | | | | | | | | | | | | The offset variable (undefined) is passed to DEBUGP function, so you get a compilation error if you try to build iptables with debug enabled Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | nft: fix syntax error in nft_parse_cmp()Giuseppe Longo2014-10-181-1/+1
| | | | | | | | | | | | | | This fixes a syntax error, remove ; in an if statement Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | refresh nf_tables.h cached copyPablo Neira Ayuso2014-10-091-1/+76
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | arptables-compat: remove save codePablo Neira Ayuso2014-10-091-29/+2
| | | | | | | | | | | | | | | | There is not native arptables-save. The original author provides perl scripts to implement arptables-save and arptables-restore. We should use them to mimic arptables behaviour. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | arptables-compat: get output in sync with arptables -L -n --line-numbersPablo Neira Ayuso2014-10-096-46/+94
| | | | | | | | | | | | | | | | | | | | # arptables-compat -L -n --line-numbers Chain INPUT (policy ACCEPT) num target prot opt source destination <-- This header is not shown by arptables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | arptables-compat: allow to not specify a targetPablo Neira Ayuso2014-10-096-230/+163
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | arptables allows this: # arptables -I INPUT however, arptables-compat says: arptables v1.4.21: No target provided or initalization failed Try `arptables -h' or 'arptables --help' for more information. the compat utility must mimic the same behaviour. Fix this by introducing the arptables_command_state abstraction that is already available in ip{6}tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | arptables-compat: fix missing error reportingPablo Neira Ayuso2014-10-091-0/+5
| | | | | | | | | | | | | | # arptables-compat -D INPUT -j ACCEPT arptables: Bad rule (does a matching rule exist in that chain?) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables-compat: nft: fix error reportingPablo Neira Ayuso2014-10-091-16/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | This fixes # iptables-compat -X test4345 iptables: No chain/target/match by that name. # iptables-compat -N test4345 # iptables-compat -N test4345 iptables: File exists. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables-compat: nft: fix user chain addition, deletion and renamePablo Neira Ayuso2014-10-091-27/+60
| | | | | | | | | | | | | | Add the glue code to use the chain batching for user chain commands. Reported-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge branch 'tests'Pablo Neira Ayuso2014-10-0161-1/+1037
|\ \ | | | | | | | | | | | | This merges the iptables-test.py script and the corresponding test files.
| * | build: don't include tests in released tarballPablo Neira Ayuso2013-12-041-1/+1
| | | | | | | | | | | | | | | | | | | | | Do not include all our .t test files in releases. Skip iptables-tests.py script as well. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_MARK: add unit testPablo Neira Ayuso2013-10-071-0/+7
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_owner: add unit testPablo Neira Ayuso2013-10-071-0/+12
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libip6t_DNAT: add unit testPablo Neira Ayuso2013-10-071-0/+8
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libipt_SNAT: add unit testPablo Neira Ayuso2013-10-071-0/+8
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_TEE: add unit testPablo Neira Ayuso2013-10-071-0/+4
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_physdev: add unit testPablo Neira Ayuso2013-10-071-0/+14
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_iprange: add unit testPablo Neira Ayuso2013-10-071-0/+11
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_quota: add unit testPablo Neira Ayuso2013-10-071-0/+10
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_cpu: add unit testPablo Neira Ayuso2013-10-071-0/+6
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_dscp: add unit testPablo Neira Ayuso2013-10-071-0/+10
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libip6t_REJECT: add unit testPablo Neira Ayuso2013-10-071-0/+9
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_multiport: add unit testPablo Neira Ayuso2013-10-071-0/+23
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libipt_ULOG: add unit testPablo Neira Ayuso2013-10-071-0/+19
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_conntrack: add unit testPablo Neira Ayuso2013-10-071-0/+27
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_limit: add unit testPablo Neira Ayuso2013-10-071-0/+6
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libip6t_eui64: add unit testPablo Neira Ayuso2013-10-071-0/+8
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_DSCP: add unit testPablo Neira Ayuso2013-10-071-0/+11
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_TOS: add unit testPablo Neira Ayuso2013-10-071-0/+16
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_TRACE: add unit testPablo Neira Ayuso2013-10-071-0/+3
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libipt_ECN: add unit testPablo Neira Ayuso2013-10-071-0/+5
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_standard: add unit testPablo Neira Ayuso2013-10-071-0/+4
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libipt_MASQUERADE: add unit testPablo Neira Ayuso2013-10-071-0/+8
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_NOTRACK: add unit testPablo Neira Ayuso2013-10-071-0/+4
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_sctp: add unit testPablo Neira Ayuso2013-10-071-0/+32
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libipt_REJECT: add unit testPablo Neira Ayuso2013-10-071-0/+9
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_mark: add unit testPablo Neira Ayuso2013-10-071-0/+7
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_nfacct: add unit testPablo Neira Ayuso2013-10-071-0/+10
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_rateest: add unit testPablo Neira Ayuso2013-10-071-0/+16
| | | | | | | | | | | | | | | | | | based on tests/options-most.rules Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: libxt_string: add unit testPablo Neira Ayuso2013-10-071-0/+18
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>