summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add --compat option to *tables-nft and *-nft-restore commandsPhil Sutter2023-08-1111-13/+95
| | | | | | | | | | | | | | | The flag sets nft_handle::compat boolean, indicating a compatible rule implementation is wanted. Users expecting their created rules to be fetched from kernel by an older version of *tables-nft may use this to avoid potential compatibility issues. Changes since v1: - Expect short option '-C' in {ip,ip6,eb}tables-nft-restore command line parser - Support -C/--compat in arptables-nft-restore, too - Update man pages with the new flag Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Introduce and use bool nft_handle::compatPhil Sutter2023-08-113-5/+8
| | | | | | | | If set, create rules using compat expressions where possible and disable the bitwise expression avoidance introduced in 323259001d617 ("nft: Optimize class-based IP prefix matches"). Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Pass nft_handle to add_{target,action}()Phil Sutter2023-08-116-13/+17
| | | | | | Prepare for varying rule content based on a global flag. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Use SOCK_CLOEXEC/O_CLOEXEC where availablePhil Sutter2023-08-103-27/+4
| | | | | | | | | | | | No need for the explicit fcntl() call, request the behaviour when opening the descriptor. One fcntl() call setting FD_CLOEXEC remains in extensions/libxt_bpf.c, the indirect syscall seems not to support passing the flag directly. Reported-by: Gaurav Gupta <g.gupta@samsung.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1104 Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Test chain policy counter behaviourPhil Sutter2023-08-101-0/+78
| | | | | | Test the last two fixes in that area. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Revert "libiptc: fix wrong maptype of base chain counters on restore"Phil Sutter2023-08-101-1/+1
| | | | | | | | | | | | | This reverts commit 7c4d668c9c2ee007c82063b7fc784cbbf46b2ec4. The change can't be right: A simple rule append call will reset all built-in chains' counters. The old code works fine even given the mentioned "empty restore" use-case, at least if counters don't change on the fly in-kernel. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=912 Fixes: 7c4d668c9c2ee ("libiptc: fix wrong maptype of base chain counters on restore") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Create builtin chains with counters enabledPhil Sutter2023-08-101-6/+8
| | | | | | | | | | | | | | The kernel enables policy counters for nftables chains only if NFTA_CHAIN_COUNTERS attribute is present. For this to be generated, one has to set NFTNL_CHAIN_PACKETS and NFTNL_CHAIN_BYTES attributes in the allocated nftnl_chain object. The above happened for base chains only with iptables-nft-restore if called with --counters flag. Since this is very unintuitive to users, fix the situation by adding counters to base chains in any case. Fixes: 384958620abab ("use nf_tables and nf_tables compatibility interface") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Fix command segfault reportsPhil Sutter2023-08-101-3/+6
| | | | | | | Logging produced a stack trace due to undefined variable 'cmd'. Fixes: 0e80cfea3762b ("tests: iptables-test: Implement fast test mode") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-ruleparse: parse meta mark set as MARK targetFlorian Westphal2023-08-101-12/+28
| | | | | | | | | | | | | | | | | | Mixing nftables and iptables-nft in the same table doesn't work, but some people do this. v1.8.8 ignored rules it could not represent in iptables syntax, v1.8.9 bails in this case. Add parsing of meta mark expressions so iptables-nft can render them as -j MARK rules. This is flawed, nft has features that have no corresponding syntax in iptables, but we can't undo this. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1659 Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-ruleparse: Introduce nft_create_target()Phil Sutter2023-08-106-87/+52
| | | | | | | | | | | | | | | | Like nft_create_match(), this is a small wrapper around the typical target extension lookup and (standard) init code. To use it from nft_parse_target() and nft_parse_log(), introduce an inner variant which accepts the target payload size as parameter. The call to rule_parse_ops::target callback was problematic with standard target, because the callbacks initialized iptables_command_state::jumpto with the target name, "standard" in that case. Perform its tasks in nft_create_target(), keep it only for bridge family's special handling of watcher "targets". Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libip6t_icmp: Add names for mld-listener typesPhil Sutter2023-08-052-0/+11
| | | | | | | Add the three names (plus one alias) just as in nftables. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1250 Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: move processing logic out of assertsJan Palus2023-08-052-6/+17
| | | | | | | | | | [Phil: Introduce assert_nft_restart() to keep things clean, also add fallback returns to nft_action() and nft_prepare(), sanitizing things at least a bit.] Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1487 Signed-off-by: Jan Palus <atler@pld-linux.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: iptables-save.8: Start paragraphs in upper-casePhil Sutter2023-08-051-2/+2
| | | | | | | Also add a missing full stop. Fixes: 117341ada43dd ("Added iptbles-restore and iptables-save manpages") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: iptables-save.8: Fix --modprobe descriptionPhil Sutter2023-08-051-3/+4
| | | | | | | | | - Consistently use 'modprobe' as option argument name - Add a reference to modprobe man page - Put the path in italics and the command in bold Fixes: fbb5639c02218 ("iptables-save: module loading corrections") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: iptables-save.8: Clarify 'available tables'Phil Sutter2023-08-051-1/+4
| | | | | | | | This appears to be confusing. Since a missing table is also not flushed ("restored") when feeding the dump into iptables-restore, such a restore call may be considered incomplete. Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: Trivial: Missing space after commaPhil Sutter2023-08-052-2/+2
| | | | | Fixes: 6a79d78986c02 ("iptables: mention iptables-apply(8) in manpages") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: iptables-restore.8: Start paragraphs in upper-casePhil Sutter2023-08-051-2/+2
| | | | | | | Also add a missing full stop in one spot. Fixes: 117341ada43dd ("Added iptbles-restore and iptables-save manpages") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: iptables-restore.8: Put 'file' in italics in synopsisPhil Sutter2023-08-051-2/+2
| | | | | | | The text has it this way already, be consistent. Fixes: 081d57839e91e ("iptables-restore.8: file to read from can be specified as argument") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: iptables-restore.8: Drop -W option from synopsisPhil Sutter2023-08-051-2/+2
| | | | | | | | The description was dropped already, there is no benefit in still listing it. Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: iptables-restore.8: Consistently document -w optionPhil Sutter2023-08-051-2/+2
| | | | | | | Use the same name for the option's argument. Fixes: 65801d02a482b ("iptables-restore.8: document -w/-W options") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: iptables-restore.8: Fix --modprobe descriptionPhil Sutter2023-08-051-3/+4
| | | | | | | | | - Consistently use 'modprobe' as option argument name - Add a reference to modprobe man page - Put the path in italics, and the command in bold Fixes: 8c46901ff5785 ("doc: document iptables-restore's -M option") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: iptables.8: Trivial font fixesPhil Sutter2023-08-051-3/+3
| | | | | | | No content changes intended, just type commands in bold and the single path reference in italics. Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: Use HTTPS for links to netfilter.orgPhil Sutter2023-08-052-3/+3
| | | | | | | The browser is redirected there anyway, but who cares about such minor details nowadays. Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: iptables.8: Clarify --goto descriptionPhil Sutter2023-08-051-1/+1
| | | | | | | | | Text speaks about behaviour of RETURN target when used in chains redirected to using --goto instead of --jump, not the difference between --jump option and "return". Fixes: 17fc163babc34 ("add 'goto' support (Henrik Nordstrom <hno@marasystems.com>)") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: iptables.8: Fix intra page referencePhil Sutter2023-08-051-2/+2
| | | | | | | | When sections MATCH EXTENSIONS and TARGET EXTENSIONS were combined, the reference could have been updated to specify the exact title. Fixes: 4496801821c01 ("doc: deduplicate extension descriptions into a new manpage") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: iptables.8: Trivial spelling fixesPhil Sutter2023-08-051-5/+5
| | | | | | | | | | - Missing "and" as well as full stop - Missing comma in enumeration - Duplicate "previous" - Confusions are avoided rather than simplified - Missing space after comma Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: iptables.8: Extend exit code descriptionPhil Sutter2023-08-051-3/+6
| | | | | | | | Codes 3 and 4 were missing. Reported-by: Steven Barre <steven.barre@dxcas.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1353 Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libipt_icmp.t: Enable tests with numeric outputPhil Sutter2023-08-041-6/+3
| | | | | | | | | | Unrelated to the question whether numeric (save) output is desired or not, enable the tests and expect the known format. Using --list without --numeric prints the names, BTW. Fixes: 49d5b7277c7f2 ("extensions: libipt_icmp: add unit test") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libipt_icmp: Fix confusion between 255/255 and anyPhil Sutter2023-08-042-1/+4
| | | | | | | | | | | | | | | | Per definition, ICMP type "any" is type 255 and the full range of codes (0-255). Save callback though ignored the actual code values, printing "any" for every type 255 match. This at least confuses users as they can't find their rule added as '--icmp-type 255/255' anymore. It is not entirely clear what the fixed commit was trying to establish, but the save output is certainly not correct (especially since print callback gets things right). Reported-by: Amelia Downs <adowns@vmware.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1600 Fixes: fc9237da4e845 ("Fix '-p icmp -m icmp' issue (Closes: #37)") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-apply: Eliminate shellcheck warningsPhil Sutter2023-08-011-8/+8
| | | | | | | | | | | | | Actual warnings were only about use of '-a' in bracket expressions (replace by '&&' pipeline) and the immediate evaluation of the variable in trap command. The remaining changes silence info-level messages: missing quoting around variables, pointless '$' in arithmetic expressions, backticks instead of $(...), missing '-r' parameter when calling read and an awkward negated '-z' check. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-restore: Drop dead codePhil Sutter2023-08-011-2/+0
| | | | | | | | Handle initialization is guarded by 'in_table' boolean, so there can't be a handle already (because the branch which unsets 'in_table' also frees the handle). Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix and extend chain rename testPhil Sutter2023-07-282-12/+40
| | | | | | | | | | The old version exited unintentionally before testing ip6tables. Replace it by a more complete variant testing for all tools, creating and renaming of,chains with various illegal names instead of just renaming to a clashing name. Fixes: ed9cfe1b48526 ("tests: add initial save/restore test cases") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Improve invalid chain name detectionPhil Sutter2023-07-281-5/+28
| | | | | | | | | | | | | | | | Fix several issues: - Most importantly, --new-chain command accepted any name. Introduce ebt_assert_valid_chain_name() for use with both --new-chain and --rename-chain. - Restrict maximum name length to what legacy ebtables allows - this is a bit more than iptables-nft, subject to be unified. - Like iptables, legacy ebtables rejects names prefixed by '-' or '!'. - Use xs_has_arg() for consistency, keep the check for extra args for now. Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") Signed-off-by: Phil Sutter <phil@nwl.cc>
* *tables: Reject invalid chain names when renamingPhil Sutter2023-07-281-0/+1
| | | | | | | | | While given chain name was sanity checked with --new-chain command, --rename-chain command allowed to choose an invalid name. Keep things consistent by adding the missing check. Fixes: e6869a8f59d77 ("reorganized tree after kernel merge") Signed-off-by: Phil Sutter <phil@nwl.cc>
* *tables-restore: Enforce correct counters syntax if presentPhil Sutter2023-07-283-21/+24
| | | | | | | | | If '--counters' option was not given, restore parsers would ignore anything following the policy word. Make them more strict, rejecting anything in that spot which does not look like counter values even if not restoring counters. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Include sets in debug outputPhil Sutter2023-07-282-1/+15
| | | | | | | Rules referencing them are incomplete without, so add debug output on the same level as for rules. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Do not pass nft_rule_ctx to add_nft_among()Phil Sutter2023-07-281-6/+5
| | | | | | | | It is not used, must be a left-over from an earlier version of the fixed commit. Fixes: 4e95200ded923 ("nft-bridge: pass context structure to ops->add() to improve anonymous set support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: More verbose extension comparison debuggingPhil Sutter2023-07-282-0/+9
| | | | | | Dump extension data if it differs. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Special casing for among match in compare_matches()Phil Sutter2023-07-281-2/+5
| | | | | | | | | | | When other extensions may have "garbage" appended to their data which should not be considered for match comparison, among match is the opposite in that it extends its data beyond the value in 'size' field. Add special casing to cover for this, avoiding false-positive rule comparison. Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Sanitize nft-only/0009-needless-bitwise_0Phil Sutter2023-07-191-1/+1
| | | | | | | | | | | Some versions of awk (gawk-4.2.1-4.el8 in particular) also print the non-debug ruleset listing's empty lines, causing the diff to fail. Catch this by exiting upon seeing the first table heading. For the sake of comparing bytecode, the actual ruleset listing is not interesting, anyway. Fixes: 0f7ea0390b336 ("tests/shell: Fix nft-only/0009-needless-bitwise_0") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-bridge: pass context structure to ops->add() to improve anonymous set ↵Pablo Neira Ayuso2023-07-128-37/+62
| | | | | | | | | | | | | | | | | support Add context structure to improve bridge among support which creates an anonymous set. This context structure specifies the command and it allows to optionally store a anonymous set. Use this context to generate native bytecode only if this is an add/insert/replace command. This fixes a dangling anonymous set that is created on rule removal. Fixes: 26753888720d ("nft: bridge: Rudimental among extension support") Reported-and-tested-by: Igor Raits <igor@gooddata.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Fix handling of non-existent chainsJacek Tomasiak2023-06-212-1/+2
| | | | | | | | | | | | | | | | | Since 694612adf87 the "compatibility" check considers non-existent chains as "incompatible". This broke some scripts which used calls like `iptables -L CHAIN404` to test for chain existence and expect "No chain/target/match by that name." in the output. This patch changes the logic of `nft_is_table_compatible()` to report non-existent chains as "compatible" which restores the old behavior. Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648 Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com> Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables: Fix setting of ipv6 countersJacek Tomasiak2023-06-213-6/+9
| | | | | | | | | | | | | | When setting counters using ip6tables-nft -c X Y the X and Y values were not stored. This is a fix based on 9baf3bf0e77dab6ca4b167554ec0e57b65d0af01 but applied to the nft variant of ipv6 not the legacy. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1647 Fixes: 0391677c1a0b2 ("xtables: add IPv6 support") Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com> Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: dissolve should_load_protoJan Engelhardt2023-06-161-14/+4
| | | | | | | | | cs->proto_used already tells whether -p foo was turned into an implicit -m foo once, so I do not think should_load_proto() has a reason to exist. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: use payload matching for layer 4 protocolPablo Neira Ayuso2023-06-161-1/+2
| | | | | | | | | This is an IPv4 header, which does not require the special handling as in IPv6, use the payload matching instead of meta l4proto which is slightly faster in this case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: string: document BM false negativesJeremy Sowden2023-06-161-0/+15
| | | | | | | | | | For non-linear skb's there's a possibility that the kernel's Boyer-Moore text-search implementation may miss matches. There's a warning about this in the kernel source. Include that warning in the man-page. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1390 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: check for source and destination address in first placePablo Neira Ayuso2023-06-023-43/+47
| | | | | | | | | | | | | | | | | | | | | | When generating bytecode, check for source and destination address in first place, then, check for the input and output device. In general, the first expression in the rule is the most evaluated during the evaluation process. These selectors are likely to show more variability in rulesets. # iptables-nft -vv -I INPUT -s 1.2.3.4 -p tcp tcp opt -- in * out * 1.2.3.4 -> 0.0.0.0/0 table filter ip flags 0 use 0 handle 0 ip filter INPUT use 0 type filter hook input prio 0 policy accept packets 0 bytes 0 ip filter INPUT [ payload load 4b @ network header + 12 => reg 1 ] [ cmp eq reg 1 0x04030201 ] [ meta load l4proto => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ counter pkts 0 bytes 0 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: ruleparse: Create family-specific source filesPhil Sutter2023-05-0311-725/+846
| | | | | | | Extract the remaining nftnl rule parsing code from nft-<family>.c sources into dedicated ones to complete the separation. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Extract rule parsing callbacks from nft_family_opsPhil Sutter2023-05-037-41/+60
| | | | | | | Introduce struct nft_ruleparse_ops holding the family-specific expression parsers and integrate it into nft_family_ops for now. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Introduce nft-ruleparse.{c,h}Phil Sutter2023-05-035-1290/+1327
| | | | | | | | | | | Extract all code dealing with parsing from struct nftnl_rule into struct iptables_command_state from nft-shared.c into a separate source file. Basically this is nft_rule_to_iptables_command_state() and the functions it calls, plus family-independent parsers called from family-specific callbacks. Signed-off-by: Phil Sutter <phil@nwl.cc>