summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * extensions: libxt_time: add unit testPablo Neira Ayuso2013-10-071-0/+4
| | | | | | | | | | | | based on tests/options-most.rules Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libxt_hashlimit: add unit testPablo Neira Ayuso2013-10-071-0/+26
| | | | | | | | | | | | based on tests/options-most.rules Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libxt_CONNMARK: add unit testPablo Neira Ayuso2013-10-071-0/+7
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libxt_connmark: add unit testPablo Neira Ayuso2013-10-071-0/+9
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libxt_connlimit: add unit testPablo Neira Ayuso2013-10-071-0/+16
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libxt_connbytes: add unit testPablo Neira Ayuso2013-10-071-0/+21
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libxt_CLASSIFY: add unit testPablo Neira Ayuso2013-10-071-0/+9
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libxt_CHECKSUM: add unit testPablo Neira Ayuso2013-10-071-0/+4
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libxt_AUDIT: add unit testPablo Neira Ayuso2013-10-071-0/+6
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libxt_comment: add unit testPablo Neira Ayuso2013-10-071-0/+12
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libxt_cluster: add unit testPablo Neira Ayuso2013-10-071-0/+10
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libip6t_LOG: add unit testPablo Neira Ayuso2013-10-071-0/+12
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libxt_addrtype: add unit testPablo Neira Ayuso2013-10-071-0/+17
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libipt_LOG: add unit testPablo Neira Ayuso2013-10-071-0/+12
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libip6t_ah: add unit testPablo Neira Ayuso2013-10-071-0/+14
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: libipt_ah: add unit testPablo Neira Ayuso2013-10-071-0/+12
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * add iptables unit test infrastructurePablo Neira Ayuso2013-10-071-0/+311
| | | | | | | | | | | | This patch adds a python script to verify unit test cases. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables-compat: get rid of error reporting via perrorPablo Neira Ayuso2014-09-303-85/+35
| | | | | | | | | | | | The compat layer should report problems in the iptables way instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables-compat: fix use after free in the batch send pathPablo Neira Ayuso2014-09-301-8/+19
| | | | | | | | | | | | Release the batch pages once they have been sent via sendmsg(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables-compat: nft: use nft_batch_begin and nft_batch_end from libnftnlPablo Neira Ayuso2014-09-301-21/+5
| | | | | | | | | | | | Use the existing functions in libnftnl to begin and end a batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables-compat: fix address prefixPablo Neira Ayuso2014-09-305-111/+196
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes: # iptables-compat -I INPUT -s 1.2.3.0/24 generates this bytecode: ip filter INPUT 20 [ payload load 4b @ network header + 12 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00ffffff ) ^ 0x00000000 ] [ cmp eq reg 1 0x00030201 ] [ counter pkts 0 bytes 0 ] and it displays: # iptables-compat-save ... -A INPUT -s 1.2.3.0/24 ip6tables-compat and arptables-compat are also fixed. This patch uses the new context structure to annotate payload, meta and bitwise, so it interprets the cmp expression based on the context. This provides a rudimentary way to delinearize the iptables-compat rule-set, but it should be enough for the built-in xtables selectors since we still use the xtables extensions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | extensions: libxt_devgroup: Fix the path of the group mappings fileAna Rey2014-09-191-2/+2
| | | | | | | | | | | | | | | | Use "/etc/iproute2/group" as the default path to the mapping file instead of "/etc/iproute2/group_map". Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | extensions: libxt_connlabel: do not open config file from _init hookFlorian Westphal2014-09-051-7/+20
| | | | | | | | | | | | | | | | else, static builds will print this for every iptables invocation, even 'iptables -L'. Delay open until we need to translate a mapping. Reported-by: Thomas De Schampheleire <patrickdepinguin@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* | libxtables: fix two off-by-one memory corruption bugsRonald Wahl2014-09-051-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The LSB of xtables_pending_matches was overwritten with zero that lead to segmentation fault. But simply adding an additional variable in the code or changing compilation options modified the behaviour so that no segmentation fault happens so it is rather subtle. (1) memset(p + (bits / 8) + 1, 0, (128 - bits) / 8); In case of bits % 8 == 0 we write the byte behind *p (2) p[bits/8] = 0xff << (8 - (bits & 7)); In case of bits == 128 we write the byte behind *p Closes bug 943. Signed-off-by: Florian Westphal <fw@strlen.de>
* | nft: add nft_xt_ctx structGiuseppe Longo2014-08-243-50/+69
| | | | | | | | | | | | | | | | This patch provides the context used to transfer information between different nft_parse_* function calls. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | nft: compare layer 4 protocol in first placeGiuseppe Longo2014-08-242-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the protocol is tested after the ip address, this fixes the order testing the protocol before the ip address. Now the code generated is incorrect: ip filter INPUT 16 [ payload load 4b @ network header + 12 => reg 1 ] [ cmp eq reg 1 0x0100a8c0 ] [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ match name tcp rev 0 ] [ match name conntrack rev 3 ] [ counter pkts 0 bytes 0 ] [ immediate reg 0 accept ] With this patch, the code generated is: ip filter INPUT 16 [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ payload load 4b @ network header + 12 => reg 1 ] [ cmp eq reg 1 0x0100a8c0 ] [ bitwise reg 1 = (reg=1 & 0xffffffff ) ^ 0x00000000 ] [ match name tcp rev 0 ] [ match name conntrack rev 3 ] [ counter pkts 0 bytes 0 ] [ immediate reg 0 accept ] Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | nft-arp: remove wrong conditionsGiuseppe Longo2014-08-111-6/+0
| | | | | | | | | | | | | | | | | | | | | | Removes wrong conditions in flags translating functions that doesn't permit to delete rule with inverse flags set. For instance, the following command doesn't remove the rule: arptables-compat -D INPUT -i ! eth1 -j ACCEPT Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | include: add linux/filter.hWillem de Bruijn2014-07-301-0/+139
| | | | | | | | | | | | | | | | xt_bpf.h includes linux/filter.h for the definition of sock_filter. add that file to the repository Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: add optional [seconds] argument to -wJiri Popelka2014-07-256-22/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds an optional numeric argument to -w option (added with 93587a0) so one can specify how long to wait for an exclusive lock. If the value isn't specified it works as before, i.e. program waits indefinitely. If user specifies it, program exits after the given time interval passes. This patch also adds the -w/--wait to nftables compat code, so the parser doesn't complain. [ In the original patch, iptables-compat -w X was not working, I have fixed by adding the dummy code not to break scripts using the new optional argument --pablo ] Signed-off-by: Jiri Popelka <jpopelka@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Makefile: fix static compilation iptables-compat without shared librariesPablo Neira Ayuso2014-06-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix linking problems when this configuration is used: $ ./configure --prefix=/usr --enable-shared=no --enable-static=yes $ make ... xtables_compat_multi-xtables-save.o: In function `xtables_save_main': /home/pablo/devel/iptables/iptables/xtables-save.c:98: undefined reference to `init_extensions4' xtables_compat_multi-xtables-restore.o: In function `xtables_restore_main': /home/pablo/devel/iptables/iptables/xtables-restore.c:195: undefined reference to `init_extensions4' xtables_compat_multi-xtables-standalone.o: In function `xtables_main': /home/pablo/devel/iptables/iptables/xtables-standalone.c:61: undefined reference to `init_extensions4' xtables_compat_multi-xtables-events.o: In function `xtables_events_main': /home/pablo/devel/iptables/iptables/xtables-events.c:184: undefined reference to `init_extensions4' Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | libxtables: fix getaddrinfo return value usageDomen Puncer2014-06-131-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | getaddrinfo return value on error can also be positive. On Android they're positive, e.g.: android-ndk-r9d/platforms/android-19/arch-arm/usr/include/netdb.h 147 #define EAI_NONAME 8 /* hostname nor servname provided, or not known */ And as a plus, it's not bad to conform to specs. Signed-off-by: Domen Puncer Kugler <domen.puncer@samsung.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | nft: save: fix the printing of the countersGiuseppe Longo2014-06-116-24/+44
| | | | | | | | | | | | | | | | This patch prints the counters of a rule before the details, like iptables-save syntax. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: nft: add tables and chains to the batchPablo Neira Ayuso2014-06-102-123/+249
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since kernel changes: 55dd6f9 ("netfilter: nf_tables: use new transaction infrastructure to handle table"). 91c7b38 ("netfilter: nf_tables: use new transaction infrastructure to handle chain"). it is possible to put tables and chains in the same batch (which was already including rules). This patch probes the kernel to check if if the new transaction is available, otherwise it falls back to the previous non-transactional approach to handle these two objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: nft: remove unused codePablo Neira Ayuso2014-06-102-55/+4
| | | | | | | | | | | | | | Remove code to set table in dormant state, this is not required from the iptables over nft compatibility layer. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: nft: generalize batch infrastructurePablo Neira Ayuso2014-06-092-43/+43
| | | | | | | | | | | | Prepare inclusion of tables and chain objects in the batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge branch 'next-3.14'Pablo Neira Ayuso2014-05-1610-13/+274
|\ \
| * | iptables: add libxt_cgroup frontendDaniel Borkmann2014-01-043-0/+93
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the user space extension/frontend for process matching based on cgroups from the kernel patch entitled "netfilter: xtables: lightweight process control group matching". Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | iptables: snat: add randomize-full supportDaniel Borkmann2014-01-044-13/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch provides the userspace part for snat in order to make randomize-full support available in {ip,nf}tables. It allows for enabling full port randomization that was motivated in [1] and introduced to the kernel in [2]. Joint work between Hannes Frederic Sowa and Daniel Borkmann. [1] https://sites.google.com/site/hayashulman/files/NIC-derandomisation.pdf [2] http://patchwork.ozlabs.org/patch/304306/ Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | iptables: Add IPv4/6 IPcomp match supportfan.du2013-12-243-0/+139
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch enables user to set iptables ACTIONs for IPcomp flow specified by its SPI value. For example: iptables -A OUTPUT -p 108 -m ipcomp --ipcompspi 0x12 -j DROP ip6tables -A OUTPUT -p 108 -m ipcomp --ipcompspi 0x12 -j DROP IPcomp packet with spi as 0x12 will be dropped. Signed-off-by: Fan Du <fan.du@windriver.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | iptables.8: --policy is either ACCEPT or DROPFlorian Westphal2014-04-171-4/+2
| | | | | | | | | | | | | | | | | | its enforced by both by libiptc and kernel. Signed-off-by: Florian Westphal <fw@strlen.de>
* | | nft: replace nft_rule_attr_get_u8Giuseppe Longo2014-03-244-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the family declaration has been modified in libnftnl, from commit 3cd9cd06625f8181c713489cec2c1ce6722a7e16 the assertion is failed for {ip,ip6,arp}tables-compat when printing rules. iptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination libnftnl: attribute 0 assertion failed in rule.c:273 ip6tables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination libnftnl: attribute 0 assertion failed in rule.c:273 arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination libnftnl: attribute 0 assertion failed in rule.c:273 Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | iptables-save: actually parse -M/--modprobe optionJiri Popelka2014-03-174-4/+4
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | iptables-{save,restore}: warn that -b/--binary isn't implementedJiri Popelka2014-03-176-15/+18
| | | | | | | | | | | | | | | | | | see also 296dca39be Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | iptables-restore.8: file to read from can be specified as argumentJiri Popelka2014-03-141-4/+5
| | | | | | | | | | | | | | | | | | | | | original bug report: https://bugzilla.redhat.com/show_bug.cgi?id=1022228 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | iptables-restore.8: missing -T in synopsisJiri Popelka2014-03-141-0/+1
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | iptables: missing bracket in iptables-save(8)Jiri Popelka2014-03-131-1/+1
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | update FSF address in license textJiri Popelka2014-03-136-6/+6
| | | | | | | | | | | | | | | | | | | | | http://www.gnu.org/licenses/gpl-2.0.html http://www.fsf.org/about/contact/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | iptables.8: update coreteam members from manpagePablo Neira Ayuso2014-03-071-3/+4
| | | | | | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | iptables: fix version in iptables(8)Jiri Popelka2014-03-071-1/+1
| | | | | | | | | | | | | | | Signed-off-by: Jiri Popelka <jpopelka@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | nft-arp: wrong condition in parse_payloadGiuseppe Longo2014-03-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the current condition doesn't permit to parse ip addresses when they should be. Obviously they are not printed. arptables-compat -A INPUT -s 1.1.1.1 -i eth0 -j ACCEPT arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination -j ACCEPT -i eth0 Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>