summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* xtables-monitor: add missing spaces in printed strAnton Luka Šijanec2022-06-231-2/+2
| | | | | | | | | | when printing the ID and OPTs in iptables/xtables-monitor.c, a space is missing after the string, thereby concatenating the number with the next item in the printed PACKET line. Fixes: d26c538b9a549 ("xtables: add xtables-monitor") Signed-off-by: Anton Luka Šijanec <anton@sijanec.eu> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Exit if nftnl_alloc_expr failsPhil Sutter2022-06-211-15/+16
| | | | | | | | | | In some code-paths, 'reg' pointer remaining uninitialized is used later so at least minimal error checking is necessary. Given that a call to nftnl_alloc_expr() with sane argument should never fail, complain and exit if it happens. Fixes: 7e38890c6b4fb ("nft: prepare for dynamic register allocation") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables.8: mention that iptables exits when setuidFlorian Westphal2022-06-171-0/+5
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: string: Fix and enable testsPhil Sutter2022-06-111-14/+7
| | | | | | | | | | Some minor fixes were necessary: * --algo is printed after the pattern * Second long string test must fail, that string is 129 chars long * --from 0 and --to 65535 are not printed (default values) Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: string: Review parse_string() functionPhil Sutter2022-06-111-7/+6
| | | | | | | | | | | * Compare against sizeof(info->pattern) which is more clear than having to know that this buffer is of size XT_STRING_MAX_PATTERN_SIZE * Invert the check and error early to reduce indenting * Pass info->patlen to memcpy() to avoid reading past end of 's' Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: string: Do not print default --to valuePhil Sutter2022-06-111-2/+2
| | | | | | | Default value is UINT16_MAX, not 0. Fix the conditional printing. Fixes: c6fbf41cdd157 ("update string match to reflect new kernel implementation (Pablo Neira)") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables-restore: Deny --init-tablePhil Sutter2022-06-111-0/+3
| | | | | | | Allowing this segfaults the program. The deny is in line with legacy ebtables, so no point in implementing support for that. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_standard.t: Test logical-{in,out} as wellPhil Sutter2022-06-111-0/+5
| | | | | | | These weren't used anywhere before. At least ensure they are only allowed where claimed. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Extend zero counters test a bit furtherPhil Sutter2022-06-111-0/+15
| | | | | | Test zeroing a single rule's counters as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Extend iptables-xml test a bitPhil Sutter2022-06-111-9/+1
| | | | | | | | Call with --combine as well, even though output doesn't differ. Also there's no need to skip for xtables-nft-multi, it provides the same functionality. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Add some more rules to 0002-verbose-output_0Phil Sutter2022-06-111-0/+15
| | | | | | This increases coverage of function print_match() from 0 to 86.6%. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Add --enable-profiling configure optionPhil Sutter2022-06-118-1/+20
| | | | | | A little convenience to prepare a build for analysis with gcov/gprof. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Make some functions staticPhil Sutter2022-06-102-34/+17
| | | | | | | | With all ip(6)tables variants using the same do_parse() function, quite a bunch of functions are not used outside of xshared.c anymore. Make them static. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-legacy: Drop redundant include of xtables-multi.hPhil Sutter2022-06-101-4/+0
| | | | | | | | The header is included unconditionally first, so no point in doing it a second time of ENABLE_NFTABLES is defined. Fixes: be70918eab26e ("xtables: rename xt-multi binaries to -nft, -legacy") Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables: Support -x/--exact flagPhil Sutter2022-06-081-1/+1
| | | | | | | | | | Legacy arptables accepts but ignores the flag. Yet there are remains of the functionality in sources, like OPT_EXPANDED define and a print_num() function which acts on FMT_KILOMEGAGIGA flag being set or not. So instead of mimicking legacy behaviour by explicitly ignoring -x flag for arptables, just enable the feature for it. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Unexport init_extensions*() declarationsPhil Sutter2022-06-071-22/+22
| | | | | | | | | | | | | | The functions are used for static builds to initialize extensions after libxtables init. Regular library users should not need them, but the empty declarations introduced in #else case (and therefore present in user's env) may clash with existing symbol names. Avoid problems and guard the whole block declaring the function prototypes and mangling extensions' _init functions by XTABLES_INTERNAL. Reported-by: Nick Hainke <vincent@systemli.org> Fixes: 6c689b639cf8e ("Simplify static build extension loading") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Check overhead in iptables-save and -restorePhil Sutter2022-06-021-0/+37
| | | | | | | Some repeated calls have been reduced recently, assert this in a test evaluating strace output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: Fix error during out of tree buildBen Brown2022-05-251-1/+1
| | | | | | | | | | | Fixes the following error: ../../libxtables/xtables.c:52:10: fatal error: libiptc/linux_list.h: No such file or directory 52 | #include <libiptc/linux_list.h> Fixes: f58b0d7406451 ("libxtables: Implement notargets hash table") Signed-off-by: Ben Brown <ben@demerara.io> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Revert "fix build for missing ETH_ALEN definition"Phil Sutter2022-05-251-3/+5
| | | | | | | | | | | | | This reverts commit c5d9a723b5159a28f547b577711787295a14fd84 as it broke compiling against musl libc. Might be a bug in the latter, but for the time being try to please both by avoiding the include and instead defining ETH_ALEN if unset. While being at it, move netinet/ether.h include up. Fixes: 1bdb5535f561a ("libxtables: Extend MAC address printing/parsing support") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Maciej Żenczykowski <maze@google.com>
* treewide: use uint* instead of u_int*Nick Hainke2022-05-188-11/+11
| | | | | | | | | | | | | | | | | | | | Gcc complains about missing types. Some commits introduced u_int* instead of uint*. Use uint treewide. Fixes errors in the form of: In file included from xtables-legacy-multi.c:5: xshared.h:83:56: error: unknown type name 'u_int16_t'; did you mean 'uint16_t'? 83 | set_option(unsigned int *options, unsigned int option, u_int16_t *invflg, | ^~~~~~~~~ | uint16_t make[6]: *** [Makefile:712: xtables_legacy_multi-xtables-legacy-multi.o] Error 1 Avoid libipq API breakage by adjusting libipq.h include accordingly. For arpt_mangle.h kernel uAPI header, apply same change as in kernel commit e91ded8db5747 ("uapi: netfilter_arp: use __u8 instead of u_int8_t"). Signed-off-by: Nick Hainke <vincent@systemli.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix build for -Werror=format-securityPhil Sutter2022-05-131-1/+1
| | | | | | Gcc complains about the omitted format string. Signed-off-by: Phil Sutter <phil@nwl.cc>
* configure: bump version for 1.8.8 releasev1.8.8Pablo Neira Ayuso2022-05-131-3/+3
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Fix EPERM handling for extensions without rev 0Phil Sutter2022-05-112-4/+13
| | | | | | | | | | Treating revision 0 as compatible in EPERM case works fine as long as there is a revision 0 of that extension defined in DSO. Fix the code for others: Extend the EPERM handling to all revisions and keep the existing warning for revision 0. Fixes: 17534cb18ed0a ("Improve error messages for unsupported extensions") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: LOG: Document --log-macdecode in man pagePhil Sutter2022-05-111-0/+3
| | | | | | | Help text already contains it, so no update needed there. Fixes: 127647892c7ca ("extensions: libipt_LOG/libip6t_LOG: support macdecode option") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: *NAT: Review --random* option descriptionsPhil Sutter2022-05-114-20/+6
| | | | | | | | Stating the option again in the first (single?) sentence is pointless. Get rid of that initial half-sentence in MASQUERADE options and unify the texts a bit. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: DNAT: Merge core printing functionsPhil Sutter2022-05-111-31/+27
| | | | | | | | | | | Have a versatile __NAT_print() function providing enough flexibility for DNAT and REDIRECT, IPv4 and IPv6 and 'print' and 'save' output. Then define macros to simplify calling it. As a side effect, this fixes ip6tables DNAT revision 1 print output. Fixes: 14d77c8aa29a7 ("extensions: Merge IPv4 and IPv6 DNAT targets") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Revert change to struct xtables_pprotPhil Sutter2022-05-111-1/+1
| | | | | | | | | | | | While protocol values may exceed eight bits, the data structure is indeed used only to store the static list of name/value pairs for faster lookups. None of those has such a value and if one is added in future, the compiler will complain about it. So restore the old field type to retain binary compatibility. Fixes: 556f704458cdb ("Use proto_to_name() from xshared in more places") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Drop xtables_globals 'optstring' fieldPhil Sutter2022-05-118-8/+20
| | | | | | | | | | | Define the different optstrings in xshared.h instead, they are not relevant for other libxtables users. This is a partial revert of commit 65b150ae382a8 ("xshared: Store optstring in xtables_globals") to avoid breaking libxtables' ABI compatibility. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Extend xtables_printhelp() for arptablesPhil Sutter2022-05-117-119/+43
| | | | | | | | | | | | | | | | | | | | | | | | The function checks afinfo->family already to cover ip6tables specifics, doing the same for arptables does not make things much worse. This changes arptables-nft help output slightly: * List possible negations extrapositioned, which is preferred anyway (arptables-nft supports both) * List --out-interface option at lexically sorted position * Print --wait option, it's ignored just like with iptables * Restore default target option printing as with legacy arptables (not sure if arptables-nft ever did this) by explicitly loading them. While being at it, add --set-counters short option '-c' to help output for ip(6)tables. This effectively removes the need for (and all users of) xtables_global's 'print_help' callback, thus effectively reverts commit fe83b12fc910e ("libxtables: Introduce xtables_globals print_help callback") which broke libxtables' ABI compatibility. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Move arp_opcodes into shared spacePhil Sutter2022-05-118-29/+21
| | | | | | | It will be referenced by xtables_printhelp() if printing for arptables and therefore must be present in legacy as well even if unused. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: MARK: Drop extra newline at end of helpPhil Sutter2022-05-111-2/+1
| | | | | Fixes: f4b737fb0c52a ("libxt_MARK r2") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: split gen_payload() to allocate register and initialize expressionPablo Neira Ayuso2022-05-021-4/+14
| | | | | | Add __gen_payload(), in preparation for the dynamic register allocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: prepare for dynamic register allocationPablo Neira Ayuso2022-05-026-94/+137
| | | | | | | | | Store the register that has been allocated and pass it on to the next expression. NFT_REG_1 is still used. No functional changes are expected. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: pass handle to helper functions to build netlink payloadPablo Neira Ayuso2022-05-027-66/+73
| | | | | | | Pass struct nft_handle to helper functions in preparation for the dynamic register allocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: native mark matching supportPablo Neira Ayuso2022-05-022-0/+59
| | | | | | Use meta mark + bitwise + cmp instead of nft_compat mark match. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: pass struct nft_xt_ctx to parse_meta()Pablo Neira Ayuso2022-05-026-10/+10
| | | | | | In preparation for native mark match support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-shared: update context register for bitwise expressionPablo Neira Ayuso2022-05-021-0/+2
| | | | | | | | Update the destination register, otherwise nft_parse_cmp() gives up on interpreting the cmp expression when bitwise sreg != dreg. Fixes: 2c4a34c30cb4 ("iptables-compat: fix address prefix") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: man: Document service name support in DNAT and REDIRECTPhil Sutter2022-04-082-0/+3
| | | | | | | Unless as part of a range, service names may be used. Point this out to avoid confusion. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Merge REDIRECT into DNATPhil Sutter2022-04-0812-380/+204
| | | | | | | | | Code is very similar, join them to reuse parsing code at least. As a side-effect, this enables parsing of service names for ports in DNAT as well as using port number 0 as that's what REDIRECT allows. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Merge IPv4 and IPv6 DNAT targetsPhil Sutter2022-04-085-468/+218
| | | | | | | | | Make parse_to() family-aware so it serves for both IPv4 and IPv6. Have a core _DNAT_parse() function which parses into the most modern (nf_nat_range2) data structure and a bunch of wrappers to copy into legacy data structures if needed. Treat other callbacks analogous. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: DNAT: Rename from libipt to libxtPhil Sutter2022-04-081-0/+0
| | | | | | | Prepare for merge of libipt and libip6t DNAT extensions, allow for better code review. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ipt_DNAT: Combine xlate functions alsoPhil Sutter2022-04-081-67/+21
| | | | | | | | | | Make use of the new sprint_range() to introduce a common inner function for both v1 and v2 xlate functions. Also abort translation with shifted port ranges to not hide the missing feature in nftables. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ipt_DNAT: Merge v1/v2 print/save codePhil Sutter2022-04-081-65/+46
| | | | | | | | | | | Turn print_range() function into sprint_range() so it becomes more versatile. Make it accept the new nf_nat_range2 data structure and make v1 callers convert their nf_nat_ipv4_multi_range_compat structs to that. This allows to introduce an inner __DNAT_print() which acts for v1 and v2 and prints either 'print' or 'save' syntax. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ipt_DNAT: Merge v1 and v2 parsersPhil Sutter2022-04-081-179/+111
| | | | | | | | | | | | | | | | Use v2 parser for both and copy field values into v1 data structure if needed. While being at it: * Introduce parse_ports() function similar to the one in libipt_REDIRECT.c. * Use xtables_strtoui() in the above instead of atoi() for integrated range checking. * Parse IP addresses using inet_pton(), writing directly into struct nf_nat_range2 fields. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Revert "libipt_[SD]NAT: avoid false error about multiple destinations specified"Phil Sutter2022-04-084-25/+4
| | | | | | | | | | | | | This reverts commit f25b2355e889290879c8cecad3dd24ec0c384fb8. The workaround is not needed anymore since commit 30b178b9bf11e ("extensions: *NAT: Kill multiple IPv4 range support"). While being at it, drop the same hidden flag logic from libip6t_[SD]NAT extensions as well and just don't set XTOPT_MULTI so guided option parser will reject multiple parameters automatically. Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: DNAT: Describe shifted port range featurePhil Sutter2022-04-081-1/+4
| | | | | | This wasn't mentioned anywhere. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xlate-test: Fix for empty source line on failurePhil Sutter2022-03-311-1/+2
| | | | | | | | The code overwrites 'line' before checking expected output. Save it in a temporary variable. Fixes: 62828a6aff231 ("tests: xlate-test: support multiline expectation") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Boost rule target checks by announcing chain namesPhil Sutter2022-03-174-0/+11
| | | | | | | | | | | | | | | | | When restoring a ruleset, feed libxtables with chain names from respective lines to avoid an extension search. While the user's intention is clear, this effectively disables the sanity check for clashes with target extensions. But: * The check yielded only a warning and the clashing chain was finally accepted. * Users crafting iptables dumps for feeding into iptables-restore likely know what they're doing. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* libxtables: Implement notargets hash tablePhil Sutter2022-03-171-0/+75
| | | | | | | | | Target lookup is relatively costly due to the filesystem access. Avoid this overhead in huge rulesets which contain many chain jumps by caching the failed lookups into a hashtable for later. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Reject standard targets as chain names when restoringPhil Sutter2022-03-173-7/+4
| | | | | | | | | | | | | Reuse parse_chain() called from do_parse() for '-N' and rename it for a better description of what it does. Note that by itself, this patch will likely kill iptables-restore performance for big rulesets due to the extra extension lookup for chain lines. A following patch announcing those chains to libxtables will alleviate that. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Florian Westphal <fw@strlen.de>
generated by cgit v1.2.3 (git 2.25.0) at 2025-05-12 16:34:42 +0000