summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tests: iptables-test: Exit non-zero on errorPhil Sutter2021-09-131-1/+2
| | | | | | If any test fails, return a non-zero exit code. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate-test: Exit non-zero on errorPhil Sutter2021-09-131-10/+16
| | | | | | | | | If a test fails, return a non-zero exit code. To do so, propagate the pass/fail statistics up to main() for evaluation. While being at it, move the statistics printing into there as well and get rid of that redundant assignment to 'test_passed'. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Print errors to stderrPhil Sutter2021-09-131-4/+5
| | | | | | | No big deal, just pass the extra parameter to the four error print calls. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate-test: Print errors to stderrPhil Sutter2021-09-131-2/+2
| | | | | | | Return code is always zero, so grepping for output on stderr is a simple way to detect testsuite failures. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate-test: Don't skip any input after the first empty linePhil Sutter2021-09-131-2/+2
| | | | | | | | | | | | | | | | | | | | | In conditionals, testing the empty string evaluates to false. This is dumb but seems intentional, as readline() method returns an empty string at EOF. This is distinct from reading an empty line as the latter contains the newline character - unless it is stripped in between readline() and conditional. The fixed commit introduced just that by accident, effectively reducing any test file to the first contained test: | $ ./xlate-test.py | [...] | 81 test files, 84 tests, 84 tests passed, 0 tests failed, 0 errors With this change in place, the summary looks much better: | 81 test files, 368 tests, 368 tests passed, 0 tests failed, 0 errors Fixes: 62828a6aff231 ("tests: xlate-test: support multiline expectation") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Fix missing chain casePhil Sutter2021-09-131-2/+5
| | | | | | | | | If a chain line was really missing, Python complained about reference before assignment of 'chain_array' variable. While being at it, reuse print_error() function for reporting and allow to continue with the next input file instead of exiting. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-nft: allow removal of empty builtin chainsFlorian Westphal2021-09-078-45/+72
| | | | | | | | | | | | The only reason why this is prohibited is that you cannot do it in iptables-legacy. This removes the artifical limitation. "iptables-nft -X" will leave the builtin chains alone; Also, deletion is only permitted if the chain is empty. Signed-off-by: Florian Westphal <fw@strlen.de>
* Fix a few doc typosŠtěpán Němec2021-09-032-4/+4
| | | | | | | Just a few minor language fixes. Signed-off-by: Štěpán Němec <snemec@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Use xtables_{m,c}alloc() everywherePhil Sutter2021-08-316-47/+12
| | | | | | | | | | Make use of libxtables allocators where sensible to have implicit error checking. Leave library-internal calls in place to not create unexpected program exit points for users, apart from xt_xlate_alloc() as that function called xtables_error() in error case which exits by itself already. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Use xtables_malloc() in mnl_err_list_node_add()Phil Sutter2021-08-311-1/+1
| | | | | | | | The function called malloc() without checking for memory allocation failure. Simply replace the call by xtables_malloc() to fix that. Fixes: 4e2020952d6f9 ("xtables: use libnftnl batch API") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libxt_mac: Fix for missing space in listingPhil Sutter2021-08-311-2/+2
| | | | | | | | | Listing the extension using 'iptables -L', there was no space between 'MAC' and the following Address. Reported-by: Adam Wójcik <a.wojcik@hyp.home.pl> Fixes: 1bdb5535f561a ("libxtables: Extend MAC address printing/parsing support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-test: Make netns spawning more robustPhil Sutter2021-08-111-7/+30
| | | | | | | On systems without unshare Python module, try to call unshare binary with oneself as parameters. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: hashlimit: Fix tests with HZ=100Phil Sutter2021-08-101-4/+2
| | | | | | | | | | With the kernel ticking at 100Hz, a limit of 1/day with burst 5 does not overflow in kernel, making the test unstable depending on kernel config. Change it to not overflow with 1000Hz either by increasing the burst value by a factor of 100. Fixes: fcf9f6f25db11 ("extensions: libxt_hashlimit: add unit test") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ip6tables: masquerade: use fully-random so that nft can understand the rulePavel Tikhomirov2021-08-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Here is the problem: []# nft -v nftables v0.9.8 (E.D.S.) []# iptables-nft -v iptables v1.8.7 (nf_tables): no command specified Try `iptables -h' or 'iptables --help' for more information. []# nft flush ruleset []# ip6tables-nft -t nat -A POSTROUTING -j MASQUERADE --random-full []# nft list ruleset table ip6 nat { chain POSTROUTING { type nat hook postrouting priority srcnat; policy accept; counter packets 0 bytes 0 masquerade random-fully } } []# nft list ruleset > /tmp/ruleset []# nft flush ruleset []# nft -f /tmp/ruleset /tmp/ruleset:4:54-54: Error: syntax error, unexpected newline counter packets 0 bytes 0 masquerade random-fully That's because nft list ruleset saves "random-fully" which is wrong format for nft -f, right should be "fully-random". We face this problem because we run k8s in Virtuozzo container, and k8s creates those "random-fully" rules by iptables(nft) and then CRIU can't restore those rules using nft. Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: exit if called by setuid executeableFlorian Westphal2021-08-041-0/+4
| | | | | | | | | iptables (legacy or nft, doesn't matter) cannot be safely used with setuid binaries. Add a safety check for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: Assert non-verbose mode is silentPhil Sutter2021-08-031-0/+11
| | | | | | | | | | Unexpected output from iptables commands might mess up error-checking in scripts for instance, so do a quick test of the most common commands. Note: Test adds two rules to make sure flush command operates on a non-empty chain. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix for non-verbose check commandPhil Sutter2021-08-031-1/+1
| | | | | | | | Check command was unconditionally verbose since v1.8.5. Make it respect --verbose option again. Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Dump atomic wastePhil Sutter2021-08-021-53/+0
| | | | | | | | | | | With ebtables-nft.8 now educating people about the missing functionality, get rid of atomic remains in source code. This eliminates mostly comments except for --atomic-commit which was treated as alias of --init-table. People not using the latter are probably trying to atomic-commit from an atomic-file which in turn is not supported, so no point keeping it. Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: ebtables-nft.8: Adjust for missing atomic-optionsPhil Sutter2021-07-291-56/+8
| | | | | | | | | Drop any reference to them (and the environment variable) but list them in BUGS section hinting at ebtables-save and -restore tools. Fixes: 1939cbc25e6f5 ("doc: Adjust ebtables man page") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Call init_extensions6() for static buildsErik Wilson2021-07-145-0/+5
| | | | | | | | Initialize extensions from libext6 for cases where xtables is built statically. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1550 Signed-off-by: Erik Wilson <Erik.E.Wilson@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libxt_multiport: add translation for -m multiport --portsPablo Neira Ayuso2021-06-252-8/+33
| | | | | | Add a translation for -m multiport --ports. Extend the existing testcase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_conntrack: simplify translation using negationPablo Neira Ayuso2021-06-072-37/+17
| | | | | | | | | Available since nftables 0.9.9. For example: # iptables-translate -I INPUT -m state ! --state NEW,INVALID nft insert rule ip filter INPUT ct state ! invalid,new counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_tcp: rework translation to use flags match representationPablo Neira Ayuso2021-06-073-10/+10
| | | | | | | Use the new flags match representation available since nftables 0.9.9 to simplify the translation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_connlimit: add translationPablo Neira Ayuso2021-06-072-0/+64
| | | | | | | | This patch adds a translation for connlimit matches which requires the definition of a set and the family context (either IPv4 or IPv6) which is required to display the netmask accordingly. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: xlate-test: support multiline expectationPablo Neira Ayuso2021-06-071-2/+12
| | | | | | | | | | Extend translation test to deal with multiline translation, e.g. iptables-translate -A INPUT -m connlimit --connlimit-above 2 nft add set ip filter connlimit0 { type ipv4_addr; flags dynamic; } nft add rule ip filter INPUT add @connlimit0 { ip saddr ct count over 2 } counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: extend xlate infrastructurePablo Neira Ayuso2021-06-074-28/+93
| | | | | | | | | | | | | | This infrastructure extends the existing xlate infrastructure: - Extensions can define set dependencies through .xlate. The resulting set definition can be obtained through xt_xlate_set_get(). - Add xl_xlate_set_family() and xl_xlate_get_family() to store/fetch the family. The first client of this new xlate API is the connlimit extension, which is added in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_string: Avoid buffer size warning for strncpy()Phil Sutter2021-06-071-1/+1
| | | | | | | If the target buffer does not need to be null-terminated, one may simply use memcpy() and thereby avoid any compiler warnings. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce xtables_strdup() and use it everywherePhil Sutter2021-06-0726-73/+60
| | | | | | This wraps strdup(), checking for errors. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_ip6: Use xtables_ip6parse_any()Phil Sutter2021-06-071-64/+10
| | | | | | | | | | | The code was almost identical and suffered from the same problem as fixed in commit a76a5c997a235 ("libxtables: fix two off-by-one memory corruption bugs"). The only functional change this involves is ebt_parse_ip6_address() will now accept hostnames as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-apply: Drop unused variablePhil Sutter2021-06-071-1/+0
| | | | | | | It was assigned to but never read. Fixes: b45b4e3903414 ("iptables-apply: script and manpage update") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Avoid buffer size warnings copying iface namesPhil Sutter2021-06-072-4/+4
| | | | | | | | | The call to strncpy() is actually not needed: source buffer is only IFNAMSIZ bytes large and guaranteed to be null-terminated. Use this to avoid compiler warnings due to size parameter matching the destination buffer size by performing the copy using (dumb) memcpy() instead. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Avoid memleak in error path of nft_cmd_new()Phil Sutter2021-06-071-1/+3
| | | | | | | | If rule allocation fails, free the allocated 'cmd' before returning to caller. Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Fix memleak in xtopt_parse_hostmask()Phil Sutter2021-06-071-0/+1
| | | | | | | The allocated hostmask duplicate needs to be freed again. Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_ip6: Drop unused variablesPhil Sutter2021-06-071-4/+2
| | | | | | | They are being assigned to but never read. Fixes: 5c8ce9c6aede0 ("ebtables-compat: add 'ip6' match extension") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Drop leftover variable in xtables_numeric_to_ip6addr()Phil Sutter2021-06-071-2/+1
| | | | | | | Variable 'err' was only used in removed debug code, so drop it as well. Fixes: 7f526c9373c17 ("libxtables: xtables: remove unnecessary debug code") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: sctp: Translate --chunk-types optionPhil Sutter2021-05-192-19/+78
| | | | | | | | | The translation is not fully complete as it is not possible to map 'any' match type into nft syntax with a single rule. Also, 'only' match type translation is a bit poor as it explicitly lists all chunk types that are supposed to be missing. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: sctp: Fix nftables translationPhil Sutter2021-05-192-11/+9
| | | | | | | If both sport and dport was present, incorrect nft syntax was generated. Fixes: defc7bd2bac89 ("extensions: libxt_sctp: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* Use proto_to_name() from xshared in more placesPhil Sutter2021-05-176-38/+16
| | | | | | | | | | Share the common proto name lookup code. While being at it, make proto number variable 16bit, values may exceed 256. This aligns iptables-nft '-p' argument printing with legacy iptables. In practice, this should make a difference only in corner cases. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables-translate: Use shared ebt_get_current_chain() functionPhil Sutter2021-05-171-17/+1
| | | | | | | | | | | | | | | | | | | | Drop the local reimplementation. It was barely different enough to be buggy: | % ebtables-nft -A foo -o eth0 -j ACCEPT | % xtables-nft-multi ebtables-translate -A foo -o eth0 -j ACCEPT | ebtables-translate v1.8.5 (nf_tables): Use -o only in OUTPUT, FORWARD and POSTROUTING chains | Try `ebtables-translate -h' or 'ebtables-translate --help' for more information. With this change, output is as expected: | % xtables-nft-multi ebtables-translate -A foo -o eth0 -j ACCEPT | nft add rule bridge filter foo oifname "eth0" counter accept This is roughly the same issue fixed in commit e1ccd979e6849 ("ebtables: fix over-eager -o checks on custom chains"). Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Merge invflags handling codePhil Sutter2021-05-177-199/+88
| | | | | | | | | | Join invflags handling between iptables, ip6tables, xtables and arptables. Ebtables still has its own code which differs quite a bit. In order to use a shared set_option() routine, iptables and ip6tables need to provide a local 'invflags' variable which is 16bits wide. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Eliminate iptables_command_state->invertPhil Sutter2021-05-177-133/+113
| | | | | | | | | This field is not used by routines working with struct iptables_command_state: It is merely a temporary flag used by parsers to carry the '!' prefix until invflags have been populated (or error checking done if unsupported). Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Make invflags 16bit widePhil Sutter2021-05-172-3/+3
| | | | | | | | | | | | | This is needed to merge with xtables-arp which has more builtin options and hence needs more bits in invflags. The only adjustment needed is the set_option() call for option '-j' which passed a pointer to cs->fw.ip.invflags. That field can't be changed, it belongs to uAPI. Though using args->invflags instead works fine, aside from that '-j' doesn't support inverting so this is merely a sanity check and no real invflag value assignment will happen. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: SECMARK: Implement revision 1Phil Sutter2021-05-043-20/+80
| | | | | | | | | The changed data structure for communication with kernel allows to exclude the field 'secid' which is populated on kernel side. Thus this fixes the formerly always failing extension comparison breaking rule check and rule delete by content. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-arp: Make use of ipv4_addr_to_string()Phil Sutter2021-04-303-94/+14
| | | | | | | This eliminates quite a bit of redundant code apart from also dropping use of obsolete function gethostbyaddr(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* Eliminate inet_aton() and inet_ntoa()Phil Sutter2021-04-302-11/+18
| | | | | | | Both functions are obsolete, replace them by equivalent calls to inet_pton() and inet_ntop(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: sctp: Explain match types in man pagePhil Sutter2021-04-291-0/+11
| | | | | | They weren't mentioned at all. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Increase BATCH_PAGE_SIZE to support huge rulesetsPhil Sutter2021-04-101-5/+7
| | | | | | | | | | | | | | In order to support the same ruleset sizes as legacy iptables, the kernel's limit of 1024 iovecs has to be overcome. Therefore increase each iovec's size from 128KB to 2MB. While being at it, add a log message for failing sendmsg() call. This is not supposed to happen, even if the transaction fails. Yet if it does, users are left with only a "line XXX failed" message (with line number being the COMMIT line). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: cache: Sort chains on demand onlyPhil Sutter2021-04-065-13/+73
| | | | | | | | | Mandatory sorted insert of chains into cache significantly slows down restoring of large rulesets. Since the sorted list of user-defined chains is needed for listing and verbose output only, introduce nft_cache_sort_chains() and call it where needed. Signed-off-by: Phil Sutter <phil@nwl.cc>
* fix build for missing ETH_ALEN definitionMaciej Żenczykowski2021-04-031-0/+1
| | | | | | | (this is needed at least with bionic) Signed-off-by: Maciej Żenczykowski <maze@google.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libxt_conntrack: use bitops for status negationAlexander Mikhalitsyn2021-04-022-10/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At the moment, status_xlate_print function prints statusmask as comma-separated sequence of enabled statusmask flags. But if we have inverted conntrack ctstatus condition then we have to use more complex expression (if more than one flag enabled) because nft not supports syntax like "ct status != expected,assured". Examples: ! --ctstatus CONFIRMED,ASSURED should be translated as ct status & (assured|confirmed) == 0 ! --ctstatus CONFIRMED can be translated as ct status & confirmed == 0 See also netfilter/xt_conntrack.c (conntrack_mt() function as a reference). Reproducer: $ iptables -A INPUT -d 127.0.0.1/32 -p tcp -m conntrack ! --ctstatus expected,assured -j DROP $ nft list ruleset ... meta l4proto tcp ip daddr 127.0.0.1 ct status != expected,assured counter packets 0 bytes 0 drop ... it will fail if we try to load this rule: $ nft -f nft_test ../nft_test:6:97-97: Error: syntax error, unexpected comma, expecting newline or semicolon Cc: Florian Westphal <fw@strlen.de> Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com> Signed-off-by: Florian Westphal <fw@strlen.de>