summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* ebtables: Fix entries count in chain listingPhil Sutter2018-08-166-9/+40
| | | | | | | | | | | | | | | The previous fix for reference counts in iptables-nft output wasn't complete: While iptables lists the number of references for each custom chain (i.e., the number of jumps to it), ebtables lists number of entries (i.e., the number of rules contained) for each chain. Both used the same value for it, although they are different metrics. Fix this by passing both numbers separately to the 'print_header' callback so that each tool may print the desired value. Fixes: a0698de9866d2 ("xtables: Do not count rules as chain references") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Make 'iptables -S nonexisting' return non-zeroPhil Sutter2018-08-164-15/+86
| | | | | | | | | | | | To be consistent with legacy iptables, calling -S with a non-existing chain should lead to an error message. This is how some scripts find out whether a user-defined chain exists or not. Make sure doing the same for an existing chain does succeed, even if an invalid rule number was given. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Fix for listing of non-existent chainsPhil Sutter2018-08-162-5/+7
| | | | | | | | | | | | | | | | | When trying to list a non-existent chain, ebtables-nft would just print the table header and then exit with a code of zero. In order to be more consistent with legacy ebtables, change the code to: * Print table header only if chosen chain is found and * propagate the error condition if chain was not found to print an error message. Note that this does not establish full parity with legacy ebtables due to the error code being 1 instead of 255 and the error message differing from the legacy one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix for no output in iptables-nft -SPhil Sutter2018-08-161-0/+17
| | | | | | | | | | | Just like with 'iptables-nft -L', we have to make sure the standard set of chains exist for a given table when listing it using '-S' flag. The added code was just copied over from nft_rule_list() which does the same. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables: Drop extensions/libxt_mangle.cPhil Sutter2018-08-161-396/+0
| | | | | | | This was merely an outdated duplicate of extensions/libarpt_mangle.c. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Merge libebt_limit.c into libxt_limit.cPhil Sutter2018-08-165-225/+97
| | | | | | | | | | | | | | | | | Both extensions were very similar already, but now that they both are translated into native nftables code, their actual difference (i.e. match size) doesn't matter anymore. This change comes with one caveat: Since ebtables limit match is not in its own file anymore, match preloading automatically also loads the NFPROTO_UNSPEC limit match. This is not a problem per se since match lookup will prefer the family-specific one, but when parsing unknown options, a match without 'parse' callback is encountered. Therefore do_commandeb() has to check existence of that callback prior to dereferencing it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Use native nftables limit expressionPhil Sutter2018-08-162-4/+95
| | | | | | | | | | | | | | | | | | | | The original issue was that for a rule with limit match added by ebtables-nft, the kernel might attempt to use xt_limit instead of ebt_limit (and fail due to that). This happens if xt_limit.ko is loaded but ebt_limit.ko is not, because the kernel prefers the family-independent variants. There are multiple ways to avoid above issue, but using neither xt_limit nor ebt_limit with nft-variants should be the most effective one. Therefore translate a created limit match in userspace into native nftables code before sending it to kernel and do the reverse translation when listing rules. Apart from the translation routines, this requires slight adjustment of nft_is_expr_compatible() since neither xt_limit nor ebt_limit support byte-based limits or inverted limit match. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Remove flags misinterpretationsPhil Sutter2018-08-101-9/+7
| | | | | | | | | | | | | | | This is actually quite a mess: xtables-eb.c defines names for bits in 'flags' variable of do_commandeb(), though these tend to clash with bit names defined in xshared.h due to the same 'OPT_' prefix. Therefore checking for bits OPT_NUMERIC and OPT_VERBOSE is syntactically correct, but semantically wrong as they actually refer to bits OPT_COMMAND and OPT_PROTOCOL. Since ebtables doesn't support numeric nor verbose modes, just replace the checks with zero values. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for wrong counter format in -S outputPhil Sutter2018-08-097-32/+83
| | | | | | | | | | | | | | | | | | | | | | Legacy iptables uses '-c PCNT BCNT' format in listed rules, nft-variant used '[PCNT BCNT]' prefix like with iptables-save. In order to pass the counter format preference along, FMT_C_COUNTS is introduced and related 'format' checks adjusted. Since legacy iptables prints the counters between matches and target, this change affects save_matches_and_target() function. In order to get access to the rule counters, it's declaration is adjusted to receive iptables_command_state pointer instead of match, target and jumpto pointers from the same object. While being at it, integrate jump to user-defined chain into it as well since the related code in both callers was almost identical. Though since different rule flags are used between iptables and ip6tables, pass a 'goto_flag' boolean instead of the actual 'flags' bitfield. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Don't pass full invflags to add_compat()Phil Sutter2018-08-094-3/+13
| | | | | | | | | | | The function expects a boolean, not a bitfield. This bug caused inversion in another match to carry over to protocol match by accident. The supplied testcase contains rules which then fail because they contain matches requiring that protocol. Fixes: 4ef77b6d1b52e ("xtables: fix missing protocol and invflags") Fixes: 4143a08819a07 ("ebtables-compat: add nft rule compat information to bridge rules") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Improve xtables-monitor first impressionPhil Sutter2018-08-091-1/+2
| | | | | | | | | | | | | First time users are likely to call 'xtables-monitor --help' to see what's going on. Make this situation a bit more pleasant for them: * When complaining about illegal arguments, add a final newline character to the error message. * Actually support '--help' long option as an alias to '-h'. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: Fix skipping for recent nft-only testsPhil Sutter2018-08-094-4/+4
| | | | | | | | | | | | | | | In an attempt to sanitize shell scripting, exit test in recent testcases was altered, which led to them being skipped even in nft test runs. Drop the quotes so that globbing happens again. While here, improve the check a bit to glob only on leading path part, not also the file name. Also print "skip ..." just like nft-only/0001compat_0 testcase does. Fixes: f1d8508fd6fdc ("tests: Add arptables-{save,restore} testcases") Fixes: fbf0bf7c079d8 ("tests: Add ebtables-{save,restore} testcases") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Spelling fixes in xtables-monitorPhil Sutter2018-08-072-7/+7
| | | | | | | | | Fix a few minor spelling issues in xtables-monitor help output and man page. While being at it, change 'ipv4' and 'ipv6' to 'IPv4' and 'IPv6', respectively. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix potential segfault in nft_rule_append()Phil Sutter2018-08-061-1/+3
| | | | | | | | | If batch_rule_add() failed (ENOMEM), nft_rule_append() frees the rule and then tries to add it to the rule cache. Better return 0 (failure) instead of continuing. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: Add ebtables-{save,restore} testcasesPhil Sutter2018-08-062-0/+145
| | | | | | | | | | | This actually does a bit more since it creates the ruleset using separate ebtables calls. Note that there are a few commented out lines containing commands which don't apply for unknown reasons - something to investigate later. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: Add arptables-{save,restore} testcasesPhil Sutter2018-08-062-0/+86
| | | | | | | | | | | This actually does a bit more since it creates the ruleset using separate arptables calls. Note that there are a few commented out lines containing commands which don't apply for unknown reasons - something to investigate later. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Implement arptables-{save,restore}Phil Sutter2018-08-069-43/+146
| | | | | | | | | | | This adds C implementations for arptables-save and -restore in compat layer based on the two perl scripts in legacy arptables repository. To share common code, introduce nft_init_arp() analogous to nft_init_eb() introduced earlier. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Review match/target lookupPhil Sutter2018-08-062-42/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since ebtables does not indicate extension use on commandline via '-m' flag as in iptables, loading of matches has to happen prior to commandline parsing. While parsing, the right extension is searched for unknown parameters by passing it to its 'parse' callback and checking if it succeeds. As an unavoidable side-effect, custom data in xtables_targets objects is being altered if the extension parser succeeds. If called multiple times, do_commandeb() leaks memory and fixing this requires to properly treat the above quirk: * Load extensions just once at program startup, thereby reusing the existing ones for several calls of do_commandeb(). * In ebt_cs_clean(), don't free memory which is being reused. Instead reinit custom extension data if it was used in current do_commandeb() call (i.e., it is contained in cs->match_list). On the other hand, target lookup in command_jump() can be simplified a lot: The only target it may have loaded is 'standard', so just load that at as well at program startup and reduce command_jump() to a simple linked list search. Since 'standard' target does not prove a 'parse' callback, a check is necessary when parsing target options. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-restore: Use xtables_restore_parse()Phil Sutter2018-08-064-89/+24
| | | | | | | | | This drops the dedicated input parser (which was broken in many ways anyway) and replaces it by the common one now that all required knobs are in place. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-restore: Make COMMIT support configurablePhil Sutter2018-08-062-3/+9
| | | | | | | | | | | | | | Legacy ebtables-restore does not support COMMIT directive, so allow for callers of xtables_restore_parse() to toggle whether it is required or not. In iptables, omitting COMMIT may be used for syntax checking, so we must not add an implicit commit at EOF. Although ebtables/arptables legacy does not support COMMIT lines at all, this patch allows them in nft variants. If omitted, an implicit commit happens for them at EOF. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-restore: Improve user-defined chain detectionPhil Sutter2018-08-063-13/+21
| | | | | | | | | | | | Legacy ebtables-save does not use a policy string of '-' to denote user-defined chains but instead lists them with a policy of ACCEPT. In order to use ebtables_restore_parse() for ebtables-save implementation, make use of builtin table definitions to decide whether a given chain is a builtin one or not. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Match verbose ip{,6}tables output with legacyPhil Sutter2018-08-047-25/+157
| | | | | | | | | | | | | | Legacy ip{,6}tables prints feedback for various commands if in verbose mode, make sure nft variants do the same. There is one difference, namely when checking a rule (-C command): Legacy ip{,6}tables print the rule in any case, nft variants don't in case the rule wasn't found. Changing this though would require to populate the nftnl_rule object just for printing, which is probably not feasible. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Reserve space for 'opt' column in ip6tables outputPhil Sutter2018-08-041-0/+5
| | | | | | | | | Although ip6tables does not support matching on fragments, the 'opt' column is included in ruleset listing nevertheless. So nft_ipv6_print_rule() has to fill that space up with blanks. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Print error when listing non-existent chainsPhil Sutter2018-08-041-2/+5
| | | | | | | | Just like legacy iptables, iptables-nft should not treat the attempt to list a non-existing chain as OK. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for no output on first iptables-nft invocationPhil Sutter2018-08-041-1/+3
| | | | | | | | | | | | Fix the same issue commit a4e78370af849 ("iptables-compat: fix empty chains after first invocation of iptables-compat -L") fixed back in 2014. Seems like some changes since then broke it again. This time, existing cache not containing the added table/chains gets into the way, so clear it if nft_commit() was called. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Do not count rules as chain referencesPhil Sutter2018-08-042-0/+52
| | | | | | | | | | Unlike iptables, nftables counts rules in a chain as references to that chain. Align output of 'iptables-nft -L' with that of legacy iptables by counting the number of rules in a chain and subtracting that value from reference count before printing the chain header. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Fix jumps into user-defined chainsPhil Sutter2018-08-041-11/+0
| | | | | | | | | | | | | | | Trying to jump into a user-defined chain was not possible: | arptables-nft -N foo | arptables-nft -A INPUT -j foo | (null) v1.8.0 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain INPUT Since nft_arp_add() already does the right thing if cs->target is NULL and cs->jumpto contains a non-empty string, simply drop the block of code trying to deal with the situation. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Fix opcode printing in numeric outputPhil Sutter2018-08-041-0/+1
| | | | | | | | This line of code was dropped by accident, add it back. Fixes: 68e5e18210b8d ("nft-arp: adds nft_arp_save_firewall") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix symlinks/names for ebtables-{save, restore}Phil Sutter2018-08-042-2/+5
| | | | | | | | | | While xtables-nft-multi only recognized ebtables-save and -restore, Makefile did install only ebtables-nft-save and -restore symlinks. Clean this up by making both name variants known and installing respective symlinks, just like for ebtables and ebtables-nft. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Support --init-table commandPhil Sutter2018-08-041-1/+3
| | | | | | | | | This effectively flushes all built-in chains and removes user-defined ones. Since compat layer takes care of built-in table/chain creation, it is sufficient to just drop the relevant table. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Print policy only for base chainsPhil Sutter2018-08-041-1/+1
| | | | | | | Printing a policy for user-defined chains is pointless. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Fix for trailing spaces in outputPhil Sutter2018-08-041-24/+16
| | | | | | | | | | | | This changes mangle target to print whitespace before each option, not afterwards. This fixes any cases of trailing or double whitespace in arptables output. While being at it, introduce ipaddr_to() helper in libarpt_mangle.c to simplify arpmangle_print() a bit. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Fix memleaks in do_commandarp()Phil Sutter2018-08-041-7/+12
| | | | | | | | | The function did not free memory allocated in parse_hostnetworkmask() and command_jump(). To fix the latter, code was aligned a bit more with xtables.c (especially opts handling). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Print non-standard target parametersPhil Sutter2018-08-041-1/+3
| | | | | | | | | | | | | | | If a rule has a non-standard target (i.e., cs->target != NULL), it may contain parameters. This patch enables printing them. The code assumed that a non-standard target is only present if cs->jumpto is not set, but that is wrong: If nft_rule_to_iptables_command_state() encounters a target expression, it calls nft_parse_target() which in turn calls the family-specific parse_target callback. All of them assign cs->target, whose name is later assigned to cs->jumpto by the first function. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Fix match_list insertionPhil Sutter2018-08-041-10/+8
| | | | | | | | Find the end of the match_list before inserting in case the list contains more than one element. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Fix for wrong program name in error messagesPhil Sutter2018-08-044-5/+5
| | | | | | | | Since nft_init_eb() is shared among standalone ebtables and ebtables-restore, allow for callers to pass the program name. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Consolidate argv construction routinesPhil Sutter2018-08-046-374/+161
| | | | | | | | | | | | | | | | | | | | | Implementations were equal in {ip,ip6,x}tables-restore.c. The one in iptables-xml.c differed slightly. For now, collect all features together. Maybe it would make sense to migrate iptables-xml.c to using add_param_to_argv() at some point and therefore extend the latter to store whether a given parameter was quoted or not. While being at it, a few improvements were done: * free_argv() now also resets 'newargc' variable, so users don't have to do that anymore. * Indenting level in add_param_to_argv() was reduced a bit. * That long error message is put into a single line to aid in grepping for it. * Explicit call to exit() after xtables_error() is removed since the latter does not return anyway. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Consolidate parse_counters()Phil Sutter2018-08-046-49/+15
| | | | | | | | | Move this helper function into xshared. While being at it, drop the need for temporary variables and take over null pointer tolerance from the implementation in iptables-xml.c. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Consolidate DEBUGP macrosPhil Sutter2018-08-048-38/+10
| | | | | | | | | | | | | | | | | | This debug printing macro was defined in various places, always identical. Move it into xshared.h and drop it from sources including that header. There are a few exceptions: * iptables-xml.c did not include xshared.h, which this patch changes. * Sources in extensions and libiptc mostly left alone since they don't include xshared.h (and maybe shouldn't). Only libxt_set.h does, so it's converted, too. This also converts DEBUG define use in libip6t_hbh.c to avoid a compiler warning. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix program name in xtables_error()Phil Sutter2018-08-041-3/+3
| | | | | | | | The error function is shared among different programs, so it should take information from xt_params pointer instead of xtables_globals object. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Use correct built-in chain countPhil Sutter2018-08-041-1/+1
| | | | | | | | | | In nft_chain_builtin_init(), The wrong macro was used for iterating over the built-in chains of a given table. That array's length is defined using NF_INET_NUMHOOKS, not NF_IP_NUMHOOKS. Though this change is rather cosmetic since both macros resolve into the same value. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix compilation with NLDEBUG definedPhil Sutter2018-08-041-2/+2
| | | | | | | | | In libnftnl-1.0.5, symbol name prefix changed from 'nft_' to 'nftnl_'. This patch fixes for two places forgotten by the relevant commit. Fixes: 742baabd185c3 ("iptables-compat: use new symbols in libnftnl") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Free chains in NFT_COMPAT_CHAIN_ADD jobsPhil Sutter2018-08-041-2/+6
| | | | | | | | | | | | | | Chains in NFT_COMPAT_CHAIN_ADD usually have to be freed because they are not added to the cache. There is one exception though, namely when zeroing counters: nft_chain_zero_counters() adds a chain object it took from chain cache. To distinguish this situation from the others, introduce NFT_COMPAT_CHAIN_ZERO batch object type, which is treated just like NFT_COMPAT_CHAIN_ADD but batch_obj_del() does not free it's chain. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Free chains in NFT_COMPAT_CHAIN_USER_DEL jobsPhil Sutter2018-08-041-1/+1
| | | | | | | | These always have to be freed because nft_chain_user_del() removes them from the cache so they are not freed when the chain cache is flushed. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for nft_rule_flush() returning garbagePhil Sutter2018-08-041-3/+5
| | | | | | | | | | | | | | Due to variable 'ret' not being initialized in all situations, return code of the function depends on garbage in stack. Fix this by initializing 'ret' to zero upon declaration. While being at it, make nftnl_chain_list_get() failure as well as nftnl_chain_list_iter_create() failure an error condition since both functions should succeed even if the current ruleset does not contain any chains at all. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Allocate rule cache just oncePhil Sutter2018-08-041-3/+5
| | | | | | | | | | For each parsed table, xtables-restore calls nft_table_flush() which each time allocates a new rule cache, possibly overwriting the pointer to the previously allocated one. Fix this by checking the pointer value and only allocate if it's NULL. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: don't print rule counters unless verboseEric Garver2018-08-012-1/+31
| | | | | | | | | | | Currently rule counters are always printed, but that's not the desired behavior. We should only print them with the verbose flag. This broke when the arguments of nft_rule_print_save() were changed to accept the format instead of a counters flag. Fixes: cdc78b1d6bd7 ("nft: convert rule into a command state structure") Signed-off-by: Eric Garver <e@erig.me> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-restore: free the table lock when skipping a tableJoel Goguen2018-07-265-2/+113
| | | | | | | | | | | | | | | | | | | Currently, when running `iptables-restore --table=X`, where `X` is not the first table in the rules dump, the restore will fail when parsing the second table: - a lock is acquird when parsing the first table name - the table name does not match the parameter to `--table` so processing continues until the next table - when processing the next table a lock is acquired, which fails because a lock is already held Another app is currently holding the xtables lock. Perhaps you want to use the -w option? This will release the lock as soon as it's decided the current table won't be used. Signed-off-by: Joel Goguen <contact+netfilter@jgoguen.ca> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: avoid bogus 'is incompatible' warningFlorian Westphal2018-07-242-1/+27
| | | | | | | | | | | | | | | | | | | | | | when using custom nft tables + iptables-nft, iptables-nft -L may fail with iptables v1.8.0 (nf_tables): table `filter' is incompatible, use 'nft' tool. even if filter table is compatible. Problem is that the chain cache tracks ALL chains. The "old" compat-check only walked chains in the table to checked (filter in this case), now we will see all other chains including base chains of another table. It seems better to extend the chain cache long-term to track chains per table instead, but for now skip the foreign ones. Reported-by: Eric Garver <e@erig.me> Fixes: 01e25e264a4c4 ("xtables: add chain cache") Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: decode meta l4protoFlorian Westphal2018-07-212-0/+20
| | | | | | | Allow to show '-p tcp' in case rule was added by nft (which prefers use of meta l4proto). Signed-off-by: Florian Westphal <fw@strlen.de>