summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* iptables-translate: print nft iff there are more expanded rules to printPablo Neira Ayuso2017-03-091-1/+1
| | | | | | | | | | | | | | | $ iptables-translate -I INPUT -s yahoo.com nft insert rule ip filter INPUT ip saddr 98.139.183.24 counter nft insert rule ip filter INPUT ip saddr 206.190.36.45 counter nft insert rule ip filter INPUT ip saddr 98.138.253.109 counter nft This extra 'nft' print is incorrect, just print it if there are more rules to be printed. Reported-by: Alexander Alemayhu <alexander@alemayhu.com> Tested-by: Alexander Alemayhu <alexander@alemayhu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: abolish AI_CANONNAMEJan Engelhardt2017-03-081-2/+0
| | | | | | | | ares->ai_canonname is never used, so there is no point in requesting that piece of information with AI_CANONNAME. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: remove unnecessary nesting from host_to_ip(6)addrJan Engelhardt2017-03-081-30/+24
| | | | | | | | The error path already terminally returns from the function, so there is no point in having an explicit else block. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: print nft command for each expand rules via dns namesPablo Neira Ayuso2017-03-081-0/+2
| | | | | | | | | | | | | | | | | | | | We have to print nft at the very beginning for each rule that rules from the expansion, otherwise the output is not correct: # iptables-translate -I INPUT -s yahoo.com nft insert rule ip filter INPUT ip saddr 206.190.36.45 counter insert rule ip filter INPUT ip saddr 98.138.253.109 counter insert rule ip filter INPUT ip saddr 98.139.183.24 counter After this patch: # iptables-translate -I INPUT -s yahoo.com nft insert rule ip filter INPUT ip saddr 206.190.36.45 counter nft insert rule ip filter INPUT ip saddr 98.138.253.109 counter nft insert rule ip filter INPUT ip saddr 98.139.183.24 counter Reported-by: Alexander Alemayhu <alexander@alemayhu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate: Avoid querying the kernelPhil Sutter2017-03-081-0/+10
| | | | | | | | | | | | | | | This originally came up when accidentally calling iptables-translate as unprivileged user - nft_compatible_revision() then fails every time, making the translator fall back to using revision 0 only which often leads to failed translations (due to missing xlate callback). The bottom line is there is no need to check what revision of a given iptables match the kernel supports when it is only to be translated into an nftables equivalent. So just assign a dummy callback returning good for any revision being asked for. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_addrtype: Add translation to nftPhil Sutter2017-03-081-0/+69
| | | | | | | | | | | | | | | | | | | Translate addrtype match into fib expression: $ iptables-translate -A INPUT -m addrtype --src-type LOCAL nft add rule ip filter INPUT fib saddr type local counter $ iptables-translate -A INPUT -m addrtype --dst-type LOCAL nft add rule ip filter INPUT fib daddr type local counter $ iptables-translate -A INPUT -m addrtype ! --dst-type ANYCAST,LOCAL nft add rule ip filter INPUT fib daddr type != { local, anycast } counter $ iptables-translate -A INPUT -m addrtype --limit-iface-in --dst-type ANYCAST,LOCAL nft add rule ip filter INPUT fib daddr . iif type { local, anycast } counter Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: nfsynproxy: fix build with musl libcBaruch Siach2017-03-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | The musl libc exposes some struct tcphdr field only when _GNU_SOURCE is defined. Fix the following build failure: nfsynproxy.c: In function ‘parse_packet’: nfsynproxy.c:34:9: error: ‘const struct tcphdr’ has no member named ‘syn’ if (!th->syn || !th->ack) ^ nfsynproxy.c:34:21: error: ‘const struct tcphdr’ has no member named ‘ack’ if (!th->syn || !th->ack) ^ nfsynproxy.c:42:8: error: ‘const struct tcphdr’ has no member named ‘res2’ if (th->res2 == 0x1) ^ nfsynproxy.c:45:13: error: ‘const struct tcphdr’ has no member named ‘doff’ length = th->doff * 4 - sizeof(*th); ^ Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libiptc: don't set_changed() when checking rules with module jumpsDan Williams2017-02-281-6/+8
| | | | | | | | | | | | | | | Checking a rule that includes a jump to a module-based target currently sets the "changed" flag on the handle, which then causes TC_COMMIT() to run through the whole SO_SET_REPLACE/SO_SET_ADD_COUNTERS path. This seems wrong for simply checking rules, an operation which is documented as "...does not alter the existing iptables configuration..." but yet it clearly could do so. Fix that by ensuring that rule check operations for module targets don't set the changed flag, and thus exit early from TC_COMMIT(). Signed-off-by: Dan Williams <dcbw@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_hashlimit: Add translation to nftElise Lennion2017-02-281-0/+224
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hashlimit has similar functionality to flow tables in nftables. Some usage examples are: $ iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit \ --hashlimit-above 20kb/s --hashlimit-burst 1mb --hashlimit-mode dstip \ --hashlimit-name https --hashlimit-dstmask 24 -m state --state NEW \ -j DROP nft add rule ip filter OUTPUT tcp dport 443 flow table https { ip \ daddr and 255.255.255.0 timeout 60s limit rate over 20 kbytes/second \ burst 1 mbytes} ct state new counter drop $ iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit \ --hashlimit-upto 300 --hashlimit-burst 15 --hashlimit-mode \ srcip,dstip --hashlimit-name https --hashlimit-htable-expire 300000 \ -m state --state NEW -j DROP nft add rule ip filter OUTPUT tcp dport 443 flow table https { ip \ daddr . ip saddr timeout 300s limit rate 300/second burst 15 packets} \ ct state new counter drop The translation isn't supported when --hashlimit-mode isn't specified. Also, the following options don't apply to flow tables: --hashlimit-htable-size --hashlimit-htable-max --hashlimit-htable-gcinterval Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xshared: using the blocking file lock request when we wait indefinitelyLiping Zhang2017-02-281-11/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When using "-w" to avoid concurrent instances, we try to do flock() every one second until it success. But one second maybe too long in some situations, and it's hard to select a suitable interval time. So when using "iptables -w" to wait indefinitely, it's better to block until it become success. Now do some performance tests. First, flush all the iptables rules in filter table, and run "iptables -w -S" endlessly: # iptables -F # iptables -X # while : ; do iptables -w -S >&- & done Second, after adding and deleting the iptables rules 100 times, measure the time cost: # time for i in $(seq 100); do iptables -w -A INPUT iptables -w -D INPUT done Before this patch: real 1m15.962s user 0m0.224s sys 0m1.475s Apply this patch: real 0m1.830s user 0m0.168s sys 0m1.130s Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xshared: do not lock again and again if "-w" option is not specifiedLiping Zhang2017-02-281-7/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | After running the following commands, some confusing messages was printed out: # while : ; do iptables -A INPUT & iptables -D INPUT & done [...] Another app is currently holding the xtables lock; still -9s 0us time ahead to have a chance to grab the lock... Another app is currently holding the xtables lock; still -29s 0us time ahead to have a chance to grab the lock... If "-w" option is not specified, the "wait" will be zero, so we should check whether the timer_left is less than wait_interval before we call select to sleep. Also remove unused "BASE_MICROSECONDS" and "struct timeval waited_time" introduced by commit e8f857a5a151 ("xtables: Add an interval option for xtables lock wait"). Fixes: e8f857a5a151 ("xtables: Add an interval option for xtables lock wait") Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxt_hashlimit: add new unit test to catch kernel bugPablo Neira Ayuso2017-02-211-0/+1
| | | | | | | | | | | | commit ad5b55761956427f61ed9c96961bf9c5cd4f92dc Author: Alban Browaeys <alban.browaeys@gmail.com> Date: Mon Feb 6 23:50:33 2017 +0100 netfilter: xt_hashlimit: Fix integer divide round to zero. http://patchwork.ozlabs.org/patch/724800/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: update pf.osXose Vazquez Perez2017-02-011-1/+4
| | | | | | | | | | Sync with latest OpenBSD release. Changelog: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: netfilter-devel <netfilter-devel@vger.kernel.org> Signed-off-by: Xose Vazquez Perez <xose.vazquez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: fix the wrong appending of jump verdict after the comment.v1.6.1Shyam Saini2017-01-262-6/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix wrong appending of jump verdict after the comment For example: $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar" nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT Note that even without comment with double-quotes (i.e. --comment "foobar"), it will add quotes: $ iptables-translate -A FORWARD -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j DROP -m comment --comment singlecomment nft add rule ip filter FORWARD ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"singlecomment\"drop Attempting to apply the translated/generated rule will result to: $ nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment \"foobar\"jump LONGNACCEPT <cmdline>:1:111-114: Error: syntax error, unexpected jump, expecting endof file or newline or semicolon add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter comment "foobar"jump LONGNACCEPT After this patch $ iptables-translate -A INPUT -p tcp -m tcp --sport http -s 192.168.0.0/16 -d 192.168.0.0/16 -j LONGNACCEPT -m comment --comment "foobar" nft add rule ip filter INPUT ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 tcp sport 80 counter jump LONGNACCEPT comment \"foobar\" which is correct translation Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Reviewed-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-save: exit with error if unable to open proc fileThomas Habets2017-01-182-8/+20
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libxt_rpfilter: add translation to nftLiping Zhang2017-01-161-0/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For example: # iptables-translate -t mangle -A PREROUTING -m rpfilter nft add rule ip mangle PREROUTING fib saddr . iif oif != 0 counter # iptables-translate -t mangle -A PREROUTING -m rpfilter --validmark \ --loose nft add rule ip mangle PREROUTING fib saddr . mark oif != 0 counter # ip6tables-translate -t mangle -A PREROUTING -m rpfilter --validmark \ --invert nft add rule ip6 mangle PREROUTING fib saddr . mark . iif oif 0 counter Finally, when the "--accept-local" option is specified, we can combine with "fib saddr type" to simulate it. But when it is used like this: "-m rpfilter --accept-local", it means "||" relationship, so we cannot translate it to one single nft rule, translation is not supported yet: # iptables-translate -t mangle -A PREROUTING -m rpfilter --accept-local nft # -t mangle -A PREROUTING -m rpfilter --accept-local When "--accpet-local" is combined with "--invert", it means "&&" relationship, so translation can be: # iptables-translate -t mangle -A PREROUTING -m rpfilter \ --accept-local --invert nft add rule ip mangle PREROUTING fib saddr type != local fib saddr \ . iif oif 0 counter Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_connbytes: Add translation to nftLiping Zhang2017-01-161-0/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | For example: # iptables-translate -A OUTPUT -m connbytes --connbytes 200 \ --connbytes-dir original --connbytes-mode packets nft add rule ip filter OUTPUT ct original packets ge 200 counter # iptables-translate -A OUTPUT -m connbytes ! --connbytes 200 \ --connbytes-dir reply --connbytes-mode packets nft add rule ip filter OUTPUT ct reply packets lt 200 counter # iptables-translate -A OUTPUT -m connbytes --connbytes 200:600 \ --connbytes-dir both --connbytes-mode bytes nft add rule ip filter OUTPUT ct bytes 200-600 counter # iptables-translate -A OUTPUT -m connbytes ! --connbytes 200:600 \ --connbytes-dir both --connbytes-mode bytes nft add rule ip filter OUTPUT ct bytes != 200-600 counter # iptables-translate -A OUTPUT -m connbytes --connbytes 200:200 \ --connbytes-dir both --connbytes-mode avgpkt nft add rule ip filter OUTPUT ct avgpkt 200 counter Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables 1.6.1 releasePablo Neira Ayuso2017-01-161-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: Fix two compile errors during out-of-tree buildKeno Fischer2017-01-162-2/+2
| | | | | | | | | | | | | | | | | | | | The first: ``` iptables/extensions/libebt_limit.c:21:26: fatal error: iptables/nft.h: No such file or directory #include "iptables/nft.h" ``` The second: ``` /data/keno/sandbox/iptables/iptables/xtables-config-parser.y:19:32: fatal error: libiptc/linux_list.h: No such file or directory #include <libiptc/linux_list.h> ^ ``` Simply fixed by adding the relevant `-I` directives. Signed-off-by: Keno Fischer <keno@juliacomputing.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: xtables: Use getnameinfo()Shyam Saini2016-12-201-4/+11
| | | | | | | | | Replace gethostbyaddr() with getnameinfo() as getnameinfo() deprecates the former and allows programs to eliminate IPv4-versus-IPv6 dependencies Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: xtables: remove unnecessary debug codeShyam Saini2016-12-201-26/+3
| | | | | | | Remove unnecessary debug code Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: on revision mismatch, do not call print/saveWillem de Bruijn2016-12-112-8/+28
| | | | | | | | Between revisions, the layout of xtables data may change completely. Do not interpret the data in a revision M with a module of revision N. Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_bpf: support ebpf pinned objectsWillem de Bruijn2016-12-104-50/+216
| | | | | | | | | | | | | | | Exercise the new kernel feature introduced in commit 2c16d6033264 ("netfilter: xt_bpf: support ebpf") to load pinned eBPF programs. The new interface allows instantiating a bpf match using -m bpf --object-pinned ${PATH} where ${PATH} points to a node in a bpf virtual filesystem. See also the revised man page. Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: LOG: add log flags translation to nftLiping Zhang2016-11-292-8/+52
| | | | | | | | | | | | | | | | | | | | | | | For example: # iptables-translate -A OUTPUT -j LOG --log-uid nft add rule ip filter OUTPUT counter log flags skuid # iptables-translate -A OUTPUT -j LOG --log-tcp-sequence \ --log-tcp-options nft add rule ip filter OUTPUT counter log flags tcp sequence,options # iptables-translate -A OUTPUT -j LOG --log-level debug --log-uid nft add rule ip filter OUTPUT counter log level debug flags skuid # ip6tables-translate -A OUTPUT -j LOG --log-ip-options --log-macdecode nft add rule ip6 filter OUTPUT counter log flags ip options flags ether # ip6tables-translate -A OUTPUT -j LOG --log-ip-options --log-uid \ --log-tcp-sequence --log-tcp-options --log-macdecode nft add rule ip6 filter OUTPUT counter log flags all Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tcp_xlate: Enclose LH flag values in parenthesesPhil Sutter2016-11-291-2/+2
| | | | | | | | | | | | | | This fixes TCP flags matches: | $ iptables-translate -A invalid -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP | nft add rule ip filter invalid tcp flags & fin|syn == fin|syn counter drop Although the generated rule is syntactically correct and accepted by nft, it will be interpreted in a different way than expected since binary AND takes precedence over OR. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate: Fix chain type when translating nat tablePhil Sutter2016-11-291-6/+12
| | | | | | | | | | | | | | | | | | | | | | | This makes the type of translated chains in nat table to be of type 'nat' instead of 'filter' which is incorrect. Verified like so: | $ iptables-restore-translate -f /dev/stdin <<EOF | *nat | :POSTROUTING ACCEPT [0:0] | [0:0] -A POSTROUTING -j MASQUERADE | COMMIT | EOF | # Translated by ./install/sbin/iptables-restore-translate v1.6.0 on Mon Nov 28 12:11:30 2016 | add table ip nat | add chain ip nat POSTROUTING { type nat hook postrouting priority 0; policy accept; } | add rule ip nat POSTROUTING counter masquerade Ditto for ip6tables-restore-translate. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft_ipv{4,6}_xlate: Respect prefix lengthsPhil Sutter2016-11-292-7/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This was an annoying bug in the translator since it silently dropped crucial information which is easily overlooked: | $ iptables-translate -A INPUT -s 192.168.0.0/24 -j ACCEPT | nft add rule ip filter INPUT ip saddr 192.168.0.0 counter accept | $ ip6tables-translate -A INPUT -s feed:babe::/64 -j ACCEPT | nft add rule ip6 filter INPUT ip6 saddr feed:babe:: counter accept To my surprise, this fix works really well in all kinds of situations: | $ iptables-translate -A INPUT -s 1.2.3.4/0 -j ACCEPT | nft add rule ip filter INPUT counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/23 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.2.0/23 counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/24 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.3.0/24 counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/32 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.3.4 counter accept | | $ iptables-translate -A INPUT -s 1.2.3.4/255.255.0.0 -j ACCEPT | nft add rule ip filter INPUT ip saddr 1.2.0.0/16 counter accept Ditto for IPv6. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate: Support setting standard chain policyPhil Sutter2016-11-291-5/+11
| | | | | | | | | Looks like this bit was simply forgotten when implementing xlate_chain_set() as everything needed was there to just print the desired policy along with the chain definition. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_ah: Fix translation of plain '-m ah'Phil Sutter2016-11-291-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | This is actually a limitation of ip6tables: | # ip6tables -A INPUT -p ah -j ACCEPT | Warning: never matched protocol: ah. use extension match instead. The working alternative is like so: | # ip6tables -A INPUT -m ah -j ACCEPT But upon translating, this statement gets ignored: | $ ip6tables-translate -A INPUT -m ah -j ACCEPT | nft add rule ip6 filter INPUT counter accept This patch (ab)uses the 'space' variable to check if a parameter to the 'ah' match was present and if not translates the match into an extension header check: | $ ip6tables-translate -A INPUT -m ah -j ACCEPT | add rule ip6 filter INPUT meta l4proto ah counter accept Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxt_multiport: remove an unused variableGeorge Burgess IV2016-11-231-2/+0
| | | | | | | | | Clang's static analyzer flagged the shift this patch removes as shifting a garbage value. Looks like `m` isn't used at all anyway, so we can simply remove it. Signed-off-by: George Burgess IV <gbiv@google.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* configure: update libnetfilter_conntrack version dependencyPablo Neira Ayuso2016-11-101-1/+1
| | | | | | | nfct_labels_get_path() requires libnetfilter_conntrack-1.0.6, update this dependency. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: update Arturo Borrero email addressArturo Borrero Gonzalez2016-11-107-7/+7
| | | | | | | The email address has changed, let's update it. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_mangle: Use getaddrinfo()Shivani Bhardwaj2016-11-101-10/+18
| | | | | | | | | Replace gethostbyname() with getaddrinfo() as getaddrinfo() deprecates the former and allows programs to eliminate IPv4-versus-IPv6 dependencies. Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: xtables-arp: Use getaddrinfo()Shivani Bhardwaj2016-11-101-10/+18
| | | | | | | | | Replace gethostbyname() with getaddrinfo() as getaddrinfo() deprecates the former and allows programs to eliminate IPv4-versus-IPv6 dependencies. Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* connlabel: clarify default config pathFlorian Westphal2016-10-181-2/+5
| | | | | | | | | Pablo suggested to print full config file path for connlabel.conf parsing errors. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_statistic: add translation to nftLiping Zhang2016-10-141-0/+21
| | | | | | | | | | | | | | | | | | | For example: # iptables-translate -A OUTPUT -m statistic --mode nth --every 10 \ --packet 1 nft add rule ip filter OUTPUT numgen inc mod 10 1 counter # iptables-translate -A OUTPUT -m statistic --mode nth ! --every 10 \ --packet 5 nft add rule ip filter OUTPUT numgen inc mod 10 != 5 counter Note, mode random is not completely supported in nft, so: # iptables-translate -A OUTPUT -m statistic --mode random \ --probability 0.1 nft # -A OUTPUT -m statistic --mode random --probability 0.1 Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_DSCP: add translation to nftLiping Zhang2016-10-141-13/+51
| | | | | | | | | | | | For example: # iptables-translate -A OUTPUT -j DSCP --set-dscp 1 nft add rule ip filter OUTPUT counter ip dscp set 0x01 # ip6tables-translate -A OUTPUT -j DSCP --set-dscp 6 nft add rule ip6 filter OUTPUT counter ip6 dscp set 0x06 Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_quota: add translation to nftLiping Zhang2016-10-141-0/+12
| | | | | | | | | | | | For example: # iptables-translate -A OUTPUT -m quota --quota 111 nft add rule ip filter OUTPUT quota 111 bytes counter # iptables-translate -A OUTPUT -m quota ! --quota 111 nft add rule ip filter OUTPUT quota over 111 bytes counter Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_ipcomp: add range support in translationLiping Zhang2016-10-141-3/+7
| | | | | | | | | | | | | | | | | | | When translate to nft rules, ipcompspi range is not supported, so: # iptables-translate -A OUTPUT -m ipcomp --ipcompspi 1:2 nft add rule ip filter OUTPUT comp cpi 1 counter # iptables-translate -A OUTPUT -m ipcomp ! --ipcompspi 3:30 nft add rule ip filter OUTPUT comp cpi != 3 counter Apply this patch: # iptables-translate -A OUTPUT -m ipcomp --ipcompspi 1:2 nft add rule ip filter OUTPUT comp cpi 1-2 counter # iptables-translate -A OUTPUT -m ipcomp ! --ipcompspi 3:30 nft add rule ip filter OUTPUT comp cpi != 3-30 counter Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_devgroup: handle the invert flag properly in translationLiping Zhang2016-10-141-2/+3
| | | | | | | | | | | | | | We forgot to put "!=" when devgroup can be mapped to name, so translation is wrong: # iptables-translate -A OUTPUT -m devgroup ! --dst-group 0 nft add rule ip filter OUTPUT oifgroup default counter Apply this patch: # iptables-translate -A OUTPUT -m devgroup ! --dst-group 0 nft add rule ip filter OUTPUT oifgroup != default counter Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_iprange: handle the invert flag properly in translationLiping Zhang2016-10-141-32/+20
| | | | | | | | | | | | | | | | | | | | If we specify the invert flag, we should put "!=" after "ip saddr/daddr", so the current translation is wrong: # iptables-translate -A OUTPUT -m iprange ! --dst-range 1.1.1.1-1.1.1.2 nft add rule ip filter OUTPUT != ip daddr 1.1.1.1-1.1.1.2 counter # ip6tables-translate -A OUTPUT -m iprange ! --src-range 2003::1-2003::3 nft add rule ip6 filter OUTPUT != ip6 saddr 2003::1-2003::3 counter Apply this patch: # iptables-translate -A OUTPUT -m iprange ! --dst-range 1.1.1.1-1.1.1.2 nft add rule ip filter OUTPUT ip daddr != 1.1.1.1-1.1.1.2 counter # ip6tables-translate -A OUTPUT -m iprange ! --src-range 2003::1-2003::3 nft add rule ip6 filter OUTPUT ip6 saddr != 2003::1-2003::3 counter Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_iprange: rename "ip saddr" to "ip6 saddr" in ip6tables-xlateLiping Zhang2016-10-141-2/+2
| | | | | | | | | | | | | | | nft will complain the syntax error if we use "ip saddr" or "ip daddr" in ip6 family, so the current translation is wrong: # ip6tables-translate -A OUTPUT -m iprange --src-range 2003::1-2003::3 nft add rule ip6 filter OUTPUT ip saddr 2003::1-2003::3 counter ^^ Apply this patch: # ip6tables-translate -A OUTPUT -m iprange --src-range 2003::1-2003::3 nft add rule ip6 filter OUTPUT ip6 saddr 2003::1-2003::3 counter Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_realm: add a missing space in translationLiping Zhang2016-10-141-1/+1
| | | | | | | | | | | | | | | We missed a blank space when do translate to nft, so if rt_realm can be mapped to name, the result looks ugly: # iptables-translate -A OUTPUT -m realm --realm 0 nft add rule ip filter OUTPUT rtclassidcosmos counter ^ Apply this patch: # iptables-translate -A OUTPUT -m realm --realm 0 nft add rule ip filter OUTPUT rtclassid cosmos counter Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_hashlimit: Create revision 2 of xt_hashlimit to support ↵Vishwanath Pai2016-10-043-91/+394
| | | | | | | | | | | | | | | | higher pps rates Create a new revision for the hashlimit iptables extension module. Rev 2 will support higher pps of upto 1 million, Version 1 supports only 10k. To support this we have to increase the size of the variables avg and burst in hashlimit_cfg to 64-bit. Create two new structs hashlimit_cfg2 and xt_hashlimit_mtinfo2 and also create newer versions of all the functions for match, checkentry and destory. Signed-off-by: Vishwanath Pai <vpai@akamai.com> Signed-off-by: Joshua Hunt <johunt@akamai.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_hashlimit: Prepare libxt_hashlimit.c for revision 2Vishwanath Pai2016-10-041-39/+39
| | | | | | | | | | | I am planning to add a revision 2 for the hashlimit xtables module to support higher packets per second rates. This patch renames all the functions and variables related to revision 1 by adding _v1 at the end of the names. Signed-off-by: Vishwanath Pai <vpai@akamai.com> Signed-off-by: Joshua Hunt <johunt@akamai.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_SNAT/DNAT: add square bracket in xlat output when port ↵Liping Zhang2016-09-052-14/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | is specified It is better to add square brackets to ip6 address in nft translation output when the port is specified. This is keep consistent with the nft syntax. Before this patch: # ip6tables-translate -t nat -A OUTPUT -p tcp -j DNAT --to-destination \ [123::4]:1 nft add rule ip6 nat OUTPUT meta l4proto tcp counter dnat to 123::4 :1 # ip6tables-translate -t nat -A POSTROUTING -p tcp -j SNAT --to-source \ [123::4-123::8]:1 nft add rule ip6 nat POSTROUTING meta l4proto tcp counter snat to 123::4-123::8 :1 Apply this patch: # ip6tables-translate -t nat -A OUTPUT -p tcp -j DNAT --to-destination \ [123::4]:1 nft add rule ip6 nat OUTPUT meta l4proto tcp counter dnat to [123::4]:1 # ip6tables-translate -t nat -A POSTROUTING -p tcp -j SNAT --to-source \ [123::4-123::8]:1 nft add rule ip6 nat POSTROUTING meta l4proto tcp counter snat to [123::4]-[123::8]:1 Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate-restore: do not escape quotesPablo M. Bermudo Garay2016-09-052-2/+5
| | | | | | | | If quotes are escaped, nft -f is unable to parse and load the translated ruleset. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: add rule cachePablo M. Bermudo Garay2016-08-302-12/+25
| | | | | | | | | | | | | | This patch adds a cache of rules within the nft handle. This feature is useful since the whole ruleset was brought from the kernel for every chain during listing operations. In addition with the new checks of ruleset compatibility, the rule list is loaded one more time. Now all the operations causing changes in the ruleset must invalidate the cache, a function called flush_rule_cache has been introduced for this purpose. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip[6]t_REDIRECT: use new nft syntax when do xlateLiping Zhang2016-08-302-2/+2
| | | | | | | | | | | | | | | | | After commit "parser_bison: redirect to :port for consistency with nat/masq statement" in nftables tree, we should recommend the end user to use the new syntax. Before this patch: # iptables-translate -t nat -A PREROUTING -p tcp -j REDIRECT --to-ports 1 nft add rule ip nat PREROUTING ip protocol tcp counter redirect to 1 Apply this patch: # iptables-translate -t nat -A PREROUTING -p tcp -j REDIRECT --to-ports 1 nft add rule ip nat PREROUTING ip protocol tcp counter redirect to :1 Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip[6]t_SNAT/DNAT: use the new nft syntax when do xlateLiping Zhang2016-08-304-4/+4
| | | | | | | | | | | | | | | | | | | | | | After commit "src: add 'to' for snat and dnat" in nftables tree, we should recommend the end user to use the new syntax. Before this patch: # iptables-translate -t nat -A POSTROUTING -j SNAT --to-source 1.1.1.1 nft add rule ip nat POSTROUTING counter snat 1.1.1.1 # ip6tables-translate -t nat -A PREROUTING -j DNAT --to-destination 2001::1 nft add rule ip6 nat PREROUTING counter dnat 2001::1 Apply this patch: # iptables-translate -t nat -A POSTROUTING -j SNAT --to-source 1.1.1.1 nft add rule ip nat POSTROUTING counter snat to 1.1.1.1 # ip6tables-translate -t nat -A PREROUTING -j DNAT --to-destination 2001::1 nft add rule ip6 nat PREROUTING counter dnat to 2001::1 Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>