summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* xshared: Perform protocol value parsing in callbackPhil Sutter2023-12-052-9/+14
| | | | | | | | The code is same in iptables and ip6tables, but different in ebtables. Therefore move it into the callback to keep that part of do_parse() generic. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: do_parse: Skip option checking for CMD_DELETE_NUMPhil Sutter2023-12-051-1/+0
| | | | | | | This command will delete a rule by its number, not rule spec. No -i/-o options are expected on commandline. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Fix for non-CIDR-compatible hostmasksPhil Sutter2023-11-291-0/+5
| | | | | | | | | | | | | | | | | | | In order to parse the mask, xtopt_parse_hostmask() calls xtopt_parse_plenmask() thereby limiting netmask support to prefix lengths (alternatively specified in IP address notation). In order to lift this impractical restriction, make xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may fall back to xtopt_parse_mask() which correctly initializes val.hmask itself and indicates non-CIDR-compatible masks by setting val.hlen to -1. So in order to support these odd masks, it is sufficient for xtopt_parse_plenmask() to skip its mask building from val.hlen value and take whatever val.hmask contains. Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Fix for garbage access in xtables_options_xfrm()Phil Sutter2023-11-291-1/+2
| | | | | | | | | | Allocation of the temporary array did not account for a terminating NULL entry, causing array boundary overstepping in the called xtables_merge_options(), causing spurious errors in extension parameter parsing. Fixes: ed8c3ea4015f0 ("libxtables: Combine the two extension option mergers") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: Do not escape exclamation marksPhil Sutter2023-11-292-2/+2
| | | | | | | | | | This appears to be not necessary, also mandoc complains about it: | mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \! Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage") Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Leave interface masks alone when parsing from kernelPhil Sutter2023-11-296-36/+16
| | | | | | | | The mask is entirely unused by nft-variants in general and legacy ones when printing. It is relevant only when inserting a legacy rule into kernel as it doesn't detect the '+'-suffix. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Do not populate interface masks per defaultPhil Sutter2023-11-294-11/+48
| | | | | | | | | These are needed by legacy variants only, so introduce a simplified xtables_parse_interface() replacement which does not deal with them and a small function which sets the mask based on given interface name for use by legacy tools. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Entirely ignore interface masks when saving rulesPhil Sutter2023-11-296-38/+12
| | | | | | | Rule printing code does this for more than 20 years now, assume it's safe to rely upon the wildcard interface name to contain a '+' suffix. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Simplify generic_opt_check()Phil Sutter2023-11-291-49/+28
| | | | | | | | | | The option/command matrix does not contain any '+' entries anymore, so each option/command combination is either allowed (and optional) or not. Reduce the matrix to an array of unsigned ints which specify the commands a given option is allowed with. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce xt_cmd_parse_ops::option_invertPhil Sutter2023-11-297-24/+34
| | | | | | | | | Replace the awkward inverse_for_options array with basically a few switch() statements clearly identifying the relation between option and inverse values and relieve callers from having to find the option flag bit's position. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce xt_cmd_parse_ops::option_namePhil Sutter2023-11-297-66/+100
| | | | | | | | | | | | The old opt2char() function was flawed: Since not every field in optflags contains a printable character, typical use of its return value in print statements could lead to garbage on screen. Replace this by a mechanism to retrieve an option's long name which supports family-specific overrides. and get rid of optflags field altogether and define NUMBER_OF_OPT similar to NUMBER_OF_CMD. Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: proper roff encoding for ~ and ^Jan Engelhardt2023-11-275-20/+20
| | | | | | Fixes: v1.8.10-28-g4b0c168a Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: MARK: arptables: Use guided option parserPhil Sutter2023-11-231-67/+15
| | | | | | | | | | | It expects mark values in hex which is possible by setting the base field. The only adjustment needed to use the revision 2 parser is to fill the mask for --set-mark: With XTTYPE_MARKMASK32, an omitted mask sets all mask bits, XTTYPE_UINT32 leaves it uninitialized, though. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libarpt_mangle: Use guided option parserPhil Sutter2023-11-232-84/+48
| | | | | | | | | | | | | Sadly not the best conversion, struct arpt_mangle is not ideal for use as storage backend: With MAC addresses, xtopt_parse_ethermac() refuses to write into *_devaddr fields as they are larger than expected. With XTTYPE_HOSTMASK OTOH, XTOPT_PUT is not supported in the first place. As a side-effect, network names (from /etc/networks) are no longer accepted. But earlier migrations to guided option parser had this side-effect as well, so probably not a frequently used feature. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce struct xt_option_entry::basePhil Sutter2023-11-232-2/+4
| | | | | | | Enable guided option parser users to parse integer values with a fixed base. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce xtables_strtoul_base()Phil Sutter2023-11-232-5/+13
| | | | | | | | Semantically identical to xtables_strtoul() but accepts the base as parameter so callers may force it irrespective of number prefix. The old xtables_strtoul() becomes a shallow wrapper. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Fix guided option parser for use with arptablesPhil Sutter2023-11-231-5/+18
| | | | | | | | With an unexpected value in afinfo->family, guided option parser was rather useless when called from arptables extensions. Introduce afinfo_family() wrapper to sanitize at least NFPROTO_ARP value. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Combine the two extension option mergersPhil Sutter2023-11-231-43/+8
| | | | | | | | | | For extending the command parser's struct option array, there is xtables_merge_options() and xtables_options_xfrm(). Since their bodies were almost identical, make the latter a wrapper of the former by transforming the passed struct xt_option_entry array into a temporary struct option one before handing over. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Implement --change-counters commandPhil Sutter2023-11-236-20/+197
| | | | | | | | Treat it like --replace against the same rule with changed counters. The operation is obviously not atomic, so rule counters may change in kernel while the rule is fetched, modified and replaced. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: do_parse: Ignore '-j CONTINUE'Phil Sutter2023-11-231-1/+2
| | | | | | | | | | | While iptables does not support his NOP, arptables man page claims it does (although legacy arptables rejects it) and ebtables prefers to print it instead of omitting the '-j' option. Accept and ignore the target when parsing to at least fix for arptables-nft and prepare for ebtables-nft using do_parse() as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Align line number formatting with legacyPhil Sutter2023-11-231-1/+1
| | | | | | | | Legacy ebtables appends a dot to the number printed in first column if --Ln flag was given. Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Make ebt_load_match_extensions() staticPhil Sutter2023-11-232-2/+1
| | | | | | The function is not used outside of xtables-eb.c. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Drop append_entry() wrapperPhil Sutter2023-11-231-22/+4
| | | | | | There is no point in having it when there is no code to share. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate: Print failing command linePhil Sutter2023-11-231-2/+3
| | | | | | | | If the command segfaults, 'error' variable is empty and the resulting error message is even misleading as the called program may not have been iptables-translate. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Drop pointless CMD_REPLACE checkPhil Sutter2023-11-231-5/+0
| | | | | | | | All current users set default source and destination addresses in their post_parse callbacks, so legacy variants are safe and nft variants don't have this restriction anyway. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Drop needless assignment in --help casePhil Sutter2023-11-231-3/+0
| | | | | | | Help text printing code does not refer to optarg, so there is no need to assign to it if unset. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: All variants support -v, update OPTSTRING_COMMONPhil Sutter2023-11-231-4/+4
| | | | | Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: struct xt_cmd_parse::xlate is unusedPhil Sutter2023-11-232-2/+0
| | | | | | | | | | Drop the boolean, it was meant to disable some existence checks in do_parse() prior to the caching rework. Now that do_parse() runs before any caching is done, the checks in question don't exist anymore so drop this relict. Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-bridge: nft_bridge_add() uses wrong flagsPhil Sutter2023-11-231-2/+2
| | | | | | | | | When checking whether -s or -d was given, invflags were used by accident. This change has no functional effect since the values remain the same, but this way it's clear where the previously assigned flags are used. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Install arptables-translate link and man pagePhil Sutter2023-11-232-8/+15
| | | | | | | | While at it, introduce a variable to hold the various semantic links to xtables-translate.8 man page. Fixes: 5b7324e0675e3 ("nft-arp: add arptables-translate") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: more backslash-encoding of charactersJan Engelhardt2023-11-137-83/+83
| | | | | | | | "-" is the dash, "\-" is minus as we know, but groff lists some more characters: "^" is "modifier circumflex" and "~" is "modifier tilde", which, too, need to be escaped for our use. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: limit targets for -P option synopsisJan Engelhardt2023-11-132-2/+2
| | | | | | Do not suggest that -P could be used with arbitrary targets. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: copy synopsis markup from iptables.8 to arptables-nft.8Jan Engelhardt2023-11-131-14/+28
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: stop putting non-terminals in italicJan Engelhardt2023-11-131-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: repeal manual hyphenationJan Engelhardt2023-11-131-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: remove lone .nh commandJan Engelhardt2023-11-131-2/+0
| | | | | | | No other manpage files use .nh, and I cannot see a reason iptables-apply would exceptionally need it. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: consistent use of \(em in Name sectionsJan Engelhardt2023-11-137-7/+7
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* extensions: libarpt_standard.t: Add a rule with builtin option masksPhil Sutter2023-11-091-0/+1
| | | | | | | | Just some random values in hope this starts failing if masks support changes or breaks. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* arptables: Fix --proto-type mask formattingPhil Sutter2023-11-092-1/+5
| | | | | | | | | | | | | | | | | | Arptables accepts numeric --proto-type values and masks in any numeral system identified by (absence of) prefix. Yet it prints the mask value in hex without '0x'-prefix, breaking save and restore the same way numeric --h-type output did. In theory, this could be fixed either by adding the missing prefix or printing the mask in decimal (like most other builtin matches do), but since the value is printed in hex with prefix already, align mask output with that. Also a day 1 bug and consistent with legacy, so no Fixes: tag here as well. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* arptables: Fix formatting of numeric --h-type outputPhil Sutter2023-11-092-3/+5
| | | | | | | | | | | | | | | | | Arptables expects numeric arguments to --h-type option in hexadecimal form, even if no '0x'-prefix is present. In contrast, it prints such values in decimal. This is not just inconsistent, but makes it impossible to save and later restore a ruleset without fixing up the values in between. Assuming that the parser side can't be changed for compatibility reasons, fix the output side instead. This is a day 1 bug and present in legacy arptables as well, so treat this as a "feature" of arptables-nft and omit a Fixes: tag. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* extensions: MARK: fix arptables supportFlorian Westphal2023-11-072-0/+11
| | | | | | | | | | | | arptables "--set-mark" is really just "--or-mark". This bug is also in arptables-legacy. Fix this and add test cases. Note that the test for "16" vs. "0x16" is intentional, arptables parser is buggy and always uses "%x". Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables-txlate: add test casesFlorian Westphal2023-11-073-1/+15
| | | | | | | | | | | | | | | Add test cases for libarpt_mangle and extend the generic tests to cover basic arptables matches. Note that there are several historic artefacts that could be revised. For example, arptables-legacy and arptables-nft both ignore "-p" instead of returning an error about an unsupported option. The ptype could be hard-wired to 0x800 and set unconditionally. OTOH, this should always match for ethernet arp packets anyway. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-arp: add arptables-translateFlorian Westphal2023-11-075-1/+236
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-arp: add missing mask supportFlorian Westphal2023-11-072-2/+27
| | | | | | | | | | arptables-legacy supports masks for --h-type, --opcode and --proto-type, but arptables-nft did not. Add this. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Fix corner-case noflush restore bugPhil Sutter2023-11-072-0/+27
| | | | | | | | | | Report came from firwalld, but this is actually rather hard to trigger. Since a regular chain line prevents it, typical dump/restore use-cases are unaffected. Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation") Cc: Eric Garver <eric@garver.life> Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables-nft: remove ARPT_INV flags usageFlorian Westphal2023-11-033-4/+6
| | | | | | | | | | | | | | | | | | | | | | ARPT_ and IPT_INV flags are not interchangeable, e.g.: define IPT_INV_SRCDEVADDR 0x0080 define ARPT_INV_SRCDEVADDR 0x0010 as these flags can be tested by libarp_foo.so such checks can yield incorrect results. Because arptables-nft uses existing code, e.g. xt_mark, it makes sense to unify this completely by converting the last users of ARPT_INV_ constants. Note that arptables-legacy does not do run-time module loading via dlopen(). Functionaliy implemented by "extensions" in the arptables-legacy git tree are built-in, so this doesn't break arptables-legacy binaries. Fixes: 44457c080590 ("xtables-arp: Don't use ARPT_INV_*") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: reveal rateest's combination categoriesPhil Sutter2023-10-271-4/+8
| | | | | | | | The .\" prefix made these paragraphs invisible in at least regular man page output. Turn them into tags instead. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: use .TP for lists in xt_osf man pagePhil Sutter2023-10-271-12/+22
| | | | | | | | Value and description are more clearly set apart. Using .RS/.RE pairs also adds proper indenting. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: use native bullet point markupJan Engelhardt2023-10-271-12/+17
| | | | | | | | Replace some "fake" bullet point by the official syntax/markup for bulleted lists. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: grammar fixes to some manpagesJan Engelhardt2023-10-272-6/+6
| | | | | | | | | English generally uses open compounds rather than closed ones; fix the excess hyphens in words. Fix a missing dash for the portnr option as well. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>