summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* nft: family_ops: Pass nft_handle to 'rule_find' callbackPhil Sutter2019-11-255-11/+10
| | | | | | | | | In order to prepare for rules containing set references, nft handle has to be passed to nft_rule_to_iptables_command_state() in order to let it access the set in cache. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'add' callbackPhil Sutter2019-11-257-12/+14
| | | | | | | | | In order for add_match() to create anonymous sets when converting xtables matches it needs access to nft handle. So pass it along from callers of family ops' add callback. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Fix -Z for rules with NFTA_RULE_COMPATPhil Sutter2019-11-151-0/+39
| | | | | | | | | | | | | | | | | | | | | The special nested attribute NFTA_RULE_COMPAT holds information about any present l4proto match (given via '-p' parameter) in input. The match is contained as meta expression as well, but some xtables extensions explicitly check it's value (see e.g. xt_TPROXY). This nested attribute is input only, the information is lost after parsing (and initialization of compat extensions). So in order to feed a rule back to kernel with zeroed counters, the attribute has to be reconstructed based on the rule's expressions. Other code paths are not affected since rule_to_cs() callback will populate respective fields in struct iptables_command_state and 'add' callback (which is the inverse to rule_to_cs()) calls add_compat() in any case. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: CMD_ZERO needs a rule cachePhil Sutter2019-11-152-0/+3
| | | | | | | | | | | In order to zero rule counters, they have to be fetched from kernel. Fix this for both standalone calls as well as xtables-restore --noflush. Fixes: b5cb6e631c828 ("nft-cache: Fetch only chains in nft_chain_list_get()") Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Add ipt-restore/0007-flush-noflush_0Phil Sutter2019-11-061-0/+42
| | | | | | | | Simple test to make sure iptables-restore does not touch tables it is not supposed to. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Improve performance of --noflush operationPhil Sutter2019-11-061-7/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | | The reason for that full cache fetching when called with --noflush even before looking at any input data was that there might be a command requiring a rule cache following some rule add/insert ones which don't. At that point one needs to fetch rules from kernel and try to insert the local ones at the right spot which is non-trivial. At the same time there is a performance-critical use-case for --noflush, namely fast insertion of a bunch of rules in one go, avoiding the process spawn overhead. Optimize for this use-case by preloading input into a 64KB buffer to see if it fits. If so, search for commands requiring a rule cache. If there are none, skip initial full cache fetching. The above algorithm may abort at any point, so actual input parsing must happen in three stages: 1) parse all preloaded lines from 64KB buffer 2) parse any leftover line in line buffer (happens if input exceeds the preload buffer size) 3) parse remaining input from input file pointer Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Allow lines without trailing newline characterPhil Sutter2019-11-062-1/+7
| | | | | | | | | | | | | | | Old code in add_param_to_argv() assumed the input line would always end with a newline character. Without it, the last word of input wasn't recognized. Fix this by adding a final check for param.len (indicating leftover data in buffer). In line parsing code itself, only COMMIT line check required presence of trailing newline. The replaced conditional is not 100% accurate as it allows for characters after newline to be present, but since fgets() is used this shouldn't happen anyway. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Remove some pointless linebreaksPhil Sutter2019-11-061-15/+10
| | | | | | | | Due to reduced indenting level, some linebreaks are no longer needed. OTOH, strings should not be split to aid in grepping for error output. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Introduce line parsing functionPhil Sutter2019-11-061-170/+177
| | | | | | | | | | Move the loop code parsing a distinct line of input into a dedicated function as a preparation for changing input sources. Since loop code either calls continue or exit() directly, there is no need for a return code to indicate failure. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Introduce struct nft_xt_restore_statePhil Sutter2019-11-061-31/+35
| | | | | | | | | | | | This data structure holds parser state information. A follow-up patch will extract line parsing code into a separate function which will need a place to persistently store this info in between calls. While being at it, make 'in_table' variable boolean and drop some extra braces in conditionals checking its value. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Integrate restore callbacks into struct nft_xt_restore_parsePhil Sutter2019-11-063-16/+21
| | | | | | | | There's really no point in passing those as separate parameter. While being at it, make them static const everywhere. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-arp: Use xtables_print_mac_and_mask()Phil Sutter2019-10-301-27/+4
| | | | | | | | | | This libxtables function does exactly what the local implementation did. The only noteworthy difference is that it assumes MAC/mask lengths, but the local implementation was passed ETH_ALEN in each invocation, so no practical difference. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-arp: Use xtables_parse_interface()Phil Sutter2019-10-301-44/+6
| | | | | | | | | The local implementation differs just slightly but libxtables version seems more correct (no needless memsetting of mask, more relevant illegal character checking) so use that one. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-arp: Drop some unused variablesPhil Sutter2019-10-301-17/+0
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-arp: Integrate OPT_* defines into xshared.hPhil Sutter2019-10-302-29/+21
| | | | | | | | | | | | | | | | | | These defines are internal use only, so their actual value doesn't matter as long as they're unique and inverse_for_options array items match: When negating a given option, the corresponding OPT_* value's bit is used as an index into inverse_for_options to retrieve the corresponding invflag. If zero, either negating or the option itself is not supported. (In practice, a lookup for unsupported option won't happen as those are caught by getopt_long()). Since xtables-arp's OPT_* values change, adjust the local inverse_for_options array accordingly. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Replace TRUE/FALSE with true/falsePhil Sutter2019-10-304-42/+12
| | | | | | | And drop the conditional defines. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-arp: Drop generic_opt_check()Phil Sutter2019-10-301-66/+0
| | | | | | | | With all fields in commands_v_options[][] being whitespace, the function is effectively a noop. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge CMD_* definesPhil Sutter2019-10-306-73/+20
| | | | | | | | | They are mostly identical, just xtables-arp ones differ slightly. Though since they are internal use only and their actual value doesn't matter (as long as it's a distinct bit), they can be merged anyway. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xshared: Share a common implementation of parse_rulenumber()Phil Sutter2019-10-306-50/+13
| | | | | | | The function is really small, but still copied four times. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xshared: Share a common add_command() implementationPhil Sutter2019-10-306-91/+31
| | | | | | | | | | | The shared definition of cmdflags is a super set of the previous one in xtables-arp.c so while not being identical, they're compatible. Avoid accidental array overstep in cmd2char() by incrementing an index variable and checking its final value before using it as such. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip6tables, xtables-arp: Drop unused struct pprotPhil Sutter2019-10-302-13/+0
| | | | | | | | These seem like leftovers when changing code to use xtables_chain_protos as struct xtables_pprot is identical to struct pprot removed here. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-arp: Use xtables_ipparse_multiple()Phil Sutter2019-10-261-213/+30
| | | | | | | | | | | Use the same code for parsing source and destination IP addresses as iptables and drop all the local functions dealing with that. While being at it, call free() for 'saddrs' and 'daddrs' unconditionally (like iptables does), they are NULL if not used. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* xshared: Introduce struct argv_storePhil Sutter2019-10-245-95/+96
| | | | | | | | | | | | The use of global variables in code around add_argv() is error-prone and hard to follow. Replace them by a struct which functions will modify instead of causing side-effects. Given the lack of static variables, this effectively makes argv construction code reentrant. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* iptables-xml: Use add_param_to_argv()Phil Sutter2019-10-244-73/+949
| | | | | | | | | Extend the shared argv parser by storing whether a given argument was quoted or not, then use it in iptables-xml. One remaining extra bit is extraction of chain name in -A commands, do that afterwards in a loop. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Use ARRAY_SIZE() macro in nft_strerror()Phil Sutter2019-10-231-1/+1
| | | | | | | | Variable 'table' is an array of type struct table_struct, so this is a classical use-case for ARRAY_SIZE() macro. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Unbreak *tables-restorePhil Sutter2019-10-235-5/+34
| | | | | | | | | | | | | | | | | Commit 3dc433b55bbfa ("xtables-restore: Fix --table parameter check") installed an error check which evaluated true in all cases as all callers of do_command callbacks pass a pointer to a table name already. Attached test case passed as it tested error condition only. Fix the whole mess by introducing a boolean to indicate whether a table parameter was seen already. Extend the test case to cover positive as well as negative behaviour and to test ebtables-restore and ip6tables-restore as well. Also add the required checking code to the latter since the original commit missed it. Fixes: 3dc433b55bbfa ("xtables-restore: Fix --table parameter check") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Fix --table parameter checkPhil Sutter2019-10-215-12/+25
| | | | | | | | | | | | | | | | | | | | | Xtables-restore tries to reject rule commands in input which contain a --table parameter (since it is adding this itself based on the previous table line). The manual check was not perfect though as it caught any parameter starting with a dash and containing a 't' somewhere, even in rule comments: | *filter | -A FORWARD -m comment --comment "- allow this one" -j ACCEPT | COMMIT Instead of error-prone manual checking, go a much simpler route: All do_command callbacks are passed a boolean indicating they're called from *tables-restore. React upon this when handling a table parameter and error out if it's not the first one. Fixes: f8e5ebc5986bf ("iptables: Fix crash on malformed iptables-restore") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* xtables-restore: Drop chain_list callbackPhil Sutter2019-10-182-17/+0
| | | | | | | | Since commit 0baa08fed43fa ("xtables: unify user chain add/flush for restore case") it is not used anymore, so just drop it. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Drop local xtc_ops instancePhil Sutter2019-10-181-7/+2
| | | | | | | | | It is merely used to hold nft_strerror() pointer but using that function in turn does not provide any benefit as it falls back to plain strerror() if nft_fn is not initialized. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-restore: Constify struct iptables_restore_cbPhil Sutter2019-10-181-4/+5
| | | | | | | | Just like with xtables-restore, these callbacks don't change at run-time. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Constify struct nft_xt_restore_cbPhil Sutter2019-10-183-6/+6
| | | | | | | | There is no need for dynamic callback mangling, so make all instances static const. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Introduce rule counter tokenizer functionPhil Sutter2019-10-186-91/+70
| | | | | | | | | | | | | | The same piece of code appears three times, introduce a function to take care of tokenizing and error reporting. Pass buffer pointer via reference so it can be updated to point to after the counters (if found). While being at it, drop pointless casting when passing pcnt/bcnt to add_argv(). Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Use xt_params->program_namePhil Sutter2019-10-183-9/+7
| | | | | | | | | | | Instead of setting newargv[0] to argv[0]'s value, just use whatever xt_params->program_name contains. The latter is arbitrarily defined, but may still be more correct than real argv[0] which may simply be for instance xtables-nft-multi. Either way, there is no practical significance since newargv[0] is used exclusively in debug output. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Treat struct nft_xt_restore_parse as constPhil Sutter2019-10-182-2/+2
| | | | | | | | | This structure contains restore parser configuration, parser is not supposed to alter it. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Optimize flushing all chains of a tablePhil Sutter2019-10-173-18/+39
| | | | | | | | | | | | | | | | | | | | | | | | Leverage nftables' support for flushing all chains of a table by omitting NFTNL_RULE_CHAIN attribute in NFT_MSG_DELRULE payload. The only caveat is with verbose output, as that still requires to have a list of (existing) chains to iterate over. Apart from that, implementing this shortcut is pretty straightforward: Don't retrieve a chain list and just call __nft_rule_flush() directly which doesn't set above attribute if chain name pointer is NULL. A bigger deal is keeping rule cache consistent: Instead of just clearing rule list for each flushed chain, flush_rule_cache() is updated to iterate over all cached chains of the given table, clearing their rule lists if not called for a specific chain. While being at it, sort local variable declarations in nft_rule_flush() from longest to shortest and drop the loop-local 'chain_name' variable (but instead use 'chain' function parameter which is not used at that point). Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Support nft_is_table_compatible() per chainPhil Sutter2019-10-173-10/+29
| | | | | | | | | | | | | | When operating on a single chain only, compatibility checking causes unwanted overhead by checking all chains of the current table. Avoid this by accepting the current chain name as parameter and pass it along to nft_chain_list_get(). While being at it, introduce nft_assert_table_compatible() which calls xtables_error() in case compatibility check fails. If a chain name was given, include that in error message. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Reduce cache overhead of nft_chain_builtin_init()Phil Sutter2019-10-171-4/+5
| | | | | | | | There is no need for a full chain cache, fetch only the few builtin chains that might need to be created. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-cache: Support partial rule cache per chainPhil Sutter2019-10-175-44/+79
| | | | | | | | | | | | | | | | | Accept an additional chain name pointer in __nft_build_cache() and pass it along to fetch only that specific chain and its rules. Enhance nft_build_cache() to take an optional nftnl_chain pointer to fetch rules for. Enhance nft_chain_list_get() to take an optional chain name. If cache level doesn't include chains already, it will fetch only the specified chain from kernel (if existing) and add that to table's chain list which is returned. This keeps operations for all chains of a table or a specific one within the same code path in nft.c. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-cache: Support partial cache per tablePhil Sutter2019-10-171-25/+57
| | | | | | | | | | | | Accept a builtin_table pointer in __nft_build_cache() and pass it along when fetching chains and rules to operate on that table only (unless the pointer is NULL). Make use of it in nft_chain_list_get() since that accepts a table name and performs a builtin table lookup internally already. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-cache: Cover for multiple fetcher invocationPhil Sutter2019-10-171-1/+18
| | | | | | | | | | | | | | | | | | | | Preparing for partial caches, it is necessary to make sure these functions don't cause harm if called repeatedly. * Use h->cache->tables pointer as indicator for existing table cache, return immediately from fetch_table_cache() if non-NULL. * Initialize table's chain list only if non-NULL. * Search for chain in table's chain list before adding it. * Don't fetch rules for a chain if it has any rules already. With rule list being embedded in struct nftnl_chain, this is the best way left to check if rules have been fetched already or not. It will fail for empty chains, but causes no harm in that case, either. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-cache: Fetch only chains in nft_chain_list_get()Phil Sutter2019-10-172-1/+21
| | | | | | | | | | The function is used to return the given table's chains, so fetching chain cache is enough. Add calls to nft_build_cache() in places where a rule cache is required. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-cache: Introduce cache levelsPhil Sutter2019-10-172-16/+47
| | | | | | | | | | | | | Replace the simple have_cache boolean by a cache level indicator defining how complete the cache is. Since have_cache indicated full cache (including rules), make code depending on it check for cache level NFT_CL_RULES. Core cache fetching routine __nft_build_cache() accepts a new level via parameter and raises cache completeness to that level. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-test: Run tests in lexical orderPhil Sutter2019-10-171-2/+6
| | | | | | | | To quickly see if a given test was run or not, sort the file list. Also filter non-test files right when preparing the list. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Extract cache routines into nft-cache.cPhil Sutter2019-10-107-361/+404
| | | | | | | | The amount of code dealing with caching only is considerable and hence deserves an own source file. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Avoid nested cache fetchingPhil Sutter2019-10-101-2/+1
| | | | | | | | | Don't call fetch_table_cache() from within fetch_chain_cache() but instead from __nft_build_cache(). Since that is the only caller of fetch_chain_cache(), this change should not have any effect in practice. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Pass nft_handle to flush_cache()Phil Sutter2019-10-101-17/+11
| | | | | | | | | This allows to call nft_table_builtin_find() and hence removes the only real user of __nft_table_builtin_find(). Consequently remove the latter by integrating it into its sole caller. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_SYNPROXY: add xlate methodJose M. Guisado Gomez2019-10-012-0/+25
| | | | | | | | This adds translation capabilities when encountering SYNPROXY inside iptables rules. Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Minimize caching when flushingPhil Sutter2019-09-303-2/+23
| | | | | | | | | | | | | | Unless --noflush was given, xtables-restore merely needs the list of tables to decide whether to delete it or not. Introduce nft_fake_cache() function which populates table list, initializes chain lists (so nft_chain_list_get() returns an empty list instead of NULL) and sets 'have_cache' to turn any later calls to nft_build_cache() into nops. If --noflush was given, call nft_build_cache() just once instead of for each table line in input. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Make nftnl_table_list_get() fetch only tablesPhil Sutter2019-09-301-1/+2
| | | | | | | No need for a full cache to serve the list of tables. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Fix for add and delete of same rule in single batchPhil Sutter2019-09-302-5/+16
| | | | | | | | | | | | | | | Another corner-case found when extending restore ordering test: If a delete command in a dump referenced a rule added earlier within the same dump, kernel would reject the resulting NFT_MSG_DELRULE command. Catch this by assigning the rule to delete a RULE_ID value if it doesn't have a handle yet. Since __nft_rule_del() does not duplicate the nftnl_rule object when creating the NFT_COMPAT_RULE_DELETE command, this RULE_ID value is added to both NEWRULE and DELRULE commands - exactly what is needed to establish the reference. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>