summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* extensions: libebt_arpreply: Use guided option parserPhil Sutter2024-01-102-34/+22
|
* extensions: libebt_stp: Use guided option parserPhil Sutter2024-01-102-160/+100
|
* extensions: libebt_*: Drop some needless init callbacksPhil Sutter2024-01-104-42/+0
| | | | Extension data is zero by default.
* ebtables: Support for guided option parserPhil Sutter2024-01-101-57/+51
| | | | | | | | | Adjust ebt_load_match() and ebt_command_default() to expect x6_options/x6_parse fiels to be set instead of the traditional ones. Much of this is c'n'p from command_default() in xshared.c, but due to ebtables' custom match data structure (combining matches and watchers), sharing the code is probably not feasible.
* libxtables: xtoptions: Treat NFPROTO_BRIDGE as IPv4Phil Sutter2024-01-101-0/+1
| | | | | | | | | When parsing for XTTYPE_HOST(MASK), the return value of afinfo_family() is used to indicate the expected address family. Make guided option parser expect IPv4 by default for ebtables as this is the more common case. The exception is libebt_ip6, which will temporarily adjust afinfo->family while parsing.
* libxtables: xtoptions: Implement XTTYPE_ETHERMACMASKPhil Sutter2024-01-102-1/+16
| | | | | | Accept an Ethernet MAC address with optional mask in the format xtables_parse_mac_and_mask() expects it. Does not support XTOPT_PUT (for now) due to the lack of defined data structure.
* libxtables: xtoptions: Support XTOPT_NBO with XTTYPE_UINT*Phil Sutter2024-01-101-9/+31
| | | | | Value conversion into Big Endian byteorder is pretty straightforward, merely needed a small helper for uint64.
* libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASKPhil Sutter2024-01-102-2/+0
| | | | | | | | Do as the comment in xtopt_parse_hostmask() claims and omit XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate() will catch the incompatibility. Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support")
* tests: iptables-test: Use difflib if dumps differPhil Sutter2023-12-211-5/+7
| | | | | | | Improve log readability by printing a unified diff of the expected vs. actual iptables-save output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-legacy: Fix for mandatory lock waitingPhil Sutter2023-12-212-2/+57
| | | | | | | | | | | | | | | | | | | | | | Parameter 'wait' passed to xtables_lock() signals three modes of operation, depending on its value: 0: --wait not specified, do not wait if lock is busy -1: --wait specified without value, wait indefinitely until lock becomes free >0: Wait for 'wait' seconds for lock to become free, abort otherwise Since fixed commit, the first two cases were treated the same apart from calling alarm(0), but that is a nop if no alarm is pending. Fix the code by requesting a non-blocking flock() in the second case. While at it, restrict the alarm setup to the third case only. Cc: Jethro Beekman <jethro@fortanix.com> Cc: howardjohn@google.com Cc: Antonio Ojea <antonio.ojea.garcia@gmail.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1728 Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: replace `echo -e` with `printf`Jeremy Sowden2023-12-151-3/+3
| | | | | | | | | | | | | | | | | | | | | | `echo -e` is not portable and we can end up with: GEN matches.man -e + ./libxt_addrtype.man -e + ./libip6t_ah.man -e + ./libipt_ah.man -e + ./libxt_bpf.man -e + ./libxt_cgroup.man -e + ./libxt_cluster.man -e + ./libxt_comment.man -e + ./libxt_connbytes.man -e + ./libxt_connlabel.man -e + ./libxt_connlimit.man -e + ./libxt_connmark.man -e + ./libxt_conntrack.man [...] Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: add an automake verbosity variable for `ln`Jeremy Sowden2023-12-151-6/+9
| | | | | Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: use standard automake verbosity variablesJeremy Sowden2023-12-152-20/+27
| | | | | | | | | | The previous implementation ignored the default verbosity defined by configure, and controlled by --{enable,disable}-silent-rules, and treated V="" as V=0. Instead, follow the guide-lines given in the automake manual. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: remove unused `AM_VERBOSE_CXX*` variablesJeremy Sowden2023-12-151-2/+0
| | | | | | | There is no C++, so these variables are not required. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: remove obsolete `AM_LIBTOOL_SILENT` variableJeremy Sowden2023-12-151-1/+0
| | | | | | | It doesn't do anything, so get rid of it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: format `AM_CPPFLAGS` variablesJeremy Sowden2023-12-152-2/+17
| | | | | Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Fix spelling mistakesJeremy Sowden2023-12-129-11/+11
| | | | | | | | Corrections for several spelling mistakes, typo's and non-native usages in man-pages and error-messages. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Use do_parse() from xsharedPhil Sutter2023-12-057-1079/+341
| | | | | | | | | | | | | | | | | | | Drop the custom commandline parsers from ebtables and ebtables-translate, extend and use the shared one instead. ebtables gains a few new features from doing this: - Rule counters may be specified in the '-c N,M' syntax - Support for --replace command - Support for --list-rules command - Zero individual rules There is one known regression in this patch, namely maximum chain name length shrinks to 28 characters (from 32). Since this limit changed for iptables in the past as well (e.g. with commit 5429b41c2bb4a), assume nobody really relies upon it anyway. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce option_test_and_reject()Phil Sutter2023-12-051-10/+11
| | | | | | Just a small helper eliminating the repetitive code there. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Use struct xt_cmd_parsePhil Sutter2023-12-051-23/+36
| | | | | | | This is merely to reduce size of the parser merge patch, no functional change intended. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Make 'h' case just a call to print_help()Phil Sutter2023-12-052-31/+31
| | | | | | | | | Move the special ebtables help parameter handling into its print_help() function to prepare for it turning into a callback. Add new field 'argc' to struct iptables_command_state to make this possible. It is actually kind of consistent as it holds 'argv' already. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Pass struct iptables_command_state to print_help()Phil Sutter2023-12-051-6/+5
| | | | | | | | Parameters passed by the sole caller came from there already, apart from 'table' which is not used (ebtables-nft does not have per-table help texts). Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Change option values to avoid clashesPhil Sutter2023-12-052-19/+19
| | | | | | | | In order to parse input using do_parse(), distinct ebtables option's values have to be distinct from others. Since arptables uses values 2-8 already, resort to values >10. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables{,-translate}: Convert if-clause to switch()Phil Sutter2023-12-052-29/+41
| | | | | | | Parser merge prep work, align final do_commandeb*() parts with do_commandx(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Support for ebtables' --change-counters commandPhil Sutter2023-12-053-9/+66
| | | | | | | | | This is tricky because the short-option clashes with the --check command. OTOH, ebtables supports --check as well (though without short-option), so making do_parse() detect ebtables based on struct xtables_args::family is probably still the least messy option. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Support rule range deletion in do_parse()Phil Sutter2023-12-052-1/+35
| | | | | | | | This is a distinct ebtables feature. Introduce struct xt_cmd_parse::rule_ranges boolean indicating support for it and bail otherwise if a range was specified by the user. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce print_help callback (again)Phil Sutter2023-12-057-3/+10
| | | | | | | | Prep work for ebtables parser to use do_parse(). Adding more special casing to xtables_printhelp() causes a mess, so work with a callback again. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Turn command_default() into a callbackPhil Sutter2023-12-057-3/+12
| | | | | | | | Ebtables' variant is pretty different since all extensions are loaded up front and some targets serve as "watcher" extensions, so let variants specify the function to call for extension parameters. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Perform protocol value parsing in callbackPhil Sutter2023-12-052-9/+14
| | | | | | | | The code is same in iptables and ip6tables, but different in ebtables. Therefore move it into the callback to keep that part of do_parse() generic. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: do_parse: Skip option checking for CMD_DELETE_NUMPhil Sutter2023-12-051-1/+0
| | | | | | | This command will delete a rule by its number, not rule spec. No -i/-o options are expected on commandline. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Fix for non-CIDR-compatible hostmasksPhil Sutter2023-11-291-0/+5
| | | | | | | | | | | | | | | | | | | In order to parse the mask, xtopt_parse_hostmask() calls xtopt_parse_plenmask() thereby limiting netmask support to prefix lengths (alternatively specified in IP address notation). In order to lift this impractical restriction, make xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may fall back to xtopt_parse_mask() which correctly initializes val.hmask itself and indicates non-CIDR-compatible masks by setting val.hlen to -1. So in order to support these odd masks, it is sufficient for xtopt_parse_plenmask() to skip its mask building from val.hlen value and take whatever val.hmask contains. Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Fix for garbage access in xtables_options_xfrm()Phil Sutter2023-11-291-1/+2
| | | | | | | | | | Allocation of the temporary array did not account for a terminating NULL entry, causing array boundary overstepping in the called xtables_merge_options(), causing spurious errors in extension parameter parsing. Fixes: ed8c3ea4015f0 ("libxtables: Combine the two extension option mergers") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: Do not escape exclamation marksPhil Sutter2023-11-292-2/+2
| | | | | | | | | | This appears to be not necessary, also mandoc complains about it: | mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \! Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage") Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Leave interface masks alone when parsing from kernelPhil Sutter2023-11-296-36/+16
| | | | | | | | The mask is entirely unused by nft-variants in general and legacy ones when printing. It is relevant only when inserting a legacy rule into kernel as it doesn't detect the '+'-suffix. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Do not populate interface masks per defaultPhil Sutter2023-11-294-11/+48
| | | | | | | | | These are needed by legacy variants only, so introduce a simplified xtables_parse_interface() replacement which does not deal with them and a small function which sets the mask based on given interface name for use by legacy tools. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Entirely ignore interface masks when saving rulesPhil Sutter2023-11-296-38/+12
| | | | | | | Rule printing code does this for more than 20 years now, assume it's safe to rely upon the wildcard interface name to contain a '+' suffix. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Simplify generic_opt_check()Phil Sutter2023-11-291-49/+28
| | | | | | | | | | The option/command matrix does not contain any '+' entries anymore, so each option/command combination is either allowed (and optional) or not. Reduce the matrix to an array of unsigned ints which specify the commands a given option is allowed with. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce xt_cmd_parse_ops::option_invertPhil Sutter2023-11-297-24/+34
| | | | | | | | | Replace the awkward inverse_for_options array with basically a few switch() statements clearly identifying the relation between option and inverse values and relieve callers from having to find the option flag bit's position. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce xt_cmd_parse_ops::option_namePhil Sutter2023-11-297-66/+100
| | | | | | | | | | | | The old opt2char() function was flawed: Since not every field in optflags contains a printable character, typical use of its return value in print statements could lead to garbage on screen. Replace this by a mechanism to retrieve an option's long name which supports family-specific overrides. and get rid of optflags field altogether and define NUMBER_OF_OPT similar to NUMBER_OF_CMD. Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: proper roff encoding for ~ and ^Jan Engelhardt2023-11-275-20/+20
| | | | | | Fixes: v1.8.10-28-g4b0c168a Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: MARK: arptables: Use guided option parserPhil Sutter2023-11-231-67/+15
| | | | | | | | | | | It expects mark values in hex which is possible by setting the base field. The only adjustment needed to use the revision 2 parser is to fill the mask for --set-mark: With XTTYPE_MARKMASK32, an omitted mask sets all mask bits, XTTYPE_UINT32 leaves it uninitialized, though. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libarpt_mangle: Use guided option parserPhil Sutter2023-11-232-84/+48
| | | | | | | | | | | | | Sadly not the best conversion, struct arpt_mangle is not ideal for use as storage backend: With MAC addresses, xtopt_parse_ethermac() refuses to write into *_devaddr fields as they are larger than expected. With XTTYPE_HOSTMASK OTOH, XTOPT_PUT is not supported in the first place. As a side-effect, network names (from /etc/networks) are no longer accepted. But earlier migrations to guided option parser had this side-effect as well, so probably not a frequently used feature. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce struct xt_option_entry::basePhil Sutter2023-11-232-2/+4
| | | | | | | Enable guided option parser users to parse integer values with a fixed base. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce xtables_strtoul_base()Phil Sutter2023-11-232-5/+13
| | | | | | | | Semantically identical to xtables_strtoul() but accepts the base as parameter so callers may force it irrespective of number prefix. The old xtables_strtoul() becomes a shallow wrapper. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Fix guided option parser for use with arptablesPhil Sutter2023-11-231-5/+18
| | | | | | | | With an unexpected value in afinfo->family, guided option parser was rather useless when called from arptables extensions. Introduce afinfo_family() wrapper to sanitize at least NFPROTO_ARP value. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Combine the two extension option mergersPhil Sutter2023-11-231-43/+8
| | | | | | | | | | For extending the command parser's struct option array, there is xtables_merge_options() and xtables_options_xfrm(). Since their bodies were almost identical, make the latter a wrapper of the former by transforming the passed struct xt_option_entry array into a temporary struct option one before handing over. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Implement --change-counters commandPhil Sutter2023-11-236-20/+197
| | | | | | | | Treat it like --replace against the same rule with changed counters. The operation is obviously not atomic, so rule counters may change in kernel while the rule is fetched, modified and replaced. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: do_parse: Ignore '-j CONTINUE'Phil Sutter2023-11-231-1/+2
| | | | | | | | | | | While iptables does not support his NOP, arptables man page claims it does (although legacy arptables rejects it) and ebtables prefers to print it instead of omitting the '-j' option. Accept and ignore the target when parsing to at least fix for arptables-nft and prepare for ebtables-nft using do_parse() as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Align line number formatting with legacyPhil Sutter2023-11-231-1/+1
| | | | | | | | Legacy ebtables appends a dot to the number printed in first column if --Ln flag was given. Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Make ebt_load_match_extensions() staticPhil Sutter2023-11-232-2/+1
| | | | | | The function is not used outside of xtables-eb.c. Signed-off-by: Phil Sutter <phil@nwl.cc>