summaryrefslogtreecommitdiffstats
path: root/extensions
Commit message (Collapse)AuthorAgeFilesLines
* xshared: Do not omit all-wildcard interface spec when invertedPhil Sutter2024-07-313-0/+6
| | | | | | | | | | | The rule parses correctly, but the (never matching) part is lost on output. Looks like a day-1 bug, make it fix the change after which it applies cleanly. Fixes: b2197e7834f77 ("xshared: Entirely ignore interface masks when saving rules") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: conntrack: Use the right callbacksPhil Sutter2024-07-271-6/+6
| | | | | | | | | | | | These version-agnostic conntrack match aliases emulating the 'state' extension introduced by commit 0d70163162589 ("libxt_state: replace as an alias to xt_conntrack") had incompatible print and save callbacks assigned. These callbacks expected struct xt_state_info in match->data which is incompatible to any of the actual xt_conntrack_mtinfo* structs used. Fixes: b28d4dcc9f555 ("iptables: state match incompatibilty across versions") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: recent: Fix format string for unsigned valuesPhil Sutter2024-07-271-4/+8
| | | | | | | | | | Both fields 'seconds' and 'hit_count' are unsigned, use '%u' accordingly. While being at it, also fix coding-style in those lines. Basically a day-1 bug, have Fixes: point at a reasonably old commit. Fixes: af1660fe0e88c ("Move libipt_recent to libxt_recent") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: recent: New kernels support 999 hitsPhil Sutter2024-07-271-1/+1
| | | | | | | | | Since kernel commit f4ebd03496f6 ("netfilter: xt_recent: Lift restrictions on max hitcount value"), the max supported hitcount value has increased significantly. Adjust the test to use a value which fails on old as well as new kernels. Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: recent: Adjust to changes around ip_pkt_list_tot parameterPhil Sutter2024-07-051-5/+5
| | | | | | | | | | The parameter became obsolete in kernel commit abc86d0f9924 ("netfilter: xt_recent: relax ip_pkt_list_tot restrictions"). Reported-by: Fabio <pedretti.fabio@gmail.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1745 Cc: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libxt_sctp: Add an extra assert()Phil Sutter2024-06-121-0/+2
| | | | | | The code is sane, but this keeps popping up in static code analyzers. Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: extensions: recent: Clarify default value of ip_list_hash_sizePhil Sutter2024-06-121-1/+3
| | | | | | | | The default value of 0 is a bit confusing. Reported-by: Fabio <pedretti.fabio@gmail.com> Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1745 Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix parsing of empty string arg in '-c' optionPhil Sutter2024-04-101-0/+5
| | | | | | | | | | | | | | Calling iptables with '-c ""' resulted in a call to strchr() with an invalid pointer as 'optarg + 1' points to past the buffer. The most simple fix is to drop the offset: The global optstring part specifies a single colon after 'c', so getopt() enforces a valid pointer in optarg. If it contains a comma at first position, packet counter value parsing will fail so all cases are covered. Reported-by: gorbanev.es@gmail.com Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741 Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xlate: libip6t_mh: Fix and simplify plain '-m mh' matchPhil Sutter2024-04-092-4/+2
| | | | | | | | | | Since core xlate code now ignores '-p mh' if an mh extension is also present in the rule, mh extension has to emit the l4proto match itself. Therefore emit the exthdr match irrespective of '-p' argument value just like other IPv6 extension header matches do. Fixes: 83f60fb37d594 ("extensions: mh: Save/xlate inverted full ranges") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xlate: Improve redundant l4proto match avoidancePhil Sutter2024-04-091-3/+3
| | | | | | | | | | | | | | | xtables-translate tries to avoid 'ip protocol'/'meta l4proto' matches if following expressions add this as dependency anyway. E.g.: | # iptables-translate -A FOO -p tcp -m tcp --dport 22 -j ACCEPT | nft 'add rule ip filter FOO tcp dport 22 counter accept' This worked by searching protocol name in loaded matches, but that approach is flawed as the protocol name and corresponding extension may differ ("mobility-header" vs. "mh"). Improve this by searching for all names (cached or resolved) for a given protocol number. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: xt_TPROXY: add txlate supportFlorian Westphal2024-03-092-0/+79
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: xt_socket: add txlate support for socket matchFlorian Westphal2024-03-062-0/+51
| | | | | | | | | | | | | | | | | | | v2: document the match semantics of -m socket. Ignore --nowildcard if used with other options when translating and add "wildcard 0" if the option is missing. "-m socket" will ignore sockets bound to 0.0.0.0/:: by default, unless --nowildcard is given. So, xlate must always append "wildcard 0", can elide "wildcard" if other options are present along with --nowildcard. To emulate "-m socket --nowildcard", check for "wildcard <= 1" to get a "socket exists" type matching. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Leverage stored protocol namesPhil Sutter2024-02-291-0/+30
| | | | | | | | | | | Align output of ip(6)tables-translate for --protocol arguments with that of ip(6)tables -L/-S by calling proto_to_name() from xshared.c. The latter will consult xtables_chain_protos list first to make sure (the right) names are used for "common" protocol values and otherwise falls back to getprotobynumber() which it replaces here. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1738 Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Respect min/max values when completing rangesPhil Sutter2024-02-021-2/+2
| | | | | | | | If an extension defines a minimum/maximum valid value for an option's range argument, treat this as the lower/upper boundary to use when completing (half) open ranges. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: tcp/udp: Save/xlate inverted full rangesPhil Sutter2024-02-026-43/+64
| | | | | | | | Also translate a bare '-m tcp/udp' to 'meta l4proto' match. Fixes: 04f569ded54a7 ("extensions: libxt_udp: add translation to nft") Fixes: fb2593ebbf656 ("extensions: libxt_tcp: add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Do not omit full ranges if invertedPhil Sutter2024-02-022-4/+4
| | | | | | | Otherwise this turns a never matching rule into an always matching one. Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ipcomp: Save inverted full rangesPhil Sutter2024-02-022-4/+5
| | | | | Fixes: 0bb8765cc28cf ("iptables: Add IPv4/6 IPcomp match support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: esp: Save/xlate inverted full rangesPhil Sutter2024-02-023-13/+23
| | | | | | | | | Also add a translation for plain '-m esp' match which depends on the address family: While ip6tables-translate may emit an exthdr exists match, iptables-translate must stick to meta l4proto. Fixes: 6cfa723a83d45 ("extensions: libxt_esp: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: rt: Save/xlate inverted full rangesPhil Sutter2024-02-023-11/+23
| | | | | | | Also translate plain '-m rt' match into an exthdr exists one. Fixes: 9dbb616c2f0c3 ("extensions: libip6t_rt.c: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: mh: Save/xlate inverted full rangesPhil Sutter2024-02-023-7/+19
| | | | | | | | | Also translate '-m mh' into an exthdr exists match unless '-p mh' is also present. The latter is converted into 'meta l4proto mh' which might need fixing itself at a later point. Fixes: 6d4b93485055a ("extensions: libip6t_mh: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: frag: Save/xlate inverted full rangesPhil Sutter2024-02-023-12/+21
| | | | | | | Also translate plain '-m frag' match into an exthdr exists one. Fixes: bd5bbc7a0fbd8 ("extensions: libip6t_frag: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ah: Save/xlate inverted full rangesPhil Sutter2024-02-026-23/+33
| | | | | | | | | | | While at it, fix xlate output for plain '-m ah' matches: With ip6tables-translate, one should emit an extdhr exists match since ip6t_ah.c in kernel also uses ipv6_find_hdr(). With iptables-translate, a simple 'meta l4proto ah' was missing. Fixes: bb498c8ba7bb3 ("extensions: libip6t_ah: Fix translation of plain '-m ah'") Fixes: b9a46ee406165 ("extensions: libipt_ah: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Reject negative port rangesPhil Sutter2024-02-023-8/+8
| | | | | | | Analogous to XTTYPE_UINT*RC value parsing, assert consecutive port values are not lower than previous ones. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Assert ranges are monotonic increasingPhil Sutter2024-02-0210-24/+17
| | | | | | | | | | | Extensions commonly require the upper range value to be larger or equal to the lower one. Performing this check in the parser is easier and covers all extensions at once. One notable exception is NFQUEUE which requires strict monotonicity. Hence leave its checks in place. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: *.t/*.txlate: Test range corner-casesPhil Sutter2024-02-0226-0/+253
| | | | | | | | | | | For every extension option accepting a range, test open and half-open as well as single element and invalid (negative) ranges. The added tests merely reflect the status quo, not the expected outcome. Following patches will fix results and the already existing test cases highlight the fixes' effects. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Increase non-fast mode strictnessPhil Sutter2024-02-012-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | The simple search for the rule in save output accepted arbitrary leading and trailing rule parts. This was partly desired as it allowed to omit the leading '-A' flag or ignore the mandatory '-j CONTINUE' in ebtables rules, though it could hide bugs. Introduction of fast mode mitigated this due to the way how it searches for multiple rules at the same time, but there are cases which fast mode does not support yet (e.g. test cases containing variant-specific rule output). Given save output format will never contain the rule in first or last line, so enclosing the searched rule in newline characters is sufficient to make the search apply to full lines only. The only drawback is having to add '-A' and '-j CONTINUE' parts if needed. The hidden bugs this revealed were: - Long --nflog-prefix strings are not cut to 64 chars with iptables-nft - The TCPMSS rule supposed to fail with legacy only must specify an expected save output Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_stp: fix range checkingFlorian Westphal2024-01-251-1/+1
| | | | | | | | | | | | | | This has to either consider ->nvals > 1 or check the values post-no-range-fixup: ./iptables-test.py extensions/libebt_stp.t extensions/libebt_stp.t: ERROR: line 12 (cannot load: ebtables -A INPUT --stp-root-cost 1) (it tests 0 < 1 and fails, but test should be 1 < 1). Fixes: dc6efcfeac38 ("extensions: libebt_stp: Use guided option parser") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Default to extrapositioned negationsPhil Sutter2024-01-1023-164/+165
| | | | | | | | | | | | | | | ebtables-nft has always supported both intra- and extrapositioned negations but defaulted to intrapositioned when printing/saving rules. With commit 58d364c7120b5 ("ebtables: Use do_parse() from xshared") though, it started to warn about intrapositioned negations. So change the default to avoid mandatory warnings when e.g. loading previously dumped rulesets. Also adjust test cases, help texts and ebtables-nft.8 accordingly. Cc: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libxt_HMARK: Review HMARK_parse()Phil Sutter2024-01-101-51/+9
| | | | | | | | * With XTOPT_NBO support in UINT types, the manual byteorder conversion calls are no longer needed * Setting bits in cb->xflags is done by xtables_option_parse() already * Since O_HMARK_* values match XT_HMARK_* ones, all but the O_HMARK_TYPE case fold together into a single default one
* extensions: libebt_mark_m: Use guided option parserPhil Sutter2024-01-101-36/+22
| | | | | | | Can't use XTTYPE_MARKMASK32 here because in 'val/mask', 'val' is optional. Would have to extend xtopt_parse_markmask() to accept this, maybe guarded by a new XTOPT_ flag to avoid unexpected changes in behaviour?
* extensions: libebt_pkttype: Use guided option parserPhil Sutter2024-01-101-22/+23
| | | | | Not much to gain here. Maybe implement number parsing with fallback to get rid of that part from extension parsers?
* extensions: libxt_limit: Use guided option parser for NFPROTO_BRIDGE, tooPhil Sutter2024-01-101-48/+2
|
* extensions: libebt_arp: Use guided option parserPhil Sutter2024-01-102-130/+78
|
* extensions: libebt_vlan: Use guided option parserPhil Sutter2024-01-101-68/+34
|
* extensions: libebt_802_3: Use guided option parserPhil Sutter2024-01-102-55/+21
|
* extensions: libebt_redirect: Use guided option parserPhil Sutter2024-01-101-23/+17
|
* extensions: libebt_snat: Use guided option parserPhil Sutter2024-01-102-42/+34
|
* extensions: libebt_nflog: Use guided option parserPhil Sutter2024-01-101-64/+18
|
* extensions: libebt_mark: Use guided option parserPhil Sutter2024-01-101-86/+54
|
* extensions: libebt_log: Use guided option parserPhil Sutter2024-01-101-91/+30
|
* extensions: libebt_ip: Use guided option parserPhil Sutter2024-01-102-123/+84
|
* extensions: libebt_ip6: Use guided option parserPhil Sutter2024-01-102-124/+83
|
* extensions: libebt_dnat: Use guided option parserPhil Sutter2024-01-101-37/+27
|
* extensions: libebt_arpreply: Use guided option parserPhil Sutter2024-01-102-34/+22
|
* extensions: libebt_stp: Use guided option parserPhil Sutter2024-01-102-160/+100
|
* extensions: libebt_*: Drop some needless init callbacksPhil Sutter2024-01-104-42/+0
| | | | Extension data is zero by default.
* build: replace `echo -e` with `printf`Jeremy Sowden2023-12-151-3/+3
| | | | | | | | | | | | | | | | | | | | | | `echo -e` is not portable and we can end up with: GEN matches.man -e + ./libxt_addrtype.man -e + ./libip6t_ah.man -e + ./libipt_ah.man -e + ./libxt_bpf.man -e + ./libxt_cgroup.man -e + ./libxt_cluster.man -e + ./libxt_comment.man -e + ./libxt_connbytes.man -e + ./libxt_connlabel.man -e + ./libxt_connlimit.man -e + ./libxt_connmark.man -e + ./libxt_conntrack.man [...] Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: add an automake verbosity variable for `ln`Jeremy Sowden2023-12-151-6/+9
| | | | | Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: use standard automake verbosity variablesJeremy Sowden2023-12-151-17/+24
| | | | | | | | | | The previous implementation ignored the default verbosity defined by configure, and controlled by --{enable,disable}-silent-rules, and treated V="" as V=0. Instead, follow the guide-lines given in the automake manual. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: remove unused `AM_VERBOSE_CXX*` variablesJeremy Sowden2023-12-151-2/+0
| | | | | | | There is no C++, so these variables are not required. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
generated by cgit v1.2.3 (git 2.25.0) at 2025-08-03 10:01:36 +0000