summaryrefslogtreecommitdiffstats
path: root/extensions
Commit message (Collapse)AuthorAgeFilesLines
* xtables: Introduce and use common function to print val[/mask] argumentsSerhey Popovych2018-04-274-64/+19
| | | | | | | | | | | | | | | | There are number of places where argument is in val[/mask] format printed in extensions and some of them may print corresponding symbolic name. By introducing common function for this task we eliminate custom code parts in extensions to perform printing of arguments in required formats. Use xtables_print_mark_mask() helper for extensions without symbolic name for val[/mask]. Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Introduce and use common function to parse val[/mask] argumentsSerhey Popovych2018-04-272-51/+13
| | | | | | | | | | | | | | There are a couple of places in both core and extensions where arguments in the form of val[/mask] is parsed (see XTTYPE_MARKMASK32). In some cases symbolic name might be used which is mapped in code to numeric value. Introduce common function to handle both cases where value given is either val[/mask] or symbolic name. Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Initialize linear mapping of symbols in _init() of extensionSerhey Popovych2018-04-272-21/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | libxt_devgroup and libipt_realm currently unable to display symbolic names in save/print commands because linear mapping is not initialized. It looks bit confusing as linear mapping initialization is done in init() of extension, which is expected to be called before any other function of extension. However init is called only when '-m' option specified on command line, that is true only for insert, append, replace and destroy iptables commands. Move initialization to extension _init() function before calling any function in extension. Before: ------- ... src-group 0x1 dst-group 0x2 ... src-group 0x2 dst-group 0x1 After: ------ ... src-group grp1 dst-group grp2 ... src-group grp2 dst-group grp1 Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: ULOG: remove testFlorian Westphal2018-04-271-19/+0
| | | | | | ULOG target was removed in 3.17, so this always fails now. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add 'vlan' match extensionFlorian Westphal2018-04-222-0/+237
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add 'pkttype' match extensionFlorian Westphal2018-04-222-0/+139
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add 'ip6' match extensionFlorian Westphal2018-04-192-0/+665
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* libebt_ip: fix translations for tos and icmpFlorian Westphal2018-04-192-7/+7
| | | | | | | tos translation to dscp yielded incorrect value. icmp inserted extra "ip" keyword, remove it. Signed-off-by: Florian Westphal <fw@strlen.de>
* libebt_ip: add icmp supportFlorian Westphal2018-04-192-2/+304
| | | | | | Was added to ebtables recently, so backport this to ebt-compat. Signed-off-by: Florian Westphal <fw@strlen.de>
* xt-translate: quote interface names in translated outputFlorian Westphal2018-04-199-29/+29
| | | | | | | it its good practice as interface names can be virtually any identifier and could clash with nft keywords. Signed-off-by: Florian Westphal <fw@strlen.de>
* icmp: split icmp type printing to header fileFlorian Westphal2018-04-193-58/+35
| | | | | | | | | | | libebt_ip will get icmp support soon, unify icmp name mapping a bit so we can re-use this code from libebt_ip.c. It doesn't seem to be too useful to move to libxtables (as its icmp specific), so add a hedaer file for this to reduce copy & paste needs. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-translate: add initial test casesFlorian Westphal2018-04-138-5/+80
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* libebt_limit: print 'minute' and 'seconds', not 'min' and 'secs'Florian Westphal2018-04-131-3/+3
| | | | | | | | | nft xlate needs the full name, for ebtables it makes no difference, 'minute' would work too. Also fixup ' ' placement in xlate. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add initial translationsFlorian Westphal2018-04-116-0/+270
| | | | | | add translations for ip, limit, log, mark, mark_m, nflog. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: constify option structArushi Singhal2018-04-111-1/+1
| | | | | | | | The struct of type option is only used to initialise a field and is not modified anywhere. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxt_comment: silence truncation warningFlorian Westphal2018-04-101-4/+3
| | | | | | | | | | | gcc warned here: libxt_comment.c:62 output may be truncated before the last format character [-Wformat-truncation=] snprintf(comment, XT_MAX_COMMENT_LEN, "\"%s\"" ... It tells us that the '"' might not fit anymore, so increase output buffer size to make room for "" escapes too. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: CLUSTERIP: do not allow --local-node 0Pablo Neira Ayuso2018-03-301-1/+2
| | | | | | Makes no sense, fail in such a case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: CLUSTERIP: add testsPablo Neira Ayuso2018-03-281-0/+3
| | | | | | Add a few tests to catch regressions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_bpf: Fix build with old kernel versionsHauke Mehrtens2018-02-281-1/+2
| | | | | | | | | | | | | | | | In kernel 3.18 the union bpf_attr does not have a pathname attribute and BPF_OBJ_GET is also not defined in these versions. This was added in Linux commit b2197755b263 ("bpf: add support for persistent maps/progs"). Check for the BPF_FS_MAGIC define which was also added in this Linux commit and only activate this code in case we find that define. This fixes a build problem with Linux 3.18. Netfilter bug: #1231 Fixes: f17f9ace8a8 ("extensions: libxt_bpf: support ebpf pinned objects") Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extenstions: ecn: add tcp ecn/cwr translationFlorian Westphal2018-02-262-18/+37
| | | | | | nft can match tcp flags, so add ece/cwr translation. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: add tests for comp match optionsHarsha Sharma2018-02-252-5/+6
| | | | | | | | This patch adds test for ipcomp flow match specified by its SPI value and move tests for ipcomp protocol to libxt_policy.t Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: connmark: remove non-working translationFlorian Westphal2018-02-202-18/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ... and return 0 so output reflects that no translation was performed. iptables-translate -A I -j CONNMARK --save-mark --mask 0xff nft # -A I -j CONNMARK --save-mark --mask 0xff The translation that was performed: nft add rule ip mangle PREROUTING counter meta mark set ct mark and 0xff will clear (zero) most bits: [ meta load mark => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x000000ff ) ^ 0x00000000 ] [ ct set mark with reg 1 ] The xtables module however does this: newmark = (ct->mark & ~info->ctmask) ^ (skb->mark & info->nfmask); I.e., for ctmark mask defines what to clear, for nfmark what to keep, i.e. we're supposed to only alter the lower bits of the ctmark. nftables can't do this at the moment because bitwise operator RHS requires immediate values. same is true for 'restore'. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: prefer plain 'set' over 'set mark and'Florian Westphal2018-02-204-6/+12
| | | | | | | | | | | | | | adding a test case for MARK --set-mark 0 fails with exp: nft add rule ip mangle OUTPUT counter meta mark set 0x0 res: nft add rule ip mangle OUTPUT counter meta mark set mark and 0x0 This translation isn't wrong, but unneccessarily complex, so change order to first check if mask bits are all ones. In that case we can simply use an immediate value without need for logical operators. Signed-off-by: Florian Westphal <fw@strlen.de>
* policy: add nft translation for simple policy none/strict use caseFlorian Westphal2018-01-312-0/+32
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: hashlimit: remove space before burst in translation to nftPablo Neira Ayuso2018-01-291-1/+1
| | | | | | | | | | | | | | Fixes the following test: # python xlate-test.py extensions/libxt_hashlimit.txlate extensions/libxt_hashlimit.txlate: Fail src: iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit --hashlimit-upto 300 --hashlimit-burst 15 --hashlimit-mode srcip,dstip --hashlimit-name https --hashlimit-htable-expire 300000 -m state --state NEW -j DROP exp: nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr . ip saddr timeout 300s limit rate 300/second burst 15 packets} ct state new counter drop res: nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr . ip saddr timeout 300s limit rate 300/second burst 15 packets} ct state new counter drop 1 test file, 2 tests, 1 tests passed, 1 tests failed, 0 errors Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: hashlimit: Rename 'flow table' keyword to metershyam saini2018-01-292-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | After nft v0.8.1 "flow table" is renamed as meter. This should reflect in iptables to nftables translation. Before this patch: $ iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit --hashlimit-above 200/sec --hashlimit-mode srcip,dstport --hashlimit-name http1 -j DROP nft add rule ip filter INPUT tcp dport 80 flow table http1 { tcp dport . ip saddr limit rate over 200/second } counter drop After this patch: $ iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit --hashlimit-upto 200 --hashlimit-mode srcip --hashlimit-name http3 --hashlimit-srcmask 24 -j DROP nft add rule ip filter INPUT tcp dport 80 meter http3 { ip saddr and 255.255.255.0 limit rate 200/second } counter drop Signed-off-by: shyam saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: Add test for cluster nft translationShyam Saini2018-01-191-0/+26
| | | | | | | | | | | | This patch adds test cases for iptables to nft translation of cluster match This adds all test cases including corner cases. Run these test cases like: $ ./xlate-test.py extensions/libxt_cluster.txlate Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: ip6t_{S,D}NAT: add more testsThierry Du Tre2018-01-164-0/+4
| | | | | Signed-off-by: Thierry Du Tre <thierry@dtsystems.be> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: ip6t_{S,D}NAT: multiple to-dst/to-src arguments not reportedThierry Du Tre2018-01-166-12/+16
| | | | | | | | | | | | | | | | | | | | | | This patch is fixing the detection of multiple '--to-destination' in a DNAT rule and '--to-source' in SNAT rule for IPv6. Currently, when defining multiple values for these, only the last will be used and others ignored silently. The checks for (cb->xflags & F_X_TO_[DEST/SRC]) always fails because the flags are never set before. It seems to be a copy-paste artefact since introduction of the IPv6 DNAT/SNAT extensions based on IPv4 code. I also removed the kernel_version checks because they seem useless. Extensions for IPv6 DNAT/SNAT are using xt_target with revision 1. That seems only added since kernel version 3.7-rc1 and therefore the check for > v2.6.10 will always return true. The check is probably also coming from the IPv4 copy-paste. Add tests to cover this too, including the IPv4 side. Signed-off-by: Thierry Du Tre <thierry@dtsystems.be> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_cluster: Add translation to nftShyam Saini2018-01-161-0/+51
| | | | | | | | | | | | | | | | | | | | | | | Add translation for cluster to nft $ sudo iptables-translate -A PREROUTING -t mangle -i eth1 -m cluster --cluster-total-nodes 7 --cluster-local-node 5 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark 0xffff nft add rule ip mangle PREROUTING iifname eth1 jhash ct original saddr mod 7 seed 0xdeadbeef eq 5 meta pkttype set host counter meta mark set 0xffff $ sudo iptables-translate -A PREROUTING -t mangle -i eth1 -m cluster --cluster-total-nodes 7 --cluster-local-nodemask 5 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark 0xffff nft add rule ip mangle PREROUTING iifname eth1 jhash ct original saddr mod 7 seed 0xdeadbeef { 0, 2 } meta pkttype set host counter meta mark set 0xffff Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: add support for 'srh' matchAhmed Abdelsalam2018-01-122-0/+268
| | | | | | | | | This patch adds a new exetension to iptables to supprt 'srh' match The implementation considers revision 7 of the SRH draft. https://tools.ietf.org/html/draft-ietf-6man-segment-routing-header-07 Signed-off-by: Ahmed Abdelsalam <amsalam20@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: hashlimit: fix incorrect burst in translationsPablo Neira Ayuso2018-01-041-3/+5
| | | | | | | | | | | | | iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit --hashlimit-above 200kb/s --hashlimit-burst 1mb --hashlimit-mode srcip,dstport --hashlimit-name http2 --hashlimit-htable-expire 3000 -j DROP shows: nft add rule ip filter INPUT tcp dport 80 flow table http2 { tcp dport . ip saddr timeout 3s limit rate over 200 kbytes/second burst 1 mbytes burst 6 packets} counter drop which prints burst twice, this is not correct. Reported-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_hashlimit: Do not print default timeout and burstHarsha Sharma2017-12-281-8/+12
| | | | | | | | | | | | | | Do not print timeout and burst in case default values are used. For e.g. iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit --hashlimit-above 200/sec --hashlimit-mode srcip,dstport --hashlimit-name http1 -j DROP nft add rule ip filter INPUT tcp dport 80 flow table http1 { tcp dport . ip saddr limit rate over 200/second } counter drop Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: Add macro _DEFAULT_SOURCE.Varsha Rao2017-12-212-0/+2
| | | | | | | | | | | | | | | Define _DEFAULT_SOURCE as _BSD_SOURCE is deprecated. https://sourceware.org/glibc/wiki/Release/2.20#Packaging_Changes This patch fixes the following warning: warning: #warning "_BSD_SOURCE and _SVID_SOURCE are deprecated, use _DEFAULT_SOURCE" [-Wcpp] # warning "_BSD_SOURCE and _SVID_SOURCE are deprecated, use # _DEFAULT_SOURCE" Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: masquerade: add randomize-full supportMax Laverse2017-12-045-2/+40
| | | | | Signed-off-by: Max Laverse <max@laverse.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: patch to correct linker flag sequenceYogesh Prasad2017-12-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Description This patch will correct the sequence of -pie and -shared options. When used together, -pie should be provided to the linker before -shared. If -pie is provided after -shared, the linker throws an error shown below as example. ------------------------------------------------------------------------- /host/lib/gcc/powerpc-buildroot-linux-gnu/6.4.0/../../../.. /powerpc-buildroot-linux-gnu/bin/ld: BFD (GNU Binutils) 2.28.1 assertion fail elf32-ppc.c:8923 collect2: error: ld returned 1 exit status + ./libxt_SYNPROXY.man make[4]: *** [libxt_TCPOPTSTRIP.so] Error 1 + ./libip6t_mh.man /host/powerpc-buildroot-linux-gnu/sysroot/usr/lib/Scrt1.o:(.data+0x4): undefined reference to `main' /host/lib/gcc/powerpc-buildroot-linux-gnu + ./libxt_TCPMSS.man /6.4.0/../../../../powerpc-buildroot-linux-gnu/bin/ld: BFD (GNU Binutils) 2.28.1 assertion fail elf32-ppc.c:8923 collect2: error: ld returned 1 exit status ------------------------------------------------------------------------- Signed-off-by: Yogesh Prasad <yogesh.prasad@rockwellcollins.com> Signed-off-by: Matt Weber <matthew.weber@rockwellcollins.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_tcpmss: Add test case for invalid ranges.Varsha Rao2017-11-301-0/+1
| | | | | | | This patch adds test case for invalid MSS range. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: extensions: Fix MARK target helpMart Frauenlob2017-11-271-1/+1
| | | | | | | A typo in the help output of: iptables -j MARK -h. Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxt_sctp: fix array out of range in print_chunkhuaibin Wang2017-11-132-7/+4
| | | | | | | | | | | | | | | | | For chunk type ASCONF, ASCONF_ACK and FORWARD_TSN, sctp_chunk_names[].chunk_type is not equal to the corresponding index in sctp_chunk_names[]. Using this field leads to a segmentation fault (index out of range). Example $ iptables -A INPUT -p sctp --chunk-type all ASCONF,ASCONF_ACK,FORWARD_TSN -j ACCEPT $ iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Segmentation fault Signed-off-by: huaibin Wang <huaibin.wang@6wind.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: add tests for ipcomp protocolHarsha Sharma2017-10-241-0/+5
| | | | | | | This patch adds test for ipcomp protocol. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxt_recent: Remove ineffective checks for info->namePhil Sutter2017-10-201-2/+2
| | | | | | | | | | | | In struct xt_recent_mtinfo{,_v1}, field 'name' is an array, not a pointer. So there is no point in comparing it against NULL. Changing the check to make sure it's content is not an empty string is pointless either, since a non-empty default string is used and the argument parser will refuse empty strings as --name argument. So simply get rid of the checks altogether. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxt_TOS: add tests for translation infrastructureHarsha Sharma2017-10-171-0/+23
| | | | | | | This patch checks that the iptables TOS to nftables translation works fine. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: iptables-compat translation for TCPMSSAastha Gupta2017-10-171-0/+14
| | | | | | | | Since path mtu support was added, we can now add iptables-compat translation for TCPMSS extension. Signed-off-by: Aastha Gupta <aastha.gupta4104@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_tcpmss: Detect invalid rangesPhil Sutter2017-10-172-2/+6
| | | | | | | | | | | | Previously, an MSS range of e.g. 65535:1000 was silently accepted but would then never match a packet since the kernel checks whether the MSS value is greater than or equal to the first *and* less than or equal to the second value. Detect this as a parameter problem and update the man page accordingly. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: add test file for TCPMSS extensionAastha Gupta2017-10-171-0/+5
| | | | | | | This adds test file for the recently added TCPMSS extension. Signed-off-by: Aastha Gupta <aastha.gupta4104@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_bpf: fix missing __NR_bpf declarationRafael Buchbinder2017-09-101-0/+2
| | | | | | | This include is needed to compile the bpf_obj_get function properly, as it brings in the __NR_bpf declaration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: xt_hashlimit: add rate match modeVishwanath Pai2017-09-083-35/+384
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a new feature to hashlimit that allows matching on the current packet/byte rate without rate limiting. This can be enabled with a new flag --hashlimit-rate-match. The match returns true if the current rate of packets is above/below the user specified value. The main difference between the existing algorithm and the new one is that the existing algorithm rate-limits the flow whereas the new algorithm does not. Instead it *classifies* the flow based on whether it is above or below a certain rate. I will demonstrate this with an example below. Let us assume this rule: iptables -A INPUT -m hashlimit --hashlimit-above 10/s -j new_chain If the packet rate is 15/s, the existing algorithm would ACCEPT 10 packets every second and send 5 packets to "new_chain". But with the new algorithm, as long as the rate of 15/s is sustained, all packets will continue to match and every packet is sent to new_chain. This new functionality will let us classify different flows based on their current rate, so that further decisions can be made on them based on what the current rate is. This is how the new algorithm works: We divide time into intervals of 1 (sec/min/hour) as specified by the user. We keep track of the number of packets/bytes processed in the current interval. After each interval we reset the counter to 0. When we receive a packet for match, we look at the packet rate during the current interval and the previous interval to make a decision: if [ prev_rate < user and cur_rate < user ] return Below else return Above Where cur_rate is the number of packets/bytes seen in the current interval, prev is the number of packets/bytes seen in the previous interval and 'user' is the rate specified by the user. We also provide flexibility to the user for choosing the time interval using the option --hashilmit-interval. For example the user can keep a low rate like x/hour but still keep the interval as small as 1 second. To preserve backwards compatibility we have to add this feature in a new revision, so I've created revision 3 for hashlimit. The two new options we add are: --hashlimit-rate-match --hashlimit-rate-interval I have updated the help text to add these new options. Also added a few tests for the new options. Suggested-by: Igor Lubashev <ilubashe@akamai.com> Reviewed-by: Josh Hunt <johunt@akamai.com> Signed-off-by: Vishwanath Pai <vpai@akamai.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libip6t_icmp6: xlate: remove leftover spacePablo M. Bermudo Garay2017-06-061-2/+0
| | | | | | | | This change should have been included in commit f035be35c749 ("xtables-translate: fix multiple spaces issue"), but was forgotten. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: xlate: generalize ownerPablo M. Bermudo Garay2017-06-061-1/+1
| | | | | | | | | The owner name was hard-coded in the owner extension translation test. The translation process requires the user to exist in the system, so this commit replaces it with the usual UID_MIN value (1000). Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_hashlimit: fix 64-bit printf formatsJames Cowgill2017-04-141-7/+9
| | | | | | | | | | | | hashlimit was using "%lu" in a lot of printf format specifiers to print 64-bit integers. This is incorrect on 32-bit architectures because "long int" is 32-bits there. On MIPS, it was causing iptables to segfault when printing these integers. Fix by using the correct format specifier. Signed-off-by: James Cowgill <James.Cowgill@imgtec.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>