summaryrefslogtreecommitdiffstats
path: root/extensions
Commit message (Collapse)AuthorAgeFilesLines
...
* man: more backslash-encoding of charactersJan Engelhardt2023-11-132-3/+3
| | | | | | | | "-" is the dash, "\-" is minus as we know, but groff lists some more characters: "^" is "modifier circumflex" and "~" is "modifier tilde", which, too, need to be escaped for our use. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* extensions: libarpt_standard.t: Add a rule with builtin option masksPhil Sutter2023-11-091-0/+1
| | | | | | | | Just some random values in hope this starts failing if masks support changes or breaks. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* arptables: Fix --proto-type mask formattingPhil Sutter2023-11-091-0/+4
| | | | | | | | | | | | | | | | | | Arptables accepts numeric --proto-type values and masks in any numeral system identified by (absence of) prefix. Yet it prints the mask value in hex without '0x'-prefix, breaking save and restore the same way numeric --h-type output did. In theory, this could be fixed either by adding the missing prefix or printing the mask in decimal (like most other builtin matches do), but since the value is printed in hex with prefix already, align mask output with that. Also a day 1 bug and consistent with legacy, so no Fixes: tag here as well. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* arptables: Fix formatting of numeric --h-type outputPhil Sutter2023-11-091-1/+3
| | | | | | | | | | | | | | | | | Arptables expects numeric arguments to --h-type option in hexadecimal form, even if no '0x'-prefix is present. In contrast, it prints such values in decimal. This is not just inconsistent, but makes it impossible to save and later restore a ruleset without fixing up the values in between. Assuming that the parser side can't be changed for compatibility reasons, fix the output side instead. This is a day 1 bug and present in legacy arptables as well, so treat this as a "feature" of arptables-nft and omit a Fixes: tag. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* extensions: MARK: fix arptables supportFlorian Westphal2023-11-072-0/+11
| | | | | | | | | | | | arptables "--set-mark" is really just "--or-mark". This bug is also in arptables-legacy. Fix this and add test cases. Note that the test for "16" vs. "0x16" is intentional, arptables parser is buggy and always uses "%x". Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables-txlate: add test casesFlorian Westphal2023-11-072-0/+12
| | | | | | | | | | | | | | | Add test cases for libarpt_mangle and extend the generic tests to cover basic arptables matches. Note that there are several historic artefacts that could be revised. For example, arptables-legacy and arptables-nft both ignore "-p" instead of returning an error about an unsupported option. The ptype could be hard-wired to 0x800 and set unconditionally. OTOH, this should always match for ethernet arp packets anyway. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-arp: add arptables-translateFlorian Westphal2023-11-071-0/+47
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables-nft: remove ARPT_INV flags usageFlorian Westphal2023-11-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | ARPT_ and IPT_INV flags are not interchangeable, e.g.: define IPT_INV_SRCDEVADDR 0x0080 define ARPT_INV_SRCDEVADDR 0x0010 as these flags can be tested by libarp_foo.so such checks can yield incorrect results. Because arptables-nft uses existing code, e.g. xt_mark, it makes sense to unify this completely by converting the last users of ARPT_INV_ constants. Note that arptables-legacy does not do run-time module loading via dlopen(). Functionaliy implemented by "extensions" in the arptables-legacy git tree are built-in, so this doesn't break arptables-legacy binaries. Fixes: 44457c080590 ("xtables-arp: Don't use ARPT_INV_*") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: reveal rateest's combination categoriesPhil Sutter2023-10-271-4/+8
| | | | | | | | The .\" prefix made these paragraphs invisible in at least regular man page output. Turn them into tags instead. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: use .TP for lists in xt_osf man pagePhil Sutter2023-10-271-12/+22
| | | | | | | | Value and description are more clearly set apart. Using .RS/.RE pairs also adds proper indenting. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: use native bullet point markupJan Engelhardt2023-10-271-12/+17
| | | | | | | | Replace some "fake" bullet point by the official syntax/markup for bulleted lists. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: grammar fixes to some manpagesJan Engelhardt2023-10-272-6/+6
| | | | | | | | | English generally uses open compounds rather than closed ones; fix the excess hyphens in words. Fix a missing dash for the portnr option as well. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: consistent casing of "IPv[46]"Jan Engelhardt2023-10-272-2/+2
| | | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: encode hyphens the way groff/man requires itJan Engelhardt2023-10-272-2/+2
| | | | | | | | | | Edit a few spots where indeed a hyphens (U+2010) rather than U+002D is desired. ("set-name" is not something you input, it is a placeholder in the context of documentation. "out-of-flow" is part of the regular flowed text, so should not use anything but hyphens.) Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: encode emdash the way groff/man requires itJan Engelhardt2023-10-274-4/+4
| | | | | | | | | Unlike LaTeX, two/three U+002D in the source do not translate to an en and em-dash in man. Using \(en and \(em, respectively, addresses this. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: encode minushyphen the way groff/man requires itJan Engelhardt2023-10-2726-51/+54
| | | | | | | | | | | | | | Sparked by a recent LWN article[1], sweeps over the iptables manpages for incorrectly encoded dashes was made by Phil Sutter and myself. An ASCII minushyphen in the source manpage translates to a hyphen in output, so one has to use the sequence "\-" to get a minushyphen in the output, as groff_char(7) explains. [1] https://lwn.net/Articles/947941/ (paywalled until about 2023-11-06) Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: display number ranges with an en dashJan Engelhardt2023-10-274-11/+11
| | | | | | | | For ranges, en dashes should be used; cf. e.g. https://en.wikipedia.org/wiki/Dash#En_dash . Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: string: Adjust description of --to to recent kernel changesPhil Sutter2023-10-251-6/+3
| | | | | | | | | | | | | | This reverts commit 920ece2b392fb83bd26416e0e6f8f6a847aacbaa. Since kernel commit c4eee56e14fe ("net: skb_find_text: Ignore patterns extending past 'to'"), pattern scanning no longer happens past --to offset even if skb_seq_read() returned a larger block. Point this out in the description and also drop the '-1' offset which is not true as kernel's selftest in tools/testing/selftests/netfilter/xt_string.sh shows. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1707 Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: string: Clarify description of --toPhil Sutter2023-10-121-2/+6
| | | | | | | | String match indeed returns a match as long as the given pattern starts in the range of --from and --to, update the text accordingly. Also add a note regarding fragment boundaries. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1707
* nft: Fix for useless meta expressions in rulePhil Sutter2023-09-143-0/+9
| | | | | | | | | | | | | | | | | | | A relict of legacy iptables' mandatory matching on interfaces and IP addresses is support for the '-i +' notation, basically a "match any input interface". Trying to make things better than its predecessor, iptables-nft boldly optimizes that nop away - not entirely though, the meta expression loading the interface name was left in place. While not a problem (apart from pointless overhead) in current HEAD, v1.8.7 would trip over this as a following cmp expression (for another match) was incorrectly linked to that stale meta expression, loading strange values into the respective interface name field. While being at it, merge and generalize the functions into a common one for use with ebtables' NFT_META_BRI_(I|O)IFNAME matches, too. Fixes: 0a8635183edd0 ("xtables-compat: ignore '+' interface name") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1702 Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Fix checking of conntrack --ctproto 0Quentin Armitage2023-09-142-9/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are three issues in the code: 1) the check (sinfo->invflags & XT_INV_PROTO) is using the wrong mask 2) in conntrack_mt_parse it is testing (info->invert_flags & XT_INV_PROTO) before the invert bit has been set. 3) the sense of the error message is the wrong way round 1) To get the error, ! -ctstatus XXX has to be specified, since XT_INV_PROTO == XT_CONNTRACK_STATUS e.g. | iptables -I CHAIN -m conntrack ! --ctstatus ASSURED --ctproto 0 ... 3) Unlike --proto 0 (where 0 means all protocols), in the conntrack match --ctproto 0 appears to mean protocol 0, which can never be. Therefore --ctproto 0 could never match and ! --ctproto 0 will always match. Both of these should be rejected, since the user clearly cannot be intending what was specified. The attached patch resolves the issue, and also produces an error message if --ctproto 0 is specified (as well as ! --ctproto 0 ), since --ctproto 0 will never match, and ! --ctproto 0 will always match. [Phil: - Added Fixes: tag - it's a day 1 bug - Copied patch description from Bugzilla - Reorganized changes to reduce diff - Added test cases] Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=874 Fixes: 5054e85be3068 ("general conntrack match module userspace support files") Signed-off-by: Quentin Armitage <quentin@armitage.org.uk> Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: fix example of xt_cpuVictor Julien2023-08-291-2/+2
| | | | | | | | | REDIRECT uses --to-ports instead of --to-port. Fixes: 2d59208943a3 ("extension: add xt_cpu match") Signed-off-by: Victor Julien <victor@inliniac.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* Use SOCK_CLOEXEC/O_CLOEXEC where availablePhil Sutter2023-08-101-7/+1
| | | | | | | | | | | | No need for the explicit fcntl() call, request the behaviour when opening the descriptor. One fcntl() call setting FD_CLOEXEC remains in extensions/libxt_bpf.c, the indirect syscall seems not to support passing the flag directly. Reported-by: Gaurav Gupta <g.gupta@samsung.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1104 Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libip6t_icmp: Add names for mld-listener typesPhil Sutter2023-08-052-0/+11
| | | | | | | Add the three names (plus one alias) just as in nftables. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1250 Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: Use HTTPS for links to netfilter.orgPhil Sutter2023-08-051-1/+1
| | | | | | | The browser is redirected there anyway, but who cares about such minor details nowadays. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libipt_icmp.t: Enable tests with numeric outputPhil Sutter2023-08-041-6/+3
| | | | | | | | | | Unrelated to the question whether numeric (save) output is desired or not, enable the tests and expect the known format. Using --list without --numeric prints the names, BTW. Fixes: 49d5b7277c7f2 ("extensions: libipt_icmp: add unit test") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libipt_icmp: Fix confusion between 255/255 and anyPhil Sutter2023-08-042-1/+4
| | | | | | | | | | | | | | | | Per definition, ICMP type "any" is type 255 and the full range of codes (0-255). Save callback though ignored the actual code values, printing "any" for every type 255 match. This at least confuses users as they can't find their rule added as '--icmp-type 255/255' anymore. It is not entirely clear what the fixed commit was trying to establish, but the save output is certainly not correct (especially since print callback gets things right). Reported-by: Amelia Downs <adowns@vmware.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1600 Fixes: fc9237da4e845 ("Fix '-p icmp -m icmp' issue (Closes: #37)") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: string: document BM false negativesJeremy Sowden2023-06-161-0/+15
| | | | | | | | | | For non-linear skb's there's a possibility that the kernel's Boyer-Moore text-search implementation may miss matches. There's a warning about this in the kernel source. Include that warning in the man-page. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1390 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix parsing of option arguments in same wordPhil Sutter2023-04-282-0/+5
| | | | | | | | | | | | | | | | When merging commandline parsers, a decision between 'argv[optind - 1]' and 'optarg' had to be made in some spots. While the implementation of check_inverse() required the former, use of the latter allows for the common syntax of '--opt=arg' or even '-oarg' as 'optarg' will point at the suffix while 'argv[optind - 1]' will just point at the following option. Fix the mess by making check_inverse() update optarg pointer if needed so calling code may refer to and always correct 'optarg'. Fixes: 0af80a91b0a98 ("nft: Merge xtables-arp-standalone.c into xtables-standalone.c") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1677 Signed-off-by: Phil Sutter <phil@nwl.cc>
* xt_sctp: add the missing chunk types in sctp_helpXin Long2023-02-211-1/+1
| | | | | | | | | | | | | Add the missing chunk types in sctp_help(), so that the help cmd can display these chunk types as below: # iptables -p sctp --help chunktypes - ... I_DATA RE_CONFIG PAD ... I_FORWARD_TSN ALL NONE Fixes: 6b04d9c34e25 ("xt_sctp: support a couple of new chunk types") Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Support insert with indexPhil Sutter2023-02-171-1/+1
| | | | | | | | | Translation is pretty simple due to nft's 'insert rule ... index' support. Testing the translation is sadly not: index 1 vanishes (as it should), higher indexes are rejected in replay mode since no rules previously exist. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_ip: Translation has to match on ether typePhil Sutter2023-02-172-3/+24
| | | | | | | | | | | | | | On one hand, nft refuses th expression in bridge family if layer3 protocol has not been assured by a previous match. On the other, ebt_ip kernel module will only match on IPv4 packets, so there might be a functional change in the translation versus the original. Instead of just always emitting an 'ether type' match, decide whether it's actually needed - explicit "ip <something>" payload matches (or icmp ones) cause implicit creation of a match on IPv4 by nft. Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_ip: Do not use 'ip dscp' for translationPhil Sutter2023-02-172-3/+3
| | | | | | | | | Converting from TOS field match to DSCP one is irreversible, so replay testing is not possible. Use a raw payload expression to produce something that translates 1:1 back into an 'ip' match. Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_redirect: Fix for wrong syntax in translationPhil Sutter2023-02-172-4/+4
| | | | | | | Meta key comes before 'set' in meta statement. Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_redirect: Fix target translationPhil Sutter2023-02-172-1/+9
| | | | | | | | | While EBT_ACCEPT is the default verdict for ebtables targets, omitting it from translation implicitly converts it into 'continue'. Omit the non-default EBT_CONTINUE instead. Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: CLUSTERIP: Drop test filePhil Sutter2023-02-171-4/+0
| | | | | | | The extension was removed from kernel, do not test for it anymore. Keep the code alive though, to not break existing setups. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Refuse unselected targets' optionsPhil Sutter2023-01-315-18/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | Unlike legacy, ebtables-nft would allow e.g.: | -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be While the result is correct, it may mislead users into believing multiple targets are possible per rule. Better follow legacy's behaviour and reject target options unless they have been "enabled" by a previous '-j' option. To achieve this, one needs to distinguish targets from watchers also attached to 'xtables_targets' and otherwise behaving like regular matches. Introduce XTABLES_EXT_WATCHER to mark the two. The above works already, but error messages are misleading when using the now unsupported syntax since target options have been merged already. Solve this by not pre-loading the targets at all, code will just fall back to loading ad '-j' parsing time as iptables does. Note how this also fixes for 'counter' statement being in wrong position of ebtables-translate output. Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: NAT: Fix for -Werror=format-securityPhil Sutter2023-01-121-1/+1
| | | | | | | Have to pass either a string literal or format string to xt_xlate_add(). Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE") Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Replace brace expansionPhil Sutter2023-01-101-2/+3
| | | | | | | | | According to bash(1), it is not supported by "historical versions of sh". Dash seems to be such a historical version. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Fixes: 3822a992bc277 ("Makefile: Fix for 'make distcheck'") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Reject tcp/udp extension without proper protocol matchPhil Sutter2022-12-222-0/+6
| | | | | | | | | Internally, 'th' expression is used, which works but matches both protocols. Since users won't expect '-m tcp --dport 1' to match UDP packets, catch missing/wrong '-p' argument. Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Fix for 'make distcheck'Phil Sutter2022-12-141-1/+14
| | | | | | | | | Since extensions/ directory does not use automake, some targets have to be added manually. Apart from that, several Makefiles either missed to specify relevant files or did not specify them correctly for 'make dist' to add them to the tarball. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Makefile: Merge initext targetsPhil Sutter2022-12-141-92/+14
| | | | | | | Abstract initext*.c and .initext*.dd stamp file recipes so a single one serves for all variants. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Fix MAC address match translationPhil Sutter2022-12-021-1/+1
| | | | | | | If a mask was present, ebtables-translate would emit illegal syntax. Fixes: 5e2b473a64bc7 ("xtables-compat: extend generic tests for masks and wildcards") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Fix for interfaces with asterisk mid-stringPhil Sutter2022-12-021-7/+7
| | | | | | | | | | | | | For nft, asterisk is special at end of the interface name only. Escaping it mid-string makes the escape char part of the interface name, so avoid this. In the test case, also drop the ticks around interface names in *-translate command - since there's no shell involved which would eat them, they become part of the interface name. Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: add xt_statistics random mode translationFlorian Westphal2022-12-012-2/+8
| | | | | | | Use meta random and bitops to replicate what xt_statistics is doing. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: change expected output for new formatFlorian Westphal2022-11-3081-402/+402
| | | | | | | | Now that xtables-translate encloses the entire command line in ', update the test cases accordingly. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xlate: get rid of escape_quotesFlorian Westphal2022-11-306-38/+13
| | | | | | | | | | | | | | | | Its not necessary to escape " characters, we can let xtables-translate print the entire translation/command enclosed in '' chracters, i.e. nft 'add rule ...', this also takes care of [, { and other special characters that some shells might parse otherwise (when copy-pasting translated output). The escape_quotes struct member is retained to avoid an ABI breakage. This breaks all xlate test cases, fixup in followup patches. v3: no need to escape ', replace strcmp(x, "") with x[0] (Phil Sutter) Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: xlate: Format sets consistentlyPhil Sutter2022-11-294-14/+10
| | | | | | Print a space after separating commas. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libxt_conntrack: Drop extra whitespace in xlatePhil Sutter2022-11-293-4/+3
| | | | | | | | No point in having this. Interestingly, other test cases even made up for it. Fixes: 0afd957f6bc03 ("extensions: libxt_state: add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Leverage xlate auto-spacingPhil Sutter2022-11-299-79/+42
| | | | | | Drop code which is used explicitly to deal with spacing. Signed-off-by: Phil Sutter <phil@nwl.cc>