summaryrefslogtreecommitdiffstats
path: root/extensions
Commit message (Collapse)AuthorAgeFilesLines
* xshared: Fix parsing of empty string arg in '-c' optionPhil Sutter2024-04-101-0/+5
| | | | | | | | | | | | | | Calling iptables with '-c ""' resulted in a call to strchr() with an invalid pointer as 'optarg + 1' points to past the buffer. The most simple fix is to drop the offset: The global optstring part specifies a single colon after 'c', so getopt() enforces a valid pointer in optarg. If it contains a comma at first position, packet counter value parsing will fail so all cases are covered. Reported-by: gorbanev.es@gmail.com Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741 Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xlate: libip6t_mh: Fix and simplify plain '-m mh' matchPhil Sutter2024-04-092-4/+2
| | | | | | | | | | Since core xlate code now ignores '-p mh' if an mh extension is also present in the rule, mh extension has to emit the l4proto match itself. Therefore emit the exthdr match irrespective of '-p' argument value just like other IPv6 extension header matches do. Fixes: 83f60fb37d594 ("extensions: mh: Save/xlate inverted full ranges") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xlate: Improve redundant l4proto match avoidancePhil Sutter2024-04-091-3/+3
| | | | | | | | | | | | | | | xtables-translate tries to avoid 'ip protocol'/'meta l4proto' matches if following expressions add this as dependency anyway. E.g.: | # iptables-translate -A FOO -p tcp -m tcp --dport 22 -j ACCEPT | nft 'add rule ip filter FOO tcp dport 22 counter accept' This worked by searching protocol name in loaded matches, but that approach is flawed as the protocol name and corresponding extension may differ ("mobility-header" vs. "mh"). Improve this by searching for all names (cached or resolved) for a given protocol number. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: xt_TPROXY: add txlate supportFlorian Westphal2024-03-092-0/+79
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: xt_socket: add txlate support for socket matchFlorian Westphal2024-03-062-0/+51
| | | | | | | | | | | | | | | | | | | v2: document the match semantics of -m socket. Ignore --nowildcard if used with other options when translating and add "wildcard 0" if the option is missing. "-m socket" will ignore sockets bound to 0.0.0.0/:: by default, unless --nowildcard is given. So, xlate must always append "wildcard 0", can elide "wildcard" if other options are present along with --nowildcard. To emulate "-m socket --nowildcard", check for "wildcard <= 1" to get a "socket exists" type matching. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Leverage stored protocol namesPhil Sutter2024-02-291-0/+30
| | | | | | | | | | | Align output of ip(6)tables-translate for --protocol arguments with that of ip(6)tables -L/-S by calling proto_to_name() from xshared.c. The latter will consult xtables_chain_protos list first to make sure (the right) names are used for "common" protocol values and otherwise falls back to getprotobynumber() which it replaces here. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1738 Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Respect min/max values when completing rangesPhil Sutter2024-02-021-2/+2
| | | | | | | | If an extension defines a minimum/maximum valid value for an option's range argument, treat this as the lower/upper boundary to use when completing (half) open ranges. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: tcp/udp: Save/xlate inverted full rangesPhil Sutter2024-02-026-43/+64
| | | | | | | | Also translate a bare '-m tcp/udp' to 'meta l4proto' match. Fixes: 04f569ded54a7 ("extensions: libxt_udp: add translation to nft") Fixes: fb2593ebbf656 ("extensions: libxt_tcp: add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Do not omit full ranges if invertedPhil Sutter2024-02-022-4/+4
| | | | | | | Otherwise this turns a never matching rule into an always matching one. Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ipcomp: Save inverted full rangesPhil Sutter2024-02-022-4/+5
| | | | | Fixes: 0bb8765cc28cf ("iptables: Add IPv4/6 IPcomp match support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: esp: Save/xlate inverted full rangesPhil Sutter2024-02-023-13/+23
| | | | | | | | | Also add a translation for plain '-m esp' match which depends on the address family: While ip6tables-translate may emit an exthdr exists match, iptables-translate must stick to meta l4proto. Fixes: 6cfa723a83d45 ("extensions: libxt_esp: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: rt: Save/xlate inverted full rangesPhil Sutter2024-02-023-11/+23
| | | | | | | Also translate plain '-m rt' match into an exthdr exists one. Fixes: 9dbb616c2f0c3 ("extensions: libip6t_rt.c: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: mh: Save/xlate inverted full rangesPhil Sutter2024-02-023-7/+19
| | | | | | | | | Also translate '-m mh' into an exthdr exists match unless '-p mh' is also present. The latter is converted into 'meta l4proto mh' which might need fixing itself at a later point. Fixes: 6d4b93485055a ("extensions: libip6t_mh: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: frag: Save/xlate inverted full rangesPhil Sutter2024-02-023-12/+21
| | | | | | | Also translate plain '-m frag' match into an exthdr exists one. Fixes: bd5bbc7a0fbd8 ("extensions: libip6t_frag: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ah: Save/xlate inverted full rangesPhil Sutter2024-02-026-23/+33
| | | | | | | | | | | While at it, fix xlate output for plain '-m ah' matches: With ip6tables-translate, one should emit an extdhr exists match since ip6t_ah.c in kernel also uses ipv6_find_hdr(). With iptables-translate, a simple 'meta l4proto ah' was missing. Fixes: bb498c8ba7bb3 ("extensions: libip6t_ah: Fix translation of plain '-m ah'") Fixes: b9a46ee406165 ("extensions: libipt_ah: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Reject negative port rangesPhil Sutter2024-02-023-8/+8
| | | | | | | Analogous to XTTYPE_UINT*RC value parsing, assert consecutive port values are not lower than previous ones. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Assert ranges are monotonic increasingPhil Sutter2024-02-0210-24/+17
| | | | | | | | | | | Extensions commonly require the upper range value to be larger or equal to the lower one. Performing this check in the parser is easier and covers all extensions at once. One notable exception is NFQUEUE which requires strict monotonicity. Hence leave its checks in place. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: *.t/*.txlate: Test range corner-casesPhil Sutter2024-02-0226-0/+253
| | | | | | | | | | | For every extension option accepting a range, test open and half-open as well as single element and invalid (negative) ranges. The added tests merely reflect the status quo, not the expected outcome. Following patches will fix results and the already existing test cases highlight the fixes' effects. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Increase non-fast mode strictnessPhil Sutter2024-02-012-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | The simple search for the rule in save output accepted arbitrary leading and trailing rule parts. This was partly desired as it allowed to omit the leading '-A' flag or ignore the mandatory '-j CONTINUE' in ebtables rules, though it could hide bugs. Introduction of fast mode mitigated this due to the way how it searches for multiple rules at the same time, but there are cases which fast mode does not support yet (e.g. test cases containing variant-specific rule output). Given save output format will never contain the rule in first or last line, so enclosing the searched rule in newline characters is sufficient to make the search apply to full lines only. The only drawback is having to add '-A' and '-j CONTINUE' parts if needed. The hidden bugs this revealed were: - Long --nflog-prefix strings are not cut to 64 chars with iptables-nft - The TCPMSS rule supposed to fail with legacy only must specify an expected save output Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_stp: fix range checkingFlorian Westphal2024-01-251-1/+1
| | | | | | | | | | | | | | This has to either consider ->nvals > 1 or check the values post-no-range-fixup: ./iptables-test.py extensions/libebt_stp.t extensions/libebt_stp.t: ERROR: line 12 (cannot load: ebtables -A INPUT --stp-root-cost 1) (it tests 0 < 1 and fails, but test should be 1 < 1). Fixes: dc6efcfeac38 ("extensions: libebt_stp: Use guided option parser") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Default to extrapositioned negationsPhil Sutter2024-01-1023-164/+165
| | | | | | | | | | | | | | | ebtables-nft has always supported both intra- and extrapositioned negations but defaulted to intrapositioned when printing/saving rules. With commit 58d364c7120b5 ("ebtables: Use do_parse() from xshared") though, it started to warn about intrapositioned negations. So change the default to avoid mandatory warnings when e.g. loading previously dumped rulesets. Also adjust test cases, help texts and ebtables-nft.8 accordingly. Cc: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libxt_HMARK: Review HMARK_parse()Phil Sutter2024-01-101-51/+9
| | | | | | | | * With XTOPT_NBO support in UINT types, the manual byteorder conversion calls are no longer needed * Setting bits in cb->xflags is done by xtables_option_parse() already * Since O_HMARK_* values match XT_HMARK_* ones, all but the O_HMARK_TYPE case fold together into a single default one
* extensions: libebt_mark_m: Use guided option parserPhil Sutter2024-01-101-36/+22
| | | | | | | Can't use XTTYPE_MARKMASK32 here because in 'val/mask', 'val' is optional. Would have to extend xtopt_parse_markmask() to accept this, maybe guarded by a new XTOPT_ flag to avoid unexpected changes in behaviour?
* extensions: libebt_pkttype: Use guided option parserPhil Sutter2024-01-101-22/+23
| | | | | Not much to gain here. Maybe implement number parsing with fallback to get rid of that part from extension parsers?
* extensions: libxt_limit: Use guided option parser for NFPROTO_BRIDGE, tooPhil Sutter2024-01-101-48/+2
|
* extensions: libebt_arp: Use guided option parserPhil Sutter2024-01-102-130/+78
|
* extensions: libebt_vlan: Use guided option parserPhil Sutter2024-01-101-68/+34
|
* extensions: libebt_802_3: Use guided option parserPhil Sutter2024-01-102-55/+21
|
* extensions: libebt_redirect: Use guided option parserPhil Sutter2024-01-101-23/+17
|
* extensions: libebt_snat: Use guided option parserPhil Sutter2024-01-102-42/+34
|
* extensions: libebt_nflog: Use guided option parserPhil Sutter2024-01-101-64/+18
|
* extensions: libebt_mark: Use guided option parserPhil Sutter2024-01-101-86/+54
|
* extensions: libebt_log: Use guided option parserPhil Sutter2024-01-101-91/+30
|
* extensions: libebt_ip: Use guided option parserPhil Sutter2024-01-102-123/+84
|
* extensions: libebt_ip6: Use guided option parserPhil Sutter2024-01-102-124/+83
|
* extensions: libebt_dnat: Use guided option parserPhil Sutter2024-01-101-37/+27
|
* extensions: libebt_arpreply: Use guided option parserPhil Sutter2024-01-102-34/+22
|
* extensions: libebt_stp: Use guided option parserPhil Sutter2024-01-102-160/+100
|
* extensions: libebt_*: Drop some needless init callbacksPhil Sutter2024-01-104-42/+0
| | | | Extension data is zero by default.
* build: replace `echo -e` with `printf`Jeremy Sowden2023-12-151-3/+3
| | | | | | | | | | | | | | | | | | | | | | `echo -e` is not portable and we can end up with: GEN matches.man -e + ./libxt_addrtype.man -e + ./libip6t_ah.man -e + ./libipt_ah.man -e + ./libxt_bpf.man -e + ./libxt_cgroup.man -e + ./libxt_cluster.man -e + ./libxt_comment.man -e + ./libxt_connbytes.man -e + ./libxt_connlabel.man -e + ./libxt_connlimit.man -e + ./libxt_connmark.man -e + ./libxt_conntrack.man [...] Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: add an automake verbosity variable for `ln`Jeremy Sowden2023-12-151-6/+9
| | | | | Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: use standard automake verbosity variablesJeremy Sowden2023-12-151-17/+24
| | | | | | | | | | The previous implementation ignored the default verbosity defined by configure, and controlled by --{enable,disable}-silent-rules, and treated V="" as V=0. Instead, follow the guide-lines given in the automake manual. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: remove unused `AM_VERBOSE_CXX*` variablesJeremy Sowden2023-12-151-2/+0
| | | | | | | There is no C++, so these variables are not required. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: remove obsolete `AM_LIBTOOL_SILENT` variableJeremy Sowden2023-12-151-1/+0
| | | | | | | It doesn't do anything, so get rid of it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: format `AM_CPPFLAGS` variablesJeremy Sowden2023-12-151-1/+9
| | | | | Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Fix spelling mistakesJeremy Sowden2023-12-124-5/+5
| | | | | | | | Corrections for several spelling mistakes, typo's and non-native usages in man-pages and error-messages. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: Do not escape exclamation marksPhil Sutter2023-11-292-2/+2
| | | | | | | | | | This appears to be not necessary, also mandoc complains about it: | mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \! Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage") Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: proper roff encoding for ~ and ^Jan Engelhardt2023-11-272-3/+3
| | | | | | Fixes: v1.8.10-28-g4b0c168a Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: MARK: arptables: Use guided option parserPhil Sutter2023-11-231-67/+15
| | | | | | | | | | | It expects mark values in hex which is possible by setting the base field. The only adjustment needed to use the revision 2 parser is to fill the mask for --set-mark: With XTTYPE_MARKMASK32, an omitted mask sets all mask bits, XTTYPE_UINT32 leaves it uninitialized, though. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libarpt_mangle: Use guided option parserPhil Sutter2023-11-232-84/+48
| | | | | | | | | | | | | Sadly not the best conversion, struct arpt_mangle is not ideal for use as storage backend: With MAC addresses, xtopt_parse_ethermac() refuses to write into *_devaddr fields as they are larger than expected. With XTTYPE_HOSTMASK OTOH, XTOPT_PUT is not supported in the first place. As a side-effect, network names (from /etc/networks) are no longer accepted. But earlier migrations to guided option parser had this side-effect as well, so probably not a frequently used feature. Signed-off-by: Phil Sutter <phil@nwl.cc>