summaryrefslogtreecommitdiffstats
path: root/iptables/ip6tables.c
Commit message (Collapse)AuthorAgeFilesLines
* iptables: Remove const qualifier from struct option.Varsha Rao2017-12-211-1/+1
| | | | | | | | | | | | | As opts is reassigned multiple times, it cannot be made constant. So remove const qualifier from structure option. This patch fixes the following warning: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] .orig_opts = original_opts, Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Constify option structHarsha Sharma2017-10-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The struct of type option is only used to initialise a field inside the xtables_globals struct and is not modified anywhere. Done using following coccinelle semantic patch @r1 disable optional_qualifier@ identifier s,i; position p; @@ static struct option i@p[] ={...}; @ok1@ identifier r1.i; expression e; position p; @@ e = i@p @bad@ position p != {r1.p,ok1.p}; identifier r1.i; @@ e@i@p @depends on !bad disable optional_qualifier@ identifier r1.i; @@ static +const struct option i[] = { ... }; Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: insist that the lock is held.Lorenzo Colitti2017-05-291-9/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, iptables programs will exit with an error if the iptables lock cannot be acquired, but will silently continue if the lock cannot be opened at all. This can cause unexpected failures (with unhelpful error messages) in the presence of concurrent updates, which can be very difficult to find in a complex or multi-administrator system. Instead, refuse to do anything if the lock cannot be acquired. The behaviour is not affected by command-line flags because: 1. In order to reliably avoid concurrent modification, all invocations of iptables commands must follow this behaviour. 2. Whether or not the lock can be opened is typically not a run-time condition but is likely to be a configuration error. Existing systems that depended on things working mostly correctly even if there was no lock might be affected by this change. However, that is arguably a configuration error, and now that the iptables lock is configurable, it is trivial to provide a lock file that is always accessible: if nothing else, the iptables binary itself can be used. The lock does not have to be writable, only readable. Tested by configuring the system to use an xtables.lock file in a non-existent directory and observing that all commands failed. Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-restore: support acquiring the lock.Lorenzo Colitti2017-03-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, ip[6]tables-restore does not perform any locking, so it is not safe to use concurrently with ip[6]tables. This patch makes ip[6]tables-restore wait for the lock if -w was specified. Arguments to -w and -W are supported in the same was as they are in ip[6]tables. The lock is not acquired on startup. Instead, it is acquired when a new table handle is created (on encountering '*') and released when the table is committed (COMMIT). This makes it possible to keep long-running iptables-restore processes in the background (for example, reading commands from a pipe opened by a system management daemon) and simultaneously run iptables commands. If -w is not specified, then the command proceeds without taking the lock. Tested as follows: 1. Run iptables-restore -w, and check that iptables commands work with or without -w. 2. Type "*filter" into the iptables-restore input. Verify that a) ip[6]tables commands without -w fail with "another app is currently holding the xtables lock...". b) ip[6]tables commands with "-w 2" fail after 2 seconds. c) ip[6]tables commands with "-w" hang until "COMMIT" is typed into the iptables-restore window. 3. With the lock held by an ip6tables-restore process: strace -e flock /tmp/iptables/sbin/iptables-restore -w 1 -W 100000 shows 11 calls to flock and fails. 4. Run an iptables-restore with -w and one without -w, and check: a) Type "*filter" in the first and then the second, and the second exits with an error. b) Type "*filter" in the second and "*filter" "-S" "COMMIT" into the first. The rules are listed only when the first copy sees "COMMIT". Signed-off-by: Narayan Kamath <narayan@google.com> Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: remove duplicated argument parsing codeLorenzo Colitti2017-03-171-46/+16
| | | | | | | | | | 1. Factor out repeated code to a new xs_has_arg function. 2. Add a new parse_wait_time option to parse the value of -w. 3. Make parse_wait_interval take argc and argv so its callers can be simpler. Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: on revision mismatch, do not call print/saveWillem de Bruijn2016-12-111-4/+14
| | | | | | | | Between revisions, the layout of xtables data may change completely. Do not interpret the data in a revision M with a module of revision N. Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Add an interval option for xtables lock waitSubash Abhinov Kasiviswanathan2016-07-031-3/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ip[6]tables currently waits for 1 second for the xtables lock to be freed if the -w option is used. We have seen that the lock is held much less than that resulting in unnecessary delay when trying to acquire the lock. This problem is even severe in case of latency sensitive applications. Introduce a new option 'W' to specify the wait interval in microseconds. If this option is not specified, the command sleeps for 1 second by default. v1->v2: Change behavior to take millisecond sleep as an argument to -w as suggested by Pablo. Also maintain current behavior for -w to sleep for 1 second as mentioned by Liping. v2->v3: Move the millisecond behavior to a new option as suggested by Pablo. v3->v4: Use select instead of usleep. Sleep every iteration for the time specified in the "-W" argument. Update man page. v4->v5: Fix compilation error when enabling nftables v5->v6: Simplify -W so it only takes the interval wait in microseconds. Bail out if -W is specific but -w is not. Joint work with Pablo Neira. Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip6tables: Warn about use of DROP in nat tableThomas Woerner2016-06-151-0/+7
| | | | | | | Clone of 1eada72b with 9bb76094 and e0390bee on top. Signed-off-by: Thomas Woerner <twoerner@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Spelling fixesVille Skyttä2015-09-071-6/+8
| | | | | | | While at it, update comment format for the respective blocks. Signed-off-by: Ville Skyttä <ville.skytta@iki.fi> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: add optional [seconds] argument to -wJiri Popelka2014-07-251-7/+19
| | | | | | | | | | | | | | | | | | | | | | This patch adds an optional numeric argument to -w option (added with 93587a0) so one can specify how long to wait for an exclusive lock. If the value isn't specified it works as before, i.e. program waits indefinitely. If user specifies it, program exits after the given time interval passes. This patch also adds the -w/--wait to nftables compat code, so the parser doesn't complain. [ In the original patch, iptables-compat -w X was not working, I have fixed by adding the dummy code not to break scripts using the new optional argument --pablo ] Signed-off-by: Jiri Popelka <jpopelka@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* use nf_tables and nf_tables compatibility interfacePablo Neira Ayuso2013-12-301-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the following utilities: * xtables * xtables-restore * xtables-save * xtables-config They all use Patrick's nf_tables infrastructure plus my compatibility layer. xtables, xtables-restore and xtables-save are syntax compatible with ip[6]tables, ip[6]tables-restore and ip[6]tables-save. Semantics aims to be similar, still the main exception is that there is no commit operation. Thus, we incrementally add/delete rules without entire table locking. The following options are also not yet implemented: -Z (this requires adding expr->ops->reset(...) so nft_counters can reset internal state of expressions while dumping it) -R and -E (this requires adding this feature to nf_tables) -f (can be implemented with expressions: payload 6 (2-bytes) + bitwise a&b^!b + cmp neq 0) -IPv6 support. But those are a matter of time to get them done. A new utility, xtables-config, is available to register tables and chains. By default there is a configuration file that adds backward compatible tables and chains under iptables/etc/xtables.conf. You have to call this utility first to register tables and chains. However, it would be possible to automagically register tables and chains while using xtables and xtables-restore to get similar operation than with iptables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: improve chain name validationPhil Oester2013-11-031-13/+27
| | | | | | | | | | | | | | As pointed out by Andrew Domaszek, iptables allows whitespace to be included in chain names. This causes issues with iptables-restore, and later iptables actions on the chain. Attached patch disallows whitespace, and also consolidates all chain name checking into a new function. This closes netfilter bugzilla #855. [ Included ip6tables changed as well --pablo ] Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip[6]tables: fix incorrect alignment in commands_v_optionsPablo Neira Ayuso2013-08-141-1/+1
| | | | | | | | | | CMD_ZERO_NUM is 14, so it has to be defined in position 15 in the commands_v_options array. This does not manifests easily since commands from 9 to 14 have a very similar pattern in such array. Based on this patch: http://patchwork.ozlabs.org/patch/188153/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip{6}tables-restore: fix breakage due to new locking approachPablo Neira Ayuso2013-07-081-2/+8
| | | | | | | | | | | | | | | | Since (93587a0 ip[6]tables: Add locking to prevent concurrent instances), ip{6}tables-restore does not work anymore: iptables-restore < x Another app is currently holding the xtables lock. Perhaps you want to use the -w option? do_command{6}(...) is called from ip{6}tables-restore for every iptables command contained in the rule-set file. Thus, hitting the lock error after the second command. Fix it by bypassing the locking in the ip{6}tables-restore path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip[6]tables: Add locking to prevent concurrent instancesPhil Oester2013-06-111-1/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There have been numerous complaints and bug reports over the years when admins attempt to run more than one instance of iptables simultaneously. Currently open bug reports which are related: 325: Parallel execution of the iptables is impossible 758: Retry iptables command on transient failure 764: Doing -Z twice in parallel breaks counters 822: iptables shows negative or other bad packet/byte counts As Patrick notes in 325: "Since this has been a problem people keep running into, I'd suggest to simply add some locking to iptables to catch the most common case." I started looking into alternatives to add locking, and of course the most common/obvious solution is to use a pidfile. But this has various downsides, such as if the application is terminated abnormally and the pidfile isn't cleaned up. And this also requires a writable filesystem. Using a UNIX domain socket file (e.g. in /var/run) has similar issues. Starting in 2.2, Linux added support for abstract sockets. These sockets require no filesystem, and automatically disappear once the application terminates. This is the locking solution I chose to implement in ip[6]tables. As an added bonus, since each network namespace has its own socket pool, an ip[6]tables instance running in one namespace will not lock out an ip[6]tables instance running in another namespace. A filesystem approach would have to recognize and handle multiple network namespaces. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip[6]tables: show --protocol instead of --proto in usageMart Frauenlob2013-03-291-1/+1
| | | | | | | | As the man page shows --protocol not --proto, also do so in the usage text displayed by ip[6]tables -h. Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libip6t_NETMAP: Use xtables_ip6mask_to_cidr and get rid of libip6tc dependencyPablo Neira Ayuso2013-03-291-1/+1
| | | | | | | | | This patch changes the NETMAP target extension (IPv6 side) to use the xtables_ip6mask_to_cidr available in libxtables. As a side effect, we get rid of the libip6tc dependency. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Introduce match/target aliasesJozsef Kadlecsik2013-01-281-16/+18
| | | | | The match/target alias allows us to support the syntax of matches, targets targets merged into other matches/targets.
* libxtables: add xtables_print_numPablo Neira Ayuso2013-01-041-44/+4
| | | | | | | | This function is used both by iptables and ip6tables, and refactorize to avoid longer than 80-chars per column lines of code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: add xtables_rule_matches_freePablo Neira Ayuso2013-01-041-22/+1
| | | | | | This function is shared by iptables and ip6tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: restore NOTRACK functionality, target aliasingJan Engelhardt2012-10-081-7/+10
| | | | | | | | | | | | | | | | | | | | | | | | | Commit v1.4.16-1-g2aaa7ec is testing for real_name (not) being NULL which was always false (true). real_name was never NULL, so cs->jumpto would always be used, which rendered -j NOTRACK unusable, since the chosen real name.revision is for example NOTRACK.1, which does not exist at the kernel side. # ./iptables/xtables-multi main4 -t raw -A foo -j NOTRACK dbg: Using NOTRACK.1 WARNING: The NOTRACK target is obsolete. Use CT instead. iptables: Protocol wrong type for socket. To reasonably support the extra-special verdict names, make it so that real_name remains NULL when an extension defined no alias, which we can then use to determine whether the user entered an alias name (which needs to be followed) or not. [ I have mangled this patch to remove a comment unnecessarily large. BTW, this patch gets this very close to the initial target aliasing proposal --pablo ] Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: fix standard targetPablo Neira Ayuso2012-10-081-1/+4
| | | | | | | | | | | | | | | | | | | | | | | This regression was added by: commit cd2f9bdbb7f9b737e5d640aafeb78bcd8e3a7adf Author: Jan Engelhardt <jengelh@inai.de> Date: Tue Sep 4 05:24:47 2012 +0200 iptables: support for target aliase The result is that: iptables -I INPUT -j ACCEPT says: iptables: No chain/target/match by that name. This also breaks iptables-restore, of course. Jan, you'll have to explain me how you have tested this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'master' of git://git.inai.de/iptablesJan Engelhardt2012-09-301-2/+11
|\
| * iptables: support for match aliasesJan Engelhardt2012-09-291-1/+5
| | | | | | | | | | | | | | This patch allows for match names listed on the command line to be rewritten to new names and revisions, like we did for targets before. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
| * iptables: support for target aliasesJan Engelhardt2012-09-271-1/+6
| | | | | | | | | | | | | | | | | | | | | | This patch allows for target names listed on the command line to be rewritten to new names and revisions. As before, we will pick a revision that is supported by the kernel - now including real_name in the search. This gives us the possibility to test for many action names. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* | iptables: fix wrong error messagesPablo Neira Ayuso2012-09-081-1/+1
|/ | | | | | | | | | iptables -P INPUT iptables v1.4.15: -X requires a chain and a policy Try `iptables -h' or 'iptables --help' for more information. Note that it says -X when we have used -P. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: resolve old macro names that are indirectionsJan Engelhardt2011-09-111-25/+25
| | | | | | | | | | | Command used: git grep -f <(pcregrep -hior '(?<=#define\s)IP6?(T_\w+)(?=\s+X\1)' include/) and then fix all occurrences. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libiptc: combine common types: _handleJan Engelhardt2011-09-111-17/+17
| | | | | | | No real API/ABI change incurred, since the definition of the structs' types is not visible anyhow. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libiptc: replace ipt_chainlabel by xt_chainlabelJan Engelhardt2011-09-111-15/+15
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* option: remove last traces of intrapositional negationJan Engelhardt2011-07-101-5/+0
| | | | | | Intrapositional negation was deprecated in 1.4.3. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: consolidate target/match init callJan Engelhardt2011-06-211-6/+3
| | | | | | | This is useful for the upcoming patch about per-instance auxiliary data. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* option: fix ignored negation before implicit extension loadingJan Engelhardt2011-06-071-1/+7
| | | | | | | | | | | | `iptables -A INPUT -p tcp ! --syn` forgot the negation, i.e. it was not present in a subsequent `iptables -S`. Commit v1.4.11~77^2~9 missed the fact that after autoloading a proto extension, cs.invert must not be touched until the next getopt call. This is now fixed by having command_default return a value to indicate whether to jump or not. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: move all iptables pieces into a separate directoryJan Engelhardt2011-06-071-0/+1967
(Unclutter top-level dir) Signed-off-by: Jan Engelhardt <jengelh@medozas.de>