summaryrefslogtreecommitdiffstats
path: root/iptables/nft-arp.c
Commit message (Collapse)AuthorAgeFilesLines
* arptables: fix src/dst mac handlingFlorian Westphal2018-11-121-9/+57
| | | | | | | | | | 1. check both address and mask, not just first byte of mac 2. use add_addr() for this so mask is also handled via bitwise expr. 3. use the correct offsets. 4. add dissector so we can reverse translate the payload expressions generated for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: fix target ip offsetFlorian Westphal2018-11-121-2/+3
| | | | | | | | | | | | | | | | --dst-ip checks the first four octets of the target mac. Format of ipv4 arp is: arphdr (htype, ptype...) src mac src ip target mac target ip So we need to add hlen (6 bytes) a second time (arphdr + 6 + 4 + 6) to get correct offset. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: fix -s/-d handling for negation and maskFlorian Westphal2018-11-121-6/+14
| | | | | | | also handle negations in other cases. Still to be resolved: mask handling for other options such as hlen. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: fix rule deletion/compareFlorian Westphal2018-11-121-1/+2
| | | | | | | arptables -D fails most of the time, as we compared source mask with target mask. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-save: add -c option, like xtables-saveFlorian Westphal2018-11-121-8/+9
| | | | | | | | | arptables classic doesn't have arptables-save, it only has a perl script that attempts to emulate iptables-save. It supports no options, and thus has no way to dump counters. Add -c option, like iptables to enable this. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: use ->save for arptables-save, like xtablesFlorian Westphal2018-11-121-9/+24
| | | | | | | | | | | | | arptables-save will show -A OUTPUT --h-length 6 --h-type 1 -j MARK --set-xmark 0x1/0xffffffff as --h-length 6 --h-type Ethernet -j MARK MARK set 0x1 Because it uses ->print() instead of ->save(). Switch it to use ->save, we can then also drop special handling of CLASSIFY target. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Use the shared nft_ipv46_parse_target()Phil Sutter2018-09-251-8/+1
| | | | | | | | No point in having a dedicated implementation for 'parse_target' callback since it is identical with the shared one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Fix incorrect strcmp() in nft_arp_rule_find()Phil Sutter2018-09-241-1/+1
| | | | | | | | | Since nft_arp_rule_to_cs() may not set cs->jumpto, later call to strcmp() may be passed a NULL pointer. Therefore check if the pointer is valid before doing so. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-arp: Drop ineffective conditionalPhil Sutter2018-09-241-3/+0
| | | | | | | | Since fw->arp.arhln is of type __u8, its value will never become less than zero. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Add missing deinitializationPhil Sutter2018-08-241-1/+1
| | | | | | | | | | These fix reports for definitely lost blocks in valgrind. Not really memleaks, but due to nft_handle going out of scope they're counted as lost. Still worth fixing though since it reduces noise when auditing code for real issues. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Fix entries count in chain listingPhil Sutter2018-08-161-1/+2
| | | | | | | | | | | | | | | The previous fix for reference counts in iptables-nft output wasn't complete: While iptables lists the number of references for each custom chain (i.e., the number of jumps to it), ebtables lists number of entries (i.e., the number of rules contained) for each chain. Both used the same value for it, although they are different metrics. Fix this by passing both numbers separately to the 'print_header' callback so that each tool may print the desired value. Fixes: a0698de9866d2 ("xtables: Do not count rules as chain references") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Implement arptables-{save,restore}Phil Sutter2018-08-061-17/+38
| | | | | | | | | | | This adds C implementations for arptables-save and -restore in compat layer based on the two perl scripts in legacy arptables repository. To share common code, introduce nft_init_arp() analogous to nft_init_eb() introduced earlier. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Fix opcode printing in numeric outputPhil Sutter2018-08-041-0/+1
| | | | | | | | This line of code was dropped by accident, add it back. Fixes: 68e5e18210b8d ("nft-arp: adds nft_arp_save_firewall") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Print policy only for base chainsPhil Sutter2018-08-041-1/+1
| | | | | | | Printing a policy for user-defined chains is pointless. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: rename {print,save}_rule functionsPhil Sutter2018-07-191-6/+6
| | | | | | | | | The name is quite misleading, since these functions/callbacks are not about the whole ruleset but just a single rule. So rename them to reflect this. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: arp: make rule_to_cs callback privatePhil Sutter2018-07-191-5/+5
| | | | | | | | Since it is not directly called from outside of nft-arp.c anymore, make it private and reduce the overlong name it had. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: introduce rule_to_cs/clear_cs callbacksPhil Sutter2018-07-191-0/+2
| | | | | | | | This introduces callbacks in nft_family_ops for parsing an nftnl rule into iptables_command_state and clearing it afterwards. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: simplify struct nft_xt_ctxPhil Sutter2018-07-191-2/+2
| | | | | | | Replace union 'state' by its sole member. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: merge {ip,arp}tables_command_state structsPhil Sutter2018-07-191-20/+20
| | | | | | | | | | Differences between both structs are marginal (apart from arptables_command_state being much smaller), so merge them into one. Struct iptables_command_state is already shared between iptables, ip6tables and ebtables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: nft-arp: fix warning wrt. sprintf-out-of-boundsFlorian Westphal2018-05-031-2/+2
| | | | | | | nft-arp.c:112:3: note: 'sprintf' output between 2 and 21 bytes into a destination of size 20 sprintf(buf, "/%s", addr_to_dotted(mask)); Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-compat: use new symbols in libnftnlPablo Neira Ayuso2015-09-161-14/+14
| | | | | | | | | Adapt this code to use the new symbols in libnftnl. This patch contains quite some renaming to reserve the nft_ prefix for our high level library. Explicitly request libnftnl 1.0.5 at configure stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: delete extra space in target printingArturo Borrero2015-03-051-1/+1
| | | | | | | This is an extra space, let's get rid of it. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: unset context flags in netlink delinearize stepPablo Neira Ayuso2015-02-221-4/+8
| | | | | | | | | | | | | | | | | | Once the data that the compare expression provides have been digested. For example: -A INPUT -i noexist -p udplite -s 10.10.10.10/32 -d 10.0.0.10/32 -j ACCEPT doesn't show anymore the following broken output via iptables-compat-save: -A INPUT -i +t -p udplite -s 10.10.10.10/32 -d 10.0.0.10/32 -j ACCEPT Reported-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* arptables-compat: add mangle target extensionArturo Borrero2015-02-181-10/+9
| | | | | | | | This patch adds support to use the mangle target extensions, along with the required changes in the surrounding code. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: fix nft payload basesArturo Borrero2015-01-281-5/+10
| | | | | | | | | | ebtables should use NFT_PAYLOAD_LL_HEADER to fetch basic payload information from packets in the bridge family. Let's allow the add_payload() function to know in which base it should work. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: kill add_*() invflags parameterArturo Borrero2014-11-121-37/+28
| | | | | | | | | | | Let's kill the invflags parameter and use directly NFT_CMP_[N]EQ. The caller must calculate which kind of cmp operation requires. BTW, this patch solves absence of inversion in some arptables-compat builtin matches. Thus, translating arptables inv flags is no longer needed. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: remove save codePablo Neira Ayuso2014-10-091-29/+2
| | | | | | | | There is not native arptables-save. The original author provides perl scripts to implement arptables-save and arptables-restore. We should use them to mimic arptables behaviour. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: get output in sync with arptables -L -n --line-numbersPablo Neira Ayuso2014-10-091-0/+22
| | | | | | | | | | # arptables-compat -L -n --line-numbers Chain INPUT (policy ACCEPT) num target prot opt source destination <-- This header is not shown by arptables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: allow to not specify a targetPablo Neira Ayuso2014-10-091-106/+64
| | | | | | | | | | | | | | | | | | arptables allows this: # arptables -I INPUT however, arptables-compat says: arptables v1.4.21: No target provided or initalization failed Try `arptables -h' or 'arptables --help' for more information. the compat utility must mimic the same behaviour. Fix this by introducing the arptables_command_state abstraction that is already available in ip{6}tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: fix address prefixPablo Neira Ayuso2014-09-301-19/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes: # iptables-compat -I INPUT -s 1.2.3.0/24 generates this bytecode: ip filter INPUT 20 [ payload load 4b @ network header + 12 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00ffffff ) ^ 0x00000000 ] [ cmp eq reg 1 0x00030201 ] [ counter pkts 0 bytes 0 ] and it displays: # iptables-compat-save ... -A INPUT -s 1.2.3.0/24 ip6tables-compat and arptables-compat are also fixed. This patch uses the new context structure to annotate payload, meta and bitwise, so it interprets the cmp expression based on the context. This provides a rudimentary way to delinearize the iptables-compat rule-set, but it should be enough for the built-in xtables selectors since we still use the xtables extensions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: add nft_xt_ctx structGiuseppe Longo2014-08-241-5/+10
| | | | | | | | This patch provides the context used to transfer information between different nft_parse_* function calls. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-arp: remove wrong conditionsGiuseppe Longo2014-08-111-6/+0
| | | | | | | | | | | Removes wrong conditions in flags translating functions that doesn't permit to delete rule with inverse flags set. For instance, the following command doesn't remove the rule: arptables-compat -D INPUT -i ! eth1 -j ACCEPT Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: save: fix the printing of the countersGiuseppe Longo2014-06-111-6/+8
| | | | | | | | This patch prints the counters of a rule before the details, like iptables-save syntax. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: replace nft_rule_attr_get_u8Giuseppe Longo2014-03-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Since the family declaration has been modified in libnftnl, from commit 3cd9cd06625f8181c713489cec2c1ce6722a7e16 the assertion is failed for {ip,ip6,arp}tables-compat when printing rules. iptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination libnftnl: attribute 0 assertion failed in rule.c:273 ip6tables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination libnftnl: attribute 0 assertion failed in rule.c:273 arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination libnftnl: attribute 0 assertion failed in rule.c:273 Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-arp: wrong condition in parse_payloadGiuseppe Longo2014-03-071-1/+1
| | | | | | | | | | | | | | | the current condition doesn't permit to parse ip addresses when they should be. Obviously they are not printed. arptables-compat -A INPUT -s 1.1.1.1 -i eth0 -j ACCEPT arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination -j ACCEPT -i eth0 Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-arp: fix is_same_interfaces argumentsGiuseppe Longo2014-03-071-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Wrong arguments are passed to is_same_interfaces that causes sometimes to delete a wrong rule. See the example below: arptables-compat -A INPUT -i eth0 -j ACCEPT arptables-compat -A INPUT -i eth1 -j ACCEPT arptables-compat -A INPUT -i eth2 -j ACCEPT arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination -j ACCEPT -i eth0 -j ACCEPT -i eth1 -j ACCEPT -i eth2 arptables-compat -D INPUT -i eth2 -j ACCEPT arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination -j ACCEPT -i eth1 -j ACCEPT -i eth2 Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-arp: adds nft_arp_save_firewallGiuseppe Longo2014-02-251-63/+109
| | | | | | | | Adds nft_arp_save_firewall to arp family. (Avoids the segfault in xtables-events) Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: arp: fix possible string overflowGiuseppe Longo2013-12-301-2/+4
| | | | | | | | | | | | | | This patch replaces strcat with strncat and strcpy with strncpy fixing possible string overflow. Based on the original patch: http://patchwork.ozlabs.org/patch/279672/ from Jaromír Končický via Jiri Popelka. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: arp: add parse_target to nft_family_ops_arpGiuseppe Longo2013-12-301-0/+1
| | | | | | | | | | | | This patch adds parse_target for arp family, fixing segfaults for xtables-arp -L after rules like: xtables-arp -A OUTPUT -o eth0 -j CLASSIFY --set-class 0:7 xtables-arp -A OUTPUT -o eth1 --h-length 6 \ -j mangle --mangle-mac-s 01:00:5e:00:01:01 Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: arp: initialize flags in nft_arp_parse_metaGiuseppe Longo2013-12-301-1/+1
| | | | | | | | This small patch initialize the flags in nft_arp_parse_meta, now the nft_arp_rule_find is working properly. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: arp: Store target entry properly and compare them relevantlyTomasz Bursztyka2013-12-301-23/+21
| | | | | | | Fixes a segfault issue when deleting a rule. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: consolidate nft_rule_new to support ARPPablo Neira Ayuso2013-12-301-1/+29
| | | | | | | | This patch removes nft_arp_rule_new, which almost a copy and paste of the original nft_rule_new. This patch generalizes the infrastructure to support ARP. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: consolidate nft_rule_find for ARP, IPv4 and IPv6Pablo Neira Ayuso2013-12-301-0/+44
| | | | | | | | | This patch kills nft_arp_rule_find, which is almost a copy and paste of the original nft_rule_find function. Refactor this function to move specific protocol parts to the corresponding nft-{ipv4,ipv6,arp}.c files. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: nft-arp: implements is_same op for ARP familyGiuseppe Longo2013-12-301-3/+30
| | | | | | | | The following patch implements the is_same operation for ARP family needed for searching arp rule. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: nft-arp: fix endianess in nft_arp_parse_payloadPablo Neira Ayuso2013-12-301-6/+6
| | | | | | | | nft_arp_print_firewall already handles endianess appropriately. This fixes the output of the option that allows you to match ARP header fields. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: bootstrap ARP compatibility layer for nftablesGiuseppe Longo2013-12-301-0/+549
This patch bootstraps ARP support for the compatibility layer: 1) copy original arptables code into xtables-arp.c 2) adapt it to fit into the existing nft infrastructure. 3) add the builtin table/chains for ARP. 4) add necessary parts so xtables-multi can provide xtables-arp. 5) add basic support for rule addition (-A), insertion (-I) and listing (-L). [ This was originally posted in a series of patches with interdependencies that I have collapsed to leave the repository in consistent state. This patch includes the following changes I made: * Rename from xtables-arptables to xtables-arp, previous name too long. * Remove nft-arptables.c, now we have one single nft-arp.c file. Moved specific ARP functions to nft.c. Those should go away at some point as some refactorization should allow to accomodate those functions to the existing infrastructure. * Fix --opcode Request/Reply, so we can do something useful with this like dropping ARP request/replies. --pablo ] Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>