summaryrefslogtreecommitdiffstats
path: root/iptables/nft-arp.c
Commit message (Collapse)AuthorAgeFilesLines
* nft: family_ops: Pass nft_handle to 'rule_to_cs' callbackPhil Sutter2019-11-251-2/+2
| | | | | | | | | | | This is the actual callback used to parse nftables rules. Pass nft_handle to it so it can access the cache (and possible sets therein). Having to pass nft_handle to nft_rule_print_save() allows to simplify it a bit since no family ops lookup has to be done anymore. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'print_rule' callbackPhil Sutter2019-11-251-1/+2
| | | | | | | | Prepare for 'rule_to_cs' callback to receive nft_handle pointer so it is able to access cache for set lookups. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'rule_find' callbackPhil Sutter2019-11-251-2/+2
| | | | | | | | | In order to prepare for rules containing set references, nft handle has to be passed to nft_rule_to_iptables_command_state() in order to let it access the set in cache. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'add' callbackPhil Sutter2019-11-251-1/+1
| | | | | | | | | In order for add_match() to create anonymous sets when converting xtables matches it needs access to nft handle. So pass it along from callers of family ops' add callback. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-arp: Use xtables_print_mac_and_mask()Phil Sutter2019-10-301-27/+4
| | | | | | | | | | This libxtables function does exactly what the local implementation did. The only noteworthy difference is that it assumes MAC/mask lengths, but the local implementation was passed ETH_ALEN in each invocation, so no practical difference. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-nft: fix decoding of hlen on bigendian platformsFlorian Westphal2019-02-221-2/+3
| | | | | | | | | | | | | | | The existing test fail with: extensions/libarpt_standard.t: ERROR: line 2 (cannot find: arptables -I INPUT -s 192.168.0.1) ... because hlen is 0 instead of expected "6". The rule is correct, i.e. this is a decode/display bug: arp_hlen is specified as 'unsigned short' instead of uint8_t. On LSB systems, this doesn't matter but on MSB the value then is '0x600' instead of '0x006' which becomes 0 when assignment to the u8 header field. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* arptables: Print space before comma and countersPhil Sutter2019-02-211-1/+1
| | | | | | | | | Legacy arptables separates counters from rest of rule by ' , '. Assuming that scripts scraping 'arptables -vL' output match on this, make arptables-nft output conformant. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Fix potential memleaks in nft_*_rule_find()Phil Sutter2019-02-011-4/+8
| | | | | | | | | These functions parse an nftnl_rule into a local instance of iptables_command_state which potentially allocates memory (for matches or target), so call ops->clear_cs() before returning to caller. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Don't print default h-len/h-type valuesPhil Sutter2019-01-311-2/+2
| | | | | | | | | | | | | | Default values for --h-len and --h-type being printed for rules where user didn't provide them is unexpected and confusing. The drawback is the opposite: If user provided either of them with their default value, they are later omitted when listing rules. Though since unlike legacy arptables we can't distinguish between not specified and specified with default value, we can't fix both - so choose to optimize for the more likely case. Fixes: 5aecb2d8bfdda ("arptables: pre-init hlen and ethertype") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft-save: Fix position of -j optionPhil Sutter2019-01-311-26/+39
| | | | | | | | | | | | | | | | | | Legacy arptables-save (just like arptables itself) prints verdict as first option, then matches and finally any target options. To achieve this without introducing double/trailing spaces everywhere, integrate target ('-j') option printing into nft_arp_print_rule_details() and make it print separating whitespace before each option. In nft_arp_save_rule(), replace the call to save_matches_and_target() by by a direct call to cs->target->save() since the former prints '-j' option itself. Since there are no match extensions in arptables, any other code from that function is not needed. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Remove space between *cnt= and valuePhil Sutter2019-01-311-2/+2
| | | | | | | | When printing rule counters, call xtables_print_num() with FMT_NOTABLE bit set to avoid spaces between equal sign and value. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Fix listing rules without targetPhil Sutter2019-01-311-1/+1
| | | | | | | | Don't try to print cs.jumpto if it is an empty string, otherwise listing (and verbose output) contains '-j' flag without argument. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: rename opcodes to arp_opcodesFlorian Westphal2018-11-191-2/+2
| | | | | | way too generic name. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: use generic expression parsing functionFlorian Westphal2018-11-181-82/+10
| | | | | | | | | | | | | | | | | since commit d9c6a5d0977a6d8bbe772dbc31a2c4f58eec1708 ("xtables: merge {ip,arp}tables_command_state structs") arptables uses the shared representation. With only minor changes (e.g., use generic counters in command_state), in print/save functions we can use the shared nftnl expression parser too. arptables-legacy prints (-L) the jump target first, i.e.: -j MARK -d 0.0.0.0/8 --h-length 6 ... ... so keep that here too. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: fix src/dst mac handlingFlorian Westphal2018-11-121-9/+57
| | | | | | | | | | 1. check both address and mask, not just first byte of mac 2. use add_addr() for this so mask is also handled via bitwise expr. 3. use the correct offsets. 4. add dissector so we can reverse translate the payload expressions generated for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: fix target ip offsetFlorian Westphal2018-11-121-2/+3
| | | | | | | | | | | | | | | | --dst-ip checks the first four octets of the target mac. Format of ipv4 arp is: arphdr (htype, ptype...) src mac src ip target mac target ip So we need to add hlen (6 bytes) a second time (arphdr + 6 + 4 + 6) to get correct offset. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: fix -s/-d handling for negation and maskFlorian Westphal2018-11-121-6/+14
| | | | | | | also handle negations in other cases. Still to be resolved: mask handling for other options such as hlen. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: fix rule deletion/compareFlorian Westphal2018-11-121-1/+2
| | | | | | | arptables -D fails most of the time, as we compared source mask with target mask. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-save: add -c option, like xtables-saveFlorian Westphal2018-11-121-8/+9
| | | | | | | | | arptables classic doesn't have arptables-save, it only has a perl script that attempts to emulate iptables-save. It supports no options, and thus has no way to dump counters. Add -c option, like iptables to enable this. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: use ->save for arptables-save, like xtablesFlorian Westphal2018-11-121-9/+24
| | | | | | | | | | | | | arptables-save will show -A OUTPUT --h-length 6 --h-type 1 -j MARK --set-xmark 0x1/0xffffffff as --h-length 6 --h-type Ethernet -j MARK MARK set 0x1 Because it uses ->print() instead of ->save(). Switch it to use ->save, we can then also drop special handling of CLASSIFY target. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Use the shared nft_ipv46_parse_target()Phil Sutter2018-09-251-8/+1
| | | | | | | | No point in having a dedicated implementation for 'parse_target' callback since it is identical with the shared one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Fix incorrect strcmp() in nft_arp_rule_find()Phil Sutter2018-09-241-1/+1
| | | | | | | | | Since nft_arp_rule_to_cs() may not set cs->jumpto, later call to strcmp() may be passed a NULL pointer. Therefore check if the pointer is valid before doing so. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-arp: Drop ineffective conditionalPhil Sutter2018-09-241-3/+0
| | | | | | | | Since fw->arp.arhln is of type __u8, its value will never become less than zero. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Add missing deinitializationPhil Sutter2018-08-241-1/+1
| | | | | | | | | | These fix reports for definitely lost blocks in valgrind. Not really memleaks, but due to nft_handle going out of scope they're counted as lost. Still worth fixing though since it reduces noise when auditing code for real issues. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Fix entries count in chain listingPhil Sutter2018-08-161-1/+2
| | | | | | | | | | | | | | | The previous fix for reference counts in iptables-nft output wasn't complete: While iptables lists the number of references for each custom chain (i.e., the number of jumps to it), ebtables lists number of entries (i.e., the number of rules contained) for each chain. Both used the same value for it, although they are different metrics. Fix this by passing both numbers separately to the 'print_header' callback so that each tool may print the desired value. Fixes: a0698de9866d2 ("xtables: Do not count rules as chain references") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Implement arptables-{save,restore}Phil Sutter2018-08-061-17/+38
| | | | | | | | | | | This adds C implementations for arptables-save and -restore in compat layer based on the two perl scripts in legacy arptables repository. To share common code, introduce nft_init_arp() analogous to nft_init_eb() introduced earlier. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Fix opcode printing in numeric outputPhil Sutter2018-08-041-0/+1
| | | | | | | | This line of code was dropped by accident, add it back. Fixes: 68e5e18210b8d ("nft-arp: adds nft_arp_save_firewall") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Print policy only for base chainsPhil Sutter2018-08-041-1/+1
| | | | | | | Printing a policy for user-defined chains is pointless. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: rename {print,save}_rule functionsPhil Sutter2018-07-191-6/+6
| | | | | | | | | The name is quite misleading, since these functions/callbacks are not about the whole ruleset but just a single rule. So rename them to reflect this. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: arp: make rule_to_cs callback privatePhil Sutter2018-07-191-5/+5
| | | | | | | | Since it is not directly called from outside of nft-arp.c anymore, make it private and reduce the overlong name it had. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: introduce rule_to_cs/clear_cs callbacksPhil Sutter2018-07-191-0/+2
| | | | | | | | This introduces callbacks in nft_family_ops for parsing an nftnl rule into iptables_command_state and clearing it afterwards. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: simplify struct nft_xt_ctxPhil Sutter2018-07-191-2/+2
| | | | | | | Replace union 'state' by its sole member. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: merge {ip,arp}tables_command_state structsPhil Sutter2018-07-191-20/+20
| | | | | | | | | | Differences between both structs are marginal (apart from arptables_command_state being much smaller), so merge them into one. Struct iptables_command_state is already shared between iptables, ip6tables and ebtables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: nft-arp: fix warning wrt. sprintf-out-of-boundsFlorian Westphal2018-05-031-2/+2
| | | | | | | nft-arp.c:112:3: note: 'sprintf' output between 2 and 21 bytes into a destination of size 20 sprintf(buf, "/%s", addr_to_dotted(mask)); Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-compat: use new symbols in libnftnlPablo Neira Ayuso2015-09-161-14/+14
| | | | | | | | | Adapt this code to use the new symbols in libnftnl. This patch contains quite some renaming to reserve the nft_ prefix for our high level library. Explicitly request libnftnl 1.0.5 at configure stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: delete extra space in target printingArturo Borrero2015-03-051-1/+1
| | | | | | | This is an extra space, let's get rid of it. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: unset context flags in netlink delinearize stepPablo Neira Ayuso2015-02-221-4/+8
| | | | | | | | | | | | | | | | | | Once the data that the compare expression provides have been digested. For example: -A INPUT -i noexist -p udplite -s 10.10.10.10/32 -d 10.0.0.10/32 -j ACCEPT doesn't show anymore the following broken output via iptables-compat-save: -A INPUT -i +t -p udplite -s 10.10.10.10/32 -d 10.0.0.10/32 -j ACCEPT Reported-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* arptables-compat: add mangle target extensionArturo Borrero2015-02-181-10/+9
| | | | | | | | This patch adds support to use the mangle target extensions, along with the required changes in the surrounding code. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: fix nft payload basesArturo Borrero2015-01-281-5/+10
| | | | | | | | | | ebtables should use NFT_PAYLOAD_LL_HEADER to fetch basic payload information from packets in the bridge family. Let's allow the add_payload() function to know in which base it should work. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: kill add_*() invflags parameterArturo Borrero2014-11-121-37/+28
| | | | | | | | | | | Let's kill the invflags parameter and use directly NFT_CMP_[N]EQ. The caller must calculate which kind of cmp operation requires. BTW, this patch solves absence of inversion in some arptables-compat builtin matches. Thus, translating arptables inv flags is no longer needed. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: remove save codePablo Neira Ayuso2014-10-091-29/+2
| | | | | | | | There is not native arptables-save. The original author provides perl scripts to implement arptables-save and arptables-restore. We should use them to mimic arptables behaviour. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: get output in sync with arptables -L -n --line-numbersPablo Neira Ayuso2014-10-091-0/+22
| | | | | | | | | | # arptables-compat -L -n --line-numbers Chain INPUT (policy ACCEPT) num target prot opt source destination <-- This header is not shown by arptables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: allow to not specify a targetPablo Neira Ayuso2014-10-091-106/+64
| | | | | | | | | | | | | | | | | | arptables allows this: # arptables -I INPUT however, arptables-compat says: arptables v1.4.21: No target provided or initalization failed Try `arptables -h' or 'arptables --help' for more information. the compat utility must mimic the same behaviour. Fix this by introducing the arptables_command_state abstraction that is already available in ip{6}tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: fix address prefixPablo Neira Ayuso2014-09-301-19/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes: # iptables-compat -I INPUT -s 1.2.3.0/24 generates this bytecode: ip filter INPUT 20 [ payload load 4b @ network header + 12 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00ffffff ) ^ 0x00000000 ] [ cmp eq reg 1 0x00030201 ] [ counter pkts 0 bytes 0 ] and it displays: # iptables-compat-save ... -A INPUT -s 1.2.3.0/24 ip6tables-compat and arptables-compat are also fixed. This patch uses the new context structure to annotate payload, meta and bitwise, so it interprets the cmp expression based on the context. This provides a rudimentary way to delinearize the iptables-compat rule-set, but it should be enough for the built-in xtables selectors since we still use the xtables extensions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: add nft_xt_ctx structGiuseppe Longo2014-08-241-5/+10
| | | | | | | | This patch provides the context used to transfer information between different nft_parse_* function calls. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-arp: remove wrong conditionsGiuseppe Longo2014-08-111-6/+0
| | | | | | | | | | | Removes wrong conditions in flags translating functions that doesn't permit to delete rule with inverse flags set. For instance, the following command doesn't remove the rule: arptables-compat -D INPUT -i ! eth1 -j ACCEPT Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: save: fix the printing of the countersGiuseppe Longo2014-06-111-6/+8
| | | | | | | | This patch prints the counters of a rule before the details, like iptables-save syntax. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: replace nft_rule_attr_get_u8Giuseppe Longo2014-03-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Since the family declaration has been modified in libnftnl, from commit 3cd9cd06625f8181c713489cec2c1ce6722a7e16 the assertion is failed for {ip,ip6,arp}tables-compat when printing rules. iptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination libnftnl: attribute 0 assertion failed in rule.c:273 ip6tables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination libnftnl: attribute 0 assertion failed in rule.c:273 arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination libnftnl: attribute 0 assertion failed in rule.c:273 Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-arp: wrong condition in parse_payloadGiuseppe Longo2014-03-071-1/+1
| | | | | | | | | | | | | | | the current condition doesn't permit to parse ip addresses when they should be. Obviously they are not printed. arptables-compat -A INPUT -s 1.1.1.1 -i eth0 -j ACCEPT arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination -j ACCEPT -i eth0 Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-arp: fix is_same_interfaces argumentsGiuseppe Longo2014-03-071-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Wrong arguments are passed to is_same_interfaces that causes sometimes to delete a wrong rule. See the example below: arptables-compat -A INPUT -i eth0 -j ACCEPT arptables-compat -A INPUT -i eth1 -j ACCEPT arptables-compat -A INPUT -i eth2 -j ACCEPT arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination -j ACCEPT -i eth0 -j ACCEPT -i eth1 -j ACCEPT -i eth2 arptables-compat -D INPUT -i eth2 -j ACCEPT arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination -j ACCEPT -i eth1 -j ACCEPT -i eth2 Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>