summaryrefslogtreecommitdiffstats
path: root/iptables/nft-shared.h
Commit message (Collapse)AuthorAgeFilesLines
* xshared: Move do_parse to shared spacePhil Sutter2022-01-121-4/+0
| | | | | | | | | | | Small adjustments were needed: - Pass line variable via xt_cmd_parse, xshared.c does not have it in namespace. - Replace opts, prog_name and prog_vers defines by the respective xt_params field reference. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Do not pass nft_handle to do_parse()Phil Sutter2022-01-121-38/+2
| | | | | | | | | Make it fit for sharing with legacy iptables, drop nft-specific parameter. This requires to mirror proto_parse and post_parse callbacks from family_ops somewhere reachable - use xt_cmd_parse, it holds other "parser setup data" as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Move struct nft_xt_cmd_parse to xshared.hPhil Sutter2022-01-121-13/+1
| | | | | | | Preparing for shared use with legacy variants, move it to "neutral ground" and give it a more generic name. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Drop unused function print_proto()Phil Sutter2021-11-231-1/+0
| | | | | | | | | The last users vanished back in 2013. There is identical code in save_rule_details(), but with only a single user there's not much point in keeping the function. Fixes: cdc78b1d6bd7b ("nft: convert rule into a command state structure") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share print_header() with legacy iptablesPhil Sutter2021-11-231-5/+2
| | | | | | | | | | | | | | | Legacy iptables fetches the relevant data via libiptc before calling the shared routine which merely prints data as requested. Drop the 'basechain' parameter, instead make sure a policy name is passed only with base chains. Since the function is not shared with ebtables (which uses a very rudimental header instead), this is safe. In order to support legacy iptables' checking of iptc_get_references() return code (printing an error message instead of the reference count), make refs parameter signed and print the error message if it's negative. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share print_rule_details() with legacyPhil Sutter2021-11-231-4/+0
| | | | | | | | | | Have to pass pointer to counters directly since different fields are being used for some reason. Since proto_to_name() is not used outside of xshared.c anymore, make it static. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share save_rule_details() with legacyPhil Sutter2021-11-231-6/+0
| | | | | | | | | | The function combines printing of input and output interfaces and protocol parameter, all being IP family independent. Extend the function to print fragment option ('-f'), too if requested. While being at it, drop unused iptables_command_state parameter and reorder the remaining ones a bit. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-arp: Introduce post_parse callbackPhil Sutter2021-10-201-0/+3
| | | | | | | This accomplishes the same tasks as e.g. nft_ipv4_post_parse() plus some arptables-specific bits. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Add family ops callbacks wrapping different nft_cmd_* functionsPhil Sutter2021-10-201-0/+18
| | | | | | | | | | Commands supporting multiple source/destination addresses need to iterate over them and call the respective nft_cmd_* function multiple times. These loops are family-specific though as each family uses a different data structure within struct iptables_command_state to store the addresses. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Simplify addr_mask freeingPhil Sutter2021-10-201-0/+2
| | | | | | Introduce a generic 'ptr' union field to pass to free(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Introduce init_cs family ops callbackPhil Sutter2021-10-201-0/+1
| | | | | | | Arptables sets a few defaults in struct iptables_command_state upon initialization. Introduce a callback to do that. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Make invflags 16bit widePhil Sutter2021-05-171-1/+1
| | | | | | | | | | | | | This is needed to merge with xtables-arp which has more builtin options and hence needs more bits in invflags. The only adjustment needed is the set_option() call for option '-j' which passed a pointer to cs->fw.ip.invflags. That field can't be changed, it belongs to uAPI. Though using args->invflags instead works fine, aside from that '-j' doesn't support inverting so this is merely a sanity check and no real invflag value assignment will happen. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Optimize masked MAC address matchesPhil Sutter2020-11-041-1/+2
| | | | | | | | | | Just like with class-based prefix matches in iptables-nft, optimize masked MAC address matches if the mask is on a byte-boundary. To reuse the logic in add_addr(), extend it to accept the payload base value via parameter. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Optimize class-based IP prefix matchesPhil Sutter2020-11-041-0/+4
| | | | | | | Payload expression works on byte-boundaries, leverage this with suitable prefix lengths. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-restore: Fix verbose mode table flushingPhil Sutter2020-06-091-1/+2
| | | | | | | | | | When called with --verbose mode, iptables-nft-restore did not print anything when flushing the table. Fix this by adding a "manual" mode to nft_cmd_table_flush(), turning it into a wrapper around '-F' and '-X' commands, which is exactly what iptables-legacy-restore does to flush a table. This though requires a real cache, so don't set NFT_CL_FAKE then. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Drop save_counters callback from family_opsPhil Sutter2020-05-181-2/+0
| | | | | | | All families use the same callback function, just fold it into the sole place it's called. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Merge nft_*_rule_find() functionsPhil Sutter2020-05-181-4/+0
| | | | | | | | | Both ebtables and arptables are fine with using nft_ipv46_rule_find() instead of their own implementations. Take the chance and move the former into nft.c as a static helper since it is used in a single place, only. Then get rid of the callback from family_ops. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: split parsing from netlink commandsPablo Neira Ayuso2020-05-111-2/+2
| | | | | | | | | | | | | | This patch updates the parser to generate a list of command objects. This list of commands is then transformed to a list of netlink jobs. This new command object stores the rule using the nftnl representation via nft_rule_new(). To reduce the number of updates in this patch, the nft_*_rule_find() functions have been updated to restore the native representation to skip the update of the rule comparison code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Support parsing lookup expressionPhil Sutter2019-11-251-0/+2
| | | | | | | | Add required glue code to support family specific lookup expression parsers implemented as family_ops callback. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Embed rule's table name in nft_xt_ctxPhil Sutter2019-11-251-0/+1
| | | | | | | | Down to the point where expression parsing happens, the rule's table is not known anymore but relevant if set lookups are required. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Bore up nft_parse_payload()Phil Sutter2019-11-251-1/+3
| | | | | | | | | Allow for closer inspection by storing payload expression's base and length values. Also facilitate for two consecutive payload expressions as LHS of a (cmp/lookup) statement as used with concatenations. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Keep nft_handle pointer in nft_xt_ctxPhil Sutter2019-11-251-1/+1
| | | | | | | | | Instead of carrying the family value, carry the handle (which contains the family value) and relieve expression parsers from having to call nft_family_ops_lookup(). Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'rule_to_cs' callbackPhil Sutter2019-11-251-2/+3
| | | | | | | | | | | This is the actual callback used to parse nftables rules. Pass nft_handle to it so it can access the cache (and possible sets therein). Having to pass nft_handle to nft_rule_print_save() allows to simplify it a bit since no family ops lookup has to be done anymore. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'print_rule' callbackPhil Sutter2019-11-251-2/+2
| | | | | | | | Prepare for 'rule_to_cs' callback to receive nft_handle pointer so it is able to access cache for set lookups. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'rule_find' callbackPhil Sutter2019-11-251-2/+2
| | | | | | | | | In order to prepare for rules containing set references, nft handle has to be passed to nft_rule_to_iptables_command_state() in order to let it access the set in cache. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'add' callbackPhil Sutter2019-11-251-2/+2
| | | | | | | | | In order for add_match() to create anonymous sets when converting xtables matches it needs access to nft handle. So pass it along from callers of family ops' add callback. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Integrate restore callbacks into struct nft_xt_restore_parsePhil Sutter2019-11-061-9/+9
| | | | | | | | There's really no point in passing those as separate parameter. While being at it, make them static const everywhere. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge CMD_* definesPhil Sutter2019-10-301-17/+0
| | | | | | | | | They are mostly identical, just xtables-arp ones differ slightly. Though since they are internal use only and their actual value doesn't matter (as long as it's a distinct bit), they can be merged anyway. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Drop chain_list callbackPhil Sutter2019-10-181-2/+0
| | | | | | | | Since commit 0baa08fed43fa ("xtables: unify user chain add/flush for restore case") it is not used anymore, so just drop it. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Constify struct nft_xt_restore_cbPhil Sutter2019-10-181-1/+1
| | | | | | | | There is no need for dynamic callback mangling, so make all instances static const. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Use xt_params->program_namePhil Sutter2019-10-181-2/+1
| | | | | | | | | | | Instead of setting newargv[0] to argv[0]'s value, just use whatever xt_params->program_name contains. The latter is arbitrarily defined, but may still be more correct than real argv[0] which may simply be for instance xtables-nft-multi. Either way, there is no practical significance since newargv[0] is used exclusively in debug output. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Treat struct nft_xt_restore_parse as constPhil Sutter2019-10-181-1/+1
| | | | | | | | | This structure contains restore parser configuration, parser is not supposed to alter it. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Fix add_bitwise_u16() on Big EndianPhil Sutter2019-09-231-1/+1
| | | | | | | | | | | | | | | | | | | | | Type used for 'mask' and 'xor' parameters was wrong, 'int' is four bytes on 32 or 64 bit architectures. After casting a uint16_t to int, on Big Endian the first two bytes of data are (the leading) zero which libnftnl then copies instead of the actual value. This problem was noticed when using '--fragment' option: | # iptables-nft -A FORWARD --fragment -j ACCEPT | # nft list ruleset | grep frag-off | ip frag-off & 0 != 0 counter packets 0 bytes 0 accept With this fix in place, the resulting nft rule is correct: | ip frag-off & 8191 != 0 counter packets 0 bytes 0 accept Fixes: 2f1fbab671576 ("iptables: nft: add -f support") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: unify user chain add/flush for restore caseFlorian Westphal2019-04-271-5/+2
| | | | | | | | | | | | The idea here is to move the 'flush' decision into the core, rather than have the decision in the frontend. This will be required later when "generation id" is passed to kernel. In this case, we might have to add the flush when re-trying the transaction. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Review chain handlingPhil Sutter2018-12-271-2/+0
| | | | | | | | | | | | | | | | | | | | | | | There is no need to "delete" (actually, remove from cache) a chain if noflush wasn't given: While handling the corresponding table line, 'table_flush' callback has already taken care of that. This .chain_del indirection is not required since d1eb4d587297 ("iptables-compat: chains are purge out already from table flush"). Streamlining the code further, move syntax checks to the top. If these concede, there are three cases to distinguish: A) Given chain name matches a builtin one in current table, so assume it exists already and just set policy and counters. B) Noflush was given and the (custom) chain exists already, flush it. C) Custom chain was either flushed (noflush not given) or didn't exist before, create it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: make all nft_parse_ helpers staticFlorian Westphal2018-11-191-8/+0
| | | | | | no more external callers. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Introduce per table chain cachesPhil Sutter2018-11-171-1/+2
| | | | | | | | | | | | | | | | Being able to omit the previously obligatory table name check when iterating over the chain cache might help restore performance with large rulesets in xtables-save and -restore. There is one subtle quirk in the code: flush_chain_cache() did free the global chain cache if not called with a table name but didn't if a table name was given even if it emptied the chain cache. In other places, chain_cache being non-NULL prevented a cache update from happening, so this patch establishes the same behaviour (for each individual chain cache) since otherwise unexpected cache updates lead to weird problems. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix for spurious errors from iptables-translatePhil Sutter2018-10-231-0/+1
| | | | | | | | | | | | When aligning iptables-nft error messages with legacy ones, I missed that translate tools shouldn't check for missing or duplicated chains. Introduce a boolean in struct nft_xt_cmd_parse indicating we're "just" translating and do_parse() should skip the checks. Fixes: b6a06c1a215f8 ("xtables: Align return codes with legacy iptables") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Use print_ifaces() from xtablesPhil Sutter2018-09-241-2/+0
| | | | | | | | | | Move the function to xshared.c for common use between legacy and xtables sources. While being at it, silence a covscan warning triggered by that function as it couldn't verify input buffers won't exceed IFNAMSIZ. Therefore use snprintf() when writing to the local buffer. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Use meta l4proto for -p matchPhil Sutter2018-08-211-0/+1
| | | | | | | | | | | | | | | Use of payload expression to match against IPv6 nexthdr field does not work if extension headers are present. A simple example for that is matching for fragmented icmpv6 traffic. Instead, generate a 'meta l4proto' expression which works even if extension headers are present. For consistency, apply the same change to iptables-nft as well. No adjustment to reverse path required as the needed bits were added by commit 6ea7579e6fe24 ("nft: decode meta l4proto") already. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Fix entries count in chain listingPhil Sutter2018-08-161-2/+2
| | | | | | | | | | | | | | | The previous fix for reference counts in iptables-nft output wasn't complete: While iptables lists the number of references for each custom chain (i.e., the number of jumps to it), ebtables lists number of entries (i.e., the number of rules contained) for each chain. Both used the same value for it, although they are different metrics. Fix this by passing both numbers separately to the 'print_header' callback so that each tool may print the desired value. Fixes: a0698de9866d2 ("xtables: Do not count rules as chain references") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix for wrong counter format in -S outputPhil Sutter2018-08-091-4/+3
| | | | | | | | | | | | | | | | | | | | | | Legacy iptables uses '-c PCNT BCNT' format in listed rules, nft-variant used '[PCNT BCNT]' prefix like with iptables-save. In order to pass the counter format preference along, FMT_C_COUNTS is introduced and related 'format' checks adjusted. Since legacy iptables prints the counters between matches and target, this change affects save_matches_and_target() function. In order to get access to the rule counters, it's declaration is adjusted to receive iptables_command_state pointer instead of match, target and jumpto pointers from the same object. While being at it, integrate jump to user-defined chain into it as well since the related code in both callers was almost identical. Though since different rule flags are used between iptables and ip6tables, pass a 'goto_flag' boolean instead of the actual 'flags' bitfield. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-restore: Make COMMIT support configurablePhil Sutter2018-08-061-0/+1
| | | | | | | | | | | | | | Legacy ebtables-restore does not support COMMIT directive, so allow for callers of xtables_restore_parse() to toggle whether it is required or not. In iptables, omitting COMMIT may be used for syntax checking, so we must not add an implicit commit at EOF. Although ebtables/arptables legacy does not support COMMIT lines at all, this patch allows them in nft variants. If omitted, an implicit commit happens for them at EOF. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Consolidate DEBUGP macrosPhil Sutter2018-08-041-4/+1
| | | | | | | | | | | | | | | | | | This debug printing macro was defined in various places, always identical. Move it into xshared.h and drop it from sources including that header. There are a few exceptions: * iptables-xml.c did not include xshared.h, which this patch changes. * Sources in extensions and libiptc mostly left alone since they don't include xshared.h (and maybe shouldn't). Only libxt_set.h does, so it's converted, too. This also converts DEBUG define use in libip6t_hbh.c to avoid a compiler warning. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: introduce save_chain callbackPhil Sutter2018-07-191-0/+3
| | | | | | | | In preparation for ebtables-save implementation, introduce a callback for convenient per-family formatting of chains in save output. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: rename {print,save}_rule functionsPhil Sutter2018-07-191-13/+13
| | | | | | | | | The name is quite misleading, since these functions/callbacks are not about the whole ruleset but just a single rule. So rename them to reflect this. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: get rid of nft_ipv{4,6}_save_counters()Phil Sutter2018-07-191-1/+1
| | | | | | | | Just replace them by the shared save_counters() function after adjusting it's signature to meet callback requirements. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: eliminate nft_ipv{4,6}_rule_find()Phil Sutter2018-07-191-1/+1
| | | | | | | | | Both functions just pass their parameters 1:1 to nft_ipv46_rule_find, so replace them by the latter after minor adjustment to match expected callback signature. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: merge nft_ipv{4,6}_parse_target()Phil Sutter2018-07-191-0/+1
| | | | | | | | Both functions are identical, replace them by a common one in nft-shared.c. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: introduce rule_to_cs/clear_cs callbacksPhil Sutter2018-07-191-0/+4
| | | | | | | | This introduces callbacks in nft_family_ops for parsing an nftnl rule into iptables_command_state and clearing it afterwards. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>