summaryrefslogtreecommitdiffstats
path: root/iptables/nft.c
Commit message (Collapse)AuthorAgeFilesLines
* xtables: Use new callbacks in nft_rule_print_save()Phil Sutter2018-07-191-16/+10
| | | | | | | | This relieves callers from having to prepare iptables_command_state, which often happens just for the sake of passing it to this function. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: fix crash if nft_rule_list_get() failsPhil Sutter2018-07-191-1/+2
| | | | | | | | Without this, trying to add a rule using ebtables without proper permissions crashes the program. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: display legacy/nf_tables flavor in error messages, tooFlorian Westphal2018-07-021-9/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Also, in nf_tables backend case, only show more than one error if we're iptables-restore, else we get very long concatenated errorline. old: iptables v1.6.2: can't initialize iptables table `security': Table does not exist (do you need to insmod?) iptables v1.6.2: iptables: CHAIN_ADD failed (Device or resource busy): chain PREROUTINGCHAIN_ADD failed (Device or resource busy): chain INPUTCHAIN_ADD failed (Device or resource busy): chain POSTROUTINGCHAIN_ADD failed (Device or resource busy): chain OUTPUT iptables-restore v1.6.2: iptables-restore: line 1: CHAIN_ADD failed (Device or resource busy): chain PREROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain INPUT line 1: CHAIN_ADD failed (Device or resource busy): chain POSTROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain OUTPUT line 6: RULE_INSERT failed (No such file or directory): rule in chain PREROUTING now: iptables v1.6.2 (legacy): can't initialize iptables table `security': Table does not exist (do you need to insmod?) iptables v1.6.2 (nf_tables): CHAIN_ADD failed (Device or resource busy): chain PREROUTING iptables-restore v1.6.2 (nf_tables): line 1: CHAIN_ADD failed (Device or resource busy): chain PREROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain INPUT line 1: CHAIN_ADD failed (Device or resource busy): chain POSTROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain OUTPUT line 6: RULE_INSERT failed (No such file or directory): rule in chain PREROUTING Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-restore: init table before processing policiesFlorian Westphal2018-06-271-0/+6
| | | | | | | | | | | | | | | | | | | | *filter :INPUT DROP [32:4052] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] -A OUTPUT COMMIT will be restored with ACCEPT policies. When -A OUTPUT is processed, the OUTPUT chain isn't found in the chain cache, so the table is re-created with ACCEPT policies, which overrides the earlier DROP policies. A better fix would be to add the policy setting to the chain cache but it seems we'll need a chain abstraction with refcounting first. Fixes: 01e25e264a4c4 ("xtables: add chain cache") Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: translate nft meta trace set 1 to -j TRACEFlorian Westphal2018-06-251-0/+25
| | | | | | | nft meta expr enables the nfnetlink based trace infrastruvture, so prefer to use that rather than xt_TRACE. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: skip invalid tablesFlorian Westphal2018-05-301-1/+3
| | | | | | | in bridge and arp families, some tables such as security do not exist, so name is NULL. skip them, else we segfault in strcmp. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: more error printing fixesPablo Neira Ayuso2018-05-291-3/+2
| | | | | | | | Check for nft_insert_rule, since nft_add_rule is never set via nft_fn. Moreover, generalize ELOOP error since there is only one single location in the kernel code where we can hit this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: homogenize error messageArushi Singhal2018-05-291-1/+1
| | | | | | | | | | | | | | | | There is a difference between error messages in iptables and iptables-compat: # iptables-compat -D INPUT 4 iptables: No chain/target/match by that name. # iptables -D INPUT 4 iptables: Index of deletion too big. Now, will show same error message. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: initialize basechains for rule flush command tooPablo Neira Ayuso2018-05-281-0/+3
| | | | | | Otherwise, flush commands on not-yet-initialized basechains hit ENOENT. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: rework rule cache logicPablo Neira Ayuso2018-05-281-28/+59
| | | | | | | | | | | Perform incremental tracking on rule cache updates, instead of flushing and resynchronizing with the kernel over and over again. Note that there is no need to call flush_rule_cache() from nft_rule_delete() and nft_rule_delete_num(), since __nft_rule_del() already deletes the rule from the list. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add chain cachePablo Neira Ayuso2018-05-281-31/+51
| | | | | | | | So we don't have to dump the chain cache content over and over again. Moreover, perform incremental updates on the chain cache to add and to delete non-base chains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: initialize basechains only once on ruleset restorePablo Neira Ayuso2018-05-281-20/+28
| | | | | | | | | | | | | | We cannot assume iptables-restore files always come with explicit basechain definition, eg. :PREROUTING ACCEPT incremental ruleset updates may deliberately skip this. But loading basechains over and over again can take time, so do it just once per batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: append all errors into single lineFlorian Westphal2018-05-281-19/+37
| | | | | | | | | | | iptables-restore < /tmp/bogus iptables-restore v1.6.2: iptables-restore: line 49: RULE_APPEND failed (No such file or directory): rule in chain FOOBAR line 2023: RULE_APPEND failed (Invalid argument): rule in chain TESTSNAT This is a followup commit to 437746c7b528f ("xtables: extended error reporting"). Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: extended error reportingFlorian Westphal2018-05-261-22/+125
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: use libnftnl batch APIPablo Neira Ayuso2018-05-261-103/+89
| | | | | | | Use existing batching API from library, the existing code relies on an earlier implementation of it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: remove nft_is_ruleset_compatibleFlorian Westphal2018-05-251-35/+27
| | | | | | | | | | | Use nft_is_table_compatible instead as only helper to a 'skip' decision. Custom tables, tables that have extra base chains that iptables syntax doesn't allow or rules that have special constructs line nftables set lookups or verdict maps are not listed, but a message is provided to show that such table exists. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: allow dumping of chains in specific tableFlorian Westphal2018-05-251-11/+21
| | | | | | | | | | This is used by a followup patch to avoid continuing the 'dump everything and then ignore what we don't need' model. Places that know they only need a particular table 'iptables-save -t filter' can ask the kernel to limit this for us. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: inconsistent error reporting for -X and no empty chainPablo Neira Ayuso2018-05-231-0/+2
| | | | | | | | | | | | | # iptables-compat -N coffee # iptables-compat -I coffee # iptables-compat -X coffee iptables: Device or resource busy. While it should say: iptables: Directory not empty. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat-restore: flush table and its content with no -nPablo Neira Ayuso2018-05-081-56/+66
| | | | | | | | | | With no -n, semantics for *filter are to delete filter table and all its content. This restores the similar behaviour introduced in ca165845f7ec ("xtables-compat-restore: flush rules and delete user-defined chains"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: fix bogus error with -X and no user-defined chainsPablo Neira Ayuso2018-05-071-1/+1
| | | | | | | | | # iptables-compat -X iptables: No chain/target/match by that name. While it should display no error message at all. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat-restore: flush user-defined chains with -nPablo Neira Ayuso2018-05-071-0/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -n still flushes user-defined chains and its content, the following snippet: iptables-compat -N FOO iptables-compat -I INPUT iptables-compat -I FOO iptables-compat -I FOO iptables-compat-save > A iptables-compat-restore < A iptables-compat -N BAR iptables-compat -A BAR iptables-compat-restore -n < A results in: iptables-compat-save # Generated by xtables-save v1.6.2 on Mon May 7 17:18:44 2018 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :BAR - [0:0] :FOO - [0:0] -A INPUT -A INPUT -A BAR -A FOO -A FOO COMMIT # Completed on Mon May 7 17:18:44 2018 Still, user-defined chains that are not re-defined, such as BAR, are left in place. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat-restore: flush rules and delete user-defined chainsPablo Neira Ayuso2018-05-071-27/+56
| | | | | | Instead of deleting the table and base chains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: pass larger socket bufferFlorian Westphal2018-05-071-6/+6
| | | | | | | | needed to display rules that exceed 4k (MNL buffer size). This can happen with many matches in a rule or when using -m cgroup (4k per match). Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: xtables-save: don't return 1Florian Westphal2018-05-071-10/+4
| | | | | | | | | | noticed that iptables-compat-save exits with 1 on success, whereas iptables-compat-save -t filter returns 0 (as expected). Caused by double-invert of return value, so ge rid of those. do_output now returns a value suitable to pass to exit() or return from main. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-compat: chains are purge out already from table flushPablo Neira Ayuso2018-05-051-45/+0
| | | | | | | Remove dead code that uses the ancient non-batch netlink API. Chains are already purged out from table flush. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: do not fail on restore if user chain existsPablo Neira Ayuso2018-05-051-0/+27
| | | | | | | | | | | | The following snippet fails if user chain FOO exists, but it should not fail: iptables-compat -F iptables-compat -N FOO iptables-compat-save > foo iptables-compat-restore < foo Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: remove non-batching routinesPablo Neira Ayuso2018-05-051-150/+7
| | | | | | | This is only needed by 3.16, which was released 8 months after nftables was merged upstream. That kernel version supports a reduced featureset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: fall back to comment match in case name is too longFlorian Westphal2018-05-041-3/+9
| | | | | | | ... or when using multiple --comment lines. This is more of a 'cosmetic' fix to handle the test suite case. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: truncate comments to 254 bytesFlorian Westphal2018-04-291-1/+3
| | | | | | | Kernel clamps udata size at 256 bytes, udata size however also includes internal bookkeeping which brings us over this limit. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: only fetch revisions for ip/ip6Florian Westphal2018-04-281-6/+19
| | | | | | | Only ip and ip6tables have revision retrieval support; pretend ebtables and arptables are always ok. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: arptables: remove obsolete forward hook definitionFlorian Westphal2018-04-271-6/+0
| | | | | | | | | | | | Its not supported anymore as of 4.13, and it did not work before this either (arp packets cannot be routed). This unbreaks arptables-compat -- without this fix kernel rejects the incoming ruleset skeleton. filtering forwarded arp packets on a bridge can be done either via 'netdev' or 'bridge' families. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-compat: statify nft_restart()Pablo Neira Ayuso2018-04-241-1/+1
| | | | | | This function is only used from iptables/nft.c. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: handle netlink dump EINTR errorsPablo Neira Ayuso2018-04-241-2/+40
| | | | | | Release existing list and restart in case that netlink dump hits EINTR. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: make nft_init self-containedFlorian Westphal2018-04-131-1/+3
| | | | | | | | | | | nft_init() should rollback all changes it made during init when something goes wrong, callers should NOT call nft_fini() on error. Note that this change is irrelevant at the moment, all users call exit() on failure. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: only validate the xtables builtin tablesFlorian Westphal2018-04-091-2/+9
| | | | | | | | | | This allows xtables-compat to list all builtin tables unless one contains nft specific expressions. Tables that do not exist in xtables world are not printed anymore (but a small hint is shown that such non-printable table(s) exist). Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: skip unsupported tablesFlorian Westphal2018-04-091-41/+4
| | | | | | | | | | | Instead of not listing anything at all if an unknown table name exists, just skip them. Output a small comment that the listing doesn't include the (unrecognized, nft-created) tables. Next patch will restrict 'is this table printable in xtables syntax' check to the "builtin" tables. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: also validate priorities and hook points match expected valuesFlorian Westphal2018-04-091-13/+22
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-compat: do not allow to delete populated user define chainsPablo Neira Ayuso2017-10-111-2/+8
| | | | | | | | If user chain contains rules, flush needs to happen first to retain iptables semantics. Use NLM_F_NONREC to request non-recursive chain deletion. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat-restore: fix several memory leaksPablo M. Bermudo Garay2017-08-141-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following memory leaks are detected by valgrind when ip[6]tables-compat-restore is executed: valgrind --leak-check=full iptables-compat-restore test-ruleset ==2548== 16 bytes in 1 blocks are definitely lost in loss record 1 of 20 ==2548== at 0x4C2DBC5: calloc (vg_replace_malloc.c:711) ==2548== by 0x4E39D67: __mnl_socket_open (socket.c:110) ==2548== by 0x4E39DDE: mnl_socket_open (socket.c:133) ==2548== by 0x11A48E: nft_init (nft.c:765) ==2548== by 0x11589F: xtables_restore_main (xtables-restore.c:463) ==2548== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) ==2548== by 0x12FF39: subcmd_main (xshared.c:211) ==2548== by 0x10F63C: main (xtables-compat-multi.c:41) ==2548== ==2548== 16 bytes in 1 blocks are definitely lost in loss record 2 of 20 ==2548== at 0x4C2DBC5: calloc (vg_replace_malloc.c:711) ==2548== by 0x504C7CD: nftnl_chain_list_alloc (chain.c:874) ==2548== by 0x11B2DB: nftnl_chain_list_get (nft.c:1194) ==2548== by 0x11B377: nft_chain_dump (nft.c:1210) ==2548== by 0x114DF9: get_chain_list (xtables-restore.c:167) ==2548== by 0x114EF8: xtables_restore_parse (xtables-restore.c:217) ==2548== by 0x115B43: xtables_restore_main (xtables-restore.c:526) ==2548== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) ==2548== by 0x12FF39: subcmd_main (xshared.c:211) ==2548== by 0x10F63C: main (xtables-compat-multi.c:41) ==2548== ==2548== 40 bytes in 1 blocks are definitely lost in loss record 5 of 20 ==2548== at 0x4C2DBC5: calloc (vg_replace_malloc.c:711) ==2548== by 0x56ABB99: xtables_calloc (xtables.c:291) ==2548== by 0x116DA7: command_jump (xtables.c:623) ==2548== by 0x117D5B: do_parse (xtables.c:923) ==2548== by 0x1188BA: do_commandx (xtables.c:1183) ==2548== by 0x115655: xtables_restore_parse (xtables-restore.c:405) ==2548== by 0x115B43: xtables_restore_main (xtables-restore.c:526) ==2548== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) ==2548== by 0x12FF39: subcmd_main (xshared.c:211) ==2548== by 0x10F63C: main (xtables-compat-multi.c:41) ==2548== ==2548== 40 bytes in 1 blocks are definitely lost in loss record 6 of 20 ==2548== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==2548== by 0x4E3AE07: mnl_nlmsg_batch_start (nlmsg.c:441) ==2548== by 0x1192B7: mnl_nftnl_batch_alloc (nft.c:106) ==2548== by 0x11931A: mnl_nftnl_batch_page_add (nft.c:122) ==2548== by 0x11DB0C: nft_action (nft.c:2402) ==2548== by 0x11DB65: nft_commit (nft.c:2413) ==2548== by 0x114FBB: xtables_restore_parse (xtables-restore.c:238) ==2548== by 0x115B43: xtables_restore_main (xtables-restore.c:526) ==2548== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) ==2548== by 0x12FF39: subcmd_main (xshared.c:211) ==2548== by 0x10F63C: main (xtables-compat-multi.c:41) ==2548== ==2548== 80 bytes in 5 blocks are definitely lost in loss record 8 of 20 ==2548== at 0x4C2DBC5: calloc (vg_replace_malloc.c:711) ==2548== by 0x50496FE: nftnl_table_list_alloc (table.c:433) ==2548== by 0x11DF88: nft_xtables_config_load (nft.c:2539) ==2548== by 0x11B037: nft_rule_append (nft.c:1116) ==2548== by 0x116639: add_entry (xtables.c:429) ==2548== by 0x118A3B: do_commandx (xtables.c:1187) ==2548== by 0x115655: xtables_restore_parse (xtables-restore.c:405) ==2548== by 0x115B43: xtables_restore_main (xtables-restore.c:526) ==2548== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) ==2548== by 0x12FF39: subcmd_main (xshared.c:211) ==2548== by 0x10F63C: main (xtables-compat-multi.c:41) ==2548== ==2548== 80 bytes in 5 blocks are definitely lost in loss record 9 of 20 ==2548== at 0x4C2DBC5: calloc (vg_replace_malloc.c:711) ==2548== by 0x504C7CD: nftnl_chain_list_alloc (chain.c:874) ==2548== by 0x11DF91: nft_xtables_config_load (nft.c:2540) ==2548== by 0x11B037: nft_rule_append (nft.c:1116) ==2548== by 0x116639: add_entry (xtables.c:429) ==2548== by 0x118A3B: do_commandx (xtables.c:1187) ==2548== by 0x115655: xtables_restore_parse (xtables-restore.c:405) ==2548== by 0x115B43: xtables_restore_main (xtables-restore.c:526) ==2548== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) ==2548== by 0x12FF39: subcmd_main (xshared.c:211) ==2548== by 0x10F63C: main (xtables-compat-multi.c:41) ==2548== ==2548== 135,168 bytes in 1 blocks are definitely lost in loss record 19 of 20 ==2548== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==2548== by 0x119280: mnl_nftnl_batch_alloc (nft.c:102) ==2548== by 0x11A51F: nft_init (nft.c:777) ==2548== by 0x11589F: xtables_restore_main (xtables-restore.c:463) ==2548== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) ==2548== by 0x12FF39: subcmd_main (xshared.c:211) ==2548== by 0x10F63C: main (xtables-compat-multi.c:41) An additional leak occurs if a rule-set already exits: ==2735== 375 (312 direct, 63 indirect) bytes in 3 blocks are definitely lost in loss record 19 of 24 ==2735== at 0x4C2DBC5: calloc (vg_replace_malloc.c:711) ==2735== by 0x504AAE9: nftnl_chain_alloc (chain.c:92) ==2735== by 0x11B1F1: nftnl_chain_list_cb (nft.c:1172) ==2735== by 0x4E3A2E8: __mnl_cb_run (callback.c:78) ==2735== by 0x4E3A4A7: mnl_cb_run (callback.c:162) ==2735== by 0x11920D: mnl_talk (nft.c:70) ==2735== by 0x11B343: nftnl_chain_list_get (nft.c:1203) ==2735== by 0x11B377: nft_chain_dump (nft.c:1210) ==2735== by 0x114DF9: get_chain_list (xtables-restore.c:167) ==2735== by 0x114EF8: xtables_restore_parse (xtables-restore.c:217) ==2735== by 0x115B43: xtables_restore_main (xtables-restore.c:526) ==2735== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) Fix these memory leaks. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: add rule cachePablo M. Bermudo Garay2016-08-301-12/+24
| | | | | | | | | | | | | | This patch adds a cache of rules within the nft handle. This feature is useful since the whole ruleset was brought from the kernel for every chain during listing operations. In addition with the new checks of ruleset compatibility, the rule list is loaded one more time. Now all the operations causing changes in the ruleset must invalidate the cache, a function called flush_rule_cache has been introduced for this purpose. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: check if nft ruleset is compatiblePablo M. Bermudo Garay2016-08-261-0/+194
| | | | | | | | | | | | | This patch adds a verification of the compatibility between the nft ruleset and iptables. Nft tables, chains and rules are checked to be compatible with iptables. If something is not compatible, the execution stops and an error message is displayed to the user. This checking is triggered by xtables-compat -L and xtables-compat-save commands. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: remove useless functionsPablo M. Bermudo Garay2016-08-221-24/+14
| | | | | | | | | | | | | | The static function nft_rule_list_get was exposed outside nft.c through the nft_rule_list_create function, but this was never used out there. A similar situation occurs with nftnl_rule_list_free and nft_rule_list_destroy. This patch removes nft_rule_list_create and nft_rule_list_destroy for the sake of simplicity. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: fix comments listingPablo M. Bermudo Garay2016-08-091-0/+32
| | | | | | | | | | ip[6]tables-compat -L was not printing the comments since commit d64ef34a9961 ("iptables-compat: use nft built-in comments support"). This patch solves the issue. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: use nft built-in comments supportPablo M. Bermudo Garay2016-06-221-0/+26
| | | | | | | | | | | After this patch, iptables-compat uses nft built-in comments support instead of comment match. This change simplifies the treatment of comments in nft after load a rule set through iptables-compat-restore. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: use new symbols in libnftnlPablo Neira Ayuso2015-09-161-406/+406
| | | | | | | | | Adapt this code to use the new symbols in libnftnl. This patch contains quite some renaming to reserve the nft_ prefix for our high level library. Explicitly request libnftnl 1.0.5 at configure stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: Increase rule number only for the selected table and chainThomas Woerner2015-07-231-7/+7
| | | | | | | | | This patch fixes the rule number handling in nft_rule_find and __nft_rule_list. The rule number is only valid in the selected table and chain and therefore may not be increased for other tables or chains. Signed-off-by: Thomas Woerner <twoerner@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: Allow to insert into rule_count+1 positionThomas Woerner2015-07-231-0/+11
| | | | | | | | iptables allows to insert a rule into the next non existing rule number but iptables-compat does not allow to do this Signed-off-by: Thomas Woerner <twoerner@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: fix print_headerGiuseppe Longo2014-11-241-0/+3
| | | | | | | This prints the header like ebtables. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: bootstrap ebtables-compatPablo Neira Ayuso2014-11-241-1/+52
| | | | | | | | | | | | | | | | | | | This patch bootstraps ebtables-compat, the ebtables compatibility software upon nf_tables. [ Original patches: http://patchwork.ozlabs.org/patch/395544/ http://patchwork.ozlabs.org/patch/395545/ http://patchwork.ozlabs.org/patch/395546/ I have also forward port them on top of the current git HEAD, otherwise compilation breaks. This bootstrap is experimental, this still needs more work. --Pablo ] Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-compat: create a separated object update type to rename chainsArturo Borrero2014-11-241-1/+11
| | | | | | | | This patch adds an explicit object update type to rename chains, so we avoid calling the nf_tables API with NLM_F_EXCL. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>