summaryrefslogtreecommitdiffstats
path: root/iptables/nft.c
Commit message (Collapse)AuthorAgeFilesLines
* xtables: Fix potential segfault in nft_rule_append()Phil Sutter2018-08-061-1/+3
| | | | | | | | | If batch_rule_add() failed (ENOMEM), nft_rule_append() frees the rule and then tries to add it to the rule cache. Better return 0 (failure) instead of continuing. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-restore: Improve user-defined chain detectionPhil Sutter2018-08-061-2/+2
| | | | | | | | | | | | Legacy ebtables-save does not use a policy string of '-' to denote user-defined chains but instead lists them with a policy of ACCEPT. In order to use ebtables_restore_parse() for ebtables-save implementation, make use of builtin table definitions to decide whether a given chain is a builtin one or not. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Match verbose ip{,6}tables output with legacyPhil Sutter2018-08-041-8/+31
| | | | | | | | | | | | | | Legacy ip{,6}tables prints feedback for various commands if in verbose mode, make sure nft variants do the same. There is one difference, namely when checking a rule (-C command): Legacy ip{,6}tables print the rule in any case, nft variants don't in case the rule wasn't found. Changing this though would require to populate the nftnl_rule object just for printing, which is probably not feasible. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Print error when listing non-existent chainsPhil Sutter2018-08-041-2/+5
| | | | | | | | Just like legacy iptables, iptables-nft should not treat the attempt to list a non-existing chain as OK. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for no output on first iptables-nft invocationPhil Sutter2018-08-041-1/+3
| | | | | | | | | | | | Fix the same issue commit a4e78370af849 ("iptables-compat: fix empty chains after first invocation of iptables-compat -L") fixed back in 2014. Seems like some changes since then broke it again. This time, existing cache not containing the added table/chains gets into the way, so clear it if nft_commit() was called. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Do not count rules as chain referencesPhil Sutter2018-08-041-0/+38
| | | | | | | | | | Unlike iptables, nftables counts rules in a chain as references to that chain. Align output of 'iptables-nft -L' with that of legacy iptables by counting the number of rules in a chain and subtracting that value from reference count before printing the chain header. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Use correct built-in chain countPhil Sutter2018-08-041-1/+1
| | | | | | | | | | In nft_chain_builtin_init(), The wrong macro was used for iterating over the built-in chains of a given table. That array's length is defined using NF_INET_NUMHOOKS, not NF_IP_NUMHOOKS. Though this change is rather cosmetic since both macros resolve into the same value. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix compilation with NLDEBUG definedPhil Sutter2018-08-041-2/+2
| | | | | | | | | In libnftnl-1.0.5, symbol name prefix changed from 'nft_' to 'nftnl_'. This patch fixes for two places forgotten by the relevant commit. Fixes: 742baabd185c3 ("iptables-compat: use new symbols in libnftnl") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Free chains in NFT_COMPAT_CHAIN_ADD jobsPhil Sutter2018-08-041-2/+6
| | | | | | | | | | | | | | Chains in NFT_COMPAT_CHAIN_ADD usually have to be freed because they are not added to the cache. There is one exception though, namely when zeroing counters: nft_chain_zero_counters() adds a chain object it took from chain cache. To distinguish this situation from the others, introduce NFT_COMPAT_CHAIN_ZERO batch object type, which is treated just like NFT_COMPAT_CHAIN_ADD but batch_obj_del() does not free it's chain. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Free chains in NFT_COMPAT_CHAIN_USER_DEL jobsPhil Sutter2018-08-041-1/+1
| | | | | | | | These always have to be freed because nft_chain_user_del() removes them from the cache so they are not freed when the chain cache is flushed. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for nft_rule_flush() returning garbagePhil Sutter2018-08-041-3/+5
| | | | | | | | | | | | | | Due to variable 'ret' not being initialized in all situations, return code of the function depends on garbage in stack. Fix this by initializing 'ret' to zero upon declaration. While being at it, make nftnl_chain_list_get() failure as well as nftnl_chain_list_iter_create() failure an error condition since both functions should succeed even if the current ruleset does not contain any chains at all. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Allocate rule cache just oncePhil Sutter2018-08-041-3/+5
| | | | | | | | | | For each parsed table, xtables-restore calls nft_table_flush() which each time allocates a new rule cache, possibly overwriting the pointer to the previously allocated one. Fix this by checking the pointer value and only allocate if it's NULL. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: don't print rule counters unless verboseEric Garver2018-08-011-1/+1
| | | | | | | | | | | Currently rule counters are always printed, but that's not the desired behavior. We should only print them with the verbose flag. This broke when the arguments of nft_rule_print_save() were changed to accept the format instead of a counters flag. Fixes: cdc78b1d6bd7 ("nft: convert rule into a command state structure") Signed-off-by: Eric Garver <e@erig.me> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: avoid bogus 'is incompatible' warningFlorian Westphal2018-07-241-1/+6
| | | | | | | | | | | | | | | | | | | | | | when using custom nft tables + iptables-nft, iptables-nft -L may fail with iptables v1.8.0 (nf_tables): table `filter' is incompatible, use 'nft' tool. even if filter table is compatible. Problem is that the chain cache tracks ALL chains. The "old" compat-check only walked chains in the table to checked (filter in this case), now we will see all other chains including base chains of another table. It seems better to extend the chain cache long-term to track chains per table instead, but for now skip the foreign ones. Reported-by: Eric Garver <e@erig.me> Fixes: 01e25e264a4c4 ("xtables: add chain cache") Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: pass format to nft_rule_save()Phil Sutter2018-07-191-3/+2
| | | | | | | | Preparing ebtables-save implementation, allow for callers to pass format bits to nft_rule_save() instead of just the 'counters' boolean. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: introduce save_chain callbackPhil Sutter2018-07-191-23/+14
| | | | | | | | In preparation for ebtables-save implementation, introduce a callback for convenient per-family formatting of chains in save output. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: rename {print,save}_rule functionsPhil Sutter2018-07-191-4/+4
| | | | | | | | | The name is quite misleading, since these functions/callbacks are not about the whole ruleset but just a single rule. So rename them to reflect this. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Use new callbacks in nft_rule_print_save()Phil Sutter2018-07-191-16/+10
| | | | | | | | This relieves callers from having to prepare iptables_command_state, which often happens just for the sake of passing it to this function. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: fix crash if nft_rule_list_get() failsPhil Sutter2018-07-191-1/+2
| | | | | | | | Without this, trying to add a rule using ebtables without proper permissions crashes the program. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: display legacy/nf_tables flavor in error messages, tooFlorian Westphal2018-07-021-9/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Also, in nf_tables backend case, only show more than one error if we're iptables-restore, else we get very long concatenated errorline. old: iptables v1.6.2: can't initialize iptables table `security': Table does not exist (do you need to insmod?) iptables v1.6.2: iptables: CHAIN_ADD failed (Device or resource busy): chain PREROUTINGCHAIN_ADD failed (Device or resource busy): chain INPUTCHAIN_ADD failed (Device or resource busy): chain POSTROUTINGCHAIN_ADD failed (Device or resource busy): chain OUTPUT iptables-restore v1.6.2: iptables-restore: line 1: CHAIN_ADD failed (Device or resource busy): chain PREROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain INPUT line 1: CHAIN_ADD failed (Device or resource busy): chain POSTROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain OUTPUT line 6: RULE_INSERT failed (No such file or directory): rule in chain PREROUTING now: iptables v1.6.2 (legacy): can't initialize iptables table `security': Table does not exist (do you need to insmod?) iptables v1.6.2 (nf_tables): CHAIN_ADD failed (Device or resource busy): chain PREROUTING iptables-restore v1.6.2 (nf_tables): line 1: CHAIN_ADD failed (Device or resource busy): chain PREROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain INPUT line 1: CHAIN_ADD failed (Device or resource busy): chain POSTROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain OUTPUT line 6: RULE_INSERT failed (No such file or directory): rule in chain PREROUTING Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-restore: init table before processing policiesFlorian Westphal2018-06-271-0/+6
| | | | | | | | | | | | | | | | | | | | *filter :INPUT DROP [32:4052] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] -A OUTPUT COMMIT will be restored with ACCEPT policies. When -A OUTPUT is processed, the OUTPUT chain isn't found in the chain cache, so the table is re-created with ACCEPT policies, which overrides the earlier DROP policies. A better fix would be to add the policy setting to the chain cache but it seems we'll need a chain abstraction with refcounting first. Fixes: 01e25e264a4c4 ("xtables: add chain cache") Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: translate nft meta trace set 1 to -j TRACEFlorian Westphal2018-06-251-0/+25
| | | | | | | nft meta expr enables the nfnetlink based trace infrastruvture, so prefer to use that rather than xt_TRACE. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: skip invalid tablesFlorian Westphal2018-05-301-1/+3
| | | | | | | in bridge and arp families, some tables such as security do not exist, so name is NULL. skip them, else we segfault in strcmp. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: more error printing fixesPablo Neira Ayuso2018-05-291-3/+2
| | | | | | | | Check for nft_insert_rule, since nft_add_rule is never set via nft_fn. Moreover, generalize ELOOP error since there is only one single location in the kernel code where we can hit this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: homogenize error messageArushi Singhal2018-05-291-1/+1
| | | | | | | | | | | | | | | | There is a difference between error messages in iptables and iptables-compat: # iptables-compat -D INPUT 4 iptables: No chain/target/match by that name. # iptables -D INPUT 4 iptables: Index of deletion too big. Now, will show same error message. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: initialize basechains for rule flush command tooPablo Neira Ayuso2018-05-281-0/+3
| | | | | | Otherwise, flush commands on not-yet-initialized basechains hit ENOENT. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: rework rule cache logicPablo Neira Ayuso2018-05-281-28/+59
| | | | | | | | | | | Perform incremental tracking on rule cache updates, instead of flushing and resynchronizing with the kernel over and over again. Note that there is no need to call flush_rule_cache() from nft_rule_delete() and nft_rule_delete_num(), since __nft_rule_del() already deletes the rule from the list. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add chain cachePablo Neira Ayuso2018-05-281-31/+51
| | | | | | | | So we don't have to dump the chain cache content over and over again. Moreover, perform incremental updates on the chain cache to add and to delete non-base chains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: initialize basechains only once on ruleset restorePablo Neira Ayuso2018-05-281-20/+28
| | | | | | | | | | | | | | We cannot assume iptables-restore files always come with explicit basechain definition, eg. :PREROUTING ACCEPT incremental ruleset updates may deliberately skip this. But loading basechains over and over again can take time, so do it just once per batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: append all errors into single lineFlorian Westphal2018-05-281-19/+37
| | | | | | | | | | | iptables-restore < /tmp/bogus iptables-restore v1.6.2: iptables-restore: line 49: RULE_APPEND failed (No such file or directory): rule in chain FOOBAR line 2023: RULE_APPEND failed (Invalid argument): rule in chain TESTSNAT This is a followup commit to 437746c7b528f ("xtables: extended error reporting"). Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: extended error reportingFlorian Westphal2018-05-261-22/+125
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: use libnftnl batch APIPablo Neira Ayuso2018-05-261-103/+89
| | | | | | | Use existing batching API from library, the existing code relies on an earlier implementation of it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: remove nft_is_ruleset_compatibleFlorian Westphal2018-05-251-35/+27
| | | | | | | | | | | Use nft_is_table_compatible instead as only helper to a 'skip' decision. Custom tables, tables that have extra base chains that iptables syntax doesn't allow or rules that have special constructs line nftables set lookups or verdict maps are not listed, but a message is provided to show that such table exists. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: allow dumping of chains in specific tableFlorian Westphal2018-05-251-11/+21
| | | | | | | | | | This is used by a followup patch to avoid continuing the 'dump everything and then ignore what we don't need' model. Places that know they only need a particular table 'iptables-save -t filter' can ask the kernel to limit this for us. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: inconsistent error reporting for -X and no empty chainPablo Neira Ayuso2018-05-231-0/+2
| | | | | | | | | | | | | # iptables-compat -N coffee # iptables-compat -I coffee # iptables-compat -X coffee iptables: Device or resource busy. While it should say: iptables: Directory not empty. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat-restore: flush table and its content with no -nPablo Neira Ayuso2018-05-081-56/+66
| | | | | | | | | | With no -n, semantics for *filter are to delete filter table and all its content. This restores the similar behaviour introduced in ca165845f7ec ("xtables-compat-restore: flush rules and delete user-defined chains"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: fix bogus error with -X and no user-defined chainsPablo Neira Ayuso2018-05-071-1/+1
| | | | | | | | | # iptables-compat -X iptables: No chain/target/match by that name. While it should display no error message at all. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat-restore: flush user-defined chains with -nPablo Neira Ayuso2018-05-071-0/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -n still flushes user-defined chains and its content, the following snippet: iptables-compat -N FOO iptables-compat -I INPUT iptables-compat -I FOO iptables-compat -I FOO iptables-compat-save > A iptables-compat-restore < A iptables-compat -N BAR iptables-compat -A BAR iptables-compat-restore -n < A results in: iptables-compat-save # Generated by xtables-save v1.6.2 on Mon May 7 17:18:44 2018 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :BAR - [0:0] :FOO - [0:0] -A INPUT -A INPUT -A BAR -A FOO -A FOO COMMIT # Completed on Mon May 7 17:18:44 2018 Still, user-defined chains that are not re-defined, such as BAR, are left in place. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat-restore: flush rules and delete user-defined chainsPablo Neira Ayuso2018-05-071-27/+56
| | | | | | Instead of deleting the table and base chains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: pass larger socket bufferFlorian Westphal2018-05-071-6/+6
| | | | | | | | needed to display rules that exceed 4k (MNL buffer size). This can happen with many matches in a rule or when using -m cgroup (4k per match). Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: xtables-save: don't return 1Florian Westphal2018-05-071-10/+4
| | | | | | | | | | noticed that iptables-compat-save exits with 1 on success, whereas iptables-compat-save -t filter returns 0 (as expected). Caused by double-invert of return value, so ge rid of those. do_output now returns a value suitable to pass to exit() or return from main. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-compat: chains are purge out already from table flushPablo Neira Ayuso2018-05-051-45/+0
| | | | | | | Remove dead code that uses the ancient non-batch netlink API. Chains are already purged out from table flush. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: do not fail on restore if user chain existsPablo Neira Ayuso2018-05-051-0/+27
| | | | | | | | | | | | The following snippet fails if user chain FOO exists, but it should not fail: iptables-compat -F iptables-compat -N FOO iptables-compat-save > foo iptables-compat-restore < foo Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: remove non-batching routinesPablo Neira Ayuso2018-05-051-150/+7
| | | | | | | This is only needed by 3.16, which was released 8 months after nftables was merged upstream. That kernel version supports a reduced featureset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: fall back to comment match in case name is too longFlorian Westphal2018-05-041-3/+9
| | | | | | | ... or when using multiple --comment lines. This is more of a 'cosmetic' fix to handle the test suite case. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: truncate comments to 254 bytesFlorian Westphal2018-04-291-1/+3
| | | | | | | Kernel clamps udata size at 256 bytes, udata size however also includes internal bookkeeping which brings us over this limit. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: only fetch revisions for ip/ip6Florian Westphal2018-04-281-6/+19
| | | | | | | Only ip and ip6tables have revision retrieval support; pretend ebtables and arptables are always ok. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: arptables: remove obsolete forward hook definitionFlorian Westphal2018-04-271-6/+0
| | | | | | | | | | | | Its not supported anymore as of 4.13, and it did not work before this either (arp packets cannot be routed). This unbreaks arptables-compat -- without this fix kernel rejects the incoming ruleset skeleton. filtering forwarded arp packets on a bridge can be done either via 'netdev' or 'bridge' families. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-compat: statify nft_restart()Pablo Neira Ayuso2018-04-241-1/+1
| | | | | | This function is only used from iptables/nft.c. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: handle netlink dump EINTR errorsPablo Neira Ayuso2018-04-241-2/+40
| | | | | | Release existing list and restart in case that netlink dump hits EINTR. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>