summaryrefslogtreecommitdiffstats
path: root/iptables/nft.c
Commit message (Collapse)AuthorAgeFilesLines
...
* nft: fix match revision lookup for IPv6Pablo Neira Ayuso2013-12-301-1/+2
| | | | | | IPT_SO_GET_REVISION_MATCH != IP6T_SO_GET_REVISION_MATCH, thus, the revision infrastructure was looking for targets instead matches.
* nft: associate table configuration to handle via nft_initGiuseppe Longo2013-12-301-25/+10
| | | | | | | | | We need family dependent built-in table/chain configuration. This patch is a step forward making nft family independent in order to support arptables and ebtables compatibility layers. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: no need for rule lookup if no position specified via -IPablo Neira Ayuso2013-12-301-17/+15
| | | | | | | Improve (dc3d8a6 xtables: add -I chain rulenum) to avoid a look up for the rule if no rule number is specified via -I. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add -I chain rulenumPablo Neira Ayuso2013-12-301-37/+121
| | | | | | | | | | | | This patch adds the nft_rule_insert function, which allows us to insert rules at a given position. The function nft_rule_add has been renamed to nft_rule_append. This is possible thanks to Eric Leblond's (netfilter: nf_tables: add insert operation) kernel patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix selective chain display via -SPablo Neira Ayuso2013-12-301-4/+6
| | | | | | | | | | | | | | | | | | Before: % xtables -S INPUT -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -p tcp -j ACCEPT After: $ xtables -S INPUT -P INPUT ACCEPT -A INPUT -p tcp -j ACCEPT Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: break chain listing if only one if looked forPablo Neira Ayuso2013-12-301-0/+8
| | | | | | | | | Break looping on the chain list if it finds the chain that the user requested. Based on patch from Tomasz Bursztyka. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use nft_*_list_add_tailPablo Neira Ayuso2013-12-301-3/+3
| | | | | | | Adapt it to the semantic fix that has been applied to libnftable nft_*_list_add now inserts nodes, instead of appending them. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix built-in chain ordering of the nat tablePablo Neira Ayuso2013-12-301-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Should be: % iptables -L -n -t nat Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain INPUT (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination instead of: % xtables -L -n -t nat Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain INPUT (policy ACCEPT) target prot opt source destination Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination Reported-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
* nft: Fix small memory leaksTomasz Bursztyka2013-12-301-0/+4
| | | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: add function to test for a builtin chainTomasz Bursztyka2013-12-301-12/+10
| | | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Remove useless parameter to nft_chain_list_findTomasz Bursztyka2013-12-301-2/+2
| | | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Handle error on adding rule expressionsTomasz Bursztyka2013-12-301-25/+53
| | | | | | | | If adding one of match/target/jumpto/verdit/counters fails, adding a rule will return an error. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
* nft: Set the rule family when creating a new oneTomasz Bursztyka2013-12-301-0/+1
| | | | | | | | | | Fixes the debug output from (in case of ipv4 rule): DEBUG: rule: arp filter INPUT 0 to: DEBUG: rule: ip filter INPUT 0 Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
* xtables: nft: display rule number via -SPablo Neira Ayuso2013-12-301-4/+6
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: nft: display rule by number via -LGiuseppe Longo2013-12-301-13/+16
| | | | | | | | | | This patch fixes the display of rule by number. [ Mangled this patch not to display the header, to mimic iptables --pablo ] Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix another memleak in nft_rule_list_cbGiuseppe Longo2013-12-301-0/+1
| | | | | Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: print counter issuesGiuseppe Longo2013-12-301-4/+12
| | | | | | | | The patch fixes the counter print, missing line, and delete warnings. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: break loop after found matching chainGiuseppe Longo2013-12-301-0/+7
| | | | | | | | This patch breaks looping in nft_chain_user_del, nft_chain_zero_counters and nft_rule_flush after the chain is found. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: nft: remove lots of useless debugging messagesPablo Neira Ayuso2013-12-301-109/+43
| | | | | | While at it, fix several memleaks of list objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: allow to zero chains via -ZGiuseppe Longo2013-12-301-0/+61
| | | | | Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix leaks in nft_xtables_config_loadPablo Neira Ayuso2013-12-301-0/+9
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix leak of chain iterator in nft_rule_listGiuseppe Longo2013-12-301-0/+1
| | | | | Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix leak of rule and chain iteratorsGiuseppe Longo2013-12-301-0/+4
| | | | | | | This patch fixes the leak of chain and rule iterators. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: output the same error message that iptables-restore usesPablo Neira Ayuso2013-12-301-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: don't call nft_init in nft_xtables_config_loadPablo Neira Ayuso2013-12-301-2/+0
| | | | | | Otherwise we keep initializing the handle over and over again. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: policy can be changed only on builtin chainTomasz Bursztyka2013-12-301-9/+2
| | | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: initialize xtables defaults even on listing rulesTomasz Bursztyka2013-12-301-0/+4
| | | | | | | Output of the tool should be the same as for iptables. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: fix missing protocol and invflagsPablo Neira Ayuso2013-12-301-1/+1
| | | | | | | | xtables -I INPUT -p tcp --dport 22 -j ACCEPT iptables: Target problem. Run `dmesg' for more information x_tables: ip_tables: tcp match: only valid for protocol Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: load tables and chains based on /etc/xtables.confPablo Neira Ayuso2013-12-301-3/+93
| | | | | | | | | If /etc/xtables.conf is available, use the configuration there to autoload the xtables built-in table and chain so you can define custom configurations. Otherwise, rely on default common table/chain configuration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: add -4 and -6 supportPablo Neira Ayuso2013-12-301-1/+1
| | | | | | | | | | Now you can specify: xtables-restore -6 < my-ip6tables-ruleset to restore the IPv6 rule-set. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Split nft core to become family independantTomasz Bursztyka2013-12-301-878/+18
| | | | | | | | | | | | This makes nft core code independant from the family. Each family needs to implement and provide a struct nft_family_ops {}. This split will ease the future support of bridge and arp rules manipulations. [ updated header files and rebased upon the current tree --pablo ] Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add xtables-eventsPablo Neira Ayuso2013-12-301-5/+14
| | | | | | | | | | | | | | Add new program to listen to rule updates: shell$ xtables-events -A INPUT -m state --state ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -D INPUT -p tcp -m tcp --dport 22 -j ACCEPT -D INPUT -m state --state ESTABLISHED -j ACCEPT You can use `-c' option to display counters. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: ipv6: fix -D with -pPablo Neira Ayuso2013-12-301-0/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: ipv6: add missing break in nft_parse_payload_ipv6Pablo Neira Ayuso2013-12-301-0/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix crash if TRACE is usedPablo Neira Ayuso2013-12-301-2/+4
| | | | | | And any other match and target with no save function defined. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: nft: add protocol and flags for xtables over nf_tablesPablo Neira Ayuso2013-12-301-0/+8
| | | | | | Add protocol and flags for the compatibility layer. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: support atomic commitPablo Neira Ayuso2013-12-301-0/+56
| | | | | | | | | | | | | Use new services in nf_tables to support atomic commit. Commit per table, although we support global commit at once, call commit for each table to emulate iptables-restore behaviour by now. Keep table dormant/wake up code in iptables/nft.c as it can be used in the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: purge out user-define chains from the kernelPablo Neira Ayuso2013-12-301-9/+54
| | | | | | | xtables-restore has to purge out user-defined chains that are not defined in the configuration file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add IPv6 supportTomasz Bursztyka2013-12-301-173/+482
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary of changes to add IPv6 support to the xtables utility: * modify all commands (add, delete, replace, check and listing) to support IPv6 addresses. And for the internal nft library: * add family to struct nft_handle and modify all caller to use this family instead of the hardcoded AF_INET. * move code that we can re-use for IPv4 and IPv6 into helper functions. * add IPv6 rule printing support. * add support to parse IPv6 address. Pablo added several improvements to this patch: * added basic xtables-save and xtables-restore support (so it defaults to IPv4) * fixed a couple of bugs found while testing * added reference when -f is used to point to -m frag (until we can make this consistent with IPv4). Note that we use one single xtables binary utility for IPv4 and IPv6. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: adapt chain rename to recent Patrick's updatesPablo Neira Ayuso2013-12-301-3/+52
| | | | | | | This patch gets existing code in sync with Patrick's chain renaming new approach. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: add support for dormant tablesPablo Neira Ayuso2013-12-301-3/+52
| | | | | | This patch adds support for dormant tables for xtables-restore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: use chain typesPablo Neira Ayuso2013-12-301-3/+49
| | | | | | We use the new special chain types defined in the kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: use 64-bits handlePablo Neira Ayuso2013-12-301-4/+5
| | | | | | Now that we use that in kernel space and in libnftables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: remove __nft_check_rulePablo Neira Ayuso2013-12-301-38/+104
| | | | | | | Rework code to remove __nft_check_rule and split it into logical fragments. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: move priority to chain instead of tablePablo Neira Ayuso2013-12-301-34/+43
| | | | | | | NAT table uses different chain priorities, adapt the existing code to allow this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix missing rule listing in custom chains with -LPablo Neira Ayuso2013-12-301-5/+1
| | | | | Reported-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: Add support for -R optionTomasz Bursztyka2013-12-301-10/+18
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* iptables: nft: Refactor __nft_rule_check to return rule handle when relevantTomasz Bursztyka2013-12-301-6/+9
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* iptables: nft: Fix -D chain rulenum optionTomasz Bursztyka2013-12-301-3/+4
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* nft: Add support for chain rename options (-E)Tomasz Bursztyka2013-12-301-5/+28
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>