summaryrefslogtreecommitdiffstats
path: root/iptables/xtables-eb.c
Commit message (Collapse)AuthorAgeFilesLines
* ebtables-nft: make -L, -X CHAINNAME workFlorian Westphal2018-06-291-11/+6
| | | | | | | In both cases the argument is optional, in both cases the argument wasn't evaluated. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: remove exec_styleFlorian Westphal2018-06-291-80/+7
| | | | | | no plans to support daemon mode, so remove this. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: don't crash on ebtables -XFlorian Westphal2018-06-291-4/+6
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: add nf_tables vs. legacy postfix to version stringsFlorian Westphal2018-06-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | -V now yields: arptables vlibxtables.so.12 (nf_tables) ebtables 1.6.2 (nf_tables) ip6tables v1.6.2 (legacy) ip6tables v1.6.2 (nf_tables) ip6tables-restore v1.6.2 (nf_tables) ip6tables-save v1.6.2 (nf_tables) ip6tables-restore v1.6.2 (legacy) ip6tables-restore-translate v1.6.2 ip6tables-save v1.6.2 (legacy) ip6tables-translate v1.6.2 (nf_tables) iptables v1.6.2 (legacy) iptables v1.6.2 (nf_tables) iptables-restore v1.6.2 (nf_tables) iptables-save v1.6.2 (nf_tables) iptables-restore v1.6.2 (legacy) iptables-restore-translate v1.6.2 iptables-save v1.6.2 (legacy) iptables-translate v1.6.2 (nf_tables) This allows to see wheter "iptables" is using old set/getsockopt or new nf_tables infrastructure. Suggested-by: Harald Welte <laforge@gnumonks.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: remove dead code inherited from ebtablesFlorian Westphal2018-06-151-2/+1
| | | | | | | | | | | | | | previous patch shows this problem: xtables-eb.c: In function ‘parse_change_counters_rule’: xtables-eb.c:534:65: warning: logical ‘and’ of mutually exclusive tests is always false [-Wlogical-op] (argv[optind + 1][0] == '-' && (argv[optind + 1][1] < '0' && argv[optind + 1][1] > '9'))) ... so this never worked. Just remove it, the arg will be fed to strtol() -- No need to do this check. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1149 Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add arp match extensionFlorian Westphal2018-05-211-0/+1
| | | | | | no translation yet, might be doable with raw payload expressions though. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add redirect match extensionFlorian Westphal2018-05-211-0/+1
| | | | | | | | | | No translation. The kernel match will alter packet type (meta set pkttype), but also replace dst mac with the bridges' mac address, however nft currently doesn't allow to retrieve this at runtime. So just add this without the xlate part for now. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add nat match extensionsFlorian Westphal2018-05-211-0/+2
| | | | | | | | adds snat and dnat. Translation for snat isn't complete, the --snat-arp switch isn't supported so far. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: prefer snprintf to strncpyFlorian Westphal2018-05-201-3/+4
| | | | | | | | | gcc emits these warnings: xtables-eb-translate.c:185:2: warning: ‘strncpy’ specified bound 29 equals destination size [-Wstringop-truncation] strncpy(target->t->u.user.name, jumpto, sizeof(target->t->u.user.name)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: allow checking for zero-macFlorian Westphal2018-05-101-0/+1
| | | | | | | | | | | | | | Allow checking for an all-zero mac address by replacing checks on the address with a check on the option flag. Its set when '-d' or '-s' appears on the command line and when seeing a linklayer payload request for ether s/daddr. Same for -p: s this flag gets removed during getopt when 'p' is encountered. So, if its set, no need to check protocol type. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: add and use helper to parse all interface namesFlorian Westphal2018-05-101-28/+11
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: kill ebtables_command_stateFlorian Westphal2018-05-101-30/+30
| | | | | | | | Use iptables_command_state instead. This allows to re-use code from the ip(6)tables layer and reduces cop&pasted code. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: support concurrent optionFlorian Westphal2018-05-071-5/+2
| | | | | | | | We don't need extra locking as we don't go though rmw cycle when adding a rule, but accept the option for compatibility with legacy ebtables. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add 'vlan' match extensionFlorian Westphal2018-04-221-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add 'pkttype' match extensionFlorian Westphal2018-04-221-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add 'ip6' match extensionFlorian Westphal2018-04-191-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xt-compat: add ebtables-translateFlorian Westphal2018-04-131-1/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-eb: export 3 functionsFlorian Westphal2018-04-131-5/+5
| | | | | | Will be used from eb-translate parser. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: support intra-positioned negationsFlorian Westphal2018-04-131-1/+1
| | | | | | | | | | ebtables sitll allows intra-postitioned negations, e.g. --ip-src ! 1.2.3.4 support this. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: load mark targetFlorian Westphal2018-04-111-2/+14
| | | | | | | Its already there but it did not work because it wasn't loaded. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: don't make failing extension load fatalFlorian Westphal2018-04-111-7/+10
| | | | | | | | | | | We will fail later when we can't parse the option, but that failure only happens if the is actually used. So in some cases things will work fine even if an extension doesn't exist. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: xtables-eb: Remove const qualifier from struct optionVarsha Rao2017-11-301-1/+1
| | | | | | | | | | | | | | As opts is reassigned multiple times, it cannot be made constant. So remove const qualifier from structure option. This patch fixes the following warning. xtables-eb.c: In function ‘ebt_load_match_extensions’: xtables-eb.c:653:7: warning: assignment discards ‘const’ qualifier from pointer target type opts = ebt_original_options; Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Constify option structHarsha Sharma2017-10-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The struct of type option is only used to initialise a field inside the xtables_globals struct and is not modified anywhere. Done using following coccinelle semantic patch @r1 disable optional_qualifier@ identifier s,i; position p; @@ static struct option i@p[] ={...}; @ok1@ identifier r1.i; expression e; position p; @@ e = i@p @bad@ position p != {r1.p,ok1.p}; identifier r1.i; @@ e@i@p @depends on !bad disable optional_qualifier@ identifier r1.i; @@ static +const struct option i[] = { ... }; Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: fix misplaced function attribute on ebt_print_error()Arturo Borrero Gonzalez2015-04-081-2/+2
| | | | | | | | | | | | xtables-eb.c:305:1: warning: empty declaration } __attribute__((noreturn, format(printf,2,3))); ^ xtables-eb.c:311:2: warning: initialization makes '__attribute__((noreturn))' qualified function pointer from unqualified .exit_err = ebt_print_error, ^ Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: add a bridge-specific exit_error functionArturo Borrero2015-03-131-2/+13
| | | | | | | | | | | | | | | | | | | | | Previous to this patch, error reporting in ebtables-compat was like: % ebtables-compat xxx (null) v1.4.21: Bad argument : 'xxx' Try `(null) -h' or '(null) --help' for more information. While the original ebtables was: % ebtables xxx Bad argument : 'xxx'. With this patch, we switch to: % ebtables-compat xxx Bad argument : 'xxx'. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: add support for limit extensionArturo Borrero2015-03-131-0/+1
| | | | | | Add support for the ebtables limit extension (match), Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* ebtables-compat: support nflog extensionArturo Borrero2015-03-041-0/+1
| | | | | | | Let's give support for the nflog extension (a watcher). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: add watchers supportArturo Borrero2015-02-111-10/+94
| | | | | | | ebtables watchers are targets which always return EBT_CONTINUE. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: finish target infrastructureArturo Borrero2015-02-031-40/+17
| | | | | Signed-off-by: Arturo Borrero <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: call extensions final checksArturo Borrero2015-02-031-33/+17
| | | | | | | Let's call extensions final checks. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: add mark_m match extensionArturo Borrero2015-01-301-0/+1
| | | | | | | Translate mark_m match extension to the xtables-compat environment. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: add 'ip' match extensionArturo Borrero2015-01-281-0/+1
| | | | | | | | | | | | | | | This patch adds the 'ip' match extension to ebtables-compat. It involves adapting old ebtables extension code to the xtables-compat environment. For testing: % sudo ebtables-compat -p 0x0800 --ip-src 1.1.1.1 -j ACCEPT The patch includes a cached copy of the extension kernel header. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: prevent same matches to be included multiple timesArturo Borrero2015-01-281-0/+8
| | | | | | | | | | | | | | | | | | | | | | Using two matches options results in two copies of the match being included in the nft rule. Example before this patch: % ebtables-compat -A FORWARD -p 0x0800 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 -j ACCEPT % ebtables-compat -L [...] -p 0x0800 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 -j ACCEPT Example with this patch: % ebtables-compat -A FORWARD -p 0x0800 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 -j ACCEPT % ebtables-compat -L [...] % -p 0x0800 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 -j ACCEPT [Note: the br_ip extension comes in a follow-up patch] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: prevent options overwriteArturo Borrero2015-01-281-1/+1
| | | | | | | | Parsing options will be overwritten if every time we load a match the extension options are merged to the original options. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: fix counter listingArturo Borrero2014-12-231-5/+7
| | | | | | | | | | | | | With this patch: % sudo ebtables-compat -L --Lc Bridge table: filter Bridge chain: INPUT, entries: 0, policy: ACCEPT -j ACCEPT , pcnt = 123 -- bcnt = 123 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: add ebt 802_3 extensionArturo Borrero2014-12-231-59/+149
| | | | | | | | | | | | | | This patch adds the first ebtables extension to ebtables-compat. The original 802_3 code is adapted to the xtables environment. I tried to mimic as much as possible the original ebtables code paths. With this patch, ebtables-compat is able to send the 802_3 match to the kernel, but the kernel-to-userspace path is not tested and should be adjusted in follow-up patches. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: xtables-eb: fix renaming of chainsArturo Borrero2014-11-251-2/+17
| | | | | | | | | | | | | | Renaming of chains is not working. and ebtables-compat gets: libnftnl: attribute 0 assertion failed in chain.c:159 This patch brings back the parser code of the original ebtables tool: http://git.netfilter.org/ebtables.old-history/tree/userspace/ebtables2/ebtables.c#n652 I adapted the original parser code to fit in the new environment. Also tried to keep original error messages as much as possible. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: xtables-eb: user-defined chains default policy is always RETURNArturo Borrero2014-11-241-1/+8
| | | | | | | | | | | | | | | | | | | The RETURN default policy is mandatory in user-defined chains. Builtin chains must have one of ACCEPT or DROP. So, with this patch, ebtables-compat ends with: Command: Result: -L Always RETURN for user-defined chains -P builtin RETURN Policy RETURN only allowed for user defined chains -P builtin ACCEPT|DROP ok -P userdefined RETURN|ACCEPT|DROP Policy XYZ not allowed for user defined chains -N userdefined ok -N userdefined -P RETURN|ACCEPT|DROP Policy XYZ not allowed for user defined chains Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: xtables-eb: delete extra 'policy' printfArturo Borrero2014-11-241-1/+0
| | | | | | | This message doesn't exist in the original ebtables tool. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: use ebtables_command_state in bootstrap codePablo Neira Ayuso2014-11-241-49/+51
| | | | | | | | | | | And introduce fake ebt_entry. This gets the code in sync in other existing compat tools. This will likely allow to consolidate common infrastructure. This code is still quite experimental. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: bootstrap ebtables-compatPablo Neira Ayuso2014-11-241-0/+1196
This patch bootstraps ebtables-compat, the ebtables compatibility software upon nf_tables. [ Original patches: http://patchwork.ozlabs.org/patch/395544/ http://patchwork.ozlabs.org/patch/395545/ http://patchwork.ozlabs.org/patch/395546/ I have also forward port them on top of the current git HEAD, otherwise compilation breaks. This bootstrap is experimental, this still needs more work. --Pablo ] Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>