summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* xtables-compat-restore: flush table and its content with no -nPablo Neira Ayuso2018-05-081-56/+66
| | | | | | | | | | With no -n, semantics for *filter are to delete filter table and all its content. This restores the similar behaviour introduced in ca165845f7ec ("xtables-compat-restore: flush rules and delete user-defined chains"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: fix bogus error with -X and no user-defined chainsPablo Neira Ayuso2018-05-071-1/+1
| | | | | | | | | # iptables-compat -X iptables: No chain/target/match by that name. While it should display no error message at all. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat-restore: flush user-defined chains with -nPablo Neira Ayuso2018-05-074-2/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -n still flushes user-defined chains and its content, the following snippet: iptables-compat -N FOO iptables-compat -I INPUT iptables-compat -I FOO iptables-compat -I FOO iptables-compat-save > A iptables-compat-restore < A iptables-compat -N BAR iptables-compat -A BAR iptables-compat-restore -n < A results in: iptables-compat-save # Generated by xtables-save v1.6.2 on Mon May 7 17:18:44 2018 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :BAR - [0:0] :FOO - [0:0] -A INPUT -A INPUT -A BAR -A FOO -A FOO COMMIT # Completed on Mon May 7 17:18:44 2018 Still, user-defined chains that are not re-defined, such as BAR, are left in place. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat-restore: flush rules and delete user-defined chainsPablo Neira Ayuso2018-05-071-27/+56
| | | | | | Instead of deleting the table and base chains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: pass larger socket bufferFlorian Westphal2018-05-071-6/+6
| | | | | | | | needed to display rules that exceed 4k (MNL buffer size). This can happen with many matches in a rule or when using -m cgroup (4k per match). Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: xtables-save: don't return 1Florian Westphal2018-05-072-16/+9
| | | | | | | | | | noticed that iptables-compat-save exits with 1 on success, whereas iptables-compat-save -t filter returns 0 (as expected). Caused by double-invert of return value, so ge rid of those. do_output now returns a value suitable to pass to exit() or return from main. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: support concurrent optionFlorian Westphal2018-05-071-5/+2
| | | | | | | | We don't need extra locking as we don't go though rmw cycle when adding a rule, but accept the option for compatibility with legacy ebtables. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: fix ipv4 frag (-f)Florian Westphal2018-05-051-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | iptables-translate -A I -f nft add rule ip filter I ip frag-off != 0 counter iptables however checks: frag_off = ntohs(iph->frag_off) & IP_OFFSET; if (NF_INVF(ipinfo, IPT_INV_FRAG, (ipinfo->flags & IPT_F_FRAG) && !frag_off)) return false; So we need to mask off non-offset bits. Second issue is that we negated the meaning in ipt-restore. -f should match if (frag_off & IP_OFFSET) NE 0 ! -f matches non-fragmented packets, i.e. frag_off & IP_OFFSET == 0. So we cannot use nft_invflags2cmp(), as that will use NEQ for negation, but we need EQ instead here. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: also check tg2->userspacesizeFlorian Westphal2018-05-051-1/+3
| | | | | | memcmp uses tg1->userspacesize, make sure its same as tg2 first. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: avoid unneeded bitwise opsFlorian Westphal2018-05-052-5/+23
| | | | | | no need to and with all-ones mask. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: restore: sync options with iptables-restoreFlorian Westphal2018-05-051-2/+13
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: output -s,d first during save, just like iptablesFlorian Westphal2018-05-052-10/+10
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-compat: chains are purge out already from table flushPablo Neira Ayuso2018-05-053-52/+0
| | | | | | | Remove dead code that uses the ancient non-batch netlink API. Chains are already purged out from table flush. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: do not fail on restore if user chain existsPablo Neira Ayuso2018-05-054-4/+32
| | | | | | | | | | | | The following snippet fails if user chain FOO exists, but it should not fail: iptables-compat -F iptables-compat -N FOO iptables-compat-save > foo iptables-compat-restore < foo Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: remove non-batching routinesPablo Neira Ayuso2018-05-052-153/+7
| | | | | | | This is only needed by 3.16, which was released 8 months after nftables was merged upstream. That kernel version supports a reduced featureset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: fall back to comment match in case name is too longFlorian Westphal2018-05-043-5/+13
| | | | | | | ... or when using multiple --comment lines. This is more of a 'cosmetic' fix to handle the test suite case. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: handle mac masks properlyFlorian Westphal2018-05-043-1/+17
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: nft-arp: fix warning wrt. sprintf-out-of-boundsFlorian Westphal2018-05-031-2/+2
| | | | | | | nft-arp.c:112:3: note: 'sprintf' output between 2 and 21 bytes into a destination of size 20 sprintf(buf, "/%s", addr_to_dotted(mask)); Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: truncate comments to 254 bytesFlorian Westphal2018-04-291-1/+3
| | | | | | | Kernel clamps udata size at 256 bytes, udata size however also includes internal bookkeeping which brings us over this limit. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: only fetch revisions for ip/ip6Florian Westphal2018-04-281-6/+19
| | | | | | | Only ip and ip6tables have revision retrieval support; pretend ebtables and arptables are always ok. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix rules print/save after iptables updateSerhey Popovych2018-04-272-46/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Updating iptables from 1.4.x to 1.6.x brokes rules print/save output and causes rules load after reboot to fail. Here is example from iptables-save(8) output after update: -A CHAIN1 -m set [unsupported revision] -j DROP -A CHAIN1 -m set [unsupported revision] -j DROP Similar output could be obtained via iptables -L CHAIN1. While issue reproduced with xt_set match it is not specific to any match or target module: it is related on how xtables handles revisions. In this particular case we have following situation: 1) Kernel supports revisions from 1 to 4. 2) Rules configured with iptables 1.4.x supporting only revisions from 1 to 3. Choosen highest possible revision 3. 3) Rules printed/saved with iptables 1.6.x supporting revisions from 1 to 4. 4) Xtables registers matches/targets with highest supported revision by the kernel. This is 4 in our case after update to iptables 1.6.x. 5) When printing/saving kernel submits match/target with revision it is configured (3), while iptables thinks that rules configured with highest supported (4). That's causes revision mismatch in during print and "[unsupported revision]" output. To fix this issue we now store all supported by kernel and xtables revisions in xt_matches/xt_targets list sorted in descending order. Introduce helper routines to find match/target with given revision and use them to find right revision to print submitted by kernel entry. Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-translate: turn off useless compat queriesFlorian Westphal2018-04-271-0/+6
| | | | | | | not needed as we won't be installing any rules. So just assume kernel supports everything. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: arptables: remove obsolete forward hook definitionFlorian Westphal2018-04-271-6/+0
| | | | | | | | | | | | Its not supported anymore as of 4.13, and it did not work before this either (arp packets cannot be routed). This unbreaks arptables-compat -- without this fix kernel rejects the incoming ruleset skeleton. filtering forwarded arp packets on a bridge can be done either via 'netdev' or 'bridge' families. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-compat: statify nft_restart()Pablo Neira Ayuso2018-04-242-2/+1
| | | | | | This function is only used from iptables/nft.c. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: handle netlink dump EINTR errorsPablo Neira Ayuso2018-04-242-2/+41
| | | | | | Release existing list and restart in case that netlink dump hits EINTR. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: add 'vlan' match extensionFlorian Westphal2018-04-221-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add 'pkttype' match extensionFlorian Westphal2018-04-221-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-translate: update table name on -tFlorian Westphal2018-04-221-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add 'ip6' match extensionFlorian Westphal2018-04-191-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xt-translate: quote interface names in translated outputFlorian Westphal2018-04-191-1/+1
| | | | | | | it its good practice as interface names can be virtually any identifier and could clash with nft keywords. Signed-off-by: Florian Westphal <fw@strlen.de>
* xt-compat: add ebtables-translateFlorian Westphal2018-04-135-1/+804
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xlate-translate: split common parts into helperFlorian Westphal2018-04-131-33/+26
|
* xtables-eb: export 3 functionsFlorian Westphal2018-04-132-5/+10
| | | | | | Will be used from eb-translate parser. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-bridge: add eb-translate backend functionsFlorian Westphal2018-04-131-0/+136
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-bridge: fix mac address printingFlorian Westphal2018-04-131-1/+1
| | | | | | | | | | Mask needs to be all-ones, else we print <macaddr>/ff:ff:ff:ff:ff:ff but such a mask is redundant, we can omit the mask. ebtables does this correctly. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: fix crash when getprotobynumber() returns 0Florian Westphal2018-04-132-12/+17
| | | | | | This needs to first check if pent is NULL. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: support intra-positioned negationsFlorian Westphal2018-04-131-1/+1
| | | | | | | | | | ebtables sitll allows intra-postitioned negations, e.g. --ip-src ! 1.2.3.4 support this. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-bridge: add forward declaration for struct nftnl_ruleFlorian Westphal2018-04-131-0/+1
| | | | | | nft-bridge.h:121:48: warning: 'struct nftnl_rule' declared inside parameter list will not be visible outside .. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: make nft_init self-containedFlorian Westphal2018-04-132-2/+3
| | | | | | | | | | | nft_init() should rollback all changes it made during init when something goes wrong, callers should NOT call nft_fini() on error. Note that this change is irrelevant at the moment, all users call exit() on failure. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-translate: rm duplicate includesFlorian Westphal2018-04-131-5/+0
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xt-compat: constify a few struct membersFlorian Westphal2018-04-131-3/+3
| | | | | | avoids a compiler warning in a followup patch. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: constify option structArushi Singhal2018-04-111-1/+1
| | | | | | | | The struct of type option is only used to initialise a field and is not modified anywhere. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: load mark targetFlorian Westphal2018-04-111-2/+14
| | | | | | | Its already there but it did not work because it wasn't loaded. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: don't make failing extension load fatalFlorian Westphal2018-04-111-7/+10
| | | | | | | | | | | We will fail later when we can't parse the option, but that failure only happens if the is actually used. So in some cases things will work fine even if an extension doesn't exist. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: only validate the xtables builtin tablesFlorian Westphal2018-04-091-2/+9
| | | | | | | | | | This allows xtables-compat to list all builtin tables unless one contains nft specific expressions. Tables that do not exist in xtables world are not printed anymore (but a small hint is shown that such non-printable table(s) exist). Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: skip unsupported tablesFlorian Westphal2018-04-094-43/+14
| | | | | | | | | | | Instead of not listing anything at all if an unknown table name exists, just skip them. Output a small comment that the listing doesn't include the (unrecognized, nft-created) tables. Next patch will restrict 'is this table printable in xtables syntax' check to the "builtin" tables. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: also validate priorities and hook points match expected valuesFlorian Westphal2018-04-091-13/+22
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: fix snprintf truncation warningsFlorian Westphal2018-04-082-2/+2
| | | | | | | proto is u16 in the data structure, so this gave: nft-ipv6.c:422:44: warning: '__builtin___snprintf_chk' output may be truncated before the last format character [-Wformat-truncation=] Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: add xtables-translate.8 manpageArturo Borrero Gonzalez2018-03-172-1/+136
| | | | | | | This new manpage describes how to operate the translation tools for nftables. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat-multi.c: Allow symlink of ebtablesDuncan Roe2018-02-251-0/+1
| | | | | | | | | | | | | | | | | This patch allows one to force a subsystem that one does not wish to modify (e.g. libvirt) to use the ebtables compatibility layer. ebtables-compat was already a symlink to xtables-compat-multi but ebtables was a stand-alone program. So one could move it out of the way before making the symlink as below: lrwxrwxrwx 1 root root 20 Feb 24 11:03 ebtables -> xtables-compat-multi -rwxr-xr-x 1 root root 75176 Feb 24 11:03 ebtables.orig With this patch, kernel modules ebtable_filter & ebtables are no longer loaded. Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>