summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* ebtables: Fix match_list insertionPhil Sutter2018-08-041-10/+8
| | | | | | | | Find the end of the match_list before inserting in case the list contains more than one element. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Fix for wrong program name in error messagesPhil Sutter2018-08-044-5/+5
| | | | | | | | Since nft_init_eb() is shared among standalone ebtables and ebtables-restore, allow for callers to pass the program name. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Consolidate argv construction routinesPhil Sutter2018-08-046-374/+161
| | | | | | | | | | | | | | | | | | | | | Implementations were equal in {ip,ip6,x}tables-restore.c. The one in iptables-xml.c differed slightly. For now, collect all features together. Maybe it would make sense to migrate iptables-xml.c to using add_param_to_argv() at some point and therefore extend the latter to store whether a given parameter was quoted or not. While being at it, a few improvements were done: * free_argv() now also resets 'newargc' variable, so users don't have to do that anymore. * Indenting level in add_param_to_argv() was reduced a bit. * That long error message is put into a single line to aid in grepping for it. * Explicit call to exit() after xtables_error() is removed since the latter does not return anyway. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Consolidate parse_counters()Phil Sutter2018-08-046-49/+15
| | | | | | | | | Move this helper function into xshared. While being at it, drop the need for temporary variables and take over null pointer tolerance from the implementation in iptables-xml.c. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Consolidate DEBUGP macrosPhil Sutter2018-08-046-28/+8
| | | | | | | | | | | | | | | | | | This debug printing macro was defined in various places, always identical. Move it into xshared.h and drop it from sources including that header. There are a few exceptions: * iptables-xml.c did not include xshared.h, which this patch changes. * Sources in extensions and libiptc mostly left alone since they don't include xshared.h (and maybe shouldn't). Only libxt_set.h does, so it's converted, too. This also converts DEBUG define use in libip6t_hbh.c to avoid a compiler warning. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix program name in xtables_error()Phil Sutter2018-08-041-3/+3
| | | | | | | | The error function is shared among different programs, so it should take information from xt_params pointer instead of xtables_globals object. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Use correct built-in chain countPhil Sutter2018-08-041-1/+1
| | | | | | | | | | In nft_chain_builtin_init(), The wrong macro was used for iterating over the built-in chains of a given table. That array's length is defined using NF_INET_NUMHOOKS, not NF_IP_NUMHOOKS. Though this change is rather cosmetic since both macros resolve into the same value. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix compilation with NLDEBUG definedPhil Sutter2018-08-041-2/+2
| | | | | | | | | In libnftnl-1.0.5, symbol name prefix changed from 'nft_' to 'nftnl_'. This patch fixes for two places forgotten by the relevant commit. Fixes: 742baabd185c3 ("iptables-compat: use new symbols in libnftnl") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Free chains in NFT_COMPAT_CHAIN_ADD jobsPhil Sutter2018-08-041-2/+6
| | | | | | | | | | | | | | Chains in NFT_COMPAT_CHAIN_ADD usually have to be freed because they are not added to the cache. There is one exception though, namely when zeroing counters: nft_chain_zero_counters() adds a chain object it took from chain cache. To distinguish this situation from the others, introduce NFT_COMPAT_CHAIN_ZERO batch object type, which is treated just like NFT_COMPAT_CHAIN_ADD but batch_obj_del() does not free it's chain. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Free chains in NFT_COMPAT_CHAIN_USER_DEL jobsPhil Sutter2018-08-041-1/+1
| | | | | | | | These always have to be freed because nft_chain_user_del() removes them from the cache so they are not freed when the chain cache is flushed. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for nft_rule_flush() returning garbagePhil Sutter2018-08-041-3/+5
| | | | | | | | | | | | | | Due to variable 'ret' not being initialized in all situations, return code of the function depends on garbage in stack. Fix this by initializing 'ret' to zero upon declaration. While being at it, make nftnl_chain_list_get() failure as well as nftnl_chain_list_iter_create() failure an error condition since both functions should succeed even if the current ruleset does not contain any chains at all. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Allocate rule cache just oncePhil Sutter2018-08-041-3/+5
| | | | | | | | | | For each parsed table, xtables-restore calls nft_table_flush() which each time allocates a new rule cache, possibly overwriting the pointer to the previously allocated one. Fix this by checking the pointer value and only allocate if it's NULL. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: don't print rule counters unless verboseEric Garver2018-08-012-1/+31
| | | | | | | | | | | Currently rule counters are always printed, but that's not the desired behavior. We should only print them with the verbose flag. This broke when the arguments of nft_rule_print_save() were changed to accept the format instead of a counters flag. Fixes: cdc78b1d6bd7 ("nft: convert rule into a command state structure") Signed-off-by: Eric Garver <e@erig.me> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-restore: free the table lock when skipping a tableJoel Goguen2018-07-265-2/+113
| | | | | | | | | | | | | | | | | | | Currently, when running `iptables-restore --table=X`, where `X` is not the first table in the rules dump, the restore will fail when parsing the second table: - a lock is acquird when parsing the first table name - the table name does not match the parameter to `--table` so processing continues until the next table - when processing the next table a lock is acquired, which fails because a lock is already held Another app is currently holding the xtables lock. Perhaps you want to use the -w option? This will release the lock as soon as it's decided the current table won't be used. Signed-off-by: Joel Goguen <contact+netfilter@jgoguen.ca> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: avoid bogus 'is incompatible' warningFlorian Westphal2018-07-242-1/+27
| | | | | | | | | | | | | | | | | | | | | | when using custom nft tables + iptables-nft, iptables-nft -L may fail with iptables v1.8.0 (nf_tables): table `filter' is incompatible, use 'nft' tool. even if filter table is compatible. Problem is that the chain cache tracks ALL chains. The "old" compat-check only walked chains in the table to checked (filter in this case), now we will see all other chains including base chains of another table. It seems better to extend the chain cache long-term to track chains per table instead, but for now skip the foreign ones. Reported-by: Eric Garver <e@erig.me> Fixes: 01e25e264a4c4 ("xtables: add chain cache") Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: decode meta l4protoFlorian Westphal2018-07-212-0/+20
| | | | | | | Allow to show '-p tcp' in case rule was added by nft (which prefers use of meta l4proto). Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: implement ebtables-{save,restore}Phil Sutter2018-07-198-31/+245
| | | | | | | | | | | | | | | The code for ebtables-restore was derived from legacy code, ebtables-save is actually a new implementation using the existing infrastructure and trying to adhere to legacy perl script output formatting as much as possible. This introduces a new format flag (FMT_EBT_SAVE) to allow nft_bridge_save_rule() to distinguish between ruleset listing (i.e., ebtables -L) and saving via ebtables-save - the two differ in how counters are being formatted. Odd, but that's how it is. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: introduce nft_init_eb()Phil Sutter2018-07-193-16/+37
| | | | | | | This wraps nft_init(), adding required things needed for ebtables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: parameter to add_argv() may be constPhil Sutter2018-07-191-1/+1
| | | | | | | Since the function doesn't alter the passed buffer, make it const. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: pass format to nft_rule_save()Phil Sutter2018-07-193-5/+4
| | | | | | | | Preparing ebtables-save implementation, allow for callers to pass format bits to nft_rule_save() instead of just the 'counters' boolean. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: introduce save_chain callbackPhil Sutter2018-07-195-23/+30
| | | | | | | | In preparation for ebtables-save implementation, introduce a callback for convenient per-family formatting of chains in save output. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: rename {print,save}_rule functionsPhil Sutter2018-07-197-60/+58
| | | | | | | | | The name is quite misleading, since these functions/callbacks are not about the whole ruleset but just a single rule. So rename them to reflect this. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: get rid of nft_ipv{4,6}_save_counters()Phil Sutter2018-07-194-20/+8
| | | | | | | | Just replace them by the shared save_counters() function after adjusting it's signature to meet callback requirements. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: eliminate nft_ipv{4,6}_rule_find()Phil Sutter2018-07-194-21/+5
| | | | | | | | | Both functions just pass their parameters 1:1 to nft_ipv46_rule_find, so replace them by the latter after minor adjustment to match expected callback signature. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: merge nft_ipv{4,6}_parse_target()Phil Sutter2018-07-194-16/+10
| | | | | | | | Both functions are identical, replace them by a common one in nft-shared.c. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: get rid of nft_ipv{4,6}_print_header()Phil Sutter2018-07-192-18/+2
| | | | | | | | Both functions are identical, just passing all their parameters 1:1 to print_header() shared function. So just replace them by the latter. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: arp: make rule_to_cs callback privatePhil Sutter2018-07-192-8/+5
| | | | | | | | Since it is not directly called from outside of nft-arp.c anymore, make it private and reduce the overlong name it had. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Use new callbacks in nft_rule_print_save()Phil Sutter2018-07-194-24/+13
| | | | | | | | This relieves callers from having to prepare iptables_command_state, which often happens just for the sake of passing it to this function. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: introduce rule_to_cs/clear_cs callbacksPhil Sutter2018-07-196-1/+18
| | | | | | | | This introduces callbacks in nft_family_ops for parsing an nftnl rule into iptables_command_state and clearing it afterwards. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: simplify struct nft_xt_ctxPhil Sutter2018-07-193-13/+11
| | | | | | | Replace union 'state' by its sole member. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: merge {ip,arp}tables_command_state structsPhil Sutter2018-07-197-112/+88
| | | | | | | | | | Differences between both structs are marginal (apart from arptables_command_state being much smaller), so merge them into one. Struct iptables_command_state is already shared between iptables, ip6tables and ebtables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: replace memset by c99-style initializersPhil Sutter2018-07-199-43/+27
| | | | | | | | This cleans up a few obvious cases identified by grepping the source code for 'memset'. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: fix crash if nft_rule_list_get() failsPhil Sutter2018-07-191-1/+2
| | | | | | | | Without this, trying to add a rule using ebtables without proper permissions crashes the program. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Support nft suffix for arptables and ebtablesPhil Sutter2018-07-112-1/+5
| | | | | | | | | Since the names without suffix clash with legacy tools, support the suffixed versions as well to help distributions packaging for parallel installation of both nft and legacy variants. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: check iptables retval, not echoFlorian Westphal2018-07-101-2/+2
| | | | | | | | | Pablo reports that tests that should return nozero now fail. Reason is that $? is checking return value of "echo" and not the script. Fixes: 17c66a50608 ("iptables: tests: shell: Add README") Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: tests: add test for iptables-save and iptables-restoreArushi Singhal2018-07-101-0/+47
| | | | | | | Add test for testing if iptables configuration is restored and saved. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: tests: shell: Add READMEArushi Singhal2018-07-074-1/+18
| | | | | | | | | | | 1) README is added to run test suite. 2) Rename two test-case scripts to follow proper numerical order. 3) "echo -en "\033[1A\033[K" # clean the [EXECUTING] foobar line" command should only used when verbose("-v") option is not there else instead of clearing "[EXECUTING]" prompt it is clearing last prompt of the test file. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* man: clarify translate tools do not modify any stateFlorian Westphal2018-07-052-1/+9
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-monitor: add --version optionFlorian Westphal2018-07-041-2/+6
| | | | | | ... for consistency with other commands. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-legacy: fix argv0 name for ip6tables-legacyFlorian Westphal2018-07-041-1/+1
| | | | | | xtables-legacy currently cannot be invoked as ip6tables-legacy. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: display legacy/nf_tables flavor in error messages, tooFlorian Westphal2018-07-024-12/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Also, in nf_tables backend case, only show more than one error if we're iptables-restore, else we get very long concatenated errorline. old: iptables v1.6.2: can't initialize iptables table `security': Table does not exist (do you need to insmod?) iptables v1.6.2: iptables: CHAIN_ADD failed (Device or resource busy): chain PREROUTINGCHAIN_ADD failed (Device or resource busy): chain INPUTCHAIN_ADD failed (Device or resource busy): chain POSTROUTINGCHAIN_ADD failed (Device or resource busy): chain OUTPUT iptables-restore v1.6.2: iptables-restore: line 1: CHAIN_ADD failed (Device or resource busy): chain PREROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain INPUT line 1: CHAIN_ADD failed (Device or resource busy): chain POSTROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain OUTPUT line 6: RULE_INSERT failed (No such file or directory): rule in chain PREROUTING now: iptables v1.6.2 (legacy): can't initialize iptables table `security': Table does not exist (do you need to insmod?) iptables v1.6.2 (nf_tables): CHAIN_ADD failed (Device or resource busy): chain PREROUTING iptables-restore v1.6.2 (nf_tables): line 1: CHAIN_ADD failed (Device or resource busy): chain PREROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain INPUT line 1: CHAIN_ADD failed (Device or resource busy): chain POSTROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain OUTPUT line 6: RULE_INSERT failed (No such file or directory): rule in chain PREROUTING Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: add stp matchFlorian Westphal2018-07-021-0/+1
| | | | | | Unfortunately no nft translation available so far. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add script that mimics firewalld startupFlorian Westphal2018-07-023-0/+419
| | | | | | | | | Mimic firewalld startup, i.e. "iptables-restore -n" use. First script is normal startup, second script restores ruleset, then re-runs first one (i.e., with existing rules rather than non-existent tables). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: fix variable name to multi-binaryFlorian Westphal2018-06-292-10/+10
| | | | | | Need to prepend XT_MULTI, not XTABLES_MULTI. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add a few simple tests for list/new/deleteFlorian Westphal2018-06-291-0/+52
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: make -L, -X CHAINNAME workFlorian Westphal2018-06-291-11/+6
| | | | | | | In both cases the argument is optional, in both cases the argument wasn't evaluated. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: remove exec_styleFlorian Westphal2018-06-291-80/+7
| | | | | | no plans to support daemon mode, so remove this. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: don't crash on ebtables -XFlorian Westphal2018-06-291-4/+6
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: fix some spellos and the dash escapeJan Engelhardt2018-06-282-41/+41
| | | | | | | | | Commands, options, filenames, and possibly references to other manpages, should always use the minus. (Important for copy-n-paste and e.g. following manpage links.) Everything else can do with the dash. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add firewalld default ruleset from fedora 27Florian Westphal2018-06-273-0/+320
| | | | | | | The ipv4 version has bogus counters so this can also check save/restore -c option. Signed-off-by: Florian Westphal <fw@strlen.de>