summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
...
* consistently use <errno.h>Felix Janda2015-05-027-7/+7
| | | | | | | | | On glibc, <sys/errno.h> is a synomym for <errno.h>. <errno.h> is specified by POSIX, so use that. Fixes compilation error with musl libc Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: fix misplaced function attribute on ebt_print_error()Arturo Borrero Gonzalez2015-04-081-2/+2
| | | | | | | | | | | | xtables-eb.c:305:1: warning: empty declaration } __attribute__((noreturn, format(printf,2,3))); ^ xtables-eb.c:311:2: warning: initialization makes '__attribute__((noreturn))' qualified function pointer from unqualified .exit_err = ebt_print_error, ^ Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: fix rule deleting with -D in rules with no targetArturo Borrero2015-03-131-1/+1
| | | | | | | | Before this patch, rule deleting with -D produces segfault in rules with no target. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: add a bridge-specific exit_error functionArturo Borrero2015-03-131-2/+13
| | | | | | | | | | | | | | | | | | | | | Previous to this patch, error reporting in ebtables-compat was like: % ebtables-compat xxx (null) v1.4.21: Bad argument : 'xxx' Try `(null) -h' or '(null) --help' for more information. While the original ebtables was: % ebtables xxx Bad argument : 'xxx'. With this patch, we switch to: % ebtables-compat xxx Bad argument : 'xxx'. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: add support for limit extensionArturo Borrero2015-03-131-0/+1
| | | | | | Add support for the ebtables limit extension (match), Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* arptables-compat: delete extra space in target printingArturo Borrero2015-03-051-1/+1
| | | | | | | This is an extra space, let's get rid of it. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: support nflog extensionArturo Borrero2015-03-042-1/+3
| | | | | | | Let's give support for the nflog extension (a watcher). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: unset context flags in netlink delinearize stepPablo Neira Ayuso2015-02-224-18/+36
| | | | | | | | | | | | | | | | | | Once the data that the compare expression provides have been digested. For example: -A INPUT -i noexist -p udplite -s 10.10.10.10/32 -d 10.0.0.10/32 -j ACCEPT doesn't show anymore the following broken output via iptables-compat-save: -A INPUT -i +t -p udplite -s 10.10.10.10/32 -d 10.0.0.10/32 -j ACCEPT Reported-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* arptables-compat: add mangle target extensionArturo Borrero2015-02-183-37/+27
| | | | | | | | This patch adds support to use the mangle target extensions, along with the required changes in the surrounding code. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xshared: calm down compilation warningPablo Neira Ayuso2015-02-181-0/+1
| | | | | | | xshared.c: In function ‘xtables_lock’: xshared.c:255:3: warning: implicit declaration of function ‘flock’ [-Wimplicit-function-declaration] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'ebtables-compat'Pablo Neira Ayuso2015-02-1115-25/+2542
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | The ebtables-compat branch provides the compatibility layer to run ebtables extensions. Currently, only the following matches / targets / watchers are supported: * 802_3 * ip * mark_m and mark * log The remaining ones should be easy to port them to on top of libxtables, they will follow up later.
| * ebtables-compat: add watchers supportArturo Borrero2015-02-115-19/+190
| | | | | | | | | | | | | | ebtables watchers are targets which always return EBT_CONTINUE. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: finish target infrastructureArturo Borrero2015-02-032-40/+70
| | | | | | | | | | Signed-off-by: Arturo Borrero <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: call extensions final checksArturo Borrero2015-02-031-33/+17
| | | | | | | | | | | | | | Let's call extensions final checks. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: add mark_m match extensionArturo Borrero2015-01-301-0/+1
| | | | | | | | | | | | | | Translate mark_m match extension to the xtables-compat environment. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: add 'ip' match extensionArturo Borrero2015-01-281-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the 'ip' match extension to ebtables-compat. It involves adapting old ebtables extension code to the xtables-compat environment. For testing: % sudo ebtables-compat -p 0x0800 --ip-src 1.1.1.1 -j ACCEPT The patch includes a cached copy of the extension kernel header. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: fix nft payload basesArturo Borrero2015-01-285-15/+23
| | | | | | | | | | | | | | | | | | | | ebtables should use NFT_PAYLOAD_LL_HEADER to fetch basic payload information from packets in the bridge family. Let's allow the add_payload() function to know in which base it should work. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: include rule counters in ebtables rulesArturo Borrero2015-01-281-0/+3
| | | | | | | | | | | | | | | | | | | | Counters are missing in ebtables rules. This patch includes them just before the target, so counters are incremented when the rule is about to take his action. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: prevent same matches to be included multiple timesArturo Borrero2015-01-281-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Using two matches options results in two copies of the match being included in the nft rule. Example before this patch: % ebtables-compat -A FORWARD -p 0x0800 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 -j ACCEPT % ebtables-compat -L [...] -p 0x0800 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 -j ACCEPT Example with this patch: % ebtables-compat -A FORWARD -p 0x0800 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 -j ACCEPT % ebtables-compat -L [...] % -p 0x0800 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 -j ACCEPT [Note: the br_ip extension comes in a follow-up patch] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: prevent options overwriteArturo Borrero2015-01-281-1/+1
| | | | | | | | | | | | | | | | Parsing options will be overwritten if every time we load a match the extension options are merged to the original options. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: add nft rule compat information to bridge rulesArturo Borrero2015-01-281-0/+2
| | | | | | | | | | | | | | | | The compat information is required by some ebtables extensions to properly work. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: fix ACCEPT printing by simplifying logicArturo Borrero2015-01-281-16/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The commit bc543af ("ebtables-compat: fix segfault in rules w/o target") doesn't handle all possible cases of target printing, and ACCEPT is left behind. BTW, the logic of target (-j XXX) printing is a bit weird. This patch simplifies it. I assume: * cs->jumpto is only filled by nft_immediate. * cs->target is only filled by nft_target. So we end with these cases: * nft_immediate contains a 'standard' target (ACCEPT, DROP, CONTINUE, RETURN, chain) Then cs->jumpto contains the target already. We have the rule. * No standard target. If nft_target contains a target, try to load it. * Neither nft_target nor nft_immediate exist. Then, assume CONTINUE. The printing path is then straight forward: either cs.jumpto or cs.target contains the target. As there isn't support for target extensions yet, there is no way to test the nft_target (cs.target) path. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: fix segfault in rules w/o targetArturo Borrero2015-01-061-3/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a segfault in rules without target. Now, these two rules are allowed: % ebtables-compat -A FORWARD -p 0x0600 -j CONTINUE % ebtables-compat -A FORWARD -p 0x0600 And both are printed: Bridge chain: FORWARD, entries: 1, policy: ACCEPT -p 0x600 -j CONTINUE Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: fix printing of extensionArturo Borrero2015-01-053-17/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch fix printing of ebt extensions: % sudo ebtables-compat -L [...] Bridge chain: FORWARD, entries: 1, policy: ACCEPT --802_3-type 0x0012 -j ACCEPT [...] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: fix counter listingArturo Borrero2014-12-232-5/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | With this patch: % sudo ebtables-compat -L --Lc Bridge table: filter Bridge chain: INPUT, entries: 0, policy: ACCEPT -j ACCEPT , pcnt = 123 -- bcnt = 123 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: add ebt 802_3 extensionArturo Borrero2014-12-235-85/+171
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the first ebtables extension to ebtables-compat. The original 802_3 code is adapted to the xtables environment. I tried to mimic as much as possible the original ebtables code paths. With this patch, ebtables-compat is able to send the 802_3 match to the kernel, but the kernel-to-userspace path is not tested and should be adjusted in follow-up patches. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * iptables: xtables-eb: fix renaming of chainsArturo Borrero2014-11-251-2/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Renaming of chains is not working. and ebtables-compat gets: libnftnl: attribute 0 assertion failed in chain.c:159 This patch brings back the parser code of the original ebtables tool: http://git.netfilter.org/ebtables.old-history/tree/userspace/ebtables2/ebtables.c#n652 I adapted the original parser code to fit in the new environment. Also tried to keep original error messages as much as possible. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * iptables: xtables-eb: user-defined chains default policy is always RETURNArturo Borrero2014-11-242-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The RETURN default policy is mandatory in user-defined chains. Builtin chains must have one of ACCEPT or DROP. So, with this patch, ebtables-compat ends with: Command: Result: -L Always RETURN for user-defined chains -P builtin RETURN Policy RETURN only allowed for user defined chains -P builtin ACCEPT|DROP ok -P userdefined RETURN|ACCEPT|DROP Policy XYZ not allowed for user defined chains -N userdefined ok -N userdefined -P RETURN|ACCEPT|DROP Policy XYZ not allowed for user defined chains Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * iptables: xtables-eb: delete extra 'policy' printfArturo Borrero2014-11-241-1/+0
| | | | | | | | | | | | | | This message doesn't exist in the original ebtables tool. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * nft-bridge: fix inversion of builtin matchesArturo Borrero2014-11-241-42/+25
| | | | | | | | | | | | | | | | This patch fixes inversion of builtin matches by updating the use of add_*() functions and using nft_invflags2cmp() as well. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * nft-bridge: fix printing of inverted protocols, addressesArturo Borrero2014-11-241-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | Previous to this patch, no '!' is printed in payload comparisions. This patch solves it, so we can print for example inverted protocols: % ebtables-compat -L [...] -p ! 0x800 -j ACCEPT Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: fix print_headerGiuseppe Longo2014-11-243-2/+11
| | | | | | | | | | | | | | This prints the header like ebtables. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ebtables-compat: use ebtables_command_state in bootstrap codePablo Neira Ayuso2014-11-248-191/+252
| | | | | | | | | | | | | | | | | | | | | | And introduce fake ebt_entry. This gets the code in sync in other existing compat tools. This will likely allow to consolidate common infrastructure. This code is still quite experimental. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * nft: bootstrap ebtables-compatPablo Neira Ayuso2014-11-2413-9/+2136
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch bootstraps ebtables-compat, the ebtables compatibility software upon nf_tables. [ Original patches: http://patchwork.ozlabs.org/patch/395544/ http://patchwork.ozlabs.org/patch/395545/ http://patchwork.ozlabs.org/patch/395546/ I have also forward port them on top of the current git HEAD, otherwise compilation breaks. This bootstrap is experimental, this still needs more work. --Pablo ] Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: use flock() instead of abstract unix socketsPablo Neira Ayuso2015-01-201-15/+7
|/ | | | | | | | | | | | | Abstract unix sockets cannot be used to synchronize several concurrent instances of iptables since an unpriviledged process can create them and prevent the legitimate iptables instance from running. Use flock() and /run instead as suggested by Lennart Poettering. Fixes: 93587a0 ("ip[6]tables: Add locking to prevent concurrent instances") Reported-by: Lennart Poettering <lennart@poettering.net> Cc: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-compat: create a separated object update type to rename chainsArturo Borrero2014-11-241-1/+11
| | | | | | | | This patch adds an explicit object update type to rename chains, so we avoid calling the nf_tables API with NLM_F_EXCL. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: kill add_*() invflags parameterArturo Borrero2014-11-127-93/+81
| | | | | | | | | | | Let's kill the invflags parameter and use directly NFT_CMP_[N]EQ. The caller must calculate which kind of cmp operation requires. BTW, this patch solves absence of inversion in some arptables-compat builtin matches. Thus, translating arptables inv flags is no longer needed. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: homogenize error messages with 'R' optionAna Rey2014-11-091-1/+1
| | | | | | | | | | | | | | | | There is a difference between error messages in iptables and iptables-compat: # iptables -R INPUT 23 -s 192.168.2.140 -j ACCEPT iptables: Index of replacement too big. # iptables-compat -R INPUT 23 -s 192.168.2.140 -j ACCEPT iptables: No chain/target/match by that name. Now, iptables-compat shows the same error message than iptables in this case. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: homogenize error messagesAna Rey2014-10-301-0/+4
| | | | | | | | | | | | | | | | | | | | | | | There are some differences between error messages in iptables and iptables-compat: # iptables -C INPUT -s 192.168.2.102 -j ACCEPT iptables: Bad rule (does a matching rule exist in that chain?). # iptables-compat -C INPUT -s 192.168.2.102 -j ACCEPT iptables: No chain/target/match by that name. # iptables -N new_chain # iptables -N new_chain iptables: Chain already exists. # iptables-compat -N new_chain # iptables-compat -N new_chain iptables: File exists. Now, iptables-compat shows the same error messages than iptables in those cases. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: fix empty chains after first invocation of iptables-compat -LPablo Neira Ayuso2014-10-241-1/+7
| | | | | | | | | | | | | | | | | | # iptables-compat -L # iptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Note that the second (and follow up) invocations after the first one display the chains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: assume chain policy NF_ACCEPT when creating built-in chainsPablo Neira Ayuso2014-10-241-22/+13
| | | | | | | | Newly created (emulated) xt built-in chain have to use NF_ACCEPT. Remove extra unused chain parameter and rename nft_chain_builtin_init to nft_xt_builtin_init too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: statify unused built-in table/chain functionsPablo Neira Ayuso2014-10-242-13/+8
| | | | | | | The functions that allows you to create built-in table and chains are required out of the scope of nft.c Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: fix chain policy reset with iptables -L -nPablo Neira Ayuso2014-10-241-3/+11
| | | | | | | | | | | | Initialize built-in tables/chains if they don't exists, otherwise simply skip. This avoids the chain policy reset to NF_ACCEPT by when you call iptables -L -n. Reported-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Ana Rey <anarey@gmail.com>
* nft-ipv46: replace offset var with ctx->payload.offsetGiuseppe Longo2014-10-182-2/+2
| | | | | | | | | The offset variable (undefined) is passed to DEBUGP function, so you get a compilation error if you try to build iptables with debug enabled Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix syntax error in nft_parse_cmp()Giuseppe Longo2014-10-181-1/+1
| | | | | | | This fixes a syntax error, remove ; in an if statement Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: remove save codePablo Neira Ayuso2014-10-091-29/+2
| | | | | | | | There is not native arptables-save. The original author provides perl scripts to implement arptables-save and arptables-restore. We should use them to mimic arptables behaviour. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: get output in sync with arptables -L -n --line-numbersPablo Neira Ayuso2014-10-096-46/+94
| | | | | | | | | | # arptables-compat -L -n --line-numbers Chain INPUT (policy ACCEPT) num target prot opt source destination <-- This header is not shown by arptables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: allow to not specify a targetPablo Neira Ayuso2014-10-096-230/+163
| | | | | | | | | | | | | | | | | | arptables allows this: # arptables -I INPUT however, arptables-compat says: arptables v1.4.21: No target provided or initalization failed Try `arptables -h' or 'arptables --help' for more information. the compat utility must mimic the same behaviour. Fix this by introducing the arptables_command_state abstraction that is already available in ip{6}tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: fix missing error reportingPablo Neira Ayuso2014-10-091-0/+5
| | | | | | | # arptables-compat -D INPUT -j ACCEPT arptables: Bad rule (does a matching rule exist in that chain?) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: nft: fix error reportingPablo Neira Ayuso2014-10-091-16/+6
| | | | | | | | | | | | | This fixes # iptables-compat -X test4345 iptables: No chain/target/match by that name. # iptables-compat -N test4345 # iptables-compat -N test4345 iptables: File exists. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>