summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* nft-shared: Use xtables_calloc()Phil Sutter2018-09-251-11/+2
| | | | | | | | This simplifies code a bit since it takes care of checking for out-of-memory conditions. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Use the shared nft_ipv46_parse_target()Phil Sutter2018-09-251-8/+1
| | | | | | | | No point in having a dedicated implementation for 'parse_target' callback since it is identical with the shared one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Combine parse_target() and command_jump() implementationsPhil Sutter2018-09-256-249/+79
| | | | | | | | | | | | | | | | | | | | | | | | | | | Merge these two functions from xtables, iptables, ip6tables and arptables. Both functions were basically identical in the first three, only the last one required a bit more attention. To eliminate access to 'invflags' in variant-specific location, move the call to set_option() into callers. This is actually consistent with parsing of other options in them. As with command_match(), use xt_params instead of the different *_globals objects to refer to 'opts' and 'orig_opts'. It was necessary to rename parse_target() as it otherwise clashes with a static function of same name in libxt_SET. In arptables, the maximum allowed target name is a bit larger, so introduce xtables_globals.target_maxnamelen defining the value. It is used in the shared xt_parse_target() implementation. Implementation of command_jump() in arptables diverted from the others for no obvious reason. The call to parse_target() was done outside of it and a pointer to cs->arp was passed but not used inside. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Combine command_match() implementationsPhil Sutter2018-09-255-108/+40
| | | | | | | | | | This merges the basically identical implementations of command_match() from xtables, iptables and ip6tables into one. The only required adjustment was to make use of xt_params instead of the different *_globals objects. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: Gitignore xtables-{legacy, nft}-multi scriptsPhil Sutter2018-09-241-0/+2
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Drop pointless checkPhil Sutter2018-09-241-1/+1
| | | | | | | | All commands this block handles set p->chain. Also the pointer is dereferenced before, so no point in checking for it to be non-NULL. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Fix incorrect strcmp() in nft_arp_rule_find()Phil Sutter2018-09-241-1/+1
| | | | | | | | | Since nft_arp_rule_to_cs() may not set cs->jumpto, later call to strcmp() may be passed a NULL pointer. Therefore check if the pointer is valid before doing so. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Don't read garbage in nft_ipv4_parse_payload()Phil Sutter2018-09-241-0/+1
| | | | | | | | | The problem here is that get_frag() does not set 'inv' in any case, so when later checking its value, garbage may be read. Sanitize this case by setting 'inv' to false before calling get_frag(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Fix a few cases of pointless assignmentsPhil Sutter2018-09-247-14/+8
| | | | | | | | This gets rid of a number of assignments which are either redundant or not used afterwards. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-arp: Drop ineffective conditionalPhil Sutter2018-09-241-3/+0
| | | | | | | | Since fw->arp.arhln is of type __u8, its value will never become less than zero. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: Use print_ifaces() from xtablesPhil Sutter2018-09-246-99/+31
| | | | | | | | | | Move the function to xshared.c for common use between legacy and xtables sources. While being at it, silence a covscan warning triggered by that function as it couldn't verify input buffers won't exceed IFNAMSIZ. Therefore use snprintf() when writing to the local buffer. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Share print_ipv{4,6}_addr() from xtablesPhil Sutter2018-09-246-119/+73
| | | | | | | | | | | | | | | | These functions contain code which occurs in legacy's print_firewall() functions, so use them there. Rename them to at least make clear they print more than a single address. Also introduce ipv{4,6}_addr_to_string() which take care of converting an address/netmask pair into string representation in a way which doesn't upset covscan (since that didn't detect that 'buf' may not be exceeded by the strings written into it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-apply: Replace signal numbers by namesPhil Sutter2018-09-241-1/+2
| | | | | | | | As covscan stated: "Trapping signals by number is not well defined. Prefer signal names." Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-apply: Quote strings passed to echoPhil Sutter2018-09-241-3/+3
| | | | | | | | Not a real problem here, but covscan got confused by one string containing 'then' keyword. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Remove unused variable in nft_is_table_compatible()Phil Sutter2018-09-241-1/+1
| | | | | | | | This is a leftover from previous cleanup. Fixes: 098ee2e91756c ("xtables-save: Ignore uninteresting tables") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ip{, 6}tables-restore: Fix for uninitialized array 'curtable'Phil Sutter2018-09-242-2/+2
| | | | | | | | | | When reading sufficiently malformed input, parser might hit end of loop without having written the current table name into curtable and therefore calling strcmp() with uninitialized buffer. Avoid this by setting curtable to zero upon declaration. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Mark fall through cases in switch() statementsPhil Sutter2018-09-241-0/+1
| | | | | | | | | | | | Typical covscan complaint, non-empty fall throughs should be marked as such. There was but a single case which should break instead, namely in libebt_log.c: It is not critical, since the next case merely asserts 'invert' being zero (which can't be as it was checked before). But while being at it, introduce log_chk_inv() to consolidate the semantically equal cases for the various log types. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: Integrate getethertype.c from xtables corePhil Sutter2018-09-242-162/+1
| | | | | | | | | | | | | | This moves getethertype.c into libxtables so that both extensions and xtables-nft-multi may use the implementations therein. New users are libebt_arp and libebt_vlan which drop their own duplicated implementations of getethertypebyname() for the shared one. This change originated from a covscan report of extensions' implementations not checking fopen() return value which should be implicitly fixed by this as well. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for wrong assert() in __nft_table_flush()Phil Sutter2018-09-241-1/+1
| | | | | | | | | | The code obviously tries to assert that nft_table_builtin_find() returned a valid pointer before dereferencing it, but the wrong argument was given. Assume this is just a typo and insert the missing underscore. Fixes: 9b896224e0bfc ("xtables: rework rule cache logic") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-save: Ignore uninteresting tablesPhil Sutter2018-09-182-14/+9
| | | | | | | | | | | | | | | | | | When running iptables-nft-save with other tables present, the dump succeeded but the tool complained about those other tables. In an environment where iptables-nft and nftables are uses in parallel, this is an expected situation, so only complain about incompatible builtin tables. While being at it, move the table existence check from __do_output() into do_output() since the former may be called from nft_for_each_table() in which case the table is guaranteed to exist. Also use nft_table_builtin_find() in nft_is_table_compatible() instead of open-coding the search by name in h->tables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Fix for potential array boundary overstepPhil Sutter2018-09-131-1/+1
| | | | | | | | Fix the parameter check in nft_ebt_standard_target() to avoid an array out of bounds access in ebt_standard_targets. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Accept --wait in iptables-nft-restorePhil Sutter2018-09-102-0/+23
| | | | | | | | | | | Passing --wait option to iptables-nft-restore led to program abort because the flag parameter was not skipped. Mimick iptables-restore behaviour when encountering --wait or --wait-interval options (but still ignore the parameter). Fixes: b9d7b49d84bc2 ("xtables-compat: restore: sync options with iptables-restore") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Don't check all rules for being compatiblePhil Sutter2018-09-101-0/+6
| | | | | | | | | | | | | Commit f8e29a13fed8d ("xtables: avoid bogus 'is incompatible' warning") fixed for compatibility checking to extend over all chains, not just the relevant ones. This patch does the same for rules: Make sure only rules belonging to the relevant table are being considered. Note that comparing the rule's table name is sufficient here since the table family is already considered when populating the rule cache. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-restore: Fix flushing referenced custom chainsPhil Sutter2018-09-102-10/+8
| | | | | | | | | | | | | | | | | | | | | | | | The logic to replicate 'iptables-restore --noflush' behaviour of flushing custom chains if listed in the dump was broken for chains being referenced. A minimal dump reproducing the issue is: | *filter | :foobar - [0:0] | -I INPUT -j foobar | -A foobar -j ACCEPT | COMMIT With --noflush, this can be restored just once in iptables-nft-restore. Consecutive attempts return an error since xtables tries to delete the referenced chain and recreate it instead of performing a real flush. Fix this by really flushing the custom chain in 'chain_user_flush' callback and running 'chain_user_add' callback only if the chain doesn't exist already. Fixes: df3d92bec6007 ("xtables-compat-restore: flush user-defined chains with -n") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Drop use of IP6T_F_PROTOPhil Sutter2018-09-011-4/+0
| | | | | | | | | | | | | | | | | Setting this bit in cs->fw6.ipv6.flags was done only for rules parsed from command line, not for those read from kernel. As a result, appropriate rules could not be deleted. A simple test case is: | # ip6tables-nft -A INPUT -p tcp -j ACCEPT | # ip6tables-nft -D INPUT -p tcp -j ACCEPT | iptables: Bad rule (does a matching rule exist in that chain?). Since the flag is not used anywhere in xtables-nft, dropping its use fixes the bug as well as setting it in both cases. Fixes: 5ee03e6df4172 ("xtables: Use meta l4proto for -p match") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Align return codes with legacy iptablesPhil Sutter2018-09-015-5/+107
| | | | | | | | Make sure return codes match legacy ones at least for a few selected commands typically used to check ruleset state. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for deleting rules with commentPhil Sutter2018-08-292-9/+21
| | | | | | | | | | | | | | | | | | | | | | Comment match allocation in command_match() and nft_rule_to_iptables_command_state() were misaligned in that the latter set match_size to just what is required instead of what the match needs at maximum like the further. This led to failure when comparing them later and therefore a rule with a comment could not be deleted. For comments of a specific length, the udata buffer is padded by libnftnl so nftnl_rule_get_data() returns a length value which is larger than the string (including NULL-byte). The trailing data is supposed to be ignored, but compare_matches() can't not know about that detail and therefore returns a false-negative if trailing data contains junk. To overcome this, use strncpy() when populating match data in nft_rule_to_iptables_command_state(). While being at it, make sure comment match allocation in that function is identical to what command_match() does with regards to data allocation size. Also use xtables_calloc() which does the required error checking. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Add missing deinitializationPhil Sutter2018-08-243-5/+8
| | | | | | | | | | These fix reports for definitely lost blocks in valgrind. Not really memleaks, but due to nft_handle going out of scope they're counted as lost. Still worth fixing though since it reduces noise when auditing code for real issues. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Review match/target lookup once morePhil Sutter2018-08-244-165/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a partial revert of my previous commit with similar subject - it missed to apply the needed changes to ebtables-translate as well and on top of that still left some leaks and use-after-frees in place. The new strategy is to make ebtables extension loading compatible with that of xtables, because otherwise the heavy code sharing between ebtables-translate and iptables-translate will cause trouble. Basically, ebt_add_match() and ebt_add_watcher() copy what xtables' command_match() does, but after the actual extension argument parsing has already happened. Therefore they duplicate the loaded match along with its data and reset the original one to default state for being reused (e.g., by ebtables-restore). Since mflags/tflags are cleared while doing so, clearing them for all loaded extensions in do_commandeb() is not necessary anymore. In ebt_command_default() (where extension parameter parsing happens), the list of added extensions to the current rule are consolidated first so no duplicate extension loading happens. With the above in place, ebt_cs_clean() can be reverted to its old state. Apart from sharing command_jump() function with ebtables-translate, make use of nft_init_eb() there, as well. Fixes: aa7fb04fcf72c ("ebtables: Review match/target lookup") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Add a few missing exit callsPhil Sutter2018-08-242-2/+7
| | | | | | | | | Mostly to reduce noise from valgrind output, add missing calls to destroy iterators in nft.c and add cleanup for the populated nft_handle in xtables_eb_save_main(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-translate: Fix segfault while parsing extension optionsPhil Sutter2018-08-243-73/+47
| | | | | | | | | | | | | | | Previous review of match/target lookup did not consider xtables-eb-translate.c which contains the same code. Fix parsing of target/match arguments there as well by introducing ebt_command_default() which consolidates the previously duplicated code. One notable quirk in comparison to the similar xtables code: Since ebtables allows for negations in ugly places (e.g. '--arp-opcode ! 1'), ebt_check_inverse2() has to be called first. Fixes: aa7fb04fcf72c ("ebtables: Review match/target lookup") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: trivial: Leverage C99-style initializers a bit morePhil Sutter2018-08-241-1/+1
| | | | | | | | | | This nit was discovered when comparing do_commandeb() with do_commandeb_xlate(): Since 'cs' is initialized upon declaration already, initialization of field '.eb.bitmask' may be moved there as well. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Use meta l4proto for -p matchPhil Sutter2018-08-214-4/+9
| | | | | | | | | | | | | | | Use of payload expression to match against IPv6 nexthdr field does not work if extension headers are present. A simple example for that is matching for fragmented icmpv6 traffic. Instead, generate a 'meta l4proto' expression which works even if extension headers are present. For consistency, apply the same change to iptables-nft as well. No adjustment to reverse path required as the needed bits were added by commit 6ea7579e6fe24 ("nft: decode meta l4proto") already. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for segfault in iptables-nftPhil Sutter2018-08-172-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Trying to set a chain's policy in an invalid table resulted in a segfault. Reproducer was: | # iptables -t broute -P BROUTING ACCEPT Fix this by aborting in nft_chain_new() if nft_table_builtin_find() returned NULL for the given table name. For an illustrative error message, set errno to ENXIO in the above case and add an appropriate Mesage to nft_strerror(). While being at it, improve the error message if an invalid policy was given. Before: | # iptables-nft -t filter -P INPUT ACCEPTdf | iptables: Incompatible with this kernel. After: | # iptables-nft -t filter -P INPUT ACCEPTdf | iptables: Bad policy name. Run `dmesg' for more information. Third unrelated change in this patch: Drop error checking of nft_chain_set() in do_commandx(): The function never returns negative, so that check never yielded true. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Fix entries count in chain listingPhil Sutter2018-08-166-9/+40
| | | | | | | | | | | | | | | The previous fix for reference counts in iptables-nft output wasn't complete: While iptables lists the number of references for each custom chain (i.e., the number of jumps to it), ebtables lists number of entries (i.e., the number of rules contained) for each chain. Both used the same value for it, although they are different metrics. Fix this by passing both numbers separately to the 'print_header' callback so that each tool may print the desired value. Fixes: a0698de9866d2 ("xtables: Do not count rules as chain references") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Make 'iptables -S nonexisting' return non-zeroPhil Sutter2018-08-164-15/+86
| | | | | | | | | | | | To be consistent with legacy iptables, calling -S with a non-existing chain should lead to an error message. This is how some scripts find out whether a user-defined chain exists or not. Make sure doing the same for an existing chain does succeed, even if an invalid rule number was given. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Fix for listing of non-existent chainsPhil Sutter2018-08-162-5/+7
| | | | | | | | | | | | | | | | | When trying to list a non-existent chain, ebtables-nft would just print the table header and then exit with a code of zero. In order to be more consistent with legacy ebtables, change the code to: * Print table header only if chosen chain is found and * propagate the error condition if chain was not found to print an error message. Note that this does not establish full parity with legacy ebtables due to the error code being 1 instead of 255 and the error message differing from the legacy one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix for no output in iptables-nft -SPhil Sutter2018-08-161-0/+17
| | | | | | | | | | | Just like with 'iptables-nft -L', we have to make sure the standard set of chains exist for a given table when listing it using '-S' flag. The added code was just copied over from nft_rule_list() which does the same. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Merge libebt_limit.c into libxt_limit.cPhil Sutter2018-08-163-6/+9
| | | | | | | | | | | | | | | | | Both extensions were very similar already, but now that they both are translated into native nftables code, their actual difference (i.e. match size) doesn't matter anymore. This change comes with one caveat: Since ebtables limit match is not in its own file anymore, match preloading automatically also loads the NFPROTO_UNSPEC limit match. This is not a problem per se since match lookup will prefer the family-specific one, but when parsing unknown options, a match without 'parse' callback is encountered. Therefore do_commandeb() has to check existence of that callback prior to dereferencing it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Use native nftables limit expressionPhil Sutter2018-08-162-4/+95
| | | | | | | | | | | | | | | | | | | | The original issue was that for a rule with limit match added by ebtables-nft, the kernel might attempt to use xt_limit instead of ebt_limit (and fail due to that). This happens if xt_limit.ko is loaded but ebt_limit.ko is not, because the kernel prefers the family-independent variants. There are multiple ways to avoid above issue, but using neither xt_limit nor ebt_limit with nft-variants should be the most effective one. Therefore translate a created limit match in userspace into native nftables code before sending it to kernel and do the reverse translation when listing rules. Apart from the translation routines, this requires slight adjustment of nft_is_expr_compatible() since neither xt_limit nor ebt_limit support byte-based limits or inverted limit match. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Remove flags misinterpretationsPhil Sutter2018-08-101-9/+7
| | | | | | | | | | | | | | | This is actually quite a mess: xtables-eb.c defines names for bits in 'flags' variable of do_commandeb(), though these tend to clash with bit names defined in xshared.h due to the same 'OPT_' prefix. Therefore checking for bits OPT_NUMERIC and OPT_VERBOSE is syntactically correct, but semantically wrong as they actually refer to bits OPT_COMMAND and OPT_PROTOCOL. Since ebtables doesn't support numeric nor verbose modes, just replace the checks with zero values. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for wrong counter format in -S outputPhil Sutter2018-08-096-32/+82
| | | | | | | | | | | | | | | | | | | | | | Legacy iptables uses '-c PCNT BCNT' format in listed rules, nft-variant used '[PCNT BCNT]' prefix like with iptables-save. In order to pass the counter format preference along, FMT_C_COUNTS is introduced and related 'format' checks adjusted. Since legacy iptables prints the counters between matches and target, this change affects save_matches_and_target() function. In order to get access to the rule counters, it's declaration is adjusted to receive iptables_command_state pointer instead of match, target and jumpto pointers from the same object. While being at it, integrate jump to user-defined chain into it as well since the related code in both callers was almost identical. Though since different rule flags are used between iptables and ip6tables, pass a 'goto_flag' boolean instead of the actual 'flags' bitfield. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Don't pass full invflags to add_compat()Phil Sutter2018-08-094-3/+13
| | | | | | | | | | | The function expects a boolean, not a bitfield. This bug caused inversion in another match to carry over to protocol match by accident. The supplied testcase contains rules which then fail because they contain matches requiring that protocol. Fixes: 4ef77b6d1b52e ("xtables: fix missing protocol and invflags") Fixes: 4143a08819a07 ("ebtables-compat: add nft rule compat information to bridge rules") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Improve xtables-monitor first impressionPhil Sutter2018-08-091-1/+2
| | | | | | | | | | | | | First time users are likely to call 'xtables-monitor --help' to see what's going on. Make this situation a bit more pleasant for them: * When complaining about illegal arguments, add a final newline character to the error message. * Actually support '--help' long option as an alias to '-h'. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: Fix skipping for recent nft-only testsPhil Sutter2018-08-094-4/+4
| | | | | | | | | | | | | | | In an attempt to sanitize shell scripting, exit test in recent testcases was altered, which led to them being skipped even in nft test runs. Drop the quotes so that globbing happens again. While here, improve the check a bit to glob only on leading path part, not also the file name. Also print "skip ..." just like nft-only/0001compat_0 testcase does. Fixes: f1d8508fd6fdc ("tests: Add arptables-{save,restore} testcases") Fixes: fbf0bf7c079d8 ("tests: Add ebtables-{save,restore} testcases") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Spelling fixes in xtables-monitorPhil Sutter2018-08-072-7/+7
| | | | | | | | | Fix a few minor spelling issues in xtables-monitor help output and man page. While being at it, change 'ipv4' and 'ipv6' to 'IPv4' and 'IPv6', respectively. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix potential segfault in nft_rule_append()Phil Sutter2018-08-061-1/+3
| | | | | | | | | If batch_rule_add() failed (ENOMEM), nft_rule_append() frees the rule and then tries to add it to the rule cache. Better return 0 (failure) instead of continuing. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: Add ebtables-{save,restore} testcasesPhil Sutter2018-08-062-0/+145
| | | | | | | | | | | This actually does a bit more since it creates the ruleset using separate ebtables calls. Note that there are a few commented out lines containing commands which don't apply for unknown reasons - something to investigate later. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: Add arptables-{save,restore} testcasesPhil Sutter2018-08-062-0/+86
| | | | | | | | | | | This actually does a bit more since it creates the ruleset using separate arptables calls. Note that there are a few commented out lines containing commands which don't apply for unknown reasons - something to investigate later. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Implement arptables-{save,restore}Phil Sutter2018-08-069-43/+146
| | | | | | | | | | | This adds C implementations for arptables-save and -restore in compat layer based on the two perl scripts in legacy arptables repository. To share common code, introduce nft_init_arp() analogous to nft_init_eb() introduced earlier. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>