summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* doc: Install ip{6,}tables-restore-translate.8 man pagesPhil Sutter2019-07-292-1/+4
| | | | | | | | | Just like in b738ca3677785 ("doc: Install ip{6,}tables-translate.8 manpages"), create man pages for *-restore-translate tools as semantic links to xtables-translate.8. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Install nft-variant man pages only if enabledPhil Sutter2019-07-291-6/+6
| | | | | | | | Man pages relevant for nftables backend only (xtables-*, *-translate.8) were installed even if --disable-nftables was given at configure time. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Drop support for /etc/xtables.confPhil Sutter2019-07-296-482/+9
| | | | | | | | As decided upon at NFWS2019, drop support for configurable nftables base chains to use with iptables-nft. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Set errno in nft_rule_flush()Phil Sutter2019-07-291-1/+3
| | | | | | | | | | | When trying to flush a non-existent chain, errno gets set in nft_xtables_config_load(). That is an unintended side-effect and when support for xtables.conf is later removed, iptables-nft will emit the generic "Incompatible with this kernel." error message instead of "No chain/target/match by that name." as it should. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* restore legacy behaviour of iptables-restore when rules start with -4/-6Adel Belhouane2019-07-293-0/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | v2: moved examples to testcase files Legacy implementation of iptables-restore / ip6tables-restore allowed to insert a -4 or -6 option at start of a rule line to ignore it if not matching the command's protocol. This allowed to mix specific ipv4 and ipv6 rules in a single file, as still described in iptables 1.8.3's man page in options -4 and -6. The implementation over nftables doesn't behave correctly in this case: iptables-nft-restore accepts both -4 or -6 lines and ip6tables-nft-restore throws an error on -4. There's a distribution bug report mentioning this problem: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=925343 Restore the legacy behaviour: - let do_parse() return and thus not add a command in those restore special cases - let do_commandx() ignore CMD_NONE instead of bailing out I didn't attempt to fix all minor anomalies, but just to fix the regression. For example in the line below, iptables should throw an error instead of accepting -6 and then adding it as ipv4: % iptables-nft -6 -A INPUT -p tcp -j ACCEPT Signed-off-by: Adel Belhouane <bugs.a.b@free.fr> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-save: Merge into xtables_save_main()Phil Sutter2019-07-231-110/+13
| | | | | | | | The only thing missing was handling of EBTABLES_SAVE_COUNTER env var, but that can be done after parsing parameters in bridge-specific code. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-save: Merge into xtables_save_main()Phil Sutter2019-07-231-60/+3
| | | | | | | | With all preparations in place, xtables_save_main() can replace it with not further changes. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-save: Pass format flags to do_output()Phil Sutter2019-07-231-4/+6
| | | | | | | | Let callers define the flags to pass to nft_rule_save() instead of just setting the counters boolean. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-save: Make COMMIT line optionalPhil Sutter2019-07-231-1/+4
| | | | | | | | | | Explicit commits are not used by either arp- nor ebtables-save. In order to share code between all the different *-save tools without inducing changes to ruleset dump contents, allow for callers of do_output() to turn COMMIT lines on or off. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-save: Pass optstring/longopts to xtables_save_main()Phil Sutter2019-07-231-7/+13
| | | | | | | | | | | Introduce variables for the different optstrings so short and long options live side-by-side. In order to make xtables_save_main() more versatile, pass optstring and longopts via parameter. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-save: Avoid mixed code and declarationsPhil Sutter2019-07-231-4/+4
| | | | | | | Also move time() calls to where they are used. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Make nft_for_each_table() more versatilePhil Sutter2019-07-233-14/+21
| | | | | | | Support passing arbitrary data (via void pointer) to the callback. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-save: Fix table compatibility checkPhil Sutter2019-07-231-3/+4
| | | | | | | | | | | | | | The builtin table check guarding the 'is incompatible' warning was wrong: The idea was to print the warning only for incompatible tables which are builtin, not for others. Yet the code would print the warning only for non-builtin ones. Also reorder the checks: nft_table_builtin_find() is fast and therefore a quick way to bail for uninteresting tables. The compatibility check is needed for the remaining tables, only. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-save: Unify *-save header/footer commentsPhil Sutter2019-07-237-33/+23
| | | | | | | | | Make eb- and arptables-save print both header and footer comments, too. Also print them for each table separately - the timing information is worth the extra lines in output. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-save: Fix counter formattingPhil Sutter2019-07-234-30/+81
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The initial problem was 'ebtables-save -c' printing iptables-style counters but at the same time not disabling ebtables-style counter output (which was even printed in wrong format for ebtables-save). The code around counter output was complicated enough to motivate a larger rework: * Make FMT_C_COUNTS indicate the appended counter style for ebtables. * Use FMT_EBT_SAVE to distinguish between '-c' style counters and the legacy pcnt/bcnt ones. Consequently, ebtables-save sets format to: FMT_NOCOUNTS - for no counters FMT_EBT_SAVE - for iptables-style counters FMT_EBT_SAVE | FMT_C_COUNTS - for '-c' style counters For regular ebtables, list_rules() always sets FMT_C_COUNTS (iptables-style counters are never used there) and FMT_NOCOUNTS if no counters are requested. The big plus is if neither FMT_NOCOUNTS nor FMT_C_COUNTS is set, iptables-style counters are to be printed - both in iptables and ebtables. This allows to drop the ebtables-specific 'save_counters' callback. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Fix error message for invalid parametersPhil Sutter2019-07-231-1/+1
| | | | | | | | | | | | | | | | | | With empty ruleset, ebtables-nft would report the wrong argv: | % sudo ./install/sbin/ebtables-nft -vnL | ebtables v1.8.3 (nf_tables): Unknown argument: './install/sbin/ebtables-nft' | Try `ebtables -h' or 'ebtables --help' for more information. After a (successful) call to 'ebtables-nft -L', this would even segfault: | % sudo ./install/sbin/ebtables-nft -vnL | zsh: segmentation fault sudo ./install/sbin/ebtables-nft -vnL Fixes: acde6be32036f ("ebtables-translate: Fix segfault while parsing extension options") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-save: Use argv[0] as program namePhil Sutter2019-07-181-10/+11
| | | | | | | | Don't hard-code program names. This also fixes for bogus 'xtables-save' name which is no longer used. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: exit in case we can't fetch current genidFlorian Westphal2019-07-151-2/+8
| | | | | | | | | | | When running iptables -nL as non-root user, iptables would loop indefinitely. With this change, it will fail with iptables v1.8.3 (nf_tables): Could not fetch rule set generation id: Permission denied (you must be root) Reported-by: Amish <anon.amish@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Move send/receive buffer sizes into nft_handlePhil Sutter2019-07-032-10/+9
| | | | | | | | | Store them next to the mnl_socket pointer. While being at it, add a comment to mnl_set_rcvbuffer() explaining why the buffer size is changed. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Pass nft_handle down to mnl_batch_talk()Phil Sutter2019-07-031-23/+18
| | | | | | | | | >From there, pass it along to mnl_nft_socket_sendmsg() and further down to mnl_set_{snd,rcv}buffer(). This prepares the code path for keeping stored socket buffer sizes in struct nft_handle. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Set socket receive bufferPhil Sutter2019-07-031-4/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When trying to delete user-defined chains in a large ruleset, iptables-nft aborts with "No buffer space available". This can be reproduced using the following script: | #! /bin/bash | iptables-nft-restore <( | | echo "*filter" | for i in $(seq 0 200000);do | printf ":chain_%06x - [0:0]\n" $i | done | for i in $(seq 0 200000);do | printf -- "-A INPUT -j chain_%06x\n" $i | printf -- "-A INPUT -j chain_%06x\n" $i | done | echo COMMIT | | ) | iptables-nft -X The problem seems to be the sheer amount of netlink error messages sent back to user space (one EBUSY for each chain). To solve this, set receive buffer size depending on number of commands sent to kernel. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Fix program names in help textsPhil Sutter2019-06-091-6/+7
| | | | | | | | | | | | | Avoid referring to wrong or even non-existent commands: * When calling xtables_restore_main(), pass the actual program name taken from argv[0]. * Use 'prog_name' in unknown parameter and help output instead of 'xtables-restore' which probably doesn't exist. * While being at it, fix false whitespace in help text. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace IPTABLES_VERSION by PACKAGE_VERSIONJan Engelhardt2019-05-3012-27/+30
| | | | | | | | | | | | | The IPTABLES_VERSION C macro replicates the PACKAGE_VERSION C macro (both have the same definition, "@PACKAGE_VERSION@"). Since IPTABLES_VERSION, being located in internal.h, is not exposed to downstream users in any way, it can just be replaced by PACKAGE_VERSION, which saves a configure-time file substitution. This goes towards eliminating unnecessary rebuilds after rerunning ./configure. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: reset netlink sender buffer size of socket restartPablo Neira Ayuso2019-05-201-0/+1
| | | | | | | | Otherwise, mnl_set_sndbuffer() skips the buffer update after socket restart. Then, sendmsg() fails with EMSGSIZE later on when sending the batch to the kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: do not retry on EINTRPablo Neira Ayuso2019-05-201-21/+5
| | | | | | | Patch ab1cd3b510fa ("nft: ensure cache consistency") already handles consistency via generation ID. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: don't care about previous state in ERESTARTPablo Neira Ayuso2019-05-201-7/+10
| | | | | | | We need to re-evalute based on the existing cache generation. Fixes: 58d7de0181f6 ("xtables: handle concurrent ruleset modifications") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: don't skip table addition from ERESTARTPablo Neira Ayuso2019-05-201-9/+1
| | | | | | | I don't find a scenario that trigger this case. Fixes: 58d7de0181f6 ("xtables: handle concurrent ruleset modifications") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix for explicit rule flushesPhil Sutter2019-05-201-1/+1
| | | | | | | | | | | The commit this fixes added a new parameter to __nft_rule_flush() to mark a rule flush job as implicit or not. Yet the code added to that function ignores the parameter and instead always sets batch job's 'implicit' flag to 1. Fixes: 77e6a93d5c9dc ("xtables: add and set "implict" flag on transaction objects") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: keep original cache in case of ERESTARTPablo Neira Ayuso2019-05-202-4/+22
| | | | | | | | | | | | | | | Phil Sutter says: "The problem is that data in h->obj_list potentially sits in cache, too. At least rules have to be there so insert with index works correctly. If the cache is flushed before regenerating the batch, use-after-free occurs which crashes the program." This patch keeps around the original cache until we have refreshed the batch. Fixes: 862818ac3a0de ("xtables: add and use nft_build_cache") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: ensure cache consistencyPablo Neira Ayuso2019-05-201-6/+16
| | | | | | | Check for generation ID before and after fetching the cache to ensure consistency. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: cache table listPablo Neira Ayuso2019-05-202-45/+58
| | | | | | | nft_table_find() uses the table list cache to look up for existing tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: add flush_cache()Pablo Neira Ayuso2019-05-191-11/+19
| | | | | | | | | This new function takes a struct nft_cache as parameter. This patch also introduces __nft_table_builtin_find() which is required to look up for built-in tables without the nft_handle structure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: add __nft_table_builtin_find()Pablo Neira Ayuso2019-05-191-6/+12
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: statify nft_rebuild_cache()Pablo Neira Ayuso2019-05-192-2/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: add struct nft_cachePablo Neira Ayuso2019-05-192-19/+25
| | | | | | Add new structure that encloses the cache and update the code to use it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* man: refer to iptables-translate and ip6tablesPablo Neira Ayuso2019-05-151-4/+5
| | | | | | Instead of xtables-translate. Remove old reference to xtables-compat. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Fix ipt-restore/0004-restore-race_0 testcasePhil Sutter2019-05-151-4/+3
| | | | | | | | | | | | | | | Two issues fixed: * XTABLES_LIBDIR was set wrong (CWD is not topdir but tests/). Drop the export altogether, the testscript does this already. * $LINES is a variable set by bash, so initial dump sanity check failed all the time complaining about a spurious initial dump line count. Use $LINES1 instead. Fixes: 4000b4cf2ea38 ("tests: add test script for race-free restore") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Don't leak iter in error path of __nft_chain_zero_counters()Phil Sutter2019-05-151-1/+3
| | | | | | | | | If batch_rule_add() fails, this function leaked the rule iterator object. Fixes: 4c54c892443c2 ("xtables: Catch errors when zeroing rule rounters") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xshared: check for maximum buffer length in add_param_to_argv()Pablo Neira Ayuso2019-04-301-18/+28
| | | | | | | Bail out if we go over the boundary, based on patch from Sebastian. Reported-by: Sebastian Neef <contact@0day.work> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add test script for race-free restoreFlorian Westphal2019-04-271-0/+119
| | | | | | | | | | | | | | | | | | | | | | | | | | xtables-nft-restore ignores -w, check that we don't add duplicate rules when parallel restores happen. With a slightly older iptables-nft version this ususally fails with: I: [EXECUTING] iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0 iptables-restore v1.8.2 (nf_tables): line 5: CHAIN_USER_ADD failed (File exists): chain UC-0 line 6: CHAIN_USER_ADD failed (File exists): chain UC-1 W: [FAILED] ipt-restore/0004-restore-race_0: expected 0 but got 4 or I: [EXECUTING] iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0 iptables-restore v1.8.2 (nf_tables): line 1: TABLE_FLUSH failed (No such file or directory): table filter or /tmp/tmp.SItN4URxxF /tmp/tmp.P1y4LIxhTl differ: byte 7159, line 137 As the legacy version should not have such race (due to nature of full-table-replace), only do one iteration for legacy case. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: handle concurrent ruleset modificationsFlorian Westphal2019-04-272-4/+128
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We currently race when several xtables-nft-restore processes attempt to handle rules in parallel. For instance, when no rules are present at all, then iptables-nft-restore < X & iptables-nft-restore < X ... can cause rules to be restored twice. Reason is that both processes might detect 'no rules exist', so neither issues a flush operation. We can't unconditionally issue the flush, because it would cause kernel to fail with -ENOENT unless the to-be-flushed table exists. This change passes the generation id that was used to build the transaction to the kernel. In case another process changed *any* rule somewhere, the transaction will now fail with -ERESTART. We then flush the cache, re-fetch the ruleset and refresh our transaction. For example, in the above 'parallel restore' case, the iptables-restore instance that lost the race would detect that the table has been created already, and would add the needed flush. In a similar vein, in case --noflush is used, we will add the flush op for user-defined chains that were created in the mean-time. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add and set "implict" flag on transaction objectsFlorian Westphal2019-04-271-19/+24
| | | | | | | | | | | | | | | | | | | | | | Its used to flag the rule flushes that get added in user-defined-chains that get redefined with --noflush. IOW, those objects that are added not by explicit instruction but to keep semantics. With --noflush, iptables-legacy-restore will behave as if -F USERCHAIN was given, in case USERCHAIN exists and USERCHAIN gets redefined, i.e.: iptables-save v1.8.2 on Thu Apr 18 17:11:05 2019 *filter :USERCHAIN - [0:0] COMMIT ... will remove all existing rules from USERCHAIN. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add and use nft_build_cacheFlorian Westphal2019-04-273-9/+26
| | | | | | | | | | | | Will be used with the "generation id" infrastructure. When we're told that the commit failed because someone else made changes, we can use this to re-initialize the cache and then revalidate the transaction list (e.g. to detect that we now have to flush the user-defined chain 'foo' that we wanted to create, but was added just now by someone else). Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add skip flag to objectsFlorian Westphal2019-04-271-18/+31
| | | | | | | | | | | | This will be used to skip transaction objects when committing to kernel. This is needed for example when we restore a table that doesn't exist yet. In such a case we would already build a flush operation so we can just enable it when we hit problem with the generation id and we find that the table/chain was already created in the mean time. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: unify user chain add/flush for restore caseFlorian Westphal2019-04-275-78/+59
| | | | | | | | | | | | The idea here is to move the 'flush' decision into the core, rather than have the decision in the frontend. This will be required later when "generation id" is passed to kernel. In this case, we might have to add the flush when re-trying the transaction. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: return-codes script is bash specificFlorian Westphal2019-04-191-1/+1
| | | | | | The script fails on systems where sh is not bash. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-legacy: add missing config.h includeLucas Stach2019-04-031-0/+1
| | | | | | | | | | | This fixes a IPv4 only build, where this file would have references to functions that aren't built in this case. I'm not sure how it ends up with ENABLE_IPV6 defined without the config.h include, but since this was clearly missing and fixed my issue, I didn't bother tracking down the chain. Signed-off-by: Lucas Stach <l.stach@pengutronix.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* man: iptables-save: Add note about module autoloadingPhil Sutter2019-04-031-2/+5
| | | | | | | | | Using '-t' parameter in iptables-save might lead to kernel module loading, just like with iptables itself. Copy the hint from iptables.8 to inform users. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-save: Point at existing man page in help textPhil Sutter2019-03-141-3/+6
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-legacy.8: Remove stray colonPhil Sutter2019-03-141-1/+1
| | | | | | | | This obviously doesn't belong there. Fixes: be70918eab26e ("xtables: rename xt-multi binaries to -nft, -legacy") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>