summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* iptables-compat: homogenize error messagesAna Rey2014-10-301-0/+4
| | | | | | | | | | | | | | | | | | | | | | | There are some differences between error messages in iptables and iptables-compat: # iptables -C INPUT -s 192.168.2.102 -j ACCEPT iptables: Bad rule (does a matching rule exist in that chain?). # iptables-compat -C INPUT -s 192.168.2.102 -j ACCEPT iptables: No chain/target/match by that name. # iptables -N new_chain # iptables -N new_chain iptables: Chain already exists. # iptables-compat -N new_chain # iptables-compat -N new_chain iptables: File exists. Now, iptables-compat shows the same error messages than iptables in those cases. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: fix empty chains after first invocation of iptables-compat -LPablo Neira Ayuso2014-10-241-1/+7
| | | | | | | | | | | | | | | | | | # iptables-compat -L # iptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Note that the second (and follow up) invocations after the first one display the chains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: assume chain policy NF_ACCEPT when creating built-in chainsPablo Neira Ayuso2014-10-241-22/+13
| | | | | | | | Newly created (emulated) xt built-in chain have to use NF_ACCEPT. Remove extra unused chain parameter and rename nft_chain_builtin_init to nft_xt_builtin_init too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: statify unused built-in table/chain functionsPablo Neira Ayuso2014-10-242-13/+8
| | | | | | | The functions that allows you to create built-in table and chains are required out of the scope of nft.c Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: fix chain policy reset with iptables -L -nPablo Neira Ayuso2014-10-241-3/+11
| | | | | | | | | | | | Initialize built-in tables/chains if they don't exists, otherwise simply skip. This avoids the chain policy reset to NF_ACCEPT by when you call iptables -L -n. Reported-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Ana Rey <anarey@gmail.com>
* nft-ipv46: replace offset var with ctx->payload.offsetGiuseppe Longo2014-10-182-2/+2
| | | | | | | | | The offset variable (undefined) is passed to DEBUGP function, so you get a compilation error if you try to build iptables with debug enabled Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix syntax error in nft_parse_cmp()Giuseppe Longo2014-10-181-1/+1
| | | | | | | This fixes a syntax error, remove ; in an if statement Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: remove save codePablo Neira Ayuso2014-10-091-29/+2
| | | | | | | | There is not native arptables-save. The original author provides perl scripts to implement arptables-save and arptables-restore. We should use them to mimic arptables behaviour. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: get output in sync with arptables -L -n --line-numbersPablo Neira Ayuso2014-10-096-46/+94
| | | | | | | | | | # arptables-compat -L -n --line-numbers Chain INPUT (policy ACCEPT) num target prot opt source destination <-- This header is not shown by arptables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: allow to not specify a targetPablo Neira Ayuso2014-10-096-230/+163
| | | | | | | | | | | | | | | | | | arptables allows this: # arptables -I INPUT however, arptables-compat says: arptables v1.4.21: No target provided or initalization failed Try `arptables -h' or 'arptables --help' for more information. the compat utility must mimic the same behaviour. Fix this by introducing the arptables_command_state abstraction that is already available in ip{6}tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-compat: fix missing error reportingPablo Neira Ayuso2014-10-091-0/+5
| | | | | | | # arptables-compat -D INPUT -j ACCEPT arptables: Bad rule (does a matching rule exist in that chain?) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: nft: fix error reportingPablo Neira Ayuso2014-10-091-16/+6
| | | | | | | | | | | | | This fixes # iptables-compat -X test4345 iptables: No chain/target/match by that name. # iptables-compat -N test4345 # iptables-compat -N test4345 iptables: File exists. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: nft: fix user chain addition, deletion and renamePablo Neira Ayuso2014-10-091-27/+60
| | | | | | | Add the glue code to use the chain batching for user chain commands. Reported-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: get rid of error reporting via perrorPablo Neira Ayuso2014-09-303-85/+35
| | | | | | The compat layer should report problems in the iptables way instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: fix use after free in the batch send pathPablo Neira Ayuso2014-09-301-8/+19
| | | | | | Release the batch pages once they have been sent via sendmsg(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: nft: use nft_batch_begin and nft_batch_end from libnftnlPablo Neira Ayuso2014-09-301-21/+5
| | | | | | Use the existing functions in libnftnl to begin and end a batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: fix address prefixPablo Neira Ayuso2014-09-305-111/+196
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes: # iptables-compat -I INPUT -s 1.2.3.0/24 generates this bytecode: ip filter INPUT 20 [ payload load 4b @ network header + 12 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00ffffff ) ^ 0x00000000 ] [ cmp eq reg 1 0x00030201 ] [ counter pkts 0 bytes 0 ] and it displays: # iptables-compat-save ... -A INPUT -s 1.2.3.0/24 ip6tables-compat and arptables-compat are also fixed. This patch uses the new context structure to annotate payload, meta and bitwise, so it interprets the cmp expression based on the context. This provides a rudimentary way to delinearize the iptables-compat rule-set, but it should be enough for the built-in xtables selectors since we still use the xtables extensions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: add nft_xt_ctx structGiuseppe Longo2014-08-243-50/+69
| | | | | | | | This patch provides the context used to transfer information between different nft_parse_* function calls. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: compare layer 4 protocol in first placeGiuseppe Longo2014-08-242-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the protocol is tested after the ip address, this fixes the order testing the protocol before the ip address. Now the code generated is incorrect: ip filter INPUT 16 [ payload load 4b @ network header + 12 => reg 1 ] [ cmp eq reg 1 0x0100a8c0 ] [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ match name tcp rev 0 ] [ match name conntrack rev 3 ] [ counter pkts 0 bytes 0 ] [ immediate reg 0 accept ] With this patch, the code generated is: ip filter INPUT 16 [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ payload load 4b @ network header + 12 => reg 1 ] [ cmp eq reg 1 0x0100a8c0 ] [ bitwise reg 1 = (reg=1 & 0xffffffff ) ^ 0x00000000 ] [ match name tcp rev 0 ] [ match name conntrack rev 3 ] [ counter pkts 0 bytes 0 ] [ immediate reg 0 accept ] Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-arp: remove wrong conditionsGiuseppe Longo2014-08-111-6/+0
| | | | | | | | | | | Removes wrong conditions in flags translating functions that doesn't permit to delete rule with inverse flags set. For instance, the following command doesn't remove the rule: arptables-compat -D INPUT -i ! eth1 -j ACCEPT Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: add optional [seconds] argument to -wJiri Popelka2014-07-256-22/+59
| | | | | | | | | | | | | | | | | | | | | | This patch adds an optional numeric argument to -w option (added with 93587a0) so one can specify how long to wait for an exclusive lock. If the value isn't specified it works as before, i.e. program waits indefinitely. If user specifies it, program exits after the given time interval passes. This patch also adds the -w/--wait to nftables compat code, so the parser doesn't complain. [ In the original patch, iptables-compat -w X was not working, I have fixed by adding the dummy code not to break scripts using the new optional argument --pablo ] Signed-off-by: Jiri Popelka <jpopelka@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Makefile: fix static compilation iptables-compat without shared librariesPablo Neira Ayuso2014-06-131-1/+1
| | | | | | | | | | | | | | | | | | Fix linking problems when this configuration is used: $ ./configure --prefix=/usr --enable-shared=no --enable-static=yes $ make ... xtables_compat_multi-xtables-save.o: In function `xtables_save_main': /home/pablo/devel/iptables/iptables/xtables-save.c:98: undefined reference to `init_extensions4' xtables_compat_multi-xtables-restore.o: In function `xtables_restore_main': /home/pablo/devel/iptables/iptables/xtables-restore.c:195: undefined reference to `init_extensions4' xtables_compat_multi-xtables-standalone.o: In function `xtables_main': /home/pablo/devel/iptables/iptables/xtables-standalone.c:61: undefined reference to `init_extensions4' xtables_compat_multi-xtables-events.o: In function `xtables_events_main': /home/pablo/devel/iptables/iptables/xtables-events.c:184: undefined reference to `init_extensions4' Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: save: fix the printing of the countersGiuseppe Longo2014-06-116-24/+44
| | | | | | | | This patch prints the counters of a rule before the details, like iptables-save syntax. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: add tables and chains to the batchPablo Neira Ayuso2014-06-102-123/+249
| | | | | | | | | | | | | | | | Since kernel changes: 55dd6f9 ("netfilter: nf_tables: use new transaction infrastructure to handle table"). 91c7b38 ("netfilter: nf_tables: use new transaction infrastructure to handle chain"). it is possible to put tables and chains in the same batch (which was already including rules). This patch probes the kernel to check if if the new transaction is available, otherwise it falls back to the previous non-transactional approach to handle these two objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: remove unused codePablo Neira Ayuso2014-06-102-55/+4
| | | | | | | Remove code to set table in dormant state, this is not required from the iptables over nft compatibility layer. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: generalize batch infrastructurePablo Neira Ayuso2014-06-092-43/+43
| | | | | | Prepare inclusion of tables and chain objects in the batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables.8: --policy is either ACCEPT or DROPFlorian Westphal2014-04-171-4/+2
| | | | | | its enforced by both by libiptc and kernel. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: replace nft_rule_attr_get_u8Giuseppe Longo2014-03-244-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | Since the family declaration has been modified in libnftnl, from commit 3cd9cd06625f8181c713489cec2c1ce6722a7e16 the assertion is failed for {ip,ip6,arp}tables-compat when printing rules. iptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination libnftnl: attribute 0 assertion failed in rule.c:273 ip6tables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination libnftnl: attribute 0 assertion failed in rule.c:273 arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination libnftnl: attribute 0 assertion failed in rule.c:273 Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-save: actually parse -M/--modprobe optionJiri Popelka2014-03-174-4/+4
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-{save,restore}: warn that -b/--binary isn't implementedJiri Popelka2014-03-176-15/+18
| | | | | | see also 296dca39be Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-restore.8: file to read from can be specified as argumentJiri Popelka2014-03-141-4/+5
| | | | | | | original bug report: https://bugzilla.redhat.com/show_bug.cgi?id=1022228 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-restore.8: missing -T in synopsisJiri Popelka2014-03-141-0/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: missing bracket in iptables-save(8)Jiri Popelka2014-03-131-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables.8: update coreteam members from manpagePablo Neira Ayuso2014-03-071-3/+4
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: fix version in iptables(8)Jiri Popelka2014-03-071-1/+1
| | | | | Signed-off-by: Jiri Popelka <jpopelka@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-arp: wrong condition in parse_payloadGiuseppe Longo2014-03-071-1/+1
| | | | | | | | | | | | | | | the current condition doesn't permit to parse ip addresses when they should be. Obviously they are not printed. arptables-compat -A INPUT -s 1.1.1.1 -i eth0 -j ACCEPT arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination -j ACCEPT -i eth0 Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-arp: fix is_same_interfaces argumentsGiuseppe Longo2014-03-071-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Wrong arguments are passed to is_same_interfaces that causes sometimes to delete a wrong rule. See the example below: arptables-compat -A INPUT -i eth0 -j ACCEPT arptables-compat -A INPUT -i eth1 -j ACCEPT arptables-compat -A INPUT -i eth2 -j ACCEPT arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination -j ACCEPT -i eth0 -j ACCEPT -i eth1 -j ACCEPT -i eth2 arptables-compat -D INPUT -i eth2 -j ACCEPT arptables-compat -L Chain INPUT (policy ACCEPT) target prot opt source destination -j ACCEPT -i eth1 -j ACCEPT -i eth2 Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-events: prints arp rulesGiuseppe Longo2014-02-251-8/+15
| | | | | | | | This patch permits to print arp rules, avoiding the segfault that you got currently. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-arp: adds nft_arp_save_firewallGiuseppe Longo2014-02-251-63/+109
| | | | | | | | Adds nft_arp_save_firewall to arp family. (Avoids the segfault in xtables-events) Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'nft-compat'Pablo Neira Ayuso2014-02-1325-2/+9370
|\ | | | | | | | | This merges the branch that contains the iptables over nftables compatibility layer into master.
| * nft: Pass a line after printing out a debug messageTomasz Bursztyka2014-02-121-3/+3
| | | | | | | | | | | | | | | | In this specific places, libnftnl gives back a string on which iptables should not assume any line break, thus it's up to iptables to add it. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * nft: Remove useless error messageTomasz Bursztyka2014-02-121-40/+5
| | | | | | | | | | | | | | These are not helpful. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * nft: Initialize a table only onceTomasz Bursztyka2014-02-122-0/+11
| | | | | | | | | | | | | | | | This helps to remove some runtime overhead, especially when running xtables-restore. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * nft: A builtin chain might be created when restoringTomasz Bursztyka2014-02-123-0/+3
| | | | | | | | | | | | | | | | | | nft_chain_set() is directly used in xtables-restore.c, however at that point no builtin chains have been created yet thus the need to request to build it relevantly. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * nft: Add useful debug output when a builtin table is createdTomasz Bursztyka2014-02-121-0/+8
| | | | | | | | | | | | | | This is useful to know if a builtin table is requested to be created. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * nft-compat: fix wrong protocol context in initializationPablo Neira Ayuso2014-02-112-5/+3
| | | | | | | | | | | | | | | | | | | | | | | | This fixes matches/targets that are dependent on that IPv4/Ipv6 context, eg. # ip6tables-compat -I INPUT -j REJECT --reject-with icmp6-addr-unreachable # ip6tables-compat-save ... -A INPUT -j REJECT --reject-with icmp6-port-unreachable Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * nft-compat: fix IP6T_F_GOTO flag handlingPablo Neira Ayuso2014-02-115-13/+20
| | | | | | | | | | | | | | IPT_F_GOTO and IP6T_F_GOTO don't overlap, so this need special handling to avoid misinterpretations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * nft: adds save_matches_and_targetGiuseppe Longo2014-02-116-39/+53
| | | | | | | | | | | | | | | | | | | | | | This patch permits to save matches and target for ip/ip6/arp/eb family, required for xtables-events. Also, generalizes nft_rule_print_save to be reused for all protocol families. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * xtables: Add backward compatibility with -w optionTomasz Bursztyka2014-02-114-4/+14
| | | | | | | | | | | | | | Just to keep aligned with iptables legacy tool. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * xtables: add xtables-compat-multi for the nftables compatibility layerPablo Neira Ayuso2014-02-048-38/+123
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch should allow distributors to switch to the iptables over nftables compatibility layer in a transparent way by updating symbolic links from: lrwxrwxrwx 1 root root 13 feb 4 15:35 iptables -> xtables-multi to: lrwxrwxrwx 1 root root 13 feb 4 15:35 iptables -> xtables-compat-multi Same thing with iptables-save, iptables-restore, ip6tables, ip6tables-save, ip6tables-restore and arptables. Note that, after this patch, the following new symlinks are installed: * iptables-compat * iptables-compat-save * iptables-compat-restore * ip6tables-compat * ip6tables-compat-save * ip6tables-compat-restore * arptables-compat which point to the new binary xtables-compat-multi. The idea is to keep both native and compatibility tools installed in the system, which should also make it easier for testing purposes. The iptables over nftables compatibility layer is enabled by default and it requires the libmnl and libnftnl libraries. If you don't want to compile the compatibility layer, you can still disable it through --disable-nftables. This patch also includes changes to adapt the existing code to this approach. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>