summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* extensions: libxt_NFLOG: don't truncate log prefix on print/saveKyle Bowman2022-01-182-0/+56
| | | | | | | | | | | | | | | | | | | | | | | | When parsing the rule, use a struct with a layout compatible to that of struct xt_nflog_info, but with a buffer large enough to contain the whole 128-character nft prefix. We always send the nflog-group to the kernel since, for nft, log and nflog targets are handled by the same kernel module, and are distinguished by whether they define an nflog-group. Therefore, we must send the group even if it is zero, or the kernel will configure the target as a log, not an nflog. Changes to nft_is_expr_compatible were made since only targets which have an `nflog-group` are compatible. Since nflog targets are distinguished by having an nflog-group, we ignore targets without one. We also set the copy-len flag if the snap-len is set since without this, iptables will mistake `nflog-size` for `nflog-range`. Signed-off-by: Kyle Bowman <kbowman@cloudflare.com> Signed-off-by: Alex Forster <aforster@cloudflare.com> Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libxt_NFLOG: use nft built-in logging instead of xt_NFLOGKyle Bowman2022-01-182-0/+29
| | | | | | | | | | | | | | | Replaces the use of xt_NFLOG with the nft built-in log statement. This additionally adds support for using longer log prefixes of 128 characters in size. Until now NFLOG has truncated the log-prefix to the 64-character limit supported by iptables-legacy. We now use the struct xtables_target's udata member to store the longer 128-character prefix supported by iptables-nft. Signed-off-by: Kyle Bowman <kbowman@cloudflare.com> Signed-off-by: Alex Forster <aforster@cloudflare.com> Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: fix indentation error.Jeremy Sowden2022-01-151-21/+21
| | | | | | | `add_action` was indented with 7 spaces. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* ip6tables: Use the shared do_parse, tooPhil Sutter2022-01-122-466/+40
| | | | | | | Same change as with iptables, merely have to set IP6T_F_PROTO flag in ipv6_proto_parse(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables: Use xtables' do_parse() functionPhil Sutter2022-01-122-451/+39
| | | | | | | | | | To do so, a few conversions are needed: - Make use of xt_params->optstring - Make use of xt_params->print_help callback - Switch to using a proto_parse callback Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Move proto_parse and post_parse callbacks to xsharedPhil Sutter2022-01-124-131/+139
| | | | | | | They are not nft-variant-specific and may therefore be shared with legacy. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Store parsed wait and wait_interval in xtables_argsPhil Sutter2022-01-122-5/+5
| | | | | | While nft-variants don't care, legacy ones do. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Move do_parse to shared spacePhil Sutter2022-01-125-559/+560
| | | | | | | | | | | Small adjustments were needed: - Pass line variable via xt_cmd_parse, xshared.c does not have it in namespace. - Replace opts, prog_name and prog_vers defines by the respective xt_params field reference. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Do not pass nft_handle to do_parse()Phil Sutter2022-01-128-50/+64
| | | | | | | | | Make it fit for sharing with legacy iptables, drop nft-specific parameter. This requires to mirror proto_parse and post_parse callbacks from family_ops somewhere reachable - use xt_cmd_parse, it holds other "parser setup data" as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Pass xtables_args to check_inverse()Phil Sutter2022-01-121-13/+13
| | | | | | | It holds the accessed family field as well and is more generic than nft_handle. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Pass xtables_args to check_empty_interface()Phil Sutter2022-01-121-4/+4
| | | | | | | It holds the accessed family field as well and is more generic than nft_handle. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Move struct nft_xt_cmd_parse to xshared.hPhil Sutter2022-01-125-21/+21
| | | | | | | Preparing for shared use with legacy variants, move it to "neutral ground" and give it a more generic name. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Pull table validity check out of do_parse()Phil Sutter2022-01-121-4/+4
| | | | | | | Makes do_parse() more generic, error codes don't change so this should be safe. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Drop xtables' family on demand featurePhil Sutter2022-01-121-4/+0
| | | | | | | | | | | | | This conditional h->family assignment was added by commit 3f7877e6be987 ("xtables-restore: add -4 and -6 support") with the intention to support something like 'xtables-restore -6 <ip6tables.dump', i.e. having family-agnostic commands which accept flags to set the family. Yet commit be70918eab26e ("xtables: rename xt-multi binaries to -nft, -legacy") removed support for such command names back in 2018 and nobody has complained so far. Therefore drop this leftover as it makes do_parse() more generic. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: set correct register valueFlorian Westphal2021-12-231-1/+1
| | | | | | | | | | | NFTNL_EXPR_META_DREG equals NFTNL_EXPR_PAYLOAD_BASE, so we set dreg to the payload base instead. It "works" because the simple nft rules currently generated via ipables-nft have base == register-number but this is a coincidence. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-*-restore: Drop pointless line referencePhil Sutter2021-12-164-8/+8
| | | | | | | | | There's no need to mention the offending line number in error message when calling xtables_error() with a status of PARAMETER_PROBLEM as that will cause a call to xtables_exit_tryhelp() which in turn prints "Error occurred at line: N". Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Extend basic_exit_err()Phil Sutter2021-12-165-72/+0
| | | | | | | Basically merge the function with xtables_exit_error, printing a status-specific footer for parameter or version problems. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables_globals: Embed variant name in .program_versionPhil Sutter2021-12-169-16/+16
| | | | | | Both are constant strings, so precompiler may concat them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share exit_tryhelp()Phil Sutter2021-12-165-46/+24
| | | | | | | The function existed three times in identical form. Avoid having to declare extern int line in xshared.c by making it a parameter. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share a common printhelp functionPhil Sutter2021-12-165-239/+108
| | | | | | | | | | | | | Help texts in legacy and nft variants are supposed to be identical, but those of iptables and ip6tables largely overlapped already. By referring to xt_params and afinfo pointers, it is relatively trivial to craft a suitable help text on demand, so duplicated help texts can be eliminated. As a side-effect, this fixes ip6tables-nft help text - it was identical to that of iptables-nft. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share print_match_save() between legacy ip*tablesPhil Sutter2021-12-164-62/+32
| | | | | | | | The only difference between the former two copies was the type of ip*_entry parameter. But since it is treated opaque, just hide that detail by casting to void. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Make load_proto() staticPhil Sutter2021-11-232-2/+1
| | | | | | | The last outside users vanished ten years ago. Fixes: 449cdd6bcc8d1 ("src: combine default_command functions") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Drop unused function print_proto()Phil Sutter2021-11-232-16/+0
| | | | | | | | | The last users vanished back in 2013. There is identical code in save_rule_details(), but with only a single user there's not much point in keeping the function. Fixes: cdc78b1d6bd7b ("nft: convert rule into a command state structure") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share print_header() with legacy iptablesPhil Sutter2021-11-239-161/+82
| | | | | | | | | | | | | | | Legacy iptables fetches the relevant data via libiptc before calling the shared routine which merely prints data as requested. Drop the 'basechain' parameter, instead make sure a policy name is passed only with base chains. Since the function is not shared with ebtables (which uses a very rudimental header instead), this is safe. In order to support legacy iptables' checking of iptc_get_references() return code (printing an error message instead of the reference count), make refs parameter signed and print the error message if it's negative. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share print_fragment() with legacyPhil Sutter2021-11-236-35/+25
| | | | | | | | | | | Also add a fake mode to make it suitable for ip6tables. This is required because IPT_F_FRAG value clashes with IP6T_F_PROTO, so ip6tables rules might seem to have IPT_F_FRAG bit set. While being at it, drop the local variable 'flags' from print_firewall(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share print_rule_details() with legacyPhil Sutter2021-11-238-76/+37
| | | | | | | | | | Have to pass pointer to counters directly since different fields are being used for some reason. Since proto_to_name() is not used outside of xshared.c anymore, make it static. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share save_ipv{4,6}_addr() with legacyPhil Sutter2021-11-236-119/+70
| | | | | | | While being at it, make save_ipv4_addr() accept an in_addr* as mask - mask_to_str() needs it anyway. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share save_rule_details() with legacyPhil Sutter2021-11-238-91/+50
| | | | | | | | | | The function combines printing of input and output interfaces and protocol parameter, all being IP family independent. Extend the function to print fragment option ('-f'), too if requested. While being at it, drop unused iptables_command_state parameter and reorder the remaining ones a bit. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share print_iface() functionPhil Sutter2021-11-235-80/+33
| | | | | | | | | | | Merge the three identical copies into one and name it 'save_iface' (as the printed syntax is for "save"-format). Leave arptables alone for now, its rather complicated whitespace printing doesn't allow for use of the shared function. Also keep ebtables' custom implementation, it is used for the --logical-in/--logical-out long-options, too. Apart from that, ebtables-nft does not use a mask, at all. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Change whitespace printing in save_rule callbackPhil Sutter2021-11-236-25/+30
| | | | | | | This aligns whitespace printing with legacy iptables' print_rule4() in order to prepare for further code-sharing. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Merge and share parse_chain()Phil Sutter2021-11-235-59/+26
| | | | | | | Have a common routine to perform chain name checks, combining all variants' requirements. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Unbreak xtables-translatePhil Sutter2021-11-081-1/+8
| | | | | | | | | | | | | | | | Fixed commit broke xtables-translate which still relied upon do_parse() to properly initialize the passed iptables_command_state reference. To allow for callers to preset fields, this doesn't happen anymore so do_command_xlate() has to initialize itself. Otherwise garbage from stack is read leading to segfaults and program aborts. Although init_cs callback is used by arptables only and arptables-translate has not been implemented, do call it if set just to avoid future issues. Fixes: cfdda18044d81 ("nft-shared: Introduce init_cs family ops callback") Signed-off-by: Phil Sutter <phil@nwl.cc> Tested-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Merge xtables-arp-standalone.c into xtables-standalone.cPhil Sutter2021-10-207-699/+218
| | | | | | | | | | | | | | | | | | | By declaring the relevant family_ops callbacks for arptables, the code becomes ready to just use do_commandx() instead of a dedicated parser. As a side-effect, this enables a bunch of new features in arptables-nft: * Support '-C' command * Support '-S' command * Support rule indexes just like xtables, e.g. in '-I' or '-R' commands * Reject chain names starting with '!' * Support '-c N,M' counter syntax Since arptables still accepts intrapositioned negations, add code to cover that but print a warning like iptables did 12 years ago prior to removing the functionality. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: arptables accepts empty interface namesPhil Sutter2021-10-201-8/+15
| | | | | | | | The empty string passed as interface name is simply ignored by legacy arptables. Make the new common parser print a warning but accept it. Calling xtables_parse_interface() with an empty string is safe. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Derive xtables_globals from familyPhil Sutter2021-10-205-8/+23
| | | | | | | | | | | | | | Prepare xtables_main() for use with other families than IPV4 or IPV6 which both use the same xtables_globals object. Therefore introduce a function to map from family value to xtables_globals object pointer. In do_parse(), use xt_params pointer as well instead of direct reference. While being at it, Declare arptables_globals and ebtables_globals in xtables_multi.h which seems to be the proper place for that. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Make nft_check_xt_legacy() family agnosticPhil Sutter2021-10-201-0/+5
| | | | | | | Of course there is no such thing as *_tables_names for ebtables, so no legacy tables checking for ebtables-nft. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-arp: Introduce post_parse callbackPhil Sutter2021-10-203-128/+178
| | | | | | | This accomplishes the same tasks as e.g. nft_ipv4_post_parse() plus some arptables-specific bits. Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables: Use standard data structures when parsingPhil Sutter2021-10-201-142/+138
| | | | | | | | Use the compound data structures introduced for dedicated parsing routines in other families instead of the many local variables. This allows to standardize code a bit for sharing a common parser later. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce xtables_globals print_help callbackPhil Sutter2021-10-202-3/+7
| | | | | | | | With optstring being stored in struct xtables_globals as well, it is a natural choice to store a pointer to a help printer also which matches the supported options. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-standalone: Drop version number from init errorsPhil Sutter2021-10-201-8/+4
| | | | | | | | | | | Aside from the rather unconventional formatting, if those initialization functions fail we've either released a completely broken iptables or the wrong libraries are chosen by the loader. In both cases, the version number is not really interesting. While being at it, fix indenting of the first exit() call. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Add family ops callbacks wrapping different nft_cmd_* functionsPhil Sutter2021-10-204-177/+228
| | | | | | | | | | Commands supporting multiple source/destination addresses need to iterate over them and call the respective nft_cmd_* function multiple times. These loops are family-specific though as each family uses a different data structure within struct iptables_command_state to store the addresses. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Simplify addr_mask freeingPhil Sutter2021-10-202-11/+6
| | | | | | Introduce a generic 'ptr' union field to pass to free(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Introduce init_cs family ops callbackPhil Sutter2021-10-203-5/+17
| | | | | | | Arptables sets a few defaults in struct iptables_command_state upon initialization. Introduce a callback to do that. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Store optstring in xtables_globalsPhil Sutter2021-10-204-6/+9
| | | | | | | | | | | Preparing for a common option parser, store the string of options for each family inside the respective xtables_globals object. The array of long option definitions sitting in there already indicates it's the right place. While being at it, drop '-m' support from arptables-nft. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Introduce builtin_tables_lookup()Phil Sutter2021-10-209-24/+25
| | | | | | | The set of builtin tables to use is fully determined by the given family so just look it up instead of having callers pass it explicitly. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: fix bashismJeremy Sowden2021-10-011-1/+1
| | | | | | | | | The `<(cmd)` redirection is specific to Bash. Update the shebang accordingly. Fixes: 63ab4fe3a191 ("ebtables: Avoid dropping policy when flushing") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: Delete builtin chains compatiblyPhil Sutter2021-09-273-9/+66
| | | | | | | | | | | | | | | | | | | | | | | | | | Attempting to delete all chains if --delete-chain is called without argument has unwanted side-effects especially legacy iptables users are not aware of and won't expect: * Non-default policies are ignored, a previously dropping firewall may start accepting traffic. * The kernel refuses to remove non-empty chains, causing program abort even if no user-defined chain exists. Fix this by requiring a rule cache in that situation and make builtin chain deletion depend on its policy and number of rules. Since this may change concurrently, check again when having to refresh the transaction. Also, hide builtin chains from verbose output - their creation is implicit, so treat their removal as implicit, too. When deleting a specific chain, do not allow to skip the job though. Otherwise deleting a builtin chain which is still in use will succeed although not executed. Fixes: 61e85e3192dea ("iptables-nft: allow removal of empty builtin chains") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-chain: Introduce base_slot fieldPhil Sutter2021-09-273-29/+5
| | | | | | | | For builtin chains, record the base_chains array slot they are assigned to. This simplifies removing that reference if they are being deleted later. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Check base-chain compatibility when adding to cachePhil Sutter2021-09-275-44/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | With introduction of dedicated base-chain slots, a selection process was established as no longer all base-chains ended in the same chain list for later searching/checking but only the first one found for each hook matching criteria is kept and the rest discarded. A side-effect of the above is that table compatibility checking started to omit consecutive base-chains, making iptables-nft less restrictive as long as the expected base-chains were returned first from kernel when populating the cache. Make behaviour consistent and warn users about the possibly disturbing chains found by: * Run all base-chain checks from nft_is_chain_compatible() before allowing a base-chain to occupy its slot. * If an unfit base-chain was found (and discarded), flag the table's cache as tainted and warn about it if the remaining ruleset is otherwise compatible. Since base-chains that remain in cache would pass nft_is_chain_compatible() checking, remove that and reduce it to rule inspection. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: cache: Avoid double free of unrecognized base-chainsPhil Sutter2021-09-272-3/+28
| | | | | | | | | On error, nft_cache_add_chain() frees the allocated nft_chain object along with the nftnl_chain it points at. Fix nftnl_chain_list_cb() to not free the nftnl_chain again in that case. Fixes: 176c92c26bfc9 ("nft: Introduce a dedicated base chain array") Signed-off-by: Phil Sutter <phil@nwl.cc>