summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* nft: Exit if nftnl_alloc_expr failsPhil Sutter2022-06-211-15/+16
| | | | | | | | | | In some code-paths, 'reg' pointer remaining uninitialized is used later so at least minimal error checking is necessary. Given that a call to nftnl_alloc_expr() with sane argument should never fail, complain and exit if it happens. Fixes: 7e38890c6b4fb ("nft: prepare for dynamic register allocation") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables.8: mention that iptables exits when setuidFlorian Westphal2022-06-171-0/+5
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-restore: Deny --init-tablePhil Sutter2022-06-111-0/+3
| | | | | | | Allowing this segfaults the program. The deny is in line with legacy ebtables, so no point in implementing support for that. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Extend zero counters test a bit furtherPhil Sutter2022-06-111-0/+15
| | | | | | Test zeroing a single rule's counters as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Extend iptables-xml test a bitPhil Sutter2022-06-111-9/+1
| | | | | | | | Call with --combine as well, even though output doesn't differ. Also there's no need to skip for xtables-nft-multi, it provides the same functionality. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Add some more rules to 0002-verbose-output_0Phil Sutter2022-06-111-0/+15
| | | | | | This increases coverage of function print_match() from 0 to 86.6%. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Add --enable-profiling configure optionPhil Sutter2022-06-111-0/+1
| | | | | | A little convenience to prepare a build for analysis with gcov/gprof. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Make some functions staticPhil Sutter2022-06-102-34/+17
| | | | | | | | With all ip(6)tables variants using the same do_parse() function, quite a bunch of functions are not used outside of xshared.c anymore. Make them static. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-legacy: Drop redundant include of xtables-multi.hPhil Sutter2022-06-101-4/+0
| | | | | | | | The header is included unconditionally first, so no point in doing it a second time of ENABLE_NFTABLES is defined. Fixes: be70918eab26e ("xtables: rename xt-multi binaries to -nft, -legacy") Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables: Support -x/--exact flagPhil Sutter2022-06-081-1/+1
| | | | | | | | | | Legacy arptables accepts but ignores the flag. Yet there are remains of the functionality in sources, like OPT_EXPANDED define and a print_num() function which acts on FMT_KILOMEGAGIGA flag being set or not. So instead of mimicking legacy behaviour by explicitly ignoring -x flag for arptables, just enable the feature for it. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Check overhead in iptables-save and -restorePhil Sutter2022-06-021-0/+37
| | | | | | | Some repeated calls have been reduced recently, assert this in a test evaluating strace output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* treewide: use uint* instead of u_int*Nick Hainke2022-05-182-2/+2
| | | | | | | | | | | | | | | | | | | | Gcc complains about missing types. Some commits introduced u_int* instead of uint*. Use uint treewide. Fixes errors in the form of: In file included from xtables-legacy-multi.c:5: xshared.h:83:56: error: unknown type name 'u_int16_t'; did you mean 'uint16_t'? 83 | set_option(unsigned int *options, unsigned int option, u_int16_t *invflg, | ^~~~~~~~~ | uint16_t make[6]: *** [Makefile:712: xtables_legacy_multi-xtables-legacy-multi.o] Error 1 Avoid libipq API breakage by adjusting libipq.h include accordingly. For arpt_mangle.h kernel uAPI header, apply same change as in kernel commit e91ded8db5747 ("uapi: netfilter_arp: use __u8 instead of u_int8_t"). Signed-off-by: Nick Hainke <vincent@systemli.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix build for -Werror=format-securityPhil Sutter2022-05-131-1/+1
| | | | | | Gcc complains about the omitted format string. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix EPERM handling for extensions without rev 0Phil Sutter2022-05-112-4/+13
| | | | | | | | | | Treating revision 0 as compatible in EPERM case works fine as long as there is a revision 0 of that extension defined in DSO. Fix the code for others: Extend the EPERM handling to all revisions and keep the existing warning for revision 0. Fixes: 17534cb18ed0a ("Improve error messages for unsupported extensions") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Drop xtables_globals 'optstring' fieldPhil Sutter2022-05-117-7/+20
| | | | | | | | | | | Define the different optstrings in xshared.h instead, they are not relevant for other libxtables users. This is a partial revert of commit 65b150ae382a8 ("xshared: Store optstring in xtables_globals") to avoid breaking libxtables' ABI compatibility. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Extend xtables_printhelp() for arptablesPhil Sutter2022-05-116-118/+43
| | | | | | | | | | | | | | | | | | | | | | | | The function checks afinfo->family already to cover ip6tables specifics, doing the same for arptables does not make things much worse. This changes arptables-nft help output slightly: * List possible negations extrapositioned, which is preferred anyway (arptables-nft supports both) * List --out-interface option at lexically sorted position * Print --wait option, it's ignored just like with iptables * Restore default target option printing as with legacy arptables (not sure if arptables-nft ever did this) by explicitly loading them. While being at it, add --set-counters short option '-c' to help output for ip(6)tables. This effectively removes the need for (and all users of) xtables_global's 'print_help' callback, thus effectively reverts commit fe83b12fc910e ("libxtables: Introduce xtables_globals print_help callback") which broke libxtables' ABI compatibility. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Move arp_opcodes into shared spacePhil Sutter2022-05-117-28/+21
| | | | | | | It will be referenced by xtables_printhelp() if printing for arptables and therefore must be present in legacy as well even if unused. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: split gen_payload() to allocate register and initialize expressionPablo Neira Ayuso2022-05-021-4/+14
| | | | | | Add __gen_payload(), in preparation for the dynamic register allocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: prepare for dynamic register allocationPablo Neira Ayuso2022-05-026-94/+137
| | | | | | | | | Store the register that has been allocated and pass it on to the next expression. NFT_REG_1 is still used. No functional changes are expected. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: pass handle to helper functions to build netlink payloadPablo Neira Ayuso2022-05-027-66/+73
| | | | | | | Pass struct nft_handle to helper functions in preparation for the dynamic register allocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: native mark matching supportPablo Neira Ayuso2022-05-022-0/+59
| | | | | | Use meta mark + bitwise + cmp instead of nft_compat mark match. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: pass struct nft_xt_ctx to parse_meta()Pablo Neira Ayuso2022-05-026-10/+10
| | | | | | In preparation for native mark match support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-shared: update context register for bitwise expressionPablo Neira Ayuso2022-05-021-0/+2
| | | | | | | | Update the destination register, otherwise nft_parse_cmp() gives up on interpreting the cmp expression when bitwise sreg != dreg. Fixes: 2c4a34c30cb4 ("iptables-compat: fix address prefix") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: Boost rule target checks by announcing chain namesPhil Sutter2022-03-172-0/+2
| | | | | | | | | | | | | | | | | When restoring a ruleset, feed libxtables with chain names from respective lines to avoid an extension search. While the user's intention is clear, this effectively disables the sanity check for clashes with target extensions. But: * The check yielded only a warning and the clashing chain was finally accepted. * Users crafting iptables dumps for feeding into iptables-restore likely know what they're doing. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Reject standard targets as chain names when restoringPhil Sutter2022-03-173-7/+4
| | | | | | | | | | | | | Reuse parse_chain() called from do_parse() for '-N' and rename it for a better description of what it does. Note that by itself, this patch will likely kill iptables-restore performance for big rulesets due to the extra extension lookup for chain lines. A following patch announcing those chains to libxtables will alleviate that. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Florian Westphal <fw@strlen.de>
* tests: shell: Fix 0004-return-codes_0 for static buildsPhil Sutter2022-03-151-1/+1
| | | | | | | In static builds, xtables_find_match() returns a slightly different error message if not found - make grep accept both. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Review static extension loadingPhil Sutter2022-03-154-16/+13
| | | | | | | | Combine the init_extensions() call common to all families, do not load IPv6 extensions for iptables and vice versa, drop the outdated comment about "same table". Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Call init_extensions{,a,b}() for static buildsEtienne Champetier2022-03-157-3/+26
| | | | | | | | | | Add calls to arp- and ebtables-specific extension loaders where missing. Also consistently call init_extensions() for them, as some extensions (ebtables 'limit' and arptables 'CLASSIFY' and 'MARK') live in libxt_* files. Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Simplify static build extension loadingPhil Sutter2022-03-1511-29/+0
| | | | | | | | | | Instead of guarding all calls to init_extensions*(), define stubs if not used. While at it, also add the missing prototypes for arp- and ebtables extension initializers. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Don't pass command state opaque to family ops callbacksPhil Sutter2022-03-108-102/+84
| | | | | | | | | | | There are no family-specific versions of struct iptables_command_state anymore, so no need to hide it behind void pointer. Pass the type as-is and save a few casts. While at it, drop unused callbacks parse_bitwise and parse_cmp. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* xshared: Prefer xtables_chain_protos lookup over getprotoentPhil Sutter2022-03-101-4/+4
| | | | | | | | | | | | | | | | | | | | | | | When dumping a large ruleset, common protocol matches such as for TCP port number significantly slow down rule printing due to repeated calls for getprotobynumber(). The latter does not involve any caching, so /etc/protocols is consulted over and over again. As a simple countermeasure, make functions converting between proto number and name prefer the built-in list of "well-known" protocols. This is not a perfect solution, repeated rules for protocol names libxtables does not cache (e.g. igmp or dccp) will still be slow. Implementing getprotoent() result caching could solve this. As a side-effect, explicit check for pseudo-protocol "all" may be dropped as it is contained in the built-in list and therefore immutable. Also update xtables_chain_protos entries a bit to align with typical /etc/protocols contents. The testsuite assumes those names, so the preferred ones prior to this patch are indeed uncommon nowadays. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Speed up immediate parsingPhil Sutter2022-03-102-19/+19
| | | | | | | | | | | | | | | | | | | | | | | | | Parsing of rules which jump to a chain pointlessly causes a call to xtables_find_target() despite the code already knowing the outcome. Avoid the significant delay for rulesets with many chain jumps by performing the (standard) target lookup only for accept/drop/return verdicts. From a biased test-case on my VM: | # iptables-nft-save | grep -c -- '-j' | 133943 | # time ./old/iptables-nft-save >/dev/null | real 0m45.566s | user 0m1.308s | sys 0m8.430s | # time ./new/iptables-nft-save >/dev/null | real 0m3.547s | user 0m0.762s | sys 0m2.476s Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Simplify immediate parsingPhil Sutter2022-03-106-47/+14
| | | | | | | | | | Implementations of parse_immediate callback are mostly trivial, the only relevant part is access to family-specific parts of struct iptables_command_state when setting goto flag for iptables and ip6tables. Refactor them into simple set_goto_flag callbacks. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* Improve error messages for unsupported extensionsPhil Sutter2022-03-021-3/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a given extension was not supported by the kernel, iptables would print a rather confusing error message if extension parameters were given: | # rm /lib/modules/$(uname -r)/kernel/net/netfilter/xt_LOG.ko | # iptables -A FORWARD -j LOG --log-prefix foo | iptables v1.8.7 (legacy): unknown option "--log-prefix" Avoid this by pretending extension revision 0 is always supported. It is the same hack as used to successfully print extension help texts as unprivileged user, extended to all error codes to serve privileged ones as well. In addition, print a warning if kernel rejected revision 0 and it's not a permissions problem. This helps users find out which extension in a rule the kernel didn't like. Finally, the above commands result in these messages: | Warning: Extension LOG revision 0 not supported, missing kernel module? | iptables: No chain/target/match by that name. Or, for iptables-nft: | Warning: Extension LOG revision 0 not supported, missing kernel module? | iptables v1.8.7 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain FORWARD Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Implement xtables lock timeout using signalsJethro Beekman2022-02-158-77/+36
| | | | | | | | | | | | | | | | | | | | | | | Previously, if a lock timeout is specified using `-wN `, flock() is called using LOCK_NB in a loop with a sleep. This results in two issues. The first issue is that the process may wait longer than necessary when the lock becomes available. For this the `-W` option was added, but this requires fine-tuning. The second issue is that if lock contention is high, invocations using `-w` (without a timeout) will always win lock acquisition from invocations that use `-w N`. This is because invocations using `-w` are actively waiting on the lock whereas those using `-w N` only check from time to time whether the lock is free, which will never be the case. This patch removes the sleep loop and deprecates the `-W` option (making it non-functional). Instead, flock() is always called in a blocking fashion, but the alarm() function is used with a non-SA_RESTART signal handler to cancel the system call. Signed-off-by: Jethro Beekman <jethro@fortanix.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables.8: Describe the effect of multiple -v flagsPhil Sutter2022-02-111-1/+5
| | | | | | | Functionality differs between legacy and nft variants, detail the effects a bit. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: cache: Dump rules if debuggingPhil Sutter2022-02-081-2/+16
| | | | | | | | If verbose flag was given twice, dump rules while populating the cache. This not only applies to list commands, but all requiring a rule cache - e.g. insert with position. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Add debug output to table creationPhil Sutter2022-02-081-0/+15
| | | | | | | This at least allows to inspect how tables are created on demand. Also requires setting NFTNL_TABLE_FAMILY for clean output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Support verbose modePhil Sutter2022-02-083-9/+30
| | | | | | | | Accept '-v' flag in both ebtables-nft and ebtables-nft-restore. Mostly interesting because it allows for netlink debug output when specified multiple times. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Set NFTNL_CHAIN_FAMILY in new chainsPhil Sutter2022-02-081-4/+8
| | | | | | | | | | | | | | | | | | | | | | Kernel doesn't need it, but debug output improves significantly. Before this patch: | # iptables-nft -vv -A INPUT | [...] | unknown filter INPUT use 0 type filter hook unknown prio 0 policy accept packets 0 bytes 0 | [...] and after: | # iptables-nft -vv -A INPUT | [...] | ip filter INPUT use 0 type filter hook input prio 0 policy accept packets 0 bytes 0 | [...] While being at it, make nft_chain_builtin_alloc() take only the builtin table's name as parameter - it's the only field it accesses. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-restore: Support for extra debug outputPhil Sutter2022-02-044-5/+17
| | | | | | | | | | | | | | Treat --verbose just like iptables itself, increasing debug level with number of invocations. To propagate the level into do_command() callback, insert virtual '-v' flags into rule lines. The only downside of this is that simple verbose output is changed and now also prints the rules as they are added - which would be useful if the lines contained the chain they apply to. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Use verbose flag to toggle debug outputPhil Sutter2022-02-044-19/+22
| | | | | | | | | | | Copy legacy iptables' behaviour, printing debug output if verbose flag is given more than once. Since nft debug output applies to netlink messages which are not created until nft_action() phase, carrying verbose value is non-trivial - introduce a field in struct nft_handle for that. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: add support for native tcp flag matchingFlorian Westphal2022-01-291-2/+29
| | | | | | prefer payload + bitwise + cmp to nft_compat match. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-shared: add tcp flag dissectionFlorian Westphal2022-01-291-0/+26
| | | | | | | Detect payload load of th->flags and convert it to xt tcp match structure. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: prefer native expressions instead of tcp matchFlorian Westphal2022-01-291-0/+32
| | | | | | | | | | | | | | Instead of using nft_compat+xtables tcp match, prefer to emit payload+cmp or payload+range expression. Unlike udp, tcp has flag bits that can be matched too but we have to fall back to the xt expression for now. We also don't support tcp option match, but thats a rarely used feature anyway. Delinearization support for ports was added in previous patches. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: prefer native expressions instead of udp matchFlorian Westphal2022-01-291-0/+122
| | | | | | | | | Instead of using nft_compat+xtables udp match, prefer to emit payload+cmp or payload+range expression. Delinearization support was added in previous patches. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-shared: support native udp port delinearizeFlorian Westphal2022-01-292-4/+122
| | | | | | same as previous patch, but for udp. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-shared: support native tcp port range delinearizeFlorian Westphal2022-01-293-1/+116
| | | | | | | adds support for nft ... tcp dport != min-max Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-shared: support native tcp port delinearizeFlorian Westphal2022-01-292-2/+179
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This extends iptables-nft dissector to decode native tcp port matching. nft ruleset: table ip filter { chain INPUT { type filter hook input priority filter; policy accept; tcp sport 12345 tcp sport 12345 tcp dport 6789 tcp sport < 1024 tcp dport >= 1024 } } $ iptables-nft-save -A INPUT -p tcp -m tcp --sport 12345 -A INPUT -p tcp -m tcp --sport 12345 --dport 6789 -A INPUT -p tcp -m tcp --sport 0:1023 -A INPUT -p tcp -m tcp --dport 1024:65535 This would allow to extend iptables-nft to prefer native payload expressions for --sport,dport in the future. Also, parse_cmp must not clear the "payload" flag, this is because cmp-based range expressions will contain following sequence: payload => reg1 cmp reg1 > minv cmp reg1 < maxv ... so second cmp would work. Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Fix response to unprivileged usersPhil Sutter2022-01-203-2/+66
| | | | | | | | | | | | | | | | | | | | | Expected behaviour in both variants is: * Print help without error, append extension help if -m and/or -j options are present * Indicate lack of permissions in an error message for anything else With iptables-nft, this was broken basically from day 1. Shared use of do_parse() then somewhat broke legacy: it started complaining about inability to create a lock file. Fix this by making iptables-nft assume extension revision 0 is present if permissions don't allow to verify. This is consistent with legacy. Second part is to exit directly after printing help - this avoids having to make the following code "nop-aware" to prevent privileged actions. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Florian Westphal <fw@strlen.de>