summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* iptables-nft: exit nonzero when iptables-save cannot decode all expressionsFlorian Westphal2022-11-235-14/+32
| | | | | | | | | | | | We always return 0, even if we printed some error message half-way. Increment an error counter whenever an error message was printed so that the chain-loop can exit with an error if this counter is nonzero. Another effect is that iptables-save will no longer print the COMMIT line anmore. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* nft: check for unknown meta keysFlorian Westphal2022-11-234-8/+21
| | | | | | | | | | | | | Set ->errmsg when the meta key isn't supported by iptables-nft instead of pretending everything is fine. The old code is good enough to handle rules added by iptables-nft, but its not enough to handle rules added by native nft. At least make sure that there is a an error message telling that iptables-nft could not decode the entire ruleset. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-shared: replace nftnl_expr_get_data() by nftnl_expr_get()Pablo Neira Ayuso2022-11-151-1/+1
| | | | | | | Replace nftnl_expr_get_data() alias by real function call. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: replace nftnl_.*_nlmsg_build_hdr() by nftnl_nlmsg_build_hdr()Pablo Neira Ayuso2022-11-153-15/+15
| | | | | | | Replace alias to real nftnl_nlmsg_build_hdr() function call. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Drop extra newline from xtables_error() callsPhil Sutter2022-11-1511-68/+64
| | | | | | | | | | Since basic_exit_err() appends a newline to the message itself, drop explicit ones. While being at it, fix indentation and join texts split over multiple lines. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Introduce port_match_single_to_range()Phil Sutter2022-11-151-93/+37
| | | | | | | The same algorithm was present four times, outsource it. Also use max()/min() macros for a more readable boundary notation. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share make_delete_mask() between ip{,6}tablesPhil Sutter2022-11-154-72/+42
| | | | | | | | Function bodies were mostly identical, the only difference being the use of struct ipt_entry or ip6t_entry for size calculation. Pass this value via parameter to make them fully identical. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix compile with -DDEBUGPhil Sutter2022-10-072-5/+5
| | | | | | | Conversion from 'ctx' to 'reg' missed some of the DEBUGP() calls. Fixes: f315af1cf8871 ("nft: track each register individually") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libiptc: Fix for segfault when renaming a chainPhil Sutter2022-10-071-0/+19
| | | | | | | | | | This is an odd bug: If the number of chains is right and one renames the last one in the list, libiptc dereferences a NULL pointer. Add fix and test case for it. Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc") Reported-by: Julien Castets <castets.j@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix expected ebtables log target outputPhil Sutter2022-10-062-3/+3
| | | | | | | | Forgot to update shell testsuite when removing empty --log-prefix options. Fixes: 9cdb52d655608 ("extensions: libebt_log: Avoid empty log-prefix in output") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix expected output for ip6tables dst matchPhil Sutter2022-10-061-2/+2
| | | | | | | | Forgot to update the shell testsuites when fixing for duplicate whitespace in output. Fixes: 11e06cbb3a877 ("extensions: libip6t_dst: Fix output for empty options") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-bridge: Drop 'sreg_count' variablePhil Sutter2022-09-281-4/+2
| | | | | | | | It is not needed, one can just use 'reg' function parameter in its place. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Fix meta statement parsingPhil Sutter2022-09-282-11/+9
| | | | | | | | | | | | The function nft_meta_set_to_target() would always bail since nothing sets 'sreg->meta_sreg.set' to true. This is obvious, as the immediate expression "filling" the source register does not indicate its purpose. The whole source register purpose storing in meta_sreg seems to be pointless, so drop it altogether. Fixes: f315af1cf8871 ("nft: track each register individually") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Fix among matchPhil Sutter2022-09-284-6/+25
| | | | | | | | | | | | | | | | | | Fixed commit broke among match in two ways: 1) The two lookup sizes are 12 and 6, not 12 and 4 - among supports either ether+IP or ether only, not IP only. 2) Adding two to sreg_count to get the second register is too simple: It works only for four byte regs, not the 16 byte ones. The first register is always a 16 byte one, though. Fixing (1) is trivial, fix (2) by introduction of nft_get_next_reg() doing the right thing. For consistency, use it for among match creation, too. Fixes: f315af1cf8871 ("nft: track each register individually") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Support '-p Length'Phil Sutter2022-09-282-16/+42
| | | | | | | | | | | | | | | | | | To match on Ethernet frames using the etherproto field as length value, ebtables accepts the special protocol name "LENGTH". Implement this in ebtables-nft using a native match for 'ether type < 0x0600'. Since extension 802_3 matches are valid only with such Ethernet frames, add a local add_match() wrapper which complains if the extension is used without '-p Length' parameter. Legacy ebtables does this within the extension's final_check callback, but it's not possible here due for lack of fw->bitmask field access. While being at it, add xlate support, adjust tests and make ebtables-nft print the case-insensitive argument with capital 'L' like legacy ebtables does. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Introduce __get_cmp_data()Phil Sutter2022-09-282-7/+11
| | | | | | | This is an inner function to get_cmp_data() returning the op value as-is for caller examination. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Merge OPT_* flags with xshared onesPhil Sutter2022-09-282-16/+9
| | | | | | | | | | | | | | Despite also including xshared.h, xtables-eb.c defined its own OPT_* flags with clashing values. Albeit ugly, this wasn't a problem in practice until commit 51d9d9e081344 ("ebtables: Support verbose mode") which introduced use of OPT_VERBOSE from xshared - with same value as the local OPT_PROTOCOL define. Eliminate the clash by appending ebtables-specific flags to the xshared enum and adjust for the different names of some others. Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Eliminate OPT_TABLEPhil Sutter2022-09-281-2/+3
| | | | | | | | | The flag is used for duplicate option checking only and there is a boolean indicating the same already. So copy the error message from EBT_CHECK_OPTION() in situ and just take care not to disturb restore mode handling. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Drop unused OPT_* definesPhil Sutter2022-09-281-3/+0
| | | | | | | Obviously copied from legacy ebtables, not needed by ebtables-nft. OPT_CNT_* ones seem not even used in legacy anymore. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: extend native delinearize scriptFlorian Westphal2022-09-283-19/+69
| | | | | | | | | | | | | | | | | | | Feed nft-generated ruleset to iptables-nft. At this time, this will NOT pass. because dissector can handle meta l4proto tcp ip saddr 1.2.3.4 but not ip saddr 1.2.3.4 meta l4proto tcp In the latter case, iptables-nft picks up the immediate value (6) as the ip address, because the first one (1.2.3.4) gets moved as PAYLOAD_PREV due to missing 'removal' of the CTX_PAYLOAD flag. This is error prone, so lets rewrite the dissector to track each register separately and auto-clear state on writes. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* nft: track each register individuallyFlorian Westphal2022-09-286-199/+360
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of assuming only one register is used, track all 16 regs individually. This avoids need for the 'PREV_PAYLOAD' hack and also avoids the need to clear out old flags: When we see that register 'x' will be written to, that register state is reset automatically. Existing dissector decodes ip saddr 1.2.3.4 meta l4proto tcp ... as -s 6.0.0.0 -p tcp iptables-nft -s 1.2.3.4 -p tcp is decoded correctly because the expressions are ordered like: meta l4proto tcp ip saddr 1.2.3.4 | ... and 'meta l4proto' did clear the PAYLOAD flag. The simpler fix is: ctx->flags &= ~NFT_XT_CTX_PAYLOAD; in nft_parse_cmp(), but that breaks dissection of '1-42', because the second compare ('cmp lte 42') will not find the payload expression anymore. Link: https://lore.kernel.org/netfilter-devel/20220922143544.GA22541@breakpoint.cc/T/#t Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Test delinearization of native nftables expressionsPhil Sutter2022-09-221-0/+26
| | | | | | | | Even if iptables-nft doesn't generate them anymore, it should continue to correctly parse them. Make sure this is tested for. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Revert "nft: prefer payload to ttl/hl module"/'meta pkttype' match.Florian Westphal2022-09-221-65/+0
| | | | | | | | | | | | | | | | This reverts commit 8acaccf69c22fb195a0b88e28489792304728245. This reverts commit 793caef9076cceb24336b6cbb8f55107de49f269. As per ongoing discussion, keep the dissection side but keep using nft_compat mode for now until we've figured out how to handle backwards compatibility with older iptables-nft binaries dumping the ruleset. Furthermore, "nft: prefer native 'meta pkttype' instead of xt match" broke ebtables: it has its own, incompatible pkttype match and needs special handling. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: un-break among match with concatenationFlorian Westphal2022-09-221-1/+1
| | | | | | | | | | The kernel commit 88cccd908d51 ("netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags") breaks ebtables-nft 'among' emulation, it sets NFTA_SET_ELEM_KEY_END but doesn't set the CONCAT flag. Update uapi header and also set CONCAT. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: prefer payload to ttl/hl moduleFlorian Westphal2022-09-131-0/+43
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: support ttl/hoplimit dissectionFlorian Westphal2022-09-134-0/+76
| | | | | | | xlate raw "nft ... ttl eq 1" and so on to the ttl/hl matches. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: prefer native 'meta pkttype' instead of xt matchFlorian Westphal2022-09-081-0/+22
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: support dissection of meta pkktype modeFlorian Westphal2022-09-081-0/+25
| | | | | | | Makes iptables-nft-save dump 'nft meta pkttype' rules. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: Expand extended error reporting to nft_cmd, tooPhil Sutter2022-08-264-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce the same embedded 'error' struct in nft_cmd and initialize it with the current value from nft_handle. Then in preparation phase, update nft_handle's error.lineno with the value from the current nft_cmd. This serves two purposes: * Allocated batch objects (obj_update) get the right lineno value instead of the COMMIT one. * Any error during preparation may be reported with line number. Do this and change the relevant fprintf() call to use nft_handle's lineno instead of the global 'line' variable. With this change, cryptic iptables-nft-restore error messages should finally be gone: | # iptables-nft-restore <<EOF | *filter | -A nonexist | COMMIT | EOF | iptables-nft-restore: line 2 failed: No chain/target/match by that name. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-restore: Extend failure error messagePhil Sutter2022-08-261-1/+4
| | | | | | | | | | | | | | | If a line causes zero 'ret' value and errno is set, call nft_strerror() for a more detailed error message. While not perfect, it helps with debugging ominous "line NN failed" messages pointing at COMMIT: | # iptables-nft-restore <<EOF | *filter | -A nonexist | COMMIT | EOF | iptables-nft-restore: line 3 failed: No chain/target/match by that name. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: add ebtables among testcaseYi Chen2022-08-031-0/+98
| | | | | | Validate that matching works as expected. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: fix ebtables among match when mac+ip addresses are usedFlorian Westphal2022-08-021-2/+2
| | | | | | | | | | | When matching mac and ip addresses, the ip address needs to be placed into then 2nd 32bit register, the switch to dynamic register allocation instead re-uses reg1, this partially clobbers the mac address, so set lookup comes up empty even though it should find a match. Fixes: 7e38890c6b4fb ("nft: prepare for dynamic register allocation") Reported-by: Yi Chen <yiche@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Print protocol numbers if --numeric was givenPhil Sutter2022-07-294-11/+11
| | | | | | | | | | This is much trickier than expected: On one hand, proto_to_name() is used to lookup protocol extensions so must resolve despite FMT_NUMERIC being set. On the other, --verbose implies --numeric but changing the output there is probably a bad idea. Luckily the latter situation is identified by FMT_NOTABLE bit. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix for missing space after 'prot' columnPhil Sutter2022-07-292-3/+3
| | | | | | | Format string ensured a minimum field width of five characters, but allowed for longer strings to eat the column delimiting white space. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix testcases for changed ip6tables opts outputPhil Sutter2022-07-292-11/+11
| | | | | | | | Adjust captured output, ip6tables prints '--' instead of spaces since the commit in Fixes: tag. Fixes: 6e41c2d8747b2 ("iptables: xshared: Ouptut '--' in the opt field in ipv6's fake mode") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables: xshared: Ouptut '--' in the opt field in ipv6's fake modeErik Skultety2022-07-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fact that the 'opt' table field reports spaces instead of '--' for IPv6 as it would have been the case with IPv4 has a bit of an unfortunate side effect that it completely confuses the 'jc' JSON formatter tool (which has an iptables formatter module). Consider: # ip6tables -L test Chain test (0 references) target prot opt source destination ACCEPT all a:b:c:: anywhere MAC01:02:03:04:05:06 Then: # ip6tables -L test | jc --iptables [{"chain":"test", "rules":[ {"target":"ACCEPT", "prot":"all", "opt":"a:b:c::", "source":"anywhere", "destination":"MAC01:02:03:04:05:06" }] }] which as you can see is wrong simply because whitespaces are considered as a column delimiter. [ Florian: added 'Link' for more background info. The '--' difference exists for > 20 years, but changing it appears to be least intrusive option. ] Link: https://lore.kernel.org/netfilter-devel/bb391c763171f0c5511f73e383e1b2e6a53e2014.1658322396.git.eskultet@redhat.com/t/#u Signed-off-by: Erik Skultety <eskultet@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: Define XT_OPTION_OFFSET_SCALE in xtables.hPhil Sutter2022-06-231-4/+0
| | | | | | | | This is the last symbol in xshared.h used by libxtables, move it over. Again, treat this as "implementation detail" and hence put it behind XTABLES_INTERNAL-curtains. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Move struct xtables_afinfo into xtables.hPhil Sutter2022-06-231-22/+0
| | | | | | | | | | | | | The library "owns" this structure and maintains 'afinfo' pointer to instances of it. With libxt_set, there's even an extension making use of the data. To avoid impact on library users, guard it by XTABLES_INTERNAL. To eliminate the xshared.h include by libxt_set, DEBUGP has to be redefined. Other extensions have similar defines, fix this later. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-monitor: add missing spaces in printed strAnton Luka Šijanec2022-06-231-2/+2
| | | | | | | | | | when printing the ID and OPTs in iptables/xtables-monitor.c, a space is missing after the string, thereby concatenating the number with the next item in the printed PACKET line. Fixes: d26c538b9a549 ("xtables: add xtables-monitor") Signed-off-by: Anton Luka Šijanec <anton@sijanec.eu> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Exit if nftnl_alloc_expr failsPhil Sutter2022-06-211-15/+16
| | | | | | | | | | In some code-paths, 'reg' pointer remaining uninitialized is used later so at least minimal error checking is necessary. Given that a call to nftnl_alloc_expr() with sane argument should never fail, complain and exit if it happens. Fixes: 7e38890c6b4fb ("nft: prepare for dynamic register allocation") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables.8: mention that iptables exits when setuidFlorian Westphal2022-06-171-0/+5
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-restore: Deny --init-tablePhil Sutter2022-06-111-0/+3
| | | | | | | Allowing this segfaults the program. The deny is in line with legacy ebtables, so no point in implementing support for that. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Extend zero counters test a bit furtherPhil Sutter2022-06-111-0/+15
| | | | | | Test zeroing a single rule's counters as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Extend iptables-xml test a bitPhil Sutter2022-06-111-9/+1
| | | | | | | | Call with --combine as well, even though output doesn't differ. Also there's no need to skip for xtables-nft-multi, it provides the same functionality. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Add some more rules to 0002-verbose-output_0Phil Sutter2022-06-111-0/+15
| | | | | | This increases coverage of function print_match() from 0 to 86.6%. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Add --enable-profiling configure optionPhil Sutter2022-06-111-0/+1
| | | | | | A little convenience to prepare a build for analysis with gcov/gprof. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Make some functions staticPhil Sutter2022-06-102-34/+17
| | | | | | | | With all ip(6)tables variants using the same do_parse() function, quite a bunch of functions are not used outside of xshared.c anymore. Make them static. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-legacy: Drop redundant include of xtables-multi.hPhil Sutter2022-06-101-4/+0
| | | | | | | | The header is included unconditionally first, so no point in doing it a second time of ENABLE_NFTABLES is defined. Fixes: be70918eab26e ("xtables: rename xt-multi binaries to -nft, -legacy") Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables: Support -x/--exact flagPhil Sutter2022-06-081-1/+1
| | | | | | | | | | Legacy arptables accepts but ignores the flag. Yet there are remains of the functionality in sources, like OPT_EXPANDED define and a print_num() function which acts on FMT_KILOMEGAGIGA flag being set or not. So instead of mimicking legacy behaviour by explicitly ignoring -x flag for arptables, just enable the feature for it. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Check overhead in iptables-save and -restorePhil Sutter2022-06-021-0/+37
| | | | | | | Some repeated calls have been reduced recently, assert this in a test evaluating strace output. Signed-off-by: Phil Sutter <phil@nwl.cc>