summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* xtables: Don't use native nftables commentsPhil Sutter2018-11-274-50/+6
| | | | | | | | | | | | | | | The problem with converting libxt_comment into nftables comment is that rules change when parsing from kernel due to comment match being moved to the end of the match list. And since match ordering matters, the rule may not be found anymore when checking or deleting. Apart from that, iptables-nft didn't support multiple comments per rule anymore. This is a compatibility issue without technical reason. Leave conversion from nftables comment to libxt_comment in place so we don't break running systems during an update. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Use xtables_exit_err()Phil Sutter2018-11-232-14/+3
| | | | | | | | | | | | | | | | | When e.g. ebtables-nft detects an incompatible table, a stray '.' was printed as last line of output: | # ebtables-nft -L | table `filter' is incompatible, use 'nft' tool. | . This comes from ebtables' own exit_err callback. Instead use the common one which also provides useful version information. While being at it, align the final error message in xtables_eb_main() with how the others print it. Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables: Support --set-counters optionPhil Sutter2018-11-221-1/+2
| | | | | | | | | | Relevant code for this was already present (short option '-c'), just the long option definition was missing. While being at it, add '-c' to help text. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: make all nft_parse_ helpers staticFlorian Westphal2018-11-192-16/+8
| | | | | | no more external callers. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: rename opcodes to arp_opcodesFlorian Westphal2018-11-193-5/+5
| | | | | | way too generic name. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: constify struct builtin_table and struct builtin_chainPablo Neira Ayuso2018-11-195-32/+32
| | | | | | These definitions should be const, propagate this to all existing users. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: move initialize to struct nft_handlePablo Neira Ayuso2018-11-192-5/+11
| | | | | | | Move this to the structure that stores, stateful information. Introduce nft_table_initialized() and use it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: move chain_cache back to struct nft_handlePablo Neira Ayuso2018-11-192-14/+16
| | | | | | Place this back into the structure that stores the state information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: add type field to builtin_tablePablo Neira Ayuso2018-11-192-0/+9
| | | | | | | Use enum nft_table_type to set the new type field in the structure that define tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables-nft: use generic expression parsing functionFlorian Westphal2018-11-181-82/+10
| | | | | | | | | | | | | | | | | since commit d9c6a5d0977a6d8bbe772dbc31a2c4f58eec1708 ("xtables: merge {ip,arp}tables_command_state structs") arptables uses the shared representation. With only minor changes (e.g., use generic counters in command_state), in print/save functions we can use the shared nftnl expression parser too. arptables-legacy prints (-L) the jump target first, i.e.: -j MARK -d 0.0.0.0/8 --h-length 6 ... ... so keep that here too. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-monitor: fix build with musl libcBaruch Siach2018-11-171-0/+1
| | | | | | | | | | | | | | | | | | | | | Commit 7c8791edac3 ("xtables-monitor: fix build with older glibc") changed the code to use GNU style tcphdr fields. Unfortunately, musl libc requires _GNU_SOURCE definition to expose these fields. Fix the following build failure: xtables-monitor.c: In function ‘trace_print_packet’: xtables-monitor.c:406:43: error: ‘const struct tcphdr’ has no member named ‘source’ printf("SPORT=%d DPORT=%d ", ntohs(tcph->source), ntohs(tcph->dest)); ^~ xtables-monitor.c:406:64: error: ‘const struct tcphdr’ has no member named ‘dest’ printf("SPORT=%d DPORT=%d ", ntohs(tcph->source), ntohs(tcph->dest)); ^~ ... Cc: Florian Westphal <fw@strlen.de> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Introduce per table chain cachesPhil Sutter2018-11-175-106/+95
| | | | | | | | | | | | | | | | Being able to omit the previously obligatory table name check when iterating over the chain cache might help restore performance with large rulesets in xtables-save and -restore. There is one subtle quirk in the code: flush_chain_cache() did free the global chain cache if not called with a table name but didn't if a table name was given even if it emptied the chain cache. In other places, chain_cache being non-NULL prevented a cache update from happening, so this patch establishes the same behaviour (for each individual chain cache) since otherwise unexpected cache updates lead to weird problems. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-monitor: fix build with older glibcBaruch Siach2018-11-161-16/+14
| | | | | | | | | | | | | | | | | | | | | glibc older than 2.19 only expose BSD style fields of struct tcphdr when _BSD_SOURCE is define. Current glibc however, warn that _BSD_SOURCE is deprecated. Migrate to the GNU style of tcphdr fields to make the code compatible with any glibc version. Fix the following build failure: xtables-monitor.c: In function 'trace_print_packet': xtables-monitor.c:406:43: error: 'const struct tcphdr' has no member named 'th_sport' printf("SPORT=%d DPORT=%d ", ntohs(tcph->th_sport), ntohs(tcph->th_dport)); ^ xtables-monitor.c:406:66: error: 'const struct tcphdr' has no member named 'th_dport' printf("SPORT=%d DPORT=%d ", ntohs(tcph->th_sport), ntohs(tcph->th_dport)); ^ ... Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Florian Westphal <fw@strlen.de>
* ip6tables-save: Merge into iptables-save.cPhil Sutter2018-11-133-261/+129
| | | | | | | | | Both implementations were very similar already. Differences were mostly in which libiptc functions were called. Therefore introduce struct iptables_save_cb to point to the right functions for each variant. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ip6tables-restore: Merge into iptables-restore.cPhil Sutter2018-11-133-438/+113
| | | | | | | | Introduce struct iptables_restore_cb and merge ip6tables-restore with iptables-restore. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: fix expected arptables-save outputFlorian Westphal2018-11-121-3/+3
| | | | | | | forgot to squash this before pushing arptables fixes. Fixes: 5aecb2d8bfd ("arptables: pre-init hlen and ethertype") Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: fix --version infoFlorian Westphal2018-11-121-10/+15
| | | | | | | old: arptables vlibxtables.so.12 (nf_tables) now: arptables 1.8.1 (nf_tables) Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: ignore --table argument.Florian Westphal2018-11-121-1/+4
| | | | | | | You can run 'arptables-legacy -t foobar' and commands work fine, as it still operates on filter table (the only table that exists). Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: make uni/multicast mac masks staticFlorian Westphal2018-11-121-6/+6
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: pre-init hlen and ethertypeFlorian Westphal2018-11-122-14/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | to check -s 1.2.3.4, we need to add the size of the hardware address to the arp header to obtain the offset where the ipv4 address begins: base_arphdr HW_ADDR IP_ADDR (src) IP_ADDR (target) In arptables-classic, the kernel will add dev->addr_len to the arp header base address to obtain the correct location, but we cannot do this in nf_tables, at least not at this time (we need a fixed offset value). code does: op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_TGTIP); add_addr(r, sizeof(struct arphdr) + fw->arp.arhln + ... but if user did not provide "--h-length 6" argument, then this won't work even for ethernet, as the payload expression will be told to load the first 4 bytes of arp header source mac address (sender hw address). Fix this by pre-initialising arhlen to 6. We also need to set up arhrd. Otherwise, src/dst mac can't be used: arptables -A INPUT -i lo --destination-mac 11:22:33:44:55:66 arptables v1.8.1 (nf_tables): RULE_APPEND failed (Invalid argument): rule in chain INPUT This means that matching won't work for AX25, NETROM etc, however, arptables "classic" can't parse non-ethernet addresses, and makes ETH_ALEN assumptions in several spots, so this should be fine from compatibility point of view. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: fix src/dst mac handlingFlorian Westphal2018-11-121-9/+57
| | | | | | | | | | 1. check both address and mask, not just first byte of mac 2. use add_addr() for this so mask is also handled via bitwise expr. 3. use the correct offsets. 4. add dissector so we can reverse translate the payload expressions generated for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: fix target ip offsetFlorian Westphal2018-11-121-2/+3
| | | | | | | | | | | | | | | | --dst-ip checks the first four octets of the target mac. Format of ipv4 arp is: arphdr (htype, ptype...) src mac src ip target mac target ip So we need to add hlen (6 bytes) a second time (arphdr + 6 + 4 + 6) to get correct offset. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: fix -s/-d handling for negation and maskFlorian Westphal2018-11-121-6/+14
| | | | | | | also handle negations in other cases. Still to be resolved: mask handling for other options such as hlen. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: fix rule deletion/compareFlorian Westphal2018-11-121-1/+2
| | | | | | | arptables -D fails most of the time, as we compared source mask with target mask. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: remove code that is also commented-out in original arptablesFlorian Westphal2018-11-121-31/+3
| | | | | | | This isn't a missing feature in the -nft version, neither plen and -m were ever implemented in arptables-legacy. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-save: add -c option, like xtables-saveFlorian Westphal2018-11-122-9/+35
| | | | | | | | | arptables classic doesn't have arptables-save, it only has a perl script that attempts to emulate iptables-save. It supports no options, and thus has no way to dump counters. Add -c option, like iptables to enable this. Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: use ->save for arptables-save, like xtablesFlorian Westphal2018-11-121-9/+24
| | | | | | | | | | | | | arptables-save will show -A OUTPUT --h-length 6 --h-type 1 -j MARK --set-xmark 0x1/0xffffffff as --h-length 6 --h-type Ethernet -j MARK MARK set 0x1 Because it uses ->print() instead of ->save(). Switch it to use ->save, we can then also drop special handling of CLASSIFY target. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix error return code in nft_chain_user_rename()Phil Sutter2018-11-122-2/+6
| | | | | | | If the chain to rename wasn't found, the function would return -1 which got interpreted as success. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Clarify error message when deleting by indexPhil Sutter2018-11-121-0/+1
| | | | | | | | | | | | Trying to delete a rule by index from a non-existent chain leads to a somewhat confusing error message: | # iptables-nft -D foobar 1 | iptables: Index of deletion too big. Fix this by performing chain existence checks for CMD_DELETE_NUM, too. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Fix typo in do_command() error messagePhil Sutter2018-11-121-1/+1
| | | | | | | | | | | This checks p->chain for existence, not cs->jumpto. Fixes this bogus error message: | # iptables-nft -t nat -A FORWARD -j ACCEPT | iptables v1.8.1 (nf_tables): Chain 'ACCEPT' does not exist Fixes: b6a06c1a215f8 ("xtables: Align return codes with legacy iptables") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: use extrapositioned negation consistentlyFlorian Westphal2018-11-121-2/+2
| | | | | | | | | | | | | | in the iptables universe, we enforce extrapositioned negation: ! -i foo "-i ! foo" is not even supported anymore. At least make sure that ebtables prints the former syntax everywhere as well so we don't have a mix of both ways. Parsing of --option ! 42 will still work for backwards compat reasons. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-save: add -c option, using xtables-style countersFlorian Westphal2018-11-122-17/+81
| | | | | | | | | | The 'original' ebtables-save was a perl script that supported no option. Add minimal options, like ip(6)tables save. Retain the old way of formatiing counters via environment variable, but allow overriding this using the -c option. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: add NFT_TABLE_* enumerationPablo Neira Ayuso2018-11-122-22/+24
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: replace nft_chain_dump() by nft_chain_list_get()Pablo Neira Ayuso2018-11-124-21/+16
| | | | | | So we can remove nft_chain_dump() and replace nftnl_chain_get_list(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-nft: fix -f fragment optionFlorian Westphal2018-11-111-1/+1
| | | | | | | | This needs to be passed in network byte order. Reported-by: Arno van Amersfoort <arnova@rocky.eld.leidenuniv.nl> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1292 Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: add and use mac print helpersFlorian Westphal2018-11-072-15/+6
| | | | | | | | | | | | This changes ebtables-nft to consistently print mac address with two characters, i.e. 00:01:02:03:04:0a, not 0:1:2:3:4:a. Will require another bump of vcurrent/vage. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-nft: make -Z option workFlorian Westphal2018-11-051-2/+79
| | | | | | | | -Z doesn't just zero base counters, it zeroes out all rule counters, or, optionally, all counters of a chain (-Z FOO). Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1286 Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: add missing error stringFlorian Westphal2018-11-031-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: add arpreply targetFlorian Westphal2018-11-031-0/+1
| | | | | | Unfortunately no nft translation available so far. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: relax -t table restriction, add snat/dnat test casesFlorian Westphal2018-11-031-3/+0
| | | | | | | | | | | | | | Its artificial and prevents test cases that need to add rules to a different table from working. The test script generates: -A PREROUTING -t nat ... which works fine for iptables and ip6tables. Just accept it for ebtables too and add test cases for snat and dnat. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: fix -j CONTINUE handling for add/deleteFlorian Westphal2018-11-032-27/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -j CONTINUE can be added, but it can't be removed: extensions/libebt_standard.t: ERROR: line 5 (cannot find: ebtables -I INPUT -d de:ad:be:ef:00:00 -j CONTINUE) This problem stems from silly ambiguity in ebtables-nft vs. iptables. In iptables, you can do iptables -A INPUT (no -j) in ebtables, you can do either ebtables -A INPUT or ebtables -A INPUT -j CONTINUE both are *supposed* to be the same (and they do the same even in ebtables-nft on netlink side). However, the temprary binary representation within ebtables-nft is not the same: when parsing -j CONTINUE, we add a standard target, then omit it later in _add_target(). When translating netlink representation to ebt binary one, we do not add a standard target and instead just print '-j CONTINUE' when listing rules. So when doing -I INPUT -j CONTINUE -D INPUT -j CONTINUE the -D operation fails because it has a standard target in the binary representation, whereas the rule we obtained from translating nftables netlink back to ebtables' binary represenation doesn't. Fix it by ignoring 'CONTINUE' on parser side. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-nft: fix bogus handling of zero saddr/daddrFlorian Westphal2018-11-032-5/+9
| | | | | | | | | | | | | rule for 0.0.0.0/8 is added as 0.0.0.0/0, because we did not check mask (or negation, for that matter). Fix this and add test cases too. This also revealed an ip6tables-nft-save bug, it would print ' !-d', not '! -d'. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1287 Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for matching rules with wildcard interfacesPhil Sutter2018-11-011-1/+1
| | | | | | | | | | | | | | Due to xtables_parse_interface() and parse_ifname() being misaligned regarding interface mask setting, rules containing a wildcard interface added with iptables-nft could neither be checked nor deleted. As suggested, introduce extensions/iptables.t to hold checks for built-in selectors. This file is picked up by iptables-test.py as-is. The only limitation is that iptables is being used for it, so no ip6tables-specific things can be tested with it (for now). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: limit: unbreak build without libnftnlFlorian Westphal2018-10-241-0/+1
| | | | | | | | | | Lars Wendler reported 1.8.1 build failure when trying to build without nft backend: In file included from ../iptables/nft.h:5, from libxt_limit.c:18: libnftnl/rule.h: No such file or directory Reported-by: Lars Wendler <polynomial-c@gentoo.org> Fixes: 02b80972c43 ("ebtables: Merge libebt_limit.c into libxt_limit.c") Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for spurious errors from iptables-translatePhil Sutter2018-10-233-3/+5
| | | | | | | | | | | | When aligning iptables-nft error messages with legacy ones, I missed that translate tools shouldn't check for missing or duplicated chains. Introduce a boolean in struct nft_xt_cmd_parse indicating we're "just" translating and do_parse() should skip the checks. Fixes: b6a06c1a215f8 ("xtables: Align return codes with legacy iptables") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: expose new etherdb lookup function through libxtables APIPablo Neira Ayuso2018-10-203-5/+2
| | | | | | | | | | This is used from extensions and included in libxtables, so we have to make them public. Fixes: 31f1434dfe37 ("libxtables: Integrate getethertype.c from xtables core") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc>
* libxtables: prefix exported new functions for etherdb lookupsPablo Neira Ayuso2018-10-203-8/+8
| | | | | | | | | | To avoid symbol pollution, place them under the xt_ and xtables_ prefix name. Fixes: 31f1434dfe37 ("libxtables: Integrate getethertype.c from xtables core") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc>
* xtables: Remove target_maxnamelen fieldPhil Sutter2018-10-155-7/+3
| | | | | | | | | | | | This is a partial revert of commit 9f075031a1973 ("Combine parse_target() and command_jump() implementations"): Upstream prefers to reduce max chain name length of arptables by two characters instead of the introduced struct xtables_globals field which requires to bump library API version. Fixes: 9f075031a1973 ("Combine parse_target() and command_jump() implementations") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-shared: Use xtables_calloc()Phil Sutter2018-09-251-11/+2
| | | | | | | | This simplifies code a bit since it takes care of checking for out-of-memory conditions. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Use the shared nft_ipv46_parse_target()Phil Sutter2018-09-251-8/+1
| | | | | | | | No point in having a dedicated implementation for 'parse_target' callback since it is identical with the shared one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>