summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* nft: Do not omit full ranges if invertedPhil Sutter2024-02-021-2/+2
| | | | | | | Otherwise this turns a never matching rule into an always matching one. Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Fix for memleak with change counters commandPhil Sutter2024-02-011-0/+1
| | | | | | | | | | Just like with check command, change counters command creates a temporary rule from rulespec on command line for a search by spec in rule cache. It is not used anymore afterwards, so nft_cmd_free() should free it. Fixes: f340b7b6816be ("ebtables: Implement --change-counters command") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce xtables_clear_args()Phil Sutter2024-02-016-23/+14
| | | | | | | | | | | Perform struct xtables_args object deinit in a common place, even though it merely consists of freeing any IP addresses and masks. This fixes for a memleak in arptables-translate as the check for h->family didn't catch the value NFPROTO_ARP. Fixes: 5b7324e0675e3 ("nft-arp: add arptables-translate") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix for memleak in option merging with ebtablesPhil Sutter2024-02-012-15/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The crucial difference in ebtables is that all extensions are loaded up front instead of while parsing -m/-j flags. Since this loading of all extensions before every call to do_parse() is pointless overhead (cf. ebtables-restore), other tools' mechanism of freeing all merged options in xtables_free_opts() after handling each command and resetting xt_params->opts at the start of the parser loop is problematic. Fixed commit entailed a hack to defeat the xt_params->opts happening at start of do_parse() by assigning to xt_params->orig_opts after loading all extensions. This approach caused a memleak though since xtables_free_opts() called from xtables_merge_options() will free the opts pointer only if it differs from orig_opts. Resolve this via a different approach which eliminates the xt_params->opts reset at the start of do_parse(): Make xt_params->opts be NULL until the first extension is loaded. Option merging in command_match() and command_jump() tolerates a NULL pointer there after minimal adjustment. Deinit in xtables_free_opts() is already fine as it (re)turns xt_params->opts to a NULL pointer. With do_parse() expecting that and falling back to xt_params->orig_opts, no explicit initialization is required anymore and thus ebtables' init is not mangled by accident. A critical part is that do_parse() checks xt_params->opts pointer upon each call to getopt_long() as it may get assigned while parsing. Fixes: 58d364c7120b5 ("ebtables: Use do_parse() from xshared") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-eb: Eliminate 'opts' definePhil Sutter2024-02-011-3/+7
| | | | | | | | | | | It is more harm than good as it hides assignments to xt_params->opts field and does funny things if statements actually use xt_params->opts instead of the define. Replace it by local variables where sensible (cf. command_match() and command_jump() in xshared.c). Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: ruleparse: Add missing braces around ternaryPhil Sutter2024-02-011-1/+1
| | | | | | | | | | | | | | | | The expression evaluated the sum before the ternay, consequently not adding target->size if tgsize was zero. Identified by ASAN for a simple rule using standard target: | # ebtables -A INPUT -s de:ad:be:ef:0:00 -j RETURN | # ebtables -D INPUT -s de:ad:be:ef:0:00 -j RETURN | ================================================================= | ==18925==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000120 at pc 0x7f627a4c75c5 bp 0x7ffe882b5180 sp 0x7ffe882b4928 | READ of size 8 at 0x603000000120 thread T0 | [...] Fixes: 2a6eee89083c8 ("nft-ruleparse: Introduce nft_create_target()") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables: Add missing error codesJacek Tomasiak2024-01-241-3/+9
| | | | | | | | | | Without these, commands like `iptables -n -L CHAIN` sometimes print "Incompatible with this kernel" instead of "No chain/target/match by that name". Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com> Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Default to extrapositioned negationsPhil Sutter2024-01-104-72/+76
| | | | | | | | | | | | | | | ebtables-nft has always supported both intra- and extrapositioned negations but defaulted to intrapositioned when printing/saving rules. With commit 58d364c7120b5 ("ebtables: Use do_parse() from xshared") though, it started to warn about intrapositioned negations. So change the default to avoid mandatory warnings when e.g. loading previously dumped rulesets. Also adjust test cases, help texts and ebtables-nft.8 accordingly. Cc: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Support for guided option parserPhil Sutter2024-01-101-57/+51
| | | | | | | | | Adjust ebt_load_match() and ebt_command_default() to expect x6_options/x6_parse fiels to be set instead of the traditional ones. Much of this is c'n'p from command_default() in xshared.c, but due to ebtables' custom match data structure (combining matches and watchers), sharing the code is probably not feasible.
* iptables-legacy: Fix for mandatory lock waitingPhil Sutter2023-12-212-2/+57
| | | | | | | | | | | | | | | | | | | | | | Parameter 'wait' passed to xtables_lock() signals three modes of operation, depending on its value: 0: --wait not specified, do not wait if lock is busy -1: --wait specified without value, wait indefinitely until lock becomes free >0: Wait for 'wait' seconds for lock to become free, abort otherwise Since fixed commit, the first two cases were treated the same apart from calling alarm(0), but that is a nop if no alarm is pending. Fix the code by requesting a non-blocking flock() in the second case. While at it, restrict the alarm setup to the third case only. Cc: Jethro Beekman <jethro@fortanix.com> Cc: howardjohn@google.com Cc: Antonio Ojea <antonio.ojea.garcia@gmail.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1728 Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: use standard automake verbosity variablesJeremy Sowden2023-12-151-3/+3
| | | | | | | | | | The previous implementation ignored the default verbosity defined by configure, and controlled by --{enable,disable}-silent-rules, and treated V="" as V=0. Instead, follow the guide-lines given in the automake manual. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: format `AM_CPPFLAGS` variablesJeremy Sowden2023-12-151-1/+8
| | | | | Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Fix spelling mistakesJeremy Sowden2023-12-124-5/+5
| | | | | | | | Corrections for several spelling mistakes, typo's and non-native usages in man-pages and error-messages. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Use do_parse() from xsharedPhil Sutter2023-12-057-1079/+341
| | | | | | | | | | | | | | | | | | | Drop the custom commandline parsers from ebtables and ebtables-translate, extend and use the shared one instead. ebtables gains a few new features from doing this: - Rule counters may be specified in the '-c N,M' syntax - Support for --replace command - Support for --list-rules command - Zero individual rules There is one known regression in this patch, namely maximum chain name length shrinks to 28 characters (from 32). Since this limit changed for iptables in the past as well (e.g. with commit 5429b41c2bb4a), assume nobody really relies upon it anyway. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce option_test_and_reject()Phil Sutter2023-12-051-10/+11
| | | | | | Just a small helper eliminating the repetitive code there. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Use struct xt_cmd_parsePhil Sutter2023-12-051-23/+36
| | | | | | | This is merely to reduce size of the parser merge patch, no functional change intended. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Make 'h' case just a call to print_help()Phil Sutter2023-12-052-31/+31
| | | | | | | | | Move the special ebtables help parameter handling into its print_help() function to prepare for it turning into a callback. Add new field 'argc' to struct iptables_command_state to make this possible. It is actually kind of consistent as it holds 'argv' already. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Pass struct iptables_command_state to print_help()Phil Sutter2023-12-051-6/+5
| | | | | | | | Parameters passed by the sole caller came from there already, apart from 'table' which is not used (ebtables-nft does not have per-table help texts). Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Change option values to avoid clashesPhil Sutter2023-12-052-19/+19
| | | | | | | | In order to parse input using do_parse(), distinct ebtables option's values have to be distinct from others. Since arptables uses values 2-8 already, resort to values >10. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables{,-translate}: Convert if-clause to switch()Phil Sutter2023-12-052-29/+41
| | | | | | | Parser merge prep work, align final do_commandeb*() parts with do_commandx(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Support for ebtables' --change-counters commandPhil Sutter2023-12-053-9/+66
| | | | | | | | | This is tricky because the short-option clashes with the --check command. OTOH, ebtables supports --check as well (though without short-option), so making do_parse() detect ebtables based on struct xtables_args::family is probably still the least messy option. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Support rule range deletion in do_parse()Phil Sutter2023-12-052-1/+35
| | | | | | | | This is a distinct ebtables feature. Introduce struct xt_cmd_parse::rule_ranges boolean indicating support for it and bail otherwise if a range was specified by the user. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce print_help callback (again)Phil Sutter2023-12-057-3/+10
| | | | | | | | Prep work for ebtables parser to use do_parse(). Adding more special casing to xtables_printhelp() causes a mess, so work with a callback again. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Turn command_default() into a callbackPhil Sutter2023-12-057-3/+12
| | | | | | | | Ebtables' variant is pretty different since all extensions are loaded up front and some targets serve as "watcher" extensions, so let variants specify the function to call for extension parameters. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Perform protocol value parsing in callbackPhil Sutter2023-12-052-9/+14
| | | | | | | | The code is same in iptables and ip6tables, but different in ebtables. Therefore move it into the callback to keep that part of do_parse() generic. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: do_parse: Skip option checking for CMD_DELETE_NUMPhil Sutter2023-12-051-1/+0
| | | | | | | This command will delete a rule by its number, not rule spec. No -i/-o options are expected on commandline. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Leave interface masks alone when parsing from kernelPhil Sutter2023-11-296-36/+16
| | | | | | | | The mask is entirely unused by nft-variants in general and legacy ones when printing. It is relevant only when inserting a legacy rule into kernel as it doesn't detect the '+'-suffix. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Do not populate interface masks per defaultPhil Sutter2023-11-294-11/+48
| | | | | | | | | These are needed by legacy variants only, so introduce a simplified xtables_parse_interface() replacement which does not deal with them and a small function which sets the mask based on given interface name for use by legacy tools. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Entirely ignore interface masks when saving rulesPhil Sutter2023-11-296-38/+12
| | | | | | | Rule printing code does this for more than 20 years now, assume it's safe to rely upon the wildcard interface name to contain a '+' suffix. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Simplify generic_opt_check()Phil Sutter2023-11-291-49/+28
| | | | | | | | | | The option/command matrix does not contain any '+' entries anymore, so each option/command combination is either allowed (and optional) or not. Reduce the matrix to an array of unsigned ints which specify the commands a given option is allowed with. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce xt_cmd_parse_ops::option_invertPhil Sutter2023-11-297-24/+34
| | | | | | | | | Replace the awkward inverse_for_options array with basically a few switch() statements clearly identifying the relation between option and inverse values and relieve callers from having to find the option flag bit's position. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce xt_cmd_parse_ops::option_namePhil Sutter2023-11-297-66/+100
| | | | | | | | | | | | The old opt2char() function was flawed: Since not every field in optflags contains a printable character, typical use of its return value in print statements could lead to garbage on screen. Replace this by a mechanism to retrieve an option's long name which supports family-specific overrides. and get rid of optflags field altogether and define NUMBER_OF_OPT similar to NUMBER_OF_CMD. Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: proper roff encoding for ~ and ^Jan Engelhardt2023-11-273-17/+17
| | | | | | Fixes: v1.8.10-28-g4b0c168a Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Implement --change-counters commandPhil Sutter2023-11-236-20/+197
| | | | | | | | Treat it like --replace against the same rule with changed counters. The operation is obviously not atomic, so rule counters may change in kernel while the rule is fetched, modified and replaced. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: do_parse: Ignore '-j CONTINUE'Phil Sutter2023-11-231-1/+2
| | | | | | | | | | | While iptables does not support his NOP, arptables man page claims it does (although legacy arptables rejects it) and ebtables prefers to print it instead of omitting the '-j' option. Accept and ignore the target when parsing to at least fix for arptables-nft and prepare for ebtables-nft using do_parse() as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Align line number formatting with legacyPhil Sutter2023-11-231-1/+1
| | | | | | | | Legacy ebtables appends a dot to the number printed in first column if --Ln flag was given. Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Make ebt_load_match_extensions() staticPhil Sutter2023-11-232-2/+1
| | | | | | The function is not used outside of xtables-eb.c. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Drop append_entry() wrapperPhil Sutter2023-11-231-22/+4
| | | | | | There is no point in having it when there is no code to share. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Drop pointless CMD_REPLACE checkPhil Sutter2023-11-231-5/+0
| | | | | | | | All current users set default source and destination addresses in their post_parse callbacks, so legacy variants are safe and nft variants don't have this restriction anyway. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Drop needless assignment in --help casePhil Sutter2023-11-231-3/+0
| | | | | | | Help text printing code does not refer to optarg, so there is no need to assign to it if unset. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: All variants support -v, update OPTSTRING_COMMONPhil Sutter2023-11-231-4/+4
| | | | | Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: struct xt_cmd_parse::xlate is unusedPhil Sutter2023-11-232-2/+0
| | | | | | | | | | Drop the boolean, it was meant to disable some existence checks in do_parse() prior to the caching rework. Now that do_parse() runs before any caching is done, the checks in question don't exist anymore so drop this relict. Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-bridge: nft_bridge_add() uses wrong flagsPhil Sutter2023-11-231-2/+2
| | | | | | | | | When checking whether -s or -d was given, invflags were used by accident. This change has no functional effect since the values remain the same, but this way it's clear where the previously assigned flags are used. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Install arptables-translate link and man pagePhil Sutter2023-11-232-8/+15
| | | | | | | | While at it, introduce a variable to hold the various semantic links to xtables-translate.8 man page. Fixes: 5b7324e0675e3 ("nft-arp: add arptables-translate") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: more backslash-encoding of charactersJan Engelhardt2023-11-135-80/+80
| | | | | | | | "-" is the dash, "\-" is minus as we know, but groff lists some more characters: "^" is "modifier circumflex" and "~" is "modifier tilde", which, too, need to be escaped for our use. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: limit targets for -P option synopsisJan Engelhardt2023-11-132-2/+2
| | | | | | Do not suggest that -P could be used with arbitrary targets. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: copy synopsis markup from iptables.8 to arptables-nft.8Jan Engelhardt2023-11-131-14/+28
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: stop putting non-terminals in italicJan Engelhardt2023-11-131-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: repeal manual hyphenationJan Engelhardt2023-11-131-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: remove lone .nh commandJan Engelhardt2023-11-131-2/+0
| | | | | | | No other manpage files use .nh, and I cannot see a reason iptables-apply would exceptionally need it. Signed-off-by: Jan Engelhardt <jengelh@inai.de>