summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* iptables/Makefile: Reorg variable assignmentsPhil Sutter2022-12-141-26/+32
| | | | | | | | Introduce helper variables holding SOURCES, LDADD and CFLAGS used by both legacy and nft builds. Specify also internal header files, builds should depend on them. Doing that, reorder lists for clarity. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Generate ip6tables man pages on the flyPhil Sutter2022-12-145-4/+3
| | | | | | No need to drag them around, creating them is simple. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Fix MAC address match translationPhil Sutter2022-12-021-3/+3
| | | | | | | If a mask was present, ebtables-translate would emit illegal syntax. Fixes: 5e2b473a64bc7 ("xtables-compat: extend generic tests for masks and wildcards") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Fix for interfaces with asterisk mid-stringPhil Sutter2022-12-021-1/+3
| | | | | | | | | | | | | For nft, asterisk is special at end of the interface name only. Escaping it mid-string makes the escape char part of the interface name, so avoid this. In the test case, also drop the ticks around interface names in *-translate command - since there's no shell involved which would eat them, they become part of the interface name. Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Recognize INVAL/D interface namePhil Sutter2022-12-021-0/+19
| | | | | | | | It is just a hack to translate '! -i +' into a never matching nft rule, but recognize it anyway for completeness' sake and to make xlate replay test pass. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix match generator for '! -i +'Phil Sutter2022-12-021-0/+6
| | | | | | | | | | | | | It's actually nonsense since it will never match, but iptables accepts it and the resulting nftables rule must behave identically. Reuse the solution implemented into xtables-translate (by commit e179e87a1179e) and turn the above match into 'iifname INVAL/D'. The commit this fixes merely ignored the fact that "any interface" match might be inverted. Fixes: 0a8635183edd0 ("xtables-compat: ignore '+' interface name") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix for comparing ifname matches against nft-generated onesPhil Sutter2022-12-021-1/+1
| | | | | | | | | Since nft adds the interface name as fixed-size string of 16 bytes, filling a mask based on the length value will not match the mask nft set. Fixes: 652b98e793711 ("xtables-compat: fix wildcard detection") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Implement --check commandPhil Sutter2022-12-021-3/+9
| | | | | | | | | Sadly, '-C' is in use already for --change-counters (even though ebtables-nft does not implement this), so add a long-option only. It is needed for xlate testsuite in replay mode, which will use '--check' instead of '-C'. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Free data after printing helpPhil Sutter2022-12-021-0/+3
| | | | | | | This is merely to make valgrind happy, but less noise means less real issues missed. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables: Properly clear iptables_command_state objectPhil Sutter2022-12-022-4/+2
| | | | | | | | | | | | | | | | | | | | | | When adding a rule with a target which defines a udata_size, valgrind prints: 8 bytes in 1 blocks are definitely lost in loss record 1 of 1 at 0x484659F: calloc (vg_replace_malloc.c:1328) by 0x486B128: xtables_calloc (xtables.c:434) by 0x1128B4: xs_init_target (xshared.c:238) by 0x113CD3: command_jump (xshared.c:877) by 0x114969: do_parse (xshared.c:1644) by 0x10EEB9: do_command4 (iptables.c:691) by 0x10E45B: iptables_main (iptables-standalone.c:59) by 0x49A2349: (below main) (in /lib64/libc.so.6) It is not sufficient to free cs.target->t, so call xtables_clear_iptables_command_state() which takes care of all the details. Fixes: 2dba676b68ef8 ("extensions: support for per-extension instance "global" variable space") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Introduce xtables_clear_iptables_command_state()Phil Sutter2022-12-029-23/+27
| | | | | | | | | | This is nft_clear_iptables_command_state() but in a location reachable by legacy iptables, too. Changes callers in non-family-specific code to use clear_cs callback instead of directly calling it - ebtables still has a custom variant. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables: Plug memleaks in print_firewall()Phil Sutter2022-12-022-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When adding a rule in verbose mode, valgrind prints: 192 bytes in 1 blocks are definitely lost in loss record 1 of 2 at 0x48417E5: malloc (vg_replace_malloc.c:381) by 0x486B158: xtables_malloc (xtables.c:446) by 0x486C1F6: xtables_find_match (xtables.c:826) by 0x10E684: print_match (iptables.c:115) by 0x10E684: print_firewall (iptables.c:169) by 0x10FC0C: print_firewall_line (iptables.c:196) by 0x10FC0C: append_entry (iptables.c:221) by 0x10FC0C: do_command4 (iptables.c:776) by 0x10E45B: iptables_main (iptables-standalone.c:59) by 0x49A2349: (below main) (in /lib64/libc.so.6) 200 bytes in 1 blocks are definitely lost in loss record 2 of 2 at 0x48417E5: malloc (vg_replace_malloc.c:381) by 0x486B158: xtables_malloc (xtables.c:446) by 0x486BBD6: xtables_find_target (xtables.c:956) by 0x10E579: print_firewall (iptables.c:145) by 0x10FC0C: print_firewall_line (iptables.c:196) by 0x10FC0C: append_entry (iptables.c:221) by 0x10FC0C: do_command4 (iptables.c:776) by 0x10E45B: iptables_main (iptables-standalone.c:59) by 0x49A2349: (below main) (in /lib64/libc.so.6) If the match/target was cloned, it needs to be freed. Basically a bug since day 1. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Plug memleak in nft_rule_zero_counters()Phil Sutter2022-12-021-2/+3
| | | | | | | | | | | | | | | | | | | | | | | When zeroing a specific rule, valgrind reports: 40 bytes in 1 blocks are definitely lost in loss record 1 of 1 at 0x484659F: calloc (vg_replace_malloc.c:1328) by 0x48DE128: xtables_calloc (xtables.c:434) by 0x11C7C6: nft_parse_immediate (nft-shared.c:1071) by 0x11C7C6: nft_rule_to_iptables_command_state (nft-shared.c:1236) by 0x119AF5: nft_rule_zero_counters (nft.c:2877) by 0x11A3CA: nft_prepare (nft.c:3445) by 0x11A7A8: nft_commit (nft.c:3479) by 0x114258: xtables_main.isra.0 (xtables-standalone.c:94) by 0x1142D9: xtables_ip6_main (xtables-standalone.c:118) by 0x49F2349: (below main) (in /lib64/libc.so.6) Have to free the matches/target in populated iptables_command_state object again. While being at it, call the proper family_ops callbacks since this is family-agnostic code. Fixes: a69cc575295ee ("xtables: allow to reset the counters of an existing rule") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-xml: Free allocated chain stringsPhil Sutter2022-12-021-5/+5
| | | | | | | | | Freeing only if 'created' is non-zero is wrong - the data was still allocated. In fact, the field is supposed to prevent only the call to openChain(). Fixes: 8d3eccb19a9c6 ("Add iptables-xml tool (Amin Azez <azez@ufomechanic.net>)") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-restore: Free handle with --test alsoPhil Sutter2022-12-021-2/+2
| | | | | | | | | | | | | | | | | | When running 'iptables-restore -t', valgrind reports: 1,496 (160 direct, 1,336 indirect) bytes in 1 blocks are definitely lost in loss record 4 of 4 at 0x48417E5: malloc (vg_replace_malloc.c:381) by 0x4857A46: alloc_handle (libiptc.c:1279) by 0x4857A46: iptc_init (libiptc.c:1342) by 0x1167CE: create_handle (iptables-restore.c:72) by 0x1167CE: ip46tables_restore_main (iptables-restore.c:229) by 0x116DAE: iptables_restore_main (iptables-restore.c:388) by 0x49A2349: (below main) (in /lib64/libc.so.6) Free the handle pointer before parsing the next table. Fixes: 1c9015b2cb483 ("libiptc: remove indirections") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix valgrind mode for 0008-unprivileged_0Phil Sutter2022-12-021-1/+2
| | | | | | | Valgrind is run as user nobody, let everyone write into the temporary directory. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-bridge: work around recent "among" decode breakageFlorian Westphal2022-12-011-0/+5
| | | | | | | | | | | | | | | | ebtables-nft-save will fail with "unknown meta key" when decoding "among" emulation with ipv4 or ipv6 addresses included. This is because "meta protocol ip" is used as a dependency, but its never decoded anywhere. Skip this for now to restore the "ebtables/0006-flush_0" test case. Fixes: 25883ce88bfb ("nft: check for unknown meta keys") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* xlate: get rid of escape_quotesFlorian Westphal2022-11-303-20/+16
| | | | | | | | | | | | | | | | Its not necessary to escape " characters, we can let xtables-translate print the entire translation/command enclosed in '' chracters, i.e. nft 'add rule ...', this also takes care of [, { and other special characters that some shells might parse otherwise (when copy-pasting translated output). The escape_quotes struct member is retained to avoid an ABI breakage. This breaks all xlate test cases, fixup in followup patches. v3: no need to escape ', replace strcmp(x, "") with x[0] (Phil Sutter) Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Test selective ebtables flushingPhil Sutter2022-11-291-0/+47
| | | | | | | Found this on disk, maybe there was a problem with this and among match at some point? Anyway, it is relevant again since it fails recently. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Leverage xlate auto-spacingPhil Sutter2022-11-292-8/+0
| | | | | | Drop code which is used explicitly to deal with spacing. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-nft: exit nonzero when iptables-save cannot decode all expressionsFlorian Westphal2022-11-235-14/+32
| | | | | | | | | | | | We always return 0, even if we printed some error message half-way. Increment an error counter whenever an error message was printed so that the chain-loop can exit with an error if this counter is nonzero. Another effect is that iptables-save will no longer print the COMMIT line anmore. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* nft: check for unknown meta keysFlorian Westphal2022-11-234-8/+21
| | | | | | | | | | | | | Set ->errmsg when the meta key isn't supported by iptables-nft instead of pretending everything is fine. The old code is good enough to handle rules added by iptables-nft, but its not enough to handle rules added by native nft. At least make sure that there is a an error message telling that iptables-nft could not decode the entire ruleset. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-shared: replace nftnl_expr_get_data() by nftnl_expr_get()Pablo Neira Ayuso2022-11-151-1/+1
| | | | | | | Replace nftnl_expr_get_data() alias by real function call. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: replace nftnl_.*_nlmsg_build_hdr() by nftnl_nlmsg_build_hdr()Pablo Neira Ayuso2022-11-153-15/+15
| | | | | | | Replace alias to real nftnl_nlmsg_build_hdr() function call. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Drop extra newline from xtables_error() callsPhil Sutter2022-11-1511-68/+64
| | | | | | | | | | Since basic_exit_err() appends a newline to the message itself, drop explicit ones. While being at it, fix indentation and join texts split over multiple lines. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Introduce port_match_single_to_range()Phil Sutter2022-11-151-93/+37
| | | | | | | The same algorithm was present four times, outsource it. Also use max()/min() macros for a more readable boundary notation. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share make_delete_mask() between ip{,6}tablesPhil Sutter2022-11-154-72/+42
| | | | | | | | Function bodies were mostly identical, the only difference being the use of struct ipt_entry or ip6t_entry for size calculation. Pass this value via parameter to make them fully identical. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix compile with -DDEBUGPhil Sutter2022-10-072-5/+5
| | | | | | | Conversion from 'ctx' to 'reg' missed some of the DEBUGP() calls. Fixes: f315af1cf8871 ("nft: track each register individually") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libiptc: Fix for segfault when renaming a chainPhil Sutter2022-10-071-0/+19
| | | | | | | | | | This is an odd bug: If the number of chains is right and one renames the last one in the list, libiptc dereferences a NULL pointer. Add fix and test case for it. Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc") Reported-by: Julien Castets <castets.j@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix expected ebtables log target outputPhil Sutter2022-10-062-3/+3
| | | | | | | | Forgot to update shell testsuite when removing empty --log-prefix options. Fixes: 9cdb52d655608 ("extensions: libebt_log: Avoid empty log-prefix in output") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix expected output for ip6tables dst matchPhil Sutter2022-10-061-2/+2
| | | | | | | | Forgot to update the shell testsuites when fixing for duplicate whitespace in output. Fixes: 11e06cbb3a877 ("extensions: libip6t_dst: Fix output for empty options") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-bridge: Drop 'sreg_count' variablePhil Sutter2022-09-281-4/+2
| | | | | | | | It is not needed, one can just use 'reg' function parameter in its place. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Fix meta statement parsingPhil Sutter2022-09-282-11/+9
| | | | | | | | | | | | The function nft_meta_set_to_target() would always bail since nothing sets 'sreg->meta_sreg.set' to true. This is obvious, as the immediate expression "filling" the source register does not indicate its purpose. The whole source register purpose storing in meta_sreg seems to be pointless, so drop it altogether. Fixes: f315af1cf8871 ("nft: track each register individually") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Fix among matchPhil Sutter2022-09-284-6/+25
| | | | | | | | | | | | | | | | | | Fixed commit broke among match in two ways: 1) The two lookup sizes are 12 and 6, not 12 and 4 - among supports either ether+IP or ether only, not IP only. 2) Adding two to sreg_count to get the second register is too simple: It works only for four byte regs, not the 16 byte ones. The first register is always a 16 byte one, though. Fixing (1) is trivial, fix (2) by introduction of nft_get_next_reg() doing the right thing. For consistency, use it for among match creation, too. Fixes: f315af1cf8871 ("nft: track each register individually") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Support '-p Length'Phil Sutter2022-09-282-16/+42
| | | | | | | | | | | | | | | | | | To match on Ethernet frames using the etherproto field as length value, ebtables accepts the special protocol name "LENGTH". Implement this in ebtables-nft using a native match for 'ether type < 0x0600'. Since extension 802_3 matches are valid only with such Ethernet frames, add a local add_match() wrapper which complains if the extension is used without '-p Length' parameter. Legacy ebtables does this within the extension's final_check callback, but it's not possible here due for lack of fw->bitmask field access. While being at it, add xlate support, adjust tests and make ebtables-nft print the case-insensitive argument with capital 'L' like legacy ebtables does. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Introduce __get_cmp_data()Phil Sutter2022-09-282-7/+11
| | | | | | | This is an inner function to get_cmp_data() returning the op value as-is for caller examination. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Merge OPT_* flags with xshared onesPhil Sutter2022-09-282-16/+9
| | | | | | | | | | | | | | Despite also including xshared.h, xtables-eb.c defined its own OPT_* flags with clashing values. Albeit ugly, this wasn't a problem in practice until commit 51d9d9e081344 ("ebtables: Support verbose mode") which introduced use of OPT_VERBOSE from xshared - with same value as the local OPT_PROTOCOL define. Eliminate the clash by appending ebtables-specific flags to the xshared enum and adjust for the different names of some others. Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Eliminate OPT_TABLEPhil Sutter2022-09-281-2/+3
| | | | | | | | | The flag is used for duplicate option checking only and there is a boolean indicating the same already. So copy the error message from EBT_CHECK_OPTION() in situ and just take care not to disturb restore mode handling. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Drop unused OPT_* definesPhil Sutter2022-09-281-3/+0
| | | | | | | Obviously copied from legacy ebtables, not needed by ebtables-nft. OPT_CNT_* ones seem not even used in legacy anymore. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: extend native delinearize scriptFlorian Westphal2022-09-283-19/+69
| | | | | | | | | | | | | | | | | | | Feed nft-generated ruleset to iptables-nft. At this time, this will NOT pass. because dissector can handle meta l4proto tcp ip saddr 1.2.3.4 but not ip saddr 1.2.3.4 meta l4proto tcp In the latter case, iptables-nft picks up the immediate value (6) as the ip address, because the first one (1.2.3.4) gets moved as PAYLOAD_PREV due to missing 'removal' of the CTX_PAYLOAD flag. This is error prone, so lets rewrite the dissector to track each register separately and auto-clear state on writes. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* nft: track each register individuallyFlorian Westphal2022-09-286-199/+360
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of assuming only one register is used, track all 16 regs individually. This avoids need for the 'PREV_PAYLOAD' hack and also avoids the need to clear out old flags: When we see that register 'x' will be written to, that register state is reset automatically. Existing dissector decodes ip saddr 1.2.3.4 meta l4proto tcp ... as -s 6.0.0.0 -p tcp iptables-nft -s 1.2.3.4 -p tcp is decoded correctly because the expressions are ordered like: meta l4proto tcp ip saddr 1.2.3.4 | ... and 'meta l4proto' did clear the PAYLOAD flag. The simpler fix is: ctx->flags &= ~NFT_XT_CTX_PAYLOAD; in nft_parse_cmp(), but that breaks dissection of '1-42', because the second compare ('cmp lte 42') will not find the payload expression anymore. Link: https://lore.kernel.org/netfilter-devel/20220922143544.GA22541@breakpoint.cc/T/#t Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Test delinearization of native nftables expressionsPhil Sutter2022-09-221-0/+26
| | | | | | | | Even if iptables-nft doesn't generate them anymore, it should continue to correctly parse them. Make sure this is tested for. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Revert "nft: prefer payload to ttl/hl module"/'meta pkttype' match.Florian Westphal2022-09-221-65/+0
| | | | | | | | | | | | | | | | This reverts commit 8acaccf69c22fb195a0b88e28489792304728245. This reverts commit 793caef9076cceb24336b6cbb8f55107de49f269. As per ongoing discussion, keep the dissection side but keep using nft_compat mode for now until we've figured out how to handle backwards compatibility with older iptables-nft binaries dumping the ruleset. Furthermore, "nft: prefer native 'meta pkttype' instead of xt match" broke ebtables: it has its own, incompatible pkttype match and needs special handling. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: un-break among match with concatenationFlorian Westphal2022-09-221-1/+1
| | | | | | | | | | The kernel commit 88cccd908d51 ("netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags") breaks ebtables-nft 'among' emulation, it sets NFTA_SET_ELEM_KEY_END but doesn't set the CONCAT flag. Update uapi header and also set CONCAT. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: prefer payload to ttl/hl moduleFlorian Westphal2022-09-131-0/+43
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: support ttl/hoplimit dissectionFlorian Westphal2022-09-134-0/+76
| | | | | | | xlate raw "nft ... ttl eq 1" and so on to the ttl/hl matches. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: prefer native 'meta pkttype' instead of xt matchFlorian Westphal2022-09-081-0/+22
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: support dissection of meta pkktype modeFlorian Westphal2022-09-081-0/+25
| | | | | | | Makes iptables-nft-save dump 'nft meta pkttype' rules. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: Expand extended error reporting to nft_cmd, tooPhil Sutter2022-08-264-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce the same embedded 'error' struct in nft_cmd and initialize it with the current value from nft_handle. Then in preparation phase, update nft_handle's error.lineno with the value from the current nft_cmd. This serves two purposes: * Allocated batch objects (obj_update) get the right lineno value instead of the COMMIT one. * Any error during preparation may be reported with line number. Do this and change the relevant fprintf() call to use nft_handle's lineno instead of the global 'line' variable. With this change, cryptic iptables-nft-restore error messages should finally be gone: | # iptables-nft-restore <<EOF | *filter | -A nonexist | COMMIT | EOF | iptables-nft-restore: line 2 failed: No chain/target/match by that name. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-restore: Extend failure error messagePhil Sutter2022-08-261-1/+4
| | | | | | | | | | | | | | | If a line causes zero 'ret' value and errno is set, call nft_strerror() for a more detailed error message. While not perfect, it helps with debugging ominous "line NN failed" messages pointing at COMMIT: | # iptables-nft-restore <<EOF | *filter | -A nonexist | COMMIT | EOF | iptables-nft-restore: line 3 failed: No chain/target/match by that name. Signed-off-by: Phil Sutter <phil@nwl.cc>