summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* xtables-compat: also check tg2->userspacesizeFlorian Westphal2018-05-051-1/+3
| | | | | | memcmp uses tg1->userspacesize, make sure its same as tg2 first. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: avoid unneeded bitwise opsFlorian Westphal2018-05-052-5/+23
| | | | | | no need to and with all-ones mask. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: restore: sync options with iptables-restoreFlorian Westphal2018-05-051-2/+13
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: output -s,d first during save, just like iptablesFlorian Westphal2018-05-052-10/+10
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-compat: chains are purge out already from table flushPablo Neira Ayuso2018-05-053-52/+0
| | | | | | | Remove dead code that uses the ancient non-batch netlink API. Chains are already purged out from table flush. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: do not fail on restore if user chain existsPablo Neira Ayuso2018-05-054-4/+32
| | | | | | | | | | | | The following snippet fails if user chain FOO exists, but it should not fail: iptables-compat -F iptables-compat -N FOO iptables-compat-save > foo iptables-compat-restore < foo Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: remove non-batching routinesPablo Neira Ayuso2018-05-052-153/+7
| | | | | | | This is only needed by 3.16, which was released 8 months after nftables was merged upstream. That kernel version supports a reduced featureset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: fall back to comment match in case name is too longFlorian Westphal2018-05-043-5/+13
| | | | | | | ... or when using multiple --comment lines. This is more of a 'cosmetic' fix to handle the test suite case. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: handle mac masks properlyFlorian Westphal2018-05-043-1/+17
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: nft-arp: fix warning wrt. sprintf-out-of-boundsFlorian Westphal2018-05-031-2/+2
| | | | | | | nft-arp.c:112:3: note: 'sprintf' output between 2 and 21 bytes into a destination of size 20 sprintf(buf, "/%s", addr_to_dotted(mask)); Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: truncate comments to 254 bytesFlorian Westphal2018-04-291-1/+3
| | | | | | | Kernel clamps udata size at 256 bytes, udata size however also includes internal bookkeeping which brings us over this limit. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: only fetch revisions for ip/ip6Florian Westphal2018-04-281-6/+19
| | | | | | | Only ip and ip6tables have revision retrieval support; pretend ebtables and arptables are always ok. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix rules print/save after iptables updateSerhey Popovych2018-04-272-46/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Updating iptables from 1.4.x to 1.6.x brokes rules print/save output and causes rules load after reboot to fail. Here is example from iptables-save(8) output after update: -A CHAIN1 -m set [unsupported revision] -j DROP -A CHAIN1 -m set [unsupported revision] -j DROP Similar output could be obtained via iptables -L CHAIN1. While issue reproduced with xt_set match it is not specific to any match or target module: it is related on how xtables handles revisions. In this particular case we have following situation: 1) Kernel supports revisions from 1 to 4. 2) Rules configured with iptables 1.4.x supporting only revisions from 1 to 3. Choosen highest possible revision 3. 3) Rules printed/saved with iptables 1.6.x supporting revisions from 1 to 4. 4) Xtables registers matches/targets with highest supported revision by the kernel. This is 4 in our case after update to iptables 1.6.x. 5) When printing/saving kernel submits match/target with revision it is configured (3), while iptables thinks that rules configured with highest supported (4). That's causes revision mismatch in during print and "[unsupported revision]" output. To fix this issue we now store all supported by kernel and xtables revisions in xt_matches/xt_targets list sorted in descending order. Introduce helper routines to find match/target with given revision and use them to find right revision to print submitted by kernel entry. Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-translate: turn off useless compat queriesFlorian Westphal2018-04-271-0/+6
| | | | | | | not needed as we won't be installing any rules. So just assume kernel supports everything. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: arptables: remove obsolete forward hook definitionFlorian Westphal2018-04-271-6/+0
| | | | | | | | | | | | Its not supported anymore as of 4.13, and it did not work before this either (arp packets cannot be routed). This unbreaks arptables-compat -- without this fix kernel rejects the incoming ruleset skeleton. filtering forwarded arp packets on a bridge can be done either via 'netdev' or 'bridge' families. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-compat: statify nft_restart()Pablo Neira Ayuso2018-04-242-2/+1
| | | | | | This function is only used from iptables/nft.c. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: handle netlink dump EINTR errorsPablo Neira Ayuso2018-04-242-2/+41
| | | | | | Release existing list and restart in case that netlink dump hits EINTR. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: add 'vlan' match extensionFlorian Westphal2018-04-221-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add 'pkttype' match extensionFlorian Westphal2018-04-221-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-translate: update table name on -tFlorian Westphal2018-04-221-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add 'ip6' match extensionFlorian Westphal2018-04-191-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xt-translate: quote interface names in translated outputFlorian Westphal2018-04-191-1/+1
| | | | | | | it its good practice as interface names can be virtually any identifier and could clash with nft keywords. Signed-off-by: Florian Westphal <fw@strlen.de>
* xt-compat: add ebtables-translateFlorian Westphal2018-04-135-1/+804
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xlate-translate: split common parts into helperFlorian Westphal2018-04-131-33/+26
|
* xtables-eb: export 3 functionsFlorian Westphal2018-04-132-5/+10
| | | | | | Will be used from eb-translate parser. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-bridge: add eb-translate backend functionsFlorian Westphal2018-04-131-0/+136
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-bridge: fix mac address printingFlorian Westphal2018-04-131-1/+1
| | | | | | | | | | Mask needs to be all-ones, else we print <macaddr>/ff:ff:ff:ff:ff:ff but such a mask is redundant, we can omit the mask. ebtables does this correctly. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: fix crash when getprotobynumber() returns 0Florian Westphal2018-04-132-12/+17
| | | | | | This needs to first check if pent is NULL. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: support intra-positioned negationsFlorian Westphal2018-04-131-1/+1
| | | | | | | | | | ebtables sitll allows intra-postitioned negations, e.g. --ip-src ! 1.2.3.4 support this. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-bridge: add forward declaration for struct nftnl_ruleFlorian Westphal2018-04-131-0/+1
| | | | | | nft-bridge.h:121:48: warning: 'struct nftnl_rule' declared inside parameter list will not be visible outside .. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: make nft_init self-containedFlorian Westphal2018-04-132-2/+3
| | | | | | | | | | | nft_init() should rollback all changes it made during init when something goes wrong, callers should NOT call nft_fini() on error. Note that this change is irrelevant at the moment, all users call exit() on failure. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-translate: rm duplicate includesFlorian Westphal2018-04-131-5/+0
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xt-compat: constify a few struct membersFlorian Westphal2018-04-131-3/+3
| | | | | | avoids a compiler warning in a followup patch. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: constify option structArushi Singhal2018-04-111-1/+1
| | | | | | | | The struct of type option is only used to initialise a field and is not modified anywhere. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: load mark targetFlorian Westphal2018-04-111-2/+14
| | | | | | | Its already there but it did not work because it wasn't loaded. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: don't make failing extension load fatalFlorian Westphal2018-04-111-7/+10
| | | | | | | | | | | We will fail later when we can't parse the option, but that failure only happens if the is actually used. So in some cases things will work fine even if an extension doesn't exist. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: only validate the xtables builtin tablesFlorian Westphal2018-04-091-2/+9
| | | | | | | | | | This allows xtables-compat to list all builtin tables unless one contains nft specific expressions. Tables that do not exist in xtables world are not printed anymore (but a small hint is shown that such non-printable table(s) exist). Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: skip unsupported tablesFlorian Westphal2018-04-094-43/+14
| | | | | | | | | | | Instead of not listing anything at all if an unknown table name exists, just skip them. Output a small comment that the listing doesn't include the (unrecognized, nft-created) tables. Next patch will restrict 'is this table printable in xtables syntax' check to the "builtin" tables. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: also validate priorities and hook points match expected valuesFlorian Westphal2018-04-091-13/+22
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: fix snprintf truncation warningsFlorian Westphal2018-04-082-2/+2
| | | | | | | proto is u16 in the data structure, so this gave: nft-ipv6.c:422:44: warning: '__builtin___snprintf_chk' output may be truncated before the last format character [-Wformat-truncation=] Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: add xtables-translate.8 manpageArturo Borrero Gonzalez2018-03-172-1/+136
| | | | | | | This new manpage describes how to operate the translation tools for nftables. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat-multi.c: Allow symlink of ebtablesDuncan Roe2018-02-251-0/+1
| | | | | | | | | | | | | | | | | This patch allows one to force a subsystem that one does not wish to modify (e.g. libvirt) to use the ebtables compatibility layer. ebtables-compat was already a symlink to xtables-compat-multi but ebtables was a stand-alone program. So one could move it out of the way before making the symlink as below: lrwxrwxrwx 1 root root 20 Feb 24 11:03 ebtables -> xtables-compat-multi -rwxr-xr-x 1 root root 75176 Feb 24 11:03 ebtables.orig With this patch, kernel modules ebtable_filter & ebtables are no longer loaded. Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: add xtables-compat.8 manpageArturo Borrero Gonzalez2018-02-252-1/+178
| | | | | | | Copied back from the downstream Debian package. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat-restore: use correct hook prioritiesFlorian Westphal2018-02-171-5/+31
| | | | | | | Currently defaulted to 0, it should reflect the one from xtables to get the right ordering. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: Remove const qualifier from struct option.Varsha Rao2017-12-213-3/+3
| | | | | | | | | | | | | As opts is reassigned multiple times, it cannot be made constant. So remove const qualifier from structure option. This patch fixes the following warning: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] .orig_opts = original_opts, Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: xtables-eb: Remove const qualifier from struct optionVarsha Rao2017-11-301-1/+1
| | | | | | | | | | | | | | As opts is reassigned multiple times, it cannot be made constant. So remove const qualifier from structure option. This patch fixes the following warning. xtables-eb.c: In function ‘ebt_load_match_extensions’: xtables-eb.c:653:7: warning: assignment discards ‘const’ qualifier from pointer target type opts = ebt_original_options; Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: do not allow to delete populated user define chainsPablo Neira Ayuso2017-10-111-2/+8
| | | | | | | | If user chain contains rules, flush needs to happen first to retain iptables semantics. Use NLM_F_NONREC to request non-recursive chain deletion. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Constify option structHarsha Sharma2017-10-044-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The struct of type option is only used to initialise a field inside the xtables_globals struct and is not modified anywhere. Done using following coccinelle semantic patch @r1 disable optional_qualifier@ identifier s,i; position p; @@ static struct option i@p[] ={...}; @ok1@ identifier r1.i; expression e; position p; @@ e = i@p @bad@ position p != {r1.p,ok1.p}; identifier r1.i; @@ e@i@p @depends on !bad disable optional_qualifier@ identifier r1.i; @@ static +const struct option i[] = { ... }; Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip{,6}tables-restore: Don't accept wait-interval without waitPhil Sutter2017-10-042-0/+10
| | | | | | | | If -W <val> was given, error out if -w wasn't since that doesn't make sense. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip{,6}tables-restore: Don't ignore missing wait-interval valuePhil Sutter2017-10-041-1/+1
| | | | | | | | Passing -W without a value doesn't make sense so bail out if none was given. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>