summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* nft: Merge xtables-arp-standalone.c into xtables-standalone.cHEADmasterPhil Sutter6 days7-699/+218
| | | | | | | | | | | | | | | | | | | By declaring the relevant family_ops callbacks for arptables, the code becomes ready to just use do_commandx() instead of a dedicated parser. As a side-effect, this enables a bunch of new features in arptables-nft: * Support '-C' command * Support '-S' command * Support rule indexes just like xtables, e.g. in '-I' or '-R' commands * Reject chain names starting with '!' * Support '-c N,M' counter syntax Since arptables still accepts intrapositioned negations, add code to cover that but print a warning like iptables did 12 years ago prior to removing the functionality. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: arptables accepts empty interface namesPhil Sutter6 days1-8/+15
| | | | | | | | The empty string passed as interface name is simply ignored by legacy arptables. Make the new common parser print a warning but accept it. Calling xtables_parse_interface() with an empty string is safe. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Derive xtables_globals from familyPhil Sutter6 days5-8/+23
| | | | | | | | | | | | | | Prepare xtables_main() for use with other families than IPV4 or IPV6 which both use the same xtables_globals object. Therefore introduce a function to map from family value to xtables_globals object pointer. In do_parse(), use xt_params pointer as well instead of direct reference. While being at it, Declare arptables_globals and ebtables_globals in xtables_multi.h which seems to be the proper place for that. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Make nft_check_xt_legacy() family agnosticPhil Sutter6 days1-0/+5
| | | | | | | Of course there is no such thing as *_tables_names for ebtables, so no legacy tables checking for ebtables-nft. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-arp: Introduce post_parse callbackPhil Sutter6 days3-128/+178
| | | | | | | This accomplishes the same tasks as e.g. nft_ipv4_post_parse() plus some arptables-specific bits. Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables: Use standard data structures when parsingPhil Sutter6 days1-142/+138
| | | | | | | | Use the compound data structures introduced for dedicated parsing routines in other families instead of the many local variables. This allows to standardize code a bit for sharing a common parser later. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce xtables_globals print_help callbackPhil Sutter6 days2-3/+7
| | | | | | | | With optstring being stored in struct xtables_globals as well, it is a natural choice to store a pointer to a help printer also which matches the supported options. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-standalone: Drop version number from init errorsPhil Sutter6 days1-8/+4
| | | | | | | | | | | Aside from the rather unconventional formatting, if those initialization functions fail we've either released a completely broken iptables or the wrong libraries are chosen by the loader. In both cases, the version number is not really interesting. While being at it, fix indenting of the first exit() call. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Add family ops callbacks wrapping different nft_cmd_* functionsPhil Sutter6 days4-177/+228
| | | | | | | | | | Commands supporting multiple source/destination addresses need to iterate over them and call the respective nft_cmd_* function multiple times. These loops are family-specific though as each family uses a different data structure within struct iptables_command_state to store the addresses. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Simplify addr_mask freeingPhil Sutter6 days2-11/+6
| | | | | | Introduce a generic 'ptr' union field to pass to free(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Introduce init_cs family ops callbackPhil Sutter6 days3-5/+17
| | | | | | | Arptables sets a few defaults in struct iptables_command_state upon initialization. Introduce a callback to do that. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Store optstring in xtables_globalsPhil Sutter6 days4-6/+9
| | | | | | | | | | | Preparing for a common option parser, store the string of options for each family inside the respective xtables_globals object. The array of long option definitions sitting in there already indicates it's the right place. While being at it, drop '-m' support from arptables-nft. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Introduce builtin_tables_lookup()Phil Sutter6 days9-24/+25
| | | | | | | The set of builtin tables to use is fully determined by the given family so just look it up instead of having callers pass it explicitly. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: fix bashismJeremy Sowden2021-10-011-1/+1
| | | | | | | | | The `<(cmd)` redirection is specific to Bash. Update the shebang accordingly. Fixes: 63ab4fe3a191 ("ebtables: Avoid dropping policy when flushing") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: Delete builtin chains compatiblyPhil Sutter2021-09-273-9/+66
| | | | | | | | | | | | | | | | | | | | | | | | | | Attempting to delete all chains if --delete-chain is called without argument has unwanted side-effects especially legacy iptables users are not aware of and won't expect: * Non-default policies are ignored, a previously dropping firewall may start accepting traffic. * The kernel refuses to remove non-empty chains, causing program abort even if no user-defined chain exists. Fix this by requiring a rule cache in that situation and make builtin chain deletion depend on its policy and number of rules. Since this may change concurrently, check again when having to refresh the transaction. Also, hide builtin chains from verbose output - their creation is implicit, so treat their removal as implicit, too. When deleting a specific chain, do not allow to skip the job though. Otherwise deleting a builtin chain which is still in use will succeed although not executed. Fixes: 61e85e3192dea ("iptables-nft: allow removal of empty builtin chains") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-chain: Introduce base_slot fieldPhil Sutter2021-09-273-29/+5
| | | | | | | | For builtin chains, record the base_chains array slot they are assigned to. This simplifies removing that reference if they are being deleted later. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Check base-chain compatibility when adding to cachePhil Sutter2021-09-275-44/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | With introduction of dedicated base-chain slots, a selection process was established as no longer all base-chains ended in the same chain list for later searching/checking but only the first one found for each hook matching criteria is kept and the rest discarded. A side-effect of the above is that table compatibility checking started to omit consecutive base-chains, making iptables-nft less restrictive as long as the expected base-chains were returned first from kernel when populating the cache. Make behaviour consistent and warn users about the possibly disturbing chains found by: * Run all base-chain checks from nft_is_chain_compatible() before allowing a base-chain to occupy its slot. * If an unfit base-chain was found (and discarded), flag the table's cache as tainted and warn about it if the remaining ruleset is otherwise compatible. Since base-chains that remain in cache would pass nft_is_chain_compatible() checking, remove that and reduce it to rule inspection. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: cache: Avoid double free of unrecognized base-chainsPhil Sutter2021-09-272-3/+28
| | | | | | | | | On error, nft_cache_add_chain() frees the allocated nft_chain object along with the nftnl_chain it points at. Fix nftnl_chain_list_cb() to not free the nftnl_chain again in that case. Fixes: 176c92c26bfc9 ("nft: Introduce a dedicated base chain array") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: add missing argument and option to usagemizuta.takeshi@fujitsu.com2021-09-261-2/+3
| | | | | | | | In xtables-restore-translate usage, the argument <FILE> for the -f option and the -V|--version option are missing, so added them. Signed-off-by: MIZUTA Takeshi <mizuta.takeshi@fujitsu.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Avoid dropping policy when flushingPhil Sutter2021-09-152-1/+44
| | | | | | | | Unlike nftables, ebtables' user-defined chains have policies - ebtables-nft implements those internally as invisible last rule. In order to recreate them after a flush command, a rule cache is needed. https://bugzilla.netfilter.org/show_bug.cgi?id=1558
* tests: shell: Return non-zero on errorPhil Sutter2021-09-131-1/+1
| | | | | | If any test fails, return a non-zero exit code. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-nft: allow removal of empty builtin chainsFlorian Westphal2021-09-078-45/+72
| | | | | | | | | | | | The only reason why this is prohibited is that you cannot do it in iptables-legacy. This removes the artifical limitation. "iptables-nft -X" will leave the builtin chains alone; Also, deletion is only permitted if the chain is empty. Signed-off-by: Florian Westphal <fw@strlen.de>
* Fix a few doc typosŠtěpán Němec2021-09-031-3/+3
| | | | | | | Just a few minor language fixes. Signed-off-by: Štěpán Němec <snemec@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Use xtables_{m,c}alloc() everywherePhil Sutter2021-08-315-38/+10
| | | | | | | | | | Make use of libxtables allocators where sensible to have implicit error checking. Leave library-internal calls in place to not create unexpected program exit points for users, apart from xt_xlate_alloc() as that function called xtables_error() in error case which exits by itself already. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Use xtables_malloc() in mnl_err_list_node_add()Phil Sutter2021-08-311-1/+1
| | | | | | | | The function called malloc() without checking for memory allocation failure. Simply replace the call by xtables_malloc() to fix that. Fixes: 4e2020952d6f9 ("xtables: use libnftnl batch API") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/shell: Assert non-verbose mode is silentPhil Sutter2021-08-031-0/+11
| | | | | | | | | | Unexpected output from iptables commands might mess up error-checking in scripts for instance, so do a quick test of the most common commands. Note: Test adds two rules to make sure flush command operates on a non-empty chain. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix for non-verbose check commandPhil Sutter2021-08-031-1/+1
| | | | | | | | Check command was unconditionally verbose since v1.8.5. Make it respect --verbose option again. Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Dump atomic wastePhil Sutter2021-08-021-53/+0
| | | | | | | | | | | With ebtables-nft.8 now educating people about the missing functionality, get rid of atomic remains in source code. This eliminates mostly comments except for --atomic-commit which was treated as alias of --init-table. People not using the latter are probably trying to atomic-commit from an atomic-file which in turn is not supported, so no point keeping it. Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: ebtables-nft.8: Adjust for missing atomic-optionsPhil Sutter2021-07-291-56/+8
| | | | | | | | | Drop any reference to them (and the environment variable) but list them in BUGS section hinting at ebtables-save and -restore tools. Fixes: 1939cbc25e6f5 ("doc: Adjust ebtables man page") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Call init_extensions6() for static buildsErik Wilson2021-07-145-0/+5
| | | | | | | | Initialize extensions from libext6 for cases where xtables is built statically. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1550 Signed-off-by: Erik Wilson <Erik.E.Wilson@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: extend xlate infrastructurePablo Neira Ayuso2021-06-071-8/+21
| | | | | | | | | | | | | | This infrastructure extends the existing xlate infrastructure: - Extensions can define set dependencies through .xlate. The resulting set definition can be obtained through xt_xlate_set_get(). - Add xl_xlate_set_family() and xl_xlate_get_family() to store/fetch the family. The first client of this new xlate API is the connlimit extension, which is added in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: Introduce xtables_strdup() and use it everywherePhil Sutter2021-06-074-11/+12
| | | | | | This wraps strdup(), checking for errors. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-apply: Drop unused variablePhil Sutter2021-06-071-1/+0
| | | | | | | It was assigned to but never read. Fixes: b45b4e3903414 ("iptables-apply: script and manpage update") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Avoid buffer size warnings copying iface namesPhil Sutter2021-06-072-4/+4
| | | | | | | | | The call to strncpy() is actually not needed: source buffer is only IFNAMSIZ bytes large and guaranteed to be null-terminated. Use this to avoid compiler warnings due to size parameter matching the destination buffer size by performing the copy using (dumb) memcpy() instead. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Avoid memleak in error path of nft_cmd_new()Phil Sutter2021-06-071-1/+3
| | | | | | | | If rule allocation fails, free the allocated 'cmd' before returning to caller. Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") Signed-off-by: Phil Sutter <phil@nwl.cc>
* Use proto_to_name() from xshared in more placesPhil Sutter2021-05-175-37/+15
| | | | | | | | | | Share the common proto name lookup code. While being at it, make proto number variable 16bit, values may exceed 256. This aligns iptables-nft '-p' argument printing with legacy iptables. In practice, this should make a difference only in corner cases. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables-translate: Use shared ebt_get_current_chain() functionPhil Sutter2021-05-171-17/+1
| | | | | | | | | | | | | | | | | | | | Drop the local reimplementation. It was barely different enough to be buggy: | % ebtables-nft -A foo -o eth0 -j ACCEPT | % xtables-nft-multi ebtables-translate -A foo -o eth0 -j ACCEPT | ebtables-translate v1.8.5 (nf_tables): Use -o only in OUTPUT, FORWARD and POSTROUTING chains | Try `ebtables-translate -h' or 'ebtables-translate --help' for more information. With this change, output is as expected: | % xtables-nft-multi ebtables-translate -A foo -o eth0 -j ACCEPT | nft add rule bridge filter foo oifname "eth0" counter accept This is roughly the same issue fixed in commit e1ccd979e6849 ("ebtables: fix over-eager -o checks on custom chains"). Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Merge invflags handling codePhil Sutter2021-05-177-199/+88
| | | | | | | | | | Join invflags handling between iptables, ip6tables, xtables and arptables. Ebtables still has its own code which differs quite a bit. In order to use a shared set_option() routine, iptables and ip6tables need to provide a local 'invflags' variable which is 16bits wide. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Eliminate iptables_command_state->invertPhil Sutter2021-05-177-133/+113
| | | | | | | | | This field is not used by routines working with struct iptables_command_state: It is merely a temporary flag used by parsers to carry the '!' prefix until invflags have been populated (or error checking done if unsupported). Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Make invflags 16bit widePhil Sutter2021-05-172-3/+3
| | | | | | | | | | | | | This is needed to merge with xtables-arp which has more builtin options and hence needs more bits in invflags. The only adjustment needed is the set_option() call for option '-j' which passed a pointer to cs->fw.ip.invflags. That field can't be changed, it belongs to uAPI. Though using args->invflags instead works fine, aside from that '-j' doesn't support inverting so this is merely a sanity check and no real invflag value assignment will happen. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-arp: Make use of ipv4_addr_to_string()Phil Sutter2021-04-303-94/+14
| | | | | | | This eliminates quite a bit of redundant code apart from also dropping use of obsolete function gethostbyaddr(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* Eliminate inet_aton() and inet_ntoa()Phil Sutter2021-04-301-9/+14
| | | | | | | Both functions are obsolete, replace them by equivalent calls to inet_pton() and inet_ntop(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Increase BATCH_PAGE_SIZE to support huge rulesetsPhil Sutter2021-04-101-5/+7
| | | | | | | | | | | | | | In order to support the same ruleset sizes as legacy iptables, the kernel's limit of 1024 iovecs has to be overcome. Therefore increase each iovec's size from 128KB to 2MB. While being at it, add a log message for failing sendmsg() call. This is not supposed to happen, even if the transaction fails. Yet if it does, users are left with only a "line XXX failed" message (with line number being the COMMIT line). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: cache: Sort chains on demand onlyPhil Sutter2021-04-065-13/+73
| | | | | | | | | Mandatory sorted insert of chains into cache significantly slows down restoring of large rulesets. Since the sorted list of user-defined chains is needed for listing and verbose output only, introduce nft_cache_sort_chains() and call it where needed. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Fix translation of odd netmasksPhil Sutter2021-03-092-15/+46
| | | | | | | | | Iptables supports netmasks which are not prefixes to match on (or ignore) arbitrary bits in an address. Yet nftables' prefix notation is available for real prefixes only, so translation is not as trivial - print bitmask syntax for those cases. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix bitwise expression avoidance detectionPhil Sutter2021-03-092-1/+27
| | | | | | | | | Byte-boundary prefix detection was too sloppy: Any data following the first zero-byte was ignored. Add a follow-up loop making sure there are no stray bits in the designated host part. Fixes: 323259001d617 ("nft: Optimize class-based IP prefix matches") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-nft: fix -Z optionFlorian Westphal2021-02-242-1/+65
| | | | | | | | | it zeroes the rule counters, so it needs fully populated cache. Add a test case to cover this. Fixes: 9d07514ac5c7a ("nft: calculate cache requirements from list of commands") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* ebtables: Exit gracefully on invalid table namesPhil Sutter2021-01-281-4/+4
| | | | | | | | | | | | | | | | | | | | | | Users are able to cause program abort by passing a table name that doesn't exist: | # ebtables-nft -t dummy -P INPUT ACCEPT | ebtables: nft-cache.c:455: fetch_chain_cache: Assertion `t' failed. | Aborted Avoid this by checking table existence just like iptables-nft does upon parsing '-t' optarg. Since the list of tables is known and fixed, checking the given name's length is pointless. So just drop that check in return. With this patch in place, output looks much better: | # ebtables-nft -t dummy -P INPUT ACCEPT | ebtables v1.8.7 (nf_tables): table 'dummy' does not exist | Perhaps iptables or your kernel needs to be upgraded. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/shell: Fix nft-only/0009-needless-bitwise_0Phil Sutter2021-01-151-1/+8
| | | | | | | | | For whatever reason, stored expected output contains false handles. To overcome this, filter the rule data lines from both expected and stored output before comparing. Fixes: 81a2e12851283 ("tests/shell: Add test for bitwise avoidance fixes") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Avoid pointless table/chain creationPhil Sutter2020-12-213-18/+82
| | | | | | | | | | | | | | | | | Accept a chain name in nft_xt_builtin_init() to limit the base chain creation to that specific chain only. Introduce nft_xt_builtin_table_init() to create just the table for situations where no builtin chains are needed but the command may still succeed in an empty ruleset, particularly when creating a custom chain, restoring base chains or adding a set for ebtables among match. Introduce nft_xt_fake_builtin_chains(), a function to call after cache has been populated to fill empty base chain slots. This keeps ruleset listing output intact if some base chains do not exist (or even the whole ruleset is completely empty). Signed-off-by: Phil Sutter <phil@nwl.cc>