summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* nft: ruleparse: Create family-specific source filesHEADmasterPhil Sutter2023-05-0311-725/+846
| | | | | | | Extract the remaining nftnl rule parsing code from nft-<family>.c sources into dedicated ones to complete the separation. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Extract rule parsing callbacks from nft_family_opsPhil Sutter2023-05-037-41/+60
| | | | | | | Introduce struct nft_ruleparse_ops holding the family-specific expression parsers and integrate it into nft_family_ops for now. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Introduce nft-ruleparse.{c,h}Phil Sutter2023-05-035-1290/+1327
| | | | | | | | | | | Extract all code dealing with parsing from struct nftnl_rule into struct iptables_command_state from nft-shared.c into a separate source file. Basically this is nft_rule_to_iptables_command_state() and the functions it calls, plus family-independent parsers called from family-specific callbacks. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix parsing of option arguments in same wordPhil Sutter2023-04-283-31/+35
| | | | | | | | | | | | | | | | When merging commandline parsers, a decision between 'argv[optind - 1]' and 'optarg' had to be made in some spots. While the implementation of check_inverse() required the former, use of the latter allows for the common syntax of '--opt=arg' or even '-oarg' as 'optarg' will point at the suffix while 'argv[optind - 1]' will just point at the following option. Fix the mess by making check_inverse() update optarg pointer if needed so calling code may refer to and always correct 'optarg'. Fixes: 0af80a91b0a98 ("nft: Merge xtables-arp-standalone.c into xtables-standalone.c") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1677 Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables: Don't omit standard matches if invertedPhil Sutter2023-04-281-2/+4
| | | | | | | | Inverted --h-len and --h-type matches were omitted from output by accident if they matched on their standard value. Fixes: 84331e3ed3f8e ("arptables-nft: Don't print default h-len/h-type values") Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables: Fix parsing of inverted 'arp operation' matchPhil Sutter2023-04-281-1/+1
| | | | | | | | The wrong bit was set in 'invflags', probably due to copy'n'paste from the previous case. Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Drop unused includePhil Sutter2023-04-211-1/+0
| | | | | | | Code does not refer to struct xt_comment_info anymore. Fixes: 3bb497c61d743 ("xtables: Fix for deleting rules with comment") Signed-off-by: Phil Sutter <phil@nwl.cc>
* utils: nfbpf_compile: Replace pcap_compile_nopcap()Phil Sutter2023-04-211-1/+9
| | | | | | | | The function is deprecated. Eliminate the warning by use of pcap_open_dead(), pcap_compile() and pcap_close() just how pcap_compile_nopcap() is implemented internally in libpcap. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Test for false-positive rule checkPhil Sutter2023-04-051-0/+17
| | | | | | | | Rule comparison in legacy ip6tables was broken by commit eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables"): A part of the rules' data was masked out for comparison by accident. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables-nft: add broute table emulationFlorian Westphal2023-04-047-28/+112
| | | | | | | | | | | | | | Use new 'meta broute set 1' to emulate -t broute. If '-t broute' is given, automatically translate -j DROP to 'meta broute set 1 accept' internally. Reverse translation zaps the broute and pretends verdict was DROP. Note that BROUTING is internally handled via PREROUTING, i.e. 'redirect' and 'nat' targets are not available, they will need to be emulated via nft expressions. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* include: update nf_tables uapi headerFlorian Westphal2023-04-041-5/+54
| | | | | | | Taken from nf-next. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: use pkg-config for libpcapAlyssa Ross2023-04-042-7/+8
| | | | | | | | | | | | | | | | If building statically, with libpcap built with libnl support, linking will fail, as the compiler won't be able to find the libnl symbols since static libraries don't contain dependency information. To fix this, use pkg-config to find the flags for linking libpcap, since the pkg-config files contain the neccesary dependency information. autoconf will add code to the configure script for initializing pkg-config the first time it seems PKG_CHECK_MODULES, so make the libnfnetlink check the first one in the script, so the initialization code is run unconditionally. Signed-off-by: Alyssa Ross <hi@alyssa.is> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ip6tables: Fix checking existence of ruleMarkus Boehme2023-04-041-1/+1
| | | | | | | | | | Pass the proper entry size when creating a match mask for checking the existence of a rule. Failing to do so causes wrong results. Reported-by: Jonathan Caicedo <jonathan@jcaicedo.com> Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables") Signed-off-by: Markus Boehme <markubo@amazon.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-test.py: make explicit use of python3Arturo Borrero Gonzalez2023-03-151-1/+1
| | | | | | | | | | | In most distros 'python' means python2, which is not available anywhere. This is a problem when, for example, building the Debian package. This script is called as part of the build but 'python' is not available. Mention python3 explictly. The script runs just fine in python3. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-nft: remove unused function argumentFlorian Westphal2023-03-156-6/+6
| | | | | | Not used, all callers pass NULL. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-nft: make builtin tables staticFlorian Westphal2023-03-142-7/+3
| | | | | | Only used in nft.c. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-eb: fix crash when opts isn't reallocatedFlorian Westphal2023-03-141-1/+2
| | | | | | | opts may point to statically allocated memory. This fixes abort() from libc. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-restore: Fix for deletion of new, referenced rulePhil Sutter2023-03-012-1/+18
| | | | | | | | | | | | | | | | | | Combining multiple corner-cases here: * Insert a rule before another new one which is not the first. Triggers NFTNL_RULE_ID assignment of the latter. * Delete the referenced new rule in the same batch again. Causes overwriting of the previously assigned RULE_ID. Consequently, iptables-nft-restore fails during *insert*, because the reference is dangling. Reported-by: Eric Garver <eric@garver.life> Fixes: 760b35b46e4cc ("nft: Fix for add and delete of same rule in single batch") Signed-off-by: Phil Sutter <phil@nwl.cc> Tested-by: Eric Garver <eric@garver.life>
* include: Add missing linux/netfilter/xt_LOG.hPhil Sutter2023-02-223-38/+20
| | | | | | | | | | When merging IP-version-specific LOG extensions, a dependency to that header was introduced without caching it. Fix this and drop the now unused ip{,6}t_LOG.h files. Reported-by: Thomas Devoogdt <thomas@devoogdt.com> Fixes: 87e4f1bf0b87b ("extensions: libip*t_LOG: Merge extensions") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xt_sctp: add the missing chunk types in sctp_helpXin Long2023-02-211-1/+1
| | | | | | | | | | | | | Add the missing chunk types in sctp_help(), so that the help cmd can display these chunk types as below: # iptables -p sctp --help chunktypes - ... I_DATA RE_CONFIG PAD ... I_FORWARD_TSN ALL NONE Fixes: 6b04d9c34e25 ("xt_sctp: support a couple of new chunk types") Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Support insert with indexPhil Sutter2023-02-172-1/+3
| | | | | | | | | Translation is pretty simple due to nft's 'insert rule ... index' support. Testing the translation is sadly not: index 1 vanishes (as it should), higher indexes are rejected in replay mode since no rules previously exist. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: ip and ip6 matches depend on protocol matchPhil Sutter2023-02-171-2/+9
| | | | | | | This is consistent with legacy ebtables, also avoids invalid combinations like '-p IPv6 --ip-source 1.2.3.4'. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_ip: Translation has to match on ether typePhil Sutter2023-02-172-3/+24
| | | | | | | | | | | | | | On one hand, nft refuses th expression in bridge family if layer3 protocol has not been assured by a previous match. On the other, ebt_ip kernel module will only match on IPv4 packets, so there might be a functional change in the translation versus the original. Instead of just always emitting an 'ether type' match, decide whether it's actually needed - explicit "ip <something>" payload matches (or icmp ones) cause implicit creation of a match on IPv4 by nft. Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_ip: Do not use 'ip dscp' for translationPhil Sutter2023-02-172-3/+3
| | | | | | | | | Converting from TOS field match to DSCP one is irreversible, so replay testing is not possible. Use a raw payload expression to produce something that translates 1:1 back into an 'ip' match. Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_redirect: Fix for wrong syntax in translationPhil Sutter2023-02-172-4/+4
| | | | | | | Meta key comes before 'set' in meta statement. Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_redirect: Fix target translationPhil Sutter2023-02-172-1/+9
| | | | | | | | | While EBT_ACCEPT is the default verdict for ebtables targets, omitting it from translation implicitly converts it into 'continue'. Omit the non-default EBT_CONTINUE instead. Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate: Print file names even if specifiedPhil Sutter2023-02-171-1/+1
| | | | | | | Since the script now supports running for multiple files given on command line, do not skip printing a status line for each. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate: Properly split input in replay modePhil Sutter2023-02-171-1/+1
| | | | | | | | Source command may contain quotes, using shlex.split() does the right thing there. Fixes: 7705b2daa3bdc ("tests: xlate: Use --check to verify replay") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Simplify using nft_create_match()Phil Sutter2023-02-171-66/+40
| | | | | | | | | Perform the nft_family_ops::parse_match call from inside nft_create_match(). It frees callers from having to access the match itself. Then return a pointer to match data instead of the match itself. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Use nft_create_match() in one more spotPhil Sutter2023-02-171-11/+1
| | | | | | | By dropping the per-family 'cs->matches' selection (which is the default anyway), code becomes identical to the function's body. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Lookup matches in iptables_command_statePhil Sutter2023-02-172-33/+41
| | | | | | | | | | | | | | | | Some matches may turn into multiple nft statements (naturally or via translation). Such statements must parse into a single extension again in order to rebuild the rule as it was. Introduce nft_find_match_in_cs() to iterate through the lists and drop tcp/udp port match caching in struct nft_xt_ctx which is not needed anymore. Note: Match reuse is not enabled unconditionally for all matches, because iptables supports having multiple instances of the same extension. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: CLUSTERIP: Drop test filePhil Sutter2023-02-171-4/+0
| | | | | | | The extension was removed from kernel, do not test for it anymore. Keep the code alive though, to not break existing setups. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate: Support testing multiple individual filesPhil Sutter2023-01-311-8/+13
| | | | | | | | | | Simple use-case: run xlate-test for ebtables-nft: | % ./xlate-test.py extensions/libebt_*.txlate The script interpreted all parameters as a single file. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables-translate: Print flush command after parsing is finishedPhil Sutter2023-01-311-7/+7
| | | | | | | Otherwise, bad calls like 'ebtables-translate -F -F' produce wrong output instead of an error message. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables-translate: Ignore '-j CONTINUE'Phil Sutter2023-01-311-1/+3
| | | | | | | It is default behaviour. Does not hurt here, but reducing diff to xtables-eb.c can't hurt. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables-translate: Use OPT_* from xshared.hPhil Sutter2023-01-311-18/+9
| | | | | | | Same as commit db420e268735e ("ebtables: Merge OPT_* flags with xshared ones") but also introduce 'table_set' as a replacement for OPT_TABLE. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables-translate: Drop exec_stylePhil Sutter2023-01-311-8/+0
| | | | | | | Apply the changes from commit 816bd1fdecb63 ("ebtables-nft: remove exec_style") to ebtables-translate, too. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Refuse unselected targets' optionsPhil Sutter2023-01-318-39/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | Unlike legacy, ebtables-nft would allow e.g.: | -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be While the result is correct, it may mislead users into believing multiple targets are possible per rule. Better follow legacy's behaviour and reject target options unless they have been "enabled" by a previous '-j' option. To achieve this, one needs to distinguish targets from watchers also attached to 'xtables_targets' and otherwise behaving like regular matches. Introduce XTABLES_EXT_WATCHER to mark the two. The above works already, but error messages are misleading when using the now unsupported syntax since target options have been merged already. Solve this by not pre-loading the targets at all, code will just fall back to loading ad '-j' parsing time as iptables does. Note how this also fixes for 'counter' statement being in wrong position of ebtables-translate output. Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* Proper fix for "unknown argument" error messagePhil Sutter2023-01-314-15/+50
| | | | | | | | | | | | | | | | While commit 1b8210f848631 kind of fixed the corner-case of invalid short-options packed with others, it broke error reporting for long-options. Revert it and deploy a proper solution: When passing an invalid short-option, e.g. 'iptables -vaL', getopt_long sets the variable 'optopt' to the invalid character's value. Use it for reporting instead of optind if set. To distinguish between invalid options and missing option arguments, ebtables-translate optstring needs adjustment. Fixes: 1b8210f848631 ("ebtables: Fix error message for invalid parameters") Signed-off-by: Phil Sutter <phil@nwl.cc>
* etc: Drop xtables.confPhil Sutter2023-01-183-76/+1
| | | | | | | | | | | | | | The file is not used since the commit this one fixes. Also it wasn't installed until recently, when commit 3822a992bc277 ("Makefile: Fix for 'make distcheck'") added it in the wrong spot in an attempt to reduce differences between tarballs generated by 'make tarball' and 'make dist'. While being at it, drop stale xtables_config_main() prototype from xtables-multi.h. Fixes: 06fd5e46d46f7 ("xtables: Drop support for /etc/xtables.conf") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: NAT: Fix for -Werror=format-securityPhil Sutter2023-01-121-1/+1
| | | | | | | Have to pass either a string literal or format string to xt_xlate_add(). Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE") Signed-off-by: Phil Sutter <phil@nwl.cc>
* configure: Bump version for 1.8.9 releasev1.8.9Phil Sutter2023-01-101-3/+3
| | | | Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Replace brace expansionPhil Sutter2023-01-101-2/+3
| | | | | | | | | According to bash(1), it is not supported by "historical versions of sh". Dash seems to be such a historical version. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Fixes: 3822a992bc277 ("Makefile: Fix for 'make distcheck'") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables-translate: Install symlinkPhil Sutter2022-12-223-7/+13
| | | | | | | | Make this officially a tool, we have enough test coverage in place. Also update xtables-translate.8 to mention it at least and generate ebtables-translate.8 which points to it. Signed-off-by: Phil Sutter <phil@nwl.cc>
* gitignore: Ignore generated ip6tables man pagesPhil Sutter2022-12-221-0/+4
| | | | | Fixes: 127eadee563e4 ("Makefile: Generate ip6tables man pages on the fly") Signed-off-by: Phil Sutter <phil@nwl.cc>
* gitignore: Ignore utils/nfsynproxyPhil Sutter2022-12-221-0/+1
| | | | | Fixes: 9e6928f037823 ("utils: add nfsynproxy tool") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Reject tcp/udp extension without proper protocol matchPhil Sutter2022-12-223-0/+12
| | | | | | | | | Internally, 'th' expression is used, which works but matches both protocols. Since users won't expect '-m tcp --dport 1' to match UDP packets, catch missing/wrong '-p' argument. Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Make rule parsing errors fatalPhil Sutter2022-12-201-1/+3
| | | | | | | Finish parsing the rule, thereby printing all potential problems and abort the program. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Increase rule parser strictnessPhil Sutter2022-12-205-12/+37
| | | | | | Catch more unexpected conditions. Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables: Check the mandatory ar_pln matchPhil Sutter2022-12-201-1/+6
| | | | | | | | | This match is added by nft_arp_add() to every rule with same value, so when parsing just check it is as expected and otherwise ignore it. This allows to treat matches on all other offsets/lengths as error. Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables") Signed-off-by: Phil Sutter <phil@nwl.cc>
View Lorry Controller Status