summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* xtables-monitor: Print -X command for base chains, tooHEADmasterPhil Sutter11 days2-5/+7
| | | | | | | | | | | | | | Since commit 61e85e3192dea ("iptables-nft: allow removal of empty builtin chains"), the command may be applied to "builtin" chains as well, so the output is basically valid. Apart from that, since kernel commit a1050dd07168 ("netfilter: nf_tables: Reintroduce shortened deletion notifications") the base chain deletion notification does not contain NFTNL_CHAIN_PRIO (actually: NFTA_HOOK_PRIORITY) attribute anymore so this implicitly fixes for changed kernel behaviour. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Revert "libxtables: Promote xtopt_esize_by_type() as xtopt_psize getter"Phil Sutter11 days1-11/+7
| | | | | | | | | | | | | | | This reverts commit 786b75f7c9b9feaa294da097c2e9727747162c79. The internal routine xtopt_esize_by_type() is *not* just a fancy wrapper around direct xtop_psize array access, as clearly indicated by the comment right above it: It will return the single field size for range-value types (XTTYPE_UINT*RC). Using it in xtables_option_metavalidate() leads to spurious "memory block of wrong size" complaints. Fixes: 786b75f7c9b9f ("libxtables: Promote xtopt_esize_by_type() as xtopt_psize getter") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Promote xtopt_esize_by_type() as xtopt_psize getterPhil Sutter11 days1-7/+11
| | | | | | | | | Apart from supporting range-types, this getter is convenient to sanitize array out of bounds access. Use it in xtables_option_metavalidate() to simplify the code a bit. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Florian Westphal <fw@strlen.de>
* extensions: libebt_redirect: prevent translationMiao Wang2025-07-172-26/+1
| | | | | | | | | | | | | | | The redirect target in ebtables do two things: 1. set skb->pkt_type to PACKET_HOST, and 2. set the destination mac address to the address of the receiving bridge device (when not used in BROUTING chain), or the receiving physical device (otherwise). However, the later cannot be implemented in nftables not given the translated mac address. So it is not appropriate to give a specious translation. This patch disables the translation to prevent possible misunderstanding. Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") Signed-off-by: Miao Wang <shankerwangmiao@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: sctp: Translate bare '-m sctp' matchPhil Sutter2025-07-042-2/+10
| | | | | | | | | | | | Just like with TCP and UDP protocol matches, emit a simple 'meta l4proto' match if no specific header detail is to be matched. Note that plain '-m sctp' should be a NOP in kernel, but '-p sctp -m sctp' is not and the translation is deferred to the extension in that case. Keep things stu^Wsimple and translate unconditionally. Reviewed-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Accept an option if any given command allows itPhil Sutter2025-04-231-1/+1
| | | | | | | | | | Fixed commit made option checking overly strict: Some commands may be commbined (foremost --list and --zero), reject a given option only if it is not allowed by any of the given commands. Reported-by: Adam Nielsen <a.nielsen@shikadi.net> Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: icmp: Support info-request/-reply type namesPhil Sutter2025-04-232-0/+9
| | | | | | | The intended side-effect here is that iptables-translate will accept them too. In nftables, the names are supported since basically day 1. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Add nft-compat variantPhil Sutter2025-04-101-2/+12
| | | | | | | Test iptables-nft with forced compat extension restore as third modus operandi. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Embed compat extensions in rule userdataPhil Sutter2025-04-1016-17/+240
| | | | | | | | | | If enabled (via --compat flag or XTABLES_COMPAT env variable), attach any extensions for which native nftables expressions are generated to userdata. An earlier version of the tool trying to parse the kernel-dumped ruleset may then fall back to these extensions if native expression parsing fails. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Pass nft_handle into add_{action,match}()Phil Sutter2025-04-106-13/+17
| | | | | | | Creation of compat extensions in rule userdata will depend on a flag in nft_handle. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-ruleparse: Fallback to compat expressions in userdataPhil Sutter2025-04-105-0/+204
| | | | | | | | | If parsing of a rule fails (e.g. due to an unknown native expression), check if userdata contains a UDATA_TYPE_COMPAT_EXT attribute and retry parsing the rule preferring the contained extensions instead of native expressions. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Introduce UDATA_TYPE_COMPAT_EXTPhil Sutter2025-04-102-8/+15
| | | | | | | | | | | This new rule udata attribute will contain extensions which have been converted to native nftables expressions for rule parsers to fall back to. While at it, export parse_udata_cb() as rule parsing code will call it in future. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: __add_{match,target}() can't failPhil Sutter2025-04-102-18/+12
| | | | | | | | | These functions either call xtables_error() which terminates the process or succeed - make them return void. While at it, export them as rule parsing code will call them in future. Also make input parameter const, they're not supposed to alter extension data. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: ruleparse: Introduce nft_parse_rule_expr()Phil Sutter2025-04-102-33/+44
| | | | | | | Extract the parsing of one expression into a separate function and export it, preparing for following code changes. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Make add_log() staticPhil Sutter2025-04-102-2/+3
| | | | | | | It is not used outside of nft.c, though in the wrong position so keep the declaration but right above its caller. Signed-off-by: Phil Sutter <phil@nwl.cc>
* configure: Avoid addition assignment operatorsAchill Gilgenast2025-01-281-3/+3
| | | | | | | | | | For compatability with other /bin/sh like busybox ash, since they don't support the addition assignment operators (+=) and otherwise fails with: ./configure: line 14174: regular_CFLAGS+= -D__UAPI_DEF_ETHHDR=0: not found Signed-off-by: Achill Gilgenast <fossdd@pwned.life> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: Drop interface mask leftovers from post_parse callbacksPhil Sutter2024-11-193-9/+0
| | | | | | | | | Fixed commit only adjusted the IPv4-specific callback for unclear reasons. Fixes: fe70364b36119 ("xshared: Do not populate interface masks per default") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Jeremy Sowden <jeremy@azazel.net>
* nft: fix interface comparisons in `-C` commandsJeremy Sowden2024-11-196-49/+22
| | | | | | | | | | | | | | | | | | | | | | | Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel") removed code which explicitly set interface masks to all ones. The result of this is that they are zero. However, they are used to mask interfaces in `is_same_interfaces`. Consequently, the masked values are alway zero, the comparisons are always true, and check commands which ought to fail succeed: # iptables -N test # iptables -A test -i lo \! -o lo -j REJECT # iptables -v -L test Chain test (0 references) pkts bytes target prot opt in out source destination 0 0 REJECT all -- lo !lo anywhere anywhere reject-with icmp-port-unreachable # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT REJECT all opt -- in lo out !lo 0.0.0.0/0 -> 0.0.0.0/0 reject-with icmp-port-unreachable Remove the mask parameters from `is_same_interfaces`. Add a test-case. Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ip[6]tables-translate: fix test failures when WESP is definedJeremy Sowden2024-11-121-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Protocol number 141 is assigned to a real protocol: Wrapped Encapsulating Security Payload. This is listed in Debian's /etc/protocols, which leads to test failures: ./extensions/generic.txlate: Fail src: iptables-translate -A FORWARD -p 141 exp: nft 'add rule ip filter FORWARD ip protocol 141 counter' res: nft 'add rule ip filter FORWARD ip protocol wesp counter' ./extensions/generic.txlate: Fail src: ip6tables-translate -A FORWARD -p 141 exp: nft 'add rule ip6 filter FORWARD meta l4proto 141 counter' res: nft 'add rule ip6 filter FORWARD meta l4proto wesp counter' ./extensions/generic.txlate: Fail src: iptables-translate -A FORWARD ! -p 141 exp: nft 'add rule ip filter FORWARD ip protocol != 141 counter' res: nft 'add rule ip filter FORWARD ip protocol != wesp counter' ./extensions/generic.txlate: Fail src: ip6tables-translate -A FORWARD ! -p 141 exp: nft 'add rule ip6 filter FORWARD meta l4proto != 141 counter' res: nft 'add rule ip6 filter FORWARD meta l4proto != wesp counter' Replace it with 253, which IANA reserves for testing and experimentation. Fixes: fcaa99ca9e3c ("xtables-translate: Leverage stored protocol names") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* configure: Bump version for 1.8.11 releasev1.8.11Phil Sutter2024-11-081-1/+1
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: Hide xtables_strtoul_base() symbolPhil Sutter2024-11-075-3/+10
| | | | | | | | There are no external users, no need to promote it in xtables.h. Fixes: 1af6984c57cce ("libxtables: Introduce xtables_strtoul_base()") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Makefile.am: Revert to old serial test harnessPhil Sutter2024-11-061-1/+1
| | | | | | | | | Running the different testsuites in parallel is dangerous since despite running in different netns, legacy iptables still synchronizes via the common XTABLES_LOCKFILE. Fixes: e1eaa04e31e44 ("Makefile.am: Integrate testsuites") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate-test: Fix for 'make distcheck'Phil Sutter2024-11-061-2/+4
| | | | | | | Similar problem as with the other suites: The build directory does not contain test cases, only build results. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Fix for 'make distcheck'Phil Sutter2024-11-061-3/+4
| | | | | | | | | | | | This was a tricky one: Since called from VPATH topdir, extensions/ do not contain test files at all. The script consequently passed since 0 tests failed (of 0 in total). Fix this by introducing TESTS_PATH which is extensions/ below the directory of the running iptables-test.py. Keep EXTENSIONS_PATH as-is: The built extensions are indeed there and XTABLES_LIBDIR must point to them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Print escape sequences with terminals onlyPhil Sutter2024-11-061-2/+2
| | | | | | | If stdout is not a terminal, don't print the '[EXECUTING]' status line which has to be cleared again. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: iptables/0010-wait_0 is unreliablePhil Sutter2024-11-061-1/+1
| | | | | | | | | Sometimes the test would fail, especially after removing /run/xtables.lock file. Looks like the supposedly blocking iptables-restore coproc sometimes takes a moment to set things up. Fixes: 63ab5b8906f69 ("iptables-legacy: Fix for mandatory lock waiting") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Extend fast mode docs a bitPhil Sutter2024-11-051-1/+8
| | | | | | | | To make things less confusing for new readers, describe at least what the two significant functions do. Fixes: 0e80cfea3762b ("tests: iptables-test: Implement fast test mode") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Properly assert rule deletion errorsPhil Sutter2024-11-051-1/+14
| | | | | | | | | | | Capture any non-zero return code, iptables not necessarily returns 1 on error. A known issue with trying to delete a rule by spec is the unsupported --set-counters option. Strip it before deleting the rule. Fixes: c8b7aaabbe1fc ("add iptables unit test infrastructure") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Test ebtables-restore deleting among matchesPhil Sutter2024-11-051-0/+18
| | | | | | | Rules containing among match would spuriously fail to compare if there was a previous rule with larger among match payload. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Simplify ebt_add_{match,watcher}Phil Sutter2024-11-051-15/+5
| | | | | | | | Now that extension options are parsed after these functions return, no modifications need to be carried over to the clone and undone in the original. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Clone extensions before modifying themPhil Sutter2024-11-052-10/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | Upon identifying an extension option, ebt_command_default() would have the extension parse the option prior to creating a copy for attaching to the iptables_command_state object. After copying, the (modified) initial extension's data was cleared. This somewhat awkward process breaks with among match which increases match_size if needed (but never reduces it). This change is not undone, hence leaks into following instances. This in turn is problematic with ebtables-restore only (as multiple rules are parsed) and specifically when deleting rules as the potentially over-sized match_size won't match the one parsed from the kernel. A workaround would be to make bramong_parse() realloc the match also if new size is smaller than the old one. This patch attempts a proper fix though, by making ebt_command_default() copy the extension first and parsing the option into the copy afterwards. No Fixes tag: Prior to commit 24bb57d3f52ac ("ebtables: Support for guided option parser"), ebtables relied upon the extension's parser return code instead of checking option_offset, so copying the extension opportunistically wasn't feasible. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix for 'make distcheck'Phil Sutter2024-11-051-0/+11
| | | | | | | | | The target performs a "VPATH build", so built binaries are not put into the same directory tree as the test script itself. For lack of a better way to detect this, assume $PWD in this situation remains being the build tree's TLD and check if binaries are present in there. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: extend coverage for ip6tablesPablo Neira Ayuso2024-11-0528-89/+177
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Update iptables-test.py to run libxt_*.t both for iptables and ip6tables. For libxt_*.t tests, append the command name to status output line. This update requires changes in the existing tests. * Rename libxt_*.t into libipt_*.t and add libip6_*.t variant. - TEE - TPROXY - connlimit - conntrack - iprange - ipvs - policy - recent * Rename the following libxt_*.t to libipt_*.t since they are IPv4 specific: - standard - osf * Remove IPv4 specific test in libxt_mark.t Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Fix for duplicate supposed-to-fail errorsPhil Sutter2024-11-051-10/+10
| | | | | | | | | | | | | Unexpected results for lines which are supposed to fail are reported twice: Once when fast mode runs them individually to clear the path before batch-handling all others, a second time when non-fast mode takes over after fast mode had failed and runs all tests individually again. Sort this nuisance by running these tests silently in fast mode, knowing that they will run again if failing anyway. Fixes: 0e80cfea3762b ("tests: iptables-test: Implement fast test mode") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables: tests: shell: use bash, not shFlorian Westphal2024-10-301-1/+1
| | | | | | | dash can't run this script, so it will fail: ebtables/0010-change-counters_0: 43: Syntax error: "(" unexpected Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: tests: add missing make +xFlorian Westphal2024-10-291-0/+0
| | | | | | | | | | | | | Else, run-tests.sh doesn't execute it. --- /tmp/old +++ /tmp/new @I: [OK] ././testcases/ipt-save/0001load-dumps_0 I: [OK] ././testcases/ipt-save/0002load-fedora27-firewalld_0 +I: [OK] ././testcases/ipt-save/0003save-restore_0 I: [OK] ././testcases/ipt-save/0005iptables_0 Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Test some commands involving rule numbersPhil Sutter2024-10-162-0/+197
| | | | | | | Skip on ip6tables and arptables as they share the relevant code with iptables. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix for -Z with bogus rule numberPhil Sutter2024-10-161-7/+2
| | | | | | | | | The command is supposed to fail if no rule at given index is found. While at it, drop the goto and label which are unused since commit 9b896224e0bfc ("xtables: rework rule cache logic"). Fixes: a69cc575295ee ("xtables: allow to reset the counters of an existing rule") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Fix for -S with rule numberPhil Sutter2024-10-161-1/+1
| | | | | | | | For NFT_COMPAT_RULE_SAVE, one has to store the rule number, not its index in nft_cmd object. Fixes: 58d364c7120b5 ("ebtables: Use do_parse() from xshared") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: iptables does not support '-b'Phil Sutter2024-10-161-1/+1
| | | | | | | | This flag is merely known to iptables-restore but actively rejected there and it does not use IPT_OPTSTRING at all. Fixes: 384958620abab ("use nf_tables and nf_tables compatibility interface") Signed-off-by: Phil Sutter <phil@nwl.cc>
* gitignore: Ignore generated arptables-translate.8Phil Sutter2024-10-161-0/+1
| | | | | | | It is a semantic link created by the build system. Fixes: 68ff869e94a1b ("Makefile: Install arptables-translate link and man page") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: ebtables-nft.8: Note that --concurrent is a NOPPhil Sutter2024-10-161-1/+2
| | | | | | | | For obvious reasons, ebtables-nft does not need file-based locking to prevent concurrency. Fixes: 1939cbc25e6f5 ("doc: Adjust ebtables man page") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: xtables-legacy.8: Join two paragraphsPhil Sutter2024-10-161-1/+0
| | | | | | | The second one referring to xtables-monitor seems out of context without the first one, join them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Append stderr output to log filePhil Sutter2024-10-161-0/+6
| | | | | | | | Right now this merely contains a number of intrapositioned negation warnings, but might be useful in future when debugging unexpected failures. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Adjust for recent changes in libnftnlPhil Sutter2024-10-011-1/+1
| | | | | | | | | libnftnl commit a96d5a338f24e ("rule: Don't append a newline when printing a rule") affected nft (and iptables-nft) debug output in that no extra newline is appended to rule bytecode output anymore. Tolerate this in the sole test case it breaks by ignoring changes to blank lines. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: TPROXY: Fix for translation being non-terminalPhil Sutter2024-09-152-7/+9
| | | | | | | | | | nftables users have to explicitly add a verdict: xt_TPROXY's tproxy_tg4() returns NF_ACCEPT if a socket was found and assigned, NF_DROP otherwise. Fixes: a62fe15abcc99 ("extensions: xt_TPROXY: add txlate support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* configure: Determine if musl is used for buildJoshua Lant2024-08-291-1/+21
| | | | | | | | | | | | | Error compiling with musl-libc: The commit hash 810f8568f44f5863c2350a39f4f5c8d60f762958 introduces the netinet/ether.h header into xtables.h, which causes an error due to the redefinition of the ethhdr struct, defined in linux/if_ether.h and netinet/ether.h. This is fixed by the inclusion of -D__UAPI_DEF_ETHHDR=0 in CFLAGS for musl. Automatically check for this macro, since it is defined in musl but not in glibc. Signed-off-by: Joshua Lant joshualant@gmail.com Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables: align xt_CONNMARK with current kernel headersJoshua Lant2024-08-233-14/+11
| | | | | | | | | libxt_CONNMARK.c declares enum which is declared in the kernel header. Modify the version of the header in the repo's include dir to match the current kernel, and remove the enum declaration from xt_CONNMARK.c. Signed-off-by: Joshua Lant joshualant@gmail.com Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: ruleparse: Drop 'iter' variable in nft_rule_to_iptables_command_statePhil Sutter2024-08-141-7/+5
| | | | | | | Use the same named field in 'ctx' instead, it has to carry the value anyway. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Reduce overhead in nft_rule_find()Phil Sutter2024-08-141-12/+22
| | | | | | | | | When iterating through the list of rules in a chain comparing against a sample, there is no point in carrying that sample as nftnl_rule object and converting into iptables_command_state object prior to each comparison. Just do it up front and adjust the callback accordingly. Signed-off-by: Phil Sutter <phil@nwl.cc>
generated by cgit v1.2.3 (git 2.25.0) at 2025-08-02 18:26:54 +0000