Phil Sutter [Tue, 12 May 2020 16:46:39 +0000 (18:46 +0200)]
xshared: Share make_delete_mask() between ip{,6}tables
Function bodies were mostly identical, the only difference being the use
of struct ipt_entry or ip6t_entry for size calculation. Pass this value
via parameter to make them fully identical.
Phil Sutter [Fri, 21 Oct 2022 10:15:21 +0000 (12:15 +0200)]
tests: xlate-test: Replay results for reverse direction testing
Call nft with translation output as input, then check xtables-save
output to make sure iptables-nft can handle anything it suggests nft to
turn its ruleset into.
This extends the test case syntax to cover for expected asymmetries.
When the existing syntax was something like this:
To keep things terse, <replay rule part> may omit the obligatory '-A
<chain>' argument. If missing, <xlate command> is sanitized for how it
would appear in xtables-save output: '-I' is converted into '-A' and an
optional table spec is removed.
Since replay mode has to manipulate the ruleset in-kernel, abort if
called by unprivileged user. Also try to run in own net namespace to
reduce collateral damage.
Phil Sutter [Fri, 21 Oct 2022 08:28:09 +0000 (10:28 +0200)]
tests: xlate-test: Cleanup file reading loop
Put the actual translation test into a function to call from the loop
and clean it up a bit. Preparation work for running a second test on the
same data.
Phil Sutter [Tue, 12 Apr 2022 19:19:39 +0000 (21:19 +0200)]
extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE
REDIRECT was already merged into DNAT. Given the callback generator and
generalized inner parsing routines, merging the other "flavors" is
relatively simple. Rename the extension into "libxt_NAT.so" while doing
so and turn the old DSOs into symlinks.
Phil Sutter [Sat, 9 Jul 2022 09:01:35 +0000 (11:01 +0200)]
extensions: DNAT: Generate print, save and xlate callbacks
Each extension's callbacks follow the same scheme so introduce a
generator which accepts the specifics as parameter - including the
method to transform from per-extension data into struct nf_nat_range2.
Also move the different parser frontends and fcheck callbacks in one
spot for clarity.
Phil Sutter [Wed, 5 Oct 2022 18:30:44 +0000 (20:30 +0200)]
tests: libebt_vlan.t: Drop trailing whitespace from rules
Fast iptables-test.py mode is picky and it has to: Plain redirect target
prints a trailing whitespace, generally stripping the rules in test
cases won't work therefore.
Phil Sutter [Wed, 5 Oct 2022 17:51:08 +0000 (19:51 +0200)]
tests: iptables-test: Cover for obligatory -j CONTINUE in ebtables
Unlike iptables, ebtables includes the default rule target in output.
Instead of adding it to every rule in ebtables tests, add special casing
to the testscript checking if the expected rule output contains a target
already and adding the default one if not.
Phil Sutter [Fri, 30 Sep 2022 16:15:59 +0000 (18:15 +0200)]
tests: iptables-test: Implement fast test mode
Implement a faster mode of operation for suitable test files:
1) Collect all rules to add and all expected output in lists
2) Any supposedly failing rules are checked immediately like in slow
mode.
3) Create and load iptables-restore input from the list in (1)
5) Construct the expected iptables-save output from (1) and check it in
a single search
5) If any of the steps above fail, fall back to slow mode for
verification and detailed error analysis. Fast mode failures are not
fatal, merely warn about them.
To keep things simple (and feasible), avoid complicated test files
involving external commands, multiple tables or variant-specific
results.
Aside from speeding up testsuite run-time, rule searching has become
more strict since EOL char is practically part of the search string.
This revealed many false positives where the expected string was
actually a substring of the printed rule.
The range is not communicated as "min and max queue number", but "first
queue number and count" instead. With 16bits for each value, it is not
possible to balance between all 65536 possible queues. Although probably
never used in practice, point this detail out in man page and make the
parser complain instead of the cryptic "xt_NFQUEUE: number of total
queues is 0" emitted by the kernel module.
Phil Sutter [Fri, 7 Oct 2022 16:29:07 +0000 (18:29 +0200)]
libiptc: Fix for segfault when renaming a chain
This is an odd bug: If the number of chains is right and one renames the
last one in the list, libiptc dereferences a NULL pointer. Add fix and
test case for it.
Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc") Reported-by: Julien Castets <castets.j@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Fri, 30 Sep 2022 16:06:10 +0000 (18:06 +0200)]
tests: IDLETIMER.t: Fix syntax, support for restore input
Expected output was wrong in the last OK test, probably defeating rule
search check. Also use a different label, otherwise the kernel will
reject the second idletimer with same label but different type if both
rules are added at once.
Phil Sutter [Fri, 30 Sep 2022 15:51:55 +0000 (17:51 +0200)]
extensions: among: Fix for use with ebtables-restore
When restoring multiple rules which use among match, new size may be
smaller than the old one which caused invalid writes by the memcpy()
call. Expect this and realloc the match only if it needs to grow. Also
use realloc instead of freeing and allocating from scratch.
Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") Signed-off-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Thu, 29 Sep 2022 17:11:55 +0000 (19:11 +0200)]
extensions: among: Remove pointless fall through
This seems to be a leftover from an earlier version of the switch().
This fall through is never effective as the next case's code will never
apply. So just break instead.
Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") Signed-off-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Thu, 29 Sep 2022 14:00:09 +0000 (16:00 +0200)]
tests: iptables-test: Test both variants by default
Via '--legacy' and '--nftables' flags one may choose the variant to
test. Change the default (none of them given) from legacy to both,
by effectively running twice. Prefix the summary line with the tested
variant for clarity and print a total count line as well.
Phil Sutter [Thu, 29 Sep 2022 13:52:40 +0000 (15:52 +0200)]
tests: iptables-test: Pass netns to execute_cmd()
The command to run might have to be prefixed. Once if the command is
'iptables' (or related) to define the variant, once if '-N' was given to
run the command inside the netns. Doing both prefixing inside
execute_cmd() avoids a potential conflict and thus simplifies things:
The "external command" and "external iptables call" lines become
identical in handling, there is no need for a separate prefix char
anymore.
As a side-effect, this commit also fixes for delete_rule() calls in
error case ignoring the netns value.
Phil Sutter [Thu, 29 Sep 2022 12:46:26 +0000 (14:46 +0200)]
tests: iptables-test: Simplify '-N' option a bit
Instead of hard-coding, store the netns name in args.netns if the flag
was given. The value defaults to None, so existing 'if netns' checks are
still valid.
Phil Sutter [Wed, 28 Sep 2022 16:08:43 +0000 (18:08 +0200)]
nft: Fix meta statement parsing
The function nft_meta_set_to_target() would always bail since nothing
sets 'sreg->meta_sreg.set' to true. This is obvious, as the immediate
expression "filling" the source register does not indicate its purpose.
The whole source register purpose storing in meta_sreg seems to be
pointless, so drop it altogether.
Fixes: f315af1cf8871 ("nft: track each register individually") Signed-off-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Thu, 4 Aug 2022 15:01:26 +0000 (17:01 +0200)]
ebtables: Fix among match
Fixed commit broke among match in two ways:
1) The two lookup sizes are 12 and 6, not 12 and 4 - among supports
either ether+IP or ether only, not IP only.
2) Adding two to sreg_count to get the second register is too simple: It
works only for four byte regs, not the 16 byte ones. The first
register is always a 16 byte one, though.
Fixing (1) is trivial, fix (2) by introduction of nft_get_next_reg()
doing the right thing. For consistency, use it for among match creation,
too.
Fixes: f315af1cf8871 ("nft: track each register individually") Signed-off-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Tue, 27 Sep 2022 21:19:34 +0000 (23:19 +0200)]
ebtables: Support '-p Length'
To match on Ethernet frames using the etherproto field as length value,
ebtables accepts the special protocol name "LENGTH". Implement this in
ebtables-nft using a native match for 'ether type < 0x0600'.
Since extension 802_3 matches are valid only with such Ethernet frames,
add a local add_match() wrapper which complains if the extension is used
without '-p Length' parameter. Legacy ebtables does this within the
extension's final_check callback, but it's not possible here due for lack of
fw->bitmask field access.
While being at it, add xlate support, adjust tests and make ebtables-nft
print the case-insensitive argument with capital 'L' like legacy
ebtables does.
Phil Sutter [Tue, 27 Sep 2022 17:46:47 +0000 (19:46 +0200)]
ebtables: Merge OPT_* flags with xshared ones
Despite also including xshared.h, xtables-eb.c defined its own OPT_*
flags with clashing values. Albeit ugly, this wasn't a problem in
practice until commit 51d9d9e081344 ("ebtables: Support verbose mode")
which introduced use of OPT_VERBOSE from xshared - with same value as
the local OPT_PROTOCOL define.
Eliminate the clash by appending ebtables-specific flags to the xshared
enum and adjust for the different names of some others.
Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") Signed-off-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Tue, 27 Sep 2022 17:03:47 +0000 (19:03 +0200)]
ebtables: Eliminate OPT_TABLE
The flag is used for duplicate option checking only and there is a
boolean indicating the same already. So copy the error message from
EBT_CHECK_OPTION() in situ and just take care not to disturb restore
mode handling.
Feed nft-generated ruleset to iptables-nft.
At this time, this will NOT pass. because dissector can handle
meta l4proto tcp ip saddr 1.2.3.4
but not
ip saddr 1.2.3.4 meta l4proto tcp
In the latter case, iptables-nft picks up the immediate value (6) as the ip
address, because the first one (1.2.3.4) gets moved as PAYLOAD_PREV due to
missing 'removal' of the CTX_PAYLOAD flag.
This is error prone, so lets rewrite the dissector to track each
register separately and auto-clear state on writes.
Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
As per ongoing discussion, keep the dissection side but keep using
nft_compat mode for now until we've figured out how to handle
backwards compatibility with older iptables-nft binaries dumping
the ruleset.
Furthermore, "nft: prefer native 'meta pkttype' instead of xt match"
broke ebtables: it has its own, incompatible pkttype match and needs
special handling.
The kernel commit 88cccd908d51 ("netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags")
breaks ebtables-nft 'among' emulation, it sets NFTA_SET_ELEM_KEY_END but
doesn't set the CONCAT flag.
Makes no sense for iptables/ip6tables but it does make sense for ebtables.
Classic ebtables uses libebt_pkttype which isn't compatible, but
iptables-nft can use the libxt_pkttype version when printing native
'meta pkttype'.
Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Fri, 26 Aug 2022 14:53:52 +0000 (16:53 +0200)]
nft: Expand extended error reporting to nft_cmd, too
Introduce the same embedded 'error' struct in nft_cmd and initialize it
with the current value from nft_handle. Then in preparation phase,
update nft_handle's error.lineno with the value from the current
nft_cmd.
This serves two purposes:
* Allocated batch objects (obj_update) get the right lineno value
instead of the COMMIT one.
* Any error during preparation may be reported with line number. Do this
and change the relevant fprintf() call to use nft_handle's lineno
instead of the global 'line' variable.
With this change, cryptic iptables-nft-restore error messages should
finally be gone:
| # iptables-nft-restore <<EOF
| *filter
| -A nonexist
| COMMIT
| EOF
| iptables-nft-restore: line 2 failed: No chain/target/match by that name.
Phil Sutter [Thu, 25 Aug 2022 09:53:04 +0000 (11:53 +0200)]
xtables-restore: Extend failure error message
If a line causes zero 'ret' value and errno is set, call nft_strerror()
for a more detailed error message. While not perfect, it helps with
debugging ominous "line NN failed" messages pointing at COMMIT:
| # iptables-nft-restore <<EOF
| *filter
| -A nonexist
| COMMIT
| EOF
| iptables-nft-restore: line 3 failed: No chain/target/match by that name.
nft: fix ebtables among match when mac+ip addresses are used
When matching mac and ip addresses, the ip address needs to be placed
into then 2nd 32bit register, the switch to dynamic register allocation
instead re-uses reg1, this partially clobbers the mac address, so
set lookup comes up empty even though it should find a match.
Fixes: 7e38890c6b4fb ("nft: prepare for dynamic register allocation") Reported-by: Yi Chen <yiche@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
Phil Sutter [Thu, 28 Jul 2022 10:31:36 +0000 (12:31 +0200)]
xshared: Print protocol numbers if --numeric was given
This is much trickier than expected: On one hand, proto_to_name() is
used to lookup protocol extensions so must resolve despite FMT_NUMERIC
being set. On the other, --verbose implies --numeric but changing the
output there is probably a bad idea. Luckily the latter situation is
identified by FMT_NOTABLE bit.
Erik Skultety [Wed, 20 Jul 2022 13:06:50 +0000 (15:06 +0200)]
iptables: xshared: Ouptut '--' in the opt field in ipv6's fake mode
The fact that the 'opt' table field reports spaces instead of '--' for
IPv6 as it would have been the case with IPv4 has a bit of an
unfortunate side effect that it completely confuses the 'jc' JSON
formatter tool (which has an iptables formatter module).
Consider:
# ip6tables -L test
Chain test (0 references)
target prot opt source destination
ACCEPT all a:b:c:: anywhere MAC01:02:03:04:05:06
Phil Sutter [Thu, 30 Jun 2022 16:04:39 +0000 (18:04 +0200)]
libxtables: Fix unsupported extension warning corner case
Some extensions are not supported in revision 0 by user space anymore,
for those the warning in xtables_compatible_revision() does not print as
no revision 0 is tried.
To fix this, one has to track if none of the user space supported
revisions were accepted by the kernel. Therefore add respective logic to
xtables_find_{target,match}().
Note that this does not lead to duplicated warnings for unsupported
extensions that have a revision 0 because xtables_compatible_revision()
returns true for them to allow for extension's help output.
For the record, these ip6tables extensions are affected: set/SET,
socket, tos/TOS, TPROXY and SNAT. In addition to that, TEE is affected
for both families.
Fixes: 17534cb18ed0a ("Improve error messages for unsupported extensions") Signed-off-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Thu, 2 Jun 2022 09:16:38 +0000 (11:16 +0200)]
libxtables: Define XT_OPTION_OFFSET_SCALE in xtables.h
This is the last symbol in xshared.h used by libxtables, move it over.
Again, treat this as "implementation detail" and hence put it behind
XTABLES_INTERNAL-curtains.
xtables-monitor: add missing spaces in printed str
when printing the ID and OPTs in iptables/xtables-monitor.c, a space is
missing after the string, thereby concatenating the number with the next
item in the printed PACKET line.
Fixes: d26c538b9a549 ("xtables: add xtables-monitor") Signed-off-by: Anton Luka Šijanec <anton@sijanec.eu> Signed-off-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Tue, 14 Jun 2022 15:44:47 +0000 (17:44 +0200)]
nft: Exit if nftnl_alloc_expr fails
In some code-paths, 'reg' pointer remaining uninitialized is used later
so at least minimal error checking is necessary. Given that a call to
nftnl_alloc_expr() with sane argument should never fail, complain and
exit if it happens.
Fixes: 7e38890c6b4fb ("nft: prepare for dynamic register allocation") Signed-off-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Wed, 8 Jun 2022 12:36:20 +0000 (14:36 +0200)]
extensions: string: Fix and enable tests
Some minor fixes were necessary:
* --algo is printed after the pattern
* Second long string test must fail, that string is 129 chars long
* --from 0 and --to 65535 are not printed (default values)
Phil Sutter [Thu, 20 May 2021 09:58:09 +0000 (11:58 +0200)]
tests: shell: Extend iptables-xml test a bit
Call with --combine as well, even though output doesn't differ. Also
there's no need to skip for xtables-nft-multi, it provides the same
functionality.
Phil Sutter [Wed, 1 Jun 2022 17:24:41 +0000 (19:24 +0200)]
xshared: Make some functions static
With all ip(6)tables variants using the same do_parse() function, quite
a bunch of functions are not used outside of xshared.c anymore. Make them
static.
Phil Sutter [Tue, 7 Jun 2022 16:07:00 +0000 (18:07 +0200)]
arptables: Support -x/--exact flag
Legacy arptables accepts but ignores the flag. Yet there are remains of
the functionality in sources, like OPT_EXPANDED define and a print_num()
function which acts on FMT_KILOMEGAGIGA flag being set or not. So
instead of mimicking legacy behaviour by explicitly ignoring -x flag for
arptables, just enable the feature for it.
The functions are used for static builds to initialize extensions after
libxtables init. Regular library users should not need them, but the
empty declarations introduced in #else case (and therefore present in
user's env) may clash with existing symbol names.
Avoid problems and guard the whole block declaring the function
prototypes and mangling extensions' _init functions by XTABLES_INTERNAL.
Reported-by: Nick Hainke <vincent@systemli.org> Fixes: 6c689b639cf8e ("Simplify static build extension loading") Signed-off-by: Phil Sutter <phil@nwl.cc>
Ben Brown [Wed, 25 May 2022 15:26:13 +0000 (16:26 +0100)]
build: Fix error during out of tree build
Fixes the following error:
../../libxtables/xtables.c:52:10: fatal error: libiptc/linux_list.h: No such file or directory
52 | #include <libiptc/linux_list.h>
Fixes: f58b0d7406451 ("libxtables: Implement notargets hash table") Signed-off-by: Ben Brown <ben@demerara.io> Signed-off-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Wed, 18 May 2022 14:04:09 +0000 (16:04 +0200)]
Revert "fix build for missing ETH_ALEN definition"
This reverts commit c5d9a723b5159a28f547b577711787295a14fd84 as it broke
compiling against musl libc. Might be a bug in the latter, but for the
time being try to please both by avoiding the include and instead
defining ETH_ALEN if unset.
While being at it, move netinet/ether.h include up.
Fixes: 1bdb5535f561a ("libxtables: Extend MAC address printing/parsing support") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Maciej Żenczykowski <maze@google.com>
Nick Hainke [Mon, 16 May 2022 16:16:41 +0000 (18:16 +0200)]
treewide: use uint* instead of u_int*
Gcc complains about missing types. Some commits introduced u_int* instead
of uint*. Use uint treewide.
Fixes errors in the form of:
In file included from xtables-legacy-multi.c:5:
xshared.h:83:56: error: unknown type name 'u_int16_t'; did you mean 'uint16_t'?
83 | set_option(unsigned int *options, unsigned int option, u_int16_t *invflg,
| ^~~~~~~~~
| uint16_t
make[6]: *** [Makefile:712: xtables_legacy_multi-xtables-legacy-multi.o] Error 1
Avoid libipq API breakage by adjusting libipq.h include accordingly. For
arpt_mangle.h kernel uAPI header, apply same change as in kernel commit e91ded8db5747 ("uapi: netfilter_arp: use __u8 instead of u_int8_t").
Signed-off-by: Nick Hainke <vincent@systemli.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Wed, 4 May 2022 09:19:16 +0000 (11:19 +0200)]
nft: Fix EPERM handling for extensions without rev 0
Treating revision 0 as compatible in EPERM case works fine as long as
there is a revision 0 of that extension defined in DSO. Fix the code for
others: Extend the EPERM handling to all revisions and keep the existing
warning for revision 0.
Fixes: 17534cb18ed0a ("Improve error messages for unsupported extensions") Signed-off-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Sat, 16 Apr 2022 12:21:51 +0000 (14:21 +0200)]
man: *NAT: Review --random* option descriptions
Stating the option again in the first (single?) sentence is pointless.
Get rid of that initial half-sentence in MASQUERADE options and unify
the texts a bit.
Phil Sutter [Thu, 14 Apr 2022 15:44:08 +0000 (17:44 +0200)]
extensions: DNAT: Merge core printing functions
Have a versatile __NAT_print() function providing enough flexibility for
DNAT and REDIRECT, IPv4 and IPv6 and 'print' and 'save' output. Then
define macros to simplify calling it.
As a side effect, this fixes ip6tables DNAT revision 1 print output.
Fixes: 14d77c8aa29a7 ("extensions: Merge IPv4 and IPv6 DNAT targets") Signed-off-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Thu, 5 May 2022 22:11:47 +0000 (00:11 +0200)]
libxtables: Revert change to struct xtables_pprot
While protocol values may exceed eight bits, the data structure is
indeed used only to store the static list of name/value pairs for faster
lookups. None of those has such a value and if one is added in future,
the compiler will complain about it.
So restore the old field type to retain binary compatibility.
Fixes: 556f704458cdb ("Use proto_to_name() from xshared in more places") Signed-off-by: Phil Sutter <phil@nwl.cc>
Phil Sutter [Thu, 5 May 2022 16:13:12 +0000 (18:13 +0200)]
xshared: Extend xtables_printhelp() for arptables
The function checks afinfo->family already to cover ip6tables specifics,
doing the same for arptables does not make things much worse.
This changes arptables-nft help output slightly:
* List possible negations extrapositioned, which is preferred anyway
(arptables-nft supports both)
* List --out-interface option at lexically sorted position
* Print --wait option, it's ignored just like with iptables
* Restore default target option printing as with legacy arptables (not
sure if arptables-nft ever did this) by explicitly loading them.
While being at it, add --set-counters short option '-c' to help output
for ip(6)tables.
This effectively removes the need for (and all users of)
xtables_global's 'print_help' callback, thus effectively reverts commit fe83b12fc910e ("libxtables: Introduce xtables_globals print_help
callback") which broke libxtables' ABI compatibility.
projects / thirdparty / iptables.git / log
