| Age | Commit message (Collapse) | Author |
|---|
|
Since commit 61e85e3192dea ("iptables-nft: allow removal of empty
builtin chains"), the command may be applied to "builtin" chains as
well, so the output is basically valid.
Apart from that, since kernel commit a1050dd07168 ("netfilter:
nf_tables: Reintroduce shortened deletion notifications") the base chain
deletion notification does not contain NFTNL_CHAIN_PRIO (actually:
NFTA_HOOK_PRIORITY) attribute anymore so this implicitly fixes for
changed kernel behaviour.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
This reverts commit 786b75f7c9b9feaa294da097c2e9727747162c79.
The internal routine xtopt_esize_by_type() is *not* just a fancy wrapper
around direct xtop_psize array access, as clearly indicated by the
comment right above it: It will return the single field size for
range-value types (XTTYPE_UINT*RC).
Using it in xtables_option_metavalidate() leads to spurious "memory
block of wrong size" complaints.
Fixes: 786b75f7c9b9f ("libxtables: Promote xtopt_esize_by_type() as xtopt_psize getter")
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Apart from supporting range-types, this getter is convenient to sanitize
array out of bounds access. Use it in xtables_option_metavalidate() to
simplify the code a bit.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: Florian Westphal <fw@strlen.de>
|
|
The redirect target in ebtables do two things: 1. set skb->pkt_type to
PACKET_HOST, and 2. set the destination mac address to the address of
the receiving bridge device (when not used in BROUTING chain), or the
receiving physical device (otherwise). However, the later cannot be
implemented in nftables not given the translated mac address. So it is
not appropriate to give a specious translation.
This patch disables the translation to prevent possible misunderstanding.
Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension")
Signed-off-by: Miao Wang <shankerwangmiao@gmail.com>
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Just like with TCP and UDP protocol matches, emit a simple 'meta
l4proto' match if no specific header detail is to be matched.
Note that plain '-m sctp' should be a NOP in kernel, but '-p sctp -m
sctp' is not and the translation is deferred to the extension in that
case. Keep things stu^Wsimple and translate unconditionally.
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Fixed commit made option checking overly strict: Some commands may be
commbined (foremost --list and --zero), reject a given option only if it
is not allowed by any of the given commands.
Reported-by: Adam Nielsen <a.nielsen@shikadi.net>
Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()")
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
The intended side-effect here is that iptables-translate will accept
them too. In nftables, the names are supported since basically day 1.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Test iptables-nft with forced compat extension restore as third modus
operandi.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
If enabled (via --compat flag or XTABLES_COMPAT env variable), attach
any extensions for which native nftables expressions are generated to
userdata. An earlier version of the tool trying to parse the
kernel-dumped ruleset may then fall back to these extensions if native
expression parsing fails.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Creation of compat extensions in rule userdata will depend on a flag in
nft_handle.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
If parsing of a rule fails (e.g. due to an unknown native expression),
check if userdata contains a UDATA_TYPE_COMPAT_EXT attribute and retry
parsing the rule preferring the contained extensions instead of native
expressions.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
This new rule udata attribute will contain extensions which have been
converted to native nftables expressions for rule parsers to fall back
to.
While at it, export parse_udata_cb() as rule parsing code will call it
in future.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
These functions either call xtables_error() which terminates the process
or succeed - make them return void. While at it, export them as rule
parsing code will call them in future. Also make input parameter const,
they're not supposed to alter extension data.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Extract the parsing of one expression into a separate function and
export it, preparing for following code changes.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
It is not used outside of nft.c, though in the wrong position so keep
the declaration but right above its caller.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
For compatability with other /bin/sh like busybox ash, since they don't
support the addition assignment operators (+=) and otherwise fails with:
./configure: line 14174: regular_CFLAGS+= -D__UAPI_DEF_ETHHDR=0: not found
Signed-off-by: Achill Gilgenast <fossdd@pwned.life>
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
Fixed commit only adjusted the IPv4-specific callback for unclear
reasons.
Fixes: fe70364b36119 ("xshared: Do not populate interface masks per default")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: Jeremy Sowden <jeremy@azazel.net>
|
|
Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from
kernel") removed code which explicitly set interface masks to all ones. The
result of this is that they are zero. However, they are used to mask interfaces
in `is_same_interfaces`. Consequently, the masked values are alway zero, the
comparisons are always true, and check commands which ought to fail succeed:
# iptables -N test
# iptables -A test -i lo \! -o lo -j REJECT
# iptables -v -L test
Chain test (0 references)
pkts bytes target prot opt in out source destination
0 0 REJECT all -- lo !lo anywhere anywhere reject-with icmp-port-unreachable
# iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT
REJECT all opt -- in lo out !lo 0.0.0.0/0 -> 0.0.0.0/0 reject-with icmp-port-unreachable
Remove the mask parameters from `is_same_interfaces`. Add a test-case.
Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel")
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Protocol number 141 is assigned to a real protocol: Wrapped Encapsulating
Security Payload. This is listed in Debian's /etc/protocols, which leads to
test failures:
./extensions/generic.txlate: Fail
src: iptables-translate -A FORWARD -p 141
exp: nft 'add rule ip filter FORWARD ip protocol 141 counter'
res: nft 'add rule ip filter FORWARD ip protocol wesp counter'
./extensions/generic.txlate: Fail
src: ip6tables-translate -A FORWARD -p 141
exp: nft 'add rule ip6 filter FORWARD meta l4proto 141 counter'
res: nft 'add rule ip6 filter FORWARD meta l4proto wesp counter'
./extensions/generic.txlate: Fail
src: iptables-translate -A FORWARD ! -p 141
exp: nft 'add rule ip filter FORWARD ip protocol != 141 counter'
res: nft 'add rule ip filter FORWARD ip protocol != wesp counter'
./extensions/generic.txlate: Fail
src: ip6tables-translate -A FORWARD ! -p 141
exp: nft 'add rule ip6 filter FORWARD meta l4proto != 141 counter'
res: nft 'add rule ip6 filter FORWARD meta l4proto != wesp counter'
Replace it with 253, which IANA reserves for testing and experimentation.
Fixes: fcaa99ca9e3c ("xtables-translate: Leverage stored protocol names")
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
There are no external users, no need to promote it in xtables.h.
Fixes: 1af6984c57cce ("libxtables: Introduce xtables_strtoul_base()")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Running the different testsuites in parallel is dangerous since despite
running in different netns, legacy iptables still synchronizes via the
common XTABLES_LOCKFILE.
Fixes: e1eaa04e31e44 ("Makefile.am: Integrate testsuites")
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Similar problem as with the other suites: The build directory does not
contain test cases, only build results.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
This was a tricky one: Since called from VPATH topdir, extensions/ do
not contain test files at all. The script consequently passed since 0
tests failed (of 0 in total).
Fix this by introducing TESTS_PATH which is extensions/ below the directory
of the running iptables-test.py. Keep EXTENSIONS_PATH as-is: The built
extensions are indeed there and XTABLES_LIBDIR must point to them.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
If stdout is not a terminal, don't print the '[EXECUTING]' status line
which has to be cleared again.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Sometimes the test would fail, especially after removing
/run/xtables.lock file. Looks like the supposedly blocking
iptables-restore coproc sometimes takes a moment to set things up.
Fixes: 63ab5b8906f69 ("iptables-legacy: Fix for mandatory lock waiting")
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
To make things less confusing for new readers, describe at least what
the two significant functions do.
Fixes: 0e80cfea3762b ("tests: iptables-test: Implement fast test mode")
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Capture any non-zero return code, iptables not necessarily returns 1 on
error.
A known issue with trying to delete a rule by spec is the unsupported
--set-counters option. Strip it before deleting the rule.
Fixes: c8b7aaabbe1fc ("add iptables unit test infrastructure")
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Rules containing among match would spuriously fail to compare if there
was a previous rule with larger among match payload.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Now that extension options are parsed after these functions return, no
modifications need to be carried over to the clone and undone in the
original.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Upon identifying an extension option, ebt_command_default() would have
the extension parse the option prior to creating a copy for attaching to
the iptables_command_state object. After copying, the (modified)
initial extension's data was cleared.
This somewhat awkward process breaks with among match which increases
match_size if needed (but never reduces it). This change is not undone,
hence leaks into following instances. This in turn is problematic with
ebtables-restore only (as multiple rules are parsed) and specifically
when deleting rules as the potentially over-sized match_size won't match
the one parsed from the kernel.
A workaround would be to make bramong_parse() realloc the match also if
new size is smaller than the old one. This patch attempts a proper fix
though, by making ebt_command_default() copy the extension first and
parsing the option into the copy afterwards.
No Fixes tag: Prior to commit 24bb57d3f52ac ("ebtables: Support for
guided option parser"), ebtables relied upon the extension's parser
return code instead of checking option_offset, so copying the extension
opportunistically wasn't feasible.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
The target performs a "VPATH build", so built binaries are not put into
the same directory tree as the test script itself. For lack of a better
way to detect this, assume $PWD in this situation remains being the
build tree's TLD and check if binaries are present in there.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Update iptables-test.py to run libxt_*.t both for iptables and
ip6tables. For libxt_*.t tests, append the command name to status output
line. This update requires changes in the existing tests.
* Rename libxt_*.t into libipt_*.t and add libip6_*.t variant.
- TEE
- TPROXY
- connlimit
- conntrack
- iprange
- ipvs
- policy
- recent
* Rename the following libxt_*.t to libipt_*.t since they are IPv4
specific:
- standard
- osf
* Remove IPv4 specific test in libxt_mark.t
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Unexpected results for lines which are supposed to fail are reported
twice: Once when fast mode runs them individually to clear the path
before batch-handling all others, a second time when non-fast mode takes
over after fast mode had failed and runs all tests individually again.
Sort this nuisance by running these tests silently in fast mode, knowing
that they will run again if failing anyway.
Fixes: 0e80cfea3762b ("tests: iptables-test: Implement fast test mode")
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
dash can't run this script, so it will fail:
ebtables/0010-change-counters_0: 43: Syntax error: "(" unexpected
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
Else, run-tests.sh doesn't execute it.
--- /tmp/old
+++ /tmp/new
@I: [OK] ././testcases/ipt-save/0001load-dumps_0
I: [OK] ././testcases/ipt-save/0002load-fedora27-firewalld_0
+I: [OK] ././testcases/ipt-save/0003save-restore_0
I: [OK] ././testcases/ipt-save/0005iptables_0
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
Skip on ip6tables and arptables as they share the relevant code with
iptables.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
The command is supposed to fail if no rule at given index is found.
While at it, drop the goto and label which are unused since commit
9b896224e0bfc ("xtables: rework rule cache logic").
Fixes: a69cc575295ee ("xtables: allow to reset the counters of an existing rule")
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
For NFT_COMPAT_RULE_SAVE, one has to store the rule number, not its
index in nft_cmd object.
Fixes: 58d364c7120b5 ("ebtables: Use do_parse() from xshared")
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
This flag is merely known to iptables-restore but actively rejected
there and it does not use IPT_OPTSTRING at all.
Fixes: 384958620abab ("use nf_tables and nf_tables compatibility interface")
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
It is a semantic link created by the build system.
Fixes: 68ff869e94a1b ("Makefile: Install arptables-translate link and man page")
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
For obvious reasons, ebtables-nft does not need file-based locking to
prevent concurrency.
Fixes: 1939cbc25e6f5 ("doc: Adjust ebtables man page")
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
The second one referring to xtables-monitor seems out of context without
the first one, join them.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Right now this merely contains a number of intrapositioned negation
warnings, but might be useful in future when debugging unexpected
failures.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
libnftnl commit a96d5a338f24e ("rule: Don't append a newline when
printing a rule") affected nft (and iptables-nft) debug output in that
no extra newline is appended to rule bytecode output anymore. Tolerate
this in the sole test case it breaks by ignoring changes to blank lines.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
nftables users have to explicitly add a verdict: xt_TPROXY's
tproxy_tg4() returns NF_ACCEPT if a socket was found and assigned,
NF_DROP otherwise.
Fixes: a62fe15abcc99 ("extensions: xt_TPROXY: add txlate support")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
Error compiling with musl-libc:
The commit hash 810f8568f44f5863c2350a39f4f5c8d60f762958
introduces the netinet/ether.h header into xtables.h, which causes an error due
to the redefinition of the ethhdr struct, defined in linux/if_ether.h and
netinet/ether.h. This is fixed by the inclusion of -D__UAPI_DEF_ETHHDR=0 in
CFLAGS for musl. Automatically check for this macro, since it is defined
in musl but not in glibc.
Signed-off-by: Joshua Lant joshualant@gmail.com
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
libxt_CONNMARK.c declares enum which is declared in the kernel header.
Modify the version of the header in the repo's include dir to match the
current kernel, and remove the enum declaration from xt_CONNMARK.c.
Signed-off-by: Joshua Lant joshualant@gmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
Use the same named field in 'ctx' instead, it has to carry the value
anyway.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
When iterating through the list of rules in a chain comparing against a
sample, there is no point in carrying that sample as nftnl_rule object
and converting into iptables_command_state object prior to each
comparison. Just do it up front and adjust the callback accordingly.
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
