Skip to content

GitLab

Commit 89c92f0c authored by Arturo Borrero Gonzalez's avatar Arturo Borrero Gonzalez
Browse files

New upstream version 1.8.3

parent 0309474b
Hide whitespace changes
Inline Side-by-side
iptables/xtables-monitor.c
View file @ 89c92f0c
...@@ -9,6 +9,7 @@ ...@@ -9,6 +9,7 @@
* This software has been sponsored by Sophos Astaro <http://www.sophos.com> * This software has been sponsored by Sophos Astaro <http://www.sophos.com>
*/ */
#define _GNU_SOURCE
#include <stdlib.h> #include <stdlib.h>
#include <time.h> #include <time.h>
#include <string.h> #include <string.h>
...@@ -403,26 +404,24 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg ...@@ -403,26 +404,24 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg
case IPPROTO_UDP: case IPPROTO_UDP:
if (len < 4) if (len < 4)
break; break;
printf("SPORT=%d DPORT=%d ", ntohs(tcph->th_sport), ntohs(tcph->th_dport)); printf("SPORT=%d DPORT=%d ", ntohs(tcph->source), ntohs(tcph->dest));
break; break;
case IPPROTO_TCP: case IPPROTO_TCP:
if (len < sizeof(*tcph)) if (len < sizeof(*tcph))
break; break;
printf("SPORT=%d DPORT=%d ", ntohs(tcph->th_sport), ntohs(tcph->th_dport)); printf("SPORT=%d DPORT=%d ", ntohs(tcph->source), ntohs(tcph->dest));
if (tcph->th_flags & (TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG)) { if (tcph->syn)
if (tcph->th_flags & TH_SYN) printf("SYN ");
printf("SYN "); if (tcph->ack)
if (tcph->th_flags & TH_ACK) printf("ACK ");
printf("ACK "); if (tcph->fin)
if (tcph->th_flags & TH_FIN) printf("FIN ");
printf("FIN "); if (tcph->rst)
if (tcph->th_flags & TH_RST) printf("RST ");
printf("RST "); if (tcph->psh)
if (tcph->th_flags & TH_PUSH) printf("PSH ");
printf("PSH "); if (tcph->urg)
if (tcph->th_flags & TH_URG) printf("URG ");
printf("URG ");
}
break; break;
default: default:
break; break;
......
iptables/xtables-restore.c
View file @ 89c92f0c
...@@ -19,7 +19,7 @@ ...@@ -19,7 +19,7 @@
#include "nft-bridge.h" #include "nft-bridge.h"
#include <libnftnl/chain.h> #include <libnftnl/chain.h>
static int counters, verbose, noflush; static int counters, verbose;
/* Keeping track of external matches and targets. */ /* Keeping track of external matches and targets. */
static const struct option options[] = { static const struct option options[] = {
...@@ -56,43 +56,27 @@ static void print_usage(const char *name, const char *version) ...@@ -56,43 +56,27 @@ static void print_usage(const char *name, const char *version)
" [ --ipv6 ]\n", name); " [ --ipv6 ]\n", name);
} }
static struct nftnl_chain_list *get_chain_list(struct nft_handle *h) static struct nftnl_chain_list *get_chain_list(struct nft_handle *h,
const char *table)
{ {
struct nftnl_chain_list *chain_list; struct nftnl_chain_list *chain_list;
chain_list = nft_chain_list_get(h); chain_list = nft_chain_list_get(h, table);
if (chain_list == NULL) if (chain_list == NULL)
xtables_error(OTHER_PROBLEM, "cannot retrieve chain list\n"); xtables_error(OTHER_PROBLEM, "cannot retrieve chain list\n");
return chain_list; return chain_list;
} }
static void chain_delete(struct nftnl_chain_list *clist, const char *curtable,
const char *chain)
{
struct nftnl_chain *chain_obj;
chain_obj = nft_chain_list_find(clist, curtable, chain);
/* This chain has been found, delete from list. Later
* on, unvisited chains will be purged out.
*/
if (chain_obj != NULL) {
nftnl_chain_list_del(chain_obj);
nftnl_chain_free(chain_obj);
}
}
struct nft_xt_restore_cb restore_cb = { struct nft_xt_restore_cb restore_cb = {
.chain_list = get_chain_list, .chain_list = get_chain_list,
.commit = nft_commit, .commit = nft_commit,
.abort = nft_abort, .abort = nft_abort,
.table_new = nft_table_new, .table_new = nft_table_new,
.table_flush = nft_table_flush, .table_flush = nft_table_flush,
.chain_user_flush = nft_chain_user_flush,
.chain_del = chain_delete,
.do_command = do_commandx, .do_command = do_commandx,
.chain_set = nft_chain_set, .chain_set = nft_chain_set,
.chain_user_add = nft_chain_user_add, .chain_restore = nft_chain_restore,
}; };
static const struct xtc_ops xtc_ops = { static const struct xtc_ops xtc_ops = {
...@@ -104,17 +88,13 @@ void xtables_restore_parse(struct nft_handle *h, ...@@ -104,17 +88,13 @@ void xtables_restore_parse(struct nft_handle *h,
struct nft_xt_restore_cb *cb, struct nft_xt_restore_cb *cb,
int argc, char *argv[]) int argc, char *argv[])
{ {
const struct builtin_table *curtable = NULL;
char buffer[10240]; char buffer[10240];
int in_table = 0; int in_table = 0;
struct builtin_table *curtable = NULL;
const struct xtc_ops *ops = &xtc_ops; const struct xtc_ops *ops = &xtc_ops;
struct nftnl_chain_list *chain_list = NULL;
line = 0; line = 0;
if (cb->chain_list)
chain_list = cb->chain_list(h);
/* Grab standard input. */ /* Grab standard input. */
while (fgets(buffer, sizeof(buffer), p->in)) { while (fgets(buffer, sizeof(buffer), p->in)) {
int ret = 0; int ret = 0;
...@@ -165,7 +145,9 @@ void xtables_restore_parse(struct nft_handle *h, ...@@ -165,7 +145,9 @@ void xtables_restore_parse(struct nft_handle *h,
if (p->tablename && (strcmp(p->tablename, table) != 0)) if (p->tablename && (strcmp(p->tablename, table) != 0))
continue; continue;
if (noflush == 0) { nft_build_cache(h);
if (h->noflush == 0) {
DEBUGP("Cleaning all chains of table '%s'\n", DEBUGP("Cleaning all chains of table '%s'\n",
table); table);
if (cb->table_flush) if (cb->table_flush)
...@@ -182,7 +164,6 @@ void xtables_restore_parse(struct nft_handle *h, ...@@ -182,7 +164,6 @@ void xtables_restore_parse(struct nft_handle *h,
/* New chain. */ /* New chain. */
char *policy, *chain = NULL; char *policy, *chain = NULL;
struct xt_counters count = {}; struct xt_counters count = {};
bool chain_exists = false;
chain = strtok(buffer+1, " \t\n"); chain = strtok(buffer+1, " \t\n");
DEBUGP("line %u, chain '%s'\n", line, chain); DEBUGP("line %u, chain '%s'\n", line, chain);
...@@ -193,22 +174,6 @@ void xtables_restore_parse(struct nft_handle *h, ...@@ -193,22 +174,6 @@ void xtables_restore_parse(struct nft_handle *h,
exit(1); exit(1);
} }
if (noflush == 0) {
if (cb->chain_del)
cb->chain_del(chain_list, curtable->name,
chain);
} else if (nft_chain_list_find(chain_list,
curtable->name, chain)) {
chain_exists = true;
/* Apparently -n still flushes existing user
* defined chains that are redefined. Otherwise,
* leave them as is.
*/
if (cb->chain_user_flush)
cb->chain_user_flush(h, chain_list,
curtable->name, chain);
}
if (strlen(chain) >= XT_EXTENSION_MAXNAMELEN) if (strlen(chain) >= XT_EXTENSION_MAXNAMELEN)
xtables_error(PARAMETER_PROBLEM, xtables_error(PARAMETER_PROBLEM,
"Invalid chain name `%s' " "Invalid chain name `%s' "
...@@ -246,24 +211,22 @@ void xtables_restore_parse(struct nft_handle *h, ...@@ -246,24 +211,22 @@ void xtables_restore_parse(struct nft_handle *h,
} }
DEBUGP("Setting policy of chain %s to %s\n", DEBUGP("Setting policy of chain %s to %s\n",
chain, policy); chain, policy);
ret = 1; } else if (cb->chain_restore(h, chain, curtable->name) < 0 &&
errno != EEXIST) {
} else { xtables_error(PARAMETER_PROBLEM,
if (!chain_exists && "cannot create chain "
cb->chain_user_add && "'%s' (%s)\n", chain,
cb->chain_user_add(h, chain, strerror(errno));
curtable->name) < 0) { } else if (h->family == NFPROTO_BRIDGE &&
if (errno == EEXIST) !ebt_set_user_chain_policy(h, curtable->name,
continue; chain, policy)) {
xtables_error(OTHER_PROBLEM,
xtables_error(PARAMETER_PROBLEM, "Can't set policy `%s'"
"cannot create chain " " on `%s' line %u: %s\n",
"'%s' (%s)\n", chain, policy, chain, line,
strerror(errno)); ops->strerror(errno));
}
continue;
} }
ret = 1;
} else if (in_table) { } else if (in_table) {
int a; int a;
char *pcnt = NULL; char *pcnt = NULL;
...@@ -359,7 +322,7 @@ void xtables_restore_parse(struct nft_handle *h, ...@@ -359,7 +322,7 @@ void xtables_restore_parse(struct nft_handle *h,
static int static int
xtables_restore_main(int family, const char *progname, int argc, char *argv[]) xtables_restore_main(int family, const char *progname, int argc, char *argv[])
{ {
struct builtin_table *tables; const struct builtin_table *tables;
struct nft_handle h = { struct nft_handle h = {
.family = family, .family = family,
.restore = true, .restore = true,
...@@ -402,7 +365,7 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[]) ...@@ -402,7 +365,7 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
IPTABLES_VERSION); IPTABLES_VERSION);
exit(0); exit(0);
case 'n': case 'n':
noflush = 1; h.noflush = 1;
break; break;
case 'M': case 'M':
xtables_modprobe_program = optarg; xtables_modprobe_program = optarg;
...@@ -490,16 +453,21 @@ int xtables_ip6_restore_main(int argc, char *argv[]) ...@@ -490,16 +453,21 @@ int xtables_ip6_restore_main(int argc, char *argv[])
argc, argv); argc, argv);
} }
static int ebt_table_flush(struct nft_handle *h, const char *table)
{
/* drop any pending policy rule add/removal jobs */
nft_abort_policy_rule(h, table);
return nft_table_flush(h, table);
}
struct nft_xt_restore_cb ebt_restore_cb = { struct nft_xt_restore_cb ebt_restore_cb = {
.chain_list = get_chain_list, .chain_list = get_chain_list,
.commit = nft_commit, .commit = nft_commit,
.table_new = nft_table_new, .table_new = nft_table_new,
.table_flush = nft_table_flush, .table_flush = ebt_table_flush,
.chain_user_flush = nft_chain_user_flush,
.chain_del = chain_delete,
.do_command = do_commandeb, .do_command = do_commandeb,
.chain_set = nft_chain_set, .chain_set = nft_chain_set,
.chain_user_add = nft_chain_user_add, .chain_restore = nft_chain_restore,
}; };
static const struct option ebt_restore_options[] = { static const struct option ebt_restore_options[] = {
...@@ -512,6 +480,7 @@ int xtables_eb_restore_main(int argc, char *argv[]) ...@@ -512,6 +480,7 @@ int xtables_eb_restore_main(int argc, char *argv[])
struct nft_xt_restore_parse p = { struct nft_xt_restore_parse p = {
.in = stdin, .in = stdin,
}; };
bool noflush = false;
struct nft_handle h; struct nft_handle h;
int c; int c;
...@@ -530,6 +499,7 @@ int xtables_eb_restore_main(int argc, char *argv[]) ...@@ -530,6 +499,7 @@ int xtables_eb_restore_main(int argc, char *argv[])
} }
nft_init_eb(&h, "ebtables-restore"); nft_init_eb(&h, "ebtables-restore");
h.noflush = noflush;
xtables_restore_parse(&h, &p, &ebt_restore_cb, argc, argv); xtables_restore_parse(&h, &p, &ebt_restore_cb, argc, argv);
nft_fini(&h); nft_fini(&h);
...@@ -541,11 +511,9 @@ struct nft_xt_restore_cb arp_restore_cb = { ...@@ -541,11 +511,9 @@ struct nft_xt_restore_cb arp_restore_cb = {
.commit = nft_commit, .commit = nft_commit,
.table_new = nft_table_new, .table_new = nft_table_new,
.table_flush = nft_table_flush, .table_flush = nft_table_flush,
.chain_user_flush = nft_chain_user_flush,
.chain_del = chain_delete,
.do_command = do_commandarp, .do_command = do_commandarp,
.chain_set = nft_chain_set, .chain_set = nft_chain_set,
.chain_user_add = nft_chain_user_add, .chain_restore = nft_chain_restore,
}; };
int xtables_arp_restore_main(int argc, char *argv[]) int xtables_arp_restore_main(int argc, char *argv[])
......
iptables/xtables-save.c
View file @ 89c92f0c
...@@ -73,7 +73,9 @@ __do_output(struct nft_handle *h, const char *tablename, bool counters) ...@@ -73,7 +73,9 @@ __do_output(struct nft_handle *h, const char *tablename, bool counters)
return 0; return 0;
} }
chain_list = nft_chain_list_get(h); chain_list = nft_chain_list_get(h, tablename);
if (!chain_list)
return 0;
time_t now = time(NULL); time_t now = time(NULL);
...@@ -83,7 +85,7 @@ __do_output(struct nft_handle *h, const char *tablename, bool counters) ...@@ -83,7 +85,7 @@ __do_output(struct nft_handle *h, const char *tablename, bool counters)
/* Dump out chain names first, /* Dump out chain names first,
* thereby preventing dependency conflicts */ * thereby preventing dependency conflicts */
nft_chain_save(h, chain_list, tablename); nft_chain_save(h, chain_list);
nft_rule_save(h, tablename, counters ? 0 : FMT_NOCOUNTS); nft_rule_save(h, tablename, counters ? 0 : FMT_NOCOUNTS);
now = time(NULL); now = time(NULL);
...@@ -103,8 +105,9 @@ do_output(struct nft_handle *h, const char *tablename, bool counters) ...@@ -103,8 +105,9 @@ do_output(struct nft_handle *h, const char *tablename, bool counters)
return !!ret; return !!ret;
} }
if (!nft_table_find(h, tablename)) { if (!nft_table_find(h, tablename) &&
printf("Table `%s' does not exist\n", tablename); !nft_table_builtin_find(h, tablename)) {
fprintf(stderr, "Table `%s' does not exist\n", tablename);
return 1; return 1;
} }
...@@ -120,7 +123,7 @@ do_output(struct nft_handle *h, const char *tablename, bool counters) ...@@ -120,7 +123,7 @@ do_output(struct nft_handle *h, const char *tablename, bool counters)
static int static int
xtables_save_main(int family, const char *progname, int argc, char *argv[]) xtables_save_main(int family, const char *progname, int argc, char *argv[])
{ {
struct builtin_table *tables; const struct builtin_table *tables;
const char *tablename = NULL; const char *tablename = NULL;
bool dump = false; bool dump = false;
struct nft_handle h = { struct nft_handle h = {
...@@ -184,7 +187,8 @@ xtables_save_main(int family, const char *progname, int argc, char *argv[]) ...@@ -184,7 +187,8 @@ xtables_save_main(int family, const char *progname, int argc, char *argv[])
exit(0); exit(0);
default: default:
fprintf(stderr, fprintf(stderr,
"Look at manual page `xtables-save.8' for more information.\n"); "Look at manual page `%s.8' for more information.\n",
prog_name);
exit(1); exit(1);
} }
} }
...@@ -257,7 +261,7 @@ static int __ebt_save(struct nft_handle *h, const char *tablename, bool counters ...@@ -257,7 +261,7 @@ static int __ebt_save(struct nft_handle *h, const char *tablename, bool counters
return 0; return 0;
} }
chain_list = nft_chain_list_get(h); chain_list = nft_chain_list_get(h, tablename);
if (first) { if (first) {
now = time(NULL); now = time(NULL);
...@@ -272,7 +276,7 @@ static int __ebt_save(struct nft_handle *h, const char *tablename, bool counters ...@@ -272,7 +276,7 @@ static int __ebt_save(struct nft_handle *h, const char *tablename, bool counters
/* Dump out chain names first, /* Dump out chain names first,
* thereby preventing dependency conflicts */ * thereby preventing dependency conflicts */
nft_chain_save(h, chain_list, tablename); nft_chain_save(h, chain_list);
nft_rule_save(h, tablename, format); nft_rule_save(h, tablename, format);
printf("\n"); printf("\n");
return 0; return 0;
...@@ -330,7 +334,8 @@ int xtables_eb_save_main(int argc_, char *argv_[]) ...@@ -330,7 +334,8 @@ int xtables_eb_save_main(int argc_, char *argv_[])
exit(0); exit(0);
default: default:
fprintf(stderr, fprintf(stderr,
"Look at manual page `xtables-save.8' for more information.\n"); "Look at manual page `%s.8' for more information.\n",
prog_name);
exit(1); exit(1);
} }
} }
...@@ -377,7 +382,8 @@ int xtables_arp_save_main(int argc, char **argv) ...@@ -377,7 +382,8 @@ int xtables_arp_save_main(int argc, char **argv)
exit(0); exit(0);
default: default:
fprintf(stderr, fprintf(stderr,
"Look at manual page `xtables-save.8' for more information.\n"); "Look at manual page `%s.8' for more information.\n",
prog_name);
exit(1); exit(1);
} }
} }
...@@ -399,7 +405,7 @@ int xtables_arp_save_main(int argc, char **argv) ...@@ -399,7 +405,7 @@ int xtables_arp_save_main(int argc, char **argv)
} }
printf("*filter\n"); printf("*filter\n");
nft_chain_save(&h, nft_chain_list_get(&h), "filter"); nft_chain_save(&h, nft_chain_list_get(&h, "filter"));
nft_rule_save(&h, "filter", show_counters ? 0 : FMT_NOCOUNTS); nft_rule_save(&h, "filter", show_counters ? 0 : FMT_NOCOUNTS);
printf("\n"); printf("\n");
nft_fini(&h); nft_fini(&h);
......
iptables/xtables-translate.8
View file @ 89c92f0c
...@@ -22,11 +22,12 @@ ...@@ -22,11 +22,12 @@
.\" <http://www.gnu.org/licenses/>. .\" <http://www.gnu.org/licenses/>.
.\" %%%LICENSE_END .\" %%%LICENSE_END
.\" .\"
.TH XTABLES-TRANSLATE 8 "Mar 16, 2018" .TH IPTABLES-TRANSLATE 8 "May 14, 2019"
.SH NAME .SH NAME
xtables-translate \- translation tools to migrate from iptables to nftables iptables-translate \(em translation tool to migrate from iptables to nftables
.P
ip6tables-translate \(em translation tool to migrate from ip6tables to nftables
.SH DESCRIPTION .SH DESCRIPTION
There is a set of tools to help the system administrator translate a given There is a set of tools to help the system administrator translate a given
ruleset from \fBiptables(8)\fP and \fBip6tables(8)\fP to \fBnftables(8)\fP. ruleset from \fBiptables(8)\fP and \fBip6tables(8)\fP to \fBnftables(8)\fP.
...@@ -123,7 +124,7 @@ To get up-to-date information about this, please head to ...@@ -123,7 +124,7 @@ To get up-to-date information about this, please head to
\fBhttps://wiki.nftables.org/\fP. \fBhttps://wiki.nftables.org/\fP.
.SH SEE ALSO .SH SEE ALSO
\fBnft(8)\fP, \fBxtables-compat(8)\fP \fBnft(8)\fP, \fBiptables(8)\fP
.SH AUTHORS .SH AUTHORS
The nftables framework is written by the Netfilter project The nftables framework is written by the Netfilter project
......
iptables/xtables-translate.c
View file @ 89c92f0c
...@@ -329,8 +329,8 @@ static const struct option options[] = { ...@@ -329,8 +329,8 @@ static const struct option options[] = {
{ NULL }, { NULL },
}; };
static int xlate_chain_user_add(struct nft_handle *h, const char *chain, static int xlate_chain_user_restore(struct nft_handle *h, const char *chain,
const char *table) const char *table)
{ {
printf("add chain %s %s %s\n", family2str[h->family], table, chain); printf("add chain %s %s %s\n", family2str[h->family], table, chain);
return 0; return 0;
...@@ -416,7 +416,7 @@ static int dummy_compat_rev(const char *name, uint8_t rev, int opt) ...@@ -416,7 +416,7 @@ static int dummy_compat_rev(const char *name, uint8_t rev, int opt)
static struct nft_xt_restore_cb cb_xlate = { static struct nft_xt_restore_cb cb_xlate = {
.table_new = xlate_table_new, .table_new = xlate_table_new,
.chain_set = xlate_chain_set, .chain_set = xlate_chain_set,
.chain_user_add = xlate_chain_user_add, .chain_restore = xlate_chain_user_restore,
.do_command = do_command_xlate, .do_command = do_command_xlate,
.commit = commit, .commit = commit,
.abort = commit, .abort = commit,
...@@ -426,7 +426,7 @@ static int xtables_xlate_main_common(struct nft_handle *h, ...@@ -426,7 +426,7 @@ static int xtables_xlate_main_common(struct nft_handle *h,
int family, int family,
const char *progname) const char *progname)
{ {
struct builtin_table *tables; const struct builtin_table *tables;
int ret; int ret;
xtables_globals.program_name = progname; xtables_globals.program_name = progname;
......
iptables/xtables.c
View file @ 89c92f0c
...@@ -406,7 +406,7 @@ add_entry(const char *chain, ...@@ -406,7 +406,7 @@ add_entry(const char *chain,
if (append) { if (append) {
ret = nft_rule_append(h, chain, table, ret = nft_rule_append(h, chain, table,
cs, 0, cs, NULL,
verbose); verbose);
} else { } else {
ret = nft_rule_insert(h, chain, table, ret = nft_rule_insert(h, chain, table,
...@@ -426,7 +426,7 @@ add_entry(const char *chain, ...@@ -426,7 +426,7 @@ add_entry(const char *chain,
&d.mask.v6[j], sizeof(struct in6_addr)); &d.mask.v6[j], sizeof(struct in6_addr));
if (append) { if (append) {
ret = nft_rule_append(h, chain, table, ret = nft_rule_append(h, chain, table,
cs, 0, cs, NULL,
verbose); verbose);
} else { } else {
ret = nft_rule_insert(h, chain, table, ret = nft_rule_insert(h, chain, table,
...@@ -820,7 +820,7 @@ void do_parse(struct nft_handle *h, int argc, char *argv[], ...@@ -820,7 +820,7 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
case 'j': case 'j':
set_option(&cs->options, OPT_JUMP, &cs->fw.ip.invflags, set_option(&cs->options, OPT_JUMP, &cs->fw.ip.invflags,
cs->invert); cs->invert);
command_jump(cs); command_jump(cs, optarg);
break; break;
...@@ -1064,18 +1064,11 @@ void do_parse(struct nft_handle *h, int argc, char *argv[], ...@@ -1064,18 +1064,11 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
p->chain); p->chain);
} }
if (!p->xlate && !nft_chain_exists(h, p->table, p->chain))
xtables_error(OTHER_PROBLEM,
"Chain '%s' does not exist", p->chain);
if (!p->xlate && !cs->target && strlen(cs->jumpto) > 0 && if (!p->xlate && !cs->target && strlen(cs->jumpto) > 0 &&
!nft_chain_exists(h, p->table, cs->jumpto)) !nft_chain_exists(h, p->table, cs->jumpto))
xtables_error(PARAMETER_PROBLEM, xtables_error(PARAMETER_PROBLEM,
"Chain '%s' does not exist", cs->jumpto); "Chain '%s' does not exist", cs->jumpto);
} }
if (!p->xlate && p->command == CMD_NEW_CHAIN &&
nft_chain_exists(h, p->table, p->chain))
xtables_error(OTHER_PROBLEM, "Chain already exists");
} }
int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table, int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table,
...@@ -1189,8 +1182,10 @@ int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table, ...@@ -1189,8 +1182,10 @@ int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table,
*table = p.table; *table = p.table;
xtables_rule_matches_free(&cs.matches); xtables_rule_matches_free(&cs.matches);
if (cs.target) if (cs.target) {
free(cs.target->t); free(cs.target->t);
cs.target->t = NULL;
}
if (h->family == AF_INET) { if (h->family == AF_INET) {
free(args.s.addr.v4); free(args.s.addr.v4);
......
libiptc/Makefile.am
View file @ 89c92f0c
...@@ -10,6 +10,6 @@ libiptc_la_SOURCES = ...@@ -10,6 +10,6 @@ libiptc_la_SOURCES =
libiptc_la_LIBADD = libip4tc.la libip6tc.la libiptc_la_LIBADD = libip4tc.la libip6tc.la
libiptc_la_LDFLAGS = -version-info 0:0:0 ${libiptc_LDFLAGS2} libiptc_la_LDFLAGS = -version-info 0:0:0 ${libiptc_LDFLAGS2}
libip4tc_la_SOURCES = libip4tc.c libip4tc_la_SOURCES = libip4tc.c
libip4tc_la_LDFLAGS = -version-info 1:0:1 libip4tc_la_LDFLAGS = -version-info 2:0:0
libip6tc_la_SOURCES = libip6tc.c libip6tc_la_SOURCES = libip6tc.c
libip6tc_la_LDFLAGS = -version-info 1:0:1 ${libiptc_LDFLAGS2} libip6tc_la_LDFLAGS = -version-info 2:0:0 ${libiptc_LDFLAGS2}
libiptc/Makefile.in
View file @ 89c92f0c
...@@ -380,9 +380,9 @@ libiptc_la_SOURCES = ...@@ -380,9 +380,9 @@ libiptc_la_SOURCES =
libiptc_la_LIBADD = libip4tc.la libip6tc.la libiptc_la_LIBADD = libip4tc.la libip6tc.la
libiptc_la_LDFLAGS = -version-info 0:0:0 ${libiptc_LDFLAGS2} libiptc_la_LDFLAGS = -version-info 0:0:0 ${libiptc_LDFLAGS2}
libip4tc_la_SOURCES = libip4tc.c libip4tc_la_SOURCES = libip4tc.c
libip4tc_la_LDFLAGS = -version-info 1:0:1 libip4tc_la_LDFLAGS = -version-info 2:0:0
libip6tc_la_SOURCES = libip6tc.c libip6tc_la_SOURCES = libip6tc.c
libip6tc_la_LDFLAGS = -version-info 1:0:1 ${libiptc_LDFLAGS2} libip6tc_la_LDFLAGS = -version-info 2:0:0 ${libiptc_LDFLAGS2}
all: all-am all: all-am
.SUFFIXES: .SUFFIXES:
......
libiptc/libiptc.c
View file @ 89c92f0c
...@@ -2751,11 +2751,15 @@ TC_STRERROR(int err) ...@@ -2751,11 +2751,15 @@ TC_STRERROR(int err)
const struct xtc_ops TC_OPS = { const struct xtc_ops TC_OPS = {
.commit = TC_COMMIT, .commit = TC_COMMIT,
.init = TC_INIT,
.free = TC_FREE, .free = TC_FREE,
.builtin = TC_BUILTIN, .builtin = TC_BUILTIN,
.is_chain = TC_IS_CHAIN, .is_chain = TC_IS_CHAIN,
.flush_entries = TC_FLUSH_ENTRIES, .flush_entries = TC_FLUSH_ENTRIES,
.create_chain = TC_CREATE_CHAIN, .create_chain = TC_CREATE_CHAIN,
.first_chain = TC_FIRST_CHAIN,
.next_chain = TC_NEXT_CHAIN,
.get_policy = TC_GET_POLICY,
.set_policy = TC_SET_POLICY, .set_policy = TC_SET_POLICY,
.strerror = TC_STRERROR, .strerror = TC_STRERROR,
}; };
libxtables/xtables.c
View file @ 89c92f0c
...@@ -756,8 +756,24 @@ xtables_find_target(const char *name, enum xtables_tryload tryload) ...@@ -756,8 +756,24 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
} }
for (ptr = xtables_targets; ptr; ptr = ptr->next) { for (ptr = xtables_targets; ptr; ptr = ptr->next) {
if (extension_cmp(name, ptr->name, ptr->family)) if (extension_cmp(name, ptr->name, ptr->family)) {
struct xtables_target *clone;
/* First target of this type: */
if (ptr->t == NULL)
break;
/* Second and subsequent clones */
clone = xtables_malloc(sizeof(struct xtables_target));
memcpy(clone, ptr, sizeof(struct xtables_target));
clone->udata = NULL;
clone->tflags = 0;
/* This is a clone: */
clone->next = clone;
ptr = clone;
break; break;
}
} }
#ifndef NO_SHARED_LIBS #ifndef NO_SHARED_LIBS
......
release.sh deleted 100644 → 0
View file @ 0309474b
#! /bin/sh
#
set -e
VERSION=1.4.7
PREV_VERSION=1.4.6
TMPDIR=/tmp/ipt-release
IPTDIR="$TMPDIR/iptables-$VERSION"
PATCH="patch-iptables-$PREV_VERSION-$VERSION.bz2";
TARBALL="iptables-$VERSION.tar.bz2";
CHANGELOG="changes-iptables-$PREV_VERSION-$VERSION.txt";
mkdir -p "$TMPDIR"
git shortlog "v$PREV_VERSION..v$VERSION" > "$TMPDIR/$CHANGELOG"
git diff "v$PREV_VERSION..v$VERSION" | bzip2 > "$TMPDIR/$PATCH"
git archive --prefix="iptables-$VERSION/" "v$VERSION" | tar -xC "$TMPDIR/"
cd "$IPTDIR" && {
sh autogen.sh
cd ..
}
tar -cjf "$TARBALL" "iptables-$VERSION";
gpg -u "Netfilter Core Team" -sb "$TARBALL";
md5sum "$TARBALL" >"$TARBALL.md5sum";
sha1sum "$TARBALL" >"$TARBALL.sha1sum";
gpg -u "Netfilter Core Team" -sb "$PATCH";
md5sum "$PATCH" >"$PATCH.md5sum";
sha1sum "$PATCH" >"$PATCH.sha1sum";
utils/.gitignore
View file @ 89c92f0c
/nfnl_osf /nfnl_osf
/nfnl_osf.8 /nfnl_osf.8
/nfbpf_compile /nfbpf_compile
/nfbpf_compile.8
utils/Makefile.am
View file @ 89c92f0c
...@@ -17,6 +17,7 @@ nfnl_osf_LDADD = ${libnfnetlink_LIBS} ...@@ -17,6 +17,7 @@ nfnl_osf_LDADD = ${libnfnetlink_LIBS}
endif endif
if ENABLE_BPFC if ENABLE_BPFC
man_MANS += nfbpf_compile.8
sbin_PROGRAMS += nfbpf_compile sbin_PROGRAMS += nfbpf_compile
nfbpf_compile_LDADD = -lpcap nfbpf_compile_LDADD = -lpcap
endif endif
...@@ -26,4 +27,4 @@ sbin_PROGRAMS += nfsynproxy ...@@ -26,4 +27,4 @@ sbin_PROGRAMS += nfsynproxy
nfsynproxy_LDADD = -lpcap nfsynproxy_LDADD = -lpcap
endif endif
CLEANFILES = nfnl_osf.8 CLEANFILES = nfnl_osf.8 nfbpf_compile.8
utils/Makefile.in
View file @ 89c92f0c
...@@ -94,8 +94,9 @@ sbin_PROGRAMS = $(am__EXEEXT_1) $(am__EXEEXT_2) $(am__EXEEXT_3) ...@@ -94,8 +94,9 @@ sbin_PROGRAMS = $(am__EXEEXT_1) $(am__EXEEXT_2) $(am__EXEEXT_3)
@HAVE_LIBNFNETLINK_TRUE@am__append_1 = nfnl_osf.8 @HAVE_LIBNFNETLINK_TRUE@am__append_1 = nfnl_osf.8
@HAVE_LIBNFNETLINK_TRUE@am__append_2 = nfnl_osf @HAVE_LIBNFNETLINK_TRUE@am__append_2 = nfnl_osf
@HAVE_LIBNFNETLINK_TRUE@am__append_3 = pf.os @HAVE_LIBNFNETLINK_TRUE@am__append_3 = pf.os
@ENABLE_BPFC_TRUE@am__append_4 = nfbpf_compile @ENABLE_BPFC_TRUE@am__append_4 = nfbpf_compile.8
@ENABLE_SYNCONF_TRUE@am__append_5 = nfsynproxy @ENABLE_BPFC_TRUE@am__append_5 = nfbpf_compile
@ENABLE_SYNCONF_TRUE@am__append_6 = nfsynproxy
subdir = utils subdir = utils
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/ax_check_linker_flags.m4 \ am__aclocal_m4_deps = $(top_srcdir)/m4/ax_check_linker_flags.m4 \
...@@ -107,7 +108,7 @@ am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ ...@@ -107,7 +108,7 @@ am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON) DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
mkinstalldirs = $(install_sh) -d mkinstalldirs = $(install_sh) -d
CONFIG_HEADER = $(top_builddir)/config.h CONFIG_HEADER = $(top_builddir)/config.h
CONFIG_CLEAN_FILES = nfnl_osf.8 CONFIG_CLEAN_FILES = nfnl_osf.8 nfbpf_compile.8
CONFIG_CLEAN_VPATH_FILES = CONFIG_CLEAN_VPATH_FILES =
@HAVE_LIBNFNETLINK_TRUE@am__EXEEXT_1 = nfnl_osf$(EXEEXT) @HAVE_LIBNFNETLINK_TRUE@am__EXEEXT_1 = nfnl_osf$(EXEEXT)
@ENABLE_BPFC_TRUE@am__EXEEXT_2 = nfbpf_compile$(EXEEXT) @ENABLE_BPFC_TRUE@am__EXEEXT_2 = nfbpf_compile$(EXEEXT)
...@@ -220,8 +221,8 @@ am__define_uniq_tagged_files = \ ...@@ -220,8 +221,8 @@ am__define_uniq_tagged_files = \
done | $(am__uniquify_input)` done | $(am__uniquify_input)`
ETAGS = etags ETAGS = etags
CTAGS = ctags CTAGS = ctags
am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/nfnl_osf.8.in \ am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/nfbpf_compile.8.in \
$(top_srcdir)/build-aux/depcomp $(srcdir)/nfnl_osf.8.in $(top_srcdir)/build-aux/depcomp
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
pkgdatadir = @pkgdatadir@ pkgdatadir = @pkgdatadir@
ACLOCAL = @ACLOCAL@ ACLOCAL = @ACLOCAL@
...@@ -379,11 +380,11 @@ AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include \ ...@@ -379,11 +380,11 @@ AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include \
-I${top_srcdir}/include ${libnfnetlink_CFLAGS} -I${top_srcdir}/include ${libnfnetlink_CFLAGS}
pkgdata_DATA = $(am__append_3) pkgdata_DATA = $(am__append_3)
man_MANS = $(am__append_1) man_MANS = $(am__append_1) $(am__append_4)
@HAVE_LIBNFNETLINK_TRUE@nfnl_osf_LDADD = ${libnfnetlink_LIBS} @HAVE_LIBNFNETLINK_TRUE@nfnl_osf_LDADD = ${libnfnetlink_LIBS}
@ENABLE_BPFC_TRUE@nfbpf_compile_LDADD = -lpcap @ENABLE_BPFC_TRUE@nfbpf_compile_LDADD = -lpcap
@ENABLE_SYNCONF_TRUE@nfsynproxy_LDADD = -lpcap @ENABLE_SYNCONF_TRUE@nfsynproxy_LDADD = -lpcap
CLEANFILES = nfnl_osf.8 CLEANFILES = nfnl_osf.8 nfbpf_compile.8
all: all-am all: all-am
.SUFFIXES: .SUFFIXES:
...@@ -419,6 +420,8 @@ $(ACLOCAL_M4): $(am__aclocal_m4_deps) ...@@ -419,6 +420,8 @@ $(ACLOCAL_M4): $(am__aclocal_m4_deps)
$(am__aclocal_m4_deps): $(am__aclocal_m4_deps):
nfnl_osf.8: $(top_builddir)/config.status $(srcdir)/nfnl_osf.8.in nfnl_osf.8: $(top_builddir)/config.status $(srcdir)/nfnl_osf.8.in
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
nfbpf_compile.8: $(top_builddir)/config.status $(srcdir)/nfbpf_compile.8.in
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
install-sbinPROGRAMS: $(sbin_PROGRAMS) install-sbinPROGRAMS: $(sbin_PROGRAMS)
@$(NORMAL_INSTALL) @$(NORMAL_INSTALL)
@list='$(sbin_PROGRAMS)'; test -n "$(sbindir)" || list=; \ @list='$(sbin_PROGRAMS)'; test -n "$(sbindir)" || list=; \
......
utils/nfbpf_compile.8.in 0 → 100644
View file @ 89c92f0c
.TH NFBPF_COMPILE 8 "" "@PACKAGE_STRING@" "@PACKAGE_STRING@"
.SH NAME
nfbpf_compile \- generate bytecode for use with xt_bpf
.SH SYNOPSIS
.ad l
.in +8
.ti -8
.B nfbpf_compile
[
.I LLTYPE
]
.I PROGRAM
.ti -8
.I LLTYPE
:= {
.BR EN10MB " | " RAW " | " SLIP " | "
.I ...
}
.SH DESCRIPTION
The
.B nfbpf_compile
utility aids in generating BPF byte code suitable for passing to
the iptables
.B bpf
match.
.SH OPTIONS
.TP
.I LLTYPE
Link-layer header type to operate on. This is a name as defined in
.RB < pcap/dlt.h >
but with the leading
.B DLT_
prefix stripped. For use with iptables,
.B RAW
should be the right choice (it's also the default if not specified).
.TP
.I PROGRAM
The BPF expression to compile, see
.BR pcap-filter (7)
for a description of the language.
.SH EXIT STATUS
The program returns 0 on success, 1 otherwise.
.SH EXAMPLE
Match incoming TCP packets with size bigger than 100 bytes:
.P
.in +8
.EE
bpf=$(nfbpf_compile 'tcp and greater 100')
.br
iptables -A INPUT -m bpf --bytecode "$bpf" -j ACCEPT
.RE
.P
The description of
.B bpf
match in
.BR iptables-extensions (8)
lists a few more examples.
.SH SEE ALSO
.BR iptables-extensions (8),
.BR pcap-filter (7)
xlate-test.py
View file @ 89c92f0c
...@@ -8,6 +8,7 @@ import argparse ...@@ -8,6 +8,7 @@ import argparse
from subprocess import Popen, PIPE from subprocess import Popen, PIPE
keywords = ("iptables-translate", "ip6tables-translate", "ebtables-translate") keywords = ("iptables-translate", "ip6tables-translate", "ebtables-translate")
xtables_nft_multi = 'xtables-nft-multi'
if sys.stdout.isatty(): if sys.stdout.isatty():
colors = {"magenta": "\033[95m", "green": "\033[92m", "yellow": "\033[93m", colors = {"magenta": "\033[95m", "green": "\033[92m", "yellow": "\033[93m",
...@@ -33,6 +34,7 @@ def green(string): ...@@ -33,6 +34,7 @@ def green(string):
def run_test(name, payload): def run_test(name, payload):
global xtables_nft_multi
test_passed = True test_passed = True
tests = passed = failed = errors = 0 tests = passed = failed = errors = 0
result = [] result = []
...@@ -40,7 +42,7 @@ def run_test(name, payload): ...@@ -40,7 +42,7 @@ def run_test(name, payload):
for line in payload: for line in payload:
if line.startswith(keywords): if line.startswith(keywords):
tests += 1 tests += 1
process = Popen([ os.path.abspath(os.path.curdir) + "/iptables/xtables-nft-multi" ] + shlex.split(line), stdout=PIPE, stderr=PIPE) process = Popen([ xtables_nft_multi ] + shlex.split(line), stdout=PIPE, stderr=PIPE)
(output, error) = process.communicate() (output, error) = process.communicate()
if process.returncode == 0: if process.returncode == 0:
translation = output.decode("utf-8").rstrip(" \n") translation = output.decode("utf-8").rstrip(" \n")
...@@ -86,8 +88,12 @@ def load_test_files(): ...@@ -86,8 +88,12 @@ def load_test_files():
print("%d test files, %d tests, %d tests passed, %d tests failed, %d errors" % (test_files, total_tests, total_passed, total_failed, total_error)) print("%d test files, %d tests, %d tests passed, %d tests failed, %d errors" % (test_files, total_tests, total_passed, total_failed, total_error))
def main(): def main():
os.putenv("XTABLES_LIBDIR", os.path.abspath("extensions")) global xtables_nft_multi
os.putenv("PATH", "%s/iptables:%s" % (os.path.abspath(os.path.curdir), os.getenv("PATH"))) if not args.host:
os.putenv("XTABLES_LIBDIR", os.path.abspath("extensions"))
xtables_nft_multi = os.path.abspath(os.path.curdir) \
+ '/iptables/' + xtables_nft_multi
if args.test: if args.test:
if not args.test.endswith(".txlate"): if not args.test.endswith(".txlate"):
args.test += ".txlate" args.test += ".txlate"
...@@ -101,6 +107,8 @@ def main(): ...@@ -101,6 +107,8 @@ def main():
parser = argparse.ArgumentParser() parser = argparse.ArgumentParser()
parser.add_argument('-H', '--host', action='store_true',
help='Run tests against installed binaries')
parser.add_argument("test", nargs="?", help="run only the specified test file") parser.add_argument("test", nargs="?", help="run only the specified test file")
args = parser.parse_args() args = parser.parse_args()
main() main()
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment