Skip to content

GitLab

Commit 89c92f0c authored by Arturo Borrero Gonzalez's avatar Arturo Borrero Gonzalez
Browse files

New upstream version 1.8.3

parent 0309474b
Hide whitespace changes
Inline Side-by-side
iptables/arptables-nft-restore.8 0 → 100644
View file @ 89c92f0c
.TH ARPTABLES-RESTORE 8 "March 2019" "" ""
.\"
.\" Man page written by Jesper Dangaard Brouer <brouer@redhat.com> based on a
.\" Man page written by Harald Welte <laforge@gnumonks.org>
.\" It is based on the iptables-restore man page.
.\"
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation; either version 2 of the License, or
.\" (at your option) any later version.
.\"
.\" This program is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program; if not, write to the Free Software
.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
.\"
.\"
.SH NAME
arptables-restore \- Restore ARP Tables (nft-based)
.SH SYNOPSIS
\fBarptables\-restore
.SH DESCRIPTION
.PP
.B arptables-restore
is used to restore ARP Tables from data specified on STDIN or
via a file as first argument.
Use I/O redirection provided by your shell to read from a file
.TP
.B arptables-restore
flushes (deletes) all previous contents of the respective ARP Table.
.SH AUTHOR
Jesper Dangaard Brouer <brouer@redhat.com>
.SH SEE ALSO
\fBarptables\-save\fP(8), \fBarptables\fP(8)
.PP
iptables/arptables-nft-save.8 0 → 100644
View file @ 89c92f0c
.TH ARPTABLES-SAVE 8 "March 2019" "" ""
.\"
.\" Man page written by Jesper Dangaard Brouer <brouer@redhat.com> based on a
.\" Man page written by Harald Welte <laforge@gnumonks.org>
.\" It is based on the iptables-save man page.
.\"
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation; either version 2 of the License, or
.\" (at your option) any later version.
.\"
.\" This program is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program; if not, write to the Free Software
.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
.\"
.\"
.SH NAME
arptables-save \- dump arptables rules to stdout (nft-based)
.SH SYNOPSIS
\fBarptables\-save\fP [\fB\-M\fP \fImodprobe\fP] [\fB\-c\fP]
.P
\fBarptables\-save\fP [\fB\-V\fP]
.SH DESCRIPTION
.PP
.B arptables-save
is used to dump the contents of an ARP Table in easily parseable format
to STDOUT. Use I/O-redirection provided by your shell to write to a file.
.TP
\fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe_program\fP
Specify the path to the modprobe program. By default, arptables-save will
inspect /proc/sys/kernel/modprobe to determine the executable's path.
.TP
\fB\-c\fR, \fB\-\-counters\fR
Include the current values of all packet and byte counters in the output.
.TP
\fB\-V\fR, \fB\-\-version\fR
Print version information and exit.
.SH AUTHOR
Jesper Dangaard Brouer <brouer@redhat.com>
.SH SEE ALSO
\fBarptables\-restore\fP(8), \fBarptables\fP(8)
.PP
iptables/arptables-nft.8 0 → 100644
View file @ 89c92f0c
.TH ARPTABLES 8 "March 2019"
.\"
.\" Man page originally written by Jochen Friedrich <jochen@scram.de>,
.\" maintained by Bart De Schuymer.
.\" It is based on the iptables man page.
.\"
.\" Iptables page by Herve Eychenne March 2000.
.\"
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation; either version 2 of the License, or
.\" (at your option) any later version.
.\"
.\" This program is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program; if not, write to the Free Software
.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
.\"
.\"
.SH NAME
arptables \- ARP table administration (nft-based)
.SH SYNOPSIS
.BR "arptables " [ "-t table" ] " -" [ AD ] " chain rule-specification " [ options ]
.br
.BR "arptables " [ "-t table" ] " -" [ RI ] " chain rulenum rule-specification " [ options ]
.br
.BR "arptables " [ "-t table" ] " -D chain rulenum " [ options ]
.br
.BR "arptables " [ "-t table" ] " -" [ "LFZ" ] " " [ chain ] " " [ options ]
.br
.BR "arptables " [ "-t table" ] " -" [ "NX" ] " chain"
.br
.BR "arptables " [ "-t table" ] " -E old-chain-name new-chain-name"
.br
.BR "arptables " [ "-t table" ] " -P chain target " [ options ]
.SH DESCRIPTION
.B arptables
is a user space tool, it is used to set up and maintain the
tables of ARP rules in the Linux kernel. These rules inspect
the ARP frames which they see.
.B arptables
is analogous to the
.B iptables
user space tool, but
.B arptables
is less complicated.
.SS CHAINS
The kernel table is used to divide functionality into
different sets of rules. Each set of rules is called a chain.
Each chain is an ordered list of rules that can match ARP frames. If a
rule matches an ARP frame, then a processing specification tells
what to do with that matching frame. The processing specification is
called a 'target'. However, if the frame does not match the current
rule in the chain, then the next rule in the chain is examined and so forth.
The user can create new (user-defined) chains which can be used as the 'target' of a rule.
.SS TARGETS
A firewall rule specifies criteria for an ARP frame and a frame
processing specification called a target. When a frame matches a rule,
then the next action performed by the kernel is specified by the target.
The target can be one of these values:
.IR ACCEPT ,
.IR DROP ,
.IR CONTINUE ,
.IR RETURN ,
an 'extension' (see below) or a user-defined chain.
.PP
.I ACCEPT
means to let the frame through.
.I DROP
means the frame has to be dropped.
.I CONTINUE
means the next rule has to be checked. This can be handy to know how many
frames pass a certain point in the chain or to log those frames.
.I RETURN
means stop traversing this chain and resume at the next rule in the
previous (calling) chain.
For the extension targets please see the
.B "TARGET EXTENSIONS"
section of this man page.
.SS TABLES
There is only one ARP table in the Linux
kernel. The table is
.BR filter.
You can drop the '-t filter' argument to the arptables command.
The -t argument must be the
first argument on the arptables command line, if used.
.TP
.B "-t, --table"
.br
.BR filter ,
is the only table and contains two built-in chains:
.B INPUT
(for frames destined for the host) and
.B OUTPUT
(for locally-generated frames).
.br
.br
.SH ARPTABLES COMMAND LINE ARGUMENTS
After the initial arptables command line argument, the remaining
arguments can be divided into several different groups. These groups
are commands, miscellaneous commands, rule-specifications, match-extensions,
and watcher-extensions.
.SS COMMANDS
The arptables command arguments specify the actions to perform on the table
defined with the -t argument. If you do not use the -t argument to name
a table, the commands apply to the default filter table.
With the exception of the
.B "-Z"
command, only one command may be used on the command line at a time.
.TP
.B "-A, --append"
Append a rule to the end of the selected chain.
.TP
.B "-D, --delete"
Delete the specified rule from the selected chain. There are two ways to
use this command. The first is by specifying an interval of rule numbers
to delete, syntax: start_nr[:end_nr]. Using negative numbers is allowed, for more
details about using negative numbers, see the -I command. The second usage is by
specifying the complete rule as it would have been specified when it was added.
.TP
.B "-I, --insert"
Insert the specified rule into the selected chain at the specified rule number.
If the current number of rules equals N, then the specified number can be
between -N and N+1. For a positive number i, it holds that i and i-N-1 specify the
same place in the chain where the rule should be inserted. The number 0 specifies
the place past the last rule in the chain and using this number is therefore
equivalent with using the -A command.
.TP
.B "-R, --replace"
Replaces the specified rule into the selected chain at the specified rule number.
If the current number of rules equals N, then the specified number can be
between 1 and N. i specifies the place in the chain where the rule should be replaced.
.TP
.B "-P, --policy"
Set the policy for the chain to the given target. The policy can be
.BR ACCEPT ", " DROP " or " RETURN .
.TP
.B "-F, --flush"
Flush the selected chain. If no chain is selected, then every chain will be
flushed. Flushing the chain does not change the policy of the
chain, however.
.TP
.B "-Z, --zero"
Set the counters of the selected chain to zero. If no chain is selected, all the counters
are set to zero. The
.B "-Z"
command can be used in conjunction with the
.B "-L"
command.
When both the
.B "-Z"
and
.B "-L"
commands are used together in this way, the rule counters are printed on the screen
before they are set to zero.
.TP
.B "-L, --list"
List all rules in the selected chain. If no chain is selected, all chains
are listed.
.TP
.B "-N, --new-chain"
Create a new user-defined chain with the given name. The number of
user-defined chains is unlimited. A user-defined chain name has maximum
length of 31 characters.
.TP
.B "-X, --delete-chain"
Delete the specified user-defined chain. There must be no remaining references
to the specified chain, otherwise
.B arptables
will refuse to delete it. If no chain is specified, all user-defined
chains that aren't referenced will be removed.
.TP
.B "-E, --rename-chain"
Rename the specified chain to a new name. Besides renaming a user-defined
chain, you may rename a standard chain name to a name that suits your
taste. For example, if you like PREBRIDGING more than PREROUTING,
then you can use the -E command to rename the PREROUTING chain. If you do
rename one of the standard
.B arptables
chain names, please be sure to mention
this fact should you post a question on the
.B arptables
mailing lists.
It would be wise to use the standard name in your post. Renaming a standard
.B arptables
chain in this fashion has no effect on the structure or function
of the
.B arptables
kernel table.
.SS MISCELLANOUS COMMANDS
.TP
.B "-V, --version"
Show the version of the arptables userspace program.
.TP
.B "-h, --help"
Give a brief description of the command syntax.
.TP
.BR "-j, --jump " "\fItarget\fP"
The target of the rule. This is one of the following values:
.BR ACCEPT ,
.BR DROP ,
.BR CONTINUE ,
.BR RETURN ,
a target extension (see
.BR "TARGET EXTENSIONS" ")"
or a user-defined chain name.
.TP
.BI "-c, --set-counters " "PKTS BYTES"
This enables the administrator to initialize the packet and byte
counters of a rule (during
.B INSERT,
.B APPEND,
.B REPLACE
operations).
.SS RULE-SPECIFICATIONS
The following command line arguments make up a rule specification (as used
in the add and delete commands). A "!" option before the specification
inverts the test for that specification. Apart from these standard rule
specifications there are some other command line arguments of interest.
.TP
.BR "-s, --source-ip " "[!] \fIaddress\fP[/\fImask]\fP"
The Source IP specification.
.TP
.BR "-d, --destination-ip " "[!] \fIaddress\fP[/\fImask]\fP"
The Destination IP specification.
.TP
.BR "--source-mac " "[!] \fIaddress\fP[/\fImask\fP]"
The source mac address. Both mask and address are written as 6 hexadecimal
numbers separated by colons.
.TP
.BR "--destination-mac " "[!] \fIaddress\fP[/\fImask\fP]"
The destination mac address. Both mask and address are written as 6 hexadecimal
numbers separated by colons.
.TP
.BR "-i, --in-interface " "[!] \fIname\fP"
The interface via which a frame is received (for the
.B INPUT
chain). The flag
.B --in-if
is an alias for this option.
.TP
.BR "-o, --out-interface " "[!] \fIname\fP"
The interface via which a frame is going to be sent (for the
.B OUTPUT
chain). The flag
.B --out-if
is an alias for this option.
.TP
.BR "-l, --h-length " "\fIlength\fP[/\fImask\fP]"
The hardware length (nr of bytes)
.TP
.BR "--opcode " "\fIcode\fP[/\fImask\fP]
The operation code (2 bytes). Available values are:
.BR 1 = Request
.BR 2 = Reply
.BR 3 = Request_Reverse
.BR 4 = Reply_Reverse
.BR 5 = DRARP_Request
.BR 6 = DRARP_Reply
.BR 7 = DRARP_Error
.BR 8 = InARP_Request
.BR 9 = ARP_NAK .
.TP
.BR "--h-type " "\fItype\fP[/\fImask\fP]"
The hardware type (2 bytes, hexadecimal). Available values are:
.BR 1 = Ethernet .
.TP
.BR "--proto-type " "\fItype\fP[/\fImask\fP]"
The protocol type (2 bytes). Available values are:
.BR 0x800 = IPv4 .
.SS TARGET-EXTENSIONS
.B arptables
extensions are precompiled into the userspace tool. So there is no need
to explicitly load them with a -m option like in
.BR iptables .
However, these
extensions deal with functionality supported by supplemental kernel modules.
.SS mangle
.TP
.BR "--mangle-ip-s IP address"
Mangles Source IP Address to given value.
.TP
.BR "--mangle-ip-d IP address"
Mangles Destination IP Address to given value.
.TP
.BR "--mangle-mac-s MAC address"
Mangles Source MAC Address to given value.
.TP
.BR "--mangle-mac-d MAC address"
Mangles Destination MAC Address to given value.
.TP
.BR "--mangle-target target "
Target of ARP mangle operation
.BR "" ( DROP ", " CONTINUE " or " ACCEPT " -- default is " ACCEPT ).
.SS CLASSIFY
This module allows you to set the skb->priority value (and thus clas-
sify the packet into a specific CBQ class).
.TP
.BR "--set-class major:minor"
Set the major and minor class value. The values are always
interpreted as hexadecimal even if no 0x prefix is given.
.SS MARK
This module allows you to set the skb->mark value (and thus classify
the packet by the mark in u32)
.TP
.BR "--set-mark mark"
Set the mark value. The values are always
interpreted as hexadecimal even if no 0x prefix is given
.TP
.BR "--and-mark mark"
Binary AND the mark with bits.
.TP
.BR "--or-mark mark"
Binary OR the mark with bits.
.SH NOTES
In this nft-based version of
.BR arptables ,
support for
.B FORWARD
chain has not been implemented. Since ARP packets are "forwarded" only by Linux
bridges, the same may be achieved using
.B FORWARD
chain in
.BR ebtables .
.SH MAILINGLISTS
.BR "" "See " http://netfilter.org/mailinglists.html
.SH SEE ALSO
.BR xtables-nft "(8), " iptables "(8), " ebtables "(8), " ip (8)
.PP
.BR "" "See " https://wiki.nftables.org
iptables/ebtables-nft.8 0 → 100644
View file @ 89c92f0c
.TH EBTABLES 8 "December 2011"
.\"
.\" Man page written by Bart De Schuymer <bdschuym@pandora.be>
.\" It is based on the iptables man page.
.\"
.\" The man page was edited, February 25th 2003, by
.\" Greg Morgan <" dr_kludge_at_users_sourceforge_net >
.\"
.\" Iptables page by Herve Eychenne March 2000.
.\"
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation; either version 2 of the License, or
.\" (at your option) any later version.
.\"
.\" This program is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program; if not, write to the Free Software
.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
.\"
.\"
.SH NAME
ebtables \- Ethernet bridge frame table administration (nft-based)
.SH SYNOPSIS
.BR "ebtables " [ -t " table ] " - [ ACDI "] chain rule specification [match extensions] [watcher extensions] target"
.br
.BR "ebtables " [ -t " table ] " -P " chain " ACCEPT " | " DROP " | " RETURN
.br
.BR "ebtables " [ -t " table ] " -F " [chain]"
.br
.BR "ebtables " [ -t " table ] " -Z " [chain]"
.br
.BR "ebtables " [ -t " table ] " -L " [" -Z "] [chain] [ [" --Ln "] | [" --Lx "] ] [" --Lc "] [" --Lmac2 ]
.br
.BR "ebtables " [ -t " table ] " -N " chain [" "-P ACCEPT " | " DROP " | " RETURN" ]
.br
.BR "ebtables " [ -t " table ] " -X " [chain]"
.br
.BR "ebtables " [ -t " table ] " -E " old-chain-name new-chain-name"
.br
.BR "ebtables " [ -t " table ] " --init-table
.br
.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-commit
.br
.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-init
.br
.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save
.br
.SH DESCRIPTION
.B ebtables
is an application program used to set up and maintain the
tables of rules (inside the Linux kernel) that inspect
Ethernet frames.
It is analogous to the
.B iptables
application, but less complicated, due to the fact that the Ethernet protocol
is much simpler than the IP protocol.
.SS CHAINS
There are two ebtables tables with built-in chains in the
Linux kernel. These tables are used to divide functionality into
different sets of rules. Each set of rules is called a chain.
Each chain is an ordered list of rules that can match Ethernet frames. If a
rule matches an Ethernet frame, then a processing specification tells
what to do with that matching frame. The processing specification is
called a 'target'. However, if the frame does not match the current
rule in the chain, then the next rule in the chain is examined and so forth.
The user can create new (user-defined) chains that can be used as the 'target'
of a rule. User-defined chains are very useful to get better performance
over the linear traversal of the rules and are also essential for structuring
the filtering rules into well-organized and maintainable sets of rules.
.SS TARGETS
A firewall rule specifies criteria for an Ethernet frame and a frame
processing specification called a target. When a frame matches a rule,
then the next action performed by the kernel is specified by the target.
The target can be one of these values:
.BR ACCEPT ,
.BR DROP ,
.BR CONTINUE ,
.BR RETURN ,
an 'extension' (see below) or a jump to a user-defined chain.
.PP
.B ACCEPT
means to let the frame through.
.B DROP
means the frame has to be dropped.
.B CONTINUE
means the next rule has to be checked. This can be handy, f.e., to know how many
frames pass a certain point in the chain, to log those frames or to apply multiple
targets on a frame.
.B RETURN
means stop traversing this chain and resume at the next rule in the
previous (calling) chain.
For the extension targets please refer to the
.B "TARGET EXTENSIONS"
section of this man page.
.SS TABLES
As stated earlier, there are two ebtables tables in the Linux
kernel. The table names are
.BR filter " and " nat .
Of these two tables,
the filter table is the default table that the command operates on.
If you are working with the filter table, then you can drop the '-t filter'
argument to the ebtables command. However, you will need to provide
the -t argument for
.B nat
table. Moreover, the -t argument must be the
first argument on the ebtables command line, if used.
.TP
.B "-t, --table"
.br
.B filter
is the default table and contains three built-in chains:
.B INPUT
(for frames destined for the bridge itself, on the level of the MAC destination address),
.B OUTPUT
(for locally-generated or (b)routed frames) and
.B FORWARD
(for frames being forwarded by the bridge).
.br
.br
.B nat
is mostly used to change the mac addresses and contains three built-in chains:
.B PREROUTING
(for altering frames as soon as they come in),
.B OUTPUT
(for altering locally generated or (b)routed frames before they are bridged) and
.B POSTROUTING
(for altering frames as they are about to go out). A small note on the naming
of chains PREROUTING and POSTROUTING: it would be more accurate to call them
PREFORWARDING and POSTFORWARDING, but for all those who come from the
iptables world to ebtables it is easier to have the same names. Note that you
can change the name
.BR "" ( -E )
if you don't like the default.
.SH EBTABLES COMMAND LINE ARGUMENTS
After the initial ebtables '-t table' command line argument, the remaining
arguments can be divided into several groups. These groups
are commands, miscellaneous commands, rule specifications, match extensions,
watcher extensions and target extensions.
.SS COMMANDS
The ebtables command arguments specify the actions to perform on the table
defined with the -t argument. If you do not use the -t argument to name
a table, the commands apply to the default filter table.
Only one command may be used on the command line at a time, except when
the commands
.BR -L " and " -Z
are combined, the commands
.BR -N " and " -P
are combined, or when
.B --atomic-file
is used.
.TP
.B "-A, --append"
Append a rule to the end of the selected chain.
.TP
.B "-D, --delete"
Delete the specified rule or rules from the selected chain. There are two ways to
use this command. The first is by specifying an interval of rule numbers
to delete (directly after
.BR -D ).
Syntax: \fIstart_nr\fP[\fI:end_nr\fP] (use
.B -L --Ln
to list the rules with their rule number). When \fIend_nr\fP is omitted, all rules starting
from \fIstart_nr\fP are deleted. Using negative numbers is allowed, for more
details about using negative numbers, see the
.B -I
command. The second usage is by
specifying the complete rule as it would have been specified when it was added. Only
the first encountered rule that is the same as this specified rule, in other
words the matching rule with the lowest (positive) rule number, is deleted.
.TP
.B "-C, --change-counters"
Change the counters of the specified rule or rules from the selected chain. There are two ways to
use this command. The first is by specifying an interval of rule numbers
to do the changes on (directly after
.BR -C ).
Syntax: \fIstart_nr\fP[\fI:end_nr\fP] (use
.B -L --Ln
to list the rules with their rule number). The details are the same as for the
.BR -D " command. The second usage is by"
specifying the complete rule as it would have been specified when it was added. Only
the counters of the first encountered rule that is the same as this specified rule, in other
words the matching rule with the lowest (positive) rule number, are changed.
In the first usage, the counters are specified directly after the interval specification,
in the second usage directly after
.BR -C .
First the packet counter is specified, then the byte counter. If the specified counters start
with a '+', the counter values are added to the respective current counter values.
If the specified counters start with a '-', the counter values are decreased from the respective
current counter values. No bounds checking is done. If the counters don't start with '+' or '-',
the current counters are changed to the specified counters.
.TP
.B "-I, --insert"
Insert the specified rule into the selected chain at the specified rule number. If the
rule number is not specified, the rule is added at the head of the chain.
If the current number of rules equals
.IR N ,
then the specified number can be
between
.IR -N " and " N+1 .
For a positive number
.IR i ,
it holds that
.IR i " and " i-N-1
specify the same place in the chain where the rule should be inserted. The rule number
0 specifies the place past the last rule in the chain and using this number is therefore
equivalent to using the
.BR -A " command."
Rule numbers structly smaller than 0 can be useful when more than one rule needs to be inserted
in a chain.
.TP
.B "-P, --policy"
Set the policy for the chain to the given target. The policy can be
.BR ACCEPT ", " DROP " or " RETURN .
.TP
.B "-F, --flush"
Flush the selected chain. If no chain is selected, then every chain will be
flushed. Flushing a chain does not change the policy of the
chain, however.
.TP
.B "-Z, --zero"
Set the counters of the selected chain to zero. If no chain is selected, all the counters
are set to zero. The
.B "-Z"
command can be used in conjunction with the
.B "-L"
command.
When both the
.B "-Z"
and
.B "-L"
commands are used together in this way, the rule counters are printed on the screen
before they are set to zero.
.TP
.B "-L, --list"
List all rules in the selected chain. If no chain is selected, all chains
are listed.
.br
The following options change the output of the
.B "-L"
command.
.br
.B "--Ln"
.br
Places the rule number in front of every rule. This option is incompatible with the
.BR --Lx " option."
.br
.B "--Lc"
.br
Shows the counters at the end of each rule displayed by the
.B "-L"
command. Both a frame counter (pcnt) and a byte counter (bcnt) are displayed.
The frame counter shows how many frames have matched the specific rule, the byte
counter shows the sum of the frame sizes of these matching frames. Using this option
.BR "" "in combination with the " --Lx " option causes the counters to be written out"
.BR "" "in the '" -c " <pcnt> <bcnt>' option format."
.br
.B "--Lx"
.br
Changes the output so that it produces a set of ebtables commands that construct
the contents of the chain, when specified.
If no chain is specified, ebtables commands to construct the contents of the
table are given, including commands for creating the user-defined chains (if any).
You can use this set of commands in an ebtables boot or reload
script. For example the output could be used at system startup.
The
.B "--Lx"
option is incompatible with the
.B "--Ln"
listing option. Using the
.BR --Lx " option together with the " --Lc " option will cause the counters to be written out"
.BR "" "in the '" -c " <pcnt> <bcnt>' option format."
.br
.B "--Lmac2"
.br
Shows all MAC addresses with the same length, adding leading zeroes
if necessary. The default representation omits leading zeroes in the addresses.
.TP
.B "-N, --new-chain"
Create a new user-defined chain with the given name. The number of
user-defined chains is limited only by the number of possible chain names.
A user-defined chain name has a maximum
length of 31 characters. The standard policy of the user-defined chain is
ACCEPT. The policy of the new chain can be initialized to a different standard
target by using the
.B -P
command together with the
.B -N
command. In this case, the chain name does not have to be specified for the
.B -P
command.
.TP
.B "-X, --delete-chain"
Delete the specified user-defined chain. There must be no remaining references (jumps)
to the specified chain, otherwise ebtables will refuse to delete it. If no chain is
specified, all user-defined chains that aren't referenced will be removed.
.TP
.B "-E, --rename-chain"
Rename the specified chain to a new name. Besides renaming a user-defined
chain, you can rename a standard chain to a name that suits your
taste. For example, if you like PREFORWARDING more than PREROUTING,
then you can use the -E command to rename the PREROUTING chain. If you do
rename one of the standard ebtables chain names, please be sure to mention
this fact should you post a question on the ebtables mailing lists.
It would be wise to use the standard name in your post. Renaming a standard
ebtables chain in this fashion has no effect on the structure or functioning
of the ebtables kernel table.
.TP
.B "--init-table"
Replace the current table data by the initial table data.
.TP
.B "--atomic-init"
Copy the kernel's initial data of the table to the specified
file. This can be used as the first action, after which rules are added
to the file. The file can be specified using the
.B --atomic-file
command or through the
.IR EBTABLES_ATOMIC_FILE " environment variable."
.TP
.B "--atomic-save"
Copy the kernel's current data of the table to the specified
file. This can be used as the first action, after which rules are added
to the file. The file can be specified using the
.B --atomic-file
command or through the
.IR EBTABLES_ATOMIC_FILE " environment variable."
.TP
.B "--atomic-commit"
Replace the kernel table data with the data contained in the specified
file. This is a useful command that allows you to load all your rules of a
certain table into the kernel at once, saving the kernel a lot of precious
time and allowing atomic updates of the tables. The file which contains
the table data is constructed by using either the
.B "--atomic-init"
or the
.B "--atomic-save"
command to generate a starting file. After that, using the
.B "--atomic-file"
command when constructing rules or setting the
.IR EBTABLES_ATOMIC_FILE " environment variable"
allows you to extend the file and build the complete table before
committing it to the kernel. This command can be very useful in boot scripts
to populate the ebtables tables in a fast way.
.SS MISCELLANOUS COMMANDS
.TP
.B "-V, --version"
Show the version of the ebtables userspace program.
.TP
.BR "-h, --help " "[\fIlist of module names\fP]"
Give a brief description of the command syntax. Here you can also specify
names of extensions and ebtables will try to write help about those
extensions. E.g.
.IR "ebtables -h snat log ip arp" .
Specify
.I list_extensions
to list all extensions supported by the userspace
utility.
.TP
.BR "-j, --jump " "\fItarget\fP"
The target of the rule. This is one of the following values:
.BR ACCEPT ,
.BR DROP ,
.BR CONTINUE ,
.BR RETURN ,
a target extension (see
.BR "TARGET EXTENSIONS" ")"
or a user-defined chain name.
.TP
.B --atomic-file "\fIfile\fP"
Let the command operate on the specified
.IR file .
The data of the table to
operate on will be extracted from the file and the result of the operation
will be saved back into the file. If specified, this option should come
before the command specification. An alternative that should be preferred,
is setting the
.IR EBTABLES_ATOMIC_FILE " environment variable."
.TP
.B -M, --modprobe "\fIprogram\fP"
When talking to the kernel, use this
.I program
to try to automatically load missing kernel modules.
.TP
.B --concurrent
Use a file lock to support concurrent scripts updating the ebtables kernel tables.
.SS
RULE SPECIFICATIONS
The following command line arguments make up a rule specification (as used
in the add and delete commands). A "!" option before the specification
inverts the test for that specification. Apart from these standard rule
specifications there are some other command line arguments of interest.
See both the
.BR "MATCH EXTENSIONS"
and the
.BR "WATCHER EXTENSIONS"
below.
.TP
.BR "-p, --protocol " "[!] \fIprotocol\fP"
The protocol that was responsible for creating the frame. This can be a
hexadecimal number, above
.IR 0x0600 ,
a name (e.g.
.I ARP
) or
.BR LENGTH .
The protocol field of the Ethernet frame can be used to denote the
length of the header (802.2/802.3 networks). When the value of that field is
below or equals
.IR 0x0600 ,
the value equals the size of the header and shouldn't be used as a
protocol number. Instead, all frames where the protocol field is used as
the length field are assumed to be of the same 'protocol'. The protocol
name used in ebtables for these frames is
.BR LENGTH .
.br
The file
.B /etc/ethertypes
can be used to show readable
characters instead of hexadecimal numbers for the protocols. For example,
.I 0x0800
will be represented by
.IR IPV4 .
The use of this file is not case sensitive.
See that file for more information. The flag
.B --proto
is an alias for this option.
.TP
.BR "-i, --in-interface " "[!] \fIname\fP"
The interface (bridge port) via which a frame is received (this option is useful in the
.BR INPUT ,
.BR FORWARD ,
.BR PREROUTING " and " BROUTING
chains). If the interface name ends with '+', then
any interface name that begins with this name (disregarding '+') will match.
The flag
.B --in-if
is an alias for this option.
.TP
.BR "--logical-in " "[!] \fIname\fP"
The (logical) bridge interface via which a frame is received (this option is useful in the
.BR INPUT ,
.BR FORWARD ,
.BR PREROUTING " and " BROUTING
chains).
If the interface name ends with '+', then
any interface name that begins with this name (disregarding '+') will match.
.TP
.BR "-o, --out-interface " "[!] \fIname\fP"
The interface (bridge port) via which a frame is going to be sent (this option is useful in the
.BR OUTPUT ,
.B FORWARD
and
.B POSTROUTING
chains). If the interface name ends with '+', then
any interface name that begins with this name (disregarding '+') will match.
The flag
.B --out-if
is an alias for this option.
.TP
.BR "--logical-out " "[!] \fIname\fP"
The (logical) bridge interface via which a frame is going to be sent (this option
is useful in the
.BR OUTPUT ,
.B FORWARD
and
.B POSTROUTING
chains).
If the interface name ends with '+', then
any interface name that begins with this name (disregarding '+') will match.
.TP
.BR "-s, --source " "[!] \fIaddress\fP[/\fImask\fP]"
The source MAC address. Both mask and address are written as 6 hexadecimal
numbers separated by colons. Alternatively one can specify Unicast,
Multicast, Broadcast or BGA (Bridge Group Address):
.br
.IR "Unicast" "=00:00:00:00:00:00/01:00:00:00:00:00,"
.IR "Multicast" "=01:00:00:00:00:00/01:00:00:00:00:00,"
.IR "Broadcast" "=ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff or"
.IR "BGA" "=01:80:c2:00:00:00/ff:ff:ff:ff:ff:ff."
Note that a broadcast
address will also match the multicast specification. The flag
.B --src
is an alias for this option.
.TP
.BR "-d, --destination " "[!] \fIaddress\fP[/\fImask\fP]"
The destination MAC address. See
.B -s
(above) for more details on MAC addresses. The flag
.B --dst
is an alias for this option.
.TP
.BR "-c, --set-counter " "\fIpcnt bcnt\fP"
If used with
.BR -A " or " -I ", then the packet and byte counters of the new rule will be set to
.IR pcnt ", resp. " bcnt ".
If used with the
.BR -C " or " -D " commands, only rules with a packet and byte count equal to"
.IR pcnt ", resp. " bcnt " will match."
.SS MATCH EXTENSIONS
Ebtables extensions are dynamically loaded into the userspace tool,
there is therefore no need to explicitly load them with a
-m option like is done in iptables.
These extensions deal with functionality supported by kernel modules supplemental to
the core ebtables code.
.SS 802_3
Specify 802.3 DSAP/SSAP fields or SNAP type. The protocol must be specified as
.IR "LENGTH " "(see the option " " -p " above).
.TP
.BR "--802_3-sap " "[!] \fIsap\fP"
DSAP and SSAP are two one byte 802.3 fields. The bytes are always
equal, so only one byte (hexadecimal) is needed as an argument.
.TP
.BR "--802_3-type " "[!] \fItype\fP"
If the 802.3 DSAP and SSAP values are 0xaa then the SNAP type field must
be consulted to determine the payload protocol. This is a two byte
(hexadecimal) argument. Only 802.3 frames with DSAP/SSAP 0xaa are
checked for type.
.\" .SS among
.\" Match a MAC address or MAC/IP address pair versus a list of MAC addresses
.\" and MAC/IP address pairs.
.\" A list entry has the following format:
.\" .IR xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,] ". Multiple"
.\" list entries are separated by a comma, specifying an IP address corresponding to
.\" the MAC address is optional. Multiple MAC/IP address pairs with the same MAC address
.\" but different IP address (and vice versa) can be specified. If the MAC address doesn't
.\" match any entry from the list, the frame doesn't match the rule (unless "!" was used).
.\" .TP
.\" .BR "--among-dst " "[!] \fIlist\fP"
.\" Compare the MAC destination to the given list. If the Ethernet frame has type
.\" .IR IPv4 " or " ARP ,
.\" then comparison with MAC/IP destination address pairs from the
.\" list is possible.
.\" .TP
.\" .BR "--among-src " "[!] \fIlist\fP"
.\" Compare the MAC source to the given list. If the Ethernet frame has type
.\" .IR IPv4 " or " ARP ,
.\" then comparison with MAC/IP source address pairs from the list
.\" is possible.
.\" .TP
.\" .BR "--among-dst-file " "[!] \fIfile\fP"
.\" Same as
.\" .BR --among-dst " but the list is read in from the specified file."
.\" .TP
.\" .BR "--among-src-file " "[!] \fIfile\fP"
.\" Same as
.\" .BR --among-src " but the list is read in from the specified file."
.SS arp
Specify (R)ARP fields. The protocol must be specified as
.IR ARP " or " RARP .
.TP
.BR "--arp-opcode " "[!] \fIopcode\fP"
The (R)ARP opcode (decimal or a string, for more details see
.BR "ebtables -h arp" ).
.TP
.BR "--arp-htype " "[!] \fIhardware type\fP"
The hardware type, this can be a decimal or the string
.I Ethernet
(which sets
.I type
to 1). Most (R)ARP packets have Eternet as hardware type.
.TP
.BR "--arp-ptype " "[!] \fIprotocol type\fP"
The protocol type for which the (r)arp is used (hexadecimal or the string
.IR IPv4 ,
denoting 0x0800).
Most (R)ARP packets have protocol type IPv4.
.TP
.BR "--arp-ip-src " "[!] \fIaddress\fP[/\fImask\fP]"
The (R)ARP IP source address specification.
.TP
.BR "--arp-ip-dst " "[!] \fIaddress\fP[/\fImask\fP]"
The (R)ARP IP destination address specification.
.TP
.BR "--arp-mac-src " "[!] \fIaddress\fP[/\fImask\fP]"
The (R)ARP MAC source address specification.
.TP
.BR "--arp-mac-dst " "[!] \fIaddress\fP[/\fImask\fP]"
The (R)ARP MAC destination address specification.
.TP
.BR "" "[!]" " --arp-gratuitous"
Checks for ARP gratuitous packets: checks equality of IPv4 source
address and IPv4 destination address inside the ARP header.
.SS ip
Specify IPv4 fields. The protocol must be specified as
.IR IPv4 .
.TP
.BR "--ip-source " "[!] \fIaddress\fP[/\fImask\fP]"
The source IP address.
The flag
.B --ip-src
is an alias for this option.
.TP
.BR "--ip-destination " "[!] \fIaddress\fP[/\fImask\fP]"
The destination IP address.
The flag
.B --ip-dst
is an alias for this option.
.TP
.BR "--ip-tos " "[!] \fItos\fP"
The IP type of service, in hexadecimal numbers.
.BR IPv4 .
.TP
.BR "--ip-protocol " "[!] \fIprotocol\fP"
The IP protocol.
The flag
.B --ip-proto
is an alias for this option.
.TP
.BR "--ip-source-port " "[!] \fIport1\fP[:\fIport2\fP]"
The source port or port range for the IP protocols 6 (TCP), 17
(UDP), 33 (DCCP) or 132 (SCTP). The
.B --ip-protocol
option must be specified as
.IR TCP ", " UDP ", " DCCP " or " SCTP .
If
.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used."
The flag
.B --ip-sport
is an alias for this option.
.TP
.BR "--ip-destination-port " "[!] \fIport1\fP[:\fIport2\fP]"
The destination port or port range for ip protocols 6 (TCP), 17
(UDP), 33 (DCCP) or 132 (SCTP). The
.B --ip-protocol
option must be specified as
.IR TCP ", " UDP ", " DCCP " or " SCTP .
If
.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used."
The flag
.B --ip-dport
is an alias for this option.
.SS ip6
Specify IPv6 fields. The protocol must be specified as
.IR IPv6 .
.TP
.BR "--ip6-source " "[!] \fIaddress\fP[/\fImask\fP]"
The source IPv6 address.
The flag
.B --ip6-src
is an alias for this option.
.TP
.BR "--ip6-destination " "[!] \fIaddress\fP[/\fImask\fP]"
The destination IPv6 address.
The flag
.B --ip6-dst
is an alias for this option.
.TP
.BR "--ip6-tclass " "[!] \fItclass\fP"
The IPv6 traffic class, in hexadecimal numbers.
.TP
.BR "--ip6-protocol " "[!] \fIprotocol\fP"
The IP protocol.
The flag
.B --ip6-proto
is an alias for this option.
.TP
.BR "--ip6-source-port " "[!] \fIport1\fP[:\fIport2\fP]"
The source port or port range for the IPv6 protocols 6 (TCP), 17
(UDP), 33 (DCCP) or 132 (SCTP). The
.B --ip6-protocol
option must be specified as
.IR TCP ", " UDP ", " DCCP " or " SCTP .
If
.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used."
The flag
.B --ip6-sport
is an alias for this option.
.TP
.BR "--ip6-destination-port " "[!] \fIport1\fP[:\fIport2\fP]"
The destination port or port range for IPv6 protocols 6 (TCP), 17
(UDP), 33 (DCCP) or 132 (SCTP). The
.B --ip6-protocol
option must be specified as
.IR TCP ", " UDP ", " DCCP " or " SCTP .
If
.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used."
The flag
.B --ip6-dport
is an alias for this option.
.TP
.BR "--ip6-icmp-type " "[!] {\fItype\fP[:\fItype\fP]/\fIcode\fP[:\fIcode\fP]|\fItypename\fP}"
Specify ipv6\-icmp type and code to match.
Ranges for both type and code are supported. Type and code are
separated by a slash. Valid numbers for type and range are 0 to 255.
To match a single type including all valid codes, symbolic names can
be used instead of numbers. The list of known type names is shown by the command
.nf
ebtables \-\-help ip6
.fi
This option is only valid for \-\-ip6-prococol ipv6-icmp.
.SS limit
This module matches at a limited rate using a token bucket filter.
A rule using this extension will match until this limit is reached.
It can be used with the
.B --log
watcher to give limited logging, for example. Its use is the same
as the limit match of iptables.
.TP
.BR "--limit " "[\fIvalue\fP]"
Maximum average matching rate: specified as a number, with an optional
.IR /second ", " /minute ", " /hour ", or " /day " suffix; the default is " 3/hour .
.TP
.BR "--limit-burst " "[\fInumber\fP]"
Maximum initial number of packets to match: this number gets recharged by
one every time the limit specified above is not reached, up to this
number; the default is
.IR 5 .
.SS mark_m
.TP
.BR "--mark " "[!] [\fIvalue\fP][/\fImask\fP]"
Matches frames with the given unsigned mark value. If a
.IR value " and " mask " are specified, the logical AND of the mark value of the frame and"
the user-specified
.IR mask " is taken before comparing it with the"
user-specified mark
.IR value ". When only a mark "
.IR value " is specified, the packet"
only matches when the mark value of the frame equals the user-specified
mark
.IR value .
If only a
.IR mask " is specified, the logical"
AND of the mark value of the frame and the user-specified
.IR mask " is taken and the frame matches when the result of this logical AND is"
non-zero. Only specifying a
.IR mask " is useful to match multiple mark values."
.SS pkttype
.TP
.BR "--pkttype-type " "[!] \fItype\fP"
Matches on the Ethernet "class" of the frame, which is determined by the
generic networking code. Possible values:
.IR broadcast " (MAC destination is the broadcast address),"
.IR multicast " (MAC destination is a multicast address),"
.IR host " (MAC destination is the receiving network device), or "
.IR otherhost " (none of the above)."
.SS stp
Specify stp BPDU (bridge protocol data unit) fields. The destination
address
.BR "" ( -d ") must be specified as the bridge group address"
.IR "" ( BGA ).
For all options for which a range of values can be specified, it holds that
if the lower bound is omitted (but the colon is not), then the lowest possible lower bound
for that option is used, while if the upper bound is omitted (but the colon again is not), the
highest possible upper bound for that option is used.
.TP
.BR "--stp-type " "[!] \fItype\fP"
The BPDU type (0-255), recognized non-numerical types are
.IR config ", denoting a configuration BPDU (=0), and"
.IR tcn ", denothing a topology change notification BPDU (=128)."
.TP
.BR "--stp-flags " "[!] \fIflag\fP"
The BPDU flag (0-255), recognized non-numerical flags are
.IR topology-change ", denoting the topology change flag (=1), and"
.IR topology-change-ack ", denoting the topology change acknowledgement flag (=128)."
.TP
.BR "--stp-root-prio " "[!] [\fIprio\fP][:\fIprio\fP]"
The root priority (0-65535) range.
.TP
.BR "--stp-root-addr " "[!] [\fIaddress\fP][/\fImask\fP]"
The root mac address, see the option
.BR -s " for more details."
.TP
.BR "--stp-root-cost " "[!] [\fIcost\fP][:\fIcost\fP]"
The root path cost (0-4294967295) range.
.TP
.BR "--stp-sender-prio " "[!] [\fIprio\fP][:\fIprio\fP]"
The BPDU's sender priority (0-65535) range.
.TP
.BR "--stp-sender-addr " "[!] [\fIaddress\fP][/\fImask\fP]"
The BPDU's sender mac address, see the option
.BR -s " for more details."
.TP
.BR "--stp-port " "[!] [\fIport\fP][:\fIport\fP]"
The port identifier (0-65535) range.
.TP
.BR "--stp-msg-age " "[!] [\fIage\fP][:\fIage\fP]"
The message age timer (0-65535) range.
.TP
.BR "--stp-max-age " "[!] [\fIage\fP][:\fIage\fP]"
The max age timer (0-65535) range.
.TP
.BR "--stp-hello-time " "[!] [\fItime\fP][:\fItime\fP]"
The hello time timer (0-65535) range.
.TP
.BR "--stp-forward-delay " "[!] [\fIdelay\fP][:\fIdelay\fP]"
The forward delay timer (0-65535) range.
.\" .SS string
.\" This module matches on a given string using some pattern matching strategy.
.\" .TP
.\" .BR "--string-algo " "\fIalgorithm\fP"
.\" The pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris)
.\" .TP
.\" .BR "--string-from " "\fIoffset\fP"
.\" The lowest offset from which a match can start. (default: 0)
.\" .TP
.\" .BR "--string-to " "\fIoffset\fP"
.\" The highest offset from which a match can start. (default: size of frame)
.\" .TP
.\" .BR "--string " "[!] \fIpattern\fP"
.\" Matches the given pattern.
.\" .TP
.\" .BR "--string-hex " "[!] \fIpattern\fP"
.\" Matches the given pattern in hex notation, e.g. '|0D 0A|', '|0D0A|', 'www|09|netfilter|03|org|00|'
.\" .TP
.\" .BR "--string-icase"
.\" Ignore case when searching.
.SS vlan
Specify 802.1Q Tag Control Information fields.
The protocol must be specified as
.IR 802_1Q " (0x8100)."
.TP
.BR "--vlan-id " "[!] \fIid\fP"
The VLAN identifier field (VID). Decimal number from 0 to 4095.
.TP
.BR "--vlan-prio " "[!] \fIprio\fP"
The user priority field, a decimal number from 0 to 7.
The VID should be set to 0 ("null VID") or unspecified
(in the latter case the VID is deliberately set to 0).
.TP
.BR "--vlan-encap " "[!] \fItype\fP"
The encapsulated Ethernet frame type/length.
Specified as a hexadecimal
number from 0x0000 to 0xFFFF or as a symbolic name
from
.BR /etc/ethertypes .
.SS WATCHER EXTENSIONS
Watchers only look at frames passing by, they don't modify them nor decide
to accept the frames or not. These watchers only
see the frame if the frame matches the rule, and they see it before the
target is executed.
.SS log
The log watcher writes descriptive data about a frame to the syslog.
.TP
.B "--log"
.br
Log with the default loggin options: log-level=
.IR info ,
log-prefix="", no ip logging, no arp logging.
.TP
.B --log-level "\fIlevel\fP"
.br
Defines the logging level. For the possible values, see
.BR "ebtables -h log" .
The default level is
.IR info .
.TP
.BR --log-prefix " \fItext\fP"
.br
Defines the prefix
.I text
to be printed at the beginning of the line with the logging information.
.TP
.B --log-ip
.br
Will log the ip information when a frame made by the ip protocol matches
the rule. The default is no ip information logging.
.TP
.B --log-ip6
.br
Will log the ipv6 information when a frame made by the ipv6 protocol matches
the rule. The default is no ipv6 information logging.
.TP
.B --log-arp
.br
Will log the (r)arp information when a frame made by the (r)arp protocols
matches the rule. The default is no (r)arp information logging.
.SS nflog
The nflog watcher passes the packet to the loaded logging backend
in order to log the packet. This is usually used in combination with
nfnetlink_log as logging backend, which will multicast the packet
through a
.IR netlink
socket to the specified multicast group. One or more userspace processes
may subscribe to the group to receive the packets.
.TP
.B "--nflog"
.br
Log with the default logging options
.TP
.B --nflog-group "\fInlgroup\fP"
.br
The netlink group (1 - 2^32-1) to which packets are (only applicable for
nfnetlink_log). The default value is 1.
.TP
.B --nflog-prefix "\fIprefix\fP"
.br
A prefix string to include in the log message, up to 30 characters
long, useful for distinguishing messages in the logs.
.TP
.B --nflog-range "\fIsize\fP"
.br
The number of bytes to be copied to userspace (only applicable for
nfnetlink_log). nfnetlink_log instances may specify their own
range, this option overrides it.
.TP
.B --nflog-threshold "\fIsize\fP"
.br
Number of packets to queue inside the kernel before sending them
to userspace (only applicable for nfnetlink_log). Higher values
result in less overhead per packet, but increase delay until the
packets reach userspace. The default value is 1.
.SS ulog
The ulog watcher passes the packet to a userspace
logging daemon using netlink multicast sockets. This differs
from the log watcher in the sense that the complete packet is
sent to userspace instead of a descriptive text and that
netlink multicast sockets are used instead of the syslog.
This watcher enables parsing of packets with userspace programs, the
physical bridge in and out ports are also included in the netlink messages.
The ulog watcher module accepts 2 parameters when the module is loaded
into the kernel (e.g. with modprobe):
.B nlbufsiz
specifies how big the buffer for each netlink multicast
group is. If you say
.IR nlbufsiz=8192 ,
for example, up to eight kB of packets will
get accumulated in the kernel until they are sent to userspace. It is
not possible to allocate more than 128kB. Please also keep in mind that
this buffer size is allocated for each nlgroup you are using, so the
total kernel memory usage increases by that factor. The default is 4096.
.B flushtimeout
specifies after how many hundredths of a second the queue should be
flushed, even if it is not full yet. The default is 10 (one tenth of
a second).
.TP
.B "--ulog"
.br
Use the default settings: ulog-prefix="", ulog-nlgroup=1,
ulog-cprange=4096, ulog-qthreshold=1.
.TP
.B --ulog-prefix "\fItext\fP"
.br
Defines the prefix included with the packets sent to userspace.
.TP
.BR --ulog-nlgroup " \fIgroup\fP"
.br
Defines which netlink group number to use (a number from 1 to 32).
Make sure the netlink group numbers used for the iptables ULOG
target differ from those used for the ebtables ulog watcher.
The default group number is 1.
.TP
.BR --ulog-cprange " \fIrange\fP"
.br
Defines the maximum copy range to userspace, for packets matching the
rule. The default range is 0, which means the maximum copy range is
given by
.BR nlbufsiz .
A maximum copy range larger than
128*1024 is meaningless as the packets sent to userspace have an upper
size limit of 128*1024.
.TP
.BR --ulog-qthreshold " \fIthreshold\fP"
.br
Queue at most
.I threshold
number of packets before sending them to
userspace with a netlink socket. Note that packets can be sent to
userspace before the queue is full, this happens when the ulog
kernel timer goes off (the frequency of this timer depends on
.BR flushtimeout ).
.SS TARGET EXTENSIONS
.SS arpreply
The
.B arpreply
target can be used in the
.BR PREROUTING " chain of the " nat " table."
If this target sees an ARP request it will automatically reply
with an ARP reply. The used MAC address for the reply can be specified.
The protocol must be specified as
.IR ARP .
When the ARP message is not an ARP request or when the ARP request isn't
for an IP address on an Ethernet network, it is ignored by this target
.BR "" ( CONTINUE ).
When the ARP request is malformed, it is dropped
.BR "" ( DROP ).
.TP
.BR "--arpreply-mac " "\fIaddress\fP"
Specifies the MAC address to reply with: the Ethernet source MAC and the
ARP payload source MAC will be filled in with this address.
.TP
.BR "--arpreply-target " "\fItarget\fP"
Specifies the standard target. After sending the ARP reply, the rule still
has to give a standard target so ebtables knows what to do with the ARP request.
The default target
.BR "" "is " DROP .
.SS dnat
The
.B dnat
target can only be used in the
.BR PREROUTING " and " OUTPUT " chains of the " nat " table."
It specifies that the destination MAC address has to be changed.
.TP
.BR "--to-destination " "\fIaddress\fP"
.br
Change the destination MAC address to the specified
.IR address .
The flag
.B --to-dst
is an alias for this option.
.TP
.BR "--dnat-target " "\fItarget\fP"
.br
Specifies the standard target. After doing the dnat, the rule still has to
give a standard target so ebtables knows what to do with the dnated frame.
The default target is
.BR ACCEPT .
Making it
.BR CONTINUE " could let you use"
multiple target extensions on the same frame. Making it
.BR DROP " only makes"
sense in the
.BR BROUTING " chain but using the " redirect " target is more logical there. " RETURN " is also allowed. Note that using " RETURN
in a base chain is not allowed (for obvious reasons).
.SS mark
.BR "" "The " mark " target can be used in every chain of every table. It is possible"
to use the marking of a frame/packet in both ebtables and iptables,
if the bridge-nf code is compiled into the kernel. Both put the marking at the
same place. This allows for a form of communication between ebtables and iptables.
.TP
.BR "--mark-set " "\fIvalue\fP"
.br
Mark the frame with the specified non-negative
.IR value .
.TP
.BR "--mark-or " "\fIvalue\fP"
.br
Or the frame with the specified non-negative
.IR value .
.TP
.BR "--mark-and " "\fIvalue\fP"
.br
And the frame with the specified non-negative
.IR value .
.TP
.BR "--mark-xor " "\fIvalue\fP"
.br
Xor the frame with the specified non-negative
.IR value .
.TP
.BR "--mark-target " "\fItarget\fP"
.br
Specifies the standard target. After marking the frame, the rule
still has to give a standard target so ebtables knows what to do.
The default target is
.BR ACCEPT ". Making it " CONTINUE " can let you do other"
things with the frame in subsequent rules of the chain.
.SS redirect
The
.B redirect
target will change the MAC target address to that of the bridge device the
frame arrived on. This target can only be used in the
.BR PREROUTING " chain of the " nat " table."
The MAC address of the bridge is used as destination address."
.TP
.BR "--redirect-target " "\fItarget\fP"
.br
Specifies the standard target. After doing the MAC redirect, the rule
still has to give a standard target so ebtables knows what to do.
The default target is
.BR ACCEPT ". Making it " CONTINUE " could let you use"
multiple target extensions on the same frame. Making it
.BR DROP " in the " BROUTING " chain will let the frames be routed. " RETURN " is also allowed. Note"
.BR "" "that using " RETURN " in a base chain is not allowed."
.SS snat
The
.B snat
target can only be used in the
.BR POSTROUTING " chain of the " nat " table."
It specifies that the source MAC address has to be changed.
.TP
.BR "--to-source " "\fIaddress\fP"
.br
Changes the source MAC address to the specified
.IR address ". The flag"
.B --to-src
is an alias for this option.
.TP
.BR "--snat-target " "\fItarget\fP"
.br
Specifies the standard target. After doing the snat, the rule still has
to give a standard target so ebtables knows what to do.
.BR "" "The default target is " ACCEPT ". Making it " CONTINUE " could let you use"
.BR "" "multiple target extensions on the same frame. Making it " DROP " doesn't"
.BR "" "make sense, but you could do that too. " RETURN " is also allowed. Note"
.BR "" "that using " RETURN " in a base chain is not allowed."
.br
.TP
.BR "--snat-arp "
.br
Also change the hardware source address inside the arp header if the packet is an
arp message and the hardware address length in the arp header is 6 bytes.
.br
.SH FILES
.I /etc/ethertypes
.SH ENVIRONMENT VARIABLES
.I EBTABLES_ATOMIC_FILE
.SH MAILINGLISTS
.BR "" "See " http://netfilter.org/mailinglists.html
.SH BUGS
The version of ebtables this man page ships with does not support the
.B broute
table. Also there is no support for
.BR among " and " string
matches. And finally, this list is probably not complete.
.SH SEE ALSO
.BR xtables-nft "(8), " iptables "(8), " ip (8)
.PP
.BR "" "See " https://wiki.nftables.org
iptables/ip6tables-restore.c deleted 100644 → 0
View file @ 0309474b
/* Code to restore the iptables state, from file by ip6tables-save.
* Author: Andras Kis-Szabo <kisza@sch.bme.hu>
*
* based on iptables-restore
* Authors:
* Harald Welte <laforge@gnumonks.org>
* Rusty Russell <rusty@linuxcare.com.au>
* This code is distributed under the terms of GNU GPL v2
*/
#include <getopt.h>
#include <errno.h>
#include <stdbool.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include "ip6tables.h"
#include "xshared.h"
#include "xtables.h"
#include "libiptc/libip6tc.h"
#include "ip6tables-multi.h"
static int counters, verbose, noflush, wait;
static struct timeval wait_interval = {
.tv_sec = 1,
};
/* Keeping track of external matches and targets. */
static const struct option options[] = {
{.name = "counters", .has_arg = 0, .val = 'c'},
{.name = "verbose", .has_arg = 0, .val = 'v'},
{.name = "version", .has_arg = 0, .val = 'V'},
{.name = "test", .has_arg = 0, .val = 't'},
{.name = "help", .has_arg = 0, .val = 'h'},
{.name = "noflush", .has_arg = 0, .val = 'n'},
{.name = "modprobe", .has_arg = 1, .val = 'M'},
{.name = "table", .has_arg = 1, .val = 'T'},
{.name = "wait", .has_arg = 2, .val = 'w'},
{.name = "wait-interval", .has_arg = 2, .val = 'W'},
{NULL},
};
#define prog_name ip6tables_globals.program_name
#define prog_vers ip6tables_globals.program_version
static void print_usage(const char *name, const char *version)
{
fprintf(stderr, "Usage: %s [-c] [-v] [-V] [-t] [-h] [-n] [-w secs] [-W usecs] [-T table] [-M command]\n"
" [ --counters ]\n"
" [ --verbose ]\n"
" [ --version]\n"
" [ --test ]\n"
" [ --help ]\n"
" [ --noflush ]\n"
" [ --wait=<seconds>\n"
" [ --wait-interval=<usecs>\n"
" [ --table=<TABLE> ]\n"
" [ --modprobe=<command> ]\n", name);
}
static struct xtc_handle *create_handle(const char *tablename)
{
struct xtc_handle *handle;
handle = ip6tc_init(tablename);
if (!handle) {
/* try to insmod the module if iptc_init failed */
xtables_load_ko(xtables_modprobe_program, false);
handle = ip6tc_init(tablename);
}
if (!handle) {
xtables_error(PARAMETER_PROBLEM, "%s: unable to initialize "
"table '%s'\n", prog_name, tablename);
exit(1);
}
return handle;
}
int ip6tables_restore_main(int argc, char *argv[])
{
struct xtc_handle *handle = NULL;
char buffer[10240];
int c, lock;
char curtable[XT_TABLE_MAXNAMELEN + 1] = {};
FILE *in;
int in_table = 0, testing = 0;
const char *tablename = NULL;
const struct xtc_ops *ops = &ip6tc_ops;
line = 0;
lock = XT_LOCK_NOT_ACQUIRED;
ip6tables_globals.program_name = "ip6tables-restore";
c = xtables_init_all(&ip6tables_globals, NFPROTO_IPV6);
if (c < 0) {
fprintf(stderr, "%s/%s Failed to initialize xtables\n",
ip6tables_globals.program_name,
ip6tables_globals.program_version);
exit(1);
}
#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
init_extensions();
init_extensions6();
#endif
while ((c = getopt_long(argc, argv, "bcvVthnwWM:T:", options, NULL)) != -1) {
switch (c) {
case 'b':
fprintf(stderr, "-b/--binary option is not implemented\n");
break;
case 'c':
counters = 1;
break;
case 'v':
verbose = 1;
break;
case 'V':
printf("%s v%s (legacy)\n", prog_name, prog_vers);
exit(0);
case 't':
testing = 1;
break;
case 'h':
print_usage("ip6tables-restore",
IPTABLES_VERSION);
exit(0);
case 'n':
noflush = 1;
break;
case 'w':
wait = parse_wait_time(argc, argv);
break;
case 'W':
parse_wait_interval(argc, argv, &wait_interval);
break;
case 'M':
xtables_modprobe_program = optarg;
break;
case 'T':
tablename = optarg;
break;
default:
fprintf(stderr,
"Try `ip6tables-restore -h' for more information.\n");
exit(1);
}
}
if (optind == argc - 1) {
in = fopen(argv[optind], "re");
if (!in) {
fprintf(stderr, "Can't open %s: %s\n", argv[optind],
strerror(errno));
exit(1);
}
}
else if (optind < argc) {
fprintf(stderr, "Unknown arguments found on commandline\n");
exit(1);
}
else in = stdin;
if (!wait_interval.tv_sec && !wait) {
fprintf(stderr, "Option --wait-interval requires option --wait\n");
exit(1);
}
/* Grab standard input. */
while (fgets(buffer, sizeof(buffer), in)) {
int ret = 0;
line++;
if (buffer[0] == '\n')
continue;
else if (buffer[0] == '#') {
if (verbose)
fputs(buffer, stdout);
continue;
} else if ((strcmp(buffer, "COMMIT\n") == 0) && (in_table)) {
if (!testing) {
DEBUGP("Calling commit\n");
ret = ops->commit(handle);
ops->free(handle);
handle = NULL;
} else {
DEBUGP("Not calling commit, testing\n");
ret = 1;
}
/* Done with the current table, release the lock. */
if (lock >= 0) {
xtables_unlock(lock);
lock = XT_LOCK_NOT_ACQUIRED;
}
in_table = 0;
} else if ((buffer[0] == '*') && (!in_table)) {
/* Acquire a lock before we create a new table handle */
lock = xtables_lock_or_exit(wait, &wait_interval);
/* New table */
char *table;
table = strtok(buffer+1, " \t\n");
DEBUGP("line %u, table '%s'\n", line, table);
if (!table) {
xtables_error(PARAMETER_PROBLEM,
"%s: line %u table name invalid\n",
xt_params->program_name, line);
exit(1);
}
strncpy(curtable, table, XT_TABLE_MAXNAMELEN);
curtable[XT_TABLE_MAXNAMELEN] = '\0';
if (tablename != NULL && strcmp(tablename, table) != 0) {
if (lock >= 0) {
xtables_unlock(lock);
lock = XT_LOCK_NOT_ACQUIRED;
}
continue;
}
if (handle)
ops->free(handle);
handle = create_handle(table);
if (noflush == 0) {
DEBUGP("Cleaning all chains of table '%s'\n",
table);
for_each_chain6(flush_entries6, verbose, 1,
handle);
DEBUGP("Deleting all user-defined chains "
"of table '%s'\n", table);
for_each_chain6(delete_chain6, verbose, 0,
handle);
}
ret = 1;
in_table = 1;
} else if ((buffer[0] == ':') && (in_table)) {
/* New chain. */
char *policy, *chain;
chain = strtok(buffer+1, " \t\n");
DEBUGP("line %u, chain '%s'\n", line, chain);
if (!chain) {
xtables_error(PARAMETER_PROBLEM,
"%s: line %u chain name invalid\n",
xt_params->program_name, line);
exit(1);
}
if (strlen(chain) >= XT_EXTENSION_MAXNAMELEN)
xtables_error(PARAMETER_PROBLEM,
"Invalid chain name `%s' "
"(%u chars max)",
chain, XT_EXTENSION_MAXNAMELEN - 1);
if (ops->builtin(chain, handle) <= 0) {
if (noflush && ops->is_chain(chain, handle)) {
DEBUGP("Flushing existing user defined chain '%s'\n", chain);
if (!ops->flush_entries(chain, handle))
xtables_error(PARAMETER_PROBLEM,
"error flushing chain "
"'%s':%s\n", chain,
strerror(errno));
} else {
DEBUGP("Creating new chain '%s'\n", chain);
if (!ops->create_chain(chain, handle))
xtables_error(PARAMETER_PROBLEM,
"error creating chain "
"'%s':%s\n", chain,
strerror(errno));
}
}
policy = strtok(NULL, " \t\n");
DEBUGP("line %u, policy '%s'\n", line, policy);
if (!policy) {
xtables_error(PARAMETER_PROBLEM,
"%s: line %u policy invalid\n",
xt_params->program_name, line);
exit(1);
}
if (strcmp(policy, "-") != 0) {
struct xt_counters count = {};
if (counters) {
char *ctrs;
ctrs = strtok(NULL, " \t\n");
if (!ctrs || !parse_counters(ctrs, &count))
xtables_error(PARAMETER_PROBLEM,
"invalid policy counters "
"for chain '%s'\n", chain);
}
DEBUGP("Setting policy of chain %s to %s\n",
chain, policy);
if (!ops->set_policy(chain, policy, &count,
handle))
xtables_error(OTHER_PROBLEM,
"Can't set policy `%s'"
" on `%s' line %u: %s\n",
policy, chain, line,
ops->strerror(errno));
}
ret = 1;
} else if (in_table) {
int a;
char *pcnt = NULL;
char *bcnt = NULL;
char *parsestart;
if (buffer[0] == '[') {
/* we have counters in our input */
char *ptr = strchr(buffer, ']');
if (!ptr)
xtables_error(PARAMETER_PROBLEM,
"Bad line %u: need ]\n",
line);
pcnt = strtok(buffer+1, ":");
if (!pcnt)
xtables_error(PARAMETER_PROBLEM,
"Bad line %u: need :\n",
line);
bcnt = strtok(NULL, "]");
if (!bcnt)
xtables_error(PARAMETER_PROBLEM,
"Bad line %u: need ]\n",
line);
/* start command parsing after counter */
parsestart = ptr + 1;
} else {
/* start command parsing at start of line */
parsestart = buffer;
}
add_argv(argv[0], 0);
add_argv("-t", 0);
add_argv(curtable, 0);
if (counters && pcnt && bcnt) {
add_argv("--set-counters", 0);
add_argv((char *) pcnt, 0);
add_argv((char *) bcnt, 0);
}
add_param_to_argv(parsestart, line);
DEBUGP("calling do_command6(%u, argv, &%s, handle):\n",
newargc, curtable);
for (a = 0; a < newargc; a++)
DEBUGP("argv[%u]: %s\n", a, newargv[a]);
ret = do_command6(newargc, newargv,
&newargv[2], &handle, true);
free_argv();
fflush(stdout);
}
if (tablename != NULL && strcmp(tablename, curtable) != 0)
continue;
if (!ret) {
fprintf(stderr, "%s: line %u failed\n",
xt_params->program_name, line);
exit(1);
}
}
if (in_table) {
fprintf(stderr, "%s: COMMIT expected at line %u\n",
xt_params->program_name, line + 1);
exit(1);
}
fclose(in);
return 0;
}
iptables/ip6tables-save.c deleted 100644 → 0
View file @ 0309474b
/* Code to save the ip6tables state, in human readable-form. */
/* Author: Andras Kis-Szabo <kisza@sch.bme.hu>
* Original code: iptables-save
* Authors: Paul 'Rusty' Russel <rusty@linuxcare.com.au> and
* Harald Welte <laforge@gnumonks.org>
* This code is distributed under the terms of GNU GPL v2
*/
#include <getopt.h>
#include <errno.h>
#include <stdio.h>
#include <fcntl.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <unistd.h>
#include "libiptc/libip6tc.h"
#include "ip6tables.h"
#include "ip6tables-multi.h"
#define prog_name ip6tables_globals.program_name
#define prog_vers ip6tables_globals.program_version
static int show_counters;
static const struct option options[] = {
{.name = "counters", .has_arg = false, .val = 'c'},
{.name = "dump", .has_arg = false, .val = 'd'},
{.name = "table", .has_arg = true, .val = 't'},
{.name = "modprobe", .has_arg = true, .val = 'M'},
{.name = "file", .has_arg = true, .val = 'f'},
{.name = "version", .has_arg = false, .val = 'V'},
{NULL},
};
/* Debugging prototype. */
static int for_each_table(int (*func)(const char *tablename))
{
int ret = 1;
FILE *procfile = NULL;
char tablename[XT_TABLE_MAXNAMELEN+1];
static const char filename[] = "/proc/net/ip6_tables_names";
procfile = fopen(filename, "re");
if (!procfile) {
if (errno == ENOENT)
return ret;
fprintf(stderr, "Failed to list table names in %s: %s\n",
filename, strerror(errno));
exit(1);
}
while (fgets(tablename, sizeof(tablename), procfile)) {
if (tablename[strlen(tablename) - 1] != '\n')
xtables_error(OTHER_PROBLEM,
"Badly formed tablename `%s'\n",
tablename);
tablename[strlen(tablename) - 1] = '\0';
ret &= func(tablename);
}
fclose(procfile);
return ret;
}
static int do_output(const char *tablename)
{
struct xtc_handle *h;
const char *chain = NULL;
if (!tablename)
return for_each_table(&do_output);
h = ip6tc_init(tablename);
if (h == NULL) {
xtables_load_ko(xtables_modprobe_program, false);
h = ip6tc_init(tablename);
}
if (!h)
xtables_error(OTHER_PROBLEM, "Cannot initialize: %s\n",
ip6tc_strerror(errno));
time_t now = time(NULL);
printf("# Generated by ip6tables-save v%s on %s",
IPTABLES_VERSION, ctime(&now));
printf("*%s\n", tablename);
/* Dump out chain names first,
* thereby preventing dependency conflicts */
for (chain = ip6tc_first_chain(h);
chain;
chain = ip6tc_next_chain(h)) {
printf(":%s ", chain);
if (ip6tc_builtin(chain, h)) {
struct xt_counters count;
printf("%s ",
ip6tc_get_policy(chain, &count, h));
printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
} else {
printf("- [0:0]\n");
}
}
for (chain = ip6tc_first_chain(h);
chain;
chain = ip6tc_next_chain(h)) {
const struct ip6t_entry *e;
/* Dump out rules */
e = ip6tc_first_rule(chain, h);
while(e) {
print_rule6(e, h, chain, show_counters);
e = ip6tc_next_rule(e, h);
}
}
now = time(NULL);
printf("COMMIT\n");
printf("# Completed on %s", ctime(&now));
ip6tc_free(h);
return 1;
}
/* Format:
* :Chain name POLICY packets bytes
* rule
*/
int ip6tables_save_main(int argc, char *argv[])
{
const char *tablename = NULL;
FILE *file = NULL;
int ret, c;
ip6tables_globals.program_name = "ip6tables-save";
c = xtables_init_all(&ip6tables_globals, NFPROTO_IPV6);
if (c < 0) {
fprintf(stderr, "%s/%s Failed to initialize xtables\n",
ip6tables_globals.program_name,
ip6tables_globals.program_version);
exit(1);
}
#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
init_extensions();
init_extensions6();
#endif
while ((c = getopt_long(argc, argv, "bcdt:M:f:V", options, NULL)) != -1) {
switch (c) {
case 'b':
fprintf(stderr, "-b/--binary option is not implemented\n");
break;
case 'c':
show_counters = 1;
break;
case 't':
/* Select specific table. */
tablename = optarg;
break;
case 'M':
xtables_modprobe_program = optarg;
break;
case 'f':
file = fopen(optarg, "w");
if (file == NULL) {
fprintf(stderr, "Failed to open file, error: %s\n",
strerror(errno));
exit(1);
}
ret = dup2(fileno(file), STDOUT_FILENO);
if (ret == -1) {
fprintf(stderr, "Failed to redirect stdout, error: %s\n",
strerror(errno));
exit(1);
}
fclose(file);
break;
case 'd':
do_output(tablename);
exit(0);
case 'V':
printf("%s v%s (legacy)\n", prog_name, prog_vers);
exit(0);
default:
fprintf(stderr,
"Look at manual page `ip6tables-save.8' for more information.\n");
exit(1);
}
}
if (optind < argc) {
fprintf(stderr, "Unknown arguments found on commandline\n");
exit(1);
}
return !do_output(tablename);
}
iptables/ip6tables.c
View file @ 89c92f0c
......@@ -1441,7 +1441,7 @@ int do_command6(int argc, char *argv[], char **table,
case 'j':
set_option(&cs.options, OPT_JUMP, &cs.fw6.ipv6.invflags,
cs.invert);
command_jump(&cs);
command_jump(&cs, optarg);
break;
......
iptables/iptables-restore.c
View file @ 89c92f0c
......@@ -12,10 +12,13 @@
#include <stdio.h>
#include <stdlib.h>
#include "iptables.h"
#include "ip6tables.h"
#include "xshared.h"
#include "xtables.h"
#include "libiptc/libiptc.h"
#include "libiptc/libip6tc.h"
#include "iptables-multi.h"
#include "ip6tables-multi.h"
static int counters, verbose, noflush, wait;
......@@ -38,9 +41,6 @@ static const struct option options[] = {
{NULL},
};
#define prog_name iptables_globals.program_name
#define prog_vers iptables_globals.program_version
static void print_usage(const char *name, const char *version)
{
fprintf(stderr, "Usage: %s [-c] [-v] [-V] [-t] [-h] [-n] [-w secs] [-W usecs] [-T table] [-M command]\n"
......@@ -56,28 +56,42 @@ static void print_usage(const char *name, const char *version)
" [ --modprobe=<command> ]\n", name);
}
static struct xtc_handle *create_handle(const char *tablename)
struct iptables_restore_cb {
const struct xtc_ops *ops;
int (*for_each_chain)(int (*fn)(const xt_chainlabel,
int, struct xtc_handle *),
int verbose, int builtinstoo,
struct xtc_handle *handle);
int (*flush_entries)(const xt_chainlabel, int, struct xtc_handle *);
int (*delete_chain)(const xt_chainlabel, int, struct xtc_handle *);
int (*do_command)(int argc, char *argv[], char **table,
struct xtc_handle **handle, bool restore);
};
static struct xtc_handle *
create_handle(struct iptables_restore_cb *cb, const char *tablename)
{
struct xtc_handle *handle;
handle = iptc_init(tablename);
handle = cb->ops->init(tablename);
if (!handle) {
/* try to insmod the module if iptc_init failed */
xtables_load_ko(xtables_modprobe_program, false);
handle = iptc_init(tablename);
handle = cb->ops->init(tablename);
}
if (!handle) {
xtables_error(PARAMETER_PROBLEM, "%s: unable to initialize "
"table '%s'\n", prog_name, tablename);
"table '%s'\n", xt_params->program_name, tablename);
exit(1);
}
return handle;
}
int
iptables_restore_main(int argc, char *argv[])
static int
ip46tables_restore_main(struct iptables_restore_cb *cb, int argc, char *argv[])
{
struct xtc_handle *handle = NULL;
char buffer[10240];
......@@ -86,24 +100,10 @@ iptables_restore_main(int argc, char *argv[])
FILE *in;
int in_table = 0, testing = 0;
const char *tablename = NULL;
const struct xtc_ops *ops = &iptc_ops;
line = 0;
lock = XT_LOCK_NOT_ACQUIRED;
iptables_globals.program_name = "iptables-restore";
c = xtables_init_all(&iptables_globals, NFPROTO_IPV4);
if (c < 0) {
fprintf(stderr, "%s/%s Failed to initialize xtables\n",
iptables_globals.program_name,
iptables_globals.program_version);
exit(1);
}
#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
init_extensions();
init_extensions4();
#endif
while ((c = getopt_long(argc, argv, "bcvVthnwWM:T:", options, NULL)) != -1) {
switch (c) {
case 'b':
......@@ -116,13 +116,15 @@ iptables_restore_main(int argc, char *argv[])
verbose = 1;
break;
case 'V':
printf("%s v%s (legacy)\n", prog_name, prog_vers);
printf("%s v%s (legacy)\n",
xt_params->program_name,
xt_params->program_version);
exit(0);
case 't':
testing = 1;
break;
case 'h':
print_usage("iptables-restore",
print_usage(xt_params->program_name,
IPTABLES_VERSION);
exit(0);
case 'n':
......@@ -142,7 +144,8 @@ iptables_restore_main(int argc, char *argv[])
break;
default:
fprintf(stderr,
"Try `iptables-restore -h' for more information.\n");
"Try `%s -h' for more information.\n",
xt_params->program_name);
exit(1);
}
}
......@@ -180,8 +183,8 @@ iptables_restore_main(int argc, char *argv[])
} else if ((strcmp(buffer, "COMMIT\n") == 0) && (in_table)) {
if (!testing) {
DEBUGP("Calling commit\n");
ret = ops->commit(handle);
ops->free(handle);
ret = cb->ops->commit(handle);
cb->ops->free(handle);
handle = NULL;
} else {
DEBUGP("Not calling commit, testing\n");
......@@ -213,7 +216,7 @@ iptables_restore_main(int argc, char *argv[])
strncpy(curtable, table, XT_TABLE_MAXNAMELEN);
curtable[XT_TABLE_MAXNAMELEN] = '\0';
if (tablename && (strcmp(tablename, table) != 0)) {
if (tablename && strcmp(tablename, table) != 0) {
if (lock >= 0) {
xtables_unlock(lock);
lock = XT_LOCK_NOT_ACQUIRED;
......@@ -221,18 +224,18 @@ iptables_restore_main(int argc, char *argv[])
continue;
}
if (handle)
ops->free(handle);
cb->ops->free(handle);
handle = create_handle(table);
handle = create_handle(cb, table);
if (noflush == 0) {
DEBUGP("Cleaning all chains of table '%s'\n",
table);
for_each_chain4(flush_entries4, verbose, 1,
cb->for_each_chain(cb->flush_entries, verbose, 1,
handle);
DEBUGP("Deleting all user-defined chains "
"of table '%s'\n", table);
for_each_chain4(delete_chain4, verbose, 0,
cb->for_each_chain(cb->delete_chain, verbose, 0,
handle);
}
......@@ -258,17 +261,17 @@ iptables_restore_main(int argc, char *argv[])
"(%u chars max)",
chain, XT_EXTENSION_MAXNAMELEN - 1);
if (ops->builtin(chain, handle) <= 0) {
if (noflush && ops->is_chain(chain, handle)) {
if (cb->ops->builtin(chain, handle) <= 0) {
if (noflush && cb->ops->is_chain(chain, handle)) {
DEBUGP("Flushing existing user defined chain '%s'\n", chain);
if (!ops->flush_entries(chain, handle))
if (!cb->ops->flush_entries(chain, handle))
xtables_error(PARAMETER_PROBLEM,
"error flushing chain "
"'%s':%s\n", chain,
strerror(errno));
} else {
DEBUGP("Creating new chain '%s'\n", chain);
if (!ops->create_chain(chain, handle))
if (!cb->ops->create_chain(chain, handle))
xtables_error(PARAMETER_PROBLEM,
"error creating chain "
"'%s':%s\n", chain,
......@@ -294,20 +297,20 @@ iptables_restore_main(int argc, char *argv[])
if (!ctrs || !parse_counters(ctrs, &count))
xtables_error(PARAMETER_PROBLEM,
"invalid policy counters "
"for chain '%s'\n", chain);
"invalid policy counters "
"for chain '%s'\n", chain);
}
DEBUGP("Setting policy of chain %s to %s\n",
chain, policy);
if (!ops->set_policy(chain, policy, &count,
if (!cb->ops->set_policy(chain, policy, &count,
handle))
xtables_error(OTHER_PROBLEM,
"Can't set policy `%s'"
" on `%s' line %u: %s\n",
policy, chain, line,
ops->strerror(errno));
cb->ops->strerror(errno));
}
ret = 1;
......@@ -358,19 +361,19 @@ iptables_restore_main(int argc, char *argv[])
add_param_to_argv(parsestart, line);
DEBUGP("calling do_command4(%u, argv, &%s, handle):\n",
DEBUGP("calling do_command(%u, argv, &%s, handle):\n",
newargc, curtable);
for (a = 0; a < newargc; a++)
DEBUGP("argv[%u]: %s\n", a, newargv[a]);
ret = do_command4(newargc, newargv,
ret = cb->do_command(newargc, newargv,
&newargv[2], &handle, true);
free_argv();
fflush(stdout);
}
if (tablename && (strcmp(tablename, curtable) != 0))
if (tablename && strcmp(tablename, curtable) != 0)
continue;
if (!ret) {
fprintf(stderr, "%s: line %u failed\n",
......@@ -387,3 +390,66 @@ iptables_restore_main(int argc, char *argv[])
fclose(in);
return 0;
}
#if defined ENABLE_IPV4
struct iptables_restore_cb ipt_restore_cb = {
.ops = &iptc_ops,
.for_each_chain = for_each_chain4,
.flush_entries = flush_entries4,
.delete_chain = delete_chain4,
.do_command = do_command4,
};
int
iptables_restore_main(int argc, char *argv[])
{
int c;
iptables_globals.program_name = "iptables-restore";
c = xtables_init_all(&iptables_globals, NFPROTO_IPV4);
if (c < 0) {
fprintf(stderr, "%s/%s Failed to initialize xtables\n",
iptables_globals.program_name,
iptables_globals.program_version);
exit(1);
}
#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
init_extensions();
init_extensions4();
#endif
return ip46tables_restore_main(&ipt_restore_cb, argc, argv);
}
#endif
#if defined ENABLE_IPV6
struct iptables_restore_cb ip6t_restore_cb = {
.ops = &ip6tc_ops,
.for_each_chain = for_each_chain6,
.flush_entries = flush_entries6,
.delete_chain = delete_chain6,
.do_command = do_command6,
};
int
ip6tables_restore_main(int argc, char *argv[])
{
int c;
ip6tables_globals.program_name = "ip6tables-restore";
c = xtables_init_all(&ip6tables_globals, NFPROTO_IPV6);
if (c < 0) {
fprintf(stderr, "%s/%s Failed to initialize xtables\n",
ip6tables_globals.program_name,
ip6tables_globals.program_version);
exit(1);
}
#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
init_extensions();
init_extensions6();
#endif
return ip46tables_restore_main(&ip6t_restore_cb, argc, argv);
}
#endif
iptables/iptables-save.8.in
View file @ 89c92f0c
......@@ -48,8 +48,11 @@ will log to STDOUT.
include the current values of all packet and byte counters in the output
.TP
\fB\-t\fR, \fB\-\-table\fR \fItablename\fP
restrict output to only one table. If not specified, output includes all
available tables.
restrict output to only one table. If the kernel is configured with automatic
module loading, an attempt will be made to load the appropriate module for
that table if it is not already there.
.br
If not specified, output includes all available tables.
.SH BUGS
None known as of iptables-1.2.1 release
.SH AUTHORS
......
iptables/iptables-save.c
View file @ 89c92f0c
......@@ -15,11 +15,12 @@
#include <netdb.h>
#include <unistd.h>
#include "libiptc/libiptc.h"
#include "libiptc/libip6tc.h"
#include "iptables.h"
#include "ip6tables.h"
#include "iptables-multi.h"
#define prog_name iptables_globals.program_name
#define prog_vers iptables_globals.program_version
#include "ip6tables-multi.h"
#include "xshared.h"
static int show_counters;
......@@ -33,20 +34,26 @@ static const struct option options[] = {
{NULL},
};
/* Debugging prototype. */
static int for_each_table(int (*func)(const char *tablename))
struct iptables_save_cb {
const struct xtc_ops *ops;
void (*dump_rules)(const char *chain, struct xtc_handle *handle);
};
static int
for_each_table(int (*func)(struct iptables_save_cb *cb, const char *tablename),
struct iptables_save_cb *cb)
{
int ret = 1;
FILE *procfile = NULL;
char tablename[XT_TABLE_MAXNAMELEN+1];
static const char filename[] = "/proc/net/ip_tables_names";
procfile = fopen(filename, "re");
procfile = fopen(afinfo->proc_exists, "re");
if (!procfile) {
if (errno == ENOENT)
return ret;
fprintf(stderr, "Failed to list table names in %s: %s\n",
filename, strerror(errno));
afinfo->proc_exists, strerror(errno));
exit(1);
}
......@@ -56,71 +63,65 @@ static int for_each_table(int (*func)(const char *tablename))
"Badly formed tablename `%s'\n",
tablename);
tablename[strlen(tablename) - 1] = '\0';
ret &= func(tablename);
ret &= func(cb, tablename);
}
fclose(procfile);
return ret;
}
static int do_output(const char *tablename)
static int do_output(struct iptables_save_cb *cb, const char *tablename)
{
struct xtc_handle *h;
const char *chain = NULL;
if (!tablename)
return for_each_table(&do_output);
return for_each_table(&do_output, cb);
h = iptc_init(tablename);
h = cb->ops->init(tablename);
if (h == NULL) {
xtables_load_ko(xtables_modprobe_program, false);
h = iptc_init(tablename);
h = cb->ops->init(tablename);
}
if (!h)
xtables_error(OTHER_PROBLEM, "Cannot initialize: %s\n",
iptc_strerror(errno));
cb->ops->strerror(errno));
time_t now = time(NULL);
printf("# Generated by iptables-save v%s on %s",
IPTABLES_VERSION, ctime(&now));
printf("# Generated by %s v%s on %s",
xt_params->program_name, IPTABLES_VERSION, ctime(&now));
printf("*%s\n", tablename);
/* Dump out chain names first,
* thereby preventing dependency conflicts */
for (chain = iptc_first_chain(h);
for (chain = cb->ops->first_chain(h);
chain;
chain = iptc_next_chain(h)) {
chain = cb->ops->next_chain(h)) {
printf(":%s ", chain);
if (iptc_builtin(chain, h)) {
if (cb->ops->builtin(chain, h)) {
struct xt_counters count;
printf("%s ",
iptc_get_policy(chain, &count, h));
printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
printf("%s ", cb->ops->get_policy(chain, &count, h));
printf("[%llu:%llu]\n",
(unsigned long long)count.pcnt,
(unsigned long long)count.bcnt);
} else {
printf("- [0:0]\n");
}
}
for (chain = iptc_first_chain(h);
for (chain = cb->ops->first_chain(h);
chain;
chain = iptc_next_chain(h)) {
const struct ipt_entry *e;
/* Dump out rules */
e = iptc_first_rule(chain, h);
while(e) {
print_rule4(e, h, chain, show_counters);
e = iptc_next_rule(e, h);
}
chain = cb->ops->next_chain(h)) {
cb->dump_rules(chain, h);
}
now = time(NULL);
printf("COMMIT\n");
printf("# Completed on %s", ctime(&now));
iptc_free(h);
cb->ops->free(h);
return 1;
}
......@@ -129,26 +130,13 @@ static int do_output(const char *tablename)
* :Chain name POLICY packets bytes
* rule
*/
int
iptables_save_main(int argc, char *argv[])
static int
do_iptables_save(struct iptables_save_cb *cb, int argc, char *argv[])
{
const char *tablename = NULL;
FILE *file = NULL;
int ret, c;
iptables_globals.program_name = "iptables-save";
c = xtables_init_all(&iptables_globals, NFPROTO_IPV4);
if (c < 0) {
fprintf(stderr, "%s/%s Failed to initialize xtables\n",
iptables_globals.program_name,
iptables_globals.program_version);
exit(1);
}
#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
init_extensions();
init_extensions4();
#endif
while ((c = getopt_long(argc, argv, "bcdt:M:f:V", options, NULL)) != -1) {
switch (c) {
case 'b':
......@@ -181,14 +169,17 @@ iptables_save_main(int argc, char *argv[])
fclose(file);
break;
case 'd':
do_output(tablename);
do_output(cb, tablename);
exit(0);
case 'V':
printf("%s v%s (legacy)\n", prog_name, prog_vers);
printf("%s v%s (legacy)\n",
xt_params->program_name,
xt_params->program_version);
exit(0);
default:
fprintf(stderr,
"Look at manual page `iptables-save.8' for more information.\n");
"Look at manual page `%s.8' for more information.\n",
xt_params->program_name);
exit(1);
}
}
......@@ -198,5 +189,87 @@ iptables_save_main(int argc, char *argv[])
exit(1);
}
return !do_output(tablename);
return !do_output(cb, tablename);
}
#ifdef ENABLE_IPV4
static void iptables_dump_rules(const char *chain, struct xtc_handle *h)
{
const struct ipt_entry *e;
/* Dump out rules */
e = iptc_first_rule(chain, h);
while(e) {
print_rule4(e, h, chain, show_counters);
e = iptc_next_rule(e, h);
}
}
struct iptables_save_cb ipt_save_cb = {
.ops = &iptc_ops,
.dump_rules = iptables_dump_rules,
};
/* Format:
* :Chain name POLICY packets bytes
* rule
*/
int
iptables_save_main(int argc, char *argv[])
{
iptables_globals.program_name = "iptables-save";
if (xtables_init_all(&iptables_globals, NFPROTO_IPV4) < 0) {
fprintf(stderr, "%s/%s Failed to initialize xtables\n",
iptables_globals.program_name,
iptables_globals.program_version);
exit(1);
}
#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
init_extensions();
init_extensions4();
#endif
return do_iptables_save(&ipt_save_cb, argc, argv);
}
#endif /* ENABLE_IPV4 */
#ifdef ENABLE_IPV6
static void ip6tables_dump_rules(const char *chain, struct xtc_handle *h)
{
const struct ip6t_entry *e;
/* Dump out rules */
e = ip6tc_first_rule(chain, h);
while(e) {
print_rule6(e, h, chain, show_counters);
e = ip6tc_next_rule(e, h);
}
}
struct iptables_save_cb ip6t_save_cb = {
.ops = &ip6tc_ops,
.dump_rules = ip6tables_dump_rules,
};
/* Format:
* :Chain name POLICY packets bytes
* rule
*/
int
ip6tables_save_main(int argc, char *argv[])
{
ip6tables_globals.program_name = "ip6tables-save";
if (xtables_init_all(&ip6tables_globals, NFPROTO_IPV6) < 0) {
fprintf(stderr, "%s/%s Failed to initialize xtables\n",
ip6tables_globals.program_name,
ip6tables_globals.program_version);
exit(1);
}
#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
init_extensions();
init_extensions6();
#endif
return do_iptables_save(&ip6t_save_cb, argc, argv);
}
#endif /* ENABLE_IPV6 */
iptables/iptables.c
View file @ 89c92f0c
......@@ -1421,7 +1421,7 @@ int do_command4(int argc, char *argv[], char **table,
case 'j':
set_option(&cs.options, OPT_JUMP, &cs.fw.ip.invflags,
cs.invert);
command_jump(&cs);
command_jump(&cs, optarg);
break;
......
iptables/nft-arp.c
View file @ 89c92f0c
......@@ -29,7 +29,7 @@
#include "nft.h"
/* a few names */
char *opcodes[] =
char *arp_opcodes[] =
{
"Request",
"Reply",
......@@ -338,7 +338,8 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
struct iptables_command_state *cs = data;
struct arpt_entry *fw = &cs->arp;
struct in_addr addr;
unsigned short int ar_hrd, ar_pro, ar_op, ar_hln;
uint16_t ar_hrd, ar_pro, ar_op;
uint8_t ar_hln;
bool inv;
switch (ctx->payload.offset) {
......@@ -364,7 +365,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
fw->arp.invflags |= ARPT_INV_ARPOP;
break;
case offsetof(struct arphdr, ar_hln):
get_cmp_data(e, &ar_hln, sizeof(ar_op), &inv);
get_cmp_data(e, &ar_hln, sizeof(ar_hln), &inv);
fw->arp.arhln = ar_hln;
fw->arp.arhln_mask = 0xff;
if (inv)
......@@ -412,56 +413,6 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
}
}
static void nft_arp_rule_to_cs(const struct nftnl_rule *r,
struct iptables_command_state *cs)
{
struct nftnl_expr_iter *iter;
struct nftnl_expr *expr;
int family = nftnl_rule_get_u32(r, NFTNL_RULE_FAMILY);
struct nft_xt_ctx ctx = {
.cs = cs,
.family = family,
};
iter = nftnl_expr_iter_create(r);
if (iter == NULL)
return;
ctx.iter = iter;
expr = nftnl_expr_iter_next(iter);
while (expr != NULL) {
const char *name =
nftnl_expr_get_str(expr, NFTNL_EXPR_NAME);
if (strcmp(name, "counter") == 0)
nft_parse_counter(expr, &ctx.cs->arp.counters);
else if (strcmp(name, "payload") == 0)
nft_parse_payload(&ctx, expr);
else if (strcmp(name, "meta") == 0)
nft_parse_meta(&ctx, expr);
else if (strcmp(name, "bitwise") == 0)
nft_parse_bitwise(&ctx, expr);
else if (strcmp(name, "cmp") == 0)
nft_parse_cmp(&ctx, expr);
else if (strcmp(name, "immediate") == 0)
nft_parse_immediate(&ctx, expr);
else if (strcmp(name, "target") == 0)
nft_parse_target(&ctx, expr);
expr = nftnl_expr_iter_next(iter);
}
nftnl_expr_iter_destroy(iter);
if (cs->jumpto != NULL)
return;
if (cs->target != NULL && cs->target->name != NULL)
cs->target = xtables_find_target(cs->target->name, XTF_TRY_LOAD);
else
cs->jumpto = "";
}
static void nft_arp_print_header(unsigned int format, const char *chain,
const char *pol,
const struct xt_counters *counters,
......@@ -484,14 +435,21 @@ static void nft_arp_print_header(unsigned int format, const char *chain,
}
}
static void nft_arp_print_rule_details(const struct arpt_entry *fw,
static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
unsigned int format)
{
const struct arpt_entry *fw = &cs->arp;
char buf[BUFSIZ];
char iface[IFNAMSIZ+2];
const char *sep = "";
int print_iface = 0;
int i;
if (strlen(cs->jumpto)) {
printf("%s-j %s", sep, cs->jumpto);
sep = " ";
}
iface[0] = '\0';
if (fw->arp.iniface[0] != '\0') {
......@@ -503,9 +461,11 @@ static void nft_arp_print_rule_details(const struct arpt_entry *fw,
if (format & FMT_NUMERIC) strcat(iface, "*");
else strcat(iface, "any");
}
if (print_iface)
printf("%s-i %s ", fw->arp.invflags & ARPT_INV_VIA_IN ?
if (print_iface) {
printf("%s%s-i %s", sep, fw->arp.invflags & ARPT_INV_VIA_IN ?
"! " : "", iface);
sep = " ";
}
print_iface = 0;
iface[0] = '\0';
......@@ -519,12 +479,14 @@ static void nft_arp_print_rule_details(const struct arpt_entry *fw,
if (format & FMT_NUMERIC) strcat(iface, "*");
else strcat(iface, "any");
}
if (print_iface)
printf("%s-o %s ", fw->arp.invflags & ARPT_INV_VIA_OUT ?
if (print_iface) {
printf("%s%s-o %s", sep, fw->arp.invflags & ARPT_INV_VIA_OUT ?
"! " : "", iface);
sep = " ";
}
if (fw->arp.smsk.s_addr != 0L) {
printf("%s", fw->arp.invflags & ARPT_INV_SRCIP
printf("%s%s", sep, fw->arp.invflags & ARPT_INV_SRCIP
? "! " : "");
if (format & FMT_NUMERIC)
sprintf(buf, "%s", addr_to_dotted(&(fw->arp.src)));
......@@ -532,7 +494,8 @@ static void nft_arp_print_rule_details(const struct arpt_entry *fw,
sprintf(buf, "%s", addr_to_anyname(&(fw->arp.src)));
strncat(buf, mask_to_dotted(&(fw->arp.smsk)),
sizeof(buf) - strlen(buf) - 1);
printf("-s %s ", buf);
printf("-s %s", buf);
sep = " ";
}
for (i = 0; i < ARPT_DEV_ADDR_LEN_MAX; i++)
......@@ -540,16 +503,16 @@ static void nft_arp_print_rule_details(const struct arpt_entry *fw,
break;
if (i == ARPT_DEV_ADDR_LEN_MAX)
goto after_devsrc;
printf("%s", fw->arp.invflags & ARPT_INV_SRCDEVADDR
printf("%s%s", sep, fw->arp.invflags & ARPT_INV_SRCDEVADDR
? "! " : "");
printf("--src-mac ");
print_mac_and_mask((unsigned char *)fw->arp.src_devaddr.addr,
(unsigned char *)fw->arp.src_devaddr.mask, ETH_ALEN);
printf(" ");
sep = " ";
after_devsrc:
if (fw->arp.tmsk.s_addr != 0L) {
printf("%s", fw->arp.invflags & ARPT_INV_TGTIP
printf("%s%s", sep, fw->arp.invflags & ARPT_INV_TGTIP
? "! " : "");
if (format & FMT_NUMERIC)
sprintf(buf, "%s", addr_to_dotted(&(fw->arp.tgt)));
......@@ -557,7 +520,8 @@ after_devsrc:
sprintf(buf, "%s", addr_to_anyname(&(fw->arp.tgt)));
strncat(buf, mask_to_dotted(&(fw->arp.tmsk)),
sizeof(buf) - strlen(buf) - 1);
printf("-d %s ", buf);
printf("-d %s", buf);
sep = " ";
}
for (i = 0; i <ARPT_DEV_ADDR_LEN_MAX; i++)
......@@ -565,43 +529,43 @@ after_devsrc:
break;
if (i == ARPT_DEV_ADDR_LEN_MAX)
goto after_devdst;
printf("%s", fw->arp.invflags & ARPT_INV_TGTDEVADDR
printf("%s%s", sep, fw->arp.invflags & ARPT_INV_TGTDEVADDR
? "! " : "");
printf("--dst-mac ");
print_mac_and_mask((unsigned char *)fw->arp.tgt_devaddr.addr,
(unsigned char *)fw->arp.tgt_devaddr.mask, ETH_ALEN);
printf(" ");
sep = " ";
after_devdst:
if (fw->arp.arhln_mask != 0) {
printf("%s", fw->arp.invflags & ARPT_INV_ARPHLN
if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) {
printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPHLN
? "! " : "");
printf("--h-length %d", fw->arp.arhln);
if (fw->arp.arhln_mask != 255)
printf("/%d", fw->arp.arhln_mask);
printf(" ");
sep = " ";
}
if (fw->arp.arpop_mask != 0) {
int tmp = ntohs(fw->arp.arpop);
printf("%s", fw->arp.invflags & ARPT_INV_ARPOP
printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPOP
? "! " : "");
if (tmp <= NUMOPCODES && !(format & FMT_NUMERIC))
printf("--opcode %s", opcodes[tmp-1]);
printf("--opcode %s", arp_opcodes[tmp-1]);
else
printf("--opcode %d", tmp);
if (fw->arp.arpop_mask != 65535)
printf("/%d", ntohs(fw->arp.arpop_mask));
printf(" ");
sep = " ";
}
if (fw->arp.arhrd_mask != 0) {
if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) {
uint16_t tmp = ntohs(fw->arp.arhrd);
printf("%s", fw->arp.invflags & ARPT_INV_ARPHRD
printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPHRD
? "! " : "");
if (tmp == 1 && !(format & FMT_NUMERIC))
printf("--h-type %s", "Ethernet");
......@@ -609,13 +573,13 @@ after_devdst:
printf("--h-type %u", tmp);
if (fw->arp.arhrd_mask != 65535)
printf("/%d", ntohs(fw->arp.arhrd_mask));
printf(" ");
sep = " ";
}
if (fw->arp.arpro_mask != 0) {
int tmp = ntohs(fw->arp.arpro);
printf("%s", fw->arp.invflags & ARPT_INV_ARPPRO
printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPPRO
? "! " : "");
if (tmp == 0x0800 && !(format & FMT_NUMERIC))
printf("--proto-type %s", "IPv4");
......@@ -623,18 +587,10 @@ after_devdst:
printf("--proto-type 0x%x", tmp);
if (fw->arp.arpro_mask != 65535)
printf("/%x", ntohs(fw->arp.arpro_mask));
printf(" ");
sep = " ";
}
}
static void nft_arp_save_counters(const void *data)
{
const struct iptables_command_state *cs = data;
printf("[%llu:%llu] ", (unsigned long long)cs->arp.counters.pcnt,
(unsigned long long)cs->arp.counters.bcnt);
}
static void
nft_arp_save_rule(const void *data, unsigned int format)
{
......@@ -642,18 +598,10 @@ nft_arp_save_rule(const void *data, unsigned int format)
format |= FMT_NUMERIC;
nft_arp_print_rule_details(&cs->arp, format);
if (cs->jumpto != NULL && strcmp(cs->jumpto, "") != 0) {
printf("-j %s", cs->jumpto);
} else if (cs->target) {
printf("-j %s", cs->target->name);
if (cs->target->save != NULL)
cs->target->save(&cs->arp, cs->target->t);
}
if (!(format & FMT_NONEWLINE))
fputc('\n', stdout);
nft_arp_print_rule_details(cs, format);
if (cs->target && cs->target->save)
cs->target->save(&cs->fw, cs->target->t);
printf("\n");
}
static void
......@@ -664,22 +612,16 @@ nft_arp_print_rule(struct nftnl_rule *r, unsigned int num, unsigned int format)
if (format & FMT_LINENUMBERS)
printf("%u ", num);
nft_arp_rule_to_cs(r, &cs);
nft_arp_print_rule_details(&cs.arp, format);
nft_rule_to_iptables_command_state(r, &cs);
if (cs.jumpto != NULL && strcmp(cs.jumpto, "") != 0) {
printf("-j %s", cs.jumpto);
} else if (cs.target) {
printf("-j %s", cs.target->name);
cs.target->print(&cs.arp, cs.target->t, format & FMT_NUMERIC);
}
nft_arp_print_rule_details(&cs, format);
print_matches_and_target(&cs, format);
if (!(format & FMT_NOCOUNTS)) {
printf(", pcnt=");
xtables_print_num(cs.arp.counters.pcnt, format);
printf(" , pcnt=");
xtables_print_num(cs.counters.pcnt, format | FMT_NOTABLE);
printf("-- bcnt=");
xtables_print_num(cs.arp.counters.bcnt, format);
xtables_print_num(cs.counters.bcnt, format | FMT_NOTABLE);
}
if (!(format & FMT_NONEWLINE))
......@@ -718,20 +660,24 @@ static bool nft_arp_rule_find(struct nft_family_ops *ops, struct nftnl_rule *r,
{
const struct iptables_command_state *cs = data;
struct iptables_command_state this = {};
bool ret = false;
/* Delete by matching rule case */
nft_arp_rule_to_cs(r, &this);
nft_rule_to_iptables_command_state(r, &this);
if (!nft_arp_is_same(&cs->arp, &this.arp))
return false;
goto out;
if (!compare_targets(cs->target, this.target))
return false;
goto out;
if (this.jumpto && strcmp(cs->jumpto, this.jumpto) != 0)
return false;
goto out;
return true;
ret = true;
out:
ops->clear_cs(&this);
return ret;
}
static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy)
......@@ -751,10 +697,10 @@ struct nft_family_ops nft_family_ops_arp = {
.print_header = nft_arp_print_header,
.print_rule = nft_arp_print_rule,
.save_rule = nft_arp_save_rule,
.save_counters = nft_arp_save_counters,
.save_counters = save_counters,
.save_chain = nft_arp_save_chain,
.post_parse = NULL,
.rule_to_cs = nft_arp_rule_to_cs,
.rule_to_cs = nft_rule_to_iptables_command_state,
.clear_cs = nft_clear_iptables_command_state,
.rule_find = nft_arp_rule_find,
.parse_target = nft_ipv46_parse_target,
......
iptables/nft-arp.h
View file @ 89c92f0c
#ifndef _NFT_ARP_H_
#define _NFT_ARP_H_
extern char *opcodes[];
extern char *arp_opcodes[];
#define NUMOPCODES 9
#endif
iptables/nft-bridge.c
View file @ 89c92f0c
......@@ -45,6 +45,16 @@ void ebt_cs_clean(struct iptables_command_state *cs)
free(m);
m = nm;
}
if (cs->target) {
free(cs->target->t);
cs->target->t = NULL;
if (cs->target == cs->target->next) {
free(cs->target);
cs->target = NULL;
}
}
}
static void ebt_print_mac(const unsigned char *mac)
......@@ -334,7 +344,7 @@ static void nft_rule_to_ebtables_command_state(const struct nftnl_rule *r,
static void print_iface(const char *option, const char *name, bool invert)
{
if (*name)
printf("%s%s %s ", invert ? "! " : "", option, name);
printf("%s%s %s ", option, invert ? " !" : "", name);
}
static void nft_bridge_print_table_header(const char *tablename)
......@@ -348,7 +358,7 @@ static void nft_bridge_print_header(unsigned int format, const char *chain,
bool basechain, uint32_t refs, uint32_t entries)
{
printf("Bridge chain: %s, entries: %u, policy: %s\n",
chain, entries, basechain ? pol : "RETURN");
chain, entries, pol ?: "RETURN");
}
static void print_matches_and_watchers(const struct iptables_command_state *cs,
......@@ -379,9 +389,9 @@ static void print_mac(char option, const unsigned char *mac,
const unsigned char *mask,
bool invert)
{
printf("-%c ", option);
if (invert)
printf("! ");
printf("-%c ", option);
ebt_print_mac_and_mask(mac, mask);
printf(" ");
}
......@@ -396,9 +406,9 @@ static void print_protocol(uint16_t ethproto, bool invert, unsigned int bitmask)
if (bitmask & EBT_NOPROTO)
return;
printf("-p ");
if (invert)
printf("! ");
printf("-p ");
if (bitmask & EBT_802_3) {
printf("length ");
......@@ -469,6 +479,11 @@ static void nft_bridge_save_rule(const void *data, unsigned int format)
(uint64_t)cs->counters.pcnt,
(uint64_t)cs->counters.bcnt);
if (!(format & FMT_NOCOUNTS))
printf(" , pcnt = %"PRIu64" -- bcnt = %"PRIu64"",
(uint64_t)cs->counters.pcnt,
(uint64_t)cs->counters.bcnt);
if (!(format & FMT_NONEWLINE))
fputc('\n', stdout);
}
......@@ -482,11 +497,7 @@ static void nft_bridge_print_rule(struct nftnl_rule *r, unsigned int num,
printf("%d ", num);
nft_rule_to_ebtables_command_state(r, &cs);
nft_bridge_save_rule(&cs, format & ~FMT_EBT_SAVE);
if (!(format & FMT_NOCOUNTS))
printf(" , pcnt = %"PRIu64" -- bcnt = %"PRIu64"",
(uint64_t)cs.counters.pcnt,
(uint64_t)cs.counters.bcnt);
nft_bridge_save_rule(&cs, format);
ebt_cs_clean(&cs);
}
......@@ -547,30 +558,34 @@ static bool nft_bridge_rule_find(struct nft_family_ops *ops, struct nftnl_rule *
{
struct iptables_command_state *cs = data;
struct iptables_command_state this = {};
bool ret = false;
nft_rule_to_ebtables_command_state(r, &this);
DEBUGP("comparing with... ");
if (!nft_bridge_is_same(cs, &this))
return false;
goto out;
if (!compare_matches(cs->matches, this.matches)) {
DEBUGP("Different matches\n");
return false;
goto out;
}
if (!compare_targets(cs->target, this.target)) {
DEBUGP("Different target\n");
return false;
goto out;
}
if (cs->jumpto != NULL && strcmp(cs->jumpto, this.jumpto) != 0) {
DEBUGP("Different verdict\n");
return false;
goto out;
}
return true;
ret = true;
out:
ops->clear_cs(&this);
return ret;
}
static int xlate_ebmatches(const struct iptables_command_state *cs, struct xt_xlate *xl)
......
iptables/nft-bridge.h
View file @ 89c92f0c
......@@ -32,7 +32,6 @@ int ebt_get_mac_and_mask(const char *from, unsigned char *to, unsigned char *mas
*/
#define EBT_TABLE_MAXNAMELEN 32
#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
#define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN
/* verdicts >0 are "branches" */
......@@ -122,6 +121,5 @@ void ebt_add_match(struct xtables_match *m,
void ebt_add_watcher(struct xtables_target *watcher,
struct iptables_command_state *cs);
int ebt_command_default(struct iptables_command_state *cs);
struct xtables_target *ebt_command_jump(const char *jumpto);
#endif
iptables/nft-ipv4.c
View file @ 89c92f0c
......@@ -77,17 +77,9 @@ static int nft_ipv4_add(struct nftnl_rule *r, void *data)
add_compat(r, cs->fw.ip.proto, cs->fw.ip.invflags & XT_INV_PROTO);
for (matchp = cs->matches; matchp; matchp = matchp->next) {
/* Use nft built-in comments support instead of comment match */
if (strcmp(matchp->match->name, "comment") == 0) {
ret = add_comment(r, (char *)matchp->match->m->data);
if (ret < 0)
goto try_match;
} else {
try_match:
ret = add_match(r, matchp->match->m);
if (ret < 0)
return ret;
}
ret = add_match(r, matchp->match->m);
if (ret < 0)
return ret;
}
/* Counters need to me added before the target, otherwise they are
......
iptables/nft-ipv6.c
View file @ 89c92f0c
......@@ -66,17 +66,9 @@ static int nft_ipv6_add(struct nftnl_rule *r, void *data)
add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags & XT_INV_PROTO);
for (matchp = cs->matches; matchp; matchp = matchp->next) {
/* Use nft built-in comments support instead of comment match */
if (strcmp(matchp->match->name, "comment") == 0) {
ret = add_comment(r, (char *)matchp->match->m->data);
if (ret < 0)
goto try_match;
} else {
try_match:
ret = add_match(r, matchp->match->m);
if (ret < 0)
return ret;
}
ret = add_match(r, matchp->match->m);
if (ret < 0)
return ret;
}
/* Counters need to me added before the target, otherwise they are
......
iptables/nft-shared.c
View file @ 89c92f0c
......@@ -302,7 +302,7 @@ int parse_meta(struct nftnl_expr *e, uint8_t key, char *iniface,
return 0;
}
void nft_parse_target(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
static void nft_parse_target(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
{
uint32_t tg_len;
const char *targname = nftnl_expr_get_str(e, NFTNL_EXPR_TG_NAME);
......@@ -331,7 +331,7 @@ void nft_parse_target(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
ops->parse_target(target, data);
}
void nft_parse_match(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
static void nft_parse_match(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
{
uint32_t mt_len;
const char *mt_name = nftnl_expr_get_str(e, NFTNL_EXPR_MT_NAME);
......@@ -433,7 +433,7 @@ static void nft_meta_set_to_target(struct nft_xt_ctx *ctx)
ops->parse_target(target, ctx->cs);
}
void nft_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
static void nft_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
{
ctx->meta.key = nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY);
......@@ -449,14 +449,14 @@ void nft_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
ctx->flags |= NFT_XT_CTX_META;
}
void nft_parse_payload(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
static void nft_parse_payload(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
{
ctx->reg = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG);
ctx->payload.offset = nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_OFFSET);
ctx->flags |= NFT_XT_CTX_PAYLOAD;
}
void nft_parse_bitwise(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
static void nft_parse_bitwise(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
{
uint32_t reg, len;
const void *data;
......@@ -472,7 +472,7 @@ void nft_parse_bitwise(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
ctx->flags |= NFT_XT_CTX_BITWISE;
}
void nft_parse_cmp(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
static void nft_parse_cmp(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
{
struct nft_family_ops *ops = nft_family_ops_lookup(ctx->family);
void *data = ctx->cs;
......@@ -493,13 +493,13 @@ void nft_parse_cmp(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
}
}
void nft_parse_counter(struct nftnl_expr *e, struct xt_counters *counters)
static void nft_parse_counter(struct nftnl_expr *e, struct xt_counters *counters)
{
counters->pcnt = nftnl_expr_get_u64(e, NFTNL_EXPR_CTR_PACKETS);
counters->bcnt = nftnl_expr_get_u64(e, NFTNL_EXPR_CTR_BYTES);
}
void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
{
const char *chain = nftnl_expr_get_str(e, NFTNL_EXPR_IMM_CHAIN);
struct nft_family_ops *ops;
......@@ -639,40 +639,65 @@ void nft_rule_to_iptables_command_state(const struct nftnl_rule *r,
if (nftnl_rule_is_set(r, NFTNL_RULE_USERDATA)) {
const void *data;
uint32_t len, size;
struct xtables_match *match;
struct xt_entry_match *m;
const char *comment;
data = nftnl_rule_get_data(r, NFTNL_RULE_USERDATA, &len);
match = xtables_find_match("comment", XTF_TRY_LOAD,
&cs->matches);
if (match == NULL)
return;
size = XT_ALIGN(sizeof(struct xt_entry_match)) + match->size;
m = xtables_calloc(1, size);
strncpy((char *)m->data, get_comment(data, len),
match->size - 1);
m->u.match_size = size;
m->u.user.revision = 0;
strcpy(m->u.user.name, match->name);
match->m = m;
comment = get_comment(data, len);
if (comment) {
struct xtables_match *match;
struct xt_entry_match *m;
match = xtables_find_match("comment", XTF_TRY_LOAD,
&cs->matches);
if (match == NULL)
return;
size = XT_ALIGN(sizeof(struct xt_entry_match))
+ match->size;
m = xtables_calloc(1, size);
strncpy((char *)m->data, comment, match->size - 1);
m->u.match_size = size;
m->u.user.revision = 0;
strcpy(m->u.user.name, match->name);
match->m = m;
}
}
if (cs->target != NULL)
if (cs->target != NULL) {
cs->jumpto = cs->target->name;
else if (cs->jumpto != NULL)
} else if (cs->jumpto != NULL) {
struct xt_entry_target *t;
uint32_t size;
cs->target = xtables_find_target(cs->jumpto, XTF_TRY_LOAD);
else
if (!cs->target)
return;
size = XT_ALIGN(sizeof(struct xt_entry_target)) + cs->target->size;
t = xtables_calloc(1, size);
t->u.target_size = size;
t->u.user.revision = cs->target->revision;
strcpy(t->u.user.name, cs->jumpto);
cs->target->t = t;
} else {
cs->jumpto = "";
}
}
void nft_clear_iptables_command_state(struct iptables_command_state *cs)
{
xtables_rule_matches_free(&cs->matches);
if (cs->target)
if (cs->target) {
free(cs->target->t);
cs->target->t = NULL;
if (cs->target == cs->target->next) {
free(cs->target);
cs->target = NULL;
}
}
}
void print_header(unsigned int format, const char *chain, const char *pol,
......@@ -961,6 +986,7 @@ bool nft_ipv46_rule_find(struct nft_family_ops *ops,
struct nftnl_rule *r, void *data)
{
struct iptables_command_state *cs = data, this = {};
bool ret = false;
nft_rule_to_iptables_command_state(r, &this);
......@@ -969,24 +995,27 @@ bool nft_ipv46_rule_find(struct nft_family_ops *ops,
nft_rule_print_save(r, NFT_RULE_APPEND, 0);
#endif
if (!ops->is_same(cs, &this))
return false;
goto out;
if (!compare_matches(cs->matches, this.matches)) {
DEBUGP("Different matches\n");
return false;
goto out;
}
if (!compare_targets(cs->target, this.target)) {
DEBUGP("Different target\n");
return false;
goto out;
}
if (strcmp(cs->jumpto, this.jumpto) != 0) {
DEBUGP("Different verdict\n");
return false;
goto out;
}
return true;
ret = true;
out:
ops->clear_cs(&this);
return ret;
}
void nft_check_xt_legacy(int family, bool is_ipt_save)
......
iptables/nft-shared.h
View file @ 89c92f0c
......@@ -137,14 +137,6 @@ int parse_meta(struct nftnl_expr *e, uint8_t key, char *iniface,
unsigned char *outiface_mask, uint8_t *invflags);
void print_proto(uint16_t proto, int invert);
void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
void nft_parse_bitwise(struct nft_xt_ctx *ctx, struct nftnl_expr *e);
void nft_parse_cmp(struct nft_xt_ctx *ctx, struct nftnl_expr *e);
void nft_parse_match(struct nft_xt_ctx *ctx, struct nftnl_expr *e);
void nft_parse_target(struct nft_xt_ctx *ctx, struct nftnl_expr *e);
void nft_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e);
void nft_parse_payload(struct nft_xt_ctx *ctx, struct nftnl_expr *e);
void nft_parse_counter(struct nftnl_expr *e, struct xt_counters *counters);
void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e);
void nft_rule_to_iptables_command_state(const struct nftnl_rule *r,
struct iptables_command_state *cs);
void nft_clear_iptables_command_state(struct iptables_command_state *cs);
......@@ -251,17 +243,13 @@ struct nftnl_chain_list;
struct nft_xt_restore_cb {
void (*table_new)(struct nft_handle *h, const char *table);
struct nftnl_chain_list *(*chain_list)(struct nft_handle *h);
void (*chain_del)(struct nftnl_chain_list *clist, const char *curtable,
const char *chain);
int (*chain_user_flush)(struct nft_handle *h,
struct nftnl_chain_list *clist,
const char *table, const char *chain);
struct nftnl_chain_list *(*chain_list)(struct nft_handle *h,
const char *table);
int (*chain_set)(struct nft_handle *h, const char *table,
const char *chain, const char *policy,
const struct xt_counters *counters);
int (*chain_user_add)(struct nft_handle *h, const char *chain,
const char *table);
int (*chain_restore)(struct nft_handle *h, const char *chain,
const char *table);
int (*table_flush)(struct nft_handle *h, const char *table);
......
iptables/nft.c
View file @ 89c92f0c
......@@ -41,6 +41,7 @@
#include <linux/netfilter/xt_limit.h>
#include <libmnl/libmnl.h>
#include <libnftnl/gen.h>
#include <libnftnl/table.h>
#include <libnftnl/chain.h>
#include <libnftnl/rule.h>
......@@ -55,10 +56,41 @@
#include "nft.h"
#include "xshared.h" /* proto_to_name */
#include "nft-shared.h"
#include "nft-bridge.h" /* EBT_NOPROTO */
#include "xtables-config-parser.h"
static void *nft_fn;
static int genid_cb(const struct nlmsghdr *nlh, void *data)
{
uint32_t *genid = data;
struct nftnl_gen *gen;
gen = nftnl_gen_alloc();
if (!gen)
return MNL_CB_ERROR;
if (nftnl_gen_nlmsg_parse(nlh, gen) < 0)
goto out;
*genid = nftnl_gen_get_u32(gen, NFTNL_GEN_ID);
nftnl_gen_free(gen);
return MNL_CB_STOP;
out:
nftnl_gen_free(gen);
return MNL_CB_ERROR;
}
static int mnl_genid_get(struct nft_handle *h, uint32_t *genid)
{
char buf[MNL_SOCKET_BUFFER_SIZE];
struct nlmsghdr *nlh;
nlh = nftnl_nlmsg_build_hdr(buf, NFT_MSG_GETGEN, 0, 0, h->seq);
return mnl_talk(h, nlh, genid_cb, genid);
}
int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh,
int (*cb)(const struct nlmsghdr *nlh, void *data),
void *data)
......@@ -108,9 +140,14 @@ static void mnl_nft_batch_continue(struct nftnl_batch *batch)
assert(nftnl_batch_update(batch) >= 0);
}
static uint32_t mnl_batch_begin(struct nftnl_batch *batch, uint32_t seqnum)
static uint32_t mnl_batch_begin(struct nftnl_batch *batch, uint32_t genid, uint32_t seqnum)
{
nftnl_batch_begin(nftnl_batch_buffer(batch), seqnum);
struct nlmsghdr *nlh;
nlh = nftnl_batch_begin(nftnl_batch_buffer(batch), seqnum);
mnl_attr_put_u32(nlh, NFTA_GEN_ID, htonl(genid));
mnl_nft_batch_continue(batch);
return seqnum;
......@@ -263,7 +300,9 @@ enum obj_action {
struct obj_update {
struct list_head head;
enum obj_update_type type;
enum obj_update_type type:8;
uint8_t skip:1;
uint8_t implicit:1;
unsigned int seq;
union {
struct nftnl_table *table;
......@@ -341,13 +380,13 @@ static int mnl_append_error(const struct nft_handle *h,
return snprintf(buf, len, "%s: %s", errmsg, tcr);
}
static int batch_add(struct nft_handle *h, enum obj_update_type type, void *ptr)
static struct obj_update *batch_add(struct nft_handle *h, enum obj_update_type type, void *ptr)
{
struct obj_update *obj;
obj = calloc(1, sizeof(struct obj_update));
if (obj == NULL)
return -1;
return NULL;
obj->ptr = ptr;
obj->error.lineno = h->error.lineno;
......@@ -355,11 +394,12 @@ static int batch_add(struct nft_handle *h, enum obj_update_type type, void *ptr)
list_add_tail(&obj->head, &h->obj_list);
h->obj_list_num++;
return 0;
return obj;
}
static int batch_table_add(struct nft_handle *h, enum obj_update_type type,
struct nftnl_table *t)
static struct obj_update *
batch_table_add(struct nft_handle *h, enum obj_update_type type,
struct nftnl_table *t)
{
return batch_add(h, type, t);
}
......@@ -367,18 +407,20 @@ static int batch_table_add(struct nft_handle *h, enum obj_update_type type,
static int batch_chain_add(struct nft_handle *h, enum obj_update_type type,
struct nftnl_chain *c)
{
return batch_add(h, type, c);
return batch_add(h, type, c) ? 0 : -1;
}
static int batch_rule_add(struct nft_handle *h, enum obj_update_type type,
static struct obj_update *
batch_rule_add(struct nft_handle *h, enum obj_update_type type,
struct nftnl_rule *r)
{
return batch_add(h, type, r);
}
struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
const struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
[NFT_TABLE_RAW] = {
.name = "raw",
.type = NFT_TABLE_RAW,
.chains = {
{
.name = "PREROUTING",
......@@ -396,6 +438,7 @@ struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
},
[NFT_TABLE_MANGLE] = {
.name = "mangle",
.type = NFT_TABLE_MANGLE,
.chains = {
{
.name = "PREROUTING",
......@@ -431,6 +474,7 @@ struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
},
[NFT_TABLE_FILTER] = {
.name = "filter",
.type = NFT_TABLE_FILTER,
.chains = {
{
.name = "INPUT",
......@@ -454,6 +498,7 @@ struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
},
[NFT_TABLE_SECURITY] = {
.name = "security",
.type = NFT_TABLE_SECURITY,
.chains = {
{
.name = "INPUT",
......@@ -477,6 +522,7 @@ struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
},
[NFT_TABLE_NAT] = {
.name = "nat",
.type = NFT_TABLE_NAT,
.chains = {
{
.name = "PREROUTING",
......@@ -508,9 +554,10 @@ struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
#include <linux/netfilter_arp.h>
struct builtin_table xtables_arp[NFT_TABLE_MAX] = {
const struct builtin_table xtables_arp[NFT_TABLE_MAX] = {
[NFT_TABLE_FILTER] = {
.name = "filter",
.type = NFT_TABLE_FILTER,
.chains = {
{
.name = "INPUT",
......@@ -530,9 +577,10 @@ struct builtin_table xtables_arp[NFT_TABLE_MAX] = {
#include <linux/netfilter_bridge.h>
struct builtin_table xtables_bridge[NFT_TABLE_MAX] = {
const struct builtin_table xtables_bridge[NFT_TABLE_MAX] = {
[NFT_TABLE_FILTER] = {
.name = "filter",
.type = NFT_TABLE_FILTER,
.chains = {
{
.name = "INPUT",
......@@ -556,6 +604,7 @@ struct builtin_table xtables_bridge[NFT_TABLE_MAX] = {
},
[NFT_TABLE_NAT] = {
.name = "nat",
.type = NFT_TABLE_NAT,
.chains = {
{
.name = "PREROUTING",
......@@ -579,13 +628,19 @@ struct builtin_table xtables_bridge[NFT_TABLE_MAX] = {
},
};
static bool nft_table_initialized(const struct nft_handle *h,
enum nft_table_type type)
{
return h->cache->table[type].initialized;
}
static int nft_table_builtin_add(struct nft_handle *h,
struct builtin_table *_t)
const struct builtin_table *_t)
{
struct nftnl_table *t;
int ret;
if (_t->initialized)
if (nft_table_initialized(h, _t->type))
return 0;
t = nftnl_table_alloc();
......@@ -594,14 +649,14 @@ static int nft_table_builtin_add(struct nft_handle *h,
nftnl_table_set(t, NFTNL_TABLE_NAME, (char *)_t->name);
ret = batch_table_add(h, NFT_COMPAT_TABLE_ADD, t);
ret = batch_table_add(h, NFT_COMPAT_TABLE_ADD, t) ? 0 : - 1;
return ret;
}
static struct nftnl_chain *
nft_chain_builtin_alloc(struct builtin_table *table,
struct builtin_chain *chain, int policy)
nft_chain_builtin_alloc(const struct builtin_table *table,
const struct builtin_chain *chain, int policy)
{
struct nftnl_chain *c;
......@@ -620,8 +675,8 @@ nft_chain_builtin_alloc(struct builtin_table *table,
}
static void nft_chain_builtin_add(struct nft_handle *h,
struct builtin_table *table,
struct builtin_chain *chain)
const struct builtin_table *table,
const struct builtin_chain *chain)
{
struct nftnl_chain *c;
......@@ -630,32 +685,39 @@ static void nft_chain_builtin_add(struct nft_handle *h,
return;
batch_chain_add(h, NFT_COMPAT_CHAIN_ADD, c);
nftnl_chain_list_add_tail(c, h->cache->table[table->type].chains);
}
/* find if built-in table already exists */
struct builtin_table *
nft_table_builtin_find(struct nft_handle *h, const char *table)
static const struct builtin_table *
__nft_table_builtin_find(const struct builtin_table *tables, const char *table)
{
int i;
bool found = false;
for (i = 0; i < NFT_TABLE_MAX; i++) {
if (h->tables[i].name == NULL)
if (tables[i].name == NULL)
continue;
if (strcmp(h->tables[i].name, table) != 0)
if (strcmp(tables[i].name, table) != 0)
continue;
found = true;
break;
}
return found ? &h->tables[i] : NULL;
return found ? &tables[i] : NULL;
}
/* find if built-in table already exists */
const struct builtin_table *
nft_table_builtin_find(struct nft_handle *h, const char *table)
{
return __nft_table_builtin_find(h->tables, table);
}
/* find if built-in chain already exists */
struct builtin_chain *
nft_chain_builtin_find(struct builtin_table *t, const char *chain)
const struct builtin_chain *
nft_chain_builtin_find(const struct builtin_table *t, const char *chain)
{
int i;
bool found = false;
......@@ -671,17 +733,19 @@ nft_chain_builtin_find(struct builtin_table *t, const char *chain)
}
static void nft_chain_builtin_init(struct nft_handle *h,
struct builtin_table *table)
const struct builtin_table *table)
{
struct nftnl_chain_list *list = nft_chain_list_get(h);
struct nftnl_chain_list *list = nft_chain_list_get(h, table->name);
struct nftnl_chain *c;
int i;
if (!list)
return;
/* Initialize built-in chains if they don't exist yet */
for (i=0; i < NF_INET_NUMHOOKS && table->chains[i].name != NULL; i++) {
c = nft_chain_list_find(list, table->name,
table->chains[i].name);
c = nftnl_chain_list_lookup_byname(list, table->chains[i].name);
if (c != NULL)
continue;
......@@ -691,13 +755,13 @@ static void nft_chain_builtin_init(struct nft_handle *h,
static int nft_xt_builtin_init(struct nft_handle *h, const char *table)
{
struct builtin_table *t;
const struct builtin_table *t;
t = nft_table_builtin_find(h, table);
if (t == NULL)
return -1;
if (t->initialized)
if (nft_table_initialized(h, t->type))
return 0;
if (nft_table_builtin_add(h, t) < 0)
......@@ -705,7 +769,7 @@ static int nft_xt_builtin_init(struct nft_handle *h, const char *table)
nft_chain_builtin_init(h, t);
t->initialized = true;
h->cache->table[t->type].initialized = true;
return 0;
}
......@@ -730,11 +794,12 @@ static int nft_restart(struct nft_handle *h)
return -1;
h->portid = mnl_socket_get_portid(h->nl);
nlbuffsiz = 0;
return 0;
}
int nft_init(struct nft_handle *h, struct builtin_table *t)
int nft_init(struct nft_handle *h, const struct builtin_table *t)
{
h->nl = mnl_socket_open(NETLINK_NETFILTER);
if (h->nl == NULL)
......@@ -747,6 +812,7 @@ int nft_init(struct nft_handle *h, struct builtin_table *t)
h->portid = mnl_socket_get_portid(h->nl);
h->tables = t;
h->cache = &h->__cache[0];
INIT_LIST_HEAD(&h->obj_list);
INIT_LIST_HEAD(&h->err_list);
......@@ -756,60 +822,68 @@ int nft_init(struct nft_handle *h, struct builtin_table *t)
static int __flush_rule_cache(struct nftnl_rule *r, void *data)
{
const char *tablename = data;
nftnl_rule_list_del(r);
nftnl_rule_free(r);
if (!strcmp(nftnl_rule_get_str(r, NFTNL_RULE_TABLE), tablename)) {
nftnl_rule_list_del(r);
nftnl_rule_free(r);
}
return 0;
}
static void flush_rule_cache(struct nftnl_chain *c)
{
nftnl_rule_foreach(c, __flush_rule_cache, NULL);
}
static int __flush_chain_cache(struct nftnl_chain *c, void *data)
{
nftnl_chain_list_del(c);
nftnl_chain_free(c);
return 0;
}
static void flush_rule_cache(struct nft_handle *h, const char *tablename)
static int flush_cache(struct nft_cache *c, const struct builtin_table *tables,
const char *tablename)
{
if (!h->rule_cache)
return;
const struct builtin_table *table;
int i;
if (tablename) {
nftnl_rule_list_foreach(h->rule_cache, __flush_rule_cache,
(void *)tablename);
} else {
nftnl_rule_list_free(h->rule_cache);
h->rule_cache = NULL;
table = __nft_table_builtin_find(tables, tablename);
if (!table || !c->table[table->type].chains)
return 0;
nftnl_chain_list_foreach(c->table[table->type].chains,
__flush_chain_cache, NULL);
return 0;
}
}
static int __flush_chain_cache(struct nftnl_chain *c, void *data)
{
const char *tablename = data;
for (i = 0; i < NFT_TABLE_MAX; i++) {
if (tables[i].name == NULL)
continue;
if (!strcmp(nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE), tablename)) {
nftnl_chain_list_del(c);
nftnl_chain_free(c);
if (!c->table[i].chains)
continue;
nftnl_chain_list_free(c->table[i].chains);
c->table[i].chains = NULL;
}
nftnl_table_list_free(c->tables);
c->tables = NULL;
return 0;
return 1;
}
static void flush_chain_cache(struct nft_handle *h, const char *tablename)
{
if (!h->chain_cache)
if (!h->have_cache)
return;
if (tablename) {
nftnl_chain_list_foreach(h->chain_cache, __flush_chain_cache,
(void *)tablename);
} else {
nftnl_chain_list_free(h->chain_cache);
h->chain_cache = NULL;
}
if (flush_cache(h->cache, h->tables, tablename))
h->have_cache = false;
}
void nft_fini(struct nft_handle *h)
{
flush_chain_cache(h, NULL);
flush_rule_cache(h, NULL);
mnl_socket_close(h->nl);
}
......@@ -830,8 +904,8 @@ static struct nftnl_chain *nft_chain_new(struct nft_handle *h,
const struct xt_counters *counters)
{
struct nftnl_chain *c;
struct builtin_table *_t;
struct builtin_chain *_c;
const struct builtin_table *_t;
const struct builtin_chain *_c;
_t = nft_table_builtin_find(h, table);
if (!_t) {
......@@ -1103,37 +1177,11 @@ int add_counters(struct nftnl_rule *r, uint64_t packets, uint64_t bytes)
enum udata_type {
UDATA_TYPE_COMMENT,
UDATA_TYPE_EBTABLES_POLICY,
__UDATA_TYPE_MAX,
};
#define UDATA_TYPE_MAX (__UDATA_TYPE_MAX - 1)
int add_comment(struct nftnl_rule *r, const char *comment)
{
struct nftnl_udata_buf *udata;
uint32_t len;
if (nftnl_rule_get_data(r, NFTNL_RULE_USERDATA, &len))
return -EALREADY;
udata = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN);
if (!udata)
return -ENOMEM;
if (strnlen(comment, 255) == 255)
return -ENOSPC;
if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT, comment))
return -ENOMEM;
nftnl_rule_set_data(r, NFTNL_RULE_USERDATA,
nftnl_udata_buf_data(udata),
nftnl_udata_buf_len(udata));
nftnl_udata_buf_free(udata);
return 0;
}
static int parse_udata_cb(const struct nftnl_udata *attr, void *data)
{
unsigned char *value = nftnl_udata_get(attr);
......@@ -1146,6 +1194,8 @@ static int parse_udata_cb(const struct nftnl_udata *attr, void *data)
if (value[len - 1] != '\0')
return -1;
break;
case UDATA_TYPE_EBTABLES_POLICY:
break;
default:
return 0;
}
......@@ -1196,12 +1246,14 @@ err:
return NULL;
}
static struct nftnl_rule_list *nft_rule_list_get(struct nft_handle *h);
static struct nftnl_chain *
nft_chain_find(struct nft_handle *h, const char *table, const char *chain);
int
nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
void *data, uint64_t handle, bool verbose)
void *data, struct nftnl_rule *ref, bool verbose)
{
struct nftnl_chain *c;
struct nftnl_rule *r;
int type;
......@@ -1215,13 +1267,14 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
if (r == NULL)
return 0;
if (handle > 0) {
nftnl_rule_set(r, NFTNL_RULE_HANDLE, &handle);
if (ref) {
nftnl_rule_set_u64(r, NFTNL_RULE_HANDLE,
nftnl_rule_get_u64(ref, NFTNL_RULE_HANDLE));
type = NFT_COMPAT_RULE_REPLACE;
} else
type = NFT_COMPAT_RULE_APPEND;
if (batch_rule_add(h, type, r) < 0) {
if (batch_rule_add(h, type, r) == NULL) {
nftnl_rule_free(r);
return 0;
}
......@@ -1229,10 +1282,17 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
if (verbose)
h->ops->print_rule(r, 0, FMT_PRINT_RULE);
if (!nft_rule_list_get(h))
return 0;
nftnl_rule_list_add_tail(r, h->rule_cache);
if (ref) {
nftnl_chain_rule_insert_at(r, ref);
nftnl_chain_rule_del(r);
} else {
c = nft_chain_find(h, table, chain);
if (!c) {
errno = ENOENT;
return 0;
}
nftnl_chain_rule_add_tail(r, c);
}
return 1;
}
......@@ -1271,8 +1331,9 @@ nft_rule_print_save(const struct nftnl_rule *r, enum nft_rule_print type,
static int nftnl_chain_list_cb(const struct nlmsghdr *nlh, void *data)
{
struct nft_handle *h = data;
const struct builtin_table *t;
struct nftnl_chain *c;
struct nftnl_chain_list *list = data;
c = nftnl_chain_alloc();
if (c == NULL)
......@@ -1281,7 +1342,12 @@ static int nftnl_chain_list_cb(const struct nlmsghdr *nlh, void *data)
if (nftnl_chain_nlmsg_parse(nlh, c) < 0)
goto out;
nftnl_chain_list_add_tail(c, list);
t = nft_table_builtin_find(h,
nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE));
if (!t)
goto out;
nftnl_chain_list_add_tail(c, h->cache->table[t->type].chains);
return MNL_CB_OK;
out:
......@@ -1290,230 +1356,414 @@ err:
return MNL_CB_OK;
}
struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h)
static int nftnl_table_list_cb(const struct nlmsghdr *nlh, void *data)
{
struct nftnl_table *t;
struct nftnl_table_list *list = data;
t = nftnl_table_alloc();
if (t == NULL)
goto err;
if (nftnl_table_nlmsg_parse(nlh, t) < 0)
goto out;
nftnl_table_list_add_tail(t, list);
return MNL_CB_OK;
out:
nftnl_table_free(t);
err:
return MNL_CB_OK;
}
static int fetch_table_cache(struct nft_handle *h)
{
char buf[16536];
struct nlmsghdr *nlh;
struct nftnl_chain_list *list;
struct nftnl_table_list *list;
int ret;
if (h->chain_cache)
return h->chain_cache;
retry:
list = nftnl_chain_list_alloc();
if (list == NULL) {
errno = ENOMEM;
return NULL;
}
list = nftnl_table_list_alloc();
if (list == NULL)
return 0;
nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, h->family,
nlh = nftnl_rule_nlmsg_build_hdr(buf, NFT_MSG_GETTABLE, h->family,
NLM_F_DUMP, h->seq);
ret = mnl_talk(h, nlh, nftnl_chain_list_cb, list);
if (ret < 0 && errno == EINTR) {
ret = mnl_talk(h, nlh, nftnl_table_list_cb, list);
if (ret < 0 && errno == EINTR)
assert(nft_restart(h) >= 0);
nftnl_chain_list_free(list);
goto retry;
h->cache->tables = list;
return 1;
}
static int fetch_chain_cache(struct nft_handle *h)
{
char buf[16536];
struct nlmsghdr *nlh;
int i, ret;
fetch_table_cache(h);
for (i = 0; i < NFT_TABLE_MAX; i++) {
enum nft_table_type type = h->tables[i].type;
if (!h->tables[i].name)
continue;
h->cache->table[type].chains = nftnl_chain_list_alloc();
if (!h->cache->table[type].chains)
return -1;
}
h->chain_cache = list;
nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, h->family,
NLM_F_DUMP, h->seq);
ret = mnl_talk(h, nlh, nftnl_chain_list_cb, h);
if (ret < 0 && errno == EINTR)
assert(nft_restart(h) >= 0);
return list;
return ret;
}
static const char *policy_name[NF_ACCEPT+1] = {
[NF_DROP] = "DROP",
[NF_ACCEPT] = "ACCEPT",
};
static bool nft_rule_is_policy_rule(struct nftnl_rule *r)
{
const struct nftnl_udata *tb[UDATA_TYPE_MAX + 1] = {};
const void *data;
uint32_t len;
if (!nftnl_rule_is_set(r, NFTNL_RULE_USERDATA))
return false;
int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list,
const char *table)
data = nftnl_rule_get_data(r, NFTNL_RULE_USERDATA, &len);
if (nftnl_udata_parse(data, len, parse_udata_cb, tb) < 0)
return NULL;
if (!tb[UDATA_TYPE_EBTABLES_POLICY] ||
nftnl_udata_get_u32(tb[UDATA_TYPE_EBTABLES_POLICY]) != 1)
return false;
return true;
}
static struct nftnl_rule *nft_chain_last_rule(struct nftnl_chain *c)
{
struct nftnl_chain_list_iter *iter;
struct nft_family_ops *ops;
struct nftnl_chain *c;
struct nftnl_rule *r = NULL, *last;
struct nftnl_rule_iter *iter;
ops = nft_family_ops_lookup(h->family);
iter = nftnl_rule_iter_create(c);
if (!iter)
return NULL;
iter = nftnl_chain_list_iter_create(list);
if (iter == NULL)
return 0;
do {
last = r;
r = nftnl_rule_iter_next(iter);
} while (r);
nftnl_rule_iter_destroy(iter);
c = nftnl_chain_list_iter_next(iter);
while (c != NULL) {
const char *chain_table =
nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
const char *policy = NULL;
return last;
}
if (strcmp(table, chain_table) != 0)
goto next;
static void nft_bridge_chain_postprocess(struct nft_handle *h,
struct nftnl_chain *c)
{
struct nftnl_rule *last = nft_chain_last_rule(c);
struct nftnl_expr_iter *iter;
struct nftnl_expr *expr;
int verdict;
if (nft_chain_builtin(c)) {
uint32_t pol = NF_ACCEPT;
if (!last || !nft_rule_is_policy_rule(last))
return;
if (nftnl_chain_get(c, NFTNL_CHAIN_POLICY))
pol = nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
policy = policy_name[pol];
}
iter = nftnl_expr_iter_create(last);
if (!iter)
return;
if (ops->save_chain)
ops->save_chain(c, policy);
next:
c = nftnl_chain_list_iter_next(iter);
}
expr = nftnl_expr_iter_next(iter);
if (!expr ||
strcmp("counter", nftnl_expr_get_str(expr, NFTNL_EXPR_NAME)))
goto out_iter;
nftnl_chain_list_iter_destroy(iter);
expr = nftnl_expr_iter_next(iter);
if (!expr ||
strcmp("immediate", nftnl_expr_get_str(expr, NFTNL_EXPR_NAME)) ||
!nftnl_expr_is_set(expr, NFTNL_EXPR_IMM_VERDICT))
goto out_iter;
verdict = nftnl_expr_get_u32(expr, NFTNL_EXPR_IMM_VERDICT);
switch (verdict) {
case NF_ACCEPT:
case NF_DROP:
break;
default:
goto out_iter;
}
return 1;
nftnl_chain_set_u32(c, NFTNL_CHAIN_POLICY, verdict);
if (batch_rule_add(h, NFT_COMPAT_RULE_DELETE, last) == NULL)
fprintf(stderr, "Failed to delete old policy rule\n");
nftnl_chain_rule_del(last);
out_iter:
nftnl_expr_iter_destroy(iter);
}
static int nftnl_rule_list_cb(const struct nlmsghdr *nlh, void *data)
{
struct nftnl_chain *c = data;
struct nftnl_rule *r;
struct nftnl_rule_list *list = data;
r = nftnl_rule_alloc();
if (r == NULL)
goto err;
if (nftnl_rule_nlmsg_parse(nlh, r) < 0)
goto out;
return MNL_CB_OK;
nftnl_rule_list_add_tail(r, list);
if (nftnl_rule_nlmsg_parse(nlh, r) < 0) {
nftnl_rule_free(r);
return MNL_CB_OK;
}
return MNL_CB_OK;
out:
nftnl_rule_free(r);
nftnl_rule_list_free(list);
err:
nftnl_chain_rule_add_tail(r, c);
return MNL_CB_OK;
}
static struct nftnl_rule_list *nft_rule_list_get(struct nft_handle *h)
static int nft_rule_list_update(struct nftnl_chain *c, void *data)
{
struct nft_handle *h = data;
char buf[16536];
struct nlmsghdr *nlh;
struct nftnl_rule_list *list;
struct nftnl_rule *rule;
int ret;
if (h->rule_cache)
return h->rule_cache;
rule = nftnl_rule_alloc();
if (!rule)
return -1;
retry:
list = nftnl_rule_list_alloc();
if (list == NULL)
return 0;
nftnl_rule_set_str(rule, NFTNL_RULE_TABLE,
nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE));
nftnl_rule_set_str(rule, NFTNL_RULE_CHAIN,
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME));
nlh = nftnl_rule_nlmsg_build_hdr(buf, NFT_MSG_GETRULE, h->family,
NLM_F_DUMP, h->seq);
nftnl_rule_nlmsg_build_payload(nlh, rule);
ret = mnl_talk(h, nlh, nftnl_rule_list_cb, list);
if (ret < 0) {
if (errno == EINTR) {
assert(nft_restart(h) >= 0);
nftnl_rule_list_free(list);
goto retry;
}
ret = mnl_talk(h, nlh, nftnl_rule_list_cb, c);
if (ret < 0 && errno == EINTR)
assert(nft_restart(h) >= 0);
nftnl_rule_list_free(list);
return NULL;
}
nftnl_rule_free(rule);
if (h->family == NFPROTO_BRIDGE)
nft_bridge_chain_postprocess(h, c);
h->rule_cache = list;
return list;
return 0;
}
int nft_rule_save(struct nft_handle *h, const char *table, unsigned int format)
static int fetch_rule_cache(struct nft_handle *h)
{
struct nftnl_rule_list *list;
struct nftnl_rule_list_iter *iter;
struct nftnl_rule *r;
list = nft_rule_list_get(h);
if (list == NULL)
return 0;
int i;
iter = nftnl_rule_list_iter_create(list);
if (iter == NULL)
return 0;
for (i = 0; i < NFT_TABLE_MAX; i++) {
enum nft_table_type type = h->tables[i].type;
r = nftnl_rule_list_iter_next(iter);
while (r != NULL) {
const char *rule_table =
nftnl_rule_get_str(r, NFTNL_RULE_TABLE);
if (!h->tables[i].name)
continue;
if (strcmp(table, rule_table) != 0)
goto next;
if (nftnl_chain_list_foreach(h->cache->table[type].chains,
nft_rule_list_update, h))
return -1;
}
return 0;
}
nft_rule_print_save(r, NFT_RULE_APPEND, format);
static void __nft_build_cache(struct nft_handle *h)
{
uint32_t genid_start, genid_stop;
next:
r = nftnl_rule_list_iter_next(iter);
retry:
mnl_genid_get(h, &genid_start);
fetch_chain_cache(h);
fetch_rule_cache(h);
h->have_cache = true;
mnl_genid_get(h, &genid_stop);
if (genid_start != genid_stop) {
flush_chain_cache(h, NULL);
goto retry;
}
nftnl_rule_list_iter_destroy(iter);
h->nft_genid = genid_start;
}
/* the core expects 1 for success and 0 for error */
return 1;
void nft_build_cache(struct nft_handle *h)
{
if (!h->have_cache)
__nft_build_cache(h);
}
static void
__nft_rule_flush(struct nft_handle *h, const char *table, const char *chain)
static void __nft_flush_cache(struct nft_handle *h)
{
struct nftnl_rule *r;
if (!h->cache_index) {
h->cache_index++;
h->cache = &h->__cache[h->cache_index];
} else {
flush_chain_cache(h, NULL);
}
}
r = nftnl_rule_alloc();
if (r == NULL)
return;
static void nft_rebuild_cache(struct nft_handle *h)
{
if (h->have_cache)
__nft_flush_cache(h);
nftnl_rule_set(r, NFTNL_RULE_TABLE, (char *)table);
nftnl_rule_set(r, NFTNL_RULE_CHAIN, (char *)chain);
__nft_build_cache(h);
}
if (batch_rule_add(h, NFT_COMPAT_RULE_FLUSH, r) < 0)
nftnl_rule_free(r);
static void nft_release_cache(struct nft_handle *h)
{
if (h->cache_index)
flush_cache(&h->__cache[0], h->tables, NULL);
}
struct chain_user_flush_data {
struct nft_handle *handle;
const char *table;
const char *chain;
struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
const char *table)
{
const struct builtin_table *t;
t = nft_table_builtin_find(h, table);
if (!t)
return NULL;
nft_build_cache(h);
return h->cache->table[t->type].chains;
}
static const char *policy_name[NF_ACCEPT+1] = {
[NF_DROP] = "DROP",
[NF_ACCEPT] = "ACCEPT",
};
static int __nft_chain_user_flush(struct nftnl_chain *c, void *data)
int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list)
{
const char *table_name = nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
const char *chain_name = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
struct chain_user_flush_data *d = data;
struct nft_handle *h = d->handle;
const char *table = d->table;
const char *chain = d->chain;
struct nftnl_chain_list_iter *iter;
struct nft_family_ops *ops;
struct nftnl_chain *c;
if (strcmp(table, table_name) != 0)
return 0;
ops = nft_family_ops_lookup(h->family);
if (strcmp(chain, chain_name) != 0)
iter = nftnl_chain_list_iter_create(list);
if (iter == NULL)
return 0;
if (!nftnl_chain_is_set(c, NFTNL_CHAIN_HOOKNUM))
__nft_rule_flush(h, table, chain);
c = nftnl_chain_list_iter_next(iter);
while (c != NULL) {
const char *policy = NULL;
if (nft_chain_builtin(c)) {
uint32_t pol = NF_ACCEPT;
if (nftnl_chain_get(c, NFTNL_CHAIN_POLICY))
pol = nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
policy = policy_name[pol];
} else if (h->family == NFPROTO_BRIDGE) {
if (nftnl_chain_is_set(c, NFTNL_CHAIN_POLICY)) {
uint32_t pol;
pol = nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
policy = policy_name[pol];
} else {
policy = "RETURN";
}
}
if (ops->save_chain)
ops->save_chain(c, policy);
c = nftnl_chain_list_iter_next(iter);
}
nftnl_chain_list_iter_destroy(iter);
return 1;
}
static int nft_chain_save_rules(struct nft_handle *h,
struct nftnl_chain *c, unsigned int format)
{
struct nftnl_rule_iter *iter;
struct nftnl_rule *r;
iter = nftnl_rule_iter_create(c);
if (iter == NULL)
return 1;
r = nftnl_rule_iter_next(iter);
while (r != NULL) {
nft_rule_print_save(r, NFT_RULE_APPEND, format);
r = nftnl_rule_iter_next(iter);
}
nftnl_rule_iter_destroy(iter);
return 0;
}
int nft_chain_user_flush(struct nft_handle *h, struct nftnl_chain_list *list,
const char *table, const char *chain)
int nft_rule_save(struct nft_handle *h, const char *table, unsigned int format)
{
struct chain_user_flush_data d = {
.handle = h,
.table = table,
.chain = chain,
};
struct nftnl_chain_list_iter *iter;
struct nftnl_chain_list *list;
struct nftnl_chain *c;
int ret = 0;
nft_fn = nft_chain_user_flush;
list = nft_chain_list_get(h, table);
if (!list)
return 0;
nftnl_chain_list_foreach(list, __nft_chain_user_flush, &d);
iter = nftnl_chain_list_iter_create(list);
if (!iter)
return 0;
return 1;
c = nftnl_chain_list_iter_next(iter);
while (c) {
ret = nft_chain_save_rules(h, c, format);
if (ret != 0)
break;
c = nftnl_chain_list_iter_next(iter);
}
nftnl_chain_list_iter_destroy(iter);
/* the core expects 1 for success and 0 for error */
return ret == 0 ? 1 : 0;
}
static void
__nft_rule_flush(struct nft_handle *h, const char *table,
const char *chain, bool verbose, bool implicit)
{
struct obj_update *obj;
struct nftnl_rule *r;
if (verbose)
fprintf(stdout, "Flushing chain `%s'\n", chain);
r = nftnl_rule_alloc();
if (r == NULL)
return;
nftnl_rule_set(r, NFTNL_RULE_TABLE, (char *)table);
nftnl_rule_set(r, NFTNL_RULE_CHAIN, (char *)chain);
obj = batch_rule_add(h, NFT_COMPAT_RULE_FLUSH, r);
if (!obj) {
nftnl_rule_free(r);
return;
}
obj->implicit = implicit;
}
int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table,
......@@ -1529,12 +1779,22 @@ int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table,
nft_fn = nft_rule_flush;
list = nft_chain_list_get(h);
list = nft_chain_list_get(h, table);
if (list == NULL) {
ret = 1;
goto err;
}
if (chain) {
c = nftnl_chain_list_lookup_byname(list, chain);
if (!c)
return 0;
__nft_rule_flush(h, table, chain, verbose, false);
flush_rule_cache(c);
return 1;
}
iter = nftnl_chain_list_iter_create(list);
if (iter == NULL) {
ret = 1;
......@@ -1543,29 +1803,14 @@ int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table,
c = nftnl_chain_list_iter_next(iter);
while (c != NULL) {
const char *table_name =
nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
const char *chain_name =
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
if (strcmp(table, table_name) != 0)
goto next;
if (chain != NULL && strcmp(chain, chain_name) != 0)
goto next;
if (verbose)
fprintf(stdout, "Flushing chain `%s'\n", chain_name);
__nft_rule_flush(h, table_name, chain_name);
if (chain != NULL)
break;
next:
__nft_rule_flush(h, table, chain_name, verbose, false);
flush_rule_cache(c);
c = nftnl_chain_list_iter_next(iter);
}
nftnl_chain_list_iter_destroy(iter);
flush_rule_cache(h, table);
err:
/* the core expects 1 for success and 0 for error */
return ret == 0 ? 1 : 0;
......@@ -1573,6 +1818,7 @@ err:
int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *table)
{
struct nftnl_chain_list *list;
struct nftnl_chain *c;
int ret;
......@@ -1582,125 +1828,138 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
nft_xt_builtin_init(h, table);
if (nft_chain_exists(h, table, chain)) {
errno = EEXIST;
return 0;
}
c = nftnl_chain_alloc();
if (c == NULL)
return 0;
nftnl_chain_set(c, NFTNL_CHAIN_TABLE, (char *)table);
nftnl_chain_set(c, NFTNL_CHAIN_NAME, (char *)chain);
if (h->family == NFPROTO_BRIDGE)
nftnl_chain_set_u32(c, NFTNL_CHAIN_POLICY, NF_ACCEPT);
ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c);
nft_chain_list_get(h);
nftnl_chain_list_add(c, h->chain_cache);
list = nft_chain_list_get(h, table);
if (list)
nftnl_chain_list_add(c, list);
/* the core expects 1 for success and 0 for error */
return ret == 0 ? 1 : 0;
}
/* From linux/netlink.h */
#ifndef NLM_F_NONREC
#define NLM_F_NONREC 0x100 /* Do not delete recursively */
#endif
int nft_chain_user_del(struct nft_handle *h, const char *chain,
const char *table, bool verbose)
int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table)
{
struct nftnl_chain_list *list;
struct nftnl_chain_list_iter *iter;
struct nftnl_chain *c;
int ret = 0;
int deleted_ctr = 0;
nft_fn = nft_chain_user_del;
bool created = false;
int ret;
list = nft_chain_list_get(h);
if (list == NULL)
goto err;
c = nft_chain_find(h, table, chain);
if (c) {
/* Apparently -n still flushes existing user defined
* chains that are redefined.
*/
if (h->noflush)
__nft_rule_flush(h, table, chain, false, true);
} else {
c = nftnl_chain_alloc();
if (!c)
return -1;
iter = nftnl_chain_list_iter_create(list);
if (iter == NULL)
goto err;
nftnl_chain_set(c, NFTNL_CHAIN_TABLE, (char *)table);
nftnl_chain_set(c, NFTNL_CHAIN_NAME, (char *)chain);
created = true;
}
c = nftnl_chain_list_iter_next(iter);
while (c != NULL) {
const char *table_name =
nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
const char *chain_name =
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
if (h->family == NFPROTO_BRIDGE)
nftnl_chain_set_u32(c, NFTNL_CHAIN_POLICY, NF_ACCEPT);
/* don't delete built-in chain */
if (nft_chain_builtin(c))
goto next;
if (!created)
return 0;
if (strcmp(table, table_name) != 0)
goto next;
ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c);
if (chain != NULL && strcmp(chain, chain_name) != 0)
goto next;
list = nft_chain_list_get(h, table);
if (list)
nftnl_chain_list_add(c, list);
if (verbose)
fprintf(stdout, "Deleting chain `%s'\n", chain);
return ret;
}
ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_DEL, c);
/* From linux/netlink.h */
#ifndef NLM_F_NONREC
#define NLM_F_NONREC 0x100 /* Do not delete recursively */
#endif
if (ret < 0)
break;
struct chain_user_del_data {
struct nft_handle *handle;
bool verbose;
int builtin_err;
};
deleted_ctr++;
nftnl_chain_list_del(c);
static int __nft_chain_user_del(struct nftnl_chain *c, void *data)
{
struct chain_user_del_data *d = data;
struct nft_handle *h = d->handle;
int ret;
if (chain != NULL)
break;
next:
c = nftnl_chain_list_iter_next(iter);
}
/* don't delete built-in chain */
if (nft_chain_builtin(c))
return d->builtin_err;
nftnl_chain_list_iter_destroy(iter);
err:
if (d->verbose)
fprintf(stdout, "Deleting chain `%s'\n",
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME));
/* chain not found */
if (chain != NULL && deleted_ctr == 0) {
ret = -1;
errno = ENOENT;
}
/* XXX This triggers a fast lookup from the kernel. */
nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_DEL, c);
if (ret)
return -1;
/* the core expects 1 for success and 0 for error */
return ret == 0 ? 1 : 0;
nftnl_chain_list_del(c);
return 0;
}
struct nftnl_chain *
nft_chain_list_find(struct nftnl_chain_list *list,
const char *table, const char *chain)
int nft_chain_user_del(struct nft_handle *h, const char *chain,
const char *table, bool verbose)
{
struct nftnl_chain_list_iter *iter;
struct chain_user_del_data d = {
.handle = h,
.verbose = verbose,
};
struct nftnl_chain_list *list;
struct nftnl_chain *c;
int ret = 0;
iter = nftnl_chain_list_iter_create(list);
if (iter == NULL)
return NULL;
c = nftnl_chain_list_iter_next(iter);
while (c != NULL) {
const char *table_name =
nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
const char *chain_name =
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
if (strcmp(table, table_name) != 0)
goto next;
nft_fn = nft_chain_user_del;
if (strcmp(chain, chain_name) != 0)
goto next;
list = nft_chain_list_get(h, table);
if (list == NULL)
return 0;
nftnl_chain_list_iter_destroy(iter);
return c;
next:
c = nftnl_chain_list_iter_next(iter);
if (chain) {
c = nftnl_chain_list_lookup_byname(list, chain);
if (!c) {
errno = ENOENT;
return 0;
}
d.builtin_err = -2;
ret = __nft_chain_user_del(c, &d);
if (ret == -2)
errno = EINVAL;
goto out;
}
nftnl_chain_list_iter_destroy(iter);
return NULL;
ret = nftnl_chain_list_foreach(list, __nft_chain_user_del, &d);
out:
/* the core expects 1 for success and 0 for error */
return ret == 0 ? 1 : 0;
}
static struct nftnl_chain *
......@@ -1708,17 +1967,17 @@ nft_chain_find(struct nft_handle *h, const char *table, const char *chain)
{
struct nftnl_chain_list *list;
list = nft_chain_list_get(h);
list = nft_chain_list_get(h, table);
if (list == NULL)
return NULL;
return nft_chain_list_find(list, table, chain);
return nftnl_chain_list_lookup_byname(list, chain);
}
bool nft_chain_exists(struct nft_handle *h,
const char *table, const char *chain)
{
struct builtin_table *t = nft_table_builtin_find(h, table);
const struct builtin_table *t = nft_table_builtin_find(h, table);
/* xtables does not support custom tables */
if (!t)
......@@ -1737,7 +1996,12 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
uint64_t handle;
int ret;
nft_fn = nft_chain_user_add;
nft_fn = nft_chain_user_rename;
if (nft_chain_exists(h, table, newname)) {
errno = EEXIST;
return 0;
}
/* If built-in chains don't exist for this table, create them */
if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
......@@ -1769,56 +2033,17 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
return ret == 0 ? 1 : 0;
}
static int nftnl_table_list_cb(const struct nlmsghdr *nlh, void *data)
{
struct nftnl_table *t;
struct nftnl_table_list *list = data;
t = nftnl_table_alloc();
if (t == NULL)
goto err;
if (nftnl_table_nlmsg_parse(nlh, t) < 0)
goto out;
nftnl_table_list_add_tail(t, list);
return MNL_CB_OK;
out:
nftnl_table_free(t);
err:
return MNL_CB_OK;
}
static struct nftnl_table_list *nftnl_table_list_get(struct nft_handle *h)
{
char buf[16536];
struct nlmsghdr *nlh;
struct nftnl_table_list *list;
int ret;
retry:
list = nftnl_table_list_alloc();
if (list == NULL)
return 0;
nlh = nftnl_rule_nlmsg_build_hdr(buf, NFT_MSG_GETTABLE, h->family,
NLM_F_DUMP, h->seq);
ret = mnl_talk(h, nlh, nftnl_table_list_cb, list);
if (ret < 0 && errno == EINTR) {
assert(nft_restart(h) >= 0);
nftnl_table_list_free(list);
goto retry;
}
nft_build_cache(h);
return list;
return h->cache->tables;
}
bool nft_table_find(struct nft_handle *h, const char *tablename)
{
struct nftnl_table_list *list;
struct nftnl_table_list_iter *iter;
struct nftnl_table_list *list;
struct nftnl_table *t;
bool ret = false;
......@@ -1844,7 +2069,6 @@ bool nft_table_find(struct nft_handle *h, const char *tablename)
}
nftnl_table_list_iter_destroy(iter);
nftnl_table_list_free(list);
err:
return ret;
......@@ -1877,13 +2101,13 @@ int nft_for_each_table(struct nft_handle *h,
}
nftnl_table_list_iter_destroy(iter);
nftnl_table_list_free(list);
return 0;
}
static int __nft_table_flush(struct nft_handle *h, const char *table)
static int __nft_table_flush(struct nft_handle *h, const char *table, bool exists)
{
struct builtin_table *_t;
const struct builtin_table *_t;
struct obj_update *obj;
struct nftnl_table *t;
t = nftnl_table_alloc();
......@@ -1892,14 +2116,20 @@ static int __nft_table_flush(struct nft_handle *h, const char *table)
nftnl_table_set_str(t, NFTNL_TABLE_NAME, table);
batch_table_add(h, NFT_COMPAT_TABLE_FLUSH, t);
obj = batch_table_add(h, NFT_COMPAT_TABLE_FLUSH, t);
if (!obj) {
nftnl_table_free(t);
return -1;
}
if (!exists)
obj->skip = 1;
_t = nft_table_builtin_find(h, table);
assert(_t);
_t->initialized = false;
h->cache->table[_t->type].initialized = false;
flush_chain_cache(h, table);
flush_rule_cache(h, table);
return 0;
}
......@@ -1909,6 +2139,7 @@ int nft_table_flush(struct nft_handle *h, const char *table)
struct nftnl_table_list_iter *iter;
struct nftnl_table_list *list;
struct nftnl_table *t;
bool exists = false;
int ret = 0;
nft_fn = nft_table_flush;
......@@ -1930,26 +2161,17 @@ int nft_table_flush(struct nft_handle *h, const char *table)
const char *table_name =
nftnl_table_get_str(t, NFTNL_TABLE_NAME);
if (strcmp(table_name, table) != 0)
goto next;
if (strcmp(table_name, table) == 0) {
exists = true;
break;
}
ret = __nft_table_flush(h, table);
if (ret < 0)
goto err_table_iter;
next:
t = nftnl_table_list_iter_next(iter);
}
if (!h->rule_cache) {
h->rule_cache = nftnl_rule_list_alloc();
if (h->rule_cache == NULL)
return -1;
}
err_table_iter:
ret = __nft_table_flush(h, table, exists);
nftnl_table_list_iter_destroy(iter);
err_table_list:
nftnl_table_list_free(list);
err_out:
/* the core expects 1 for success and 0 for error */
return ret == 0 ? 1 : 0;
......@@ -1961,15 +2183,14 @@ void nft_table_new(struct nft_handle *h, const char *table)
nft_xt_builtin_init(h, table);
}
static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule_list *list,
struct nftnl_rule *r)
static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule *r)
{
int ret;
struct obj_update *obj;
nftnl_rule_list_del(r);
ret = batch_rule_add(h, NFT_COMPAT_RULE_DELETE, r);
if (ret < 0) {
obj = batch_rule_add(h, NFT_COMPAT_RULE_DELETE, r);
if (!obj) {
nftnl_rule_free(r);
return -1;
}
......@@ -1977,48 +2198,29 @@ static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule_list *list,
}
static struct nftnl_rule *
nft_rule_find(struct nft_handle *h, struct nftnl_rule_list *list,
const char *chain, const char *table, void *data, int rulenum)
nft_rule_find(struct nft_handle *h, struct nftnl_chain *c, void *data, int rulenum)
{
struct nftnl_rule *r;
struct nftnl_rule_list_iter *iter;
int rule_ctr = 0;
struct nftnl_rule_iter *iter;
bool found = false;
iter = nftnl_rule_list_iter_create(list);
if (rulenum >= 0)
/* Delete by rule number case */
return nftnl_rule_lookup_byindex(c, rulenum);
iter = nftnl_rule_iter_create(c);
if (iter == NULL)
return 0;
r = nftnl_rule_list_iter_next(iter);
r = nftnl_rule_iter_next(iter);
while (r != NULL) {
const char *rule_table =
nftnl_rule_get_str(r, NFTNL_RULE_TABLE);
const char *rule_chain =
nftnl_rule_get_str(r, NFTNL_RULE_CHAIN);
if (strcmp(table, rule_table) != 0 ||
strcmp(chain, rule_chain) != 0) {
DEBUGP("different chain / table\n");
goto next;
}
if (rulenum >= 0) {
/* Delete by rule number case */
if (rule_ctr == rulenum) {
found = true;
break;
}
} else {
found = h->ops->rule_find(h->ops, r, data);
if (found)
break;
}
rule_ctr++;
next:
r = nftnl_rule_list_iter_next(iter);
found = h->ops->rule_find(h->ops, r, data);
if (found)
break;
r = nftnl_rule_iter_next(iter);
}
nftnl_rule_list_iter_destroy(iter);
nftnl_rule_iter_destroy(iter);
return found ? r : NULL;
}
......@@ -2026,42 +2228,46 @@ next:
int nft_rule_check(struct nft_handle *h, const char *chain,
const char *table, void *data, bool verbose)
{
struct nftnl_rule_list *list;
struct nftnl_chain *c;
struct nftnl_rule *r;
nft_fn = nft_rule_check;
list = nft_rule_list_get(h);
if (list == NULL)
return 0;
c = nft_chain_find(h, table, chain);
if (!c)
goto fail_enoent;
r = nft_rule_find(h, c, data, -1);
if (r == NULL)
goto fail_enoent;
r = nft_rule_find(h, list, chain, table, data, -1);
if (r == NULL) {
errno = ENOENT;
return 0;
}
if (verbose)
h->ops->print_rule(r, 0, FMT_PRINT_RULE);
return 1;
fail_enoent:
errno = ENOENT;
return 0;
}
int nft_rule_delete(struct nft_handle *h, const char *chain,
const char *table, void *data, bool verbose)
{
int ret = 0;
struct nftnl_chain *c;
struct nftnl_rule *r;
struct nftnl_rule_list *list;
nft_fn = nft_rule_delete;
list = nft_rule_list_get(h);
if (list == NULL)
c = nft_chain_find(h, table, chain);
if (!c) {
errno = ENOENT;
return 0;
}
r = nft_rule_find(h, list, chain, table, data, -1);
r = nft_rule_find(h, c, data, -1);
if (r != NULL) {
ret =__nft_rule_del(h, list, r);
ret =__nft_rule_del(h, r);
if (ret < 0)
errno = ENOMEM;
if (verbose)
......@@ -2075,18 +2281,32 @@ int nft_rule_delete(struct nft_handle *h, const char *chain,
static struct nftnl_rule *
nft_rule_add(struct nft_handle *h, const char *chain,
const char *table, struct iptables_command_state *cs,
uint64_t handle, bool verbose)
struct nftnl_rule *ref, bool verbose)
{
struct nftnl_rule *r;
uint64_t ref_id;
r = nft_rule_new(h, chain, table, cs);
if (r == NULL)
return NULL;
if (handle > 0)
nftnl_rule_set_u64(r, NFTNL_RULE_POSITION, handle);
if (ref) {
ref_id = nftnl_rule_get_u64(ref, NFTNL_RULE_HANDLE);
if (ref_id > 0) {
nftnl_rule_set_u64(r, NFTNL_RULE_POSITION, ref_id);
DEBUGP("adding after rule handle %"PRIu64"\n", ref_id);
} else {
ref_id = nftnl_rule_get_u32(ref, NFTNL_RULE_ID);
if (!ref_id) {
ref_id = ++h->rule_id;
nftnl_rule_set_u32(ref, NFTNL_RULE_ID, ref_id);
}
nftnl_rule_set_u32(r, NFTNL_RULE_POSITION_ID, ref_id);
DEBUGP("adding after rule ID %"PRIu64"\n", ref_id);
}
}
if (batch_rule_add(h, NFT_COMPAT_RULE_INSERT, r) < 0) {
if (!batch_rule_add(h, NFT_COMPAT_RULE_INSERT, r)) {
nftnl_rule_free(r);
return NULL;
}
......@@ -2100,9 +2320,8 @@ nft_rule_add(struct nft_handle *h, const char *chain,
int nft_rule_insert(struct nft_handle *h, const char *chain,
const char *table, void *data, int rulenum, bool verbose)
{
struct nftnl_rule *r, *new_rule;
struct nftnl_rule_list *list;
uint64_t handle = 0;
struct nftnl_rule *r = NULL, *new_rule;
struct nftnl_chain *c;
/* If built-in chains don't exist for this table, create them */
if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
......@@ -2110,40 +2329,36 @@ int nft_rule_insert(struct nft_handle *h, const char *chain,
nft_fn = nft_rule_insert;
if (rulenum > 0) {
list = nft_rule_list_get(h);
if (list == NULL)
goto err;
c = nft_chain_find(h, table, chain);
if (!c) {
errno = ENOENT;
goto err;
}
r = nft_rule_find(h, list, chain, table, data, rulenum);
if (rulenum > 0) {
r = nft_rule_find(h, c, data, rulenum);
if (r == NULL) {
/* special case: iptables allows to insert into
* rule_count + 1 position.
*/
r = nft_rule_find(h, list, chain, table, data,
rulenum - 1);
r = nft_rule_find(h, c, data, rulenum - 1);
if (r != NULL)
return nft_rule_append(h, chain, table, data,
0, verbose);
NULL, verbose);
errno = ENOENT;
errno = E2BIG;
goto err;
}
handle = nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE);
DEBUGP("adding after rule handle %"PRIu64"\n", handle);
} else {
nft_rule_list_get(h);
}
new_rule = nft_rule_add(h, chain, table, data, handle, verbose);
new_rule = nft_rule_add(h, chain, table, data, r, verbose);
if (!new_rule)
goto err;
if (handle)
nftnl_rule_list_insert_at(new_rule, r);
if (r)
nftnl_chain_rule_insert_at(new_rule, r);
else
nftnl_rule_list_add(new_rule, h->rule_cache);
nftnl_chain_rule_add(new_rule, c);
return 1;
err:
......@@ -2154,23 +2369,25 @@ int nft_rule_delete_num(struct nft_handle *h, const char *chain,
const char *table, int rulenum, bool verbose)
{
int ret = 0;
struct nftnl_chain *c;
struct nftnl_rule *r;
struct nftnl_rule_list *list;
nft_fn = nft_rule_delete_num;
list = nft_rule_list_get(h);
if (list == NULL)
c = nft_chain_find(h, table, chain);
if (!c) {
errno = ENOENT;
return 0;
}
r = nft_rule_find(h, list, chain, table, NULL, rulenum);
r = nft_rule_find(h, c, NULL, rulenum);
if (r != NULL) {
DEBUGP("deleting rule by number %d\n", rulenum);
ret = __nft_rule_del(h, list, r);
ret = __nft_rule_del(h, r);
if (ret < 0)
errno = ENOMEM;
} else
errno = ENOENT;
errno = E2BIG;
return ret;
}
......@@ -2179,117 +2396,106 @@ int nft_rule_replace(struct nft_handle *h, const char *chain,
const char *table, void *data, int rulenum, bool verbose)
{
int ret = 0;
struct nftnl_chain *c;
struct nftnl_rule *r;
struct nftnl_rule_list *list;
nft_fn = nft_rule_replace;
list = nft_rule_list_get(h);
if (list == NULL)
c = nft_chain_find(h, table, chain);
if (!c) {
errno = ENOENT;
return 0;
}
r = nft_rule_find(h, list, chain, table, data, rulenum);
r = nft_rule_find(h, c, data, rulenum);
if (r != NULL) {
DEBUGP("replacing rule with handle=%llu\n",
(unsigned long long)
nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE));
nftnl_rule_list_del(r);
ret = nft_rule_append(h, chain, table, data,
nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE),
verbose);
ret = nft_rule_append(h, chain, table, data, r, verbose);
} else
errno = ENOENT;
errno = E2BIG;
return ret;
}
static int
__nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
__nft_rule_list(struct nft_handle *h, struct nftnl_chain *c,
int rulenum, unsigned int format,
void (*cb)(struct nftnl_rule *r, unsigned int num,
unsigned int format))
{
struct nftnl_rule_list *list;
struct nftnl_rule_list_iter *iter;
struct nftnl_rule_iter *iter;
struct nftnl_rule *r;
int rule_ctr = 0;
list = nft_rule_list_get(h);
if (list == NULL)
return 0;
if (rulenum > 0) {
r = nftnl_rule_lookup_byindex(c, rulenum - 1);
if (!r)
/* iptables-legacy returns 0 when listing for
* valid chain but invalid rule number
*/
return 1;
cb(r, rulenum, format);
return 1;
}
iter = nftnl_rule_list_iter_create(list);
iter = nftnl_rule_iter_create(c);
if (iter == NULL)
return 0;
r = nftnl_rule_list_iter_next(iter);
r = nftnl_rule_iter_next(iter);
while (r != NULL) {
const char *rule_table =
nftnl_rule_get_str(r, NFTNL_RULE_TABLE);
const char *rule_chain =
nftnl_rule_get_str(r, NFTNL_RULE_CHAIN);
if (strcmp(table, rule_table) != 0 ||
strcmp(chain, rule_chain) != 0)
goto next;
rule_ctr++;
if (rulenum > 0 && rule_ctr != rulenum) {
/* List by rule number case */
goto next;
}
cb(r, rule_ctr, format);
if (rulenum > 0)
break;
next:
r = nftnl_rule_list_iter_next(iter);
cb(r, ++rule_ctr, format);
r = nftnl_rule_iter_next(iter);
}
nftnl_rule_list_iter_destroy(iter);
nftnl_rule_iter_destroy(iter);
return 1;
}
static int nft_rule_count(struct nft_handle *h,
const char *chain, const char *table)
static int nft_rule_count(struct nft_handle *h, struct nftnl_chain *c)
{
struct nftnl_rule_list_iter *iter;
struct nftnl_rule_list *list;
struct nftnl_rule_iter *iter;
struct nftnl_rule *r;
int rule_ctr = 0;
list = nft_rule_list_get(h);
if (list == NULL)
return 0;
iter = nftnl_rule_list_iter_create(list);
iter = nftnl_rule_iter_create(c);
if (iter == NULL)
return 0;
r = nftnl_rule_list_iter_next(iter);
r = nftnl_rule_iter_next(iter);
while (r != NULL) {
const char *rule_table =
nftnl_rule_get_str(r, NFTNL_RULE_TABLE);
const char *rule_chain =
nftnl_rule_get_str(r, NFTNL_RULE_CHAIN);
if (strcmp(table, rule_table) != 0 ||
strcmp(chain, rule_chain) != 0)
goto next;
rule_ctr++;
next:
r = nftnl_rule_list_iter_next(iter);
r = nftnl_rule_iter_next(iter);
}
nftnl_rule_list_iter_destroy(iter);
nftnl_rule_iter_destroy(iter);
return rule_ctr;
}
static void __nft_print_header(struct nft_handle *h,
const struct nft_family_ops *ops,
struct nftnl_chain *c, unsigned int format)
{
const char *chain_name = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
bool basechain = !!nftnl_chain_get(c, NFTNL_CHAIN_HOOKNUM);
uint32_t refs = nftnl_chain_get_u32(c, NFTNL_CHAIN_USE);
uint32_t entries = nft_rule_count(h, c);
struct xt_counters ctrs = {
.pcnt = nftnl_chain_get_u64(c, NFTNL_CHAIN_PACKETS),
.bcnt = nftnl_chain_get_u64(c, NFTNL_CHAIN_BYTES),
};
const char *pname = NULL;
if (nftnl_chain_is_set(c, NFTNL_CHAIN_POLICY))
pname = policy_name[nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY)];
ops->print_header(format, chain_name, pname,
&ctrs, basechain, refs - entries, entries);
}
int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
int rulenum, unsigned int format)
{
......@@ -2300,16 +2506,8 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
bool found = false;
/* If built-in chains don't exist for this table, create them */
if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0) {
if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
nft_xt_builtin_init(h, table);
/* Force table and chain creation, otherwise first iptables -L
* lists no table/chains.
*/
if (!list_empty(&h->obj_list)) {
nft_commit(h);
flush_chain_cache(h, NULL);
}
}
ops = nft_family_ops_lookup(h->family);
......@@ -2318,75 +2516,43 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
return 0;
}
if (chain && rulenum) {
__nft_rule_list(h, chain, table,
rulenum, format, ops->print_rule);
list = nft_chain_list_get(h, table);
if (!list)
return 0;
if (chain) {
c = nftnl_chain_list_lookup_byname(list, chain);
if (!c)
return 0;
if (!rulenum) {
if (ops->print_table_header)
ops->print_table_header(table);
__nft_print_header(h, ops, c, format);
}
__nft_rule_list(h, c, rulenum, format, ops->print_rule);
return 1;
}
list = nft_chain_list_get(h);
iter = nftnl_chain_list_iter_create(list);
if (iter == NULL)
goto err;
return 0;
if (!chain && ops->print_table_header)
if (ops->print_table_header)
ops->print_table_header(table);
c = nftnl_chain_list_iter_next(iter);
while (c != NULL) {
const char *chain_table =
nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
const char *chain_name =
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
uint32_t policy =
nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
uint32_t refs =
nftnl_chain_get_u32(c, NFTNL_CHAIN_USE);
struct xt_counters ctrs = {
.pcnt = nftnl_chain_get_u64(c, NFTNL_CHAIN_PACKETS),
.bcnt = nftnl_chain_get_u64(c, NFTNL_CHAIN_BYTES),
};
bool basechain = false;
uint32_t entries;
if (nftnl_chain_get(c, NFTNL_CHAIN_HOOKNUM))
basechain = true;
if (strcmp(table, chain_table) != 0)
goto next;
if (chain) {
if (strcmp(chain, chain_name) != 0)
goto next;
else if (ops->print_table_header)
ops->print_table_header(table);
}
if (found)
printf("\n");
entries = nft_rule_count(h, chain_name, table);
ops->print_header(format, chain_name, policy_name[policy],
&ctrs, basechain, refs - entries, entries);
__nft_rule_list(h, chain_name, table,
rulenum, format, ops->print_rule);
__nft_print_header(h, ops, c, format);
__nft_rule_list(h, c, rulenum, format, ops->print_rule);
found = true;
/* we printed the chain we wanted, stop processing. */
if (chain)
break;
next:
c = nftnl_chain_list_iter_next(iter);
}
nftnl_chain_list_iter_destroy(iter);
err:
if (chain && !found)
return 0;
return 1;
}
......@@ -2396,50 +2562,44 @@ list_save(struct nftnl_rule *r, unsigned int num, unsigned int format)
nft_rule_print_save(r, NFT_RULE_APPEND, format);
}
static int
nftnl_rule_list_chain_save(struct nft_handle *h, const char *chain,
const char *table, struct nftnl_chain_list *list,
int counters)
static int __nftnl_rule_list_chain_save(struct nftnl_chain *c, void *data)
{
struct nftnl_chain_list_iter *iter;
struct nftnl_chain *c;
const char *chain_name = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
uint32_t policy = nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
int *counters = data;
iter = nftnl_chain_list_iter_create(list);
if (iter == NULL)
if (!nft_chain_builtin(c)) {
printf("-N %s\n", chain_name);
return 0;
}
c = nftnl_chain_list_iter_next(iter);
while (c != NULL) {
const char *chain_table =
nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
const char *chain_name =
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
uint32_t policy =
nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
/* this is a base chain */
if (strcmp(table, chain_table) != 0 ||
(chain && strcmp(chain, chain_name) != 0))
goto next;
printf("-P %s %s", chain_name, policy_name[policy]);
if (*counters)
printf(" -c %"PRIu64" %"PRIu64,
nftnl_chain_get_u64(c, NFTNL_CHAIN_PACKETS),
nftnl_chain_get_u64(c, NFTNL_CHAIN_BYTES));
printf("\n");
return 0;
}
/* this is a base chain */
if (nft_chain_builtin(c)) {
printf("-P %s %s", chain_name, policy_name[policy]);
if (counters) {
printf(" -c %"PRIu64" %"PRIu64"\n",
nftnl_chain_get_u64(c, NFTNL_CHAIN_PACKETS),
nftnl_chain_get_u64(c, NFTNL_CHAIN_BYTES));
} else
printf("\n");
} else {
printf("-N %s\n", chain_name);
}
next:
c = nftnl_chain_list_iter_next(iter);
}
static int
nftnl_rule_list_chain_save(struct nft_handle *h, const char *chain,
struct nftnl_chain_list *list, int counters)
{
struct nftnl_chain *c;
nftnl_chain_list_iter_destroy(iter);
if (chain) {
c = nftnl_chain_list_lookup_byname(list, chain);
if (!c)
return 0;
__nftnl_rule_list_chain_save(c, &counters);
return 1;
}
nftnl_chain_list_foreach(list, __nftnl_rule_list_chain_save, &counters);
return 1;
}
......@@ -2453,62 +2613,46 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain,
int ret = 0;
/* If built-in chains don't exist for this table, create them */
if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0) {
if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
nft_xt_builtin_init(h, table);
/* Force table and chain creation, otherwise first iptables -L
* lists no table/chains.
*/
if (!list_empty(&h->obj_list)) {
nft_commit(h);
flush_chain_cache(h, NULL);
}
}
if (!nft_is_table_compatible(h, table)) {
xtables_error(OTHER_PROBLEM, "table `%s' is incompatible, use 'nft' tool.\n", table);
return 0;
}
list = nft_chain_list_get(h);
/* Dump policies and custom chains first */
if (!rulenum)
nftnl_rule_list_chain_save(h, chain, table, list, counters);
/* Now dump out rules in this table */
iter = nftnl_chain_list_iter_create(list);
if (iter == NULL)
goto err;
list = nft_chain_list_get(h, table);
if (!list)
return 0;
/* Dump policies and custom chains first */
if (!rulenum)
nftnl_rule_list_chain_save(h, chain, list, counters);
if (counters < 0)
format = FMT_C_COUNTS;
else if (counters == 0)
format = FMT_NOCOUNTS;
c = nftnl_chain_list_iter_next(iter);
while (c != NULL) {
const char *chain_table =
nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
const char *chain_name =
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
if (chain) {
c = nftnl_chain_list_lookup_byname(list, chain);
if (!c)
return 0;
if (strcmp(table, chain_table) != 0)
goto next;
if (chain && strcmp(chain, chain_name) != 0)
goto next;
return __nft_rule_list(h, c, rulenum, format, list_save);
}
ret = __nft_rule_list(h, chain_name, table, rulenum,
format, list_save);
/* Now dump out rules in this table */
iter = nftnl_chain_list_iter_create(list);
if (iter == NULL)
return 0;
/* we printed the chain we wanted, stop processing. */
if (chain)
break;
next:
c = nftnl_chain_list_iter_next(iter);
while (c != NULL) {
ret = __nft_rule_list(h, c, rulenum, format, list_save);
c = nftnl_chain_list_iter_next(iter);
}
nftnl_chain_list_iter_destroy(iter);
err:
return ret;
}
......@@ -2516,17 +2660,17 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain,
const char *table, int rulenum)
{
struct iptables_command_state cs = {};
struct nftnl_rule_list *list;
struct nftnl_chain *c;
struct nftnl_rule *r;
int ret = 0;
nft_fn = nft_rule_delete;
list = nft_rule_list_get(h);
if (list == NULL)
c = nft_chain_find(h, table, chain);
if (!c)
return 0;
r = nft_rule_find(h, list, chain, table, NULL, rulenum);
r = nft_rule_find(h, c, NULL, rulenum);
if (r == NULL) {
errno = ENOENT;
ret = 1;
......@@ -2537,9 +2681,7 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain,
cs.counters.pcnt = cs.counters.bcnt = 0;
ret = nft_rule_append(h, chain, table, &cs,
nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE),
false);
ret = nft_rule_append(h, chain, table, &cs, r, false);
error:
return ret;
......@@ -2589,8 +2731,8 @@ static void batch_obj_del(struct nft_handle *h, struct obj_update *o)
break;
case NFT_COMPAT_CHAIN_ZERO:
case NFT_COMPAT_CHAIN_USER_ADD:
break;
case NFT_COMPAT_CHAIN_ADD:
break;
case NFT_COMPAT_CHAIN_USER_DEL:
case NFT_COMPAT_CHAIN_USER_FLUSH:
case NFT_COMPAT_CHAIN_UPDATE:
......@@ -2611,6 +2753,71 @@ static void batch_obj_del(struct nft_handle *h, struct obj_update *o)
free(o);
}
static void nft_refresh_transaction(struct nft_handle *h)
{
const char *tablename, *chainname;
const struct nftnl_chain *c;
struct obj_update *n, *tmp;
bool exists;
h->error.lineno = 0;
list_for_each_entry_safe(n, tmp, &h->obj_list, head) {
if (n->implicit) {
batch_obj_del(h, n);
continue;
}
switch (n->type) {
case NFT_COMPAT_TABLE_FLUSH:
tablename = nftnl_table_get_str(n->table, NFTNL_TABLE_NAME);
if (!tablename)
continue;
exists = nft_table_find(h, tablename);
if (exists)
n->skip = 0;
else
n->skip = 1;
break;
case NFT_COMPAT_CHAIN_USER_ADD:
tablename = nftnl_chain_get_str(n->chain, NFTNL_CHAIN_TABLE);
if (!tablename)
continue;
chainname = nftnl_chain_get_str(n->chain, NFTNL_CHAIN_NAME);
if (!chainname)
continue;
if (!h->noflush)
break;
c = nft_chain_find(h, tablename, chainname);
if (c) {
/* -restore -n flushes existing rules from redefined user-chain */
__nft_rule_flush(h, tablename,
chainname, false, true);
n->skip = 1;
} else if (!c) {
n->skip = 0;
}
break;
case NFT_COMPAT_TABLE_ADD:
case NFT_COMPAT_CHAIN_ADD:
case NFT_COMPAT_CHAIN_ZERO:
case NFT_COMPAT_CHAIN_USER_DEL:
case NFT_COMPAT_CHAIN_USER_FLUSH:
case NFT_COMPAT_CHAIN_UPDATE:
case NFT_COMPAT_CHAIN_RENAME:
case NFT_COMPAT_RULE_APPEND:
case NFT_COMPAT_RULE_INSERT:
case NFT_COMPAT_RULE_REPLACE:
case NFT_COMPAT_RULE_DELETE:
case NFT_COMPAT_RULE_FLUSH:
break;
}
}
}
static int nft_action(struct nft_handle *h, int action)
{
struct obj_update *n, *tmp;
......@@ -2618,14 +2825,21 @@ static int nft_action(struct nft_handle *h, int action)
unsigned int buflen, i, len;
bool show_errors = true;
char errmsg[1024];
uint32_t seq = 1;
uint32_t seq;
int ret = 0;
retry:
seq = 1;
h->batch = mnl_batch_init();
mnl_batch_begin(h->batch, seq++);
mnl_batch_begin(h->batch, h->nft_genid, seq++);
h->nft_genid++;
list_for_each_entry(n, &h->obj_list, head) {
if (n->skip)
continue;
n->seq = seq++;
switch (n->type) {
case NFT_COMPAT_TABLE_ADD:
......@@ -2702,7 +2916,20 @@ static int nft_action(struct nft_handle *h, int action)
break;
}
errno = 0;
ret = mnl_batch_talk(h->nl, h->batch, &h->err_list);
if (ret && errno == ERESTART) {
nft_rebuild_cache(h);
nft_refresh_transaction(h);
i=0;
list_for_each_entry_safe(err, ne, &h->err_list, head)
mnl_err_list_free(err);
mnl_batch_reset(h->batch);
goto retry;
}
i = 0;
buflen = sizeof(errmsg);
......@@ -2726,6 +2953,7 @@ static int nft_action(struct nft_handle *h, int action)
batch_obj_del(h, n);
}
nft_release_cache(h);
mnl_batch_reset(h->batch);
if (i)
......@@ -2734,8 +2962,111 @@ static int nft_action(struct nft_handle *h, int action)
return ret == 0 ? 1 : 0;
}
static int ebt_add_policy_rule(struct nftnl_chain *c, void *data)
{
uint32_t policy = nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
struct iptables_command_state cs = {
.eb.bitmask = EBT_NOPROTO,
};
struct nftnl_udata_buf *udata;
struct nft_handle *h = data;
struct nftnl_rule *r;
const char *pname;
if (nftnl_chain_get(c, NFTNL_CHAIN_HOOKNUM))
return 0; /* ignore base chains */
if (!nftnl_chain_is_set(c, NFTNL_CHAIN_POLICY))
return 0;
nftnl_chain_unset(c, NFTNL_CHAIN_POLICY);
switch (policy) {
case NFT_RETURN:
return 0; /* return policy is default for nft chains */
case NF_ACCEPT:
pname = "ACCEPT";
break;
case NF_DROP:
pname = "DROP";
break;
default:
return -1;
}
command_jump(&cs, pname);
r = nft_rule_new(h, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME),
nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE), &cs);
if (!r)
return -1;
udata = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN);
if (!udata)
return -1;
if (!nftnl_udata_put_u32(udata, UDATA_TYPE_EBTABLES_POLICY, 1))
return -1;
nftnl_rule_set_data(r, NFTNL_RULE_USERDATA,
nftnl_udata_buf_data(udata),
nftnl_udata_buf_len(udata));
nftnl_udata_buf_free(udata);
if (!batch_rule_add(h, NFT_COMPAT_RULE_APPEND, r)) {
nftnl_rule_free(r);
return -1;
}
return 0;
}
int ebt_set_user_chain_policy(struct nft_handle *h, const char *table,
const char *chain, const char *policy)
{
struct nftnl_chain *c = nft_chain_find(h, table, chain);
int pval;
if (!c)
return 0;
if (!strcmp(policy, "DROP"))
pval = NF_DROP;
else if (!strcmp(policy, "ACCEPT"))
pval = NF_ACCEPT;
else if (!strcmp(policy, "RETURN"))
pval = NFT_RETURN;
else
return 0;
nftnl_chain_set_u32(c, NFTNL_CHAIN_POLICY, pval);
return 1;
}
static void nft_bridge_commit_prepare(struct nft_handle *h)
{
const struct builtin_table *t;
struct nftnl_chain_list *list;
int i;
for (i = 0; i < NFT_TABLE_MAX; i++) {
t = &h->tables[i];
if (!t->name)
continue;
list = h->cache->table[t->type].chains;
if (!list)
continue;
nftnl_chain_list_foreach(list, ebt_add_policy_rule, h);
}
}
int nft_commit(struct nft_handle *h)
{
if (h->family == NFPROTO_BRIDGE)
nft_bridge_commit_prepare(h);
return nft_action(h, NFT_COMPAT_COMMIT);
}
......@@ -2744,6 +3075,27 @@ int nft_abort(struct nft_handle *h)
return nft_action(h, NFT_COMPAT_ABORT);
}
int nft_abort_policy_rule(struct nft_handle *h, const char *table)
{
struct obj_update *n, *tmp;
list_for_each_entry_safe(n, tmp, &h->obj_list, head) {
if (n->type != NFT_COMPAT_RULE_APPEND &&
n->type != NFT_COMPAT_RULE_DELETE)
continue;
if (strcmp(table,
nftnl_rule_get_str(n->rule, NFTNL_RULE_TABLE)))
continue;
if (!nft_rule_is_policy_rule(n->rule))
continue;
batch_obj_del(h, n);
}
return 0;
}
int nft_compatible_revision(const char *name, uint8_t rev, int opt)
{
struct mnl_socket *nl;
......@@ -2830,10 +3182,11 @@ const char *nft_strerror(int err)
{ nft_chain_user_del, EMLINK,
"Can't delete chain with references left" },
{ nft_chain_user_add, EEXIST, "Chain already exists" },
{ nft_rule_insert, ENOENT, "Index of insertion too big" },
{ nft_chain_user_rename, EEXIST, "File exists" },
{ nft_rule_insert, E2BIG, "Index of insertion too big" },
{ nft_rule_check, ENOENT, "Bad rule (does a matching rule exist in that chain?)" },
{ nft_rule_replace, ENOENT, "Index of replacement too big" },
{ nft_rule_delete_num, ENOENT, "Index of deletion too big" },
{ nft_rule_replace, E2BIG, "Index of replacement too big" },
{ nft_rule_delete_num, E2BIG, "Index of deletion too big" },
/* { TC_READ_COUNTER, E2BIG, "Index of counter too big" },
{ TC_ZERO_COUNTER, E2BIG, "Index of counter too big" }, */
/* ENOENT for DELETE probably means no matching rule */
......@@ -2992,41 +3345,41 @@ int nft_xtables_config_load(struct nft_handle *h, const char *filename,
return h->config_done;
}
static void nft_chain_zero_rule_counters(struct nft_handle *h,
struct nftnl_chain *c)
struct chain_zero_data {
struct nft_handle *handle;
bool verbose;
};
static int __nft_chain_zero_counters(struct nftnl_chain *c, void *data)
{
struct nftnl_rule_list_iter *iter;
struct nftnl_rule_list *list;
const char *table_name;
const char *chain_name;
struct chain_zero_data *d = data;
struct nft_handle *h = d->handle;
struct nftnl_rule_iter *iter;
struct nftnl_rule *r;
list = nft_rule_list_get(h);
if (list == NULL)
return;
iter = nftnl_rule_list_iter_create(list);
if (iter == NULL)
return;
if (d->verbose)
fprintf(stdout, "Zeroing chain `%s'\n",
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME));
if (nftnl_chain_is_set(c, NFTNL_CHAIN_HOOKNUM)) {
/* zero base chain counters. */
nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, 0);
nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, 0);
nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
if (batch_chain_add(h, NFT_COMPAT_CHAIN_ZERO, c))
return -1;
}
table_name = nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
chain_name = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
iter = nftnl_rule_iter_create(c);
if (iter == NULL)
return -1;
r = nftnl_rule_list_iter_next(iter);
r = nftnl_rule_iter_next(iter);
while (r != NULL) {
struct nftnl_expr_iter *ei;
const char *table_chain;
const char *rule_chain;
struct nftnl_expr *e;
bool zero_needed;
table_chain = nftnl_rule_get_str(r, NFTNL_RULE_TABLE);
if (strcmp(table_chain, table_name))
goto next;
rule_chain = nftnl_rule_get_str(r, NFTNL_RULE_CHAIN);
if (strcmp(rule_chain, chain_name))
goto next;
ei = nftnl_expr_iter_create(r);
if (!ei)
break;
......@@ -3055,67 +3408,45 @@ static void nft_chain_zero_rule_counters(struct nft_handle *h,
* rule based on its handle only.
*/
nftnl_rule_unset(r, NFTNL_RULE_POSITION);
batch_rule_add(h, NFT_COMPAT_RULE_REPLACE, r);
if (!batch_rule_add(h, NFT_COMPAT_RULE_REPLACE, r)) {
nftnl_rule_iter_destroy(iter);
return -1;
}
}
next:
r = nftnl_rule_list_iter_next(iter);
r = nftnl_rule_iter_next(iter);
}
nftnl_rule_list_iter_destroy(iter);
nftnl_rule_iter_destroy(iter);
return 0;
}
int nft_chain_zero_counters(struct nft_handle *h, const char *chain,
const char *table, bool verbose)
{
struct nftnl_chain_list *list;
struct nftnl_chain_list_iter *iter;
struct chain_zero_data d = {
.handle = h,
.verbose = verbose,
};
struct nftnl_chain *c;
int ret = 0;
list = nft_chain_list_get(h);
list = nft_chain_list_get(h, table);
if (list == NULL)
goto err;
iter = nftnl_chain_list_iter_create(list);
if (iter == NULL)
goto err;
c = nftnl_chain_list_iter_next(iter);
while (c != NULL) {
const char *chain_name =
nftnl_chain_get(c, NFTNL_CHAIN_NAME);
const char *chain_table =
nftnl_chain_get(c, NFTNL_CHAIN_TABLE);
if (strcmp(table, chain_table) != 0)
goto next;
if (chain != NULL && strcmp(chain, chain_name) != 0)
goto next;
if (verbose)
fprintf(stdout, "Zeroing chain `%s'\n", chain_name);
if (nftnl_chain_is_set(c, NFTNL_CHAIN_HOOKNUM)) {
/* zero base chain counters. */
nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, 0);
nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, 0);
if (chain) {
c = nftnl_chain_list_lookup_byname(list, chain);
if (!c) {
errno = ENOENT;
return 0;
}
nft_chain_zero_rule_counters(h, c);
nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
ret = batch_chain_add(h, NFT_COMPAT_CHAIN_ZERO, c);
if (chain != NULL)
break;
next:
c = nftnl_chain_list_iter_next(iter);
ret = __nft_chain_zero_counters(c, &d);
goto err;
}
nftnl_chain_list_iter_destroy(iter);
ret = nftnl_chain_list_foreach(list, __nft_chain_zero_counters, &d);
err:
/* the core expects 1 for success and 0 for error */
return ret == 0 ? 1 : 0;
......@@ -3143,7 +3474,7 @@ static const char *supported_exprs[NFT_COMPAT_EXPR_MAX] = {
};
static int nft_is_expr_compatible(const struct nftnl_expr *expr)
static int nft_is_expr_compatible(struct nftnl_expr *expr, void *data)
{
const char *name = nftnl_expr_get_str(expr, NFTNL_EXPR_NAME);
int i;
......@@ -3158,143 +3489,60 @@ static int nft_is_expr_compatible(const struct nftnl_expr *expr)
nftnl_expr_get_u32(expr, NFTNL_EXPR_LIMIT_FLAGS) == 0)
return 0;
return 1;
return -1;
}
static bool nft_is_rule_compatible(struct nftnl_rule *rule)
static int nft_is_rule_compatible(struct nftnl_rule *rule, void *data)
{
struct nftnl_expr_iter *iter;
struct nftnl_expr *expr;
bool compatible = false;
iter = nftnl_expr_iter_create(rule);
if (iter == NULL)
return false;
expr = nftnl_expr_iter_next(iter);
while (expr != NULL) {
if (nft_is_expr_compatible(expr) == 0) {
expr = nftnl_expr_iter_next(iter);
continue;
}
compatible = true;
break;
}
nftnl_expr_iter_destroy(iter);
return compatible;
return nftnl_expr_foreach(rule, nft_is_expr_compatible, NULL);
}
static int nft_is_chain_compatible(const struct nft_handle *h,
const struct nftnl_chain *chain)
static int nft_is_chain_compatible(struct nftnl_chain *c, void *data)
{
const char *table, *name, *type, *cur_table;
struct builtin_chain *chains;
int i, j, prio;
const struct builtin_table *table;
const struct builtin_chain *chain;
const char *tname, *cname, *type;
struct nft_handle *h = data;
enum nf_inet_hooks hook;
int prio;
table = nftnl_chain_get(chain, NFTNL_CHAIN_TABLE);
name = nftnl_chain_get(chain, NFTNL_CHAIN_NAME);
type = nftnl_chain_get(chain, NFTNL_CHAIN_TYPE);
prio = nftnl_chain_get_u32(chain, NFTNL_CHAIN_PRIO);
hook = nftnl_chain_get_u32(chain, NFTNL_CHAIN_HOOKNUM);
for (i = 0; i < NFT_TABLE_MAX; i++) {
cur_table = h->tables[i].name;
chains = h->tables[i].chains;
if (!cur_table || strcmp(table, cur_table) != 0)
continue;
for (j = 0; j < NF_INET_NUMHOOKS && chains[j].name; j++) {
if (strcmp(name, chains[j].name) != 0)
continue;
if (strcmp(type, chains[j].type) == 0 &&
prio == chains[j].prio &&
hook == chains[j].hook)
return 0;
break;
}
}
return 1;
}
if (nftnl_rule_foreach(c, nft_is_rule_compatible, NULL))
return -1;
static int nft_are_chains_compatible(struct nft_handle *h, const char *tablename)
{
struct nftnl_chain_list *list;
struct nftnl_chain_list_iter *iter;
struct nftnl_chain *chain;
int ret = 0;
if (!nft_chain_builtin(c))
return 0;
list = nft_chain_list_get(h);
if (list == NULL)
tname = nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
table = nft_table_builtin_find(h, tname);
if (!table)
return -1;
iter = nftnl_chain_list_iter_create(list);
if (iter == NULL)
cname = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
chain = nft_chain_builtin_find(table, cname);
if (!chain)
return -1;
chain = nftnl_chain_list_iter_next(iter);
while (chain != NULL) {
const char *chain_table;
chain_table = nftnl_chain_get_str(chain, NFTNL_CHAIN_TABLE);
if (strcmp(chain_table, tablename) ||
!nft_chain_builtin(chain))
goto next;
ret = nft_is_chain_compatible(h, chain);
if (ret != 0)
break;
next:
chain = nftnl_chain_list_iter_next(iter);
}
nftnl_chain_list_iter_destroy(iter);
type = nftnl_chain_get_str(c, NFTNL_CHAIN_TYPE);
prio = nftnl_chain_get_u32(c, NFTNL_CHAIN_PRIO);
hook = nftnl_chain_get_u32(c, NFTNL_CHAIN_HOOKNUM);
if (strcmp(type, chain->type) ||
prio != chain->prio ||
hook != chain->hook)
return -1;
return ret;
return 0;
}
bool nft_is_table_compatible(struct nft_handle *h, const char *tablename)
{
struct nftnl_rule_list *list;
struct nftnl_rule_list_iter *iter;
struct nftnl_rule *rule;
int ret = 0;
struct nftnl_chain_list *clist;
if (!nft_table_builtin_find(h, tablename))
clist = nft_chain_list_get(h, tablename);
if (clist == NULL)
return false;
ret = nft_are_chains_compatible(h, tablename);
if (ret != 0)
if (nftnl_chain_list_foreach(clist, nft_is_chain_compatible, h))
return false;
list = nft_rule_list_get(h);
if (list == NULL)
return true;
iter = nftnl_rule_list_iter_create(list);
if (iter == NULL)
return true;
rule = nftnl_rule_list_iter_next(iter);
while (rule != NULL) {
const char *table = nftnl_rule_get_str(rule, NFTNL_RULE_TABLE);
if (strcmp(table, tablename))
goto next_rule;
ret = nft_is_rule_compatible(rule);
if (ret != 0)
break;
next_rule:
rule = nftnl_rule_list_iter_next(iter);
}
nftnl_rule_list_iter_destroy(iter);
return ret == 0;
return true;
}
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment