summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Renames libipt_NOTRACK.c to libxt_NOTRACK.cYasuyuki KOZAKAI2007-07-242-1/+2
|
* Use unified API in NOTRACK target.Yasuyuki KOZAKAI2007-07-241-16/+15
|
* Moves all declarations in iptables_common.h to xtables.h.Yasuyuki KOZAKAI2007-07-246-41/+32
|
* Installs libxt_*.so to DEST_IPT_LIBIDR and link libip[6]t_*.so to it.Yasuyuki KOZAKAI2007-07-241-0/+26
|
* Introduces DEST_IPT_LIBDIR to simplify $(DESTDIR)$(LIBDIR)/iptablesYasuyuki KOZAKAI2007-07-242-8/+10
|
* Fixes warning on compilation, part 2Yasuyuki KOZAKAI2007-07-246-29/+46
| | | | | | | | | | This changes the type of arguments as follows in multiport, DNAT, SNAT, MASQUERADE, and REDIRECT - ip[6]t_ip[6] * -> void * - ip[6]t_entry * -> void * and adds lines to cast these pointer with intended type.
* Fixes warning on compilation of ip6tables matches/targetsYasuyuki KOZAKAI2007-07-2436-107/+107
| | | | | | This changes the type of arguments as follows - ip6t_ip6 * -> void * - ip6t_entry * -> void *
* Fixes warning on compilation of iptables matches/targetsYasuyuki KOZAKAI2007-07-2460-177/+177
| | | | | | | | | This changes the type of arguments as follows - ipt_ip * -> void * - ipt_entry * -> void * This patch doesn't change multiport, DNAT, SNAT, MASQUERADE, REDIRECT because these need more changes (casting void * variable with intended type)
* Replaces ip6t_entry_* with xt_entry_* in matches/targetsYasuyuki KOZAKAI2007-07-2434-128/+127
|
* Replaces ipt_entry_* with xt_entry_* in matches/targetsYasuyuki KOZAKAI2007-07-2464-237/+237
|
* Moves IPPROTO_* and IP[6]T_LIB_DIR definitions to xtables.hYasuyuki KOZAKAI2007-07-243-22/+16
|
* Moves some duplicated functions in ip[6]tables.c to xtables.cYasuyuki KOZAKAI2007-07-247-230/+120
| | | | | string_to_number_ll, string_to_number_l, string_to_number, service_to_port, parse_port, parse_interface, are moved.
* Introduces xtables match/target registrationYasuyuki KOZAKAI2007-07-2411-875/+728
| | | | | | | | | | | | | | | | | | | | | | | - moves lib_dir to xtables.c - introduces struct pfinfo which has protocol family dependent infomations. - unifies load_ip[6]tables_ko() and moves them as load_xtables_ko() - introduces xt_{match,match_rule,target,tryload} and replaces ip[6]t_* with them - unifies following functions and move them to xtables.c - find_{match,find_target} - compatible_revision, compatible_{match,target}_revision - introduces xtables_register_{match,target} and make register_{match,target}[6] call them. xtables_register_* register ONLY matches/targets matched protocol family Some concepts: - source compatibility for libip[6]t_xxx.c with warning on compilation not binary compatibility. - binary compatibility between 2.4/2.6 kernel and iptables/ip6tables, of cause. - xtables is enough to support only one address family at runtime. Then xtables keeps infomations of only the focused address famiy in struct afinfo.
* Moves ip[6]tables_insmod() to xtables.c as xtables_insmod()Yasuyuki KOZAKAI2007-07-248-167/+94
|
* Moves common fw_malloc() and fw_calloc() to xtables.cYasuyuki KOZAKAI2007-07-244-48/+35
|
* Adds xtables.[ch] and change Makefile to compile itYasuyuki KOZAKAI2007-07-243-7/+30
|
* iptables-xmlSam Liddicott2007-07-173-3/+117
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Attached are: 1. A man page for iptables-xml 2. A fix for iptables.xslt allowing for an arbitrary depth of arguments or modifiers. Although iptables-xml cannot generate more than two levels deep, xml generated by other systems may prefer to generate <action> <restore-mark> <mask>0xff00</mask> </restore-mark> </action> than <action> <restore-mark/> <mask>0xff00</mask> </action> (which is what iptables-xml generates) even though the same iptables is re-generated on conversion. 3. A fix for iptables-xml.c so that combining of consecutive targets of rules with the same match into one XML rule, will not combine over a terminating action; i.e. there is no point in converting -A table -p tcp -j DROP -A table -p tcp -j MARK --set-mark 25 -A table -p tcp -j RETURN into one XML rule with multiple actions as they are probably not logically combined in the mind of the author. Signed-off by: Sam Liddicott <azez@ufomechanic.net>
* Ignore generated filesPatrick McHardyYasuyuki KOZAKAI2007-07-160-0/+0
|
* Adds missing explanations about FIN in mask part of '--syn' in libip[6]_tcp.cPatrick McHardyYasuyuki KOZAKAI2007-07-163-3/+3
| | | | and libip6t_tcp.man.
* Adds missing FIN to mask part generated by '--syn' of libip6t_tcpYasuyuki KOZAKAI2007-07-162-2/+2
|
* Change default KERNEL_DIR location and add KBUILD_OUTPUT (Sven Wegener ↵Sven Wegener2007-07-151-2/+8
| | | | <sven.wegener@stealer.net>)
* Fixes compile error of connlimit where NO_SHARED_LIBS=1 is specifiedYasuyuki KOZAKAI2007-07-132-2/+2
|
* PATCH: Add connlimit to iptables.Jan Engelhardt2007-07-096-2/+352
| | | | Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
* libipt_statistic: add a few missing validity checksNicolas Bouliane2007-07-031-0/+9
| | | | Signed-off-by: Nicolas Bouliane
* Removes KERNEL_64_USERSPACE_32Yasuyuki KOZAKAI2007-06-306-124/+0
| | | | | | | The recent kernel has compat layer for iptables. It doesn't have compat layer for libipq and ip6tables, but ip6tables with KERNEL_64_USERSPACE_32 is still broken. We should fix kernel instead of fixing them if and when we want use their 32bit binary with 64bit kernel.
* Removes some KERNEL_64_USERSPACE_32 because linux 2.6 has compat layerYasuyuki KOZAKAI2007-06-2816-167/+3
|
* Fix "iptables getsockopt failed strangely" when querying revisions for ↵Patrick McHardy2007-06-262-2/+2
| | | | | | non-existant matches and targets Reported by Joseph Jezak <josejx@gentoo.org>.
* Add Jozsef's TRACE target.Patrick McHardy2007-06-255-2/+148
| | | | | Changed to be built unconditionally by myself since it doesn't need any headerfiles anyways.
* bump versionv1.3.8Pablo Neira Ayuso2007-06-251-2/+2
|
* Fixes build error of conntrack match because of missing ip_conntrack_tuple.hYasuyuki KOZAKAI2007-06-241-1/+0
| | | | | in linux 2.6.22. It is not needed because nf_conntrack headers can be used instead.
* A white space fix in ip6tables.cYasuyuki KOZAKAI2007-06-121-1/+1
|
* '-p all' and '-p 0' should be allowed. And actually ip6tables in kernelYasuyuki KOZAKAI2007-06-111-7/+6
| | | | | allows '! -p xxx' where xxx is extension header. It matches all valid IPv6 packets.
* libipt_hashlimit doc updateJan Engelhardt2007-06-031-2/+2
| | | | | | Add srcip,srcport to hashlimit manpage. Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
* Add --random option to DNAT and REDIRECT targets and fix the manpage mess ↵Patrick McHardy2007-05-297-27/+76
| | | | this option left behind.
* Use posix conform directory existance check (Roy Marples <uberlord@gentoo.org>)Roy Marples2007-05-101-1/+1
| | | | | | Makefile uses [ -a /dir ] which is invalid on non bash shells Bugzilla #569
* Fix missing newlines in iptables-save/restore output (Pavol Rusnak ↵Pavel Rusnak2007-05-104-6/+6
| | | | | | <prusnak@suse.cz>) Bugzilla #568
* update quota manpage for SMP (Phil Oester)Phil Oester2007-05-021-1/+0
| | | | | The quota match works fine on SMP, so update the manpage to reflect this. Closes bugzilla #564.
* In fixing bug #446 [1], the output for unspecified proto was changed from ↵Phil Oester2007-04-302-0/+2
| | | | "all" to "0". This reverts to the original behaviour, and closes bugzilla #543. (Phil Oester)
* Fix iptables-save with --random optionPatrick McHardy2007-04-183-3/+14
|
* Remove unnecessary IP_NAT_RANGE_PROTO_RANDOM ifdefs.Patrick McHardy2007-04-183-45/+7
|
* Remove libnsl from LDLIBSPatrick McHardy2007-04-181-1/+1
| | | | Bugzilla 557
* fix problem with iptables-restore and quotes (close bugzilla id 505)Pablo Neira Ayuso2007-04-181-15/+32
|
* Use nf_conntrack headers instead of ip_conntrack ones and add sanitized ↵Patrick McHardy2007-04-1816-12/+308
| | | | versions.
* Remove unnecessary ip_conntrack/ip_nat includesPatrick McHardy2007-04-182-2/+0
|
* revert some slipped through patchesPablo Neira AyusoMaurice van der Pot2007-04-162-33/+16
|
* prepare conntrack and conntrackd merge: rename conntrack to conntrack-toolsPablo Neira Ayuso2007-04-162-16/+33
|
* Fix iptables --modprobe parameter (Maurice van der Pot <griffon26@kfk4ever.com>)Pablo Neira AyusoMaurice van der Pot2007-04-161-1/+1
| | | | | | Supply modprobe parameter to iptables_insmod function. Bugzilla #556
* ip6tables-restore should output error of modprobe if failed to loadYasuyuki KOZAKAI2007-03-201-1/+1
| | | | ip6tables.ko after failed to initialize handle.
* Fixes typos in the argument of ip[6]tables_insmod: quit -> quietYasuyuki KOZAKAI2007-03-204-12/+14
|
* Supress error message from modprobe on checking revision.Yasuyuki KOZAKAI2007-03-136-22/+34
|