summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add UDPLITE multiport supportPatrick McHardy2007-01-115-3/+14
|
* Fix missing space in ruleset listingPatrick McHardy2007-01-111-1/+1
|
* Remove extensions for unmaintained/obsolete patchletsPatrick McHardy2007-01-1065-5009/+2
|
* Fix greedy debug grepPatrick McHardy2007-01-101-1/+1
| | | | | | | | | | | | | | | | | | | | | From Bugzilla #527: if you have a kernel with say a '-g' in it, then KERNEL_DIR will include the '-g' in it, CFLAGS will include the '-g' in it, and then the grep will think you have -g in your CFLAGS for example, if you use the grsec or gentoo patchset: $ uname -r 2.6.19.1-grsec $ uname -r 2.6.19-gentoo-r2 then your CFLAGS will look like: -O2 -Wall -Wunused -I"/lib/modules/2.6.19.1-grsec/build"/include -Iinclude/ -DIPTABLES_VERSION=\"1.3.7\" and the greedy check grep will incorrectly flag this: egrep -e '-g|-pg|IPTC_DEBUG'
* fix typo in manpage (thomas@aktaia.intevation.org)thomas2007-01-071-1/+1
|
* Move extensions for pom patches to individual patchlets.Patrick McHardy2006-12-1218-1337/+1
|
* fix compile/install error for iptables-xml with DO_MULTI=1 (Lutz Jaenicke)Lutz Jaenicke2006-12-095-8/+13
|
* Bump version to 1.3.7v1.3.7Patrick McHardy2006-12-041-2/+2
|
* Add target extensions for new NFLOG targetPatrick McHardy2006-12-034-0/+326
|
* Fix iptables-save not printing -s !0/0 and -d !0/0 as well as ip6tablesPatrick McHardy2006-12-022-2/+2
| | | | unnecessarily printing the address. Base on patch by Daniel De Graaf.
* Fix /etc/network usage (Pablo Neira)Pablo Neira Ayuso2006-11-293-36/+36
| | | | | | | | | | | | | | | | | | | | | | http://bugs.debian.org/398082 iptables 1.3.5 and 1.3.6 appear to read /etc/networks, but the information is lost somewhere with 1.3.6. # cat /etc/networks foonet 10.0.0.0 # strace -s 255 -o /tmp/foo iptables -v -A INPUT -s foonet/8 -j ACCEPT #1.3.5 [1] ACCEPT all opt -- in * out * 10.0.0.0/8 -> 0.0.0.0/0 # strace -s 255 -o /tmp/bar iptables -v -A INPUT -s foonet/8 -j ACCEPT #1.3.6 [2] iptables v1.3.6: host/network `foonet.0.0.0' not found Try `iptables -h' or 'iptables --help' for more information. 1. http://people.debian.org/~ljlane/stuff/strace-iptables-1.3.5.txt 2. http://people.debian.org/~ljlane/stuff/strace-iptables-1.3.6.txt
* Fix -E (rename) in iptables/ip6tablesKrzysztof Piotr Oledzki2006-11-142-2/+0
| | | | | | | | | | Remove ununsed CHECK entry in commands_v_options. It makes -E (rename) working again - generic_opt_check expects options for RENAME not for CHECK at that table index. Signed-off-by: Krzysztof Piotr Oledzki <ole@ans.pl> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Use /lib/modules/$(uname -r)/build instead of /usr/src/linux as KERNEL_DIR ↵Patrick McHardy2006-11-141-1/+1
| | | | default
* Add ip6tables support for hashlimit matchPatrick McHardy2006-11-132-0/+372
|
* Add iptables-xml tool (Amin Azez <azez@ufomechanic.net>)Amin Azez2006-11-133-3/+1012
|
* Add ip6tables support for sctp matchPatrick McHardy2006-11-132-0/+553
|
* load ip_[6]tables.ko just before checking revision support in kernel.Yasuyuki KOZAKAI2006-11-134-4/+40
|
* changes IP6T_SO_GET_REVISION_{MATCH,TARGET} to 68,69Yasuyuki KOZAKAI2006-11-131-2/+2
| | | | 66 and 67 is conflicted with IPv6 Advanced API in kernel <= 2.6.18.
* - Add revision support to ip6tables.Rémi Denis-Courmont2006-10-204-4/+324
| | | | | - Add support port range match to libip6t_multiport (R?mi Denis-Courmont <rdenis@simphalempin.com>)
* Fix spelling errorPatrick McHardy2006-10-111-1/+1
|
* iptables segfaults when given "" to --log-prefix (Mike Frysinger ↵Mike Frysinger2006-10-103-0/+16
| | | | | | <vapier@gentoo.org>) Bugzilla #516
* Add endian annotation types to fix compilation for kernels > 2.6.18Patrick McHardy2006-10-091-0/+5
|
* Version number was not bumped in Makefile in svnv1.3.6Joszef Kadlecsik2006-10-091-2/+2
|
* Use correct types at error reporting (patch sent by H. Nakano)Joszef Kadlecsik2006-10-061-2/+2
|
* Use negative-list for "weird character in interface" warning instead of ↵Patrick McHardy2006-09-202-7/+7
| | | | warning for basically every non-alphanumeric character.
* Named realm (Simon Lodal <simon@parknet.dk>)Simon Lodal2006-09-022-13/+158
| | | | Optionally read realm values from /etc/iproute2/rt_realms
* Add statistic match extensionPatrick McHardy2006-08-312-0/+177
|
* iptables: fix ipt_MARK documentation (Eric Leblond)Eric Leblond2006-08-291-1/+8
| | | | | This patch documents --or-mask and --and-mask options of the MARK target. Description is directly taken from the source code.
* iptables -Z clears the per-rule counters, but not the chain policy counters ↵Andy Gay2006-08-221-0/+3
| | | | | | (Andy Gay <andy@andynet.net>) https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=502
* update quota match for xtables + fix -D bug (Phil Oester <kernel@linuxace.com>)Phil Oester2006-08-082-7/+8
|
* Revert "proto_to_name duplication" patch, as noticed by Yasuyuki it can causePatrick McHardyJesper Brouer2006-07-253-5/+20
| | | | invalid arguments to get accepted.
* proto_to_name duplication (Phil Oester <kernel@linuxace.com>)Phil Oester2006-07-223-20/+5
| | | | | Update multiport match to use the iptables version of proto_to_name instead of reinventing the wheel.
* BUG: libiptc chain references bug (Jesper Brouer <hawk@diku.dk>)Patrick McHardyJesper Brouer2006-07-251-0/+8
| | | | | | | | | Correcting a chain references increment bug in libiptc. The bug lies in function iptc_delete_entry() / TC_DELETE_ENTRY. The problem is the construction of "r" the rule entry, that is used for comparison. The problem is that the function iptcc_map_target() increase the target chains references count.
* reduce parse_*_port duplication (Phil Oester <kernel@linuxace.com>)Phil Oester2006-07-2013-137/+46
| | | | | The below patch (dependent upon my 'reduce service_to_port duplication' patch) centralizes the parse_*_port functions into parse_port.
* reduce service_to_port duplication (Phil Oester <kernel@linuxace.com>)Phil Oester2006-07-2013-105/+30
| | | | | The service_to_port function is used in a number of places, and could benefit from some centralization instead of being duplicated everywhere.
* Use gcc to build shared objects (Phil Oester <kernel@linuxace.com>)Phil Oester2006-07-203-2/+4
| | | | | | | | | | | | As suggested by Dmitry Levin and included in Fedora Core releases, use gcc instead of ld to link shared objects. Fedora rpm notes refer to this fixing a plugin problem, but does not offer specifics. But in any event, 'gcc -dumpspecs' does show gcc will pass a number of parameters which in theory it thinks are better. Compile tested both with and without NO_SHARED_LIBS. Closes bug #454.
* iptables: handle cidr notation more sanely (Phil Oester <kernel@linuxace.com>)Phil Oester2006-07-101-0/+30
| | | | | | | | | | | | | | | | At present, a command such as iptables -A foo -s 10.10/16 will interpret 10.10/16 as 10.0.0.10/16, and after applying the mask end up with 10.0.0.0/16, which likely isn't what the user intended. Yet some people do expect 10.10 (without the cidr notation) to end up as 10.0.0.10. The below patch should satisfy all parties. It zero pads the missing octets only in the cidr case, leaving the IP untouched otherwise. This resolves bug #422
* please kill santa-claus (Pierre-Yves Ritschard <pierre-yves@spootnik.org>)Pierre-Yves Ritschard2006-07-051-1/+0
| | | | Remove "hoho" message :)
* libiptc symbols clash (Phil Oester <kernel@linuxace.com>)Phil Oester2006-07-052-0/+4
| | | | | As reported by Dmitry Levin, the TC_NUM_RULES and TC_GET_RULE exports clash. His patch below, resolving bug #456
* - force user to specify --icmpv6-type if icmpv6 match is required to loadYasuyuki KOZAKAI2006-07-042-1/+11
| | | | | | - Don't allow multiple --icmp-type/icmpv6-type (Closes: #461)
* ip6tables multiport does not support x:y (Phil Oester <kernel@linuxace.com>)Phil Oester2006-07-031-5/+4
| | | | | | | | | | Update the manpage for ip6tables multiport match to reflect reality -- it does not (yet) support x:y syntax. I looked at adding it, but adding revision support to ip6tables seems a waste at this point, since once xtables support is added to iptables, this problem will resolve itself. Closes bug #451.
* iptables trivial compile warning cleanup (Phil Oester <kernel@linuxace.com>)Phil Oester2006-07-032-4/+6
| | | | | | | | | | | Cleanup a few compile warnings in latest snapshot: extensions/libipt_dscp_helper.c:69: warning: 'dscp_to_name' defined but not used extensions/libipt_sctp.c: In function 'print_chunks': extensions/libipt_sctp.c:465: warning: value computed is not used extensions/libipt_sctp.c:477: warning: value computed is not used Resolves bug #457.
* size_t changed to socklen_t in getsockopt callJoszef Kadlecsik2006-06-231-3/+3
|
* set match negation bug fixedJoszef Kadlecsik2006-06-232-3/+3
|
* REDIRECT does not accept IP (Phil Oester <kernel@linuxace.com>)Phil Oester2006-06-201-0/+3
| | | | | | As pointed out by Nicolas Mailhot in bugzilla #483, REDIRECT does not accept an IP address and when supplied with one, provides unexpected results. Patch below fixes this.
* Add new exit value to indicate concurrency issues (Jesper Dangaard Brouer ↵Jesper Dangaard Brouer2006-06-192-2/+7
| | | | <hawk@comx.dk>)
* trivial connlimit manpage fix (Phil Oester <kernel@linuxace.com>)Phil Oester2006-05-291-2/+2
|
* Use lowercase letters for match name (Simon Lodal <simonl@parknet.dk>)Simon Lodal2006-05-241-4/+4
|
* Add information about :<port> syntax (Evan Miller <evanm@frap.net>)Evan Miller2006-05-241-2/+3
|
* secmark: Add libip6t_CONNSECMARKJames Morris2006-05-243-1/+140
| | | | | | | This patch adds the shared library module for the CONNSECMARK target (IPv6). Signed-off-by: James Morris <jmorris@namei.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-10 21:35:38 +0000