summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * libip6t_hbh: use guided option parserJan Engelhardt2011-04-061-39/+22
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libip6t_dst: use guided option parserJan Engelhardt2011-04-061-41/+20
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libip[6]t_REJECT: use guided option parserJan Engelhardt2011-04-062-58/+48
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxtables: XTTYPE_STRING supportJan Engelhardt2011-04-062-0/+27
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_esp: use guided option parserJan Engelhardt2011-04-061-79/+16
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libip6t_frag: use guided option parserJan Engelhardt2011-04-061-109/+36
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libip[6]t_ah: use guided option parserJan Engelhardt2011-04-062-158/+43
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxtables: XTTYPE_UINT32RC supportJan Engelhardt2011-04-062-2/+59
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libip[6]t_hl: use guided option parserJan Engelhardt2011-04-062-133/+82
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libip[6]t_HL: use guided option parserJan Engelhardt2011-04-062-137/+84
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxtables: XTTYPE_UINT8 supportJan Engelhardt2011-04-062-1/+11
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | Merge branch 'opts' of git://dev.medozas.de/iptablesPatrick McHardy2011-04-1213-333/+695
|\|
| * libxt_cluster: use guided option parserJan Engelhardt2011-04-061-139/+48
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxtables: min-max option supportJan Engelhardt2011-04-062-0/+8
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_cpu: use guided option parserJan Engelhardt2011-04-061-49/+16
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxtables: XTTYPE_UINT32 supportJan Engelhardt2011-04-062-3/+27
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_CONNSECMARK: use guided option parserJan Engelhardt2011-04-061-36/+23
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxtables: provide better final_checkJan Engelhardt2011-04-064-28/+63
| | | | | | | | | | | | | | | | This passes the per-extension data block to the new x6_fcheck function pointer, which can then do last alterations without using hacks like global variables (think libxt_statistic). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_socket: use guided option parserJan Engelhardt2011-04-061-14/+15
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_CHECKSUM: use guided option parserJan Engelhardt2011-04-061-32/+14
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxtables: guided option parserJan Engelhardt2011-04-067-54/+501
| | | | | | | | | | | | | | | | | | | | | | This patchset seeks to drastically reduce the code in the individual extensions by centralizing their argument parsing (breakdown of strings), validation, and in part, assignment. As a secondary goal, this reduces the number of static storage duration variables in flight. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * extensions: add missing checks for specific flags (2)Jan Engelhardt2011-04-061-1/+3
| | | | | | | | | | | | | | Addendum to v1.4.10-75-g4e5d4bf. It does not make sense to use ipv6header's --soft without specifying any options. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | Merge branch 'master' of vishnu.netfilter.org:/data/git/iptablesPatrick McHardy2011-04-121-4/+3
|\ \
| * | Fix set match/target direction parserJozsef Kadlecsik2011-04-091-4/+3
| | | | | | | | | | | | | | | The direction parser did not catch when more src/dst direction parameters were supplied than allowed.
* | | doc: avoid duplicate entries in manpageJan Engelhardt2011-04-061-2/+2
|/ / | | | | | | | | | | | | | | | | Commit v1.4.9-35-gd4105ad changed from [A-Z] and [a-z] to use [[:alnum:]], which unfortunately drew matches into the target section, and targets into the match section. [[:upper:]] and [[:lower:]] should have been used instead, of course. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | convert ip6?tables-multi to actually use their own header filesMaciej Zenczykowski2011-04-052-9/+2
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | move 'int line' definition from ip6?tables.c into xtables.cMaciej Zenczykowski2011-04-053-12/+6
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | v6: rename do_command() to do_command6()Maciej Zenczykowski2011-04-041-2/+2
| | | | | | | | | | | | | | | | (actually only applies to two comments, since the function has long been called do_command6) Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | v4: rename do_command() to do_command4()Maciej Zenczykowski2011-04-045-8/+8
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | v6: rename print_rule() to print_rule6()Maciej Zenczykowski2011-04-043-4/+4
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | v4: rename print_rule() to print_rule4()Maciej Zenczykowski2011-04-043-4/+4
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | v6: rename delete_chain() to delete_chain6()Maciej Zenczykowski2011-04-043-5/+5
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | v4: rename delete_chain() to delete_chain4()Maciej Zenczykowski2011-04-043-5/+5
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | v6: rename flush_entries() to flush_entries6()Maciej Zenczykowski2011-04-043-5/+5
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | v4: rename flush_entries() to flush_entries4()Maciej Zenczykowski2011-04-043-5/+5
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | v6: rename for_each_chain() to for_each_chain6()Maciej Zenczykowski2011-04-043-7/+7
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | v4: rename for_each_chain() to for_each_chain4()Maciej Zenczykowski2011-04-043-7/+7
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | xtables.h: init_extensions() no longer existsMaciej Zenczykowski2011-04-041-1/+0
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | v6: rename init_extensions() to init_extensions6()Maciej Zenczykowski2011-04-045-5/+6
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | v4: rename init_extensions() to init_extensions4()Maciej Zenczykowski2011-04-045-5/+6
| | | | | | | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | xtables: delay (statically built) match/target initializationMaciej Zenczykowski2011-04-041-5/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Matches and targets built into the iptables static binary will always be registered as the binary starts up, this may potentially (as a result of kernel version support checking) result in modules being autoloaded. This is undesirable (for example it may cause CONNMARK target to load and thus cause the kernel to load the conntrack module, which isn't a no-op). Transition to a system where matches and targets are registered into a pending list, from whence they get fully registered only when required. Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | xtables_ip6addr_to_numeric: fix typo in commentMaciej Zenczykowski2011-04-041-1/+1
|/ | | | | | | | | | An IPv6 address consists of eight hexadecimal 16-bit values seperated by colons, or alternatively, six (not five) of these followed by a colon and an IPv4 address in standard dotted decimal quad notation (for IPv4 mapped addresses and the like). Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* mark newly opened fds as FD_CLOEXEC (close on exec)Maciej Zenczykowski2011-04-047-6/+17
| | | | | | | (This is iptables-1.4.3.1-cloexec.patch from RedHat iptables.src.rpm) Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* man pages: allow underscores in match and target namesMaciej Zenczykowski2011-04-041-2/+2
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: documentation for iptables and ip6tables "security" tablesMark Montague2011-04-044-4/+32
| | | | | | | | Add documentation for the iptables and ip6tables "security" tables. Based on http://lwn.net/Articles/267140/ and kernel source. Signed-off-by: Mark Montague <mark@catseye.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: add manual page section for AUDIT targetThomas Graf2011-03-161-0/+14
| | | | | Signed-off-by: Thomas Graf <tgraf@redhat.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: add -C to check for existing rulesStefan Tomanek2011-03-089-21/+162
| | | | | | | | | | | | | | | | | It is often useful to check whether a specific rule is already present in a chain without actually modifying the iptables config. Services like fail2ban usually employ techniques like grepping through the output of "iptables -L" which is quite error prone. This patch adds a new operation -C to the iptables command which mostly works like -D; it can detect and indicate the existence of the specified rule by modifying the exit code. The new operation TC_CHECK_ENTRY uses the same code as the -D operation, whose functions got a dry-run parameter appended. Signed-off-by: Stefan Tomanek <stefan.tomanek@wertarbyte.de> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* ip(6)tables-multi: unify subcommand handlingStefan Tomanek2011-03-074-72/+73
| | | | | | | | | | I found the subcommand handling and naming done by iptables-multi and ip6tables-multi very confusing and complicated; this patch reorganizes the subcommands in a single table, allowing both variants of them to be used (iptables/main) and also prints a list of the allowed commands if an unknown command is entered by the user. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: add VERSION section to manpagesJan Engelhardt2011-03-012-0/+6
| | | | | | | | This shall make it easier to identify outdated HTML renditions on the interwebs, since many of them do not display the .TH header like man(1) does. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix an inversionJan Engelhardt2011-03-011-1/+1
| | | | | | | | | | | Revisiting the original condition (viewable in git log -1 -p v1.4.10-57-gacef604), one can notice an unforuntate inversion. This commit corrects this. Testcase: -A INPUT -p tcp --dport 1 Reported-by: Florian Westphal Signed-off-by: Jan Engelhardt <jengelh@medozas.de>