summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* xtables_ip6addr_to_numeric: fix typo in commentMaciej Zenczykowski2011-04-041-1/+1
| | | | | | | | | | An IPv6 address consists of eight hexadecimal 16-bit values seperated by colons, or alternatively, six (not five) of these followed by a colon and an IPv4 address in standard dotted decimal quad notation (for IPv4 mapped addresses and the like). Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* mark newly opened fds as FD_CLOEXEC (close on exec)Maciej Zenczykowski2011-04-047-6/+17
| | | | | | | (This is iptables-1.4.3.1-cloexec.patch from RedHat iptables.src.rpm) Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* man pages: allow underscores in match and target namesMaciej Zenczykowski2011-04-041-2/+2
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: documentation for iptables and ip6tables "security" tablesMark Montague2011-04-044-4/+32
| | | | | | | | Add documentation for the iptables and ip6tables "security" tables. Based on http://lwn.net/Articles/267140/ and kernel source. Signed-off-by: Mark Montague <mark@catseye.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: add manual page section for AUDIT targetThomas Graf2011-03-161-0/+14
| | | | | Signed-off-by: Thomas Graf <tgraf@redhat.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: add -C to check for existing rulesStefan Tomanek2011-03-089-21/+162
| | | | | | | | | | | | | | | | | It is often useful to check whether a specific rule is already present in a chain without actually modifying the iptables config. Services like fail2ban usually employ techniques like grepping through the output of "iptables -L" which is quite error prone. This patch adds a new operation -C to the iptables command which mostly works like -D; it can detect and indicate the existence of the specified rule by modifying the exit code. The new operation TC_CHECK_ENTRY uses the same code as the -D operation, whose functions got a dry-run parameter appended. Signed-off-by: Stefan Tomanek <stefan.tomanek@wertarbyte.de> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* ip(6)tables-multi: unify subcommand handlingStefan Tomanek2011-03-074-72/+73
| | | | | | | | | | I found the subcommand handling and naming done by iptables-multi and ip6tables-multi very confusing and complicated; this patch reorganizes the subcommands in a single table, allowing both variants of them to be used (iptables/main) and also prints a list of the allowed commands if an unknown command is entered by the user. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: add VERSION section to manpagesJan Engelhardt2011-03-012-0/+6
| | | | | | | | This shall make it easier to identify outdated HTML renditions on the interwebs, since many of them do not display the .TH header like man(1) does. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix an inversionJan Engelhardt2011-03-011-1/+1
| | | | | | | | | | | Revisiting the original condition (viewable in git log -1 -p v1.4.10-57-gacef604), one can notice an unforuntate inversion. This commit corrects this. Testcase: -A INPUT -p tcp --dport 1 Reported-by: Florian Westphal Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: use all IPv6 addresses resolved from a hostnameWes Campaigne2011-02-271-17/+12
| | | | | | | | | | | | | | Fixes a long-standing issue where host_to_ip6addr would only ever examine/return the first item of the address chain returned by getaddrinfo, instead of traversing the chain and copying each of them. This has always been how host_to_ip6addr behaves, and all of the other related IPv6 code is already written to handle multiple possible addresses. [Style fixups. Removal of redundant i<*naddrs check. -j.eng] Signed-off-by: Wes Campaigne <westacular@gmail.com>
* xtables: fix the broken detection/removal of redundant addressesWes Campaigne2011-02-271-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [To observe this issue, populate a hostname (DNS or local db) with multiple adresses across multiple subnets (cf. prefixlen below) # e.g. /etc/hosts 127.0.0.2 lo-x 127.0.0.3 lo-x 127.0.1.4 lo-x 127.0.1.5 lo-x 127.0.2.6 lo-x Then invoke xtables_ipparse_any by e.g. `-m conntrack --ctorigsrc lo-x/24`. -j.eng] This same block of code, apparently to detect if addresses are identical after applying the mask, and to skip the duplicates and the ones made redundant by the mask, has been present and unchanged from as far back as I could find (circa iptables 1.2). By inspection, it was wrong, and always has been: once the code finds a duplicate, it will drop the rest of the array one by one as it re-detects the same duplicate over and over. When the addresses came from a single hostname lookup, and their order was random, then this created unpredictable behaviour by iptables, which seem to ignore some of those addresses at random times. I suspect the original idea also involved a swap between the duplicate and the address from the (current) end of the array, but a line of code to do that seems to have never existed. I have finally added it. (Well, as much as is needed: there does not need to be a full swap, because we are just going to ignore the duplicate, pretend the array is one shorter, and never look at the contents of the end again. So, we can get away with just copying from the end.) [Reword comment about shuffle: replace by mentioning tail copy to replace dup. -j.eng] Signed-off-by: Wes Campaigne <westacular@gmail.com>
* xtables: fix excessive memory allocation in host_to_ipaddrWes Campaigne2011-02-261-1/+1
| | | | | | | host_to_ipaddr was unnecessarily asking for an array of length n^2 to store just n addresses. Signed-off-by: Wes Campaigne <westacular@gmail.com>
* libxtables: avoid confusing use of ai_protocol=IPPROTO_IPV6Wes Campaigne2011-02-221-2/+0
| | | | | | | | | | | | | [Split hunk from Wes's submission. Added commit message. -j.eng] ai_protocol normally specifies the L4 protocol one wants to specifically inquire about when a service (2nd parameter to getaddrinfo) is specified. Such a service lookup would potentially yield nothing, because there just is not any "mytunnel 2222/ipv6" in /etc/services, since IPPROTO_IPV6 itself is not a protocol with a concept of (port-based) services to begin with. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: fix memory scribble beyond end of arrayJan Engelhardt2011-02-211-2/+2
| | | | | | | | | | | | | | | When using -s "", the "n" variable in the code remains uninitialized and usually scribbes beyond the end of the array. Furthermore, "n" is just as big as entries in the last host lookup. When specifying more than one item to -s, e.g. "-s host,host", "n" is less than "count", and we are not masking the addresses at all (leaving them at addr/32 resp. addr/128). The issue goes back to the initial code from v1.4.5~21. References: http://bugs.debian.org/611990 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: rateest options can be optionalJan Engelhardt2011-02-211-4/+4
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_quota: require --quota to be specifiedJan Engelhardt2011-02-201-1/+9
| | | | | | | It is pretty pointless to use -m quota without specifying --quota. There would be nothing left to count down on. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: fix odd partial sentence in libipt_TTLJan Engelhardt2011-02-201-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: mention other possible nf_loggers for TRACEJan Engelhardt2011-02-201-3/+5
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libipt_ECN: set proper option flagsJan Engelhardt2011-02-191-1/+1
| | | | | | | When specifying --ecn-tcp-remove, *flags will be wrongly set to denote that --ecn-ip-ect had been specified. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: add missing checks for specific flagsJan Engelhardt2011-02-193-3/+3
| | | | | | | | | With "!flags", any option will be accepted. The extensions however want one very specific option to be used (or wrong help text). Commits: DNAT: v1.3.8~23, osf: v1.4.6~3 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_hbh: remove unimplemented --hbh-not-strictJan Engelhardt2011-02-191-14/+0
| | | | | | Same as with ip6t_dst. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_dst: remove unimplemented --dst-not-strictJan Engelhardt2011-02-191-18/+0
| | | | | | This was never ever implemented in the kernel, so just remove it. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Remove unused CVS expanded keywordsJan Engelhardt2011-02-1913-26/+0
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: remove redundant init functionsJan Engelhardt2011-02-1914-87/+1
| | | | | | The main program already zeroes the per-extension data block. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: fix misspelling of "field"Jan Engelhardt2011-02-183-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: fix wrong sentence about negation in xt_limitJan Engelhardt2011-02-171-2/+5
| | | | | | This is an update to commit v1.4.7~6. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: use strspn() to check if string needs to be quotedMax Kellerman2011-02-171-1/+1
| | | | | | | | | | | | | | | | | | | | Problem: the call xtables_save_string("'") prints just a single quote, not enclosed in double quoted and not escaped. Steps to reproduce: $ iptables -A foo -m comment --comment "'" -j ACCEPT $ iptables-multi save|grep foo -A foo -m comment --comment ' -j ACCEPT The cause was the use of strcspn() to locate the first character which justified quoting the string in double quotes. That however was wrong, because the way strcspn() was called, it returned a pointer to the first character that was not to be escaped, which did the right thing most of the time, but not for strings consisting only of quote characters. This patch changes strcspn() to strspn(). Signed-off-by: Patrick McHardy <kaber@trash.net>
* extensions: fix indent of vtableJan Engelhardt2011-02-164-45/+45
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_devgroup: option whitespace update following v1.4.10-49-g7386635Jan Engelhardt2011-02-161-7/+7
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* ip6tables: spacing fixes for -o argumentJan Engelhardt2011-02-161-1/+1
| | | | | | For aesthetic consistency, put a space after -o. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix segfault target option parsingJan Engelhardt2011-02-112-6/+6
| | | | | | | With v1.4.10-58-g94e247b, target option parsing started to happen in the wrong case. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2011-02-094-671/+608
|\
| * iptables: fix error message for unknown optionsJan Engelhardt2011-02-072-20/+14
| | | | | | | | | | | | | | -From: iptables v1.4.10: option "-q" requires an argument +To: iptables v1.4.10: unknown option "-q" Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: move match option handling from do_command6 into its own functionsJan Engelhardt2011-02-072-52/+55
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: move jump option handling from do_command6 into its own functionJan Engelhardt2011-02-073-72/+80
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: unclutter command_default functionJan Engelhardt2011-02-072-118/+91
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (Essentially, 5 levels of indentation have been stripped compared to the original layout, and this is surely a result that looks a lot better than it did before.) Things to note: 1. If the m->parse call succeeded, we can return from the function and do not need to go through the other code. As such, "m" is guaranteed to be useless at the end of the match loop, and so, conditions can be removed. 2. Since the per-extension parse function only ever get their own option codes (since v1.4.10-26-gd09b6d5), their return value no longer has a meaning and can be ignored. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: deduplicate and simplify implicit protocol extension loadingJan Engelhardt2011-02-074-69/+37
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: put shared option flags into xsharedJan Engelhardt2011-02-073-28/+19
| | | | | | | | | | | | This will be needed for the find_proto function. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: move OPT_FRAGMENT to the end so the list can be sharedJan Engelhardt2011-02-071-11/+11
| |
| * src: deduplicate find_proto functionJan Engelhardt2011-02-074-71/+41
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: share iptables_command_state across the two programsJan Engelhardt2011-02-073-55/+49
| | | | | | | | | | | | | | struct iptables_command_state and quite a bit of the code looks worthy of deduplication. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: move large default: block from do_command6 into its own functionJan Engelhardt2011-02-062-203/+225
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: collect do_command variables in a structJan Engelhardt2011-02-062-316/+330
| | | | | | | | | | | | | | This will make it easier to put the code for the cases into separate functions. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | libxt_cluster: fix inversion in the cluster matchPablo Neira Ayuso2011-02-061-2/+2
|/ | | | | | | | | | | | | | | | | | | | In libxt_cluster.c, we use: info->flags |= (1 << XT_CLUSTER_F_INV); but we should use instead: info->flags |= XT_CLUSTER_F_INV; since the definition of XT_CLUSTER_F_INV is: enum xt_cluster_flags { XT_CLUSTER_F_INV = (1 << 0) }; This fixes the inversion in the cluster match. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: add extension for devgroup matchPatrick McHardy2011-02-032-0/+318
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: do not print trailing whitespacesJan Engelhardt2011-01-3193-996/+940
| | | | | | | | | | | | | | | | | Due to the use of printf("foobar "), iptables emits spaces at the end-of-line, which looks odd to some users because it causes the terminal to wrap even if there is seemingly nothing to print. It may also have other points of annoyance, such as mailers interpreting a trailing space as an indicator that the paragraph continues when format=flowed is also on. And git highlights trailing spaces in red, so let's avoid :) Preexisting inconsistencies in outputting spaces in the right spot are also addressed right away. References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=429579 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: remove more redundant castsJan Engelhardt2011-01-312-6/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: remove bogus address-ofJan Engelhardt2011-01-312-2/+2
| | | | | | | Casts are bad. &curtable is actually of type char (*)[], which is quite different from what add_argv expects. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: warn when parameter limit is exceededJan Engelhardt2011-01-312-2/+8
| | | | | | | | | While testing many match extensions in a single rule, I ran into this error not warned about. Arguments were just ignored, causing surprising "Need to specify an argument to --whatever" when the argument was in fact given on the command line. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: set custom opts to NULL on freeJan Engelhardt2011-01-311-1/+3
| | | | | | | | | When inside ip6tables-restore, xtables_free_opts can be called multiple times, especially when trying to exit with an error message from outside do_command. So set it to NULL so that we do not attempt to free a dangling pointer. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>