summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMaciej ┼╗enczykowski <maze@google.com>2011-04-14 02:22:14 -0700
committerMaciej ┼╗enczykowski <maze@google.com>2011-04-19 18:20:49 -0700
commit57664121bce6d3ae05a186c7627c919fb0799649 (patch)
treec36a4966a682c6273d195c426e996fab6fb0c4c4
parentb32b361a725c8fe3a3aa494e6cdec09a80785aac (diff)
Add --ipv4/-4 and --ipv6/-6 support to ip6?tables{,-restore}.
This enables one to have a single configuration file for both ipv4 and ipv6 firewall rules. Example: iptables-restore config ip6tables-restore config Where the file 'config' contains: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :ssh - [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -m state --state INVALID -j DROP -A INPUT -i lo -j ACCEPT -A INPUT -4 -p icmp -j ACCEPT -A INPUT -6 -p icmpv6 -j ACCEPT -A INPUT -p tcp --dport 22 -m state --state NEW -j ssh -A ssh -j ACCEPT COMMIT Signed-off-by: Maciej Zenczykowski <maze@google.com>
-rw-r--r--ip6tables.c17
-rw-r--r--iptables.c16
2 files changed, 31 insertions, 2 deletions
diff --git a/ip6tables.c b/ip6tables.c
index f9909f13..967a5f80 100644
--- a/ip6tables.c
+++ b/ip6tables.c
@@ -124,6 +124,8 @@ static struct option original_opts[] = {
{.name = "modprobe", .has_arg = 1, .val = 'M'},
{.name = "set-counters", .has_arg = 1, .val = 'c'},
{.name = "goto", .has_arg = 1, .val = 'g'},
+ {.name = "ipv4", .has_arg = 0, .val = '4'},
+ {.name = "ipv6", .has_arg = 0, .val = '6'},
{NULL},
};
@@ -248,6 +250,8 @@ exit_printhelp(const struct xtables_rule_match *matches)
" Change chain name, (moving any references)\n"
"Options:\n"
+" --ipv4 -4 Error (line is ignored by ip6tables-restore)\n"
+" --ipv6 -6 Nothing (line is ignored by iptables-restore)\n"
"[!] --proto -p proto protocol: by number or name, eg. `tcp'\n"
"[!] --source -s address[/mask][,...]\n"
" source specification\n"
@@ -1439,7 +1443,7 @@ int do_command6(int argc, char *argv[], char **table, struct ip6tc_handle **hand
opts = xt_params->orig_opts;
while ((cs.c = getopt_long(argc, argv,
- "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:bvnt:m:xc:g:",
+ "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:bvnt:m:xc:g:46",
opts, NULL)) != -1) {
switch (cs.c) {
/*
@@ -1756,6 +1760,17 @@ int do_command6(int argc, char *argv[], char **table, struct ip6tc_handle **hand
cs.fw6.counters.bcnt = cnt;
break;
+ case '4':
+ /* This is not the IPv4 iptables */
+ if (line != -1)
+ return 1; /* success: line ignored */
+ fprintf(stderr, "This is the IPv6 version of ip6tables.\n");
+ exit_tryhelp(2);
+
+ case '6':
+ /* This is indeed the IPv6 ip6tables */
+ break;
+
case 1: /* non option */
if (optarg[0] == '!' && optarg[1] == '\0') {
if (cs.invert)
diff --git a/iptables.c b/iptables.c
index 0441dce3..cc7525a1 100644
--- a/iptables.c
+++ b/iptables.c
@@ -123,6 +123,8 @@ static struct option original_opts[] = {
{.name = "modprobe", .has_arg = 1, .val = 'M'},
{.name = "set-counters", .has_arg = 1, .val = 'c'},
{.name = "goto", .has_arg = 1, .val = 'g'},
+ {.name = "ipv4", .has_arg = 0, .val = '4'},
+ {.name = "ipv6", .has_arg = 0, .val = '6'},
{NULL},
};
@@ -261,6 +263,8 @@ exit_printhelp(const struct xtables_rule_match *matches)
" Change chain name, (moving any references)\n"
"Options:\n"
+" --ipv4 -4 Nothing (line is ignored by ip6tables-restore)\n"
+" --ipv6 -6 Error (line is ignored by iptables-restore)\n"
"[!] --proto -p proto protocol: by number or name, eg. `tcp'\n"
"[!] --source -s address[/mask][...]\n"
" source specification\n"
@@ -1467,7 +1471,7 @@ int do_command4(int argc, char *argv[], char **table, struct iptc_handle **handl
opts = xt_params->orig_opts;
while ((cs.c = getopt_long(argc, argv,
- "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvnt:m:xc:g:",
+ "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvnt:m:xc:g:46",
opts, NULL)) != -1) {
switch (cs.c) {
/*
@@ -1782,6 +1786,16 @@ int do_command4(int argc, char *argv[], char **table, struct iptc_handle **handl
cs.fw.counters.bcnt = cnt;
break;
+ case '4':
+ /* This is indeed the IPv4 iptables */
+ break;
+
+ case '6':
+ /* This is not the IPv6 ip6tables */
+ if (line != -1)
+ return 1; /* success: line ignored */
+ fprintf(stderr, "This is the IPv4 version of iptables.\n");
+ exit_tryhelp(2);
case 1: /* non option */
if (optarg[0] == '!' && optarg[1] == '\0') {