diff options
-rw-r--r-- | extensions/libxt_conntrack.c | 27 | ||||
-rw-r--r-- | extensions/libxt_state.man | 2 | ||||
-rw-r--r-- | include/linux/netfilter/xt_conntrack.h | 1 | ||||
-rw-r--r-- | include/xtables.h | 16 | ||||
-rw-r--r-- | iptables/ip6tables.c | 34 | ||||
-rw-r--r-- | iptables/iptables.c | 34 |
6 files changed, 78 insertions, 36 deletions
diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c index c37f14d2..f7704eba 100644 --- a/extensions/libxt_conntrack.c +++ b/extensions/libxt_conntrack.c @@ -801,7 +801,9 @@ conntrack_dump(const struct xt_conntrack_mtinfo3 *info, const char *prefix, if (info->match_flags & XT_CONNTRACK_STATE) { if (info->invert_flags & XT_CONNTRACK_STATE) printf(" !"); - printf(" %sctstate", prefix); + printf(" %s%s", prefix, + info->match_flags & XT_CONNTRACK_STATE_ALIAS + ? "state" : "ctstate"); print_state(info->state_mask); } @@ -902,6 +904,15 @@ conntrack_dump(const struct xt_conntrack_mtinfo3 *info, const char *prefix, } } +static const char * +conntrack_print_name_alias(const struct xt_entry_match *match) +{ + struct xt_conntrack_mtinfo1 *info = (void *)match->data; + + return info->match_flags & XT_CONNTRACK_STATE_ALIAS + ? "state" : "conntrack"; +} + static void conntrack_print(const void *ip, const struct xt_entry_match *match, int numeric) { @@ -1083,7 +1094,7 @@ static void state_ct1_parse(struct xt_option_call *cb) struct xt_conntrack_mtinfo1 *sinfo = cb->data; xtables_option_parse(cb); - sinfo->match_flags = XT_CONNTRACK_STATE; + sinfo->match_flags = XT_CONNTRACK_STATE | XT_CONNTRACK_STATE_ALIAS; sinfo->state_mask = state_parse_states(cb->arg); if (cb->invert) sinfo->invert_flags |= XT_CONNTRACK_STATE; @@ -1094,7 +1105,7 @@ static void state_ct23_parse(struct xt_option_call *cb) struct xt_conntrack_mtinfo3 *sinfo = cb->data; xtables_option_parse(cb); - sinfo->match_flags = XT_CONNTRACK_STATE; + sinfo->match_flags = XT_CONNTRACK_STATE | XT_CONNTRACK_STATE_ALIAS; sinfo->state_mask = state_parse_states(cb->arg); if (cb->invert) sinfo->invert_flags |= XT_CONNTRACK_STATE; @@ -1158,6 +1169,7 @@ static struct xtables_match conntrack_mt_reg[] = { .x6_fcheck = conntrack_mt_check, .print = conntrack_print, .save = conntrack_save, + .alias = conntrack_print_name_alias, .x6_options = conntrack_mt_opts_v0, }, { @@ -1172,6 +1184,7 @@ static struct xtables_match conntrack_mt_reg[] = { .x6_fcheck = conntrack_mt_check, .print = conntrack1_mt4_print, .save = conntrack1_mt4_save, + .alias = conntrack_print_name_alias, .x6_options = conntrack2_mt_opts, }, { @@ -1186,6 +1199,7 @@ static struct xtables_match conntrack_mt_reg[] = { .x6_fcheck = conntrack_mt_check, .print = conntrack1_mt6_print, .save = conntrack1_mt6_save, + .alias = conntrack_print_name_alias, .x6_options = conntrack2_mt_opts, }, { @@ -1200,6 +1214,7 @@ static struct xtables_match conntrack_mt_reg[] = { .x6_fcheck = conntrack_mt_check, .print = conntrack2_mt_print, .save = conntrack2_mt_save, + .alias = conntrack_print_name_alias, .x6_options = conntrack2_mt_opts, }, { @@ -1214,6 +1229,7 @@ static struct xtables_match conntrack_mt_reg[] = { .x6_fcheck = conntrack_mt_check, .print = conntrack2_mt6_print, .save = conntrack2_mt6_save, + .alias = conntrack_print_name_alias, .x6_options = conntrack2_mt_opts, }, { @@ -1228,6 +1244,7 @@ static struct xtables_match conntrack_mt_reg[] = { .x6_fcheck = conntrack_mt_check, .print = conntrack3_mt_print, .save = conntrack3_mt_save, + .alias = conntrack_print_name_alias, .x6_options = conntrack3_mt_opts, }, { @@ -1242,6 +1259,7 @@ static struct xtables_match conntrack_mt_reg[] = { .x6_fcheck = conntrack_mt_check, .print = conntrack3_mt6_print, .save = conntrack3_mt6_save, + .alias = conntrack_print_name_alias, .x6_options = conntrack3_mt_opts, }, { @@ -1249,6 +1267,7 @@ static struct xtables_match conntrack_mt_reg[] = { .name = "state", .real_name = "conntrack", .revision = 1, + .ext_flags = XTABLES_EXT_ALIAS, .version = XTABLES_VERSION, .size = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo1)), .userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo1)), @@ -1261,6 +1280,7 @@ static struct xtables_match conntrack_mt_reg[] = { .name = "state", .real_name = "conntrack", .revision = 2, + .ext_flags = XTABLES_EXT_ALIAS, .version = XTABLES_VERSION, .size = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo2)), .userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo2)), @@ -1273,6 +1293,7 @@ static struct xtables_match conntrack_mt_reg[] = { .name = "state", .real_name = "conntrack", .revision = 3, + .ext_flags = XTABLES_EXT_ALIAS, .version = XTABLES_VERSION, .size = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo3)), .userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo3)), diff --git a/extensions/libxt_state.man b/extensions/libxt_state.man index bd60468f..ec096ca6 100644 --- a/extensions/libxt_state.man +++ b/extensions/libxt_state.man @@ -1,4 +1,4 @@ -The "state" module is an obsolete version of "conntrack". +The "state" extension is a subset of the "conntrack" module. "state" allows access to the connection tracking state for this packet. .TP [\fB!\fP] \fB\-\-state\fP \fIstate\fP diff --git a/include/linux/netfilter/xt_conntrack.h b/include/linux/netfilter/xt_conntrack.h index 74b904d8..e9715011 100644 --- a/include/linux/netfilter/xt_conntrack.h +++ b/include/linux/netfilter/xt_conntrack.h @@ -30,6 +30,7 @@ enum { XT_CONNTRACK_REPLSRC_PORT = 1 << 10, XT_CONNTRACK_REPLDST_PORT = 1 << 11, XT_CONNTRACK_DIRECTION = 1 << 12, + XT_CONNTRACK_STATE_ALIAS = 1 << 13, }; struct xt_conntrack_mtinfo1 { diff --git a/include/xtables.h b/include/xtables.h index 75de958e..c35a6e6d 100644 --- a/include/xtables.h +++ b/include/xtables.h @@ -201,6 +201,10 @@ struct xtables_lmap { struct xtables_lmap *next; }; +enum xtables_ext_flags { + XTABLES_EXT_ALIAS = 1 << 0, +}; + /* Include file for additions: new matches and targets. */ struct xtables_match { @@ -218,6 +222,9 @@ struct xtables_match /* Revision of match (0 by default). */ u_int8_t revision; + /* Extension flags */ + u_int8_t ext_flags; + u_int16_t family; /* Size of match data. */ @@ -251,6 +258,9 @@ struct xtables_match /* ip is struct ipt_ip * for example */ void (*save)(const void *ip, const struct xt_entry_match *match); + /* Print match name or alias */ + const char *(*alias)(const struct xt_entry_match *match); + /* Pointer to list of extra command-line options */ const struct option *extra_opts; @@ -289,6 +299,9 @@ struct xtables_target /* Revision of target (0 by default). */ u_int8_t revision; + /* Extension flags */ + u_int8_t ext_flags; + u_int16_t family; @@ -322,6 +335,9 @@ struct xtables_target void (*save)(const void *ip, const struct xt_entry_target *target); + /* Print target name or alias */ + const char *(*alias)(const struct xt_entry_target *target); + /* Pointer to list of extra command-line options */ const struct option *extra_opts; diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c index 556647f8..4cfbea3d 100644 --- a/iptables/ip6tables.c +++ b/iptables/ip6tables.c @@ -1000,7 +1000,8 @@ static int print_match_save(const struct xt_entry_match *e, xtables_find_match(e->u.user.name, XTF_TRY_LOAD, NULL); if (match) { - printf(" -m %s", e->u.user.name); + printf(" -m %s", + match->alias ? match->alias(e) : e->u.user.name); /* some matches don't provide a save function */ if (match->save) @@ -1089,16 +1090,8 @@ void print_rule6(const struct ip6t_entry *e, if (counters < 0) printf(" -c %llu %llu", (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt); - /* Print target name */ + /* Print target name and targinfo part */ target_name = ip6tc_get_target(e, h); - if (target_name && (*target_name != '\0')) -#ifdef IP6T_F_GOTO - printf(" -%c %s", e->ipv6.flags & IP6T_F_GOTO ? 'g' : 'j', target_name); -#else - printf(" -j %s", target_name); -#endif - - /* Print targinfo part */ t = ip6t_get_target((struct ip6t_entry *)e); if (t->u.user.name[0]) { struct xtables_target *target = @@ -1110,6 +1103,7 @@ void print_rule6(const struct ip6t_entry *e, exit(1); } + printf(" -j %s", target->alias ? target->alias(t) : target_name); if (target->save) target->save(&e->ipv6, t); else { @@ -1124,7 +1118,13 @@ void print_rule6(const struct ip6t_entry *e, exit(1); } } - } + } else if (target_name && (*target_name != '\0')) +#ifdef IP6T_F_GOTO + printf(" -%c %s", e->ipv6.flags & IP6T_F_GOTO ? 'g' : 'j', target_name); +#else + printf(" -j %s", target_name); +#endif + printf("\n"); } @@ -1229,9 +1229,10 @@ static void command_jump(struct iptables_command_state *cs) strcpy(cs->target->t->u.user.name, cs->jumpto); } else { strcpy(cs->target->t->u.user.name, cs->target->real_name); - fprintf(stderr, "WARNING: The %s target is obsolete. " - "Use %s instead.\n", - cs->jumpto, cs->target->real_name); + if (!(cs->target->ext_flags & XTABLES_EXT_ALIAS)) + fprintf(stderr, "Notice: The %s target is converted into %s target " + "in rule listing and saving.\n", + cs->jumpto, cs->target->real_name); } cs->target->t->u.user.revision = cs->target->revision; @@ -1265,8 +1266,9 @@ static void command_match(struct iptables_command_state *cs) strcpy(m->m->u.user.name, m->name); } else { strcpy(m->m->u.user.name, m->real_name); - fprintf(stderr, "WARNING: The %s match is obsolete. " - "Use %s instead.\n", m->name, m->real_name); + if (!(m->ext_flags & XTABLES_EXT_ALIAS)) + fprintf(stderr, "Notice: The %s match is converted into %s match " + "in rule listing and saving.\n", m->name, m->real_name); } m->m->u.user.revision = m->revision; diff --git a/iptables/iptables.c b/iptables/iptables.c index 00e3f016..085eea16 100644 --- a/iptables/iptables.c +++ b/iptables/iptables.c @@ -991,7 +991,8 @@ static int print_match_save(const struct xt_entry_match *e, xtables_find_match(e->u.user.name, XTF_TRY_LOAD, NULL); if (match) { - printf(" -m %s", e->u.user.name); + printf(" -m %s", + match->alias ? match->alias(e) : e->u.user.name); /* some matches don't provide a save function */ if (match->save) @@ -1080,16 +1081,8 @@ void print_rule4(const struct ipt_entry *e, if (counters < 0) printf(" -c %llu %llu", (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt); - /* Print target name */ + /* Print target name and targinfo part */ target_name = iptc_get_target(e, h); - if (target_name && (*target_name != '\0')) -#ifdef IPT_F_GOTO - printf(" -%c %s", e->ip.flags & IPT_F_GOTO ? 'g' : 'j', target_name); -#else - printf(" -j %s", target_name); -#endif - - /* Print targinfo part */ t = ipt_get_target((struct ipt_entry *)e); if (t->u.user.name[0]) { const struct xtables_target *target = @@ -1101,6 +1094,7 @@ void print_rule4(const struct ipt_entry *e, exit(1); } + printf(" -j %s", target->alias ? target->alias(t) : target_name); if (target->save) target->save(&e->ip, t); else { @@ -1115,7 +1109,13 @@ void print_rule4(const struct ipt_entry *e, exit(1); } } - } + } else if (target_name && (*target_name != '\0')) +#ifdef IPT_F_GOTO + printf(" -%c %s", e->ip.flags & IPT_F_GOTO ? 'g' : 'j', target_name); +#else + printf(" -j %s", target_name); +#endif + printf("\n"); } @@ -1222,9 +1222,10 @@ static void command_jump(struct iptables_command_state *cs) } else { /* Alias support for userspace side */ strcpy(cs->target->t->u.user.name, cs->target->real_name); - fprintf(stderr, "WARNING: The %s target is obsolete. " - "Use %s instead.\n", - cs->jumpto, cs->target->real_name); + if (!(cs->target->ext_flags & XTABLES_EXT_ALIAS)) + fprintf(stderr, "Notice: The %s target is converted into %s target " + "in rule listing and saving.\n", + cs->jumpto, cs->target->real_name); } cs->target->t->u.user.revision = cs->target->revision; @@ -1259,8 +1260,9 @@ static void command_match(struct iptables_command_state *cs) strcpy(m->m->u.user.name, m->name); } else { strcpy(m->m->u.user.name, m->real_name); - fprintf(stderr, "WARNING: The %s match is obsolete. " - "Use %s instead.\n", m->name, m->real_name); + if (!(m->ext_flags & XTABLES_EXT_ALIAS)) + fprintf(stderr, "Notice: the %s match is converted into %s match " + "in rule listing and saving.\n", m->name, m->real_name); } m->m->u.user.revision = m->revision; |