diff options
| -rw-r--r-- | configure.ac | 4 | ||||
| -rw-r--r-- | extensions/libipt_DNAT.c | 17 | ||||
| -rw-r--r-- | extensions/libipt_SAME.c | 24 | ||||
| -rw-r--r-- | extensions/libipt_SNAT.c | 17 | ||||
| -rw-r--r-- | iptables/ip6tables.8.in | 16 | ||||
| -rw-r--r-- | iptables/iptables.8.in | 10 | ||||
| -rw-r--r-- | libiptc/.gitignore | 2 | ||||
| -rw-r--r-- | libiptc/Makefile.am | 2 | ||||
| -rw-r--r-- | libiptc/libip4tc.pc.in | 10 | ||||
| -rw-r--r-- | libiptc/libip6tc.pc.in | 10 | ||||
| -rw-r--r-- | libiptc/libiptc.pc.in | 6 |
11 files changed, 80 insertions, 38 deletions
diff --git a/configure.ac b/configure.ac index 8afba8c1..298d551d 100644 --- a/configure.ac +++ b/configure.ac @@ -112,6 +112,8 @@ AC_SUBST([libxtables_vmajor]) AC_CONFIG_FILES([Makefile extensions/GNUmakefile include/Makefile iptables/Makefile iptables/xtables.pc libipq/Makefile libipq/libipq.pc - libiptc/Makefile libiptc/libiptc.pc libxtables/Makefile utils/Makefile + libiptc/Makefile libiptc/libiptc.pc + libiptc/libip4tc.pc libiptc/libip6tc.pc + libxtables/Makefile utils/Makefile include/xtables.h include/iptables/internal.h]) AC_OUTPUT diff --git a/extensions/libipt_DNAT.c b/extensions/libipt_DNAT.c index 3b55c69c..466c9def 100644 --- a/extensions/libipt_DNAT.c +++ b/extensions/libipt_DNAT.c @@ -174,21 +174,23 @@ static void DNAT_parse(struct xt_option_call *cb) "DNAT: Multiple --to-destination not supported"); } *cb->target = parse_to(cb->arg, portok, info); - /* WTF do we need this for?? */ - if (cb->xflags & F_RANDOM) - info->mr.range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; cb->xflags |= F_X_TO_DEST; break; - case O_RANDOM: - if (cb->xflags & F_TO_DEST) - info->mr.range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; - break; case O_PERSISTENT: info->mr.range[0].flags |= IP_NAT_RANGE_PERSISTENT; break; } } +static void DNAT_fcheck(struct xt_fcheck_call *cb) +{ + static const unsigned int f = F_TO_DEST | F_RANDOM; + struct nf_nat_multi_range *mr = cb->data; + + if ((cb->xflags & f) == f) + mr->range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; +} + static void print_range(const struct nf_nat_range *r) { if (r->flags & IP_NAT_RANGE_MAP_IPS) { @@ -248,6 +250,7 @@ static struct xtables_target dnat_tg_reg = { .userspacesize = XT_ALIGN(sizeof(struct nf_nat_multi_range)), .help = DNAT_help, .x6_parse = DNAT_parse, + .x6_fcheck = DNAT_fcheck, .print = DNAT_print, .save = DNAT_save, .x6_options = DNAT_opts, diff --git a/extensions/libipt_SAME.c b/extensions/libipt_SAME.c index 2ff6c82e..e603ef64 100644 --- a/extensions/libipt_SAME.c +++ b/extensions/libipt_SAME.c @@ -9,7 +9,8 @@ enum { O_TO_ADDR = 0, O_NODST, O_RANDOM, - F_RANDOM = 1 << O_RANDOM, + F_TO_ADDR = 1 << O_TO_ADDR, + F_RANDOM = 1 << O_RANDOM, }; static void SAME_help(void) @@ -73,7 +74,6 @@ static void parse_to(const char *orig_arg, struct nf_nat_range *range) static void SAME_parse(struct xt_option_call *cb) { struct ipt_same_info *mr = cb->data; - unsigned int count; xtables_option_parse(cb); switch (cb->entry->id) { @@ -84,22 +84,25 @@ static void SAME_parse(struct xt_option_call *cb) "is %i ranges.\n", IPT_SAME_MAX_RANGE); parse_to(cb->arg, &mr->range[mr->rangesize]); - /* WTF do we need this for? */ - if (cb->xflags & F_RANDOM) - mr->range[mr->rangesize].flags - |= IP_NAT_RANGE_PROTO_RANDOM; mr->rangesize++; break; case O_NODST: mr->info |= IPT_SAME_NODST; break; - case O_RANDOM: - for (count=0; count < mr->rangesize; count++) - mr->range[count].flags |= IP_NAT_RANGE_PROTO_RANDOM; - break; } } +static void SAME_fcheck(struct xt_fcheck_call *cb) +{ + static const unsigned int f = F_TO_ADDR | F_RANDOM; + struct ipt_same_info *mr = cb->data; + unsigned int count; + + if ((cb->xflags & f) == f) + for (count = 0; count < mr->rangesize; ++count) + mr->range[count].flags |= IP_NAT_RANGE_PROTO_RANDOM; +} + static void SAME_print(const void *ip, const struct xt_entry_target *target, int numeric) { @@ -166,6 +169,7 @@ static struct xtables_target same_tg_reg = { .userspacesize = XT_ALIGN(sizeof(struct ipt_same_info)), .help = SAME_help, .x6_parse = SAME_parse, + .x6_fcheck = SAME_fcheck, .print = SAME_print, .save = SAME_save, .x6_options = SAME_opts, diff --git a/extensions/libipt_SNAT.c b/extensions/libipt_SNAT.c index 80233060..c8cb26df 100644 --- a/extensions/libipt_SNAT.c +++ b/extensions/libipt_SNAT.c @@ -174,21 +174,23 @@ static void SNAT_parse(struct xt_option_call *cb) "SNAT: Multiple --to-source not supported"); } *cb->target = parse_to(cb->arg, portok, info); - /* WTF do we need this for?? */ - if (cb->xflags & F_RANDOM) - info->mr.range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; cb->xflags |= F_X_TO_SRC; break; - case O_RANDOM: - if (cb->xflags & F_TO_SRC) - info->mr.range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; - break; case O_PERSISTENT: info->mr.range[0].flags |= IP_NAT_RANGE_PERSISTENT; break; } } +static void SNAT_fcheck(struct xt_fcheck_call *cb) +{ + static const unsigned int f = F_TO_SRC | F_RANDOM; + struct nf_nat_multi_range *mr = cb->data; + + if ((cb->xflags & f) == f) + mr->range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; +} + static void print_range(const struct nf_nat_range *r) { if (r->flags & IP_NAT_RANGE_MAP_IPS) { @@ -248,6 +250,7 @@ static struct xtables_target snat_tg_reg = { .userspacesize = XT_ALIGN(sizeof(struct nf_nat_multi_range)), .help = SNAT_help, .x6_parse = SNAT_parse, + .x6_fcheck = SNAT_fcheck, .print = SNAT_print, .save = SNAT_save, .x6_options = SNAT_opts, diff --git a/iptables/ip6tables.8.in b/iptables/ip6tables.8.in index 748cebba..65f38646 100644 --- a/iptables/ip6tables.8.in +++ b/iptables/ip6tables.8.in @@ -250,7 +250,11 @@ But IPv6 extension headers except \fBesp\fP are not allowed. \fBesp\fP and \fBipv6\-nonext\fP can be used with Kernel version 2.6.11 or later. A "!" argument before the protocol inverts the -test. The number zero is equivalent to \fBall\fP. "\fBall\fP" +test. The number zero is equivalent to \fBall\fP, which means that you cannot +test the protocol field for the value 0 directly. To match on a HBH header, +even if it were the last, you cannot use \fB\-p 0\fP, but always need +\fB\-m hbh\fP. +"\fBall\fP" will match with all protocols and is taken as default when this option is omitted. .TP @@ -357,15 +361,19 @@ corresponding to that rule's position in the chain. When adding or inserting rules into a chain, use \fIcommand\fP to load any necessary modules (targets, match extensions, etc). .SH MATCH EXTENSIONS -ip6tables can use extended packet matching modules. These are loaded -in two ways: implicitly, when \fB\-p\fP or \fB\-\-protocol\fP -is specified, or with the \fB\-m\fP or \fB\-\-match\fP +.PP +ip6tables can use extended packet matching modules +with the \fB\-m\fP or \fB\-\-match\fP options, followed by the matching module name; after these, various extra command line options become available, depending on the specific module. You can specify multiple extended match modules in one line, and you can use the \fB\-h\fP or \fB\-\-help\fP options after the module has been specified to receive help specific to that module. +.PP +If the \fB\-p\fP or \fB\-\-protocol\fP was specified and if and only if an +unknown option is encountered, ip6tables will try load a match module of the +same name as the protocol, to try making the option available. .\" @MATCH@ .SH TARGET EXTENSIONS ip6tables can use extended target modules: the following are included diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in index 24618b7b..59d6e040 100644 --- a/iptables/iptables.8.in +++ b/iptables/iptables.8.in @@ -356,15 +356,19 @@ corresponding to that rule's position in the chain. When adding or inserting rules into a chain, use \fIcommand\fP to load any necessary modules (targets, match extensions, etc). .SH MATCH EXTENSIONS -iptables can use extended packet matching modules. These are loaded -in two ways: implicitly, when \fB\-p\fP or \fB\-\-protocol\fP -is specified, or with the \fB\-m\fP or \fB\-\-match\fP +.PP +iptables can use extended packet matching modules +with the \fB\-m\fP or \fB\-\-match\fP options, followed by the matching module name; after these, various extra command line options become available, depending on the specific module. You can specify multiple extended match modules in one line, and you can use the \fB\-h\fP or \fB\-\-help\fP options after the module has been specified to receive help specific to that module. +.PP +If the \fB\-p\fP or \fB\-\-protocol\fP was specified and if and only if an +unknown option is encountered, iptables will try load a match module of the +same name as the protocol, to try making the option available. .\" @MATCH@ .SH TARGET EXTENSIONS iptables can use extended target modules: the following are included diff --git a/libiptc/.gitignore b/libiptc/.gitignore index 87675507..49ca83d0 100644 --- a/libiptc/.gitignore +++ b/libiptc/.gitignore @@ -1 +1 @@ -/libiptc.pc +/*.pc diff --git a/libiptc/Makefile.am b/libiptc/Makefile.am index 0b59007d..f789d34e 100644 --- a/libiptc/Makefile.am +++ b/libiptc/Makefile.am @@ -3,7 +3,7 @@ AM_CFLAGS = ${regular_CFLAGS} AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include -I${top_srcdir}/include ${kinclude_CPPFLAGS} -pkgconfig_DATA = libiptc.pc +pkgconfig_DATA = libiptc.pc libip4tc.pc libip6tc.pc lib_LTLIBRARIES = libip4tc.la libip6tc.la libiptc.la libiptc_la_SOURCES = diff --git a/libiptc/libip4tc.pc.in b/libiptc/libip4tc.pc.in new file mode 100644 index 00000000..5efa1ca2 --- /dev/null +++ b/libiptc/libip4tc.pc.in @@ -0,0 +1,10 @@ +prefix=@prefix@ +exec_prefix=@exec_prefix@ +libdir=@libdir@ +includedir=@includedir@ + +Name: libip4tc +Description: iptables IPv4 ruleset ADT and kernel interface +Version: @PACKAGE_VERSION@ +Libs: -L${libdir} -lip4tc +Cflags: -I${includedir} diff --git a/libiptc/libip6tc.pc.in b/libiptc/libip6tc.pc.in new file mode 100644 index 00000000..30a61b22 --- /dev/null +++ b/libiptc/libip6tc.pc.in @@ -0,0 +1,10 @@ +prefix=@prefix@ +exec_prefix=@exec_prefix@ +libdir=@libdir@ +includedir=@includedir@ + +Name: libip6tc +Description: iptables IPv6 ruleset ADT and kernel interface +Version: @PACKAGE_VERSION@ +Libs: -L${libdir} -lip6tc +Cflags: -I${includedir} diff --git a/libiptc/libiptc.pc.in b/libiptc/libiptc.pc.in index 99a35440..0264bf05 100644 --- a/libiptc/libiptc.pc.in +++ b/libiptc/libiptc.pc.in @@ -5,8 +5,6 @@ libdir=@libdir@ includedir=@includedir@ Name: libiptc -Description: iptables ruleset ADT and kernel interface +Description: iptables v4/v6 ruleset ADT and kernel interface Version: @PACKAGE_VERSION@ -Libs: -L${libdir} -liptc -Libs.private: -lip4tc -lip6tc -Cflags: -I${includedir} +Requires: libip4tc libip6tc |