summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* MARK: print mark rules with mask 0xffffffff as --set-mark instead of --set-xmarkPatrick McHardy2009-11-041-0/+2
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables/extensions: make bundled options work againJan Engelhardt2009-11-0339-107/+107
| | | | | | | | | | | | | When using a bundled option like "-ptcp", 'argv[optind-1]' would logically point to "-ptcp", but this is obviously not right. 'optarg' is needed instead, which if properly offset to "tcp". Not all places change optind-based access to optarg; where look-ahead is needed, such as for tcp's --tcp-flags option for example, optind is ok. References: http://bugzilla.netfilter.org/show_bug.cgi?id=611 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: hand argv to xtables_check_inverseJan Engelhardt2009-11-0365-142/+143
| | | | | | | | | In going to fix NF bug #611, "argv" is needed in xtables_check_inverse to set "optarg" to the right spot in case of an intrapositional negation. References: http://bugzilla.netfilter.org/show_bug.cgi?id=611 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* style: reduce indent in xtables_check_inverseJan Engelhardt2009-10-291-16/+16
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix undersized deletion mask creationJan Engelhardt2009-10-292-12/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | The mask created for the -D rulespec is simply too small. xtables_targets points to whatever target has last been loaded, so xtables_targets->size is quite almost wrong, as we need to use the size of the target for the specific rule that is about to be deleted. This bug existed ever since iptables history is tracked, and requires certain circumstances to be visible, where the deletion operation is one. Furthermore, multiple userspace target extensions must have been loaded, and a target B whose .size is smaller than the target A of the rule we are about to delete must have been loaded more recently than target A. The minimal testcase is (rule 60007 gets wrongly removed) *nat -F -X -A POSTROUTING -p udp -j SNAT --to 192.168.1.1:60007 -A POSTROUTING -p udp -j SNAT --to 192.168.1.1:60008 -A POSTROUTING -p udp -j CONNMARK --set-mark 0 -D POSTROUTING -p udp -j SNAT --to 192.168.1.1:60008 COMMIT References: http://bugzilla.netfilter.org/show_bug.cgi?id=606 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libiptc: fix wrong maptype of base chain counters on restoreJan Engelhardt2009-10-291-1/+1
| | | | | | | | | | | | | | | When a ruleset that does not reset any chain policies/counters, such as *filter COMMIT is sourced by iptables-restore, the previous policy and counters (i.e. the ones read from the kernel) are reused. The counter skew offsetting is wrong however, causing the read value to be readded to the kernel value. This manifests itself in practice by the counter value almost doubling everytime iptables-restore is called. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: restore --disable-ipv6 functionality on system w/o v6 headersOlaf Rempel2009-10-291-1/+2
| | | | | | | | | Commit 332e4acc (iptables: accept multiple IP address specifications for -s, d) broke the --disable-ipv6 configure option. > ./.libs/libxtables.so: undefined reference to `in6addr_any' Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iprange: warn on reverse range (log)Jan Engelhardt2009-10-290-0/+0
| | | | | | | | | | | Reverse ranges like B-A cause packets to be generally never matched, as an address S does not match >=B && <=A (except for the border case where S=A=B). The kernel module itself does not check for reverse ranges, and it seems nicer to check that in userspace anyway. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iprange: do accept non-ranges for xt_iprange v1 (log)Jan Engelhardt2009-10-250-0/+0
| | | | | | | | | | | | | | | | | Details for commit v1.4.5-11-ga10a12a: "When upgraded to new lenny kernel from 2.6.24 from etch'n'half iprange now does not allow to use single ip-address as its argument: # iptables -A FORWARD -m iprange --src-range 192.168.0.0" References: http://bugs.debian.org/547139 What we have here is that the user is now using iprange v1 from previously v0. Add recognition for single addresses to v1. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iprange: roll address parsing into a loopJan Engelhardt2009-10-251-20/+16
|
* iprange: warn on reverse rangeJan Engelhardt2009-10-251-22/+29
|
* iprange: do accept non-ranges for xt_iprange v1Jan Engelhardt2009-10-251-72/+47
| | | | [fill in details]
* libiptc: avoid strict-aliasing warningsJan Engelhardt2009-10-253-5/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | In file included from libiptc/libip4tc.c:117:0: libiptc/libiptc.c: In function ‘__iptcc_p_del_policy’: libiptc/libiptc.c:826:4: warning: dereferencing type-punned pointer will break strict-aliasing rules libiptc/libiptc.c: In function ‘iptc_get_target’: libiptc/libiptc.c:1650:4: warning: dereferencing type-punned pointer will break strict-aliasing rules libiptc/libip4tc.c: In function ‘dump_entry’: libiptc/libip4tc.c:157:3: warning: dereferencing type-punned pointer will break strict-aliasing rules CC libiptc/libip6tc.lo In file included from libiptc/libip6tc.c:112:0: libiptc/libiptc.c: In function ‘__iptcc_p_del_policy’: libiptc/libiptc.c:826:4: warning: dereferencing type-punned pointer will break strict-aliasing rules libiptc/libiptc.c: In function ‘ip6tc_get_target’: libiptc/libiptc.c:1650:4: warning: dereferencing type-punned pointer will break strict-aliasing rules libiptc/libip6tc.c: In function ‘dump_entry’: libiptc/libip6tc.c:188:3: warning: dereferencing type-punned pointer will break strict-aliasing rules Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libiptc: remove unused functionsJan Engelhardt2009-10-251-39/+0
| | | | | | | | | | | | | Fix the two warnings in libiptc.c: CC libiptc/libip4tc.lo libiptc/libiptc.c:1570:1: warning: ‘iptc_num_rules’ defined but not used libiptc/libiptc.c:1586:1: warning: ‘iptc_get_rule’ defined but not used CC libiptc/libip6tc.lo libiptc/libiptc.c:1570:1: warning: ‘ip6tc_num_rules’ defined but not used libiptc/libiptc.c:1586:1: warning: ‘ip6tc_get_rule’ defined but not used Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* realm: remove static initializationsJan Engelhardt2009-10-251-3/+2
| | | | | | Save a little disk space, they are initialized to zero anyway. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: update TCPMSS manpage with Linux 2.6.25 changesTim Small2009-10-251-1/+9
| | | | | | | | References: http://bugs.debian.org/551272 [j.eng: modified --set-mss option description to be understandable] Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Support for nommu archesJan Engelhardt2009-10-251-1/+1
| | | | | | | | | | Linux systems that lack a MMU cannot call fork(). Fortunately, the only place in iptables that uses fork() follows it by an exec(), so we can easily convert the code to vfork(). References: http://bugzilla.netfilter.org/show_bug.cgi?id=614 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: fix typo in length manpagesobtwmxt2009-10-251-1/+1
| | | | | References: http://bugs.debian.org/551867 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: mention maximum mark size in manpagesJan Engelhardt2009-10-253-3/+5
|
* Merge branch 'zero' of git://dev.medozas.de/iptablesPatrick McHardy2009-09-144-20/+56
|\
| * iptables: manpage updates for augmented -Z syntaxJan Engelhardt2009-08-202-6/+8
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * iptables: expose option to zero packet/byte counters for a specific ruleMohit Mehta2009-08-202-14/+48
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | Bump version number to 1.4.5v1.4.5Patrick McHardy2009-09-142-3/+3
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* | man: fix incorrect plural in libipt_set.manPatrick McHardy2009-08-241-1/+1
|/ | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* manpages: more fixes to minuses, hyphens, dashesJan Engelhardt2009-08-2016-37/+33
| | | | | | | | | | | | | | | | Debian still carries patches patches to the iptables nroff code touching ASCII minuses, so I thought, what's it this time. Eventually, this patch tries to straighten things once more, per http://en.wikipedia.org/wiki/Wikipedia:Manual_of_Style#Hyphens and http://en.wikipedia.org/wiki/Wikipedia:Manual_of_Style#Dashes . Titles will get the em dash; all typed commands or parameters with a hyphen get a minus (so that man(1) hyperlinking and copy-pasting does work), but other mentions get the hyphen. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* manpage: fix lintian warningsLaurence J. Lane2009-08-202-2/+2
| | | | | | | | | | | Description: extraneous slash caused this lintian warning: W: iptables: manpage-has-errors-from-man usr/share/man/man8/iptables.8.gz 220: cannot use newline as a starting delimiter W: iptables: manpage-has-errors-from-man usr/share/man/man8/ip6tables.8.gz 1823: warning: `precedence'' not defined Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* ipt_set: fix a typo in the manpageTrent W. Buck2009-08-201-1/+1
| | | | | | References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=539101 Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxt_NFQUEUE: add new v1 version with queue-balance optionFlorian Westphal2009-08-203-10/+129
| | | | | | | | | | | | | | | | New version that adds support for specifying a queue range instead of a single queue id. The kernel will distribute flows across the given queue range. This is useful for multicore systems, simply start multiple instances of the userspace program on queues x, x+1, .. x+n and use "--queue-balance x:x+n". Packets belonging to the same connection are put into the same queue. With fixes from Jan Engelhardt. Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge branch 'stable'Jan Engelhardt2009-08-053-22/+152
|\ | | | | | | | | | | | | Conflicts: extensions/libxt_conntrack.c Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_helper: fix invalid passed option to check_inverseJan Engelhardt2009-06-251-1/+1
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * xt_conntrack: revision 2 for enlarged state_mask memberJan Engelhardt2009-06-252-27/+161
| | | | | | | | | | | | This complements the xt_conntrack revision 2 code added to the kenrel. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | build: build only iptables-multiJan Engelhardt2009-07-251-37/+13
| | | | | | | | | | | | | | | | | | | | | | | | I see no pressing reason to install all single programs when the multi binary can do the job. Within the build directory, developers can run the components by means of, for example, ./ip6tables-multi {main|restore|save} ... And when make install-ed, symlinks are available. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | build: combine iptables-multi and iptables-staticJan Engelhardt2009-07-2510-40/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changed the Makefile so that: 1. --enable-shared / --disable-shared control the linkage against libdl (and thus the potential to use 3rd party extensions) 2. --enable-static / --disable-static controls whether shipped extensions are built-in or provided as modules iptables-static becomes redundant by this action; iptables-multi now has the feature. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | build: fix struct size mismatchJan Engelhardt2009-07-251-4/+0
| | | | | | | | | | | | | | | | | | Mixing code compiled with and without -DNO_SHARED_LIBS is fine as long as the structs have the same layout. This patch prevents a potential (currently non-triggerable) "ip6tables: target (null)<123> is missing a version" error. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | multi binary: allow subcommand via argv[1]Jan Engelhardt2009-07-252-43/+70
| | | | | | | | | | | | | | | | | | libtool does not play well with symlinks when trying to run commands in the build directory. So provide an alternate way to call iptables-multi: when argv[0] is not a recognized name, inspect [1] for an alternate identifer. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | build: order of dependent libs is sensitiveJan Engelhardt2009-07-231-1/+1
| | | | | | | | | | | | | | libiptc.la must come after its components or `make install` won't get things right. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | COMMIT_NOTES: notice to check for soversion bumpsJan Engelhardt2009-06-261-1/+5
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | xtables: warn of missing version identifier in extensionsJan Engelhardt2009-06-261-0/+10
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | extensions: collapse data variables to use multi-reg callsJan Engelhardt2009-06-2615-566/+552
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | xtables: add multi-registration functionsJan Engelhardt2009-06-262-0/+16
| | | | | | | | | | | | Similar to the ones that are present in the kernel. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | extensions: remove empty help and parse functionsJan Engelhardt2009-06-267-127/+0
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | iptables: allow for help-less extensionsJan Engelhardt2009-06-265-40/+53
| | | | | | | | | | | | | | This is for extensions that do not take any options, and which subsequently do not offer any help text either. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | iptables: allow for parse-less extensionsJan Engelhardt2009-06-262-8/+10
| | | | | | | | | | | | This means we can do some code removal in extensions. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | extensions: collapse registration structuresJan Engelhardt2009-06-2627-474/+29
| | | | | | | | | | | | | | | | | | | | | | | | There are no different code paths between IPV4 and IPV6, so data can be consolidated here. text data bss dec hex filename 243757 12212 2576 258545 3f1f1 ip6tables-static[before.i586] 243613 9428 2576 255617 3e681 ip6tables-static[after.i586] -144 -2784 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | libiptc: split v4 and v6Jan Engelhardt2009-06-261-7/+12
| | | | | | | | | | | | | | The split can save some diskspace for constrained systems running which are only running one protocol. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | iptables: accept multiple IP address specifications for -s, -dMichael Granzow2009-06-267-34/+251
|/ | | | | | | | | | | | | | libiptc already supports adding and deleting multiple rules with different addresses, so it only needs to be wired up to the options. # ip6tables -I INPUT -s 2001:db8::d,2001:db8::e -j DROP References: http://marc.info/?l=netfilter-devel&m=123929790719202&w=2 Adjustments made: syntax, removal of unneeded variables, manpage adjustment, soversion bump. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Bump versionv1.4.4Patrick McHardy2009-06-161-1/+1
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge branch 'stable' of git://dev.medozas.de/iptablesPatrick McHardy2009-06-1112-30/+39
|\
| * manpages: markup correctionsJan Engelhardt2009-06-105-26/+25
| | | | | | | | | | | | | | | | The manpage of xt_cluster and xt_recent had some unclosed tags. Backslashes in commands are also not wanted because manpages are a freeform, automatically-wrapped text. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * iptables: close open file descriptorsJan Engelhardt2009-06-105-0/+8
| | | | | | | | | | | | | | Just for correctness, close some file descriptors that were opened. (E.g. ip6tables-save reading from procfs files.) Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 16:16:50 +0000