summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* libxt_MARK: use guided option parserJan Engelhardt2011-04-132-193/+104
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: XTTYPE_MARKMASK32 supportJan Engelhardt2011-04-132-0/+34
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_u32: use guided option parserJan Engelhardt2011-04-061-22/+17
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_time: use guided option parserJan Engelhardt2011-04-061-101/+52
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_state: use guided option parserJan Engelhardt2011-04-061-34/+16
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_pkttype: use guided option parserJan Engelhardt2011-04-061-37/+15
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_physdev: use guided option parserJan Engelhardt2011-04-061-71/+42
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_helper: use guided option parserJan Engelhardt2011-04-061-38/+16
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_comment: use guided option parserJan Engelhardt2011-04-061-50/+11
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_TCPOPTSTRIP: use guided option parserJan Engelhardt2011-04-061-34/+12
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_SECMARK: use guided option parserJan Engelhardt2011-04-061-39/+15
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_LED: use guided option parserJan Engelhardt2011-04-061-51/+33
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_DSCP: use guided option parserJan Engelhardt2011-04-062-127/+54
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_CLASSIFY: use guided option parserJan Engelhardt2011-04-061-40/+15
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_AUDIT: use guided option parserJan Engelhardt2011-04-061-44/+22
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libipt_addrtype: use guided option parserJan Engelhardt2011-04-061-103/+57
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libipt_ECN: use guided option parserJan Engelhardt2011-04-062-109/+68
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_ipv6header: use guided option parserJan Engelhardt2011-04-061-61/+27
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip[6]t_icmp: use guided option parserJan Engelhardt2011-04-062-65/+35
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_hbh: use guided option parserJan Engelhardt2011-04-061-39/+22
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_dst: use guided option parserJan Engelhardt2011-04-061-41/+20
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip[6]t_REJECT: use guided option parserJan Engelhardt2011-04-062-58/+48
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: XTTYPE_STRING supportJan Engelhardt2011-04-062-0/+27
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_esp: use guided option parserJan Engelhardt2011-04-061-79/+16
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_frag: use guided option parserJan Engelhardt2011-04-061-109/+36
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip[6]t_ah: use guided option parserJan Engelhardt2011-04-062-158/+43
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: XTTYPE_UINT32RC supportJan Engelhardt2011-04-062-2/+59
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip[6]t_hl: use guided option parserJan Engelhardt2011-04-062-133/+82
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip[6]t_HL: use guided option parserJan Engelhardt2011-04-062-137/+84
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: XTTYPE_UINT8 supportJan Engelhardt2011-04-062-1/+11
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_cluster: use guided option parserJan Engelhardt2011-04-061-139/+48
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: min-max option supportJan Engelhardt2011-04-062-0/+8
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_cpu: use guided option parserJan Engelhardt2011-04-061-49/+16
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: XTTYPE_UINT32 supportJan Engelhardt2011-04-062-3/+27
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_CONNSECMARK: use guided option parserJan Engelhardt2011-04-061-36/+23
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: provide better final_checkJan Engelhardt2011-04-064-28/+63
| | | | | | | | This passes the per-extension data block to the new x6_fcheck function pointer, which can then do last alterations without using hacks like global variables (think libxt_statistic). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_socket: use guided option parserJan Engelhardt2011-04-061-14/+15
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_CHECKSUM: use guided option parserJan Engelhardt2011-04-061-32/+14
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: guided option parserJan Engelhardt2011-04-067-54/+501
| | | | | | | | | | | This patchset seeks to drastically reduce the code in the individual extensions by centralizing their argument parsing (breakdown of strings), validation, and in part, assignment. As a secondary goal, this reduces the number of static storage duration variables in flight. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: add missing checks for specific flags (2)Jan Engelhardt2011-04-061-1/+3
| | | | | | | Addendum to v1.4.10-75-g4e5d4bf. It does not make sense to use ipv6header's --soft without specifying any options. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* mark newly opened fds as FD_CLOEXEC (close on exec)Maciej Zenczykowski2011-04-047-6/+17
| | | | | | | (This is iptables-1.4.3.1-cloexec.patch from RedHat iptables.src.rpm) Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* man pages: allow underscores in match and target namesMaciej Zenczykowski2011-04-041-2/+2
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: documentation for iptables and ip6tables "security" tablesMark Montague2011-04-044-4/+32
| | | | | | | | Add documentation for the iptables and ip6tables "security" tables. Based on http://lwn.net/Articles/267140/ and kernel source. Signed-off-by: Mark Montague <mark@catseye.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: add manual page section for AUDIT targetThomas Graf2011-03-161-0/+14
| | | | | Signed-off-by: Thomas Graf <tgraf@redhat.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: add -C to check for existing rulesStefan Tomanek2011-03-089-21/+162
| | | | | | | | | | | | | | | | | It is often useful to check whether a specific rule is already present in a chain without actually modifying the iptables config. Services like fail2ban usually employ techniques like grepping through the output of "iptables -L" which is quite error prone. This patch adds a new operation -C to the iptables command which mostly works like -D; it can detect and indicate the existence of the specified rule by modifying the exit code. The new operation TC_CHECK_ENTRY uses the same code as the -D operation, whose functions got a dry-run parameter appended. Signed-off-by: Stefan Tomanek <stefan.tomanek@wertarbyte.de> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* ip(6)tables-multi: unify subcommand handlingStefan Tomanek2011-03-074-72/+73
| | | | | | | | | | I found the subcommand handling and naming done by iptables-multi and ip6tables-multi very confusing and complicated; this patch reorganizes the subcommands in a single table, allowing both variants of them to be used (iptables/main) and also prints a list of the allowed commands if an unknown command is entered by the user. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: add VERSION section to manpagesJan Engelhardt2011-03-012-0/+6
| | | | | | | | This shall make it easier to identify outdated HTML renditions on the interwebs, since many of them do not display the .TH header like man(1) does. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix an inversionJan Engelhardt2011-03-011-1/+1
| | | | | | | | | | | Revisiting the original condition (viewable in git log -1 -p v1.4.10-57-gacef604), one can notice an unforuntate inversion. This commit corrects this. Testcase: -A INPUT -p tcp --dport 1 Reported-by: Florian Westphal Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: use all IPv6 addresses resolved from a hostnameWes Campaigne2011-02-271-17/+12
| | | | | | | | | | | | | | Fixes a long-standing issue where host_to_ip6addr would only ever examine/return the first item of the address chain returned by getaddrinfo, instead of traversing the chain and copying each of them. This has always been how host_to_ip6addr behaves, and all of the other related IPv6 code is already written to handle multiple possible addresses. [Style fixups. Removal of redundant i<*naddrs check. -j.eng] Signed-off-by: Wes Campaigne <westacular@gmail.com>
* xtables: fix the broken detection/removal of redundant addressesWes Campaigne2011-02-271-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [To observe this issue, populate a hostname (DNS or local db) with multiple adresses across multiple subnets (cf. prefixlen below) # e.g. /etc/hosts 127.0.0.2 lo-x 127.0.0.3 lo-x 127.0.1.4 lo-x 127.0.1.5 lo-x 127.0.2.6 lo-x Then invoke xtables_ipparse_any by e.g. `-m conntrack --ctorigsrc lo-x/24`. -j.eng] This same block of code, apparently to detect if addresses are identical after applying the mask, and to skip the duplicates and the ones made redundant by the mask, has been present and unchanged from as far back as I could find (circa iptables 1.2). By inspection, it was wrong, and always has been: once the code finds a duplicate, it will drop the rest of the array one by one as it re-detects the same duplicate over and over. When the addresses came from a single hostname lookup, and their order was random, then this created unpredictable behaviour by iptables, which seem to ignore some of those addresses at random times. I suspect the original idea also involved a swap between the duplicate and the address from the (current) end of the array, but a line of code to do that seems to have never existed. I have finally added it. (Well, as much as is needed: there does not need to be a full swap, because we are just going to ignore the duplicate, pretend the array is one shorter, and never look at the contents of the end again. So, we can get away with just copying from the end.) [Reword comment about shuffle: replace by mentioning tail copy to replace dup. -j.eng] Signed-off-by: Wes Campaigne <westacular@gmail.com>