summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* v6: rename print_rule() to print_rule6()Maciej Zenczykowski2011-04-043-4/+4
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* v4: rename print_rule() to print_rule4()Maciej Zenczykowski2011-04-043-4/+4
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* v6: rename delete_chain() to delete_chain6()Maciej Zenczykowski2011-04-043-5/+5
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* v4: rename delete_chain() to delete_chain4()Maciej Zenczykowski2011-04-043-5/+5
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* v6: rename flush_entries() to flush_entries6()Maciej Zenczykowski2011-04-043-5/+5
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* v4: rename flush_entries() to flush_entries4()Maciej Zenczykowski2011-04-043-5/+5
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* v6: rename for_each_chain() to for_each_chain6()Maciej Zenczykowski2011-04-043-7/+7
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* v4: rename for_each_chain() to for_each_chain4()Maciej Zenczykowski2011-04-043-7/+7
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* xtables.h: init_extensions() no longer existsMaciej Zenczykowski2011-04-041-1/+0
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* v6: rename init_extensions() to init_extensions6()Maciej Zenczykowski2011-04-045-5/+6
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* v4: rename init_extensions() to init_extensions4()Maciej Zenczykowski2011-04-045-5/+6
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* xtables: delay (statically built) match/target initializationMaciej Zenczykowski2011-04-041-5/+53
| | | | | | | | | | | | | | | | | Matches and targets built into the iptables static binary will always be registered as the binary starts up, this may potentially (as a result of kernel version support checking) result in modules being autoloaded. This is undesirable (for example it may cause CONNMARK target to load and thus cause the kernel to load the conntrack module, which isn't a no-op). Transition to a system where matches and targets are registered into a pending list, from whence they get fully registered only when required. Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* xtables_ip6addr_to_numeric: fix typo in commentMaciej Zenczykowski2011-04-041-1/+1
| | | | | | | | | | An IPv6 address consists of eight hexadecimal 16-bit values seperated by colons, or alternatively, six (not five) of these followed by a colon and an IPv4 address in standard dotted decimal quad notation (for IPv4 mapped addresses and the like). Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* mark newly opened fds as FD_CLOEXEC (close on exec)Maciej Zenczykowski2011-04-047-6/+17
| | | | | | | (This is iptables-1.4.3.1-cloexec.patch from RedHat iptables.src.rpm) Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* man pages: allow underscores in match and target namesMaciej Zenczykowski2011-04-041-2/+2
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: documentation for iptables and ip6tables "security" tablesMark Montague2011-04-044-4/+32
| | | | | | | | Add documentation for the iptables and ip6tables "security" tables. Based on http://lwn.net/Articles/267140/ and kernel source. Signed-off-by: Mark Montague <mark@catseye.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: add manual page section for AUDIT targetThomas Graf2011-03-161-0/+14
| | | | | Signed-off-by: Thomas Graf <tgraf@redhat.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: add -C to check for existing rulesStefan Tomanek2011-03-089-21/+162
| | | | | | | | | | | | | | | | | It is often useful to check whether a specific rule is already present in a chain without actually modifying the iptables config. Services like fail2ban usually employ techniques like grepping through the output of "iptables -L" which is quite error prone. This patch adds a new operation -C to the iptables command which mostly works like -D; it can detect and indicate the existence of the specified rule by modifying the exit code. The new operation TC_CHECK_ENTRY uses the same code as the -D operation, whose functions got a dry-run parameter appended. Signed-off-by: Stefan Tomanek <stefan.tomanek@wertarbyte.de> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* ip(6)tables-multi: unify subcommand handlingStefan Tomanek2011-03-074-72/+73
| | | | | | | | | | I found the subcommand handling and naming done by iptables-multi and ip6tables-multi very confusing and complicated; this patch reorganizes the subcommands in a single table, allowing both variants of them to be used (iptables/main) and also prints a list of the allowed commands if an unknown command is entered by the user. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: add VERSION section to manpagesJan Engelhardt2011-03-012-0/+6
| | | | | | | | This shall make it easier to identify outdated HTML renditions on the interwebs, since many of them do not display the .TH header like man(1) does. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix an inversionJan Engelhardt2011-03-011-1/+1
| | | | | | | | | | | Revisiting the original condition (viewable in git log -1 -p v1.4.10-57-gacef604), one can notice an unforuntate inversion. This commit corrects this. Testcase: -A INPUT -p tcp --dport 1 Reported-by: Florian Westphal Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: use all IPv6 addresses resolved from a hostnameWes Campaigne2011-02-271-17/+12
| | | | | | | | | | | | | | Fixes a long-standing issue where host_to_ip6addr would only ever examine/return the first item of the address chain returned by getaddrinfo, instead of traversing the chain and copying each of them. This has always been how host_to_ip6addr behaves, and all of the other related IPv6 code is already written to handle multiple possible addresses. [Style fixups. Removal of redundant i<*naddrs check. -j.eng] Signed-off-by: Wes Campaigne <westacular@gmail.com>
* xtables: fix the broken detection/removal of redundant addressesWes Campaigne2011-02-271-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [To observe this issue, populate a hostname (DNS or local db) with multiple adresses across multiple subnets (cf. prefixlen below) # e.g. /etc/hosts 127.0.0.2 lo-x 127.0.0.3 lo-x 127.0.1.4 lo-x 127.0.1.5 lo-x 127.0.2.6 lo-x Then invoke xtables_ipparse_any by e.g. `-m conntrack --ctorigsrc lo-x/24`. -j.eng] This same block of code, apparently to detect if addresses are identical after applying the mask, and to skip the duplicates and the ones made redundant by the mask, has been present and unchanged from as far back as I could find (circa iptables 1.2). By inspection, it was wrong, and always has been: once the code finds a duplicate, it will drop the rest of the array one by one as it re-detects the same duplicate over and over. When the addresses came from a single hostname lookup, and their order was random, then this created unpredictable behaviour by iptables, which seem to ignore some of those addresses at random times. I suspect the original idea also involved a swap between the duplicate and the address from the (current) end of the array, but a line of code to do that seems to have never existed. I have finally added it. (Well, as much as is needed: there does not need to be a full swap, because we are just going to ignore the duplicate, pretend the array is one shorter, and never look at the contents of the end again. So, we can get away with just copying from the end.) [Reword comment about shuffle: replace by mentioning tail copy to replace dup. -j.eng] Signed-off-by: Wes Campaigne <westacular@gmail.com>
* xtables: fix excessive memory allocation in host_to_ipaddrWes Campaigne2011-02-261-1/+1
| | | | | | | host_to_ipaddr was unnecessarily asking for an array of length n^2 to store just n addresses. Signed-off-by: Wes Campaigne <westacular@gmail.com>
* libxtables: avoid confusing use of ai_protocol=IPPROTO_IPV6Wes Campaigne2011-02-221-2/+0
| | | | | | | | | | | | | [Split hunk from Wes's submission. Added commit message. -j.eng] ai_protocol normally specifies the L4 protocol one wants to specifically inquire about when a service (2nd parameter to getaddrinfo) is specified. Such a service lookup would potentially yield nothing, because there just is not any "mytunnel 2222/ipv6" in /etc/services, since IPPROTO_IPV6 itself is not a protocol with a concept of (port-based) services to begin with. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: fix memory scribble beyond end of arrayJan Engelhardt2011-02-211-2/+2
| | | | | | | | | | | | | | | When using -s "", the "n" variable in the code remains uninitialized and usually scribbes beyond the end of the array. Furthermore, "n" is just as big as entries in the last host lookup. When specifying more than one item to -s, e.g. "-s host,host", "n" is less than "count", and we are not masking the addresses at all (leaving them at addr/32 resp. addr/128). The issue goes back to the initial code from v1.4.5~21. References: http://bugs.debian.org/611990 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: rateest options can be optionalJan Engelhardt2011-02-211-4/+4
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_quota: require --quota to be specifiedJan Engelhardt2011-02-201-1/+9
| | | | | | | It is pretty pointless to use -m quota without specifying --quota. There would be nothing left to count down on. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: fix odd partial sentence in libipt_TTLJan Engelhardt2011-02-201-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: mention other possible nf_loggers for TRACEJan Engelhardt2011-02-201-3/+5
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libipt_ECN: set proper option flagsJan Engelhardt2011-02-191-1/+1
| | | | | | | When specifying --ecn-tcp-remove, *flags will be wrongly set to denote that --ecn-ip-ect had been specified. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: add missing checks for specific flagsJan Engelhardt2011-02-193-3/+3
| | | | | | | | | With "!flags", any option will be accepted. The extensions however want one very specific option to be used (or wrong help text). Commits: DNAT: v1.3.8~23, osf: v1.4.6~3 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_hbh: remove unimplemented --hbh-not-strictJan Engelhardt2011-02-191-14/+0
| | | | | | Same as with ip6t_dst. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_dst: remove unimplemented --dst-not-strictJan Engelhardt2011-02-191-18/+0
| | | | | | This was never ever implemented in the kernel, so just remove it. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Remove unused CVS expanded keywordsJan Engelhardt2011-02-1913-26/+0
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: remove redundant init functionsJan Engelhardt2011-02-1914-87/+1
| | | | | | The main program already zeroes the per-extension data block. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: fix misspelling of "field"Jan Engelhardt2011-02-183-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: fix wrong sentence about negation in xt_limitJan Engelhardt2011-02-171-2/+5
| | | | | | This is an update to commit v1.4.7~6. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: use strspn() to check if string needs to be quotedMax Kellerman2011-02-171-1/+1
| | | | | | | | | | | | | | | | | | | | Problem: the call xtables_save_string("'") prints just a single quote, not enclosed in double quoted and not escaped. Steps to reproduce: $ iptables -A foo -m comment --comment "'" -j ACCEPT $ iptables-multi save|grep foo -A foo -m comment --comment ' -j ACCEPT The cause was the use of strcspn() to locate the first character which justified quoting the string in double quotes. That however was wrong, because the way strcspn() was called, it returned a pointer to the first character that was not to be escaped, which did the right thing most of the time, but not for strings consisting only of quote characters. This patch changes strcspn() to strspn(). Signed-off-by: Patrick McHardy <kaber@trash.net>
* extensions: fix indent of vtableJan Engelhardt2011-02-164-45/+45
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_devgroup: option whitespace update following v1.4.10-49-g7386635Jan Engelhardt2011-02-161-7/+7
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* ip6tables: spacing fixes for -o argumentJan Engelhardt2011-02-161-1/+1
| | | | | | For aesthetic consistency, put a space after -o. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix segfault target option parsingJan Engelhardt2011-02-112-6/+6
| | | | | | | With v1.4.10-58-g94e247b, target option parsing started to happen in the wrong case. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2011-02-094-671/+608
|\
| * iptables: fix error message for unknown optionsJan Engelhardt2011-02-072-20/+14
| | | | | | | | | | | | | | -From: iptables v1.4.10: option "-q" requires an argument +To: iptables v1.4.10: unknown option "-q" Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: move match option handling from do_command6 into its own functionsJan Engelhardt2011-02-072-52/+55
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: move jump option handling from do_command6 into its own functionJan Engelhardt2011-02-073-72/+80
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: unclutter command_default functionJan Engelhardt2011-02-072-118/+91
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (Essentially, 5 levels of indentation have been stripped compared to the original layout, and this is surely a result that looks a lot better than it did before.) Things to note: 1. If the m->parse call succeeded, we can return from the function and do not need to go through the other code. As such, "m" is guaranteed to be useless at the end of the match loop, and so, conditions can be removed. 2. Since the per-extension parse function only ever get their own option codes (since v1.4.10-26-gd09b6d5), their return value no longer has a meaning and can be ignored. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: deduplicate and simplify implicit protocol extension loadingJan Engelhardt2011-02-074-69/+37
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: put shared option flags into xsharedJan Engelhardt2011-02-073-28/+19
| | | | | | | | | | | | This will be needed for the find_proto function. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>