summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* physdev: remove extra space in outputJan Engelhardt2008-08-131-11/+12
| | | | | | | | Just a cosmetic fix for `iptables -S` and `iptables-save` printing two spaces between arguments in the physdev match. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* manpages: correct erroneous markupJan Engelhardt2008-08-129-10/+10
| | | | | | | | Text paragraphs should use .PP, since .TP makes it a list item with indented description. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Put xtables.c into its own library, libxtables.soJan Engelhardt2008-08-044-13/+39
| | | | | | | | | | | iproute2's tc's m_ipt.c poses as a pseudo-iptables program to make use of the info structure composition of iptables extensions. Since tc would have to clone a lot of code, xtables.c is put into its own shared library and should not be relied upon by any other programs. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxt_dscp: fix save of negated dscp match rulesPhil Oester2008-08-041-1/+1
| | | | | | | | | | | | As pointed out by Vyacheslav Garashchenko, iptables-save does not save negated dscp matches properly. Fix below. This closes bugzilla #533. Phil Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables-save: fix hashlimit outputPhil Oester2008-08-041-1/+1
| | | | | | | | | In bugzilla 550, Xeb notes that the --hashlimit-htable-gcinterval argument is saved incorrectly. Patch below corrects. Patch-from: Xeb <xeb@mail.ru> Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxt_recent: do not allow both --set and --rttlJan Engelhardt2008-08-041-10/+23
| | | | | | | | | | | | Reported-by: Erich Schubert <erich@debian.org> Reference: Debian bug #346034 "I was using the --rttl option in my --set line; this caused all incoming ssh connections to be rejected; --rttl is only to be used with --rcheck and --update." Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables-restore: fix segmentation fault with -tanythingJan Engelhardt2008-08-044-8/+6
| | | | | | | | | | | | | | | | | | | | Reference: Debian bug #458042 iptables-restore must not pass a table into do_command. It checks for "-t arg" and "--table arg", but not "-targ". (On a related note, using -targ does not work as expected). This should fail gracefully, but crashes: iptables-restore <(echo -e '*filter\n-A INPUT -tx\nCOMMIT') And this should use table "filter", or perhaps raise an error, but instead sets the table to (literally) "-tfilter": iptables -tfilter -A INPUT Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: drop libiptc from installationJan Engelhardt2008-08-041-3/+0
| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: remove dependency on libiptc headersJan Engelhardt2008-08-049-10/+17
| | | | | | | | xtables.h does not need really need libxtc.h, and we can drop it from the install as it is internal-only. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* manpages: name and markup fixesJan Engelhardt2008-07-302-24/+24
| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge branch 'master' of vishnu.netfilter.org:/data/git/iptablesJan Engelhardt2008-07-2910-458/+471
|\
| * v1.4.2-rc1v1.4.2-rc1Patrick McHardy2008-07-232-4/+4
| |
| * xt_string: string extension case insensitive matchingJoonwoo Park2008-07-072-11/+74
| | | | | | | | | | | | | | | | | | The string extension can search patterns case insensitively with --icase option. A new revision 1 was added, in the meantime invert of xt_string_info was moved into flags as a flag. Signed-off-by: Joonwoo Park <joonwpark81@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * libiptc: fix scalability performance issue during initial ruleset parsingJesper Dangaard Brouer2008-07-031-11/+112
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Finding jump chains is slow O(Chain*Rules). The problem: is that the chain list is searched lineary for each rule with a jump target. The problem lies in the "second pass" (of function parse_table) where the userchain jump targets are found. For each rule "R" with a IPTCC_R_JUMP target, function iptcc_find_chain_by_offset() searches through the chains "C" in the chain list (worst-case hitting the last one). The solution: in this patch is to speed up iptcc_find_chain_by_offset() by using binary search. Reducing complexity from O(C) to O(log C). Implementation: Its possible to use the same bsearch algorithm and data structure (chain_index), as used for chain name searching. How is that possible: One has to realize that the chains are both sorted by name and offsets, this is because the chains are already sorted in the ruleset from the kernel. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * libiptc: minor bugfixJesper Dangaard Brouer2008-07-031-1/+2
| | | | | | | | | | | | | | | | Minor bugfix, an extra check is needed if the tail element is a builtin chain, as builtin chains are not sorted. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * manpages: various updatesJan Engelhardt2008-07-032-390/+225
| | | | | | | | | | | | | | | | | | - synchronized iptables--ip6tbales manpages - -S option, list of chain names, protocol names - markup updates Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * build: various changes to release.shJan Engelhardt2008-07-032-25/+2
| | | | | | | | | | | | | | | | | | - do not remove autogen.sh - remove COMMIT_NOTES - it does not apply to git anymore - create SHA1 sums for tarballs and patches Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * build: quote variables in release.shJan Engelhardt2008-07-031-11/+11
| | | | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * libxt_TOS: make sure --set-tos value/mask is recognizedJan Engelhardt2008-06-301-1/+2
| | | | | | | | | | | | | | | | | | Only when a 'stop' pointer is passed, the string may consist of more than just a number. Reported-by: Anonymous Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * build: ip6.h is not requiredJan Engelhardt2008-06-251-1/+0
| | | | | | | | | | | | | | | | | | Remove the check from configure.ac that errors out when ip6.h is not found. The code does not actually depend on any structures from it. Reported-by: anonymous Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * build: change equailty test for old bashJan Engelhardt2008-06-231-4/+4
| | | | | | | | | | | | | | | | | | Michael used GNU bash, version 1.14.7(1), which apparently does not seem to know about the double ("==") variant of equality tests. Reported-by: Michael Teicher <mteicher@gmail.com> Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * ip6tables: add --goto supportThomas Jacob2008-06-232-2/+38
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * release.sh: fix changelog filenamePatrick McHardy2008-06-191-1/+1
| | | | | | | | | | | | Add missing .txt extension. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | build: do not install ip{,6}tables.hJan Engelhardt2008-07-291-1/+1
|/ | | | | | | | These files do not contain anything that 3rd party modules could reasonably use. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Add simple release scriptPatrick McHardy2008-06-171-0/+30
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* v1.4.1.1v1.4.1.1Patrick McHardy2008-06-161-1/+1
|
* iprange: kernel flags were not setJan Engelhardt2008-06-131-0/+6
| | | | | | | | | The --src-range and --dst-range parameters did not set the IPRANGE_* flags in struct xt_iprange_mtinfo. Reported-by: Maxim Britov <maxim.britov@gmail.com> Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: fix printing of line numbers with --line-numbers argHenrik Nordstrom2008-06-132-2/+2
| | | | | | | Commit bb34082d ("iptables --list chain rulenum") broke the line numbering, starting with printing an offset of 2. Signed-off-by: Patrick McHardy <kaber@trash.net>
* build: fix `make install` when --disable-shared is usedJan Engelhardt2008-06-121-1/+1
| | | | | | | | | When --disable-shared is used, there are no .so files to install, and the argument order for install would get messed up. Reported-by: Michael Teicher <mteicher@gmail.com> Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* ip6tables: fix printing of ipv6 network masksJan Engelhardt2008-06-101-4/+4
| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* v1.4.1v1.4.1Patrick McHardy2008-06-101-1/+1
|
* manpage updatesJan Engelhardt2008-06-0818-43/+47
| | | | | | | | | A number of options support negation, but the manpage did not reflect this ("[!]" was absent). Also fix a few [] (optional arguments) to {} (required arguments) in the option-BNF. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* sparse warning fixes: integer used as pointerPatrick McHardy2008-06-077-12/+12
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables-xml: sparse fixesPatrick McHardy2008-06-071-7/+7
| | | | | | | - Using plain integer as NULL pointer - Undeclared non-static variables Signed-off-by: Patrick McHardy <kaber@trash.net>
* libiptc: move variable definitions to head of functionPatrick McHardy2008-06-071-2/+4
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxt_owner: add spaces to outputJan Engelhardt2008-06-061-23/+23
| | | | | | | | | | It could happen that --<arg><value> was printed on iptables-save with owner rules (owner_mt_save() function) without the obligatory space inbetween. Also transfer printing of the space character into owner_mt_print_item(). Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* addrtype match: added revision 1Laszlo Attila Toth2008-06-063-16/+220
| | | | | | | | | In revision 1 address type checking can be limited to either the incoming or outgoing interface depending on the current chain. In the FORWARD chain only one of them is allowed at the same time. Signed-off-by: Laszlo Attila Toth <panther@balabit.hu> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Fix iptables-save output of libxt_owner matchLutz Jaenicke2008-06-061-9/+9
| | | | | The _save functions need to use the same syntax that is used for parsing the input instead of "user readable" output.
* Bump versionv1.4.1-rc3Patrick McHardy2008-06-061-1/+1
|
* build: check for missing feature filesJan Engelhardt2008-06-052-0/+11
| | | | | | | | | | linux/dccp.h is unlikely to be installed before 2.6.18 (which was when headers_install was introduced), and does not exist at all before 2.6.14. Add a compile-time check to skip compilation of libxt_dccp in case this was detected. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Update .gitignoreJan Engelhardt2008-06-051-0/+47
| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Resync header files with kernelPatrick McHardy2008-06-0521-129/+473
| | | | | Resync headers and add types.h file for endian annotated types, which are not available with old headers.
* Use s6_addr32 to access bits in int6_addr instead of incompatible nameYasuyuki Kozakai2008-06-042-2/+2
| | | | | | | Spotted by Khem Raj <raj.khem@gmail.com> Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Add xtables version defines.Thomas Jarosch2008-06-032-1/+20
| | | | | | | | | | | | | Attached is a patch to add the new defines. The macro XTABLES_VERSION is already in use, so I named it XTABLES_VERSION_CHECK. I've also tested that an empty XTABLES_VERSION_EXTRA in configure.ac works. Now we can write code like this: #warning You are obselete and will be assimilated. Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* manpages: consistent syntaxPatrick McHardy2008-06-0231-85/+92
| | | | | | | | | | In the manpages, bold is used to denote characters the user has to enter verbatim, italic denotes placeholders and non-highlighted pieces are used as a structure: "[]" specifying an optional part, "{}" a mandatory part, with "|" used for alternations. The "!" for negation is better supported before the option than after it, too. The patch makes a few files consistent with this style already used in manpages.
* iptables 1.4.1-rc2v1.4.1-rc2Patrick McHardy2008-05-261-1/+1
|
* REDIRECT: Allow symbolic port in REDIRECT --to-portKristof Provost2008-05-261-0/+3
| | | | | | Fixes Bugzilla 482. Signed-off-by: Kristof Provost <kristof@sigsegv.be>
* Merge branch 'master' of vishnu.netfilter.org:/data/git/iptablesPatrick McHardy2008-05-201-1/+1
|\
| * Bump version to 1.4.1-rc1v1.4.1-rc1Patrick McHardy2008-05-191-1/+1
| | | | | | | | | | Actually its not a bump but a decrease, the autoconf patches apparently sneaked it a version bump to 1.4.1 already.
* | Don't assume /bin/sh is bashThomas Jacob2008-05-201-6/+8
|/ | | | | | | | The new iptables git version assumes /bin/sh is always GNU bash, that's not the case (Ubuntu 8.04 uses dash), see attachment for a fix. Signed-off-by: Patrick McHardy <kaber@trash.net>