summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* | libip6t_SNPT: add manpagePablo Neira Ayuso2013-04-011-0/+30
|/ | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxt_osf: fix bad location for location in --genrePablo Neira Ayuso2013-03-291-1/+4
| | | | | | | closes http://bugzilla.netfilter.org/show_bug.cgi?id=805 Reported-by: Bourne Without <blackhole@airpost.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxt_osf: fix missing --ttl and --log in save outputPablo Neira Ayuso2013-03-291-0/+4
| | | | | | | closes http://bugzilla.netfilter.org/show_bug.cgi?id=805 Reported-by: Bourne Without <blackhole@airpost.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip[6]tables: show --protocol instead of --proto in usageMart Frauenlob2013-03-292-2/+2
| | | | | | | | As the man page shows --protocol not --proto, also do so in the usage text displayed by ip[6]tables -h. Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "build: resolve link failure for ip6t_NETMAP"Pablo Neira Ayuso2013-03-291-11/+7
| | | | | | | | | | | | | | | | | | This reverts commit 68e77a26111ee6b8f10c735a76891a7de6d57ee6. The use of libtool was introduced to resolve linking problems in NETMAP (IPv6 version), but that resulted in RPATH problems reported from distributors and warnings spotted by libtool at linking stage. Since (0ca548b libip6t_NETMAP: Use xtables_ip6mask_to_cidr and get rid of libip6tc dependency) fixed the NETMAP issue, let's roll back to our previous stage. A small conflicts in extensions/GNUmakefile.in has been resolved in this revert. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libip6t_NETMAP: Use xtables_ip6mask_to_cidr and get rid of libip6tc dependencyPablo Neira Ayuso2013-03-295-7/+3
| | | | | | | | | This patch changes the NETMAP target extension (IPv6 side) to use the xtables_ip6mask_to_cidr available in libxtables. As a side effect, we get rid of the libip6tc dependency. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: bump version to 1.4.18v1.4.18Pablo Neira Ayuso2013-03-031-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: rpfilter: invert option should have own paragraphFlorian Westphal2013-02-171-0/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: iptables provides up to 5 independent tablesPablo Neira Ayuso2013-02-172-2/+2
| | | | | | | | | This closes bugzilla: http://bugzilla.netfilter.org/show_bug.cgi?id=807 Reported-by: Quentin Armitage <quentin@armitage.org.uk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: bump SONAME for libxtablesJan Engelhardt2013-02-061-1/+1
| | | | | | | | | Commit v1.4.17-16-gefcdba4 updated structs in xtables.h, so age must become 0 and vcurrent be increased. The latter has already happened in v1.4.17-6-gd1e7922. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'master' of vishnu.netfilter.org:/data/git/iptablesJozsef Kadlecsik2013-01-313-0/+45
|\
| * doc: document nat table for IPv6Pablo Neira Ayuso2013-01-281-0/+7
| | | | | | | | | | | | Based on the IPv4 description. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * Merge branch 'stable' into 'master'Pablo Neira Ayuso2013-01-282-0/+38
| |\
| | * extensions: S/DNPT: add missing save functionJan Engelhardt2013-01-282-0/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Jean-Michel DILLY reports that `ip6tables -S` exits with Target `DNPT' is missing save function when a DNPT rule is invoked. Fix this omission. References: http://marc.info/?l=netfilter&m=135904831220440&w=2 Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | Add the "state" alias to the "conntrack" matchJozsef Kadlecsik2013-01-283-4/+26
| | |
* | | Introduce match/target aliasesJozsef Kadlecsik2013-01-283-32/+52
|/ / | | | | | | | | The match/target alias allows us to support the syntax of matches, targets targets merged into other matches/targets.
* | doc: document the -4 and -6 optionsJan Engelhardt2013-01-072-0/+18
| | | | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | doc: mention -m in the manpageJan Engelhardt2013-01-072-0/+14
| | | | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | doc: name the supported log levels for ipt_LOGJan Engelhardt2013-01-072-2/+8
| | | | | | | | | | | | | | | | | | | | | | Leonardo Ferreira da Silva Boiko lets it be known that syslogd.conf may not exist on certain systems. Referencing that manpage is not a good idea in any case, I believe, since the strings that are accepted are defined by iptables and not a syslog implementation. References: http://bugs.debian.org/567564 Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | doc: document iptables-restore's -h optionJan Engelhardt2013-01-072-2/+8
| | | | | | | | | | | | References: http://bugs.debian.org/644221 Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | doc: document iptables-restore's -M optionJan Engelhardt2013-01-072-2/+12
| | | | | | | | | | | | References: http://bugs.debian.org/644221 Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | doc: document iptables-restore's -v optionJan Engelhardt2013-01-072-2/+8
| | | | | | | | | | | | References: http://bugs.debian.org/644221 Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | doc: document iptables-restore's -t optionJan Engelhardt2013-01-072-2/+8
| | | | | | | | | | | | References: http://bugs.debian.org/644221 Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | doc: fixup omissions in ip6tables-restore.8Jan Engelhardt2013-01-072-3/+5
| | | | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | libxtables: add xtables_print_numPablo Neira Ayuso2013-01-044-89/+53
| | | | | | | | | | | | | | | | This function is used both by iptables and ip6tables, and refactorize to avoid longer than 80-chars per column lines of code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | libxtables: add xtables_rule_matches_freePablo Neira Ayuso2013-01-045-46/+28
| | | | | | | | | | | | This function is shared by iptables and ip6tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: remove unused leftover definitionsPablo Neira Ayuso2013-01-041-16/+0
|/ | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_DNAT: set IPv6 DNAT --to-destinationUlrich Weber2013-01-041-5/+5
| | | | | | | as in IPv4 and fixes DNAT_save Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extension: libip6t_DNAT: allow port DNAT without addressUlrich Weber2013-01-042-6/+16
| | | | | | | | | | | | | | | | | | | | | | | correct parsing of IPv6 port NAT without address NAT, assume one colon as port information. Allows: * address only: -j DNAT --to affe::1 -j DNAT --to [affe::1] * port only -j DNAT --to :80 -j DNAT --to :80-110 -j DNAT --to []:80 -j DNAT --to []:80-110 * address and port -j DNAT --to [affe::1]:80 -j DNAT --to [affe::1]:80-110 Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_DNPT: fix wording in DNPT targetUlrich Weber2013-01-031-9/+9
| | | | | | | | | replaces SNPT by DNPT. This fixes broken help message that points to SNPT. Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: resolve link failure for ip6t_NETMAPJan Engelhardt2013-01-021-8/+12
| | | | | | | | | | | | | | | | | | | | | | | | Link stage of libip6t_NETMAP failed since recently. CCLD libip6t_NETMAP.so /usr/lib64/gcc/x86_64-suse-linux/4.7/../../../../x86_64-suse-linux/bin/ld: cannot find -lip6tc libip6t_NETMAP.c uses the "ipv6_prefix_length" function from libip6tc.so; "-lip6tc" is used in the Makefile, but, the directory to it is not specified. Why does the link succeed for some people? Because /usr/lib(64)/libip6tc.so satisfies -lip6tc, but not all environments, especially those without iptables development files, have that file, hence this link error can happen. By suggestion of Mike Frysinger, this patch uses libtool to produce and link the plugins. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Acked-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* bump version to 1.4.17v1.4.17Pablo Neira Ayuso2012-12-251-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Manpage update: matches are evaluated in the order they are specified.Jozsef Kadlecsik2012-12-061-1/+2
| | | | Fixes bugzilla id 797.
* extensions: libxt_statistic: Fix save outputTom Eastep2012-11-191-1/+1
| | | | | | | | | | Suppressing '--packet 0' in save output resulted in restore failure. This patch includes '--packet 0' in save output while continuing to suppress it in print output. Signed-off-by: Tom Eastep <teastep@shorewall.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'next' branch that contains new features scheduled forPablo Neira Ayuso2012-10-2524-257/+1262
|\ | | | | | | Linux kernel 3.7
| * libxt_time: add support to ignore day transitionFlorian Westphal2012-09-303-0/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, if you want to do something like: "match Monday, starting 23:00, for two hours" You need two rules, one for Mon 23:00 to 0:00 and one for Tue 0:00-1:00. The rule --weekdays Mo --timestart 23:00 --timestop 01:00 looks correct, but it will first match on monday from midnight to 1 a.m. and then again for another hour from 23:00 onwards. This permits userspace to explicitly ignore the day transition and match for a single, continuous time period instead. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: add NPT extensionPatrick McHardy2012-09-103-0/+158
| | | | | | | | | | | | | | | | Add extensions for the SNPT and DNPT stateless IPv6-to-IPv6 Network Prefix Translation targets. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: add IPv6 NETMAP extensionPatrick McHardy2012-09-102-1/+94
| | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: add IPv6 REDIRECT extensionPatrick McHardy2012-09-101-0/+151
| | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: add IPv6 DNAT targetPatrick McHardy2012-09-101-0/+247
| | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: add IPv6 SNAT extensionPatrick McHardy2012-09-101-0/+247
| | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * extensions: add IPv6 MASQUERADE extensionPatrick McHardy2012-09-103-0/+188
| | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * Convert the NAT targets to use the kernel supplied nf_nat.h headerPatrick McHardy2012-09-1011-256/+144
| | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | bump iptables to 1.4.16.3v1.4.16.3Pablo Neira Ayuso2012-10-181-1/+1
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | build: resolve compile abort in libxt_limit on RHEL5Jan Engelhardt2012-10-102-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | libxt_limit.c: In function 'print_rate': libxt_limit.c:124: error: 'INFINITY' undeclared (first use in this function) The default mode of glibc-2.15's <features.h> sets "-D_POSIX_C_SOURCE=200809L", and therefore "-D_ISOC99_SOURCE". However, on ├że olde RHEL 5's glibc-2.5, it only has "-D_POSIX_C_SOURCE=200112L". Explicitly draw in the definition of INFINITY by always defining _ISOC99_SOURCE. By doing this, we are moving off of the default set, so _BSD_SOURCE also needs to be explicitly set to get at IFNAMSIZ that is used in xt_hashlimit.h. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | build: remove symlink-only extensions from static object listJan Engelhardt2012-10-091-4/+4
| | | | | | | | | | | | | | | | | | | | | | $ ./configure --enable-static --disable-shared --enable-ipv4 --enable-ipv6 && make [...] make[3]: *** No rule to make target "libxt_NOTRACK.o", needed by "libext.a". Stop. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | bump version to 1.4.16.2v1.4.16.2Pablo Neira Ayuso2012-10-081-1/+1
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: restore NOTRACK functionality, target aliasingJan Engelhardt2012-10-083-27/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit v1.4.16-1-g2aaa7ec is testing for real_name (not) being NULL which was always false (true). real_name was never NULL, so cs->jumpto would always be used, which rendered -j NOTRACK unusable, since the chosen real name.revision is for example NOTRACK.1, which does not exist at the kernel side. # ./iptables/xtables-multi main4 -t raw -A foo -j NOTRACK dbg: Using NOTRACK.1 WARNING: The NOTRACK target is obsolete. Use CT instead. iptables: Protocol wrong type for socket. To reasonably support the extra-special verdict names, make it so that real_name remains NULL when an extension defined no alias, which we can then use to determine whether the user entered an alias name (which needs to be followed) or not. [ I have mangled this patch to remove a comment unnecessarily large. BTW, this patch gets this very close to the initial target aliasing proposal --pablo ] Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | bump version to 1.4.16.1v1.4.16.1Pablo Neira Ayuso2012-10-081-1/+1
| | | | | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables: fix standard targetPablo Neira Ayuso2012-10-082-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This regression was added by: commit cd2f9bdbb7f9b737e5d640aafeb78bcd8e3a7adf Author: Jan Engelhardt <jengelh@inai.de> Date: Tue Sep 4 05:24:47 2012 +0200 iptables: support for target aliase The result is that: iptables -I INPUT -j ACCEPT says: iptables: No chain/target/match by that name. This also breaks iptables-restore, of course. Jan, you'll have to explain me how you have tested this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>