summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* libxt_dccp: fix deprecated intrapositional ordering of !Jan Engelhardt2011-08-211-4/+5
| | | | | | | | This bug goes back to v1.4.3~63. References: Dave Täht via netfilter-devel on 2011-08-20 14:40:11 -0700 References: <CAA93jw6mpDL6rLXM+9SpAhafkDdKoSfhAxU8UM87vUqjuzjYJw@mail.gmail.com> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_dccp: restore missing XTOPT_INVERT tags for optionsJan Engelhardt2011-08-212-2/+4
| | | | | | | | This regression goes back to v1.4.11~19^2. References: Dave Täht via netfilter-devel on 2011-08-20 14:40:11 -0700 References: <CAA93jw6mpDL6rLXM+9SpAhafkDdKoSfhAxU8UM87vUqjuzjYJw@mail.gmail.com> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_conntrack: remove one misleading commentJan Engelhardt2011-08-211-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: clarify libxt_connlimit defaultsJan Engelhardt2011-08-211-1/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_string: fix space around argumentsDwight Davis2011-08-202-2/+3
| | | | | | | Fix oversight from commit v1.4.11~80. References: http://bugs.debian.org/637499 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_set: put differing variable names in directlyJan Engelhardt2011-08-202-18/+6
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: fix typo in libxt_TRACEBernard Massot2011-08-201-1/+1
| | | | | References: http://bugzilla.netfilter.org/show_bug.cgi?id=736 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_tcp: always print the mask partsJan Engelhardt2011-08-201-3/+1
| | | | | | | | | 0xFF is unlikely to happen (given that ALL translates to 0x3F at most), but assuming that through magic, 0xFF was put into memory, iptables -S/iptables-save would ignore printing it, practically outputting just one argument to --tcp-flags which currently wants two. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_set: update man page about kernel support on the featureJan Engelhardt2011-08-202-6/+4
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_u32: fix missing allowance for inversionJan Engelhardt2011-08-202-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2011-08-0911-64/+83
|\
| * libipq: add pkgconfig fileJan Engelhardt2011-08-084-1/+16
| | | | | | | | | | | | | | | | | | This is just to make sure that projects (still) using it do so with the right cflags, e.g. for when the include file ends up in a non-standard location due to ./configure having been called with --include=/somewhere/else. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * build: abort autogen on subcommand failureJan Engelhardt2011-08-011-1/+1
| | | | | | | | | | | | | | Needed to stop an automated build process when automake requirements are not fulfilled. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * build: strengthen check for overlong lladdr componentsJan Engelhardt2011-08-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ethermac[i] > UINT8_MAX is quite pointless, because ethermac[i] is just uint8_t. To catch values that are not in the range "00"-"ff", use a string length check (end-arg>2). I am willingly using 2 there, because no one is going to specify an Ethernet LL address as "0x00:0x24:0xbe:0xc2:0x7f:0x16" -- because it is always interpreted as hexadecimal anyway even without the 0x prefix. xtoptions.c: In function "xtopt_parse_ethermac": xtoptions.c:760:3: warning: comparison is always false due to limited range of data type xtoptions.c:766:2: warning: comparison is always false due to limited range of data type Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * build: workaround broken linux-headers on RHEL-5Jan Engelhardt2011-08-011-0/+2
| | | | | | | | | | | | | | maigc.h was not invented yet, but they do not ship proc_fs.h either, duh. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_string: define _GNU_SOURCE for strnlenJan Engelhardt2011-08-011-0/+1
| | | | | | | | | | | | | | | | | | On RHEL-5.6 and clones with its gcc-4.1.2 and glibc-2.5: libxt_string.c: In function "parse_string": libxt_string.c:84: warning: implicit declaration of function "strnlen" Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_TCPMSS: restore build with IPv6-less libcsJan Engelhardt2011-07-223-4/+5
| | | | | | | | | | | | | | Commit v1.4.10-149-gea2a02f added an netinet/ip6.h include, which is not available on systems without IPv6 header files. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * extensions: use multi-target registrationJan Engelhardt2011-07-222-56/+56
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | Bump version to 1.4.12v1.4.12Patrick McHardy2011-07-221-1/+1
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* | Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2011-07-1110-112/+65
|\|
| * libxt_conntrack: move more data into the xt_option_entryJan Engelhardt2011-07-101-8/+6
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_conntrack: restore network-byte order for v1,v2Jan Engelhardt2011-07-101-7/+39
| | | | | | | | | | | | References: http://bugs.debian.org/632804 References: http://marc.info/?l=netfilter-devel&m=130999299016674&w=2 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxtables: set clone's initial data to NULLJan Engelhardt2011-07-101-0/+1
| | | | | | | | | | | | | | Avoid a crash in xs_init_match when a clone's m->udata points at the parent. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * option: remove last traces of intrapositional negationJan Engelhardt2011-07-109-76/+0
| | | | | | | | | | | | Intrapositional negation was deprecated in 1.4.3. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxtables: ignore whitespace in the multiaddress argument parserJan Engelhardt2011-07-091-0/+4
| | | | | | | | | | References: http://bugzilla.netfilter.org/show_bug.cgi?id=727 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxtables: properly reject empty hostnamesJan Engelhardt2011-07-091-26/+20
| | | | | | | | | | | | | | | | | | An empty hostname in the address list of an -s/-d argument, which may be the result of a typo, is interpreted as 0/0, which, when combined with -j ACCEPT, leads to an undesired opening of the firewall. References: http://bugzilla.netfilter.org/show_bug.cgi?id=727 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2011-07-055-10/+4
|\|
| * iptables: restore negation for -fJan Engelhardt2011-07-051-1/+1
| | | | | | | | | | | | | | This move was missed in commit v1.4.11~77^2~6. References: http://bugs.debian.org/632695 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * doc: the -m option cannot be invertedJan Engelhardt2011-07-042-6/+0
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * doc: fix version string in ip6tables.8Jan Engelhardt2011-07-041-1/+1
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * build: install modules in arch-dependent locationJan Engelhardt2011-07-042-2/+2
| | | | | | | | | | | | | | Make it possible to have multiple types of ELF classes for the extension modules by putting them in an arch-dependent path. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2011-06-3026-162/+222
|\|
| * doc: mention multiple verbosity flagsJan Engelhardt2011-06-302-2/+4
| | | | | | | | | | | | | | | | "-vv" can be used to further increase the verbosity level. Document this. References: http://bugs.debian.org/616037 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * iptables-apply: select default rule file depending on call nameMartin F. Krafft2011-06-301-12/+13
| | | | | | | | | | | | | | | | | | | | ip6tables-apply points to iptables-apply (which is good). Since iptables/ip6tables rule files are different, the reporter suggests that the DEFAULT_FILE variable should depend on whether iptables-apply or ip6tables-apply is run. References: http://bugs.debian.org/547734 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * build: attempt to fix building under Linux 2.4Jan Engelhardt2011-06-242-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | iptables no longer compiles for Linux 2.4 because it uses linux/magic.h. This header and the PROC_SUPER_MAGIC macro are only for Linux 2.6. xtables.c:35:52: error: linux/magic.h: No such file or directory xtables.c: In function 'proc_file_exists': xtables.c:389: error: 'PROC_SUPER_MAGIC' undeclared (first use in this function) xtables.c:389: error: (Each undeclared identifier is reported only once for each function it appears in.) References: http://bugzilla.netfilter.org/show_bug.cgi?id=720 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * doc: fix group range in libxt_NFLOG's manJakub Zawadzki2011-06-241-1/+1
| | | | | | | | | | References: http://bugzilla.netfilter.org/show_bug.cgi?id=723 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_RATEEST: fix userspacesize fieldMassimo Maggi2011-06-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I cannot delete a rule by matching it if the target of the rule is RATEEST. Copy-paste from terminal: # iptables -t mangle -A PREROUTING -j RATEEST --rateest-name somename --rateest-interval 250ms --rateest-ewmalog 4s # iptables -t mangle -D PREROUTING -j RATEEST --rateest-name somename --rateest-interval 250ms --rateest-ewmalog 4s iptables: No chain/target/match by that name. I saw in comments of the kernel code that the last part of the struct xt_rateest_target_info is used only by kernel: struct xt_rateest_target_info { char name[IFNAMSIZ]; __s8 interval; __u8 ewma_log; /* Used internally by the kernel */ struct xt_rateest *est __attribute__((aligned(8))); }; but in struct xtables_target, .size and .userspacesize are equal. Simply correcting this solved the problem. References: http://bugzilla.netfilter.org/show_bug.cgi?id=724 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * iptables: Coverity: RESOURCE_LEAKJiri Popelka2011-06-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | xtables.c:320: alloc_fn: Calling allocation function "get_modprobe". xtables.c:294: alloc_fn: Storage is returned from allocation function "malloc". xtables.c:294: var_assign: Assigning: "ret" = "malloc(1024UL)". xtables.c:304: return_alloc: Returning allocated memory "ret". xtables.c:320: var_assign: Assigning: "buf" = storage returned from "get_modprobe()". xtables.c:323: var_assign: Assigning: "modprobe" = "buf". xtables.c:348: leaked_storage: Variable "buf" going out of scope leaks the storage it points to. xtables.c:348: leaked_storage: Returning without freeing "modprobe" leaks the storage that it points to. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * iptables: Coverity: VARARGSJiri Popelka2011-06-221-3/+9
| | | | | | | | | | | | | | | | | | xtables.c:931: va_init: Initializing va_list "args". xtables.c:938: missing_va_end: va_end was not called for "args". xtables.c:947: missing_va_end: va_end was not called for "args". xtables.c:961: missing_va_end: va_end was not called for "args". Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * iptables: Coverity: REVERSE_INULLJiri Popelka2011-06-223-6/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | ip6tables-restore.c:186: deref_ptr_in_call: Dereferencing pointer "in". ip6tables-restore.c:463: check_after_deref: Dereferencing "in" before a null check. iptables-restore.c:192: deref_ptr_in_call: Dereferencing pointer "in". iptables-restore.c:468: check_after_deref: Dereferencing "in" before a null check. iptables-xml.c:671: deref_ptr_in_call: Dereferencing pointer "in". iptables-xml.c:873: check_after_deref: Dereferencing "in" before a null check. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * iptables: Coverity: NEGATIVE_RETURNSJiri Popelka2011-06-221-1/+0
| | | | | | | | | | | | | | | | libipq.c:232: var_tested_neg: Variable "h->fd" tests negative. libipq.c:234: negative_returns: "h->fd" is passed to a parameter that cannot be negative. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * iptables: Coverity: DEADCODEJiri Popelka2011-06-221-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | libiptc.c:407: dead_error_condition: On this path, the condition "res > 0" cannot be false. libiptc.c:396: at_least: After this line, the value of "res" is at least 1. libiptc.c:393: equality_cond: Condition "res == 0" is evaluated as false. libiptc.c:396: new_values: Noticing condition "res < 0". libiptc.c:425: new_values: Noticing condition "res < 0". libiptc.c:407: new_values: Noticing condition "res > 0". libiptc.c:435: dead_error_line: Execution cannot reach this statement "return list_pos;". Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * build: bump soversion for recent data structure changeJan Engelhardt2011-06-221-1/+1
| | | | | | | | | | | | Cf. commit v1.4.11.1-5-g2dba676. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_hashlimit: use a more obvious expiry value by defaultJan Engelhardt2011-06-222-16/+46
| | | | | | | | | | | | | | | | | | | | Due to the previous default expiry of 10 sec, "--hashlimit 1/min" would allow matching up to 6/min if a properly timed. To do what the user expects, the minimum expiry must equal the selected time quantum however. Cc: Jan Rovner <jan.rovner@diadema.cz> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_state: fix regression about inversion of main optionJan Engelhardt2011-06-222-1/+3
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libip6t_HL: fix option names from ttl -> hlJan Engelhardt2011-06-222-5/+17
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_RATEEST: abolish global variablesJan Engelhardt2011-06-211-7/+12
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_rateest: abolish global variablesJan Engelhardt2011-06-211-9/+3
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * extensions: support for per-extension instance "global" variable spaceJan Engelhardt2011-06-213-3/+37
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * iptables: consolidate target/match init callJan Engelhardt2011-06-214-14/+22
| | | | | | | | | | | | | | This is useful for the upcoming patch about per-instance auxiliary data. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>