summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* ip6tables: spacing fixes for -o argumentJan Engelhardt2011-02-161-1/+1
| | | | | | For aesthetic consistency, put a space after -o. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix segfault target option parsingJan Engelhardt2011-02-112-6/+6
| | | | | | | With v1.4.10-58-g94e247b, target option parsing started to happen in the wrong case. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2011-02-094-671/+608
|\
| * iptables: fix error message for unknown optionsJan Engelhardt2011-02-072-20/+14
| | | | | | | | | | | | | | -From: iptables v1.4.10: option "-q" requires an argument +To: iptables v1.4.10: unknown option "-q" Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: move match option handling from do_command6 into its own functionsJan Engelhardt2011-02-072-52/+55
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: move jump option handling from do_command6 into its own functionJan Engelhardt2011-02-073-72/+80
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: unclutter command_default functionJan Engelhardt2011-02-072-118/+91
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (Essentially, 5 levels of indentation have been stripped compared to the original layout, and this is surely a result that looks a lot better than it did before.) Things to note: 1. If the m->parse call succeeded, we can return from the function and do not need to go through the other code. As such, "m" is guaranteed to be useless at the end of the match loop, and so, conditions can be removed. 2. Since the per-extension parse function only ever get their own option codes (since v1.4.10-26-gd09b6d5), their return value no longer has a meaning and can be ignored. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: deduplicate and simplify implicit protocol extension loadingJan Engelhardt2011-02-074-69/+37
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: put shared option flags into xsharedJan Engelhardt2011-02-073-28/+19
| | | | | | | | | | | | This will be needed for the find_proto function. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: move OPT_FRAGMENT to the end so the list can be sharedJan Engelhardt2011-02-071-11/+11
| |
| * src: deduplicate find_proto functionJan Engelhardt2011-02-074-71/+41
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: share iptables_command_state across the two programsJan Engelhardt2011-02-073-55/+49
| | | | | | | | | | | | | | struct iptables_command_state and quite a bit of the code looks worthy of deduplication. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: move large default: block from do_command6 into its own functionJan Engelhardt2011-02-062-203/+225
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: collect do_command variables in a structJan Engelhardt2011-02-062-316/+330
| | | | | | | | | | | | | | This will make it easier to put the code for the cases into separate functions. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | libxt_cluster: fix inversion in the cluster matchPablo Neira Ayuso2011-02-061-2/+2
|/ | | | | | | | | | | | | | | | | | | | In libxt_cluster.c, we use: info->flags |= (1 << XT_CLUSTER_F_INV); but we should use instead: info->flags |= XT_CLUSTER_F_INV; since the definition of XT_CLUSTER_F_INV is: enum xt_cluster_flags { XT_CLUSTER_F_INV = (1 << 0) }; This fixes the inversion in the cluster match. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: add extension for devgroup matchPatrick McHardy2011-02-032-0/+318
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: do not print trailing whitespacesJan Engelhardt2011-01-3193-996/+940
| | | | | | | | | | | | | | | | | Due to the use of printf("foobar "), iptables emits spaces at the end-of-line, which looks odd to some users because it causes the terminal to wrap even if there is seemingly nothing to print. It may also have other points of annoyance, such as mailers interpreting a trailing space as an indicator that the paragraph continues when format=flowed is also on. And git highlights trailing spaces in red, so let's avoid :) Preexisting inconsistencies in outputting spaces in the right spot are also addressed right away. References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=429579 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: remove more redundant castsJan Engelhardt2011-01-312-6/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: remove bogus address-ofJan Engelhardt2011-01-312-2/+2
| | | | | | | Casts are bad. &curtable is actually of type char (*)[], which is quite different from what add_argv expects. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: warn when parameter limit is exceededJan Engelhardt2011-01-312-2/+8
| | | | | | | | | While testing many match extensions in a single rule, I ran into this error not warned about. Arguments were just ignored, causing surprising "Need to specify an argument to --whatever" when the argument was in fact given on the command line. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: set custom opts to NULL on freeJan Engelhardt2011-01-311-1/+3
| | | | | | | | | When inside ip6tables-restore, xtables_free_opts can be called multiple times, especially when trying to exit with an error message from outside do_command. So set it to NULL so that we do not attempt to free a dangling pointer. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_u32: enclose argument in quotesJan Engelhardt2011-01-311-1/+2
| | | | | | | Otherwise ip6tables-save piped to ip6tables-restore can cause a parse error when the expression list is empty. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: improve error reporting with extension loading troublesJan Engelhardt2011-01-311-26/+27
| | | | | | | | | | | ip6tables v1.4.8: Could not load match "osf": /usr/lib/xtables/libip6t_osf.so: cannot open shared object file: No such file or directory Given that libxt_osf.so exists, a better error is now emitted. References: http://bugzilla.netfilter.org/show_bug.cgi?id=637 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_quota: clarifications on matchingJan Engelhardt2011-01-251-1/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Fix listing/saving the new revision of the SET targetJozsef Kadlecsik2011-01-211-1/+1
| | | | | Instead of the dimension of the set, the max dimension was used at listing/saving the src,dst parameters, which produced broken output.
* libxt_connlimit: remove duplicate member that caused size changeJan Engelhardt2011-01-201-1/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: libxt_conntrack: add support for specifying port rangesPatrick McHardy2011-01-203-69/+207
| | | | | | | Add support for revision 3 of the conntrack match, which allows to specify port ranges for origsrc/origdst/replsrc/repldst. Signed-off-by: Patrick McHardy <kaber@trash.net>
* extensions: libxt_NFQUEUE: add v2 revision with --queue-bypass optionFlorian Westphal2011-01-203-7/+72
| | | | | | | | --queue-bypass: if no userpace program is listening on the queue, then allow packets to continue through the ruleset instead of dropping them. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxt_AUDIT: add AUDIT targetThomas Graf2011-01-202-0/+153
| | | | | | | | | libxt module for the AUDIT target. -j AUDIT --type (accept|reject|drop) Signed-off-by: Thomas Graf <tgraf@redhat.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxt_connlimit: support for dstaddr-supporting revision 1Jan Engelhardt2011-01-193-19/+106
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_connlimit: add a --connlimit-upto optionJan Engelhardt2011-01-182-30/+49
| | | | | | | | Direct specifications like "upto" are easier to grasp than "not above". This patch adds such an upto variant similar to what libxt_hashlimit already has. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_connlimit: reword help text to say prefix lengthJan Engelhardt2011-01-182-2/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_quota: print negation when it has been selectedJan Engelhardt2011-01-181-0/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: fix typo in error message of xtables_register_match()Li Yewang2011-01-091-1/+1
| | | | | Signed-off-by: Li Yewang <lyw@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxt_time: fix random --datestart skipsFlorian Westphal2011-01-091-0/+1
| | | | | | | | | | | | | | | | | | | | | Frank Lichtenheld points out that -m time --datestart ... sometimes messes up --datestart: $ iptables -A INPUT -m time --datestart 2010-11-24T16:50:00 -j ACCEPT $ iptables-save | grep 11 -A INPUT -m time --datestart 2010-11-24T16:50:00 -j ACCEPT $ iptables-save | iptables-restore $ iptables-save | grep 11 -A INPUT -m time --datestart 2010-11-24T15:50:00 -j ACCEPT --datestart moved by one hour. As the --timestart option does not care about DST, always set dst=0 when parsing --starttime input. Reported-by: Frank Lichtenheld <flichtenheld@astaro.com> Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libipt_REDIRECT: avoid dereference of uninitialized pointerStephen Beahm2011-01-081-1/+1
| | | | | | | | When using --to-ports with a port name instead of a numerical specification, a segfault occurs. References: http://bugzilla.netfilter.org/show_bug.cgi?id=691 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: do some option structure checkingJan Engelhardt2011-01-081-0/+17
| | | | | | | libxt_recent's use of numeric values >200 always looked worrisome. Now here is a validation routine for such. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libipt_CLUSTERIP: const annotationsJan Engelhardt2011-01-081-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_sctp: fix a typoJan Engelhardt2011-01-081-1/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: remove no longer necessary default: casesJan Engelhardt2011-01-0879-230/+5
| | | | | | | Match and target parse functions now only get option characters they have defined themselves. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* ip[6]tables: only call target's parse function when option char is in rangeJan Engelhardt2011-01-082-0/+4
| | | | | | | Same as previous commit. Doing this actually allows to remove code that is no longer needed. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* ip[6]tables: only call match's parse function when option char is in rangeJan Engelhardt2011-01-084-2/+12
| | | | | | | | | | | | | | | | | Normally, extensions use a "default:" case in switch(c) to just return if they do not handle c. Apparently, libip6t_hl does that too late and checks for hl-specific parsing state before it has established that c refers to one of its own options. Also affected: libipt_ttl, libxt_ipvs, libxt_policy, libxt_statistic. One way to fix this is to move the flags checks into case '2', '3', '4'. Doing this replication feels bad, so as an alternative, let's just free extensions from having to deal with other extension's options passing thru. References: http://marc.info/?l=netfilter-devel&m=129444759532377&w=2 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: reorder num_old substraction for clarityJan Engelhardt2011-01-081-4/+7
| | | | | | | | When going over this again, I noticed we happen to malloc too much. That is no problem, but I felt moving the num_old adjustment upwards makes things more clear, and also addresses the allocation. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: abort on empty interface specificationJan Engelhardt2011-01-082-0/+16
| | | | | | | | | | Fiedler Roman brings to attention that if, in a faulty script, "$some_variable" expands to an empty string, iptables should probably catch this most likely undesired invocation. If no/all interfaces were really desired, one can either omit -i completely, or use -i +. References: http://marc.info/?l=netfilter&m=129439862903487&w=2 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: use C99/POSIX typesJan Engelhardt2011-01-0848-168/+168
| | | | | | "u_int" was a non-standardized extension predating C99 on some platforms. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xt_comment: remove redundant castJan Engelhardt2011-01-072-2/+2
|
* src: const annotationsJan Engelhardt2010-12-182-25/+27
| | | | | | Also one int -> uint here on the way through. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables-restore: resolve confusing policy error messageRob Leslie2010-12-182-2/+2
| | | | | | | | | | | | | When iptables-restore (and ip6tables-restore) is unable to set a chain's policy, it responds with a confusing message, e.g.: iptables-restore v1.4.9: Can't set policy "PREROUTING" on "ACCEPT" line 16: Bad built-in chain name This is due to the chain and policy arguments being used in the wrong order. The attached patch corrects this problem. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2010-12-1527-97/+337
|\
| * build: stop on error in subcommandJan Engelhardt2010-12-111-2/+2
| | | | | | | | | | | | | | make only evaluates $? of an entire shell invocation. As such, if any command in the chain can fail, $? needs to be thrown, and early so. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 17:07:19 +0000