summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* build: add software version to manpage first line at configure stagePablo Neira Ayuso2013-08-225-4/+6
| | | | | | | | | | | | This patch adds the software version to the first line of the following manpages: iptables-save.8 iptables-restore.8 iptables-apply.8 iptables-xml.1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: iptables-xm1.1 correct man sectionLaurence J. Lane2013-08-221-1/+1
| | | | | | | iptables-xml.8 was moved to iptables-xm1.1. Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: libip(6)t_REJECT.man default icmp typesLaurence J. Lane2013-08-222-7/+6
| | | | | | | | | | | | The extension man page shows "port-unreach" and "port-unreachable" as default icmpv6 and icomp reject-with types. Either and variations work fine for writing rules, but they are displayed as "icmp6-port-unreachable" and "icmp-port-unreachable". Let's make that consistent. http://bugs.debian.org/644819 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: libxt_conntrack.man extraneous commasLaurence J. Lane2013-08-221-2/+2
| | | | | | | | | | | The first might work. The second doesn't. (The other corrections in the bug report are already implemented.) http://bugs.debian.org/654983 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: libxt_hashlimit.man: correct addressLaurence J. Lane2013-08-221-1/+1
| | | | | | | | | Corrects an example address with subnet mask. http://bugs.debian.org/698393 Signed-off-by: Laurence J. Lane <ljlane@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip[6]tables: fix incorrect alignment in commands_v_optionsPablo Neira Ayuso2013-08-142-2/+2
| | | | | | | | | | CMD_ZERO_NUM is 14, so it has to be defined in position 15 in the commands_v_options array. This does not manifests easily since commands from 9 to 14 have a very similar pattern in such array. Based on this patch: http://patchwork.ozlabs.org/patch/188153/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'stable-1.4.20'Pablo Neira Ayuso2013-08-081-0/+6
|\ | | | | | | | | | | To retrieve: iptables: state match incompatibilty across versions
| * iptables: state match incompatibilty across versionsPhil Oester2013-08-081-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As reported in Debian bug #718810 [1], state match rules added in < 1.4.16 iptables versions are incorrectly displayed by >= 1.4.16 iptables versions. Issue bisected to commit 0d701631 (libxt_state: replace as an alias to xt_conntrack). Fix this by adding the missing .print and .save functions for state match aliases in the conntrack match. [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718810 Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge branch 'stable-1.4.20'Pablo Neira Ayuso2013-08-081-1/+1
|\| | | | | | | | | | | To retrieve: iptables: correctly reference generated file
| * iptables: correctly reference generated fileLutz Jaenicke2013-08-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | Since (14bca55 iptables: use autoconf to process .in man pages), the file "iptables-extensions.8.tmpl" is generated from "iptables-extensions.8.tmpl.in" and is consequently no longer found in ${srcdir} but in the build directory. (Becomes visible with builddir != srcdir) Signed-off-by: Lutz Jaenicke <ljaenicke@innominate.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | xtables: trivial spelling fixstephen hemminger2013-08-071-2/+2
| | | | | | | | | | Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | doc: merge ip6table man pages into ipv4 onesFlorian Westphal2013-08-0710-610/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | a couple of improvements to the iptables man page never made it into ip6tables version. The number of differences between these two files is so small that it seems preferable to alias the ipv6 man pages to their ipv4 counterpart and change iptables man page to specifically document differences (e.g. lack of ip6tables -f, etc). Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | doc: add libnetfilter_queue pointer to libxt_NFQUEUE.manFlorian Westphal2013-08-062-19/+12
| | | | | | | | | | | | | | | | ... and remove the QUEUE snippets from ip(6)tables man page, the queue target was replaced by nfqueue years ago. Fix up a couple of needless differences in ip(6)tables.8, too. Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: libxt_socket: update man pageFlorian Westphal2013-08-061-2/+19
| | | | | | | | | | | | | | | | | | | | | | Document --nowildcard option and its implications when using -m socket to intercept packets. While at it, update man page with Balazs Scheidlers comments from nf_tproxy_core.h in kernel tree to better explain how lookup is performed. Cc: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* | xt_socket: add --nowildcard flagEric Dumazet2013-08-062-0/+69
|/ | | | | | | | | | | | | | | | | | | | | xt_socket module can be a nice replacement to conntrack module in some cases (SYN filtering for example) But it lacks the ability to match the 3rd packet of TCP handshake (ACK coming from the client). Add a XT_SOCKET_NOWILDCARD flag to disable the wildcard mechanism The wildcard is the legacy socket match behavior, that ignores LISTEN sockets bound to INADDR_ANY (or ipv6 equivalent) iptables -I INPUT -p tcp --syn -j SYN_CHAIN iptables -I INPUT -m socket -j ACCEPT Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Patrick McHardy <kaber@trash.net> Cc: Jesper Dangaard Brouer <brouer@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables 1.4.20 releasev1.4.20Pablo Neira Ayuso2013-08-061-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-xml: fix parameter parsing (similar to 2165f38)Pablo Neira Ayuso2013-07-261-1/+1
| | | | | | | | Similar to (2165f38 iptables-restore: fix parameter parsing (shows up with gcc-4.7)), make sure iptables-xml doesn't hit the same problem. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: iptables-xml: Fix various parsing bugsPhil Oester2013-07-261-6/+13
| | | | | | | | | | | | | There are two bugs in iptables-xml do_rule_part parsing corrected by this patch: 1) Ignore "-A <chain>" instead of just "-A" 2) When checking to see if we need a <match> tag, inversion needs to be taken into account This closes netfilter bugzilla #679. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: fail in configure on missing dependency with --enable-bpf-compilerWillem de Bruijn2013-07-261-0/+4
| | | | | | | | | | | The build of utils/nfbpf_compile depends on libpcap. If configure is run with --enable-bpf-compiler, the script succeeds, but make fails. This small patch adds a test for the dependency (libpcap) in configure and fails hard if not found. Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: additional include path required after UAPI changesPhil Oester2013-07-241-2/+2
| | | | | | | | | | | | | | After kernel commit 607ca46e (UAPI: (Scripted) Disintegrate include/linux), using the "--with-kernel" argument to build iptables stopped working due to the missing #ifdefs in the original files. We need to make sure the UAPI include dir is listed before the original location. Leaving both allows support for old and new kernels. This fixes bug #833. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxt_CT: Add the "NOTRACK" aliasJozsef Kadlecsik2013-07-243-3/+54
| | | | | | | Available since Linux kernel 3.8. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libip6t_LOG: target output is different to libipt_LOGPhil Oester2013-07-241-2/+4
| | | | | | | | | libipt_LOG is using the xtables_save_string func, which escapes unsafe characters as needed. libip6t_LOG should do the same. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxt_recent: restore minimum value for --secondsPablo Neira Ayuso2013-07-241-1/+1
| | | | | | | This checking was accidentally removed in (74ded72 libxt_recent: add --mask netmask). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_connlabel: use libnetfilter_conntrackFlorian Westphal2013-07-166-127/+45
| | | | | | | | | | | | | | | | | Pablo suggested to make it depend on lnf-conntrack, and get rid of the example config file as well. The problem is that the file must be in a fixed path, /etc/xtables/connlabel.conf, else userspace needs to "guess-the-right-file" when translating names to their bit values (and vice versa). Originally "make install" did put an example file into /etc/xtables/, but distributors complained about iptables ignoring the sysconfdir. So rather remove the example file, the man-page explains the format, and connlabels are inherently system-specific anyway. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libipt_ULOG: man page should mention NFLOG as replacementFlorian Westphal2013-07-151-1/+2
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* libxt_recent: restore reap functionality to recent moduleRussell Senior2013-07-151-0/+2
| | | | | | | | | | | | The reap functionality appears to have been accidentally disabled by (74ded72 libxt_recent: add --mask netmask) since iptables 1.4.15 and later. This adds a patch to restore reap functionality for recent_opts_v1. Patch obtained via: http://patchwork.openwrt.org/patch/3812/ Signed-off-by: Russell Senior <russell@personaltelco.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip{6}tables-restore: fix breakage due to new locking approachPablo Neira Ayuso2013-07-088-10/+22
| | | | | | | | | | | | | | | | Since (93587a0 ip[6]tables: Add locking to prevent concurrent instances), ip{6}tables-restore does not work anymore: iptables-restore < x Another app is currently holding the xtables lock. Perhaps you want to use the -w option? do_command{6}(...) is called from ip{6}tables-restore for every iptables command contained in the rule-set file. Thus, hitting the lock error after the second command. Fix it by bypassing the locking in the ip{6}tables-restore path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip6tables: don't print out /128Phil Oester2013-07-081-1/+5
| | | | | | | | Similar to how iptables does not print /32 on IPv4 addresses, ip6tables should not print out /128 on IPv6 addresses. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
* doc: clarify DEBUG usage macroAlexey Perevalov2013-07-081-0/+2
| | | | | Signed-off-by: Alexey Perevalov <a.perevalov@samsung.com> Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org>
* Merge branch 'stable'Pablo Neira Ayuso2013-06-121-2/+2
|\ | | | | | | Get c545933 iptables: Fix connlabel.conf install location
| * iptables: Fix connlabel.conf install locationPhil Oester2013-06-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally installed in /etc/xtables instead of using prefix set at configure time. Fix to use sysconfdir variable. This closes bugzilla #828. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | ip[6]tables: Add locking to prevent concurrent instancesPhil Oester2013-06-116-2/+81
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There have been numerous complaints and bug reports over the years when admins attempt to run more than one instance of iptables simultaneously. Currently open bug reports which are related: 325: Parallel execution of the iptables is impossible 758: Retry iptables command on transient failure 764: Doing -Z twice in parallel breaks counters 822: iptables shows negative or other bad packet/byte counts As Patrick notes in 325: "Since this has been a problem people keep running into, I'd suggest to simply add some locking to iptables to catch the most common case." I started looking into alternatives to add locking, and of course the most common/obvious solution is to use a pidfile. But this has various downsides, such as if the application is terminated abnormally and the pidfile isn't cleaned up. And this also requires a writable filesystem. Using a UNIX domain socket file (e.g. in /var/run) has similar issues. Starting in 2.2, Linux added support for abstract sockets. These sockets require no filesystem, and automatically disappear once the application terminates. This is the locking solution I chose to implement in ip[6]tables. As an added bonus, since each network namespace has its own socket pool, an ip[6]tables instance running in one namespace will not lock out an ip[6]tables instance running in another namespace. A filesystem approach would have to recognize and handle multiple network namespaces. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Introduce a new revision for the set match with the counters supportJozsef Kadlecsik2013-06-074-12/+312
| | | | | | | | | | | | | | | | The revision add the support of matching the packet/byte counters if the set was defined with the extension. Also, a new flag is introduced to suppress updating the packet/byte counters if required. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* | extensions: libxt_LOG: rename IPv4 manpage and tell about IPv6 supportMart Frauenlob2013-06-072-37/+3
| | | | | | | | | | Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: libxt_MASQUERADE: rename IPv4 manpage and tell about IPv6 supportMart Frauenlob2013-06-072-36/+4
| | | | | | | | | | | | | | also update list of protocols valid for port mapping. Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Florian Westphal <fw@strlen.de>
* | configure: display summaryEric Leblond2013-06-051-2/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a message at the end of configure which displays the different compilation options and system settings. An example output is the following: Iptables Configuration: IPv4 support: yes IPv6 support: yes Devel support: yes IPQ support: no Large file support: yes BPF utils support: no Build parameters: Put plugins into executable (static): no Support plugins via dlopen (shared): yes Installation prefix (--prefix): /usr/local Xtables extension directory: /usr/local/lib/xtables Pkg-config directory: /usr/local/lib/pkgconfig Kernel build directory: /lib/modules/custom Host: x86_64-unknown-linux-gnu GCC binary: gcc Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge branch 'stable'Pablo Neira Ayuso2013-05-301-2/+1
|\| | | | | | | Get fix for LED extension.
| * extensions: libxt_LED: fix parsing of delayPablo Neira Ayuso2013-05-301-2/+1
| | | | | | | | | | | | | | Closes bugzilla: https://bugzilla.netfilter.org/show_bug.cgi?id=825 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | xtables: improve get_modprobe handlingPhil Oester2013-05-291-11/+11
| | | | | | | | | | | | | | | | | | | | | | In bug #455, Dmitry V. Levin proposed a more robust get_modprobe implementation. The patch below is a version of his patch, updated to apply to current git. This closes bug #455. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
* | iptables: use autoconf to process .in man pagesAndy Spencer2013-05-296-12/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | This fixes a bug in iptables.8 and ip6tables.8 where @PACKAGE_VERSION@ was not processed in the VERSION section. It also simplifies the Makefile by avoiding some sed commands. [ Mangled this patch to rename iptables-extensions.8.in to iptables-extensions.8.tmpl.in to avoid having a file whose name is terminated by .in.in --pablo ] Signed-off-by: Andy Spencer <andy753421@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | extensions: libxt_SNAT: rename IPv4 manpage and tell about IPv6 supportMart Frauenlob2013-05-291-8/+7
| | | | | | | | | | | | | | | | | | | | | | This patch renames libipt_SNAT.man to libxt_SNAT.man thus informing about the IPv6 version. Also the list of valid protocols for port mapping is updated to: tcp, udp, dccp and sctp. Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | extensions: libxt_NETMAP: rename IPv4 manpage and tell about IPv6 supportMart Frauenlob2013-05-291-0/+2
| | | | | | | | | | | | | | | | This patch renames libipt_NETMAP.man to libxt_NETMAP.man thus informing about the IPv6 version. Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | extensions: libxt_REDIRECT: rename IPv4 manpage and tell about IPv6 supportMart Frauenlob2013-05-291-7/+6
| | | | | | | | | | | | | | | | | | | | | | This patch renames libipt_REDIRECT.man to libxt_REDIRECT.man thus informing about the IPv6 version. Also the list of valid protocols for port mapping is updated to: tcp, udp, dccp and sctp. Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | extensions: libxt_DNAT: rename IPv4 manpage and tell about IPv6 supportMart Frauenlob2013-05-291-8/+7
| | | | | | | | | | | | | | | | | | | | | | This patch renames libipt_DNAT.man to libxt_DNAT.man thus informing about the IPv6 version, as suggested by Patrick McHardy. Also, it updates the list of valid protocols for port mapping is updated to: tcp, udp, dccp and sctp. Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | libip6t_mh: Correct command to list named mh types in manpageMart Frauenlob2013-05-291-1/+1
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* | extensions: add copyright statementsPatrick McHardy2013-05-299-0/+34
| | | | | | | | | | | | Add copyright statements to all extensions authored by myself. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | extensions: libxt_NFQUEUE: add --queue-cpu-fanout parameterholger@eitzenberger.org2013-05-293-3/+76
|/ | | | | Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables 1.4.19.1 releasev1.4.19.1Pablo Neira Ayuso2013-05-291-1/+1
| | | | | | | Unfortunately, previous release was not included two patches that were applied by Florian recently. This release fixes it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: bump version to 1.4.19Pablo Neira Ayuso2013-05-291-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: mention SNAT in INPUT chain since kernel 2.6.36Michael Roth2013-05-191-1/+10
| | | | | | | | SNAT in the INPUT chain was added Jun 2010 to the kernel (commit c68cd6cc21eb329c47ff020ff7412bf58176984e). Signed-off-by: Michael Roth <mail@mroth.net> Signed-off-by: Florian Westphal <fw@strlen.de>