summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* doc: minimal spelling updates to xt_cpuJan Engelhardt2010-07-231-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: remove extra empty line from xt_cpuJan Engelhardt2010-07-231-1/+0
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: let man(1) autoalign the text in xt_cpuJan Engelhardt2010-07-231-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Merge branch 'master' into iptables-nextPatrick McHardy2010-07-230-0/+0
|\
| * extensions: REDIRECT: add random helpEric Dumazet2010-07-231-1/+2
| | | | | | | | | | Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | extension: add xt_cpu matchEric Dumazet2010-07-233-0/+125
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kernel 2.6.36 supports xt_cpu match In some situations a CPU match permits a better spreading of connections, or select targets only for a given cpu. With Remote Packet Steering or multiqueue NIC and appropriate IRQ affinities, we can distribute trafic on available cpus, per session. (all RX packets for a given flow are handled by a given cpu) Some legacy applications being not SMP friendly, one way to scale a server is to run multiple copies of them. Instead of randomly choosing an instance, we can use the cpu number as a key so that softirq handler for a whole instance is running on a single cpu, maximizing cache effects in TCP/UDP stacks. Using NAT for example, a four ways machine might run four copies of server application, using a separate listening port for each instance, but still presenting an unique external port : iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 0 \ -j REDIRECT --to-port 8080 iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 1 \ -j REDIRECT --to-port 8081 iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 2 \ -j REDIRECT --to-port 8082 iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 3 \ -j REDIRECT --to-port 8083 Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | extensions: REDIRECT: add random helpEric Dumazet2010-07-231-1/+2
| | | | | | | | | | Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | libxt_ipvs: user-space lib for netfilter matcher xt_ipvsHannes Eder2010-07-234-2/+424
| | | | | | | | | | | | | | | | | | The user-space library for the netfilter matcher xt_ipvs. [ trivial up-port by Simon Horman <horms@verge.net.au> ] Signed-off-by: Hannes Eder <heder@google.com> Acked-by: Simon Horman <horms@verge.net.au> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | Merge branch 'master' into iptables-nextPatrick McHardy2010-07-1533-1050/+952
|\|
| * extensions: libxt_rateest: fix bps options for iptables-saveLuciano Coelho2010-07-151-2/+4
| | | | | | | | | | | | | | | | | | | | The output generated by the libxt_rateest extension for bps matches was wrong and could not be restored properly. This patch fixes this problem by using the correct options in the right order when saving the table. Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * xt_quota: also document negationJan Engelhardt2010-07-022-3/+2
| | | | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * extensions: libxt_quota.c: Support option negationSamuel Ortiz2010-07-021-0/+4
| | | | | | | | | | | | | | | | The xt_quota_info flags should be set properly for the --quota option negation support. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * extensions: libxt_rateest: fix typo in the man pageLuciano Coelho2010-07-021-4/+4
| | | | | | | | | | | | | | | | There were a few typos in some options in the rateest match section of the man page: --rateest1-bps should be --rateest-bps1 and so on. Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * Merge branch 'master' of vishnu.netfilter.org:/data/git/iptablesPatrick McHardy2010-06-2511-962/+793
| |\
| | * libxt_set: new revision addedJozsef Kadlecsik2010-06-1611-962/+793
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | libipt_set renamed to libxt_set and the support for the forthcoming ipset release added. I have tested backward (IPv4) and forward compatibility (IPv4/IPv6): ipset -N test iphash ipset -A test test-address iptables -N test-set iptables -A test-set -j LOG --log-prefix "match " iptables -A test-set -j DROP iptables -A OUTPUT -m set --match-set test dst -j test-set ping test-address
| * | Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2010-06-252-8/+14
| |\ \
| | * | libxt_conntrack: do print netmaskJan Engelhardt2010-06-241-4/+12
| | | | | | | | | | | | | | | | | | | | References: http://bugzilla.netfilter.org/show_bug.cgi?id=659 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * | libxt_hashlimit: always print burst valueJan Engelhardt2010-06-241-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | iptables -L lists the burst value, and so should iptables -S. I was certainly surprised to see it gone even when explicitly specifying --hashlimit-burst 5 on the command line. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * | | Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2010-06-2416-71/+131
| |\| | | | |/ | |/|
| | * xtables: remove xtables_set_revision functionJan Engelhardt2010-06-075-22/+8
| | | | | | | | | | | | | | | | | | | | | | | | Since iptables uses its own copies of the header files anyway where the revision field is exposed, there is no reach to access name[] beyond its size. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * xtables: another try at chain name length checkingJan Engelhardt2010-06-075-14/+12
| | | | | | | | | | | | | | | | | | | | | Since XT_EXTENSION_MAXNAMELEN is now available, make use of it and clear the confusion. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * includes: sync header files from Linux 2.6.35-rc1Jan Engelhardt2010-06-079-35/+111
| | | | | | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | | extensions: fix compilation of the new CHECKSUM targetPatrick McHardy2010-07-151-0/+18
| | | | | | | | | | | | | | | | | | Add missing header file. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | | extensions: libxt_CHECKSUM extensionMichael S. Tsirkin2010-07-152-0/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds a `CHECKSUM' target, which can be used in the iptables mangle table. You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device. The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as http://www.spinics.net/lists/kvm/msg37660.html Typical expected use (helps old dhclient binary running in a VM): iptables -A POSTROUTING -t mangle -p udp --dport bootpc \ -j CHECKSUM --checksum-fill Includes fixes by Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | | extensions: libxt_IDLETIMER: use xtables_param_act when checking optionsLuciano Coelho2010-07-152-10/+8
| | | | | | | | | | | | | | | | | | | | | | | | This patch changes custom error messages for illegal options into the default iptables messages, by using xtables_param_act(). Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | | extensions: libipt_LOG/libip6t_LOG: support macdecode optionPatrick McHardy2010-06-284-4/+37
| | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* | | extensions: add idletimer xt target extensionLuciano Coelho2010-06-153-0/+205
|/ / | | | | | | | | | | | | Add the extension plugin for the IDLETIMER x_tables target. Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | xt_sctp: support FORWARD_TSN chunk typeShan Wei2010-06-082-2/+3
| | | | | | | | | | | | | | | | | | | | The latest kernel has implemented Partial Reliability Extension that defined in RFC3758. This patch adds FORWARD_TSN chunk for tracing. Signed-off-by: Shan Wei<shanwei@cn.fujitsu.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | xt_sctp: Trace DATA chunk that supports SACK-IMMEDIATELY extensionShan Wei2010-06-082-2/+2
|/ | | | | | | | | | | SACK-IMMEDIATELY extension has defined in: http://tools.ietf.org/html/draft-tuexen-tsvwg-sctp-sack-immediately-03. And the latest kernel has added a I flag in DATA chunk to support this extension. So let iptables/netfilter can trace it. Signed-off-by: Shan Wei<shanwei@cn.fujitsu.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* doc: xt_LED: nroff formatting requirementsJan Engelhardt2010-06-041-5/+5
| | | | | | Verbatim dashes need to be backslash-prefixed. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: add the LED targetAdam Nielsen2010-06-042-0/+185
| | | | | | For the xt_LED target introduced in Linux 2.6.31. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: xt_hashlimit: fix a typoJan Engelhardt2010-06-041-1/+1
| | | | | References: http://bugzilla.netfilter.org/show_bug.cgi?id=646 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: xt_string: correct copy-and-pasting in manpageJan Engelhardt2010-06-041-1/+3
| | | | | References: http://bugzilla.netfilter.org/show_bug.cgi?id=653 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* utils: add missing include flags to MakefileJan Engelhardt2010-05-241-0/+2
| | | | | | | | | | | Fixes this compile error: CC nfnl_osf.o nfnl_osf.c:48:36: fatal error: linux/netfilter/xt_osf.h: No such file or directory compilation terminated. References: http://marc.info/?l=netfilter&m=127449929621579&w=2 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Revert "Revert "Merge branch 'iptables-next'""Patrick McHardy2010-05-213-0/+223
| | | | | | This reverts commit 110c1e4502e21ea38e0980e6f8af857d24330099. Revert the revert to restore the TEE target.
* Bump version to 1.4.8v1.4.8Patrick McHardy2010-05-211-1/+1
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Revert "Merge branch 'iptables-next'"Patrick McHardy2010-05-213-223/+0
| | | | | | | This reverts commit 65414babaebcd403e9bf2c27d9d74adb369bf3aa, reversing changes made to 7278461dfad72e2008585dd0bac0e889e5bba99e. Forgot to commit the version increase.
* Merge branch 'iptables-next'Patrick McHardy2010-05-203-0/+223
|\
| * Merge branch 'master' of git://dev.medozas.de/iptables into iptables-nextPatrick McHardy2010-05-133-0/+223
| |\
| | * extensions: add support for xt_TEEJan Engelhardt2010-04-193-0/+223
| | | | | | | | | | | | | | | | | | xt_TEE is firstly included in Linux 2.6.35. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | | extensions: MASQUERADE: fix --to-ports parserDmitry V. Levin2010-05-201-16/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rewrite port range validator to use xtables_strtoui() and xtables_param_act(). Original check failed to recognize such port range errors as "1a-2" and "1-2a". Also, original parser erroneously denied using port 0, which is now allowed. Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | | xtables: fix compilation when debugging is enabledPatrick McHardy2010-05-201-1/+1
| | | | | | | | | | | | | | | | | | Reported by yang.xuhui@jfsys.com. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | | iptables: add noreturn attribute to exit_tryhelp()Dmitry V. Levin2010-05-142-2/+2
| | | | | | | | | | | | | | | | | | | | | Found by gcc -Wmissing-noreturn. Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | | extensions: REDIRECT: fix --to-ports parserDmitry V. Levin2010-05-141-22/+18
|/ / | | | | | | | | | | | | | | | | | | | | | | Rewrite port range validator to use xtables_strtoui() and xtables_param_act(). Original check failed to recognize several types of port range errors, including: "-1", "-1a", "-1-a", "a-1", "1a-2", "1-2a", etc. Also, original parser erroneously denied using port 0, which is now allowed. Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | iptables: optionally disable largefile supportKarl Hiramoto2010-05-101-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Many toolchains for embedded systems don't have largefile support: usr/include/features.h:383:4: error: #error It appears you have defined _FILE_OFFSET_BITS=64. Unfortunately, uClibc was built without large file support enabled. In file included from /build_armeb/staging_dir/usr/include/stdio.h:72, from libiptc/libip4tc.c:18: /build_armeb/staging_dir/usr/include/bits/uClibc_stdio.h:72:2: error: #error Sorry... uClibc was built without large file support! In file included from libiptc/libip4tc.c:18: /build_armeb/staging_dir/usr/include/stdio.h:83: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'fpos_t' In file included from libiptc/libip4tc.c:18: /build_armeb/staging_dir/usr/include/stdio.h:709: error: expected declaration specifiers or '...' before 'fpos_t' /build_armeb/staging_dir/usr/include/stdio.h:711: error: expected ';', ',' or ')' before '*' token Signed-off-by: Karl Hiramoto <karl@hiramoto.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | libxt_conntrack: document --ctstate UNTRACKEDSimon Lodal2010-05-102-0/+7
| | | | | | | | | | Signed-off-by: Simon Lodal <simonl@parknet.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | CT: fix --ctevents parsingPablo Neira Ayuso2010-05-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | This patch fixes the following problem: # iptables -t raw -I PREROUTING -t raw -j CT --ctevents assured iptables v1.4.7: Unknown event type "assured" Try `iptables -h' or 'iptables --help' for more information. However, `assured' is one of the supported arguments for --ctevents. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iprange: fix xt_iprange v0 parsingVincent Bernat2010-04-211-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | iprange_parse() was incomplete and did not include parsed ranges into ipt_iprange_info structure resulting in always adding range 0.0.0.0-0.0.0.0 in the kernel. Moreover, when using --dst-range, error messages may display --src-range instead. Fix this too. Signed-off-by: Vincent Bernat <bernat@luffy.cx> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | libxt_CT: print conntrack zone in ->print/->savePatrick McHardy2010-04-201-0/+4
|/ | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxt_osf: import nfnl_osf programJan Engelhardt2010-04-067-3/+1191
| | | | | | | | xt_osf is pretty useless without the actual fingerprint loader. Import nfnl_osf-2009-06-07 and make it a part of the iptables distribution. Cc: Evgeniy Polyakov <johnpol@2ka.mxt.ru> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>