summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* libxt_AUDIT: use guided option parserJan Engelhardt2011-04-061-44/+22
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libipt_addrtype: use guided option parserJan Engelhardt2011-04-061-103/+57
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libipt_ECN: use guided option parserJan Engelhardt2011-04-062-109/+68
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_ipv6header: use guided option parserJan Engelhardt2011-04-061-61/+27
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip[6]t_icmp: use guided option parserJan Engelhardt2011-04-062-65/+35
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_hbh: use guided option parserJan Engelhardt2011-04-061-39/+22
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_dst: use guided option parserJan Engelhardt2011-04-061-41/+20
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip[6]t_REJECT: use guided option parserJan Engelhardt2011-04-062-58/+48
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: XTTYPE_STRING supportJan Engelhardt2011-04-062-0/+27
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_esp: use guided option parserJan Engelhardt2011-04-061-79/+16
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_frag: use guided option parserJan Engelhardt2011-04-061-109/+36
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip[6]t_ah: use guided option parserJan Engelhardt2011-04-062-158/+43
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: XTTYPE_UINT32RC supportJan Engelhardt2011-04-062-2/+59
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip[6]t_hl: use guided option parserJan Engelhardt2011-04-062-133/+82
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip[6]t_HL: use guided option parserJan Engelhardt2011-04-062-137/+84
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: XTTYPE_UINT8 supportJan Engelhardt2011-04-062-1/+11
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_cluster: use guided option parserJan Engelhardt2011-04-061-139/+48
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: min-max option supportJan Engelhardt2011-04-062-0/+8
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_cpu: use guided option parserJan Engelhardt2011-04-061-49/+16
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: XTTYPE_UINT32 supportJan Engelhardt2011-04-062-3/+27
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_CONNSECMARK: use guided option parserJan Engelhardt2011-04-061-36/+23
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: provide better final_checkJan Engelhardt2011-04-064-28/+63
| | | | | | | | This passes the per-extension data block to the new x6_fcheck function pointer, which can then do last alterations without using hacks like global variables (think libxt_statistic). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_socket: use guided option parserJan Engelhardt2011-04-061-14/+15
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_CHECKSUM: use guided option parserJan Engelhardt2011-04-061-32/+14
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: guided option parserJan Engelhardt2011-04-067-54/+501
| | | | | | | | | | | This patchset seeks to drastically reduce the code in the individual extensions by centralizing their argument parsing (breakdown of strings), validation, and in part, assignment. As a secondary goal, this reduces the number of static storage duration variables in flight. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: add missing checks for specific flags (2)Jan Engelhardt2011-04-061-1/+3
| | | | | | | Addendum to v1.4.10-75-g4e5d4bf. It does not make sense to use ipv6header's --soft without specifying any options. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* mark newly opened fds as FD_CLOEXEC (close on exec)Maciej Zenczykowski2011-04-047-6/+17
| | | | | | | (This is iptables-1.4.3.1-cloexec.patch from RedHat iptables.src.rpm) Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* man pages: allow underscores in match and target namesMaciej Zenczykowski2011-04-041-2/+2
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: documentation for iptables and ip6tables "security" tablesMark Montague2011-04-044-4/+32
| | | | | | | | Add documentation for the iptables and ip6tables "security" tables. Based on http://lwn.net/Articles/267140/ and kernel source. Signed-off-by: Mark Montague <mark@catseye.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: add manual page section for AUDIT targetThomas Graf2011-03-161-0/+14
| | | | | Signed-off-by: Thomas Graf <tgraf@redhat.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: add -C to check for existing rulesStefan Tomanek2011-03-089-21/+162
| | | | | | | | | | | | | | | | | It is often useful to check whether a specific rule is already present in a chain without actually modifying the iptables config. Services like fail2ban usually employ techniques like grepping through the output of "iptables -L" which is quite error prone. This patch adds a new operation -C to the iptables command which mostly works like -D; it can detect and indicate the existence of the specified rule by modifying the exit code. The new operation TC_CHECK_ENTRY uses the same code as the -D operation, whose functions got a dry-run parameter appended. Signed-off-by: Stefan Tomanek <stefan.tomanek@wertarbyte.de> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* ip(6)tables-multi: unify subcommand handlingStefan Tomanek2011-03-074-72/+73
| | | | | | | | | | I found the subcommand handling and naming done by iptables-multi and ip6tables-multi very confusing and complicated; this patch reorganizes the subcommands in a single table, allowing both variants of them to be used (iptables/main) and also prints a list of the allowed commands if an unknown command is entered by the user. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: add VERSION section to manpagesJan Engelhardt2011-03-012-0/+6
| | | | | | | | This shall make it easier to identify outdated HTML renditions on the interwebs, since many of them do not display the .TH header like man(1) does. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix an inversionJan Engelhardt2011-03-011-1/+1
| | | | | | | | | | | Revisiting the original condition (viewable in git log -1 -p v1.4.10-57-gacef604), one can notice an unforuntate inversion. This commit corrects this. Testcase: -A INPUT -p tcp --dport 1 Reported-by: Florian Westphal Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: use all IPv6 addresses resolved from a hostnameWes Campaigne2011-02-271-17/+12
| | | | | | | | | | | | | | Fixes a long-standing issue where host_to_ip6addr would only ever examine/return the first item of the address chain returned by getaddrinfo, instead of traversing the chain and copying each of them. This has always been how host_to_ip6addr behaves, and all of the other related IPv6 code is already written to handle multiple possible addresses. [Style fixups. Removal of redundant i<*naddrs check. -j.eng] Signed-off-by: Wes Campaigne <westacular@gmail.com>
* xtables: fix the broken detection/removal of redundant addressesWes Campaigne2011-02-271-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [To observe this issue, populate a hostname (DNS or local db) with multiple adresses across multiple subnets (cf. prefixlen below) # e.g. /etc/hosts 127.0.0.2 lo-x 127.0.0.3 lo-x 127.0.1.4 lo-x 127.0.1.5 lo-x 127.0.2.6 lo-x Then invoke xtables_ipparse_any by e.g. `-m conntrack --ctorigsrc lo-x/24`. -j.eng] This same block of code, apparently to detect if addresses are identical after applying the mask, and to skip the duplicates and the ones made redundant by the mask, has been present and unchanged from as far back as I could find (circa iptables 1.2). By inspection, it was wrong, and always has been: once the code finds a duplicate, it will drop the rest of the array one by one as it re-detects the same duplicate over and over. When the addresses came from a single hostname lookup, and their order was random, then this created unpredictable behaviour by iptables, which seem to ignore some of those addresses at random times. I suspect the original idea also involved a swap between the duplicate and the address from the (current) end of the array, but a line of code to do that seems to have never existed. I have finally added it. (Well, as much as is needed: there does not need to be a full swap, because we are just going to ignore the duplicate, pretend the array is one shorter, and never look at the contents of the end again. So, we can get away with just copying from the end.) [Reword comment about shuffle: replace by mentioning tail copy to replace dup. -j.eng] Signed-off-by: Wes Campaigne <westacular@gmail.com>
* xtables: fix excessive memory allocation in host_to_ipaddrWes Campaigne2011-02-261-1/+1
| | | | | | | host_to_ipaddr was unnecessarily asking for an array of length n^2 to store just n addresses. Signed-off-by: Wes Campaigne <westacular@gmail.com>
* libxtables: avoid confusing use of ai_protocol=IPPROTO_IPV6Wes Campaigne2011-02-221-2/+0
| | | | | | | | | | | | | [Split hunk from Wes's submission. Added commit message. -j.eng] ai_protocol normally specifies the L4 protocol one wants to specifically inquire about when a service (2nd parameter to getaddrinfo) is specified. Such a service lookup would potentially yield nothing, because there just is not any "mytunnel 2222/ipv6" in /etc/services, since IPPROTO_IPV6 itself is not a protocol with a concept of (port-based) services to begin with. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: fix memory scribble beyond end of arrayJan Engelhardt2011-02-211-2/+2
| | | | | | | | | | | | | | | When using -s "", the "n" variable in the code remains uninitialized and usually scribbes beyond the end of the array. Furthermore, "n" is just as big as entries in the last host lookup. When specifying more than one item to -s, e.g. "-s host,host", "n" is less than "count", and we are not masking the addresses at all (leaving them at addr/32 resp. addr/128). The issue goes back to the initial code from v1.4.5~21. References: http://bugs.debian.org/611990 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: rateest options can be optionalJan Engelhardt2011-02-211-4/+4
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_quota: require --quota to be specifiedJan Engelhardt2011-02-201-1/+9
| | | | | | | It is pretty pointless to use -m quota without specifying --quota. There would be nothing left to count down on. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: fix odd partial sentence in libipt_TTLJan Engelhardt2011-02-201-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: mention other possible nf_loggers for TRACEJan Engelhardt2011-02-201-3/+5
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libipt_ECN: set proper option flagsJan Engelhardt2011-02-191-1/+1
| | | | | | | When specifying --ecn-tcp-remove, *flags will be wrongly set to denote that --ecn-ip-ect had been specified. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: add missing checks for specific flagsJan Engelhardt2011-02-193-3/+3
| | | | | | | | | With "!flags", any option will be accepted. The extensions however want one very specific option to be used (or wrong help text). Commits: DNAT: v1.3.8~23, osf: v1.4.6~3 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_hbh: remove unimplemented --hbh-not-strictJan Engelhardt2011-02-191-14/+0
| | | | | | Same as with ip6t_dst. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_dst: remove unimplemented --dst-not-strictJan Engelhardt2011-02-191-18/+0
| | | | | | This was never ever implemented in the kernel, so just remove it. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Remove unused CVS expanded keywordsJan Engelhardt2011-02-1913-26/+0
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: remove redundant init functionsJan Engelhardt2011-02-1914-87/+1
| | | | | | The main program already zeroes the per-extension data block. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: fix misspelling of "field"Jan Engelhardt2011-02-183-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>