summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* libip[6]t_hl: use guided option parserJan Engelhardt2011-04-062-133/+82
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip[6]t_HL: use guided option parserJan Engelhardt2011-04-062-137/+84
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: XTTYPE_UINT8 supportJan Engelhardt2011-04-062-1/+11
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_cluster: use guided option parserJan Engelhardt2011-04-061-139/+48
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: min-max option supportJan Engelhardt2011-04-062-0/+8
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_cpu: use guided option parserJan Engelhardt2011-04-061-49/+16
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: XTTYPE_UINT32 supportJan Engelhardt2011-04-062-3/+27
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_CONNSECMARK: use guided option parserJan Engelhardt2011-04-061-36/+23
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: provide better final_checkJan Engelhardt2011-04-064-28/+63
| | | | | | | | This passes the per-extension data block to the new x6_fcheck function pointer, which can then do last alterations without using hacks like global variables (think libxt_statistic). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_socket: use guided option parserJan Engelhardt2011-04-061-14/+15
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_CHECKSUM: use guided option parserJan Engelhardt2011-04-061-32/+14
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: guided option parserJan Engelhardt2011-04-067-54/+501
| | | | | | | | | | | This patchset seeks to drastically reduce the code in the individual extensions by centralizing their argument parsing (breakdown of strings), validation, and in part, assignment. As a secondary goal, this reduces the number of static storage duration variables in flight. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: add missing checks for specific flags (2)Jan Engelhardt2011-04-061-1/+3
| | | | | | | Addendum to v1.4.10-75-g4e5d4bf. It does not make sense to use ipv6header's --soft without specifying any options. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* mark newly opened fds as FD_CLOEXEC (close on exec)Maciej Zenczykowski2011-04-047-6/+17
| | | | | | | (This is iptables-1.4.3.1-cloexec.patch from RedHat iptables.src.rpm) Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* man pages: allow underscores in match and target namesMaciej Zenczykowski2011-04-041-2/+2
| | | | | Signed-off-by: Maciej Zenczykowski <maze@google.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: documentation for iptables and ip6tables "security" tablesMark Montague2011-04-044-4/+32
| | | | | | | | Add documentation for the iptables and ip6tables "security" tables. Based on http://lwn.net/Articles/267140/ and kernel source. Signed-off-by: Mark Montague <mark@catseye.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: add manual page section for AUDIT targetThomas Graf2011-03-161-0/+14
| | | | | Signed-off-by: Thomas Graf <tgraf@redhat.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: add -C to check for existing rulesStefan Tomanek2011-03-089-21/+162
| | | | | | | | | | | | | | | | | It is often useful to check whether a specific rule is already present in a chain without actually modifying the iptables config. Services like fail2ban usually employ techniques like grepping through the output of "iptables -L" which is quite error prone. This patch adds a new operation -C to the iptables command which mostly works like -D; it can detect and indicate the existence of the specified rule by modifying the exit code. The new operation TC_CHECK_ENTRY uses the same code as the -D operation, whose functions got a dry-run parameter appended. Signed-off-by: Stefan Tomanek <stefan.tomanek@wertarbyte.de> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* ip(6)tables-multi: unify subcommand handlingStefan Tomanek2011-03-074-72/+73
| | | | | | | | | | I found the subcommand handling and naming done by iptables-multi and ip6tables-multi very confusing and complicated; this patch reorganizes the subcommands in a single table, allowing both variants of them to be used (iptables/main) and also prints a list of the allowed commands if an unknown command is entered by the user. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: add VERSION section to manpagesJan Engelhardt2011-03-012-0/+6
| | | | | | | | This shall make it easier to identify outdated HTML renditions on the interwebs, since many of them do not display the .TH header like man(1) does. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix an inversionJan Engelhardt2011-03-011-1/+1
| | | | | | | | | | | Revisiting the original condition (viewable in git log -1 -p v1.4.10-57-gacef604), one can notice an unforuntate inversion. This commit corrects this. Testcase: -A INPUT -p tcp --dport 1 Reported-by: Florian Westphal Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: use all IPv6 addresses resolved from a hostnameWes Campaigne2011-02-271-17/+12
| | | | | | | | | | | | | | Fixes a long-standing issue where host_to_ip6addr would only ever examine/return the first item of the address chain returned by getaddrinfo, instead of traversing the chain and copying each of them. This has always been how host_to_ip6addr behaves, and all of the other related IPv6 code is already written to handle multiple possible addresses. [Style fixups. Removal of redundant i<*naddrs check. -j.eng] Signed-off-by: Wes Campaigne <westacular@gmail.com>
* xtables: fix the broken detection/removal of redundant addressesWes Campaigne2011-02-271-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [To observe this issue, populate a hostname (DNS or local db) with multiple adresses across multiple subnets (cf. prefixlen below) # e.g. /etc/hosts 127.0.0.2 lo-x 127.0.0.3 lo-x 127.0.1.4 lo-x 127.0.1.5 lo-x 127.0.2.6 lo-x Then invoke xtables_ipparse_any by e.g. `-m conntrack --ctorigsrc lo-x/24`. -j.eng] This same block of code, apparently to detect if addresses are identical after applying the mask, and to skip the duplicates and the ones made redundant by the mask, has been present and unchanged from as far back as I could find (circa iptables 1.2). By inspection, it was wrong, and always has been: once the code finds a duplicate, it will drop the rest of the array one by one as it re-detects the same duplicate over and over. When the addresses came from a single hostname lookup, and their order was random, then this created unpredictable behaviour by iptables, which seem to ignore some of those addresses at random times. I suspect the original idea also involved a swap between the duplicate and the address from the (current) end of the array, but a line of code to do that seems to have never existed. I have finally added it. (Well, as much as is needed: there does not need to be a full swap, because we are just going to ignore the duplicate, pretend the array is one shorter, and never look at the contents of the end again. So, we can get away with just copying from the end.) [Reword comment about shuffle: replace by mentioning tail copy to replace dup. -j.eng] Signed-off-by: Wes Campaigne <westacular@gmail.com>
* xtables: fix excessive memory allocation in host_to_ipaddrWes Campaigne2011-02-261-1/+1
| | | | | | | host_to_ipaddr was unnecessarily asking for an array of length n^2 to store just n addresses. Signed-off-by: Wes Campaigne <westacular@gmail.com>
* libxtables: avoid confusing use of ai_protocol=IPPROTO_IPV6Wes Campaigne2011-02-221-2/+0
| | | | | | | | | | | | | [Split hunk from Wes's submission. Added commit message. -j.eng] ai_protocol normally specifies the L4 protocol one wants to specifically inquire about when a service (2nd parameter to getaddrinfo) is specified. Such a service lookup would potentially yield nothing, because there just is not any "mytunnel 2222/ipv6" in /etc/services, since IPPROTO_IPV6 itself is not a protocol with a concept of (port-based) services to begin with. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: fix memory scribble beyond end of arrayJan Engelhardt2011-02-211-2/+2
| | | | | | | | | | | | | | | When using -s "", the "n" variable in the code remains uninitialized and usually scribbes beyond the end of the array. Furthermore, "n" is just as big as entries in the last host lookup. When specifying more than one item to -s, e.g. "-s host,host", "n" is less than "count", and we are not masking the addresses at all (leaving them at addr/32 resp. addr/128). The issue goes back to the initial code from v1.4.5~21. References: http://bugs.debian.org/611990 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: rateest options can be optionalJan Engelhardt2011-02-211-4/+4
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_quota: require --quota to be specifiedJan Engelhardt2011-02-201-1/+9
| | | | | | | It is pretty pointless to use -m quota without specifying --quota. There would be nothing left to count down on. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: fix odd partial sentence in libipt_TTLJan Engelhardt2011-02-201-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: mention other possible nf_loggers for TRACEJan Engelhardt2011-02-201-3/+5
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libipt_ECN: set proper option flagsJan Engelhardt2011-02-191-1/+1
| | | | | | | When specifying --ecn-tcp-remove, *flags will be wrongly set to denote that --ecn-ip-ect had been specified. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: add missing checks for specific flagsJan Engelhardt2011-02-193-3/+3
| | | | | | | | | With "!flags", any option will be accepted. The extensions however want one very specific option to be used (or wrong help text). Commits: DNAT: v1.3.8~23, osf: v1.4.6~3 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_hbh: remove unimplemented --hbh-not-strictJan Engelhardt2011-02-191-14/+0
| | | | | | Same as with ip6t_dst. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip6t_dst: remove unimplemented --dst-not-strictJan Engelhardt2011-02-191-18/+0
| | | | | | This was never ever implemented in the kernel, so just remove it. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Remove unused CVS expanded keywordsJan Engelhardt2011-02-1913-26/+0
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: remove redundant init functionsJan Engelhardt2011-02-1914-87/+1
| | | | | | The main program already zeroes the per-extension data block. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: fix misspelling of "field"Jan Engelhardt2011-02-183-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: fix wrong sentence about negation in xt_limitJan Engelhardt2011-02-171-2/+5
| | | | | | This is an update to commit v1.4.7~6. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtables: use strspn() to check if string needs to be quotedMax Kellerman2011-02-171-1/+1
| | | | | | | | | | | | | | | | | | | | Problem: the call xtables_save_string("'") prints just a single quote, not enclosed in double quoted and not escaped. Steps to reproduce: $ iptables -A foo -m comment --comment "'" -j ACCEPT $ iptables-multi save|grep foo -A foo -m comment --comment ' -j ACCEPT The cause was the use of strcspn() to locate the first character which justified quoting the string in double quotes. That however was wrong, because the way strcspn() was called, it returned a pointer to the first character that was not to be escaped, which did the right thing most of the time, but not for strings consisting only of quote characters. This patch changes strcspn() to strspn(). Signed-off-by: Patrick McHardy <kaber@trash.net>
* extensions: fix indent of vtableJan Engelhardt2011-02-164-45/+45
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_devgroup: option whitespace update following v1.4.10-49-g7386635Jan Engelhardt2011-02-161-7/+7
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* ip6tables: spacing fixes for -o argumentJan Engelhardt2011-02-161-1/+1
| | | | | | For aesthetic consistency, put a space after -o. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix segfault target option parsingJan Engelhardt2011-02-112-6/+6
| | | | | | | With v1.4.10-58-g94e247b, target option parsing started to happen in the wrong case. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2011-02-094-671/+608
|\
| * iptables: fix error message for unknown optionsJan Engelhardt2011-02-072-20/+14
| | | | | | | | | | | | | | -From: iptables v1.4.10: option "-q" requires an argument +To: iptables v1.4.10: unknown option "-q" Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: move match option handling from do_command6 into its own functionsJan Engelhardt2011-02-072-52/+55
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: move jump option handling from do_command6 into its own functionJan Engelhardt2011-02-073-72/+80
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: unclutter command_default functionJan Engelhardt2011-02-072-118/+91
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (Essentially, 5 levels of indentation have been stripped compared to the original layout, and this is surely a result that looks a lot better than it did before.) Things to note: 1. If the m->parse call succeeded, we can return from the function and do not need to go through the other code. As such, "m" is guaranteed to be useless at the end of the match loop, and so, conditions can be removed. 2. Since the per-extension parse function only ever get their own option codes (since v1.4.10-26-gd09b6d5), their return value no longer has a meaning and can be ignored. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: deduplicate and simplify implicit protocol extension loadingJan Engelhardt2011-02-074-69/+37
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * src: put shared option flags into xsharedJan Engelhardt2011-02-073-28/+19
| | | | | | | | | | | | This will be needed for the find_proto function. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>