summaryrefslogtreecommitdiffstats
path: root/extensions/libipt_LOG.c
Commit message (Collapse)AuthorAgeFilesLines
* extensions: LOG: add log flags translation to nftLiping Zhang2016-11-291-4/+26
| | | | | | | | | | | | | | | | | | | | | | | For example: # iptables-translate -A OUTPUT -j LOG --log-uid nft add rule ip filter OUTPUT counter log flags skuid # iptables-translate -A OUTPUT -j LOG --log-tcp-sequence \ --log-tcp-options nft add rule ip filter OUTPUT counter log flags tcp sequence,options # iptables-translate -A OUTPUT -j LOG --log-level debug --log-uid nft add rule ip filter OUTPUT counter log level debug flags skuid # ip6tables-translate -A OUTPUT -j LOG --log-ip-options --log-macdecode nft add rule ip6 filter OUTPUT counter log flags ip options flags ether # ip6tables-translate -A OUTPUT -j LOG --log-ip-options --log-uid \ --log-tcp-sequence --log-tcp-options --log-macdecode nft add rule ip6 filter OUTPUT counter log flags all Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-translate: fix issue with quotesPablo M. Bermudo Garay2016-07-271-2/+6
| | | | | | | | | | | | | | | | | | | | | Some translations included escaped quotes when they were called from nft: $ sudo nft list ruleset table ip mangle { chain FORWARD { type filter hook forward priority -150; policy accept; ct helper \"ftp\" counter packets 0 bytes 0 ^^ ^^ } } This behavior is only correct when xlate functions are called from a xtables-translate command. This patch solves that issue using a new parameter (escape_quotes) in the xlate functions. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce struct xt_xlate_{mt,tg}_paramsPablo Neira Ayuso2016-07-251-4/+4
| | | | | | | | This structure is an extensible containers of parameters, so we don't need to propagate interface updates in every extension file in case we need to add new parameters in the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_LOG: Avoid to print the default log level in the translationLaura Garcia Liebana2016-03-101-1/+2
| | | | | | | | | | | | Avoid to print the log level in the translation when the level is the default value. Example: $ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 10 -j LOG nft add rule ip filter INPUT icmp type != router-solicitation counter log Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
* iptables-translate: pass ipt_entry and ip6t_entry to ->xlate()Pablo Neira Ayuso2016-03-091-1/+1
| | | | | | | The multiport match needs it, this basically leaves ->xlate() indirection with almost the same interface as ->print(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: rename xt_buf to xt_xlatePablo Neira Ayuso2016-02-161-4/+4
| | | | | | | Use a more generic name for this object to prepare the introduction of other translation specific fields. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_LOG: Add translation to nftShivani Bhardwaj2016-02-161-0/+37
| | | | | | | | | | | | | | | | | | | Add translation for options log-level and log-prefix of LOG target to nftables. Full translation of this target awaits the support for the options log-tcp-sequence, log-tcp-options, log-ip-options, log-uid and log-macdecode in nftables. Examples: $ sudo iptables-translate -A FORWARD -p tcp -j LOG --log-level error nft add rule ip filter FORWARD ip protocol tcp counter log level err $ sudo iptables-translate -A FORWARD -p tcp -j LOG --log-prefix "Random prefix" nft add rule ip filter FORWARD ip protocol tcp counter log prefix \"Random prefix\" level warn Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libipt_LOG: fix ignoring all but last flagsJan Engelhardt2011-06-211-5/+5
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libip[6]t_LOG: use guided option parserJan Engelhardt2011-04-131-133/+41
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: fix indent of vtableJan Engelhardt2011-02-161-11/+11
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: do not print trailing whitespacesJan Engelhardt2011-01-311-18/+18
| | | | | | | | | | | | | | | | | Due to the use of printf("foobar "), iptables emits spaces at the end-of-line, which looks odd to some users because it causes the terminal to wrap even if there is seemingly nothing to print. It may also have other points of annoyance, such as mailers interpreting a trailing space as an indicator that the paragraph continues when format=flowed is also on. And git highlights trailing spaces in red, so let's avoid :) Preexisting inconsistencies in outputting spaces in the right spot are also addressed right away. References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=429579 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: remove no longer necessary default: casesJan Engelhardt2011-01-081-2/+0
| | | | | | | Match and target parse functions now only get option characters they have defined themselves. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: use C99/POSIX typesJan Engelhardt2011-01-081-1/+1
| | | | | | "u_int" was a non-standardized extension predating C99 on some platforms. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* all: consistent syntax use in struct optionJan Engelhardt2010-07-231-8/+9
| | | | | | Try to inhibit copypasting old stuff. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: libipt_LOG/libip6t_LOG: support macdecode optionPatrick McHardy2010-06-281-1/+16
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxtables: hand argv to xtables_check_inverseJan Engelhardt2009-11-031-2/+2
| | | | | | | | | In going to fix NF bug #611, "argv" is needed in xtables_check_inverse to set "optarg" to the right spot in case of an intrapositional negation. References: http://bugzilla.netfilter.org/show_bug.cgi?id=611 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: replace open-coded sizeof by ARRAY_SIZEJan Engelhardt2009-05-261-9/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: remove unwanted/add needed includes for IPv4 extsJan Engelhardt2009-02-211-1/+0
| | | | | | | Most touched files do not use anything from ip_tables.h, so remove that #include. multiport instead, does need it (ipt_entry). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix exit_error to xtables_errorJan Engelhardt2009-02-211-13/+13
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix/order - move check_inverse to xtables.cJan Engelhardt2009-01-301-2/+2
| | | | | | | This also adds a warning that intrapositional negation support is deprecated. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix - parse and escaped output funcJan Engelhardt2009-01-301-1/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix/order - strtouiJan Engelhardt2009-01-271-1/+1
| | | | | | This commit also throws out the redundant string_to_number_*. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: remove redundant castsJan Engelhardt2009-01-271-1/+1
| | | | | | All of them are implicitly convertable without any wanted side effects. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: remove inclusion of iptables.hJan Engelhardt2008-11-201-1/+1
| | | | | | | | | iptables.h and ip6tables.h only include declarations internal to iptables (specifically iptables.c and ip6tables.c), as most of the public API has been moved to xtables.h a few months ago. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: use NFPROTO_ constantsJan Engelhardt2008-11-181-1/+1
| | | | | | | | Resync netfilter.h from the latest kernel and make use of the new NFPROTO_ constants that have been introduced. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: Update commentsJan Engelhardt2008-09-011-6/+0
| | | | | | | | A number of comments are redundant, some outdated and others outright wrong in their own way. Remove and fixup. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Remove old functions, constantsJan Engelhardt2008-04-151-8/+8
|
* fix gcc warningsMax Kellermann2008-01-291-1/+1
| | | | Max Kellermann <max@duempel.org>
* escape stringsMax Kellermann2008-01-291-2/+4
| | | | Max Kellermann <max@duempel.org>
* Unique names 4/6Jan Engelhardt2007-10-041-25/+16
| | | | | | | | | | | Give symbols of libxt targets unique names (2/3). Adds unique prefixes to all functions (most of them - especially the hook functions) so that debugging programs can unambiguously map a symbol to an address. Also unifies the names of the xtables_match/xtables_target structs, (based upon libxt_connmark.c/libip6t_*.c). Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
* Constify data structuresJan Engelhardt2007-10-041-1/+1
| | | | | | Constify more data structures. Make functions static. Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
* Delete empty ->final_check() functionsJan Engelhardt2007-10-041-6/+0
| | | | | | | Deletes empty ->final_check() functions, and makes ip[6]tables checks for NULL on these. Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
* Fix sparse warnings: non-ANSI function declarations, 0 used as pointerPatrick McHardy2007-09-081-7/+7
|
* Remove last vestiges of NFC (Peter Riley <Peter.Riley@hotpop.com>)Peter Riley2007-09-021-1/+1
|
* Make the option structures const.Jan Engelhardt2007-07-301-1/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
* Fixes warning on compilation of iptables matches/targetsYasuyuki KOZAKAI2007-07-241-3/+3
| | | | | | | | | This changes the type of arguments as follows - ipt_ip * -> void * - ipt_entry * -> void * This patch doesn't change multiport, DNAT, SNAT, MASQUERADE, REDIRECT because these need more changes (casting void * variable with intended type)
* Replaces ipt_entry_* with xt_entry_* in matches/targetsYasuyuki KOZAKAI2007-07-241-4/+4
|
* iptables segfaults when given "" to --log-prefix (Mike Frysinger ↵Mike Frysinger2006-10-101-0/+4
| | | | | | <vapier@gentoo.org>) Bugzilla #516
* don't allow newlines in LOG prefix (Phil Oester) (Closes: #312)Phil Oester2005-04-011-0/+4
|
* Kill NFC_* stuff in iptables (Pablo Neira <pablo@eurodev.net>)Pablo Neira2005-02-141-2/+0
| | | | Fixes build with conntrack event patch for 2.6
* Make it compile on current kernels, the future isn't here yet.Martin Josefsson2005-01-051-0/+6
|
* Add --log-uid option (John Lange <john.lange@open-it.ca>)John Lange2005-01-021-1/+17
|
* Get rid of some warnings when compiling 64bit.Martin Josefsson2004-05-261-1/+1
|
* remove unused variable and move to c99 initializers (Stephane Ouellette)Stephane Ouellette2003-08-111-28/+27
|
* Fix iptables-save (save everything numerically)Thomas Woerner2003-07-141-10/+2
| | | | by Thomas Woerner <twoerner@redhat.com>
* make IPv4 and IPv6 LOG target save() the log-level as string, instead of theMichael Schwendt2002-09-071-2/+11
| | | | numeric value. (Michael Schwendt)
* globally replace NETFILTER_VERSION with IPTABLES_VERSION to have consistent ↵Harald Welte2002-05-291-2/+2
| | | | naming
* Fix 'iptables -p !' bug (segfault when `!' used without argument)Harald Welte2002-03-141-2/+2
|
* loglevel patch was missing one line (strange...)Harald Welte2001-10-221-2/+3
|
* Yet another set of string_to_number() fixes.Marc Boucher2001-09-081-1/+1
|
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-10 07:54:40 +0000