summaryrefslogtreecommitdiffstats
path: root/extensions/libipt_REDIRECT.c
Commit message (Collapse)AuthorAgeFilesLines
* extensions: Merge REDIRECT into DNATPhil Sutter2022-04-081-174/+0
| | | | | | | | | Code is very similar, join them to reuse parsing code at least. As a side-effect, this enables parsing of service names for ports in DNAT as well as using port number 0 as that's what REDIRECT allows. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libip[6]t_REDIRECT: use new nft syntax when do xlateLiping Zhang2016-08-301-1/+1
| | | | | | | | | | | | | | | | | After commit "parser_bison: redirect to :port for consistency with nat/masq statement" in nftables tree, we should recommend the end user to use the new syntax. Before this patch: # iptables-translate -t nat -A PREROUTING -p tcp -j REDIRECT --to-ports 1 nft add rule ip nat PREROUTING ip protocol tcp counter redirect to 1 Apply this patch: # iptables-translate -t nat -A PREROUTING -p tcp -j REDIRECT --to-ports 1 nft add rule ip nat PREROUTING ip protocol tcp counter redirect to :1 Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce struct xt_xlate_{mt,tg}_paramsPablo Neira Ayuso2016-07-251-3/+3
| | | | | | | | This structure is an extensible containers of parameters, so we don't need to propagate interface updates in every extension file in case we need to add new parameters in the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: pass ipt_entry and ip6t_entry to ->xlate()Pablo Neira Ayuso2016-03-091-1/+1
| | | | | | | The multiport match needs it, this basically leaves ->xlate() indirection with almost the same interface as ->print(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: rename xt_buf to xt_xlatePablo Neira Ayuso2016-02-161-4/+4
| | | | | | | Use a more generic name for this object to prepare the introduction of other translation specific fields. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_REDIRECT: Add translation to nftShivani Bhardwaj2016-02-161-0/+19
| | | | | | | | | | | | | | | Add translation for target REDIRECT to nftables. Examples: $ sudo iptables-translate -t nat -A prerouting -p tcp --dport 80 -j REDIRECT --to-ports 8080 nft add rule ip nat prerouting tcp dport 80 counter redirect to 8080 $ sudo iptables-translate -t nat -A prerouting -p tcp --dport 80 -j REDIRECT --to-ports 8080 --random nft add rule ip nat prerouting tcp dport 80 counter redirect to 8080 random Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Convert the NAT targets to use the kernel supplied nf_nat.h headerPatrick McHardy2012-09-101-17/+17
| | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libipt_REDIRECT: "--to-ports" is not mandatoryLutz Jaenicke2011-05-181-2/+1
| | | | | | | | | The REDIRECT target can be called without the --to-ports option being specified. From the manual page: ...without this, the destination port is never altered. Signed-off-by: Lutz Jaenicke <ljaenicke@innominate.com> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libipt_REDIRECT: use guided option parserJan Engelhardt2011-05-091-37/+25
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: do not print trailing whitespacesJan Engelhardt2011-01-311-6/+4
| | | | | | | | | | | | | | | | | Due to the use of printf("foobar "), iptables emits spaces at the end-of-line, which looks odd to some users because it causes the terminal to wrap even if there is seemingly nothing to print. It may also have other points of annoyance, such as mailers interpreting a trailing space as an indicator that the paragraph continues when format=flowed is also on. And git highlights trailing spaces in red, so let's avoid :) Preexisting inconsistencies in outputting spaces in the right spot are also addressed right away. References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=429579 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libipt_REDIRECT: avoid dereference of uninitialized pointerStephen Beahm2011-01-081-1/+1
| | | | | | | | When using --to-ports with a port name instead of a numerical specification, a segfault occurs. References: http://bugzilla.netfilter.org/show_bug.cgi?id=691 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: remove no longer necessary default: casesJan Engelhardt2011-01-081-3/+1
| | | | | | | Match and target parse functions now only get option characters they have defined themselves. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* all: consistent syntax use in struct optionJan Engelhardt2010-07-231-3/+4
| | | | | | Try to inhibit copypasting old stuff. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: REDIRECT: add random helpEric Dumazet2010-07-231-1/+2
| | | | | Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* extensions: REDIRECT: fix --to-ports parserDmitry V. Levin2010-05-141-22/+18
| | | | | | | | | | | | Rewrite port range validator to use xtables_strtoui() and xtables_param_act(). Original check failed to recognize several types of port range errors, including: "-1", "-1a", "-1-a", "a-1", "1a-2", "1-2a", etc. Also, original parser erroneously denied using port 0, which is now allowed. Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxtables: hand argv to xtables_check_inverseJan Engelhardt2009-11-031-1/+1
| | | | | | | | | In going to fix NF bug #611, "argv" is needed in xtables_check_inverse to set "optarg" to the right spot in case of an intrapositional negation. References: http://bugzilla.netfilter.org/show_bug.cgi?id=611 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: add const qualifiers in print/save functionsJan Engelhardt2009-05-261-6/+4
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: add missing limits.h includeJan Engelhardt2009-02-211-0/+1
| | | | | | Thanks to Stephen Hemminger for noticing. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* include: resynchronize headers with 2.6.29-rc5Jan Engelhardt2009-02-211-13/+13
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix exit_error to xtables_errorJan Engelhardt2009-02-211-6/+6
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix/order - move check_inverse to xtables.cJan Engelhardt2009-01-301-1/+1
| | | | | | | This also adds a warning that intrapositional negation support is deprecated. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix - misc functionsJan Engelhardt2009-01-301-1/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: remove inclusion of iptables.hJan Engelhardt2008-11-201-1/+1
| | | | | | | | | iptables.h and ip6tables.h only include declarations internal to iptables (specifically iptables.c and ip6tables.c), as most of the public API has been moved to xtables.h a few months ago. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: use NFPROTO_ constantsJan Engelhardt2008-11-181-1/+1
| | | | | | | | Resync netfilter.h from the latest kernel and make use of the new NFPROTO_ constants that have been introduced. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Add SCTP/DCCP support to NAT targetsPatrick McHardy2008-11-041-1/+3
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: Update commentsJan Engelhardt2008-09-011-6/+0
| | | | | | | | A number of comments are redundant, some outdated and others outright wrong in their own way. Remove and fixup. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* REDIRECT: Allow symbolic port in REDIRECT --to-portKristof Provost2008-05-261-0/+3
| | | | | | Fixes Bugzilla 482. Signed-off-by: Kristof Provost <kristof@sigsegv.be>
* Remove old functions, constantsJan Engelhardt2008-04-151-8/+8
|
* fix gcc warningsMax Kellermann2008-01-291-1/+1
| | | | Max Kellermann <max@duempel.org>
* PATCH - Fix for --random option in DNAT and REDIRECTTom Eastep2007-11-151-1/+1
| | | | | | | The --random option produces "Unknown arg `--random'" errors with both the DNAT and REDIRECT targets. Corrected by the attached patch. Tom Eastep <teastep@shorewall.net>
* Unique names 4/6Jan Engelhardt2007-10-041-23/+16
| | | | | | | | | | | Give symbols of libxt targets unique names (2/3). Adds unique prefixes to all functions (most of them - especially the hook functions) so that debugging programs can unambiguously map a symbol to an address. Also unifies the names of the xtables_match/xtables_target structs, (based upon libxt_connmark.c/libip6t_*.c). Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
* Delete empty ->final_check() functionsJan Engelhardt2007-10-041-6/+0
| | | | | | | Deletes empty ->final_check() functions, and makes ip[6]tables checks for NULL on these. Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
* Fix sparse warnings: non-ANSI function declarations, 0 used as pointerPatrick McHardy2007-09-081-3/+3
|
* Remove last vestiges of NFC (Peter Riley <Peter.Riley@hotpop.com>)Peter Riley2007-09-021-1/+1
|
* Make the option structures const.Jan Engelhardt2007-07-301-1/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
* Remove the .next=NULL field. This is automatically initialized to zero.Jan Engelhardt2007-07-301-1/+0
| | | | | | | I've kept .print=NULL and .save=NULL so it stands out (since iptables will do the print/save then). Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
* Fixes warning on compilation, part 2Yasuyuki KOZAKAI2007-07-241-3/+4
| | | | | | | | | | This changes the type of arguments as follows in multiport, DNAT, SNAT, MASQUERADE, and REDIRECT - ip[6]t_ip[6] * -> void * - ip[6]t_entry * -> void * and adds lines to cast these pointer with intended type.
* Replaces ipt_entry_* with xt_entry_* in matches/targetsYasuyuki KOZAKAI2007-07-241-4/+4
|
* Add --random option to DNAT and REDIRECT targets and fix the manpage mess ↵Patrick McHardy2007-05-291-0/+19
| | | | this option left behind.
* Use nf_conntrack headers instead of ip_conntrack ones and add sanitized ↵Patrick McHardy2007-04-181-1/+1
| | | | versions.
* REDIRECT does not accept IP (Phil Oester <kernel@linuxace.com>)Phil Oester2006-06-201-0/+3
| | | | | | As pointed out by Nicolas Mailhot in bugzilla #483, REDIRECT does not accept an IP address and when supplied with one, provides unexpected results. Patch below fixes this.
* Fix NAT of ICMP ID ranges (Patrick McHardy)Patrick McHardy2005-07-221-1/+2
|
* Kill NFC_* stuff in iptables (Pablo Neira <pablo@eurodev.net>)Pablo Neira2005-02-141-2/+0
| | | | Fixes build with conntrack event patch for 2.6
* Pablo Neira: extensions conversion to C99 structure initializationPablo Neira2004-12-281-14/+13
| | | | (I removed the revision stuff for the moment, but this needs to go in before the code moves too much --RR)
* globally replace NETFILTER_VERSION with IPTABLES_VERSION to have consistent ↵Harald Welte2002-05-291-2/+2
| | | | naming
* Fix 'iptables -p !' bug (segfault when `!' used without argument)Harald Welte2002-03-141-1/+1
|
* - added patch to support statically linking of iptablesHarald Welte2001-08-061-0/+1
| | | | - iptables-save/-restore is no longer experimental
* bug in libipt_REDIRECT save function fixedHarald Welte2001-03-161-1/+1
|
* Aligning matchsize and targetsize now responsibility of extension writersRusty Russell2000-07-031-2/+2
| | | | (PPC fix).
* More fixes and testsuite enhancements.Rusty Russell2000-04-231-1/+1
|