summaryrefslogtreecommitdiffstats
path: root/extensions
Commit message (Collapse)AuthorAgeFilesLines
* remove other bits of old ip pool code, people should use ipset ↵Harald Welte2006-02-013-295/+0
| | | | (ipset.netfilter.org) these days
* Prepare policy match for x_tables unification by making sure bothPatrick McHardy2006-01-315-16/+10
| | | | ipt_policy and ip6t_policy use the same data structure.
* fix 'save' (Michael Rash)Michael Rash2006-01-301-2/+2
|
* major manpage update (Yasuyuki Kozakai)Yasuyuki KOZAKAI2006-01-3026-84/+128
|
* Add 'copy+paste' support for 'state' and 'connmark' match, as well asHarald Welte2006-01-264-1/+535
| | | | 'CONNMARK' target for ip6tables / nf_conntrack_l3proto_ipv6. This is a temporary solution for the iptables-1.3.x branch, since the 1.4.x branch will have proper support.
* add note about deprecated stateHarald Welte2006-01-261-0/+2
|
* fix spelling 'adress' -> 'address' (Closes: #431) (MJ Anthony)Harald Welte2006-01-222-2/+2
|
* Fix "empty policy element" complaining in non-strict mode.Noticed by Tom Eastep2006-01-222-2/+4
| | | | Noticed by Tom Eastep <teastep@shorewall.net>.
* Clarify --tunnel-src/--tunnel-dst optionsPatrick McHardy2006-01-122-6/+10
|
* Move empty policy element check to also catch last elementPatrick McHardy2006-01-122-10/+12
|
* Don't allow using --next option without specifying a policy elementPatrick McHardy2006-01-122-4/+14
|
* Fix invalid assignment of tunnel-src to dest address (Patrick McHardy)Patrick McHardy2006-01-091-2/+2
|
* Add documentation for string match (Pablo Neira)Pablo Neira2006-01-031-0/+15
|
* fix iptables-save of 'goto' target (Closes: #410)Harald Welte2005-12-051-2/+2
|
* Add note that TCPMSS is only valid in the mangle table (not true today, but ↵Patrick McHardy2005-12-051-1/+4
| | | | maybe someday)
* tcp-rst is the alias, not tcp-reset (Torsten Hilbrich)Harald Welte2005-11-221-1/+1
|
* Add policy match extensions from patch-o-maticPatrick McHardy2005-11-196-0/+998
|
* Fix some gcc-4 warningsPatrick McHardy2005-11-184-7/+7
|
* Don't eat numeric arguments for other extensionsPatrick McHardy2005-11-181-4/+12
|
* The conntrack match does not print any info for --ctproto, thusPhil Oester2005-11-171-0/+7
| | | | | breaking iptables-restore of any rules using this option. Below patch adds output and closes bug #398. (Phil Oester)
* fix connmark, it's now only 32bits (Deti Fliegl <deti@fliegl.de)v1.3.4Deti Fliegl2005-11-032-53/+10
| | | | | | We'ver screwed this up with the 2.6.14 release. It refuses any mask that extends 32bits. We should have fixed this by adding a new target/match revision, but now it's too late anyway :(
* The conntrack match extension doesn't handle address inversion correctly. ↵Tom Eastep2005-09-191-2/+2
| | | | (Tom Eastep)
* Kernels higher than 2.6.10 don't support multiple --to arguments inPhil Oester2005-09-192-0/+14
| | | | | | | | | | | | | | | | | | | | | DNAT and SNAT targets. At present, the error is somewhat vague: # iptables -t nat -A foo -j SNAT --to 1.2.3.4 --to 2.3.4.5 iptables: Invalid argument But if we want current iptables to work with kernels <= 2.6.10, we cannot simply disallow this in all cases. So the below patch adds kernel version checking to iptables, and utilizes it in [DS]NAT. Now, users will see a more informative error: # iptables -t nat -A foo -j SNAT --to 1.2.3.4 --to 2.3.4.5 iptables v1.3.3: Multiple --to-source not supported This generic infrastructure (shamelessly lifted from procps btw) may come in handy in the future for other changes. This fixes bugzilla #367. (Phil Oester)
* * specifying random seed for the Jenkins hash works as documentedKOVACS Krisztian2005-09-191-28/+37
| | | | | | | * iptables-save seems to work now Signed-off-by: KOVACS Krisztian <hidden@balabit.hu> Signed-off-by: Harald Welte <laforge@netfilter.org>
* Make libipt_connbytes.c compile with the ipt_connbytes version that has been ↵Martin Josefsson2005-09-111-6/+6
| | | | merged into the 2.6 kernel
* Update manpage to reflect missing ability to SNAT to multiple ranges in ↵Harald Welte2005-08-291-4/+6
| | | | 2.6.11-rc1 and later
* Update manpage to reflect missing NAT to multiple ranges support in ↵Harald Welte2005-08-291-4/+7
| | | | 2.6.11-rc1 and later.
* update string match to reflect new kernel implementation (Pablo Neira)Pablo Neira2005-08-281-40/+110
|
* add support for new 'dccp' protocol matchHarald Welte2005-08-063-0/+414
|
* port Eric Leblond's NFQUEUE missing-break fix to ip6tablesHarald Welte2005-08-052-0/+4
|
* Add missing 'break' to make parsing of NFQUEUE numbers work (Eric Leblond)Eric Leblond2005-08-052-0/+4
|
* update manpage to reflect QUEUE / nfnetlink_queue / NFQUEUE changesHarald Welte2005-07-282-0/+18
|
* Fix NAT of ICMP ID ranges (Patrick McHardy)Patrick McHardy2005-07-224-4/+8
|
* get rid of numerous gcc-4 warningsHarald Welte2005-07-1910-15/+17
|
* add NFQUEUE support for ipv4 and ipv6Harald Welte2005-07-193-2/+228
|
* fix various missing header file / #define issues on old kernels. I've now ↵v1.3.2Harald Welte2005-07-101-0/+6
| | | | tested compilation with kernels starting 2.4.17
* attempt to fix save/restore of '! --uid-owner squid' problem as reported by ↵Harald Welte2005-06-291-2/+2
| | | | Costa Tsaousis (backport from ipv4 owner)
* Add --log-uid support to libip6t_LOG (Patrick McHardy <kaber@trash.net>)Patrick McHardy2005-06-242-1/+20
|
* reduce code replication of parse_interface() (Yasuyuki Kozakai)Yasuyuki KOZAKAI2005-06-222-78/+0
|
* This patch prevents user to set negative port value of SNAT/DNAT.Yasuyuki KOZAKAI2005-06-222-4/+4
| | | | (Yasuyuki Kozakai)
* OSF: lib_ipt.c changes to support connector notifications (Evgeniy Polyakov ↵Evgeniy Polyakov2005-06-111-3/+11
| | | | <johnpol@2ka.mipt.ru>)
* update multiport manpage (Phil Oester <kernel@linuxace.com>)Phil Oester2005-06-112-8/+10
|
* Fix CONNMARK save/restore (Tom Eastep <teastep@shorewall.net>, Pawel Sikora ↵Tom Eastep2005-06-111-2/+2
| | | | <pluto@agmk.net>)
* While adding testing for inversion of multiport, noticed that documentation ↵Rusty Russell2005-05-251-2/+2
| | | | about --ports is *wrong*. Ports do not have to be equal: either dest or src being in list is enough for match.
* include FIN bit in mask of "--syn" bitsHarald Welte2005-05-042-3/+3
|
* Ignore unknown arguments in libipt_ULOG (Patrick McHardy <kaber@trash.net>)Patrick McHardy2005-05-021-0/+2
|
* Fix connbytes command line parsing bug (Piotrek Kaczmarek <kaczorek@daleka.net>)Piotrek Kaczmarek2005-04-241-0/+1
|
* pull out pmtu changes to fix compilation issuesHarald Welte2005-04-152-124/+3
|
* add REJECT with icmp-frag-needed (Florian Lohoff)Florian Lohoff2005-04-102-3/+124
|
* don't allow newlines in LOG prefix (Phil Oester) (Closes: #312)Phil Oester2005-04-012-0/+8
|