summaryrefslogtreecommitdiffstats
path: root/extensions
Commit message (Collapse)AuthorAgeFilesLines
* iptables: do not print trailing whitespacesJan Engelhardt2011-01-3190-954/+902
| | | | | | | | | | | | | | | | | Due to the use of printf("foobar "), iptables emits spaces at the end-of-line, which looks odd to some users because it causes the terminal to wrap even if there is seemingly nothing to print. It may also have other points of annoyance, such as mailers interpreting a trailing space as an indicator that the paragraph continues when format=flowed is also on. And git highlights trailing spaces in red, so let's avoid :) Preexisting inconsistencies in outputting spaces in the right spot are also addressed right away. References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=429579 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_u32: enclose argument in quotesJan Engelhardt2011-01-311-1/+2
| | | | | | | Otherwise ip6tables-save piped to ip6tables-restore can cause a parse error when the expression list is empty. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_quota: clarifications on matchingJan Engelhardt2011-01-251-1/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Fix listing/saving the new revision of the SET targetJozsef Kadlecsik2011-01-211-1/+1
| | | | | Instead of the dimension of the set, the max dimension was used at listing/saving the src,dst parameters, which produced broken output.
* extensions: libxt_conntrack: add support for specifying port rangesPatrick McHardy2011-01-202-69/+192
| | | | | | | Add support for revision 3 of the conntrack match, which allows to specify port ranges for origsrc/origdst/replsrc/repldst. Signed-off-by: Patrick McHardy <kaber@trash.net>
* extensions: libxt_NFQUEUE: add v2 revision with --queue-bypass optionFlorian Westphal2011-01-202-7/+66
| | | | | | | | --queue-bypass: if no userpace program is listening on the queue, then allow packets to continue through the ruleset instead of dropping them. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxt_AUDIT: add AUDIT targetThomas Graf2011-01-201-0/+123
| | | | | | | | | libxt module for the AUDIT target. -j AUDIT --type (accept|reject|drop) Signed-off-by: Thomas Graf <tgraf@redhat.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxt_connlimit: support for dstaddr-supporting revision 1Jan Engelhardt2011-01-192-17/+94
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_connlimit: add a --connlimit-upto optionJan Engelhardt2011-01-182-30/+49
| | | | | | | | Direct specifications like "upto" are easier to grasp than "not above". This patch adds such an upto variant similar to what libxt_hashlimit already has. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_connlimit: reword help text to say prefix lengthJan Engelhardt2011-01-182-2/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_quota: print negation when it has been selectedJan Engelhardt2011-01-181-0/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_time: fix random --datestart skipsFlorian Westphal2011-01-091-0/+1
| | | | | | | | | | | | | | | | | | | | | Frank Lichtenheld points out that -m time --datestart ... sometimes messes up --datestart: $ iptables -A INPUT -m time --datestart 2010-11-24T16:50:00 -j ACCEPT $ iptables-save | grep 11 -A INPUT -m time --datestart 2010-11-24T16:50:00 -j ACCEPT $ iptables-save | iptables-restore $ iptables-save | grep 11 -A INPUT -m time --datestart 2010-11-24T15:50:00 -j ACCEPT --datestart moved by one hour. As the --timestart option does not care about DST, always set dst=0 when parsing --starttime input. Reported-by: Frank Lichtenheld <flichtenheld@astaro.com> Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libipt_REDIRECT: avoid dereference of uninitialized pointerStephen Beahm2011-01-081-1/+1
| | | | | | | | When using --to-ports with a port name instead of a numerical specification, a segfault occurs. References: http://bugzilla.netfilter.org/show_bug.cgi?id=691 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libipt_CLUSTERIP: const annotationsJan Engelhardt2011-01-081-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_sctp: fix a typoJan Engelhardt2011-01-081-1/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: remove no longer necessary default: casesJan Engelhardt2011-01-0879-230/+5
| | | | | | | Match and target parse functions now only get option characters they have defined themselves. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: use C99/POSIX typesJan Engelhardt2011-01-0843-144/+144
| | | | | | "u_int" was a non-standardized extension predating C99 on some platforms. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xt_comment: remove redundant castJan Engelhardt2011-01-071-1/+1
|
* Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2010-12-157-46/+249
|\
| * build: stop on error in subcommandJan Engelhardt2010-12-111-2/+2
| | | | | | | | | | | | | | make only evaluates $? of an entire shell invocation. As such, if any command in the chain can fail, $? needs to be thrown, and early so. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * libxt_owner: output numeric IDs when save is requestedJan Engelhardt2010-12-061-3/+3
| | | | | | | | | | References: http://bugzilla.netfilter.org/show_bug.cgi?id=683 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * build: fix globbing of extensions in other localesJan Engelhardt2010-12-041-2/+2
| | | | | | | | | | | | | | | | | | In the fi_FI locale, [a-z] would not include 'w', for example. Rectify this by using [[:alnum:]] (to counter against different ordering) and forcing the POSIX locale (so that the alphabet has at least the 26 base characters). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * socket: add support for revision 1Jan Engelhardt2010-12-032-7/+72
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * TPROXY: add support for revision 1Jan Engelhardt2010-12-031-28/+165
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * include: update files with headers from Linux 2.6.37-rc1Jan Engelhardt2010-12-032-4/+5
| | | | | | | | Also includes the type change to __u{8,16,32} kernel types already.
* | libxt_conntrack: fix --ctdir save/dump output formatFlorian Westphal2010-11-171-4/+4
|/ | | | | | | | $ iptables-save | iptables-restore iptables-restore v1.4.6: conntrack: Bad value for "--ctdir" option: "ORIGINAL-j" Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxt_TOS: avoid an undesired overflowing computationJan Engelhardt2010-11-021-8/+11
| | | | | | | The @bits parameter was wrongly labeled and should have been @max already. This makes the - overflowing - 1<<bits redundant of course. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: fix static linkingJan Engelhardt2010-08-032-2/+2
| | | | | | | | | | | | | | | | Gabor Z. Papp noted this link-time error when configuring with --enable-static: extensions/libext4.a(initext4.o): In function "init_extensions": extensions/initext4.c:144: undefined reference to "libxt_IDLETIMER_init" extensions/initext4.c:145: undefined reference to "libxt_TEE_init" Indeed, since the two modules did not use our special macro "_init" (which expands to libxt_foo_init), initext4.c could not find them by that name. Correct this. References: http://marc.info/?l=netfilter&m=128085480927924&w=2 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_quota: don't ignore the quota value on deletionChangli Gao2010-08-021-1/+1
| | | | | | | | Don't ignore the quota value on deletion, then we can remove a special rule everytime. Signed-off-by: Changli Gao <xiaosuo@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* doc: consistent use of markupJan Engelhardt2010-07-2314-120/+120
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* all: consistent syntax use in struct optionJan Engelhardt2010-07-2387-357/+427
| | | | | | Try to inhibit copypasting old stuff. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: minimal spelling updates to xt_cpuJan Engelhardt2010-07-231-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: remove extra empty line from xt_cpuJan Engelhardt2010-07-231-1/+0
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: let man(1) autoalign the text in xt_cpuJan Engelhardt2010-07-231-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extension: add xt_cpu matchEric Dumazet2010-07-232-0/+114
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kernel 2.6.36 supports xt_cpu match In some situations a CPU match permits a better spreading of connections, or select targets only for a given cpu. With Remote Packet Steering or multiqueue NIC and appropriate IRQ affinities, we can distribute trafic on available cpus, per session. (all RX packets for a given flow are handled by a given cpu) Some legacy applications being not SMP friendly, one way to scale a server is to run multiple copies of them. Instead of randomly choosing an instance, we can use the cpu number as a key so that softirq handler for a whole instance is running on a single cpu, maximizing cache effects in TCP/UDP stacks. Using NAT for example, a four ways machine might run four copies of server application, using a separate listening port for each instance, but still presenting an unique external port : iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 0 \ -j REDIRECT --to-port 8080 iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 1 \ -j REDIRECT --to-port 8081 iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 2 \ -j REDIRECT --to-port 8082 iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 3 \ -j REDIRECT --to-port 8083 Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* extensions: REDIRECT: add random helpEric Dumazet2010-07-231-1/+2
| | | | | Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxt_ipvs: user-space lib for netfilter matcher xt_ipvsHannes Eder2010-07-232-0/+389
| | | | | | | | | The user-space library for the netfilter matcher xt_ipvs. [ trivial up-port by Simon Horman <horms@verge.net.au> ] Signed-off-by: Hannes Eder <heder@google.com> Acked-by: Simon Horman <horms@verge.net.au> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge branch 'master' into iptables-nextPatrick McHardy2010-07-1514-460/+711
|\
| * extensions: libxt_rateest: fix bps options for iptables-saveLuciano Coelho2010-07-151-2/+4
| | | | | | | | | | | | | | | | | | | | The output generated by the libxt_rateest extension for bps matches was wrong and could not be restored properly. This patch fixes this problem by using the correct options in the right order when saving the table. Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * xt_quota: also document negationJan Engelhardt2010-07-022-3/+2
| | | | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * extensions: libxt_quota.c: Support option negationSamuel Ortiz2010-07-021-0/+4
| | | | | | | | | | | | | | | | The xt_quota_info flags should be set properly for the --quota option negation support. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * extensions: libxt_rateest: fix typo in the man pageLuciano Coelho2010-07-021-4/+4
| | | | | | | | | | | | | | | | There were a few typos in some options in the rateest match section of the man page: --rateest1-bps should be --rateest-bps1 and so on. Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * Merge branch 'master' of vishnu.netfilter.org:/data/git/iptablesPatrick McHardy2010-06-258-443/+683
| |\
| | * libxt_set: new revision addedJozsef Kadlecsik2010-06-168-443/+683
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | libipt_set renamed to libxt_set and the support for the forthcoming ipset release added. I have tested backward (IPv4) and forward compatibility (IPv4/IPv6): ipset -N test iphash ipset -A test test-address iptables -N test-set iptables -A test-set -j LOG --log-prefix "match " iptables -A test-set -j DROP iptables -A OUTPUT -m set --match-set test dst -j test-set ping test-address
| * | Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2010-06-252-8/+14
| |\ \ | | |/ | |/|
| | * libxt_conntrack: do print netmaskJan Engelhardt2010-06-241-4/+12
| | | | | | | | | | | | | | | References: http://bugzilla.netfilter.org/show_bug.cgi?id=659 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * libxt_hashlimit: always print burst valueJan Engelhardt2010-06-241-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | iptables -L lists the burst value, and so should iptables -S. I was certainly surprised to see it gone even when explicitly specifying --hashlimit-burst 5 on the command line. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | | extensions: libxt_CHECKSUM extensionMichael S. Tsirkin2010-07-152-0/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds a `CHECKSUM' target, which can be used in the iptables mangle table. You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device. The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as http://www.spinics.net/lists/kvm/msg37660.html Typical expected use (helps old dhclient binary running in a VM): iptables -A POSTROUTING -t mangle -p udp --dport bootpc \ -j CHECKSUM --checksum-fill Includes fixes by Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | | extensions: libxt_IDLETIMER: use xtables_param_act when checking optionsLuciano Coelho2010-07-152-10/+8
| | | | | | | | | | | | | | | | | | | | | | | | This patch changes custom error messages for illegal options into the default iptables messages, by using xtables_param_act(). Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | | extensions: libipt_LOG/libip6t_LOG: support macdecode optionPatrick McHardy2010-06-282-2/+33
| | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>