summaryrefslogtreecommitdiffstats
path: root/include/iptables.h
Commit message (Collapse)AuthorAgeFilesLines
* libxtables: set names of programsJamal Hadi Salim2009-02-121-0/+2
| | | | | | Set proper name of application. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
* src: consolidate duplicate code in iptables/internal.hJan Engelhardt2009-02-101-2/+0
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: move compat defines to xtables.cJan Engelhardt2009-02-101-5/+0
| | | | | | | Addendum to commit v1.4.3-rc1-41-g77f48c2 where the macro users got moved. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: remove unused ipt_tryload macroJan Engelhardt2009-02-101-2/+0
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: remove iptables_rule_match indirection macroJan Engelhardt2009-02-101-1/+0
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: decouple non-xtables parts from headerJan Engelhardt2009-02-101-0/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libiptc: remove indirectionsJan Engelhardt2008-11-101-5/+5
| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libiptc: remove typedef indirectionJan Engelhardt2008-11-101-6/+6
| | | | | | | | | | | Don't you hate it when iptc_handle_t *x actually is a double-indirection struct iptc_handle **? This also shows the broken constness model, since "const iptc_handle_t x" = "iptc_handle_t const x" = "struct iptc_handle *const x", which is like no const at all. Lots of things to do then. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: remove dependency on libiptc headersJan Engelhardt2008-08-041-2/+3
| | | | | | | | xtables.h does not need really need libxtc.h, and we can drop it from the install as it is internal-only. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables --list-rules commandHenrik Nordstrom2008-05-131-0/+2
| | | | | | | | | | | | | | | | | | Adds iptables --list-rules (-S) command, acting as a combination of iptables --list and iptables-save. The primary motivation behind this patch is to get iptables-save like output capabilities in iptables-restore, allowing "iptables-restore -n" to be used as a consistent API to iptables for all kind of operations, not only blind updates.. As a bonus iptables also gets the capability of printing the rules as-is. This completely replaces the earlier patch which added the --rules option. Henrik Nordstrom <henrik@henriknordstrom.net>
* Remove old functions, constantsJan Engelhardt2008-04-151-5/+0
|
* Combine IP{,6}T_LIB_DIR into XTABLES_LIBDIRJan Engelhardt2008-04-131-4/+0
|
* Fix all remaining warnings (missing declarations, missing prototypes)Jan Engelhardt2008-04-131-2/+0
|
* rename overlapping function namesJan Engelhardt2008-01-201-5/+0
| | | | | | Rename overlapping function names. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
* bunch o' renamesJan Engelhardt2008-01-201-3/+0
| | | | | | | | Move a few functions from iptables.c/ip6tables.c to xtables.c so they are available for combined (both AF_INET and AF_INET6) libxt modules. Rename overlapping function names. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
* Moves all declarations in iptables_common.h to xtables.h.Yasuyuki KOZAKAI2007-07-241-1/+0
|
* Moves IPPROTO_* and IP[6]T_LIB_DIR definitions to xtables.hYasuyuki KOZAKAI2007-07-241-11/+1
|
* Moves some duplicated functions in ip[6]tables.c to xtables.cYasuyuki KOZAKAI2007-07-241-3/+0
| | | | | string_to_number_ll, string_to_number_l, string_to_number, service_to_port, parse_port, parse_interface, are moved.
* Introduces xtables match/target registrationYasuyuki KOZAKAI2007-07-241-138/+5
| | | | | | | | | | | | | | | | | | | | | | | - moves lib_dir to xtables.c - introduces struct pfinfo which has protocol family dependent infomations. - unifies load_ip[6]tables_ko() and moves them as load_xtables_ko() - introduces xt_{match,match_rule,target,tryload} and replaces ip[6]t_* with them - unifies following functions and move them to xtables.c - find_{match,find_target} - compatible_revision, compatible_{match,target}_revision - introduces xtables_register_{match,target} and make register_{match,target}[6] call them. xtables_register_* register ONLY matches/targets matched protocol family Some concepts: - source compatibility for libip[6]t_xxx.c with warning on compilation not binary compatibility. - binary compatibility between 2.4/2.6 kernel and iptables/ip6tables, of cause. - xtables is enough to support only one address family at runtime. Then xtables keeps infomations of only the focused address famiy in struct afinfo.
* Add UDPLITE multiport supportPatrick McHardy2007-01-111-0/+3
|
* Fix /etc/network usage (Pablo Neira)Pablo Neira Ayuso2006-11-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | http://bugs.debian.org/398082 iptables 1.3.5 and 1.3.6 appear to read /etc/networks, but the information is lost somewhere with 1.3.6. # cat /etc/networks foonet 10.0.0.0 # strace -s 255 -o /tmp/foo iptables -v -A INPUT -s foonet/8 -j ACCEPT #1.3.5 [1] ACCEPT all opt -- in * out * 10.0.0.0/8 -> 0.0.0.0/0 # strace -s 255 -o /tmp/bar iptables -v -A INPUT -s foonet/8 -j ACCEPT #1.3.6 [2] iptables v1.3.6: host/network `foonet.0.0.0' not found Try `iptables -h' or 'iptables --help' for more information. 1. http://people.debian.org/~ljlane/stuff/strace-iptables-1.3.5.txt 2. http://people.debian.org/~ljlane/stuff/strace-iptables-1.3.6.txt
* Revert "proto_to_name duplication" patch, as noticed by Yasuyuki it can causePatrick McHardyJesper Brouer2006-07-251-1/+0
| | | | invalid arguments to get accepted.
* proto_to_name duplication (Phil Oester <kernel@linuxace.com>)Phil Oester2006-07-221-0/+1
| | | | | Update multiport match to use the iptables version of proto_to_name instead of reinventing the wheel.
* reduce parse_*_port duplication (Phil Oester <kernel@linuxace.com>)Phil Oester2006-07-201-0/+1
| | | | | The below patch (dependent upon my 'reduce service_to_port duplication' patch) centralizes the parse_*_port functions into parse_port.
* reduce service_to_port duplication (Phil Oester <kernel@linuxace.com>)Phil Oester2006-07-201-0/+1
| | | | | The service_to_port function is used in a number of places, and could benefit from some centralization instead of being duplicated everywhere.
* Add DCCP/SCTP support to multiport. Patch for kernel will go in 2.6.18.Patrick McHardy2006-04-281-0/+3
|
* Multiple matches of the same type can be specified on the commandline.Joszef Kadlecsik2006-03-031-0/+4
| | | | | | | | | | If two or more matches of the same type are detected then the options are assumed to be grouped in order to tell which option belongs to which match: ... -m foo ... <options0> ... -m foo ... <options1> ... Otherwise the commandline parsing is unmodified.
* Fix probing for supported revisions (Jones Desougi <jones@ingate.com>)Jones Desougi2005-12-221-0/+1
| | | | Bugzilla #413
* Kernels higher than 2.6.10 don't support multiple --to arguments inPhil Oester2005-09-191-0/+9
| | | | | | | | | | | | | | | | | | | | | DNAT and SNAT targets. At present, the error is somewhat vague: # iptables -t nat -A foo -j SNAT --to 1.2.3.4 --to 2.3.4.5 iptables: Invalid argument But if we want current iptables to work with kernels <= 2.6.10, we cannot simply disallow this in all cases. So the below patch adds kernel version checking to iptables, and utilizes it in [DS]NAT. Now, users will see a more informative error: # iptables -t nat -A foo -j SNAT --to 1.2.3.4 --to 2.3.4.5 iptables v1.3.3: Multiple --to-source not supported This generic infrastructure (shamelessly lifted from procps btw) may come in handy in the future for other changes. This fixes bugzilla #367. (Phil Oester)
* reduce code replication of parse_interface() (Yasuyuki Kozakai)Yasuyuki KOZAKAI2005-06-221-0/+1
|
* Extension revision number support (if kernel supports the getsockopts).Rusty Russell2005-01-031-0/+18
| | | | | Enhance MARK match with second revision. Committed in anticipation of the kernel patch being applied.
* Fix setting lib_dir in ip*tables-{save,restore}Martin Josefsson2004-12-271-0/+4
|
* add definition for IPPROTO_SCTP for systems with old header filesHarald Welte2004-03-041-0/+4
|
* Make sure to use matches in the order they are given when calling ↵Martin Josefsson2004-02-021-2/+8
| | | | do_command() multiple times.
* make iptables-restore print the line number in case of an errorIlles Marci2003-03-031-0/+2
| | | | (Illes Marci <marci@balabit.hu>)
* Export addr_to_anyname(), mask_to_dotted(), parse_hostnetworkmask()Marc Boucher2001-12-061-0/+6
| | | | | and parse_protocol() as they are needed by the upcoming ipt_conntrack match module.
* - added patch to support statically linking of iptablesHarald Welte2001-08-061-0/+6
| | | | - iptables-save/-restore is no longer experimental
* make iptables-restore and iptables-save work againHarald Welte2000-12-011-0/+9
|
* Jan Echternach's const tweak.Jan Echternach2000-08-271-1/+1
|
* IPv6 enhancements.Rusty Russell2000-05-021-17/+11
|
* Changes to allow matching (for delete) on part of a rule, for rules whichRusty Russell2000-04-191-0/+6
| | | | change in the kernel (eg. ipt_limit).
* reorganized tree after kernel mergeMarc Boucher2000-03-201-0/+122
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-01 01:33:14 +0000