summaryrefslogtreecommitdiffstats
path: root/include/xtables.h
Commit message (Collapse)AuthorAgeFilesLines
* libxtables: xtoptions: Implement XTTYPE_ETHERMACMASKPhil Sutter2024-01-101-1/+6
| | | | | | Accept an Ethernet MAC address with optional mask in the format xtables_parse_mac_and_mask() expects it. Does not support XTOPT_PUT (for now) due to the lack of defined data structure.
* libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASKPhil Sutter2024-01-101-1/+0
| | | | | | | | Do as the comment in xtopt_parse_hostmask() claims and omit XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate() will catch the incompatibility. Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support")
* libxtables: Introduce struct xt_option_entry::basePhil Sutter2023-11-231-1/+2
| | | | | | | Enable guided option parser users to parse integer values with a fixed base. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce xtables_strtoul_base()Phil Sutter2023-11-231-0/+2
| | | | | | | | Semantically identical to xtables_strtoul() but accepts the base as parameter so callers may force it irrespective of number prefix. The old xtables_strtoul() becomes a shallow wrapper. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Refuse unselected targets' optionsPhil Sutter2023-01-311-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Unlike legacy, ebtables-nft would allow e.g.: | -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be While the result is correct, it may mislead users into believing multiple targets are possible per rule. Better follow legacy's behaviour and reject target options unless they have been "enabled" by a previous '-j' option. To achieve this, one needs to distinguish targets from watchers also attached to 'xtables_targets' and otherwise behaving like regular matches. Introduce XTABLES_EXT_WATCHER to mark the two. The above works already, but error messages are misleading when using the now unsupported syntax since target options have been merged already. Solve this by not pre-loading the targets at all, code will just fall back to loading ad '-j' parsing time as iptables does. Note how this also fixes for 'counter' statement being in wrong position of ebtables-translate output. Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xlate: get rid of escape_quotesFlorian Westphal2022-11-301-2/+2
| | | | | | | | | | | | | | | | Its not necessary to escape " characters, we can let xtables-translate print the entire translation/command enclosed in '' chracters, i.e. nft 'add rule ...', this also takes care of [, { and other special characters that some shells might parse otherwise (when copy-pasting translated output). The escape_quotes struct member is retained to avoid an ABI breakage. This breaks all xlate test cases, fixup in followup patches. v3: no need to escape ', replace strcmp(x, "") with x[0] (Phil Sutter) Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xt_xlate_add() to take care of spacingPhil Sutter2022-11-291-0/+3
| | | | | | | | | | | | | | | | | | Try to eliminate most of the whitespace issues by separating strings from separate xt_xlate_add() calls by whitespace if needed. Cover the common case of consecutive range, list or MAC/IP address printing by inserting whitespace only if the string to be appended starts with an alphanumeric character or a brace. The latter helps to make spacing in anonymous sets consistent. Provide *_nospc() variants which disable the auto-spacing for the mandatory exception to the rule. Make things round by dropping any trailing whitespace before returning the buffer via xt_xlate_get(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Define XT_OPTION_OFFSET_SCALE in xtables.hPhil Sutter2022-06-231-0/+3
| | | | | | | | This is the last symbol in xshared.h used by libxtables, move it over. Again, treat this as "implementation detail" and hence put it behind XTABLES_INTERNAL-curtains. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Move struct xtables_afinfo into xtables.hPhil Sutter2022-06-231-0/+22
| | | | | | | | | | | | | The library "owns" this structure and maintains 'afinfo' pointer to instances of it. With libxt_set, there's even an extension making use of the data. To avoid impact on library users, guard it by XTABLES_INTERNAL. To eliminate the xshared.h include by libxt_set, DEBUGP has to be redefined. Other extensions have similar defines, fix this later. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Unexport init_extensions*() declarationsPhil Sutter2022-06-071-22/+22
| | | | | | | | | | | | | | The functions are used for static builds to initialize extensions after libxtables init. Regular library users should not need them, but the empty declarations introduced in #else case (and therefore present in user's env) may clash with existing symbol names. Avoid problems and guard the whole block declaring the function prototypes and mangling extensions' _init functions by XTABLES_INTERNAL. Reported-by: Nick Hainke <vincent@systemli.org> Fixes: 6c689b639cf8e ("Simplify static build extension loading") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Revert change to struct xtables_pprotPhil Sutter2022-05-111-1/+1
| | | | | | | | | | | | While protocol values may exceed eight bits, the data structure is indeed used only to store the static list of name/value pairs for faster lookups. None of those has such a value and if one is added in future, the compiler will complain about it. So restore the old field type to retain binary compatibility. Fixes: 556f704458cdb ("Use proto_to_name() from xshared in more places") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Drop xtables_globals 'optstring' fieldPhil Sutter2022-05-111-1/+0
| | | | | | | | | | | Define the different optstrings in xshared.h instead, they are not relevant for other libxtables users. This is a partial revert of commit 65b150ae382a8 ("xshared: Store optstring in xtables_globals") to avoid breaking libxtables' ABI compatibility. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Extend xtables_printhelp() for arptablesPhil Sutter2022-05-111-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | The function checks afinfo->family already to cover ip6tables specifics, doing the same for arptables does not make things much worse. This changes arptables-nft help output slightly: * List possible negations extrapositioned, which is preferred anyway (arptables-nft supports both) * List --out-interface option at lexically sorted position * Print --wait option, it's ignored just like with iptables * Restore default target option printing as with legacy arptables (not sure if arptables-nft ever did this) by explicitly loading them. While being at it, add --set-counters short option '-c' to help output for ip(6)tables. This effectively removes the need for (and all users of) xtables_global's 'print_help' callback, thus effectively reverts commit fe83b12fc910e ("libxtables: Introduce xtables_globals print_help callback") which broke libxtables' ABI compatibility. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Boost rule target checks by announcing chain namesPhil Sutter2022-03-171-0/+3
| | | | | | | | | | | | | | | | | When restoring a ruleset, feed libxtables with chain names from respective lines to avoid an extension search. While the user's intention is clear, this effectively disables the sanity check for clashes with target extensions. But: * The check yielded only a warning and the clashing chain was finally accepted. * Users crafting iptables dumps for feeding into iptables-restore likely know what they're doing. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* Simplify static build extension loadingPhil Sutter2022-03-151-0/+9
| | | | | | | | | | Instead of guarding all calls to init_extensions*(), define stubs if not used. While at it, also add the missing prototypes for arp- and ebtables extension initializers. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce xtables_globals print_help callbackPhil Sutter2021-10-201-0/+1
| | | | | | | | With optstring being stored in struct xtables_globals as well, it is a natural choice to store a pointer to a help printer also which matches the supported options. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Store optstring in xtables_globalsPhil Sutter2021-10-201-0/+1
| | | | | | | | | | | Preparing for a common option parser, store the string of options for each family inside the respective xtables_globals object. The array of long option definitions sitting in there already indicates it's the right place. While being at it, drop '-m' support from arptables-nft. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: extend xlate infrastructurePablo Neira Ayuso2021-06-071-0/+6
| | | | | | | | | | | | | | This infrastructure extends the existing xlate infrastructure: - Extensions can define set dependencies through .xlate. The resulting set definition can be obtained through xt_xlate_set_get(). - Add xl_xlate_set_family() and xl_xlate_get_family() to store/fetch the family. The first client of this new xlate API is the connlimit extension, which is added in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: Introduce xtables_strdup() and use it everywherePhil Sutter2021-06-071-0/+1
| | | | | | This wraps strdup(), checking for errors. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Use proto_to_name() from xshared in more placesPhil Sutter2021-05-171-1/+1
| | | | | | | | | | Share the common proto name lookup code. While being at it, make proto number variable 16bit, values may exceed 256. This aligns iptables-nft '-p' argument printing with legacy iptables. In practice, this should make a difference only in corner cases. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Extend MAC address printing/parsing supportPhil Sutter2020-12-031-0/+3
| | | | | | | | | | | | | | | Adding a parser which supports common names for special MAC/mask combinations and a print routine detecting those special addresses and printing the respective name allows to consolidate all the various duplicated implementations. The side-effects of this change are manageable: * arptables now accepts "BGA" as alias for the bridge group address * "mac" match now prints MAC addresses in lower-case which is consistent with the remaining code at least Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce xtables_fini()Phil Sutter2020-05-111-0/+1
| | | | | | | | | | | | Record handles of loaded shared objects in a linked list and dlclose() them from the newly introduced function. While functionally not necessary, this clears up valgrind's memcheck output when also displaying reachable memory. Since this is an extra function that doesn't change the existing API, increment both current and age. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: add 'printf' attribute to xlate_addFlorian Westphal2018-11-121-1/+1
| | | | | | | | | | | | | | This allows gcc to check format string vs. passed arguments. Fix the fallout from this as well, typical warning produced is: libebt_mark_m.c:112:28: warning: format '%x' expects argument of type 'unsigned int', but argument 3 has type 'long unsigned int' [-Wformat=] xt_xlate_add(xl, "and 0x%x %s0 ", info->mask, ... ~^ ~~~~~~~~~~ so add the required casts or fixup format strings as needed. libxt_conntrack also passed an unneeded argument (port), so remove that. Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: add and use mac print helpersFlorian Westphal2018-11-071-0/+3
| | | | | | | | | | | | This changes ebtables-nft to consistently print mac address with two characters, i.e. 00:01:02:03:04:0a, not 0:1:2:3:4:a. Will require another bump of vcurrent/vage. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: expose new etherdb lookup function through libxtables APIPablo Neira Ayuso2018-10-201-0/+12
| | | | | | | | | | This is used from extensions and included in libxtables, so we have to make them public. Fixes: 31f1434dfe37 ("libxtables: Integrate getethertype.c from xtables core") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc>
* xtables: Remove target_maxnamelen fieldPhil Sutter2018-10-151-1/+0
| | | | | | | | | | | | This is a partial revert of commit 9f075031a1973 ("Combine parse_target() and command_jump() implementations"): Upstream prefers to reduce max chain name length of arptables by two characters instead of the introduced struct xtables_globals field which requires to bump library API version. Fixes: 9f075031a1973 ("Combine parse_target() and command_jump() implementations") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Combine parse_target() and command_jump() implementationsPhil Sutter2018-09-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Merge these two functions from xtables, iptables, ip6tables and arptables. Both functions were basically identical in the first three, only the last one required a bit more attention. To eliminate access to 'invflags' in variant-specific location, move the call to set_option() into callers. This is actually consistent with parsing of other options in them. As with command_match(), use xt_params instead of the different *_globals objects to refer to 'opts' and 'orig_opts'. It was necessary to rename parse_target() as it otherwise clashes with a static function of same name in libxt_SET. In arptables, the maximum allowed target name is a bit larger, so introduce xtables_globals.target_maxnamelen defining the value. It is used in the shared xt_parse_target() implementation. Implementation of command_jump() in arptables diverted from the others for no obvious reason. The call to parse_target() was done outside of it and a pointer to cs->arp was passed but not used inside. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for wrong counter format in -S outputPhil Sutter2018-08-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | Legacy iptables uses '-c PCNT BCNT' format in listed rules, nft-variant used '[PCNT BCNT]' prefix like with iptables-save. In order to pass the counter format preference along, FMT_C_COUNTS is introduced and related 'format' checks adjusted. Since legacy iptables prints the counters between matches and target, this change affects save_matches_and_target() function. In order to get access to the rule counters, it's declaration is adjusted to receive iptables_command_state pointer instead of match, target and jumpto pointers from the same object. While being at it, integrate jump to user-defined chain into it as well since the related code in both callers was almost identical. Though since different rule flags are used between iptables and ip6tables, pass a 'goto_flag' boolean instead of the actual 'flags' bitfield. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: implement ebtables-{save,restore}Phil Sutter2018-07-191-0/+1
| | | | | | | | | | | | | | | The code for ebtables-restore was derived from legacy code, ebtables-save is actually a new implementation using the existing infrastructure and trying to adhere to legacy perl script output formatting as much as possible. This introduces a new format flag (FMT_EBT_SAVE) to allow nft_bridge_save_rule() to distinguish between ruleset listing (i.e., ebtables -L) and saving via ebtables-save - the two differ in how counters are being formatted. Odd, but that's how it is. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix rules print/save after iptables updateSerhey Popovych2018-04-271-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Updating iptables from 1.4.x to 1.6.x brokes rules print/save output and causes rules load after reboot to fail. Here is example from iptables-save(8) output after update: -A CHAIN1 -m set [unsupported revision] -j DROP -A CHAIN1 -m set [unsupported revision] -j DROP Similar output could be obtained via iptables -L CHAIN1. While issue reproduced with xt_set match it is not specific to any match or target module: it is related on how xtables handles revisions. In this particular case we have following situation: 1) Kernel supports revisions from 1 to 4. 2) Rules configured with iptables 1.4.x supporting only revisions from 1 to 3. Choosen highest possible revision 3. 3) Rules printed/saved with iptables 1.6.x supporting revisions from 1 to 4. 4) Xtables registers matches/targets with highest supported revision by the kernel. This is 4 in our case after update to iptables 1.6.x. 5) When printing/saving kernel submits match/target with revision it is configured (3), while iptables thinks that rules configured with highest supported (4). That's causes revision mismatch in during print and "[unsupported revision]" output. To fix this issue we now store all supported by kernel and xtables revisions in xt_matches/xt_targets list sorted in descending order. Introduce helper routines to find match/target with given revision and use them to find right revision to print submitted by kernel entry. Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Introduce and use common function to print val[/mask] argumentsSerhey Popovych2018-04-271-0/+9
| | | | | | | | | | | | | | | | There are number of places where argument is in val[/mask] format printed in extensions and some of them may print corresponding symbolic name. By introducing common function for this task we eliminate custom code parts in extensions to perform printing of arguments in required formats. Use xtables_print_mark_mask() helper for extensions without symbolic name for val[/mask]. Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Introduce and use common function to parse val[/mask] argumentsSerhey Popovych2018-04-271-0/+11
| | | | | | | | | | | | | | There are a couple of places in both core and extensions where arguments in the form of val[/mask] is parsed (see XTTYPE_MARKMASK32). In some cases symbolic name might be used which is mapped in code to numeric value. Introduce common function to handle both cases where value given is either val[/mask] or symbolic name. Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-translate: fix issue with quotesPablo M. Bermudo Garay2016-07-271-0/+2
| | | | | | | | | | | | | | | | | | | | | Some translations included escaped quotes when they were called from nft: $ sudo nft list ruleset table ip mangle { chain FORWARD { type filter hook forward priority -150; policy accept; ct helper \"ftp\" counter packets 0 bytes 0 ^^ ^^ } } This behavior is only correct when xlate functions are called from a xtables-translate command. This patch solves that issue using a new parameter (escape_quotes) in the xlate functions. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: xtables: fix struct definitions grepabilityPablo M. Bermudo Garay2016-07-271-4/+2
| | | | | Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce struct xt_xlate_{mt,tg}_paramsPablo Neira Ayuso2016-07-251-4/+16
| | | | | | | | This structure is an extensible containers of parameters, so we don't need to propagate interface updates in every extension file in case we need to add new parameters in the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-translate: pass ipt_entry and ip6t_entry to ->xlate()Pablo Neira Ayuso2016-03-091-4/+4
| | | | | | | The multiport match needs it, this basically leaves ->xlate() indirection with almost the same interface as ->print(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* comment: Add translation to nftShivani Bhardwaj2016-02-291-0/+1
| | | | | | | | | | | | | | Add translation for match comment to nftables. This patch also adds the relevant infrastructure for carrying out the translation. Example: $ sudo iptables-translate -A INPUT -s 192.168.0.0 -m comment --comment "A privatized IP block" nft add rule ip filter INPUT ip saddr 192.168.0.0 counter comment \"A privatized IP block\" Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add xt_xlate_add_comment()Pablo Neira Ayuso2016-02-161-0/+1
| | | | | | | This new function allows us to add comments to the nft rule. This can be used to provide a translation for the comment match. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: rename xt_buf to xt_xlatePablo Neira Ayuso2016-02-161-8/+8
| | | | | | | Use a more generic name for this object to prepare the introduction of other translation specific fields. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: xtables: Add enum for better nft translation codeShivani Bhardwaj2016-02-161-0/+11
| | | | | | | | Add enum xt_op for ease to write cleaner and better code for nft translation. Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: xtables: add the infrastructure to translate from iptables to nftPablo Neira Ayuso2016-02-161-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch provides the infrastructure and two new utilities to translate iptables commands to nft, they are: 1) iptables-restore-translate which basically takes a file that contains the ruleset in iptables-restore format and converts it to the nft syntax, eg. % iptables-restore-translate -f ipt-ruleset > nft-ruleset % cat nft-ruleset # Translated by iptables-restore-translate v1.4.21 on Mon Apr 14 12:18:14 2014 add table ip filter add chain ip filter INPUT { type filter hook input priority 0; } add chain ip filter FORWARD { type filter hook forward priority 0; } add chain ip filter OUTPUT { type filter hook output priority 0; } add rule ip filter INPUT iifname lo counter accept # -t filter -A INPUT -m state --state INVALID -j LOG --log-prefix invalid: ... The rules that cannot be translated are left commented. Users should be able to run this to track down the nft progress to see at what point it can fully replace iptables and their filtering policy. 2) iptables-translate which suggests a translation for an iptables command: $ iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT nft add rule filter OUTPUT ip protocol udp ip dst 8.8.8.8 counter accept Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include Use <stdint.h> types from xtables.hFelix Janda2015-06-261-10/+10
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* use nf_tables and nf_tables compatibility interfacePablo Neira Ayuso2013-12-301-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the following utilities: * xtables * xtables-restore * xtables-save * xtables-config They all use Patrick's nf_tables infrastructure plus my compatibility layer. xtables, xtables-restore and xtables-save are syntax compatible with ip[6]tables, ip[6]tables-restore and ip[6]tables-save. Semantics aims to be similar, still the main exception is that there is no commit operation. Thus, we incrementally add/delete rules without entire table locking. The following options are also not yet implemented: -Z (this requires adding expr->ops->reset(...) so nft_counters can reset internal state of expressions while dumping it) -R and -E (this requires adding this feature to nf_tables) -f (can be implemented with expressions: payload 6 (2-bytes) + bitwise a&b^!b + cmp neq 0) -IPv6 support. But those are a matter of time to get them done. A new utility, xtables-config, is available to register tables and chains. By default there is a configuration file that adds backward compatible tables and chains under iptables/etc/xtables.conf. You have to call this utility first to register tables and chains. However, it would be possible to automagically register tables and chains while using xtables and xtables-restore to get similar operation than with iptables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: trivial spelling fixstephen hemminger2013-08-071-2/+2
| | | | | Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Introduce match/target aliasesJozsef Kadlecsik2013-01-281-0/+16
| | | | | The match/target alias allows us to support the syntax of matches, targets targets merged into other matches/targets.
* libxtables: add xtables_print_numPablo Neira Ayuso2013-01-041-0/+16
| | | | | | | | This function is used both by iptables and ip6tables, and refactorize to avoid longer than 80-chars per column lines of code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: add xtables_rule_matches_freePablo Neira Ayuso2013-01-041-0/+2
| | | | | | This function is shared by iptables and ip6tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: support for match aliasesJan Engelhardt2012-09-291-0/+1
| | | | | | | This patch allows for match names listed on the command line to be rewritten to new names and revisions, like we did for targets before. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* iptables: support for target aliasesJan Engelhardt2012-09-271-0/+3
| | | | | | | | | | | This patch allows for target names listed on the command line to be rewritten to new names and revisions. As before, we will pick a revision that is supported by the kernel - now including real_name in the search. This gives us the possibility to test for many action names. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* build: separate AC variable replacements from xtables.hJan Engelhardt2012-08-311-0/+526
| | | | | | | It was/is a bit annoying that modifying xtables.h.in causes configure to rerun. Split the @foo@ things into a separate file to bypass this. Signed-off-by: Jan Engelhardt <jengelh@inai.de>