| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
| |
|
| |
|
| |
|
|
|
|
|
| |
string_to_number_ll, string_to_number_l, string_to_number,
service_to_port, parse_port, parse_interface, are moved.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- moves lib_dir to xtables.c
- introduces struct pfinfo which has protocol family dependent infomations.
- unifies load_ip[6]tables_ko() and moves them as load_xtables_ko()
- introduces xt_{match,match_rule,target,tryload} and replaces
ip[6]t_* with them
- unifies following functions and move them to xtables.c
- find_{match,find_target}
- compatible_revision, compatible_{match,target}_revision
- introduces xtables_register_{match,target} and make
register_{match,target}[6] call them. xtables_register_* register ONLY
matches/targets matched protocol family
Some concepts:
- source compatibility for libip[6]t_xxx.c with warning on compilation
not binary compatibility.
- binary compatibility between 2.4/2.6 kernel and iptables/ip6tables,
of cause.
- xtables is enough to support only one address family at runtime.
Then xtables keeps infomations of only the focused address famiy
in struct afinfo.
|
| |
|
| |
|
| |
|
|
|
|
| |
Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
|
|
|
|
|
|
|
| |
The recent kernel has compat layer for iptables. It doesn't have
compat layer for libipq and ip6tables, but ip6tables with
KERNEL_64_USERSPACE_32 is still broken. We should fix kernel instead of
fixing them if and when we want use their 32bit binary with 64bit kernel.
|
| |
|
|
|
|
| |
versions.
|
| |
|
| |
|
|
|
|
| |
Kernel part will go in 2.6.21.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
http://bugs.debian.org/398082
iptables 1.3.5 and 1.3.6 appear to read /etc/networks, but the
information is lost somewhere with 1.3.6.
# cat /etc/networks
foonet 10.0.0.0
# strace -s 255 -o /tmp/foo iptables -v -A INPUT -s foonet/8 -j
ACCEPT #1.3.5 [1]
ACCEPT all opt -- in * out * 10.0.0.0/8 -> 0.0.0.0/0
# strace -s 255 -o /tmp/bar iptables -v -A INPUT -s foonet/8 -j
ACCEPT #1.3.6 [2]
iptables v1.3.6: host/network `foonet.0.0.0' not found
Try `iptables -h' or 'iptables --help' for more information.
1. http://people.debian.org/~ljlane/stuff/strace-iptables-1.3.5.txt
2. http://people.debian.org/~ljlane/stuff/strace-iptables-1.3.6.txt
|
| |
|
|
|
|
| |
66 and 67 is conflicted with IPv6 Advanced API in kernel <= 2.6.18.
|
|
|
|
|
| |
- Add support port range match to libip6t_multiport
(R?mi Denis-Courmont <rdenis@simphalempin.com>)
|
| |
|
|
|
|
| |
invalid arguments to get accepted.
|
|
|
|
|
| |
Update multiport match to use the iptables version of proto_to_name
instead of reinventing the wheel.
|
|
|
|
|
| |
The below patch (dependent upon my 'reduce service_to_port duplication' patch)
centralizes the parse_*_port functions into parse_port.
|
|
|
|
|
| |
The service_to_port function is used in a number of places, and could
benefit from some centralization instead of being duplicated everywhere.
|
|
|
|
|
|
|
|
|
|
|
|
| |
As suggested by Dmitry Levin and included in Fedora Core releases,
use gcc instead of ld to link shared objects. Fedora rpm notes
refer to this fixing a plugin problem, but does not offer specifics.
But in any event, 'gcc -dumpspecs' does show gcc will pass a number
of parameters which in theory it thinks are better.
Compile tested both with and without NO_SHARED_LIBS.
Closes bug #454.
|
|
|
|
| |
<hawk@comx.dk>)
|
| |
|
|
|
|
|
|
|
|
|
|
| |
If two or more matches of the same type are detected then the options
are assumed to be grouped in order to tell which option belongs
to which match:
... -m foo ... <options0> ... -m foo ... <options1> ...
Otherwise the commandline parsing is unmodified.
|
| |
|
| |
|
|
|
|
| |
(ipset.netfilter.org) these days
|
|
|
|
| |
ipt_policy and ip6t_policy use the same data structure.
|
|
|
|
| |
Bugzilla #413
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
DNAT and SNAT targets. At present, the error is somewhat vague:
# iptables -t nat -A foo -j SNAT --to 1.2.3.4 --to 2.3.4.5
iptables: Invalid argument
But if we want current iptables to work with kernels <= 2.6.10, we
cannot simply disallow this in all cases.
So the below patch adds kernel version checking to iptables, and
utilizes it in [DS]NAT. Now, users will see a more informative error:
# iptables -t nat -A foo -j SNAT --to 1.2.3.4 --to 2.3.4.5
iptables v1.3.3: Multiple --to-source not supported
This generic infrastructure (shamelessly lifted from procps btw) may
come in handy in the future for other changes.
This fixes bugzilla #367. (Phil Oester)
|
|
|
|
| |
We can't include that header since it conflicts with sys/types.h
|
| |
|
|
|
|
| |
tested compilation with kernels starting 2.4.17
|
|
|
|
| |
IP6T_LOG_UID.
|
| |
|
|
|
|
| |
to use ip_conntrack_old_tuple. (Pablo Neira)
|
| |
|
|
|
|
|
|
|
| |
Also fixes a typo in CONNMARK, --mask set the mark, not the mask.
Initial patch by: Pablo Neira <pablo@eurodev.net>
Signed-off-by: Martin Josefsson <gandalf@wlug.westbo.se>
|
|
|
|
| |
Signed-off-by: Phil Oester <kernel@linuxace.com>
|
|
|
|
| |
Multiport revision 1 userspace support.
|
|
|
|
|
| |
Enhance MARK match with second revision.
Committed in anticipation of the kernel patch being applied.
|
| |
|
| |
|
| |
|