summaryrefslogtreecommitdiffstats
path: root/ip6tables.c
Commit message (Collapse)AuthorAgeFilesLines
* iptables: add noreturn attribute to exit_tryhelp()Dmitry V. Levin2010-05-141-1/+1
| | | | | | | Found by gcc -Wmissing-noreturn. Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: correctly check for too-long chain/target/match namesJan Engelhardt2010-03-161-2/+2
| | | | | | | | | * iptables-restore was not checking for chain name length * iptables was not checking for match name length * target length was checked against 32, not 29. References: http://bugzilla.netfilter.org/show_bug.cgi?id=641 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: take masks into consideration for replace commandJan Engelhardt2009-11-151-4/+6
| | | | | | | | | | | | | The two commands: -A OUPUT -d 10.11.12.13/32 -j LOG -R OUTPUT 1 -j LOG -d 10.11.12.13 will replace 10.11.12.13/32 by 10.11.12.13/0, which is not right. (No regression, this problem was there forever.) Reported-by: Werner Pawlitschko <werner.pawlitschko@arcor.de> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables/extensions: make bundled options work againJan Engelhardt2009-11-031-6/+6
| | | | | | | | | | | | | When using a bundled option like "-ptcp", 'argv[optind-1]' would logically point to "-ptcp", but this is obviously not right. 'optarg' is needed instead, which if properly offset to "tcp". Not all places change optind-based access to optarg; where look-ahead is needed, such as for tcp's --tcp-flags option for example, optind is ok. References: http://bugzilla.netfilter.org/show_bug.cgi?id=611 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: hand argv to xtables_check_inverseJan Engelhardt2009-11-031-5/+5
| | | | | | | | | In going to fix NF bug #611, "argv" is needed in xtables_check_inverse to set "optarg" to the right spot in case of an intrapositional negation. References: http://bugzilla.netfilter.org/show_bug.cgi?id=611 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix undersized deletion mask creationJan Engelhardt2009-10-291-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | The mask created for the -D rulespec is simply too small. xtables_targets points to whatever target has last been loaded, so xtables_targets->size is quite almost wrong, as we need to use the size of the target for the specific rule that is about to be deleted. This bug existed ever since iptables history is tracked, and requires certain circumstances to be visible, where the deletion operation is one. Furthermore, multiple userspace target extensions must have been loaded, and a target B whose .size is smaller than the target A of the rule we are about to delete must have been loaded more recently than target A. The minimal testcase is (rule 60007 gets wrongly removed) *nat -F -X -A POSTROUTING -p udp -j SNAT --to 192.168.1.1:60007 -A POSTROUTING -p udp -j SNAT --to 192.168.1.1:60008 -A POSTROUTING -p udp -j CONNMARK --set-mark 0 -D POSTROUTING -p udp -j SNAT --to 192.168.1.1:60008 COMMIT References: http://bugzilla.netfilter.org/show_bug.cgi?id=606 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: expose option to zero packet/byte counters for a specific ruleMohit Mehta2009-08-201-7/+24
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: allow for help-less extensionsJan Engelhardt2009-06-261-16/+2
| | | | | | | This is for extensions that do not take any options, and which subsequently do not offer any help text either. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: allow for parse-less extensionsJan Engelhardt2009-06-261-4/+5
| | | | | | This means we can do some code removal in extensions. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: accept multiple IP address specifications for -s, -dMichael Granzow2009-06-261-18/+31
| | | | | | | | | | | | | | libiptc already supports adding and deleting multiple rules with different addresses, so it only needs to be wired up to the options. # ip6tables -I INPUT -s 2001:db8::d,2001:db8::e -j DROP References: http://marc.info/?l=netfilter-devel&m=123929790719202&w=2 Adjustments made: syntax, removal of unneeded variables, manpage adjustment, soversion bump. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: print negation extrapositionedJan Engelhardt2009-04-041-6/+6
| | | | | | | | | | | | | | This patch combines the two referenced ones by Peter. I did a quick extra audit to spot and fix the missing ip6tables parts. (People like to forget ip6tables it seems.) Extension modules were, to the best of my knowledge, already audited in v1.4.3-rc1-10-gcea9f71. Reported-by: Yar Odin <yarodin@gmail.com> References: http://bugs.gentoo.org/264089 Reported-by: Peter Volkov <pva@gentoo.org> References: http://marc.info/?l=netfilter-devel&m=123883867907935&w=2 References: http://marc.info/?l=netfilter-devel&m=123883992508943&w=2 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix broken options-merging during libxtables reworkPablo Neira Ayuso2009-03-031-1/+1
| | | | | | | | | | | | | | | | | | | | | This patch fixes options-merging that was broken somewhere during the libxtables rework. Before this patch, two pointers were used to keep the current options, however, the options field in xt_params was not appropritely updated. Thus, xtables_free_opts() was not restoring the original options. This patch fixes iptables-restore and ip6tables-restore that stopped working in my personal firewall. % iptables-restore *filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables-restore v1.4.3-rc1: Unknown arg `ESTABLISHED,RELATED' Error occurred at line: 4 Try `iptables-restore -h' or 'iptables-restore --help' for more information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: prefix exit_error to xtables_errorJan Engelhardt2009-02-211-36/+36
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: resynchronize manpage with in-code helpJan Engelhardt2009-02-211-2/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: general follow-up cleanupJamal Hadi Salim2009-02-131-10/+9
| | | | | | Kill program_name, program_version and xtables_program_name. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
* libxtables: consolidate init calls into one functionJamal Hadi Salim2009-02-131-1/+0
| | | | | | | | | | | Introduce xtables_init_all() which hides three calls xtables_init(), xtables_set_nfproto(), and xtables_set_params(). Make ip[6]tables-restore, ip[6]tables-save and ip[6]tables-standalone use it. I moved xtables_set_params around for readability reasons. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
* libxtables: consolidate merge_options into xtables_merge_optionsJamal Hadi Salim2009-02-131-34/+3
| | | | | | | | Introduce xtables_merge_options() for re-use reasons. Apps can use it instead of each defining their own merge_options(). Made iptables and ip6tables use the new shared interface. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
* libxtables: make iptables and ip6tables use xtables_free_optsJamal Hadi Salim2009-02-121-14/+5
| | | | | | | | The patch modifies xtables_globals to introduce orig_opts and xtables_free_opts() to emulate what free_opts used to do. We also get rid of the copies of free_opts() that iptables and ip6tables keep. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
* libxtables: add xtables_set_revisionJamal Hadi Salim2009-02-121-11/+3
| | | | | | Introduce xtables_set_revision() and make iptables and ip6tables use it. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
* libxtables: set names of programsJamal Hadi Salim2009-02-121-1/+0
| | | | | | Set proper name of application. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
* Merge branch 'master' of git://dev.medozas.de/iptablesPatrick McHardy2009-02-121-12/+12
|\
| * src: remove iptables_rule_match indirection macroJan Engelhardt2009-02-101-12/+12
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | libxtables: simple aliasing macro for exit_errorJamal Hadi Salim2009-02-111-2/+3
| | | | | | | | | | | | | | | | | | | | | | Rename xtables_globals exit_error cb to exit_err and introduce a very simple aliasing macro to point to it. convert iptables, ip6tables and iptables_xml to use it. Note iptables_xml does not have to define its own exit_error() since it can use the basic one provided. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | libxtables: Make ip6tables, iptables and iptables-xml use xtables_globalsJamal Hadi Salim2009-02-111-0/+8
|/ | | | | | | | convert ip6tables, iptables and iptables-xml to use xtables_globals/xtables_set_params() Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libxtables: move afinfo aroundJan Engelhardt2009-02-071-9/+0
| | | | | | | libxtables should not rely on the program executable providing the magic constants for using [gs]etsockopt. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix/order - move parse_protocol to xtables.cJan Engelhardt2009-01-301-74/+10
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix/order - move check_inverse to xtables.cJan Engelhardt2009-01-301-25/+5
| | | | | | | This also adds a warning that intrapositional negation support is deprecated. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix - parse and escaped output funcJan Engelhardt2009-01-301-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix - misc functionsJan Engelhardt2009-01-301-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix/order - ipaddr/ipmask to ascii outputJan Engelhardt2009-01-301-6/+6
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix/order - param_actJan Engelhardt2009-01-301-1/+1
| | | | | | | | Changes: exittype -> xtables_exittype P_* -> XTF_* flags Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix/order - strtouiJan Engelhardt2009-01-271-3/+3
| | | | | | This commit also throws out the redundant string_to_number_*. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix/order - match/target loadingJan Engelhardt2009-01-271-20/+25
| | | | | | | | | This change affects: find_{match,target} -> xtables_find_{match,target} enum xt_tryload -> enum xtables_tryload loose flags like DONT_LOAD -> XTF_DONT_LOAD Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix/order - modprobe and xtables.ko loadingJan Engelhardt2009-01-271-2/+3
| | | | | | | | | This change affects: load_xtables_ko -> xtables_load_ko modprobe_program -> xtables_modprobe_program Now uses bool for the "quiet" flag. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix/order - fw_xallocJan Engelhardt2009-01-271-7/+7
| | | | | | | | | | | | It is good practice to prefix names in a library some way so that it does not clash with external programs' variable names right on the first try. This change: rename fw_[cm]alloc to xtables_[cm]alloc and move the definition from internal.h to xtables.h to avoid potential compiler warnings. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: use UINT_MAX constants over open-coded numbers (2/2)Jan Engelhardt2009-01-271-2/+2
| | | | | | Use the handy constants for ranges. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: fix error reporting with wrong/missing argumentsPablo Neira Ayuso2008-11-191-1/+18
| | | | | | | | | | | | | | | | This patch fixes wrong error reporting when arguments are missing: # iptables -I INPUT -m state --state iptables v1.4.2-rc1: Unknown arg `(null)' Try `iptables -h' or 'iptables --help' for more information. or wrong: # iptables -I INPUT -m state --xyz iptables v1.4.2-rc1: Unknown arg `(null)' Try `iptables -h' or 'iptables --help' for more information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use NFPROTO_ constantsJan Engelhardt2008-11-181-1/+1
| | | | | | | | Resync netfilter.h from the latest kernel and make use of the new NFPROTO_ constants that have been introduced. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libiptc: remove indirectionsJan Engelhardt2008-11-101-35/+35
| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* libiptc: remove typedef indirectionJan Engelhardt2008-11-101-16/+16
| | | | | | | | | | | Don't you hate it when iptc_handle_t *x actually is a double-indirection struct iptc_handle **? This also shows the broken constness model, since "const iptc_handle_t x" = "iptc_handle_t const x" = "struct iptc_handle *const x", which is like no const at all. Lots of things to do then. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Synchronize invert flag order with manpagesJan Engelhardt2008-08-131-5/+5
| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables-restore: fix segmentation fault with -tanythingJan Engelhardt2008-08-041-3/+2
| | | | | | | | | | | | | | | | | | | | Reference: Debian bug #458042 iptables-restore must not pass a table into do_command. It checks for "-t arg" and "--table arg", but not "-targ". (On a related note, using -targ does not work as expected). This should fail gracefully, but crashes: iptables-restore <(echo -e '*filter\n-A INPUT -tx\nCOMMIT') And this should use table "filter", or perhaps raise an error, but instead sets the table to (literally) "-tfilter": iptables -tfilter -A INPUT Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* ip6tables: add --goto supportThomas Jacob2008-06-231-1/+29
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* iptables: fix printing of line numbers with --line-numbers argHenrik Nordstrom2008-06-131-1/+1
| | | | | | | Commit bb34082d ("iptables --list chain rulenum") broke the line numbering, starting with printing an offset of 2. Signed-off-by: Patrick McHardy <kaber@trash.net>
* fix ip6tables dest address printingJamie Strandboge2008-05-161-2/+2
| | | | | | | | | | | | | | | | | http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464244 ip6tables improperly displays the destination address when the address is longer than 18 characters. Here is example output: ... DROP tcp 2001:db8::/32 2001:db8:3:4:5:6:7:8/128tcp spt:25 ... Proper formatting should have a space between '2001:db8:3:4:5:6:7:8/128' and 'tcp'. Signed-off-by: Jamie Strandboge <jamie@ubuntu.com> Signed-off-by: Lawrence J. Lane <ljlane@debian.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Make --set-counters (-c) accept comma separated countersHenrik Nordstrom2008-05-131-5/+7
| | | | | | | | | | | | Here is the --set-counters syntax patch requested earlier today making --set-counters (-c) accept comma separated counts. -c packets,bytes I have not updated the manpage to reflect this alternate syntax for the --set-counters (-c) option. Henrik Nordstrom <henrik@henriknordstrom.net>
* iptables --list chain rulenumHenrik Nordstrom2008-05-131-15/+31
| | | | | | | | | | | | Excent --list (and --list-rules) to allow selection of a single rule number iptables --list INPUT 4 iptables --list-rules INPUT 4 list rule number 4 in INPUT. Henrik Nordstrom <henrik@henriknordstrom.net>
* iptables --list-rules commandHenrik Nordstrom2008-05-131-16/+264
| | | | | | | | | | | | | | | | | | Adds iptables --list-rules (-S) command, acting as a combination of iptables --list and iptables-save. The primary motivation behind this patch is to get iptables-save like output capabilities in iptables-restore, allowing "iptables-restore -n" to be used as a consistent API to iptables for all kind of operations, not only blind updates.. As a bonus iptables also gets the capability of printing the rules as-is. This completely replaces the earlier patch which added the --rules option. Henrik Nordstrom <henrik@henriknordstrom.net>
* Add support for --set-counters to iptables -PHenrik Nordstrom2008-05-121-2/+2
| | | | | | | | Adds support for setting the policy counters iptables -P INPUT -J DROP -c 10 20 Henrik Nordstrom <henrik@henriknordstrom.net>
* Properly initialize revision for ip6tables targetsPatrick McHardy2008-04-151-1/+8
| | | | Also resync error handling with iptables.
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 14:57:32 +0000