| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
| |
Commit bb34082d ("iptables --list chain rulenum") broke the line
numbering, starting with printing an offset of 2.
Signed-off-by: Patrick McHardy <kaber@trash.net>
|
|
|
|
|
|
|
|
|
|
|
|
| |
Here is the --set-counters syntax patch requested earlier today making
--set-counters (-c) accept comma separated counts.
-c packets,bytes
I have not updated the manpage to reflect this alternate syntax for the
--set-counters (-c) option.
Henrik Nordstrom <henrik@henriknordstrom.net>
|
|
|
|
|
|
|
|
|
|
|
|
| |
Excent --list (and --list-rules) to allow selection of a single rule
number
iptables --list INPUT 4
iptables --list-rules INPUT 4
list rule number 4 in INPUT.
Henrik Nordstrom <henrik@henriknordstrom.net>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Adds iptables --list-rules (-S) command, acting as a combination of
iptables --list and iptables-save.
The primary motivation behind this patch is to get iptables-save like
output capabilities in iptables-restore, allowing "iptables-restore -n"
to be used as a consistent API to iptables for all kind of operations,
not only blind updates..
As a bonus iptables also gets the capability of printing the rules
as-is.
This completely replaces the earlier patch which added the --rules
option.
Henrik Nordstrom <henrik@henriknordstrom.net>
|
|
|
|
|
|
|
|
| |
Adds support for setting the policy counters
iptables -P INPUT -J DROP -c 10 20
Henrik Nordstrom <henrik@henriknordstrom.net>
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
| |
Note: xt_sctp.h is still not merged upstream in the kernel as of
this commit. But a refactoring was really needed.
|
|
|
|
| |
Max Kellermann <max@duempel.org>
|
|
|
|
|
|
| |
Rename overlapping function names.
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
|
|
|
|
|
|
|
|
| |
Move a few functions from iptables.c/ip6tables.c to xtables.c
so they are available for combined (both AF_INET and AF_INET6)
libxt modules. Rename overlapping function names.
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
|
|
|
|
|
| |
- check for malloc() return value in merge_opts()
- check for merge_opts() return value
|
|
|
|
|
|
|
|
| |
iptables prints some of its error messages and warnings to stdout.
This patch applies to svn r7075 and will make iptables print
diagnostic messages to stderr instead.
Signed-off-by: Max Kellermann <max@duempel.org>
|
| |
|
|
|
|
|
|
|
| |
Deletes empty ->final_check() functions, and makes ip[6]tables
checks for NULL on these.
Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
|
|
|
|
| |
prototypes
|
| |
|
| |
|
|
|
|
| |
Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
|
|
|
|
|
|
| |
(Jan Engelhardt <jengelh@gmx.de>)
A nice side effect is that merge_option() doesn't copy options in that case.
|
|
|
|
|
| |
string_to_number_ll, string_to_number_l, string_to_number,
service_to_port, parse_port, parse_interface, are moved.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- moves lib_dir to xtables.c
- introduces struct pfinfo which has protocol family dependent infomations.
- unifies load_ip[6]tables_ko() and moves them as load_xtables_ko()
- introduces xt_{match,match_rule,target,tryload} and replaces
ip[6]t_* with them
- unifies following functions and move them to xtables.c
- find_{match,find_target}
- compatible_revision, compatible_{match,target}_revision
- introduces xtables_register_{match,target} and make
register_{match,target}[6] call them. xtables_register_* register ONLY
matches/targets matched protocol family
Some concepts:
- source compatibility for libip[6]t_xxx.c with warning on compilation
not binary compatibility.
- binary compatibility between 2.4/2.6 kernel and iptables/ip6tables,
of cause.
- xtables is enough to support only one address family at runtime.
Then xtables keeps infomations of only the focused address famiy
in struct afinfo.
|
| |
|
| |
|
|
|
|
|
|
| |
non-existant matches and targets
Reported by Joseph Jezak <josejx@gentoo.org>.
|
|
|
|
| |
"all" to "0". This reverts to the original behaviour, and closes bugzilla #543. (Phil Oester)
|
|
|
|
|
|
| |
Supply modprobe parameter to iptables_insmod function.
Bugzilla #556
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
http://bugs.debian.org/398082
iptables 1.3.5 and 1.3.6 appear to read /etc/networks, but the
information is lost somewhere with 1.3.6.
# cat /etc/networks
foonet 10.0.0.0
# strace -s 255 -o /tmp/foo iptables -v -A INPUT -s foonet/8 -j
ACCEPT #1.3.5 [1]
ACCEPT all opt -- in * out * 10.0.0.0/8 -> 0.0.0.0/0
# strace -s 255 -o /tmp/bar iptables -v -A INPUT -s foonet/8 -j
ACCEPT #1.3.6 [2]
iptables v1.3.6: host/network `foonet.0.0.0' not found
Try `iptables -h' or 'iptables --help' for more information.
1. http://people.debian.org/~ljlane/stuff/strace-iptables-1.3.5.txt
2. http://people.debian.org/~ljlane/stuff/strace-iptables-1.3.6.txt
|
|
|
|
|
|
|
|
|
|
| |
Remove ununsed CHECK entry in commands_v_options.
It makes -E (rename) working again - generic_opt_check
expects options for RENAME not for CHECK at that table index.
Signed-off-by: Krzysztof Piotr Oledzki <ole@ans.pl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
|
| |
|
| |
|
|
|
|
| |
warning for basically every non-alphanumeric character.
|
|
|
|
| |
invalid arguments to get accepted.
|
|
|
|
|
| |
Update multiport match to use the iptables version of proto_to_name
instead of reinventing the wheel.
|
|
|
|
|
| |
The below patch (dependent upon my 'reduce service_to_port duplication' patch)
centralizes the parse_*_port functions into parse_port.
|
|
|
|
|
| |
The service_to_port function is used in a number of places, and could
benefit from some centralization instead of being duplicated everywhere.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
At present, a command such as
iptables -A foo -s 10.10/16
will interpret 10.10/16 as 10.0.0.10/16, and after applying the mask end
up with 10.0.0.0/16, which likely isn't what the user intended. Yet
some people do expect 10.10 (without the cidr notation) to end up as
10.0.0.10.
The below patch should satisfy all parties. It zero pads the missing
octets only in the cidr case, leaving the IP untouched otherwise.
This resolves bug #422
|
|
|
|
|
|
| |
option. However, the new array element is not initialized in either
commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] or
inverse_for_options[NUMBER_OF_OPT]. (Closes: #462)
|
|
|
|
|
|
| |
bit position of the command mask as an index in the array. There's no entry for
CMD_CHECK (0x0800U), so lookups for CMD_RENAME_CHAIN (0x1000U) index outside the
array. (Closes: #463)
|
|
|
|
|
|
|
|
|
|
| |
If two or more matches of the same type are detected then the options
are assumed to be grouped in order to tell which option belongs
to which match:
... -m foo ... <options0> ... -m foo ... <options1> ...
Otherwise the commandline parsing is unmodified.
|
|
|
|
| |
(Closes: #446)
|
|
|
|
|
|
| |
(Closes: #440). However, while this fixes the double-free, it still doesn't make iptables
support two of the same matches within one rule. Apparently the last matchinfo is copied into all the previous
matchinfo instances.
|
|
|
|
| |
Bugzilla #413
|
| |
|
| |
|