path: root/iptables/xtables-save.c
Commit message (Collapse)AuthorAgeFilesLines
* xtables: Do not dump before command parsing has been finishedTomasz Bursztyka2013-12-301-2/+8
| | | | | | | | On xtables-save.c, -d will not output right away but after the full command line hase been parsed. Signed-off-by: Tomasz Bursztyka <> Signed-off-by: Pablo Neira Ayuso <>
* nft: associate table configuration to handle via nft_initGiuseppe Longo2013-12-301-1/+1
| | | | | | | | | We need family dependent built-in table/chain configuration. This patch is a step forward making nft family independent in order to support arptables and ebtables compatibility layers. Signed-off-by: Giuseppe Longo <> Signed-off-by: Pablo Neira Ayuso <>
* xtables: fix missing afinfo configurationPablo Neira Ayuso2013-12-301-0/+1
| | | | | | | I noticed that the iprange match in IPv6 was broken, fix it by overriding the default family (IPv4) if -6 is passed. Signed-off-by: Pablo Neira Ayuso <>
* xtables: do not proceed if nft_init failsPablo Neira Ayuso2013-12-301-1/+7
| | | | | | | Fix a crash if nft_init fails, it happens if nfnetlink support is not available in your Linux kernel. Signed-off-by: Pablo Neira Ayuso <>
* xtables-save: add -4 and -6 supportPablo Neira Ayuso2013-12-301-1/+9
| | | | | | | | | | Now you can specify: xtables-save -6 > my-ip6tables-ruleset to dump the IPv6 rule-set. Signed-off-by: Pablo Neira Ayuso <>
* xtables: add IPv6 supportTomasz Bursztyka2013-12-301-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary of changes to add IPv6 support to the xtables utility: * modify all commands (add, delete, replace, check and listing) to support IPv6 addresses. And for the internal nft library: * add family to struct nft_handle and modify all caller to use this family instead of the hardcoded AF_INET. * move code that we can re-use for IPv4 and IPv6 into helper functions. * add IPv6 rule printing support. * add support to parse IPv6 address. Pablo added several improvements to this patch: * added basic xtables-save and xtables-restore support (so it defaults to IPv4) * fixed a couple of bugs found while testing * added reference when -f is used to point to -m frag (until we can make this consistent with IPv4). Note that we use one single xtables binary utility for IPv4 and IPv6. Signed-off-by: Tomasz Bursztyka <> Signed-off-by: Pablo Neira Ayuso <>
* use nf_tables and nf_tables compatibility interfacePablo Neira Ayuso2013-12-301-0/+122
This patch adds the following utilities: * xtables * xtables-restore * xtables-save * xtables-config They all use Patrick's nf_tables infrastructure plus my compatibility layer. xtables, xtables-restore and xtables-save are syntax compatible with ip[6]tables, ip[6]tables-restore and ip[6]tables-save. Semantics aims to be similar, still the main exception is that there is no commit operation. Thus, we incrementally add/delete rules without entire table locking. The following options are also not yet implemented: -Z (this requires adding expr->ops->reset(...) so nft_counters can reset internal state of expressions while dumping it) -R and -E (this requires adding this feature to nf_tables) -f (can be implemented with expressions: payload 6 (2-bytes) + bitwise a&b^!b + cmp neq 0) -IPv6 support. But those are a matter of time to get them done. A new utility, xtables-config, is available to register tables and chains. By default there is a configuration file that adds backward compatible tables and chains under iptables/etc/xtables.conf. You have to call this utility first to register tables and chains. However, it would be possible to automagically register tables and chains while using xtables and xtables-restore to get similar operation than with iptables. Signed-off-by: Pablo Neira Ayuso <>