summaryrefslogtreecommitdiffstats
path: root/iptables
Commit message (Collapse)AuthorAgeFilesLines
* ip[6]tables: show --protocol instead of --proto in usageMart Frauenlob2013-03-292-2/+2
| | | | | | | | As the man page shows --protocol not --proto, also do so in the usage text displayed by ip[6]tables -h. Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libip6t_NETMAP: Use xtables_ip6mask_to_cidr and get rid of libip6tc dependencyPablo Neira Ayuso2013-03-291-1/+1
| | | | | | | | | This patch changes the NETMAP target extension (IPv6 side) to use the xtables_ip6mask_to_cidr available in libxtables. As a side effect, we get rid of the libip6tc dependency. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: iptables provides up to 5 independent tablesPablo Neira Ayuso2013-02-172-2/+2
| | | | | | | | | This closes bugzilla: http://bugzilla.netfilter.org/show_bug.cgi?id=807 Reported-by: Quentin Armitage <quentin@armitage.org.uk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'master' of vishnu.netfilter.org:/data/git/iptablesJozsef Kadlecsik2013-01-311-0/+7
|\
| * doc: document nat table for IPv6Pablo Neira Ayuso2013-01-281-0/+7
| | | | | | | | | | | | Based on the IPv4 description. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Introduce match/target aliasesJozsef Kadlecsik2013-01-282-32/+36
|/ | | | | The match/target alias allows us to support the syntax of matches, targets targets merged into other matches/targets.
* doc: document the -4 and -6 optionsJan Engelhardt2013-01-072-0/+18
| | | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: mention -m in the manpageJan Engelhardt2013-01-072-0/+14
| | | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: document iptables-restore's -h optionJan Engelhardt2013-01-072-2/+8
| | | | | | References: http://bugs.debian.org/644221 Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: document iptables-restore's -M optionJan Engelhardt2013-01-072-2/+12
| | | | | | References: http://bugs.debian.org/644221 Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: document iptables-restore's -v optionJan Engelhardt2013-01-072-2/+8
| | | | | | References: http://bugs.debian.org/644221 Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: document iptables-restore's -t optionJan Engelhardt2013-01-072-2/+8
| | | | | | References: http://bugs.debian.org/644221 Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fixup omissions in ip6tables-restore.8Jan Engelhardt2013-01-072-3/+5
| | | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: add xtables_print_numPablo Neira Ayuso2013-01-042-89/+8
| | | | | | | | This function is used both by iptables and ip6tables, and refactorize to avoid longer than 80-chars per column lines of code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: add xtables_rule_matches_freePablo Neira Ayuso2013-01-042-44/+2
| | | | | | This function is shared by iptables and ip6tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: remove unused leftover definitionsPablo Neira Ayuso2013-01-041-16/+0
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Manpage update: matches are evaluated in the order they are specified.Jozsef Kadlecsik2012-12-061-1/+2
| | | | Fixes bugzilla id 797.
* iptables: restore NOTRACK functionality, target aliasingJan Engelhardt2012-10-082-15/+21
| | | | | | | | | | | | | | | | | | | | | | | | | Commit v1.4.16-1-g2aaa7ec is testing for real_name (not) being NULL which was always false (true). real_name was never NULL, so cs->jumpto would always be used, which rendered -j NOTRACK unusable, since the chosen real name.revision is for example NOTRACK.1, which does not exist at the kernel side. # ./iptables/xtables-multi main4 -t raw -A foo -j NOTRACK dbg: Using NOTRACK.1 WARNING: The NOTRACK target is obsolete. Use CT instead. iptables: Protocol wrong type for socket. To reasonably support the extra-special verdict names, make it so that real_name remains NULL when an extension defined no alias, which we can then use to determine whether the user entered an alias name (which needs to be followed) or not. [ I have mangled this patch to remove a comment unnecessarily large. BTW, this patch gets this very close to the initial target aliasing proposal --pablo ] Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: fix standard targetPablo Neira Ayuso2012-10-082-2/+8
| | | | | | | | | | | | | | | | | | | | | | | This regression was added by: commit cd2f9bdbb7f9b737e5d640aafeb78bcd8e3a7adf Author: Jan Engelhardt <jengelh@inai.de> Date: Tue Sep 4 05:24:47 2012 +0200 iptables: support for target aliase The result is that: iptables -I INPUT -j ACCEPT says: iptables: No chain/target/match by that name. This also breaks iptables-restore, of course. Jan, you'll have to explain me how you have tested this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'master' of git://git.inai.de/iptablesJan Engelhardt2012-09-306-41/+49
|\ | | | | | | | | | | | | | | | | | | Conflicts: extensions/GNUmakefile.in Resolution: trivial, since this was a fuzz 3. Reason: Line added from v1.4.15-16-g33710a5 was in vincinity of changes from v1.4.15-22-g4496801.
| * doc: mention iptables-apply in the SEE ALSO sectionsJan Engelhardt2012-09-303-1/+3
| | | | | | | | | | References: http://bugs.debian.org/660748 Signed-off-by: Jan Engelhardt <jengelh@inai.de>
| * doc: deduplicate extension descriptions into a new manpageJan Engelhardt2012-09-305-40/+46
| | | | | | | | | | | | | | | | | | | | iptables.8 and ip6tables.8 had pretty much the same content, with a few protocol-specific deviations here and there. Not only did that bloat the manpages, but it also made it harder to spot differences. Separate out the extension descriptions into a new manpage, which conveniently features differences next to one another (cf. REJECT). Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* | Merge branch 'master' of git://git.inai.de/iptablesJan Engelhardt2012-09-302-4/+23
|\|
| * iptables: support for match aliasesJan Engelhardt2012-09-292-2/+10
| | | | | | | | | | | | | | This patch allows for match names listed on the command line to be rewritten to new names and revisions, like we did for targets before. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
| * iptables: support for target aliasesJan Engelhardt2012-09-272-2/+13
| | | | | | | | | | | | | | | | | | | | | | This patch allows for target names listed on the command line to be rewritten to new names and revisions. As before, we will pick a revision that is supported by the kernel - now including real_name in the search. This gives us the possibility to test for many action names. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* | iptables: fix wrong error messagesPablo Neira Ayuso2012-09-082-2/+2
|/ | | | | | | | | | iptables -P INPUT iptables v1.4.15: -X requires a chain and a policy Try `iptables -h' or 'iptables --help' for more information. Note that it says -X when we have used -P. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip[6]tables-restore: cleanup to reduce one level of indentationPablo Neira Ayuso2012-08-032-138/+130
| | | | | | | This patch moves the parameter parsing to one function to reduce one level of indentation. Jan Engelhardt likes this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-restore: warn about -t in rule linesJan Engelhardt2012-07-312-4/+8
| | | | | | | save-restore syntax uses *table, not -t table. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-restore: fix parameter parsing (shows up with gcc-4.7)Pablo Neira Ayuso2012-07-302-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes parameter parsing in iptables-restore since time ago. The problem has shown up with gcc-4.7. This version of gcc seem to perform more agressive memory management than previous. Peter Lekensteyn provided the following sample code similar to the one in iptables-restore: int i = 0; for (;;) { char x[5]; x[i] = '0' + i; if (++i == 4) { x[i] = '\0'; /* terminate string with null byte */ printf("%s\n", x); break; } } Many may expect 0123 as output. But GCC 4.7 does not do that when compiling with optimization enabled (-O1 and higher). It instead puts random data in the first bytes of the character array, which becomes: | 0 | 1 | 2 | 3 | 4 | | RANDOM | '3' | '\0' | Since the array is declared inside the scope of loop's body, you can think of it as of a new array being allocated in the automatic storage area for each loop iteration. The correct code should be: char x[5]; for (;;) { x[i] = '0' + i; if (++i == 4) { x[i] = '\0'; /* terminate string with null byte */ printf("%s\n", x); break; } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "iptables-restore: move code to add_param_to_argv, cleanup (fix gcc-4.7)"Pablo Neira Ayuso2012-07-302-130/+136
| | | | | | | | This reverts commit 44191bdbd71e685fba9eab864b9df25e63905220. Apply instead a patch that really clarifies the bug in iptables-restore. This should be good for the record (specifically, for distributors so they can find the fix by googling).
* iptables-restore: move code to add_param_to_argv, cleanup (fix gcc-4.7)Pablo Neira Ayuso2012-07-252-136/+130
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch seems to be a mere cleanup that moves the parameter parsing code to add_param_to_argv. But, in reality, it also fixes iptables when compiled with gcc-4.7. Moving param_buffer declaration out of the loop seems to resolve the issue. gcc-4.7 seems to be generating bad code regarding param_buffer. @@ -380,9 +380,9 @@ quote_open = 0; escaped = 0; param_len = 0; + char param_buffer[1024]; for (curchar = parsestart; *curchar; curchar++) { - char param_buffer[1024]; if (quote_open) { if (escaped) { But I have hard time to apply this patch in such a way. Instead, I came up with the idea of this cleanup, which does not harm after all (and fixes the issue for us). Someone in: https://bugzilla.redhat.com/show_bug.cgi?id=82579 put some light on this: "Yes, I ran into this too. The issue is that the gcc optimizer is optimizing out the code that collects quoted strings in iptables-restore.c at line 396. If inside a quotemark and it hasn't seen another one yet, it executes param_buffer[param_len++] = *curchar; continue; At -O1 or higher, the write to param_buffer[] never happens. It just increments param_len and continues. Moving the definition of char param_buffer[1024]; outside the loop fixes it. Why, I'm not sure. Defining the param_buffer[] inside the loop should simply restrict its scope to inside the loop." Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip(6)tables-restore: make sure argv is NULL terminatedFlorian Westphal2012-05-142-2/+2
| | | | | | | | | | Else, argv[argc] may point to free'd memory. Some extensions, e.g. rateest, may fail to parse valid input because argv[optind] (with optind == argc) is not NULL. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'stable'Jan Engelhardt2011-12-1810-281/+252
|\
| * Merge branch 'stable'Jan Engelhardt2011-09-193-3020/+1
| |\
| * | ip6tables-restore: make code look alike with iptables-restoreJan Engelhardt2011-09-112-33/+30
| | | | | | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * | src: resolve old macro names that are indirectionsJan Engelhardt2011-09-118-86/+84
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Command used: git grep -f <(pcregrep -hior '(?<=#define\s)IP6?(T_\w+)(?=\s+X\1)' include/) and then fix all occurrences. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * | libiptc: combine common types: _handleJan Engelhardt2011-09-118-44/+44
| | | | | | | | | | | | | | | | | | | | | No real API/ABI change incurred, since the definition of the structs' types is not visible anyhow. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * | libiptc: replace ipt_chainlabel by xt_chainlabelJan Engelhardt2011-09-112-30/+30
| | | | | | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * | iptables-save: remove binary dumping dead codeJan Engelhardt2011-09-112-92/+68
| | | | | | | | | | | | | | | | | | Was never implemented, kill it. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | | doc: clarification on the meaning of -p 0Jan Engelhardt2011-12-182-7/+19
| |/ |/| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | build: restore build order of modulesJan Engelhardt2011-09-193-3020/+1
|/ | | | | | | | iptables(exe) requires libext.a, but extensions/ require libxtables.la (in iptables/). This circular dependency does not work out, so separate libxtables into its own directory and put it in front. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: document iptables-restore's -T optionJan Engelhardt2011-09-082-1/+7
| | | | | | Commit v1.4.0-rc1-12-ge8665f8 completely forgot this. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* ip6tables-restore: implement missing -T optionJan Engelhardt2011-09-081-1/+10
| | | | | | | Commit v1.4.0-rc1-12-ge8665f8 forgot to port the change to the ip6tables part. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* doc: fix undesired newline in ip6tables-restore(8)Jan Engelhardt2011-09-081-1/+0
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: move kernel version find routing into libxtablesJan Engelhardt2011-09-033-19/+18
| | | | | | | | That way, the remaining unreferenced symbols that do appear in libipt_DNAT and libipt_SNAT as part of the new check can be resolved, and the ugly -rdynamic hack can finally be removed. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_statistic: link with -lmJan Engelhardt2011-09-031-2/+7
| | | | | | | | $ ldd -r libxt_statistic.so undefined symbol: lround (./libxt_statistic.so) References: https://bugs.archlinux.org/task/25358 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtoptions: simplify xtables_parse_interfaceRichard Weinberger2011-08-271-3/+1
| | | | | | | mask is already filled with zeros, there is no need to zero it again. References: http://marc.info/?l=netfilter-devel&m=131445196526269&w=2 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtoptions: fill in fallback value for nvalsJan Engelhardt2011-08-271-0/+6
| | | | | | | | | | | | | Parsing for libxt_conntrack rev 2 is done by using rev 2's option structure, which specifies XTTYPE_PORT, and using rev 3's parser skeleton, which uses cb->nvals. Reading cb->nvals when not using XTTYPE_PORTRC (or any other multi-value type) is undefined behavior. Make it defined. Since XTTYPE_NONE is the only type that can take void, nvals logically ought to be 1. References: http://marc.info/?l=netfilter-devel&m=131370592105298&w=2 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: remove unused IPTABLES_MULTI defineJan Engelhardt2011-08-268-38/+1
| | | | | | This dead code has been lingering around since commit v1.4.5~7. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtoptions: flag use of XTOPT_POINTER without XTOPT_PUTJan Engelhardt2011-08-211-1/+7
| | | | | | | When XTOPT_POINTER is used (and yields a non-zero offsetof), we can flag the absence of XTOPT_PUT. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>