From 57664121bce6d3ae05a186c7627c919fb0799649 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Date: Thu, 14 Apr 2011 02:22:14 -0700 Subject: Add --ipv4/-4 and --ipv6/-6 support to ip6?tables{,-restore}. This enables one to have a single configuration file for both ipv4 and ipv6 firewall rules. Example: iptables-restore config ip6tables-restore config Where the file 'config' contains: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :ssh - [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -m state --state INVALID -j DROP -A INPUT -i lo -j ACCEPT -A INPUT -4 -p icmp -j ACCEPT -A INPUT -6 -p icmpv6 -j ACCEPT -A INPUT -p tcp --dport 22 -m state --state NEW -j ssh -A ssh -j ACCEPT COMMIT Signed-off-by: Maciej Zenczykowski --- ip6tables.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) (limited to 'ip6tables.c') diff --git a/ip6tables.c b/ip6tables.c index f9909f13..967a5f80 100644 --- a/ip6tables.c +++ b/ip6tables.c @@ -124,6 +124,8 @@ static struct option original_opts[] = { {.name = "modprobe", .has_arg = 1, .val = 'M'}, {.name = "set-counters", .has_arg = 1, .val = 'c'}, {.name = "goto", .has_arg = 1, .val = 'g'}, + {.name = "ipv4", .has_arg = 0, .val = '4'}, + {.name = "ipv6", .has_arg = 0, .val = '6'}, {NULL}, }; @@ -248,6 +250,8 @@ exit_printhelp(const struct xtables_rule_match *matches) " Change chain name, (moving any references)\n" "Options:\n" +" --ipv4 -4 Error (line is ignored by ip6tables-restore)\n" +" --ipv6 -6 Nothing (line is ignored by iptables-restore)\n" "[!] --proto -p proto protocol: by number or name, eg. `tcp'\n" "[!] --source -s address[/mask][,...]\n" " source specification\n" @@ -1439,7 +1443,7 @@ int do_command6(int argc, char *argv[], char **table, struct ip6tc_handle **hand opts = xt_params->orig_opts; while ((cs.c = getopt_long(argc, argv, - "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:bvnt:m:xc:g:", + "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:bvnt:m:xc:g:46", opts, NULL)) != -1) { switch (cs.c) { /* @@ -1756,6 +1760,17 @@ int do_command6(int argc, char *argv[], char **table, struct ip6tc_handle **hand cs.fw6.counters.bcnt = cnt; break; + case '4': + /* This is not the IPv4 iptables */ + if (line != -1) + return 1; /* success: line ignored */ + fprintf(stderr, "This is the IPv6 version of ip6tables.\n"); + exit_tryhelp(2); + + case '6': + /* This is indeed the IPv6 ip6tables */ + break; + case 1: /* non option */ if (optarg[0] == '!' && optarg[1] == '\0') { if (cs.invert) -- cgit v1.2.3