From d59b9db031abee37a9aa9776662dd15370faabf4 Mon Sep 17 00:00:00 2001 From: Stefan Tomanek Date: Tue, 8 Mar 2011 22:42:51 +0100 Subject: iptables: add -C to check for existing rules It is often useful to check whether a specific rule is already present in a chain without actually modifying the iptables config. Services like fail2ban usually employ techniques like grepping through the output of "iptables -L" which is quite error prone. This patch adds a new operation -C to the iptables command which mostly works like -D; it can detect and indicate the existence of the specified rule by modifying the exit code. The new operation TC_CHECK_ENTRY uses the same code as the -D operation, whose functions got a dry-run parameter appended. Signed-off-by: Stefan Tomanek Signed-off-by: Jan Engelhardt --- libiptc/libip4tc.c | 1 + 1 file changed, 1 insertion(+) (limited to 'libiptc/libip4tc.c') diff --git a/libiptc/libip4tc.c b/libiptc/libip4tc.c index c1d78e2b..e2d2a5ee 100644 --- a/libiptc/libip4tc.c +++ b/libiptc/libip4tc.c @@ -76,6 +76,7 @@ typedef unsigned int socklen_t; #define TC_INSERT_ENTRY iptc_insert_entry #define TC_REPLACE_ENTRY iptc_replace_entry #define TC_APPEND_ENTRY iptc_append_entry +#define TC_CHECK_ENTRY iptc_check_entry #define TC_DELETE_ENTRY iptc_delete_entry #define TC_DELETE_NUM_ENTRY iptc_delete_num_entry #define TC_FLUSH_ENTRIES iptc_flush_entries -- cgit v1.2.3