manpages: update to reflect fine-grained control

diff --git a/extensions/libip6t_frag.man b/extensions/libip6t_frag.man
index 8937b5580b7cd78908570df392cc3599e5b50dd8..cc13e7917282dbd06d0604b07b1901954c38ad95 100644 (file)
--- a/extensions/libip6t_frag.man
+++ b/extensions/libip6t_frag.man
@@ -13,8 +13,8 @@ Matches if the reserved fields are filled with zero.
 .BR "--fragfirst "
 Matches on the first fragment.
 .TP
-.BR "[--fragmore]"
+\fB--fragmore\fP
 Matches if there are more fragments.
 .TP
-.BR "[--fraglast]"
+\fB--fraglast\fP
 Matches if this is the last fragment.

diff --git a/extensions/libipt_DNAT.man b/extensions/libipt_DNAT.man
index f11f4e22c4c9d2fa0d8147ac40913cf625cb703c..65c152ce3a9b23e8428bb1405bf816a01af36aaa 100644 (file)
--- a/extensions/libipt_DNAT.man
+++ b/extensions/libipt_DNAT.man
@@ -10,7 +10,7 @@ should be modified (and all future packets in this connection will
 also be mangled), and rules should cease being examined.  It takes one
 type of option:
 .TP
-.BR "--to-destination " "[\fIipaddr\fP][-\fIipaddr\fP][:\fIport\fP-\fIport\fP]"
+\fB--to-destination\fP [\fIipaddr\fP][\fB-\fP\fIipaddr\fP][\fB:\fP\fIport\fP[\fB-\fP\fIport\fP]]
 which can specify a single new destination IP address, an inclusive
 range of IP addresses, and optionally, a port range (which is only
 valid if the rule also specifies

diff --git a/extensions/libipt_SAME.man b/extensions/libipt_SAME.man
index d038615a156711811b247b330c3d4b7ddc52e28a..7e28ca54e8c0178dc87b92418f5165eda79d60c0 100644 (file)
--- a/extensions/libipt_SAME.man
+++ b/extensions/libipt_SAME.man
@@ -2,7 +2,7 @@ Similar to SNAT/DNAT depending on chain: it takes a range of addresses
 (`--to 1.2.3.4-1.2.3.7') and gives a client the same
 source-/destination-address for each connection.
 .TP
-.BI "--to " "<ipaddr>-<ipaddr>"
+\fB--to\fP \fIipaddr\fP[\fB-\fP\fIipaddr\fP]
 Addresses to map source to. May be specified more than once for
 multiple ranges.
 .TP

diff --git a/extensions/libipt_SNAT.man b/extensions/libipt_SNAT.man
index 7b34799a010acf51c56e8fd0e059d0cccdcf3e49..34939afdf68717e7dafbdf0dad2b1fde98f4e03d 100644 (file)
--- a/extensions/libipt_SNAT.man
+++ b/extensions/libipt_SNAT.man
@@ -7,7 +7,7 @@ modified (and all future packets in this connection will also be
 mangled), and rules should cease being examined.  It takes one type
 of option:
 .TP
-.BR "--to-source  " "\fIipaddr\fP[-\fIipaddr\fP][:\fIport\fP-\fIport\fP]"
+\fB--to-source\fP \fIipaddr\fP[\fB-\fP\fIipaddr\fP][\fB:\fP\fIport\fP[\fB-\fP\fIport\fP]]
 which can specify a single new source IP address, an inclusive range
 of IP addresses, and optionally, a port range (which is only valid if
 the rule also specifies

diff --git a/extensions/libxt_connmark.man b/extensions/libxt_connmark.man
index 193a4ca922bc9d432a5195a59a5975b773100569..a50c53758681c1ad30446262b6dcbf786c215bdc 100644 (file)
--- a/extensions/libxt_connmark.man
+++ b/extensions/libxt_connmark.man
@@ -1,6 +1,6 @@
 This module matches the netfilter mark field associated with a connection
 (which can be set using the \fBCONNMARK\fR target below).
 .TP
-\fB--mark\fR \fIvalue\fR[\fB/\fR\fImask\fR]
+[\fB!\fP] \fB--mark\fR \fIvalue\fR[\fB/\fR\fImask\fR]
 Matches packets in connections with the given mark value (if a mask is
 specified, this is logically ANDed with the mark before the comparison).

diff --git a/extensions/libxt_helper.man b/extensions/libxt_helper.man
index c3221ad8832ee58072eec1868820e4fbde70b707..3df1d05c0d2a65266f4c1b95b89f11ab8ae5e7ca 100644 (file)
--- a/extensions/libxt_helper.man
+++ b/extensions/libxt_helper.man
@@ -1,6 +1,6 @@
 This module matches packets related to a specific conntrack-helper.
 .TP
-.BI "--helper " "string"
+[\fB!\fP] \fB--helper\fP \fIstring\fP
 Matches packets related to the specified conntrack-helper.
 .RS
 .PP

diff --git a/extensions/libxt_iprange.man b/extensions/libxt_iprange.man
index 5acb3b3750e2bfc7fcb9d9ce3248a2a38d8266bf..1941a3b57c334aadfc1cbe3c31f82a1dc54183e2 100644 (file)
--- a/extensions/libxt_iprange.man
+++ b/extensions/libxt_iprange.man
@@ -1,7 +1,7 @@
 This matches on a given arbitrary range of IP addresses.
 .TP
-[\fB!\fR] \fB--src-range\fR \fIfrom\fR-\fIto\fR
+[\fB!\fR] \fB--src-range\fR \fIfrom\fR[\fB-\fP\fIto\fR]
 Match source IP in the specified range.
 .TP
-[\fB!\fR] \fB--dst-range\fR \fIfrom\fR-\fIto\fR
+[\fB!\fR] \fB--dst-range\fR \fIfrom\fR[\fB-\fP\fIto\fR]
 Match destination IP in the specified range.

diff --git a/extensions/libxt_mark.man b/extensions/libxt_mark.man
index a2a13957ad75d2b0ddbd1c57ea79b78327258685..4b29cd06ba97e698954fe073893820c9299e7908 100644 (file)
--- a/extensions/libxt_mark.man
+++ b/extensions/libxt_mark.man
@@ -3,7 +3,7 @@ This module matches the netfilter mark field associated with a packet
 .B MARK
 target below).
 .TP
-.BR "--mark " "\fIvalue\fP[/\fImask\fP]"
+[\fB!\fP] \fB--mark\fP \fIvalue\fP[\fB/\fP\fImask\fP]
 Matches packets with the given unsigned mark value (if a \fImask\fP is
 specified, this is logically ANDed with the \fImask\fP before the
 comparison).

diff --git a/extensions/libxt_owner.man b/extensions/libxt_owner.man
index 344ce2ea4c8f94e267209b250a132c7be0dad0d7..0bc0c65438d8bde0df7d4a3d692ab4748130f91a 100644 (file)
--- a/extensions/libxt_owner.man
+++ b/extensions/libxt_owner.man
@@ -3,17 +3,17 @@ for locally generated packets. This match is only valid in the OUTPUT and
 POSTROUTING chains. Forwarded packets do not have any socket associated with
 them. Packets from kernel threads do have a socket, but usually no owner.
 .TP
-\fB--uid-owner\fR \fIusername\fR
+[\fB!\fP] \fB--uid-owner\fP \fIusername\fP
 .TP
-\fB--uid-owner\fR \fIuserid\fR[\fB-\fR\fIuserid\fR]
+[\fB!\fP] \fB--uid-owner\fP \fIuserid\fP[\fB-\fP\fIuserid\fP]
 Matches if the packet socket's file structure (if it has one) is owned by the
 given user. You may also specify a numerical UID, or an UID range.
 .TP
-\fB--gid-owner\fR \fIgroupname\fR
+[\fB!\fP] \fB--gid-owner\fP \fIgroupname\fP
 .TP
-\fB--gid-owner\fR \fIgroupid\fR[\fB-\fR\fIgroupid\fR]
+[\fB!\fP] \fB--gid-owner\fP \fIgroupid\fP[\fB-\fR\fIgroupid\fP]
 Matches if the packet socket's file structure is owned by the given group.
 You may also specify a numerical GID, or a GID range.
 .TP
-\fB--socket-exists\fR
+[\fB!\fP] \fB--socket-exists\fP
 Matches if the packet is associated with a socket.

diff --git a/extensions/libxt_tos.man b/extensions/libxt_tos.man
index 0420105e713bcf7a5c87094ac9778738867ae998..cd72e9543462fd848f0e0c8af138f22088659cbe 100644 (file)
--- a/extensions/libxt_tos.man
+++ b/extensions/libxt_tos.man
@@ -2,11 +2,11 @@ This module matches the 8-bit Type of Service field in the IPv4 header (i.e.
 including the "Precedence" bits) or the (also 8-bit) Priority field in the IPv6
 header.
 .TP
-\fB--tos\fR \fIvalue\fR[\fB/\fR\fImask\fR]
+[\fB!\fP] \fB--tos\fR \fIvalue\fR[\fB/\fR\fImask\fR]
 Matches packets with the given TOS mark value. If a mask is specified, it is
 logically ANDed with the TOS mark before the comparison.
 .TP
-\fB--tos\fR \fIsymbol\fR
+[\fB!\fP] \fB--tos\fR \fIsymbol\fR
 You can specify a symbolic name when using the tos match for IPv4. The list of
 recognized TOS names can be obtained by calling iptables with \fB-m tos -h\fR.
 Note that this implies a mask of 0x3F, i.e. all but the ECN bits.