]> git.ipfire.org Git - thirdparty/iptables.git/log
thirdparty/iptables.git
16 years agoWarn about use of DROP in nat table
Jan Engelhardt [Wed, 13 Aug 2008 12:41:32 +0000 (14:41 +0200)] 
Warn about use of DROP in nat table

Consensus is that we should warn for now.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
16 years agophysdev: remove extra space in output
Jan Engelhardt [Wed, 13 Aug 2008 12:40:18 +0000 (14:40 +0200)] 
physdev: remove extra space in output

Just a cosmetic fix for `iptables -S` and `iptables-save` printing
two spaces between arguments in the physdev match.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
16 years agomanpages: correct erroneous markup
Jan Engelhardt [Tue, 12 Aug 2008 09:42:04 +0000 (11:42 +0200)] 
manpages: correct erroneous markup

Text paragraphs should use .PP, since .TP makes it a list item with
indented description.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
16 years agoPut xtables.c into its own library, libxtables.so
Jan Engelhardt [Mon, 4 Aug 2008 16:37:38 +0000 (18:37 +0200)] 
Put xtables.c into its own library, libxtables.so

iproute2's tc's m_ipt.c poses as a pseudo-iptables program to make
use of the info structure composition of iptables extensions.
Since tc would have to clone a lot of code, xtables.c is put into
its own shared library and should not be relied upon by any other
programs.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
16 years agolibxt_dscp: fix save of negated dscp match rules
Phil Oester [Mon, 4 Aug 2008 11:30:30 +0000 (13:30 +0200)] 
libxt_dscp: fix save of negated dscp match rules

As pointed out by Vyacheslav Garashchenko, iptables-save does not
save negated dscp matches properly.  Fix below.

This closes bugzilla #533.

Phil

Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
16 years agoiptables-save: fix hashlimit output
Phil Oester [Mon, 4 Aug 2008 11:28:07 +0000 (13:28 +0200)] 
iptables-save: fix hashlimit output

In bugzilla 550, Xeb notes that the --hashlimit-htable-gcinterval
argument is saved incorrectly.  Patch below corrects.

Patch-from: Xeb <xeb@mail.ru>
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
16 years agolibxt_recent: do not allow both --set and --rttl
Jan Engelhardt [Mon, 4 Aug 2008 10:52:27 +0000 (12:52 +0200)] 
libxt_recent: do not allow both --set and --rttl

Reported-by: Erich Schubert <erich@debian.org>
Reference: Debian bug #346034

"I was using the --rttl option in my --set line; this caused all
incoming ssh connections to be rejected; --rttl is only to be used
with --rcheck and --update."

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
16 years agoiptables-restore: fix segmentation fault with -tanything
Jan Engelhardt [Mon, 4 Aug 2008 10:51:01 +0000 (12:51 +0200)] 
iptables-restore: fix segmentation fault with -tanything

Reference: Debian bug #458042

iptables-restore must not pass a table into do_command. It checks for
"-t arg" and "--table arg", but not "-targ". (On a related note,
using -targ does not work as expected).

This should fail gracefully, but crashes:

iptables-restore <(echo -e '*filter\n-A INPUT -tx\nCOMMIT')

And this should use table "filter", or perhaps raise an error, but
instead sets the table to (literally) "-tfilter":

iptables -tfilter -A INPUT

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
16 years agosrc: drop libiptc from installation
Jan Engelhardt [Mon, 4 Aug 2008 10:48:34 +0000 (12:48 +0200)] 
src: drop libiptc from installation

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
16 years agosrc: remove dependency on libiptc headers
Jan Engelhardt [Mon, 4 Aug 2008 10:47:48 +0000 (12:47 +0200)] 
src: remove dependency on libiptc headers

xtables.h does not need really need libxtc.h, and we can drop it from
the install as it is internal-only.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
16 years agomanpages: name and markup fixes
Jan Engelhardt [Wed, 30 Jul 2008 10:49:47 +0000 (12:49 +0200)] 
manpages: name and markup fixes

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
16 years agoMerge branch 'master' of vishnu.netfilter.org:/data/git/iptables
Jan Engelhardt [Tue, 29 Jul 2008 17:04:34 +0000 (19:04 +0200)] 
Merge branch 'master' of vishnu.netfilter.org:/data/git/iptables

16 years agobuild: do not install ip{,6}tables.h
Jan Engelhardt [Tue, 29 Jul 2008 17:04:11 +0000 (19:04 +0200)] 
build: do not install ip{,6}tables.h

These files do not contain anything that 3rd party modules could
reasonably use.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
16 years agov1.4.2-rc1 v1.4.2-rc1
Patrick McHardy [Wed, 23 Jul 2008 13:03:28 +0000 (15:03 +0200)] 
v1.4.2-rc1

17 years agoxt_string: string extension case insensitive matching
Joonwoo Park [Mon, 7 Jul 2008 11:32:25 +0000 (13:32 +0200)] 
xt_string: string extension case insensitive matching

The string extension can search patterns case insensitively with
--icase option. A new revision 1 was added, in the meantime invert
of xt_string_info was moved into flags as a flag.

Signed-off-by: Joonwoo Park <joonwpark81@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agolibiptc: fix scalability performance issue during initial ruleset parsing
Jesper Dangaard Brouer [Thu, 3 Jul 2008 18:31:42 +0000 (20:31 +0200)] 
libiptc: fix scalability performance issue during initial ruleset parsing

 Finding jump chains is slow O(Chain*Rules).

The problem:
 is that the chain list is searched lineary for each rule with a jump
 target. The problem lies in the "second pass" (of function
 parse_table) where the userchain jump targets are found. For each
 rule "R" with a IPTCC_R_JUMP target, function
 iptcc_find_chain_by_offset() searches through the chains "C" in the
 chain list (worst-case hitting the last one).

The solution:
 in this patch is to speed up iptcc_find_chain_by_offset() by using
 binary search. Reducing complexity from O(C) to O(log C).

Implementation:
 Its possible to use the same bsearch algorithm and data structure
 (chain_index), as used for chain name searching.

How is that possible:
 One has to realize that the chains are both sorted by name and
 offsets, this is because the chains are already sorted in the ruleset
 from the kernel.

Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agolibiptc: minor bugfix
Jesper Dangaard Brouer [Thu, 3 Jul 2008 18:29:34 +0000 (20:29 +0200)] 
libiptc: minor bugfix

Minor bugfix, an extra check is needed if the tail element is a
builtin chain, as builtin chains are not sorted.

Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agomanpages: various updates
Jan Engelhardt [Thu, 3 Jul 2008 18:27:50 +0000 (20:27 +0200)] 
manpages: various updates

- synchronized iptables--ip6tbales manpages
- -S option, list of chain names, protocol names
- markup updates

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agobuild: various changes to release.sh
Jan Engelhardt [Thu, 3 Jul 2008 18:26:56 +0000 (20:26 +0200)] 
build: various changes to release.sh

- do not remove autogen.sh
- remove COMMIT_NOTES - it does not apply to git anymore
- create SHA1 sums for tarballs and patches

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agobuild: quote variables in release.sh
Jan Engelhardt [Thu, 3 Jul 2008 18:25:42 +0000 (20:25 +0200)] 
build: quote variables in release.sh

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agolibxt_TOS: make sure --set-tos value/mask is recognized
Jan Engelhardt [Mon, 30 Jun 2008 12:57:08 +0000 (14:57 +0200)] 
libxt_TOS: make sure --set-tos value/mask is recognized

Only when a 'stop' pointer is passed, the string may consist of more
than just a number.

Reported-by: Anonymous
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agobuild: ip6.h is not required
Jan Engelhardt [Wed, 25 Jun 2008 10:18:23 +0000 (12:18 +0200)] 
build: ip6.h is not required

Remove the check from configure.ac that errors out when ip6.h is not
found. The code does not actually depend on any structures from it.

Reported-by: anonymous
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agobuild: change equailty test for old bash
Jan Engelhardt [Mon, 23 Jun 2008 09:37:08 +0000 (11:37 +0200)] 
build: change equailty test for old bash

Michael used GNU bash, version 1.14.7(1), which apparently does not
seem to know about the double ("==") variant of equality tests.

Reported-by: Michael Teicher <mteicher@gmail.com>
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agoip6tables: add --goto support
Thomas Jacob [Mon, 23 Jun 2008 09:35:29 +0000 (11:35 +0200)] 
ip6tables: add --goto support

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agorelease.sh: fix changelog filename
Patrick McHardy [Thu, 19 Jun 2008 11:45:36 +0000 (13:45 +0200)] 
release.sh: fix changelog filename

Add missing .txt extension.

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agoAdd simple release script
Patrick McHardy [Tue, 17 Jun 2008 15:22:32 +0000 (17:22 +0200)] 
Add simple release script

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agov1.4.1.1 v1.4.1.1
Patrick McHardy [Mon, 16 Jun 2008 13:12:40 +0000 (15:12 +0200)] 
v1.4.1.1

17 years agoiprange: kernel flags were not set
Jan Engelhardt [Fri, 13 Jun 2008 15:59:29 +0000 (17:59 +0200)] 
iprange: kernel flags were not set

The --src-range and --dst-range parameters did not set the IPRANGE_*
flags in struct xt_iprange_mtinfo.

Reported-by: Maxim Britov <maxim.britov@gmail.com>
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agoiptables: fix printing of line numbers with --line-numbers arg
Henrik Nordstrom [Fri, 13 Jun 2008 15:57:35 +0000 (17:57 +0200)] 
iptables: fix printing of line numbers with --line-numbers arg

Commit bb34082d ("iptables --list chain rulenum") broke the line
numbering, starting with printing an offset of 2.

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agobuild: fix `make install` when --disable-shared is used
Jan Engelhardt [Thu, 12 Jun 2008 10:10:47 +0000 (12:10 +0200)] 
build: fix `make install` when --disable-shared is used

When --disable-shared is used, there are no .so files to install, and
the argument order for install would get messed up.

Reported-by: Michael Teicher <mteicher@gmail.com>
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agoip6tables: fix printing of ipv6 network masks
Jan Engelhardt [Tue, 10 Jun 2008 13:17:53 +0000 (15:17 +0200)] 
ip6tables: fix printing of ipv6 network masks

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agov1.4.1 v1.4.1
Patrick McHardy [Tue, 10 Jun 2008 06:12:56 +0000 (08:12 +0200)] 
v1.4.1

17 years agomanpage updates
Jan Engelhardt [Sun, 8 Jun 2008 17:11:51 +0000 (19:11 +0200)] 
manpage updates

A number of options support negation, but the manpage did not reflect
this ("[!]" was absent). Also fix a few [] (optional arguments) to {}
(required arguments) in the option-BNF.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agosparse warning fixes: integer used as pointer
Patrick McHardy [Sat, 7 Jun 2008 13:15:29 +0000 (15:15 +0200)] 
sparse warning fixes: integer used as pointer

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agoiptables-xml: sparse fixes
Patrick McHardy [Sat, 7 Jun 2008 13:07:18 +0000 (15:07 +0200)] 
iptables-xml: sparse fixes

- Using plain integer as NULL pointer
- Undeclared non-static variables

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agolibiptc: move variable definitions to head of function
Patrick McHardy [Sat, 7 Jun 2008 13:04:34 +0000 (15:04 +0200)] 
libiptc: move variable definitions to head of function

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agolibxt_owner: add spaces to output
Jan Engelhardt [Fri, 6 Jun 2008 12:20:05 +0000 (14:20 +0200)] 
libxt_owner: add spaces to output

It could happen that --<arg><value> was printed on iptables-save with
owner rules (owner_mt_save() function) without the obligatory space
inbetween. Also transfer printing of the space character into
owner_mt_print_item().

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agoaddrtype match: added revision 1
Laszlo Attila Toth [Fri, 6 Jun 2008 12:17:53 +0000 (14:17 +0200)] 
addrtype match: added revision 1

In revision 1 address type checking can be limited to either the
incoming or outgoing interface depending on the current chain. In
the FORWARD chain only one of them is allowed at the same time.

Signed-off-by: Laszlo Attila Toth <panther@balabit.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agoFix iptables-save output of libxt_owner match
Lutz Jaenicke [Fri, 6 Jun 2008 12:01:05 +0000 (14:01 +0200)] 
Fix iptables-save output of libxt_owner match

The _save functions need to use the same syntax that is used for parsing
the input instead of "user readable" output.

17 years agoBump version v1.4.1-rc3
Patrick McHardy [Fri, 6 Jun 2008 11:17:13 +0000 (13:17 +0200)] 
Bump version

17 years agobuild: check for missing feature files
Jan Engelhardt [Thu, 5 Jun 2008 17:54:48 +0000 (19:54 +0200)] 
build: check for missing feature files

linux/dccp.h is unlikely to be installed before 2.6.18 (which was
when headers_install was introduced), and does not exist at all
before 2.6.14. Add a compile-time check to skip compilation of
libxt_dccp in case this was detected.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agoUpdate .gitignore
Jan Engelhardt [Thu, 5 Jun 2008 15:10:59 +0000 (17:10 +0200)] 
Update .gitignore

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agoResync header files with kernel
Patrick McHardy [Thu, 5 Jun 2008 14:18:41 +0000 (16:18 +0200)] 
Resync header files with kernel

Resync headers and add types.h file for endian annotated types, which
are not available with old headers.

17 years agoUse s6_addr32 to access bits in int6_addr instead of incompatible name
Yasuyuki Kozakai [Wed, 4 Jun 2008 13:16:03 +0000 (15:16 +0200)] 
Use s6_addr32 to access bits in int6_addr instead of incompatible name

Spotted by Khem Raj <raj.khem@gmail.com>

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agoAdd xtables version defines.
Thomas Jarosch [Tue, 3 Jun 2008 13:02:18 +0000 (15:02 +0200)] 
Add xtables version defines.

Attached is a patch to add the new defines. The macro XTABLES_VERSION
is already in use, so I named it XTABLES_VERSION_CHECK. I've also tested
that an empty XTABLES_VERSION_EXTRA in configure.ac works.

Now we can write code like this:

    #warning You are obselete and will be assimilated.

Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agomanpages: consistent syntax
Patrick McHardy [Mon, 2 Jun 2008 10:48:48 +0000 (12:48 +0200)] 
manpages: consistent syntax

In the manpages, bold is used to denote characters the user has to
enter verbatim, italic denotes placeholders and non-highlighted
pieces are used as a structure: "[]" specifying an optional part,
"{}" a mandatory part, with "|" used for alternations. The "!" for
negation is better supported before the option than after it, too.
The patch makes a few files consistent with this style already used
in manpages.

17 years agoiptables 1.4.1-rc2 v1.4.1-rc2
Patrick McHardy [Mon, 26 May 2008 12:52:50 +0000 (14:52 +0200)] 
iptables 1.4.1-rc2

17 years agoREDIRECT: Allow symbolic port in REDIRECT --to-port
Kristof Provost [Sun, 25 May 2008 22:55:34 +0000 (00:55 +0200)] 
REDIRECT: Allow symbolic port in REDIRECT --to-port

Fixes Bugzilla 482.

Signed-off-by: Kristof Provost <kristof@sigsegv.be>
17 years agoMerge branch 'master' of vishnu.netfilter.org:/data/git/iptables
Patrick McHardy [Tue, 20 May 2008 15:18:38 +0000 (17:18 +0200)] 
Merge branch 'master' of vishnu.netfilter.org:/data/git/iptables

17 years agoDon't assume /bin/sh is bash
Thomas Jacob [Tue, 20 May 2008 15:17:02 +0000 (17:17 +0200)] 
Don't assume /bin/sh is bash

The new iptables git version assumes /bin/sh is always GNU bash,
that's not the case (Ubuntu 8.04 uses dash), see attachment
for a fix.

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agoBump version to 1.4.1-rc1 v1.4.1-rc1
Patrick McHardy [Mon, 19 May 2008 10:55:05 +0000 (12:55 +0200)] 
Bump version to 1.4.1-rc1

Actually its not a bump but a decrease, the autoconf patches
apparently sneaked it a version bump to 1.4.1 already.

17 years agofix ip6tables dest address printing
Jamie Strandboge [Fri, 16 May 2008 12:52:12 +0000 (14:52 +0200)] 
fix ip6tables dest address printing

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464244

ip6tables improperly displays the destination address when the address
is longer than 18 characters.  Here is example output:
...
DROP       tcp      2001:db8::/32        2001:db8:3:4:5:6:7:8/128tcp spt:25
...

Proper formatting should have a space between '2001:db8:3:4:5:6:7:8/128'
and 'tcp'.

Signed-off-by: Jamie Strandboge <jamie@ubuntu.com>
Signed-off-by: Lawrence J. Lane <ljlane@debian.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years agoMake --set-counters (-c) accept comma separated counters
Henrik Nordstrom [Tue, 13 May 2008 11:10:38 +0000 (13:10 +0200)] 
Make --set-counters (-c) accept comma separated counters

Here is the --set-counters syntax patch requested earlier today making
--set-counters (-c) accept comma separated counts.

-c packets,bytes

I have not updated the manpage to reflect this alternate syntax for the
--set-counters (-c) option.

Henrik Nordstrom <henrik@henriknordstrom.net>

17 years agoiptables --list chain rulenum
Henrik Nordstrom [Tue, 13 May 2008 11:09:23 +0000 (13:09 +0200)] 
iptables --list chain rulenum

Excent --list (and --list-rules) to allow selection of a single rule
number

iptables --list INPUT 4
iptables --list-rules INPUT 4

list rule number 4 in INPUT.

Henrik Nordstrom <henrik@henriknordstrom.net>

17 years agoiptables --list-rules command
Henrik Nordstrom [Tue, 13 May 2008 11:08:26 +0000 (13:08 +0200)] 
iptables --list-rules command

Adds iptables --list-rules (-S) command, acting as a combination of
iptables --list and iptables-save.

The primary motivation behind this patch is to get iptables-save like
output capabilities in iptables-restore, allowing "iptables-restore -n"
to be used as a consistent API to iptables for all kind of operations,
not only blind updates..

As a bonus iptables also gets the capability of printing the rules
as-is.

This completely replaces the earlier patch which added the --rules
option.

Henrik Nordstrom <henrik@henriknordstrom.net>

17 years agoAdd support for --set-counters to iptables -P
Henrik Nordstrom [Mon, 12 May 2008 18:53:16 +0000 (20:53 +0200)] 
Add support for --set-counters to iptables -P

Adds support for setting the policy counters

iptables -P INPUT -J DROP -c 10 20

Henrik Nordstrom <henrik@henriknordstrom.net>

17 years agoMake iptables-restore usable over a pipe
Henrik Nordstrom [Mon, 12 May 2008 18:51:45 +0000 (20:51 +0200)] 
Make iptables-restore usable over a pipe

The attached patch flushes stdout between commands to make output
operations (-L etc) in iptables-restore usable over a pipe. stdio by
defaut buffers output if not connected to a terminal.

Henrik Nordstrom <henrik@henriknordstrom.net>

17 years agoiptables out-of-tree build directory
Jan Engelhardt [Mon, 12 May 2008 08:28:34 +0000 (10:28 +0200)] 
iptables out-of-tree build directory

Reported by: Henrik Nordstrom

When xtables.h is not already found in /usr/include, compilation
would fail when ${top_srcdir} != ${top_builddir}.

17 years ago[PATCH 1] Makefile.am: use PACKAGE_TARNAME
Jan Engelhardt [Thu, 17 Apr 2008 08:32:13 +0000 (10:32 +0200)] 
[PATCH 1] Makefile.am: use PACKAGE_TARNAME

17 years agoiptables-save:remove unnecessary code.
Shan Wei [Mon, 21 Apr 2008 10:23:38 +0000 (10:23 +0000)] 
iptables-save:remove unnecessary code.

The following code is never be used. It should be removed.

Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
17 years agoProperly initialize revision for ip6tables targets
Patrick McHardy [Tue, 15 Apr 2008 13:51:19 +0000 (15:51 +0200)] 
Properly initialize revision for ip6tables targets

Also resync error handling with iptables.

17 years agoRemove old functions, constants
Jan Engelhardt [Tue, 15 Apr 2008 09:48:25 +0000 (11:48 +0200)] 
Remove old functions, constants

17 years ago[PATCH 11] configure.ac: remove already-defined variables
Jan Engelhardt [Tue, 15 Apr 2008 11:17:47 +0000 (13:17 +0200)] 
[PATCH 11] configure.ac: remove already-defined variables

17 years agoDynamically create xtables.h.in with version
Jan Engelhardt [Tue, 15 Apr 2008 09:15:16 +0000 (11:15 +0200)] 
Dynamically create xtables.h.in with version

17 years agoconfigure.ac: AC_SUBST must be separate
Jan Engelhardt [Tue, 15 Apr 2008 07:13:17 +0000 (09:13 +0200)] 
configure.ac: AC_SUBST must be separate

17 years agoUpdate documentation about building the package
Jan Engelhardt [Mon, 11 Feb 2008 13:11:14 +0000 (14:11 +0100)] 
Update documentation about building the package

17 years agoResolve libipt_set warnings
Jan Engelhardt [Mon, 14 Apr 2008 14:03:52 +0000 (16:03 +0200)] 
Resolve libipt_set warnings

17 years agoRemove support for compilation of conditional extensions
Jan Engelhardt [Wed, 13 Feb 2008 20:35:59 +0000 (21:35 +0100)] 
Remove support for compilation of conditional extensions

17 years agoWrap dlopen code into NO_SHARED_LIBS
Jan Engelhardt [Mon, 14 Apr 2008 16:37:57 +0000 (18:37 +0200)] 
Wrap dlopen code into NO_SHARED_LIBS

17 years agoResolve warnings on 64-bit compile
Jan Engelhardt [Mon, 14 Apr 2008 13:58:17 +0000 (15:58 +0200)] 
Resolve warnings on 64-bit compile

17 years agoCombine ipt and ip6t manpages
Jan Engelhardt [Thu, 14 Feb 2008 02:02:55 +0000 (03:02 +0100)] 
Combine ipt and ip6t manpages

Combine ipt and ip6t manpages

17 years agoImplement AF_UNSPEC as a wildcard for extensions
Jan Engelhardt [Thu, 14 Feb 2008 03:23:04 +0000 (04:23 +0100)] 
Implement AF_UNSPEC as a wildcard for extensions

17 years agoRATEEST: add manpage
Jan Engelhardt [Thu, 27 Mar 2008 04:48:14 +0000 (05:48 +0100)] 
RATEEST: add manpage

17 years agoiptables: use C99 lists for struct options
Gáspár Lajos [Thu, 27 Mar 2008 07:20:39 +0000 (08:20 +0100)] 
iptables: use C99 lists for struct options

17 years agoInstall libiptc header files because xtables.h depends on it
Jan Engelhardt [Mon, 11 Feb 2008 14:48:51 +0000 (15:48 +0100)] 
Install libiptc header files because xtables.h depends on it

17 years agoAdd all necessary header files - compilation fix for various cases
Jan Engelhardt [Mon, 11 Feb 2008 00:23:01 +0000 (01:23 +0100)] 
Add all necessary header files - compilation fix for various cases

Allow iptables to compile without a kernel source tree. This
implies fixing build for older kernels, such as 2.6.17 which
lack xt_SECMARK.h.

17 years agoImport iptables-apply
Martin F. Krafft [Sat, 12 Apr 2008 05:48:44 +0000 (07:48 +0200)] 
Import iptables-apply

17 years agoconfigure: split --enable-libipq from --enable-devel
Jan Engelhardt [Mon, 11 Feb 2008 14:01:03 +0000 (15:01 +0100)] 
configure: split --enable-libipq from --enable-devel

17 years agomanpages: update to reflect fine-grained control
Jan Engelhardt [Mon, 10 Mar 2008 16:55:53 +0000 (17:55 +0100)] 
manpages: update to reflect fine-grained control

17 years agomanpages: grammar and spelling
Jan Engelhardt [Mon, 10 Mar 2008 16:48:59 +0000 (17:48 +0100)] 
manpages: grammar and spelling

17 years agomanpages: fix broken markup (missing close tags)
Jan Engelhardt [Mon, 10 Mar 2008 16:45:42 +0000 (17:45 +0100)] 
manpages: fix broken markup (missing close tags)

17 years agoCombine IP{,6}T_LIB_DIR into XTABLES_LIBDIR
Jan Engelhardt [Mon, 11 Feb 2008 00:02:00 +0000 (01:02 +0100)] 
Combine IP{,6}T_LIB_DIR into XTABLES_LIBDIR

17 years agoAdd support for xt_hashlimit match revision 1
Jan Engelhardt [Sun, 10 Feb 2008 23:55:33 +0000 (00:55 +0100)] 
Add support for xt_hashlimit match revision 1

17 years agoxtables.h: move non-exported parts to internal.h
Jan Engelhardt [Thu, 10 Apr 2008 07:18:36 +0000 (09:18 +0200)] 
xtables.h: move non-exported parts to internal.h

17 years agoFix all remaining warnings (missing declarations, missing prototypes)
Jan Engelhardt [Sun, 10 Feb 2008 23:54:00 +0000 (00:54 +0100)] 
Fix all remaining warnings (missing declarations, missing prototypes)

17 years agoUpdate the libxt_owner manpage with the UID/GID-range feature
Jan Engelhardt [Sun, 10 Feb 2008 23:57:18 +0000 (00:57 +0100)] 
Update the libxt_owner manpage with the UID/GID-range feature

17 years agoFix -Wshadow warnings and clean up xt_sctp.h
Jan Engelhardt [Sun, 10 Feb 2008 23:33:30 +0000 (00:33 +0100)] 
Fix -Wshadow warnings and clean up xt_sctp.h

Note: xt_sctp.h is still not merged upstream in the kernel as of
this commit. But a refactoring was really needed.

17 years agoDrop -W from CFLAGS and some tiny code cleanups
Jan Engelhardt [Mon, 3 Mar 2008 11:30:41 +0000 (12:30 +0100)] 
Drop -W from CFLAGS and some tiny code cleanups

- change "unsigned" to explicit "unsigned int"
- remove some casts

17 years agoMakefile: add a "tarball" target
Jan Engelhardt [Mon, 3 Mar 2008 12:04:07 +0000 (13:04 +0100)] 
Makefile: add a "tarball" target

17 years agoCorrect the family member value of libxt_mark revision 1
Jan Engelhardt [Thu, 14 Feb 2008 01:10:34 +0000 (02:10 +0100)] 
Correct the family member value of libxt_mark revision 1

libxt_mark rev1 used AF_INET6 in the class structure where it should
have used AF_INET.

17 years agoFix compilation of iptables-static build
Jan Engelhardt [Sun, 10 Feb 2008 23:29:36 +0000 (00:29 +0100)] 
Fix compilation of iptables-static build

Adjust the _INIT macro and thus fix the build/linking procedure of
the monolithic do-it-all binary (iptables-static).

Also fix the Makefile since unfortunately, lib%.o does not seem to
have a higher precedence than %.o

17 years agoRetry ruleset dump when kernel returns EAGAIN.
Patrick McHardy [Wed, 2 Apr 2008 12:01:53 +0000 (14:01 +0200)] 
Retry ruleset dump when kernel returns EAGAIN.

Bugzilla #104

17 years ago[IPTABLES]: libxt_iprange: Fix IP validation logic
James King [Tue, 1 Apr 2008 19:17:36 +0000 (21:17 +0200)] 
[IPTABLES]: libxt_iprange: Fix IP validation logic

IP address validation logic was inverted, causing valid addresses to
be rejected.

Signed-off-by: James King <t.james.king@gmail.com>
17 years agoremoves useless white spaces from iptables-xml manpages.
Filippo Zangheri [Thu, 6 Mar 2008 01:19:26 +0000 (02:19 +0100)] 
removes useless white spaces from iptables-xml manpages.
Signed-off-by: Filippo Zangheri <filippo.zangheri@yahoo.it>
17 years agobump iptables version to prepare 1.4.1 release
Pablo Neira Ayuso [Sun, 2 Mar 2008 12:40:26 +0000 (13:40 +0100)] 
bump iptables version to prepare 1.4.1 release

17 years agoFix define value of SCTP chunk type.
Naohiro Ooiwa [Fri, 29 Feb 2008 12:45:27 +0000 (12:45 +0000)] 
Fix define value of SCTP chunk type.

There are wrong chunk_type values in sctp table.
The chunk_type of ASCONF and ASCNF_ACK must be 193 and 128, respectively.

Naohiro Ooiwa <nooiwa@miraclelinux.com>

17 years agoRemove compiler.h inclusions.
Patrick McHardy [Fri, 22 Feb 2008 15:00:57 +0000 (15:00 +0000)] 
Remove compiler.h inclusions.

17 years agoAdd netfilter.h
Patrick McHardy [Tue, 29 Jan 2008 14:34:27 +0000 (14:34 +0000)] 
Add netfilter.h

17 years agofix gcc warnings
Max Kellermann [Tue, 29 Jan 2008 13:48:05 +0000 (13:48 +0000)] 
fix gcc warnings

Max Kellermann <max@duempel.org>

17 years agoallow empty strings in argument parser
Max Kellermann [Tue, 29 Jan 2008 13:46:01 +0000 (13:46 +0000)] 
allow empty strings in argument parser

Max Kellermann <max@duempel.org>