Add --ipv4/-4 and --ipv6/-6 support to ip6?tables{,-restore}.

This enables one to have a single configuration file for both ipv4 and ipv6
firewall rules.

Example:
  iptables-restore config
  ip6tables-restore config

Where the file 'config' contains:
  *filter
  :INPUT ACCEPT [0:0]
  :FORWARD ACCEPT [0:0]
  :OUTPUT ACCEPT [0:0]
  :ssh - [0:0]

  -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  -A INPUT -m state --state INVALID -j DROP
  -A INPUT -i lo -j ACCEPT
  -A INPUT -4 -p icmp -j ACCEPT
  -A INPUT -6 -p icmpv6 -j ACCEPT
  -A INPUT -p tcp --dport 22 -m state --state NEW -j ssh
  -A ssh -j ACCEPT

  COMMIT

Signed-off-by: Maciej Zenczykowski <maze@google.com>

diff --git a/ip6tables.c b/ip6tables.c
index f9909f1313bf098b58fce59313362c1e15797ffb..967a5f80db8a79eb5a46e70e0ff8d3b6525f4d96 100644 (file)
--- a/ip6tables.c
+++ b/ip6tables.c
@@ -124,6 +124,8 @@ static struct option original_opts[] = {
        {.name = "modprobe",      .has_arg = 1, .val = 'M'},
        {.name = "set-counters",  .has_arg = 1, .val = 'c'},
        {.name = "goto",          .has_arg = 1, .val = 'g'},
+       {.name = "ipv4",          .has_arg = 0, .val = '4'},
+       {.name = "ipv6",          .has_arg = 0, .val = '6'},
        {NULL},
 };
 
@@ -248,6 +250,8 @@ exit_printhelp(const struct xtables_rule_match *matches)
 "                              Change chain name, (moving any references)\n"
 
 "Options:\n"
+"    --ipv4    -4              Error (line is ignored by ip6tables-restore)\n"
+"    --ipv6    -6              Nothing (line is ignored by iptables-restore)\n"
 "[!] --proto   -p proto        protocol: by number or name, eg. `tcp'\n"
 "[!] --source  -s address[/mask][,...]\n"
 "                              source specification\n"
@@ -1439,7 +1443,7 @@ int do_command6(int argc, char *argv[], char **table, struct ip6tc_handle **hand
 
        opts = xt_params->orig_opts;
        while ((cs.c = getopt_long(argc, argv,
-          "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:bvnt:m:xc:g:",
+          "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:bvnt:m:xc:g:46",
                                           opts, NULL)) != -1) {
                switch (cs.c) {
                        /*
@@ -1756,6 +1760,17 @@ int do_command6(int argc, char *argv[], char **table, struct ip6tc_handle **hand
                        cs.fw6.counters.bcnt = cnt;
                        break;
 
+               case '4':
+                       /* This is not the IPv4 iptables */
+                       if (line != -1)
+                               return 1; /* success: line ignored */
+                       fprintf(stderr, "This is the IPv6 version of ip6tables.\n");
+                       exit_tryhelp(2);
+
+               case '6':
+                       /* This is indeed the IPv6 ip6tables */
+                       break;
+
                case 1: /* non option */
                        if (optarg[0] == '!' && optarg[1] == '\0') {
                                if (cs.invert)

diff --git a/iptables.c b/iptables.c
index 0441dce31ac360d16a790cf2958b6698deb5b00f..cc7525a1afa189560df6afbba5efb4c8b0adf936 100644 (file)
--- a/iptables.c
+++ b/iptables.c
@@ -123,6 +123,8 @@ static struct option original_opts[] = {
        {.name = "modprobe",      .has_arg = 1, .val = 'M'},
        {.name = "set-counters",  .has_arg = 1, .val = 'c'},
        {.name = "goto",          .has_arg = 1, .val = 'g'},
+       {.name = "ipv4",          .has_arg = 0, .val = '4'},
+       {.name = "ipv6",          .has_arg = 0, .val = '6'},
        {NULL},
 };
 
@@ -261,6 +263,8 @@ exit_printhelp(const struct xtables_rule_match *matches)
 "                              Change chain name, (moving any references)\n"
 
 "Options:\n"
+"    --ipv4    -4              Nothing (line is ignored by ip6tables-restore)\n"
+"    --ipv6    -6              Error (line is ignored by iptables-restore)\n"
 "[!] --proto   -p proto        protocol: by number or name, eg. `tcp'\n"
 "[!] --source  -s address[/mask][...]\n"
 "                              source specification\n"
@@ -1467,7 +1471,7 @@ int do_command4(int argc, char *argv[], char **table, struct iptc_handle **handl
 
        opts = xt_params->orig_opts;
        while ((cs.c = getopt_long(argc, argv,
-          "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvnt:m:xc:g:",
+          "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvnt:m:xc:g:46",
                                           opts, NULL)) != -1) {
                switch (cs.c) {
                        /*
@@ -1782,6 +1786,16 @@ int do_command4(int argc, char *argv[], char **table, struct iptc_handle **handl
                        cs.fw.counters.bcnt = cnt;
                        break;
 
+               case '4':
+                       /* This is indeed the IPv4 iptables */
+                       break;
+
+               case '6':
+                       /* This is not the IPv6 ip6tables */
+                       if (line != -1)
+                               return 1; /* success: line ignored */
+                       fprintf(stderr, "This is the IPv4 version of iptables.\n");
+                       exit_tryhelp(2);
 
                case 1: /* non option */
                        if (optarg[0] == '!' && optarg[1] == '\0') {