Jan Engelhardt [Tue, 27 Jan 2009 19:56:23 +0000 (20:56 +0100)]
libxtables: prefix/order - program_name
Split XTABLES_VERSION into xtables and iptables, and encode the
xtables soversion into the extensions instead. This makes it possible
to upgrade iptables without having to recompile 3rd-party extensions
(if the libxtables version matches, of course).
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Daniel Drake [Mon, 19 Jan 2009 14:36:41 +0000 (15:36 +0100)]
libxt_owner: add more spaces to output
Commit bb9284d1 ("libxt_owner: add spaces to output") moved the printing
of spaces away from the owner_mt_print() function family, but forgot to
add spaces in all of the print_item() functions that are called.
This is likely to be at least the partial cause of
https://bugs.gentoo.org/show_bug.cgi?id=254435
Signed-off-by: Daniel Drake <dsd@gentoo.org>
Approves-of-this-patch: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
Jan Engelhardt [Thu, 20 Nov 2008 09:15:35 +0000 (10:15 +0100)]
src: remove inclusion of iptables.h
iptables.h and ip6tables.h only include declarations internal to
iptables (specifically iptables.c and ip6tables.c), as most of the
public API has been moved to xtables.h a few months ago.
Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
This does not make any better, but at least refer to
dmesg which is the common source of information to diagnose
kernel-side problems. This is helpful for newbie users.
# iptables -I INPUT -j CLUSTERIP
iptables: Invalid argument. Run `dmesg' for more information.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Jan Engelhardt [Mon, 10 Nov 2008 15:59:27 +0000 (16:59 +0100)]
libiptc: remove typedef indirection
Don't you hate it when iptc_handle_t *x actually is a double-indirection
struct iptc_handle **? This also shows the broken constness model, since
"const iptc_handle_t x" = "iptc_handle_t const x" =
"struct iptc_handle *const x", which is like no const at all.
Lots of things to do then.
Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
Thomas Jarosch [Thu, 23 Oct 2008 13:41:27 +0000 (15:41 +0200)]
Fix compile warnings using gcc 4.3.2
libxt_dccp.c: In function 'port_to_service':
libxt_dccp.c:196: warning: implicit declaration of function 'htons'
libxt_sctp.c: In function 'port_to_service':
libxt_sctp.c:321: warning: implicit declaration of function 'htons'
libxt_tcp.c: In function 'port_to_service':
libxt_tcp.c:220: warning: implicit declaration of function 'htons'
libxt_udp.c: In function 'port_to_service':
libxt_udp.c:104: warning: implicit declaration of function 'htons'
Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
Thomas Jarosch [Thu, 23 Oct 2008 13:40:52 +0000 (15:40 +0200)]
Fix compile error in libxt_iprange.c using gcc 4.3.2
In file included from libxt_iprange.c:9:
../include/linux/netfilter.h:43: error: field 'in' has incomplete type
../include/linux/netfilter.h:44: error: field 'in6' has incomplete type
libxt_iprange.c: In function 'parse_iprange':
libxt_iprange.c:46: error: dereferencing pointer to incomplete type
libxt_iprange.c:53: error: dereferencing pointer to incomplete type
libxt_iprange.c: In function 'iprange_mt4_parse':
libxt_iprange.c:117: error: dereferencing pointer to incomplete type
libxt_iprange.c:121: error: dereferencing pointer to incomplete type
libxt_iprange.c:136: error: dereferencing pointer to incomplete type
libxt_iprange.c:140: error: dereferencing pointer to incomplete type
libxt_iprange.c: In function 'iprange_mt6_parse':
libxt_iprange.c:167: error: dereferencing pointer to incomplete type
libxt_iprange.c:171: error: dereferencing pointer to incomplete type
libxt_iprange.c:186: error: dereferencing pointer to incomplete type
libxt_iprange.c:190: error: dereferencing pointer to incomplete type
Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Jirí Moravec [Wed, 22 Oct 2008 06:57:38 +0000 (08:57 +0200)]
libxt_TOS: fix compilation error
Fix compilation error caused by double definition of IPPROTO_SCTP:
In file included from /usr/include/netinet/ip.h:25,
from /usr/include/linux/ip.h:19,
from tos_values.c:4,
from libxt_TOS.c:15:
/usr/include/netinet/in.h:84: error: expected identifier before numeric constant
make[2]: *** [libxt_TOS.oo] Error 1
When a neg mark is saved via iptables-save it is saved as !--mark,
but this is not recognized by iptables-restore, just adding a
space to the saved file to make it look like "! --mark" makes
iptables-restore accept the file.
Signed-off-by: Pablo Sebastian Greco <pablo@fliagreco.com.ar> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Jan Engelhardt [Mon, 8 Sep 2008 13:42:06 +0000 (15:42 +0200)]
build: run ldconfig on `make install`
Reporeted-by: Brent Clark <brentgclarklist@gmail.com> Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
Phil Oester [Mon, 1 Sep 2008 13:07:26 +0000 (15:07 +0200)]
src: Missing limits.h includes
Latest git doesn't compile for me on Fedora 9 due to various *MAX constants
being undefined. Below adds the include in 3 files which need it (although
I can't see why this isn't required in 1.4.1.1).
Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
Jan Engelhardt [Mon, 4 Aug 2008 16:37:38 +0000 (18:37 +0200)]
Put xtables.c into its own library, libxtables.so
iproute2's tc's m_ipt.c poses as a pseudo-iptables program to make
use of the info structure composition of iptables extensions.
Since tc would have to clone a lot of code, xtables.c is put into
its own shared library and should not be relied upon by any other
programs.
Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
Jan Engelhardt [Mon, 4 Aug 2008 10:52:27 +0000 (12:52 +0200)]
libxt_recent: do not allow both --set and --rttl
Reported-by: Erich Schubert <erich@debian.org>
Reference: Debian bug #346034
"I was using the --rttl option in my --set line; this caused all
incoming ssh connections to be rejected; --rttl is only to be used
with --rcheck and --update."
Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
Jan Engelhardt [Mon, 4 Aug 2008 10:51:01 +0000 (12:51 +0200)]
iptables-restore: fix segmentation fault with -tanything
Reference: Debian bug #458042
iptables-restore must not pass a table into do_command. It checks for
"-t arg" and "--table arg", but not "-targ". (On a related note,
using -targ does not work as expected).
Joonwoo Park [Mon, 7 Jul 2008 11:32:25 +0000 (13:32 +0200)]
xt_string: string extension case insensitive matching
The string extension can search patterns case insensitively with
--icase option. A new revision 1 was added, in the meantime invert
of xt_string_info was moved into flags as a flag.
Signed-off-by: Joonwoo Park <joonwpark81@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
libiptc: fix scalability performance issue during initial ruleset parsing
Finding jump chains is slow O(Chain*Rules).
The problem:
is that the chain list is searched lineary for each rule with a jump
target. The problem lies in the "second pass" (of function
parse_table) where the userchain jump targets are found. For each
rule "R" with a IPTCC_R_JUMP target, function
iptcc_find_chain_by_offset() searches through the chains "C" in the
chain list (worst-case hitting the last one).
The solution:
in this patch is to speed up iptcc_find_chain_by_offset() by using
binary search. Reducing complexity from O(C) to O(log C).
Implementation:
Its possible to use the same bsearch algorithm and data structure
(chain_index), as used for chain name searching.
How is that possible:
One has to realize that the chains are both sorted by name and
offsets, this is because the chains are already sorted in the ruleset
from the kernel.
Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk> Signed-off-by: Patrick McHardy <kaber@trash.net>
projects / thirdparty / iptables.git / log
