Skip to content

GitLab

Commit 9caffe92 authored by Arturo Borrero Gonzalez's avatar Arturo Borrero Gonzalez
Browse files

New upstream version 1.8.6

parent eb1d7c5f
Hide whitespace changes
Inline Side-by-side
Makefile.in
View file @ 9caffe92
......@@ -316,6 +316,7 @@ SET_MAKE = @SET_MAKE@
SHELL = @SHELL@
STRIP = @STRIP@
VERSION = @VERSION@
XT_LOCK_NAME = @XT_LOCK_NAME@
abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
abs_top_builddir = @abs_top_builddir@
......
configure
View file @ 9caffe92
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.69 for iptables 1.8.5.
# Generated by GNU Autoconf 2.69 for iptables 1.8.6.
#
#
# Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
......@@ -587,8 +587,8 @@ MAKEFLAGS=
# Identity of this package.
PACKAGE_NAME='iptables'
PACKAGE_TARNAME='iptables'
PACKAGE_VERSION='1.8.5'
PACKAGE_STRING='iptables 1.8.5'
PACKAGE_VERSION='1.8.6'
PACKAGE_STRING='iptables 1.8.6'
PACKAGE_BUGREPORT=''
PACKAGE_URL=''
......@@ -632,6 +632,7 @@ ac_subst_vars='am__EXEEXT_FALSE
am__EXEEXT_TRUE
LTLIBOBJS
LIBOBJS
XT_LOCK_NAME
libxtables_vmajor
libxtables_vage
libxtables_vcurrent
......@@ -1405,7 +1406,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
\`configure' configures iptables 1.8.5 to adapt to many kinds of systems.
\`configure' configures iptables 1.8.6 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
......@@ -1476,7 +1477,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
short | recursive ) echo "Configuration of iptables 1.8.5:";;
short | recursive ) echo "Configuration of iptables 1.8.6:";;
esac
cat <<\_ACEOF
......@@ -1627,7 +1628,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
iptables configure 1.8.5
iptables configure 1.8.6
generated by GNU Autoconf 2.69
Copyright (C) 2012 Free Software Foundation, Inc.
......@@ -2175,7 +2176,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by iptables $as_me 1.8.5, which was
It was created by iptables $as_me 1.8.6, which was
generated by GNU Autoconf 2.69. Invocation command line was
$ $0 $@
......@@ -3046,7 +3047,7 @@ fi
# Define the identity of the package.
PACKAGE='iptables'
VERSION='1.8.5'
VERSION='1.8.6'
cat >>confdefs.h <<_ACEOF
......@@ -13284,6 +13285,8 @@ cat >>confdefs.h <<_ACEOF
#define XT_LOCK_NAME "${xt_lock_name}"
_ACEOF
XT_LOCK_NAME="${xt_lock_name}"
ac_config_files="$ac_config_files Makefile extensions/GNUmakefile include/Makefile iptables/Makefile iptables/xtables.pc iptables/iptables.8 iptables/iptables-extensions.8.tmpl iptables/iptables-save.8 iptables/iptables-restore.8 iptables/iptables-apply.8 iptables/iptables-xml.1 libipq/Makefile libipq/libipq.pc libiptc/Makefile libiptc/libiptc.pc libiptc/libip4tc.pc libiptc/libip6tc.pc libxtables/Makefile utils/Makefile include/xtables-version.h iptables/xtables-monitor.8 utils/nfnl_osf.8 utils/nfbpf_compile.8"
......@@ -13877,7 +13880,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
This file was extended by iptables $as_me 1.8.5, which was
This file was extended by iptables $as_me 1.8.6, which was
generated by GNU Autoconf 2.69. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
......@@ -13943,7 +13946,7 @@ _ACEOF
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
ac_cs_version="\\
iptables config.status 1.8.5
iptables config.status 1.8.6
configured by $0, generated by GNU Autoconf 2.69,
with options \\"\$ac_cs_config\\"
......
configure.ac
View file @ 9caffe92
AC_INIT([iptables], [1.8.5])
AC_INIT([iptables], [1.8.6])
# See libtool.info "Libtool's versioning system"
libxtables_vcurrent=15
......@@ -219,6 +219,7 @@ AC_SUBST([libxtables_vmajor])
AC_DEFINE_UNQUOTED([XT_LOCK_NAME], "${xt_lock_name}",
[Location of the iptables lock file])
AC_SUBST([XT_LOCK_NAME], "${xt_lock_name}")
AC_CONFIG_FILES([Makefile extensions/GNUmakefile include/Makefile
iptables/Makefile iptables/xtables.pc
......
extensions/GNUmakefile.in
View file @ 9caffe92
......@@ -79,7 +79,7 @@ targets_install :=
.SECONDARY:
.PHONY: all install clean distclean FORCE
.PHONY: all install uninstall clean distclean FORCE
all: ${targets}
......@@ -92,6 +92,19 @@ install: ${targets_install} ${symlinks_install}
cp -P ${symlinks_install} "${DESTDIR}${xtlibdir}/"; \
fi;
uninstall:
dir=${DESTDIR}${xtlibdir}; { \
test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; \
} || { \
test -z "${targets_install}" || ( \
cd "$$dir" && rm -f ${targets_install} \
); \
test -z "${symlinks_install}" || ( \
cd "$$dir" && rm -f ${symlinks_install} \
); \
rmdir -p --ignore-fail-on-non-empty "$$dir"; \
}
clean:
rm -f *.o *.oo *.so *.a {matches,targets}.man initext.c initext4.c initext6.c initextb.c initexta.c;
rm -f .*.d .*.dd;
......
extensions/libip6t_REJECT.man
View file @ 9caffe92
......@@ -30,3 +30,23 @@ TCP RST packet to be sent back. This is mainly useful for blocking
hosts (which won't accept your mail otherwise).
\fBtcp\-reset\fP
can only be used with kernel versions 2.6.14 or later.
.PP
\fIWarning:\fP You should not indiscriminately apply the REJECT target to
packets whose connection state is classified as INVALID; instead, you should
only DROP these.
.PP
Consider a source host transmitting a packet P, with P experiencing so much
delay along its path that the source host issues a retransmission, P_2, with
P_2 being successful in reaching its destination and advancing the connection
state normally. It is conceivable that the late-arriving P may be considered
not to be associated with any connection tracking entry. Generating a reject
response for a packet so classed would then terminate the healthy connection.
.PP
So, instead of:
.PP
-A INPUT ... -j REJECT
.PP
do consider using:
.PP
-A INPUT ... -m conntrack --ctstate INVALID -j DROP
-A INPUT ... -j REJECT
extensions/libipt_REJECT.man
View file @ 9caffe92
......@@ -30,3 +30,23 @@ TCP RST packet to be sent back. This is mainly useful for blocking
hosts (which won't accept your mail otherwise).
.IP
(*) Using icmp\-admin\-prohibited with kernels that do not support it will result in a plain DROP instead of REJECT
.PP
\fIWarning:\fP You should not indiscriminately apply the REJECT target to
packets whose connection state is classified as INVALID; instead, you should
only DROP these.
.PP
Consider a source host transmitting a packet P, with P experiencing so much
delay along its path that the source host issues a retransmission, P_2, with
P_2 being successful in reaching its destination and advancing the connection
state normally. It is conceivable that the late-arriving P may be considered
not to be associated with any connection tracking entry. Generating a reject
response for a packet so classed would then terminate the healthy connection.
.PP
So, instead of:
.PP
-A INPUT ... -j REJECT
.PP
do consider using:
.PP
-A INPUT ... -m conntrack --ctstate INVALID -j DROP
-A INPUT ... -j REJECT
extensions/libipt_icmp.c
View file @ 9caffe92
......@@ -256,6 +256,11 @@ static int icmp_xlate(struct xt_xlate *xl,
if (!type_xlate_print(xl, info->type, info->code[0],
info->code[1]))
return 0;
} else {
/* '-m icmp --icmp-type any' is a noop by itself,
* but it eats a (mandatory) previous '-p icmp' so
* emit it here */
xt_xlate_add(xl, "ip protocol icmp");
}
return 1;
}
......
extensions/libipt_icmp.txlate
View file @ 9caffe92
......@@ -6,3 +6,6 @@ nft add rule ip filter INPUT icmp type destination-unreachable counter accept
iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j ACCEPT
nft add rule ip filter INPUT icmp type != destination-unreachable counter accept
iptables-translate -t filter -A INPUT -m icmp --icmp-type any -j ACCEPT
nft add rule ip filter INPUT ip protocol icmp counter accept
extensions/libxt_conntrack.c
View file @ 9caffe92
......@@ -1249,11 +1249,19 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
}
if (sinfo->match_flags & XT_CONNTRACK_STATE) {
xt_xlate_add(xl, "%sct state %s", space,
sinfo->invert_flags & XT_CONNTRACK_STATE ?
"!= " : "");
state_xlate_print(xl, sinfo->state_mask);
space = " ";
if ((sinfo->state_mask & XT_CONNTRACK_STATE_SNAT) ||
(sinfo->state_mask & XT_CONNTRACK_STATE_DNAT)) {
xt_xlate_add(xl, "%sct status %s%s", space,
sinfo->invert_flags & XT_CONNTRACK_STATUS ? "!=" : "",
sinfo->state_mask & XT_CONNTRACK_STATE_SNAT ? "snat" : "dnat");
space = " ";
} else {
xt_xlate_add(xl, "%sct state %s", space,
sinfo->invert_flags & XT_CONNTRACK_STATE ?
"!= " : "");
state_xlate_print(xl, sinfo->state_mask);
space = " ";
}
}
if (sinfo->match_flags & XT_CONNTRACK_STATUS) {
......
extensions/libxt_conntrack.txlate
View file @ 9caffe92
......@@ -42,3 +42,10 @@ nft add rule ip filter INPUT ct direction original counter accept
iptables-translate -t filter -A INPUT -m conntrack --ctstate NEW --ctproto tcp --ctorigsrc 192.168.0.1 --ctorigdst 192.168.0.1 --ctreplsrc 192.168.0.1 --ctrepldst 192.168.0.1 --ctorigsrcport 12 --ctorigdstport 14 --ctreplsrcport 16 --ctrepldstport 18 --ctexpire 10 --ctstatus SEEN_REPLY --ctdir ORIGINAL -j ACCEPT
nft add rule ip filter INPUT ct direction original ct original protocol 6 ct state new ct status seen-reply ct expiration 10 ct original saddr 192.168.0.1 ct original daddr 192.168.0.1 ct reply saddr 192.168.0.1 ct reply daddr 192.168.0.1 ct original proto-src 12 ct original proto-dst 14 ct reply proto-src 16 ct reply proto-dst 18 counter accept
iptables-translate -t filter -A INPUT -m conntrack --ctstate SNAT -j ACCEPT
nft add rule ip filter INPUT ct status snat counter accept
iptables-translate -t filter -A INPUT -m conntrack --ctstate DNAT -j ACCEPT
nft add rule ip filter INPUT ct status dnat counter accept
include/Makefile.am
View file @ 9caffe92
......@@ -10,3 +10,8 @@ endif
nobase_include_HEADERS += \
libiptc/ipt_kernel_headers.h libiptc/libiptc.h \
libiptc/libip6tc.h libiptc/libxtc.h libiptc/xtcshared.h
uninstall-hook:
dir=${includedir}/libiptc; { \
test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; \
} || rmdir -p --ignore-fail-on-non-empty "$$dir"
include/Makefile.in
View file @ 9caffe92
......@@ -241,6 +241,7 @@ SET_MAKE = @SET_MAKE@
SHELL = @SHELL@
STRIP = @STRIP@
VERSION = @VERSION@
XT_LOCK_NAME = @XT_LOCK_NAME@
abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
abs_top_builddir = @abs_top_builddir@
......@@ -596,8 +597,9 @@ ps: ps-am
ps-am:
uninstall-am: uninstall-includeHEADERS uninstall-nobase_includeHEADERS
.MAKE: install-am install-strip
@$(NORMAL_INSTALL)
$(MAKE) $(AM_MAKEFLAGS) uninstall-hook
.MAKE: install-am install-strip uninstall-am
.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
clean-libtool cscopelist-am ctags ctags-am distclean \
......@@ -611,12 +613,17 @@ uninstall-am: uninstall-includeHEADERS uninstall-nobase_includeHEADERS
installcheck installcheck-am installdirs maintainer-clean \
maintainer-clean-generic mostlyclean mostlyclean-generic \
mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
uninstall-am uninstall-includeHEADERS \
uninstall-am uninstall-hook uninstall-includeHEADERS \
uninstall-nobase_includeHEADERS
.PRECIOUS: Makefile
uninstall-hook:
dir=${includedir}/libiptc; { \
test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; \
} || rmdir -p --ignore-fail-on-non-empty "$$dir"
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
iptables/Makefile.am
View file @ 9caffe92
......@@ -56,7 +56,7 @@ man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \
ip6tables-save.8 iptables-extensions.8 \
iptables-apply.8 ip6tables-apply.8
sbin_SCRIPT = iptables-apply
sbin_SCRIPTS = iptables-apply
if ENABLE_NFTABLES
man_MANS += xtables-nft.8 xtables-translate.8 xtables-legacy.8 \
......@@ -67,6 +67,10 @@ man_MANS += xtables-nft.8 xtables-translate.8 xtables-legacy.8 \
ebtables-nft.8
endif
CLEANFILES = iptables.8 xtables-monitor.8 \
iptables-xml.1 iptables-apply.8 \
iptables-extensions.8 iptables-extensions.8.tmpl \
iptables-restore.8 iptables-save.8 \
iptables-restore-translate.8 ip6tables-restore-translate.8 \
iptables-translate.8 ip6tables-translate.8
vx_bin_links = iptables-xml
......@@ -111,3 +115,26 @@ install-exec-hook:
for i in ${v6_sbin_links}; do ${LN_S} -f xtables-legacy-multi "${DESTDIR}${sbindir}/$$i"; done;
for i in ${x_sbin_links}; do ${LN_S} -f xtables-nft-multi "${DESTDIR}${sbindir}/$$i"; done;
${LN_S} -f iptables-apply "${DESTDIR}${sbindir}/ip6tables-apply"
uninstall-hook:
dir=${DESTDIR}${bindir}; { \
test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; \
} || { \
test -z "${vx_bin_links}" || ( \
cd "$$dir" && rm -f ${vx_bin_links} \
) \
}
dir=${DESTDIR}${sbindir}; { \
test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; \
} || { \
test -z "${v4_sbin_links}" || ( \
cd "$$dir" && rm -f ${v4_sbin_links} \
); \
test -z "${v6_sbin_links}" || ( \
cd "$$dir" && rm -f ${v6_sbin_links} \
); \
test -z "${x_sbin_links}" || ( \
cd "$$dir" && rm -f ${x_sbin_links} \
); \
( cd "$$dir" && rm -f ip6tables-apply ); \
}
iptables/Makefile.in
View file @ 9caffe92
......@@ -17,6 +17,7 @@
# -*- Makefile -*-
VPATH = @srcdir@
am__is_gnu_make = { \
if test -z '$(MAKELEVEL)'; then \
......@@ -123,8 +124,9 @@ CONFIG_CLEAN_FILES = xtables.pc iptables.8 iptables-extensions.8.tmpl \
iptables-xml.1 xtables-monitor.8
CONFIG_CLEAN_VPATH_FILES =
@ENABLE_NFTABLES_TRUE@am__EXEEXT_1 = xtables-nft-multi$(EXEEXT)
am__installdirs = "$(DESTDIR)$(sbindir)" "$(DESTDIR)$(man1dir)" \
"$(DESTDIR)$(man8dir)" "$(DESTDIR)$(pkgconfigdir)"
am__installdirs = "$(DESTDIR)$(sbindir)" "$(DESTDIR)$(sbindir)" \
"$(DESTDIR)$(man1dir)" "$(DESTDIR)$(man8dir)" \
"$(DESTDIR)$(pkgconfigdir)"
PROGRAMS = $(sbin_PROGRAMS)
am__xtables_legacy_multi_SOURCES_DIST = xtables-legacy-multi.c \
iptables-xml.c iptables-standalone.c iptables.c \
......@@ -197,6 +199,34 @@ xtables_nft_multi_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
$(xtables_nft_multi_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) $(LDFLAGS) \
-o $@
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
am__install_max = 40
am__nobase_strip_setup = \
srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
am__nobase_strip = \
for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
am__nobase_list = $(am__nobase_strip_setup); \
for p in $$list; do echo "$$p $$p"; done | \
sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
$(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
if (++n[$$2] == $(am__install_max)) \
{ print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
END { for (dir in files) print dir, files[dir] }'
am__base_list = \
sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__uninstall_files_from_dir = { \
test -z "$$files" \
|| { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
|| { echo " ( cd '$$dir' && rm -f" $$files ")"; \
$(am__cd) "$$dir" && rm -f $$files; }; \
}
SCRIPTS = $(sbin_SCRIPTS)
AM_V_P = $(am__v_P_@AM_V@)
am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
am__v_P_0 = false
......@@ -271,33 +301,6 @@ am__can_run_installinfo = \
n|no|NO) false;; \
*) (install-info --version) >/dev/null 2>&1;; \
esac
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
am__install_max = 40
am__nobase_strip_setup = \
srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
am__nobase_strip = \
for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
am__nobase_list = $(am__nobase_strip_setup); \
for p in $$list; do echo "$$p $$p"; done | \
sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
$(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
if (++n[$$2] == $(am__install_max)) \
{ print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
END { for (dir in files) print dir, files[dir] }'
am__base_list = \
sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__uninstall_files_from_dir = { \
test -z "$$files" \
|| { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
|| { echo " ( cd '$$dir' && rm -f" $$files ")"; \
$(am__cd) "$$dir" && rm -f $$files; }; \
}
man1dir = $(mandir)/man1
man8dir = $(mandir)/man8
NROFF = nroff
......@@ -396,6 +399,7 @@ SET_MAKE = @SET_MAKE@
SHELL = @SHELL@
STRIP = @STRIP@
VERSION = @VERSION@
XT_LOCK_NAME = @XT_LOCK_NAME@
abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
abs_top_builddir = @abs_top_builddir@
......@@ -513,8 +517,12 @@ man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \
iptables-xml.1 ip6tables.8 ip6tables-restore.8 \
ip6tables-save.8 iptables-extensions.8 iptables-apply.8 \
ip6tables-apply.8 $(am__append_10)
sbin_SCRIPT = iptables-apply
sbin_SCRIPTS = iptables-apply
CLEANFILES = iptables.8 xtables-monitor.8 \
iptables-xml.1 iptables-apply.8 \
iptables-extensions.8 iptables-extensions.8.tmpl \
iptables-restore.8 iptables-save.8 \
iptables-restore-translate.8 ip6tables-restore-translate.8 \
iptables-translate.8 ip6tables-translate.8
vx_bin_links = iptables-xml
......@@ -644,6 +652,41 @@ xtables-legacy-multi$(EXEEXT): $(xtables_legacy_multi_OBJECTS) $(xtables_legacy_
xtables-nft-multi$(EXEEXT): $(xtables_nft_multi_OBJECTS) $(xtables_nft_multi_DEPENDENCIES) $(EXTRA_xtables_nft_multi_DEPENDENCIES)
@rm -f xtables-nft-multi$(EXEEXT)
$(AM_V_CCLD)$(xtables_nft_multi_LINK) $(xtables_nft_multi_OBJECTS) $(xtables_nft_multi_LDADD) $(LIBS)
install-sbinSCRIPTS: $(sbin_SCRIPTS)
@$(NORMAL_INSTALL)
@list='$(sbin_SCRIPTS)'; test -n "$(sbindir)" || list=; \
if test -n "$$list"; then \
echo " $(MKDIR_P) '$(DESTDIR)$(sbindir)'"; \
$(MKDIR_P) "$(DESTDIR)$(sbindir)" || exit 1; \
fi; \
for p in $$list; do \
if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
if test -f "$$d$$p"; then echo "$$d$$p"; echo "$$p"; else :; fi; \
done | \
sed -e 'p;s,.*/,,;n' \
-e 'h;s|.*|.|' \
-e 'p;x;s,.*/,,;$(transform)' | sed 'N;N;N;s,\n, ,g' | \
$(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1; } \
{ d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \
if ($$2 == $$4) { files[d] = files[d] " " $$1; \
if (++n[d] == $(am__install_max)) { \
print "f", d, files[d]; n[d] = 0; files[d] = "" } } \
else { print "f", d "/" $$4, $$1 } } \
END { for (d in files) print "f", d, files[d] }' | \
while read type dir files; do \
if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \
test -z "$$files" || { \
echo " $(INSTALL_SCRIPT) $$files '$(DESTDIR)$(sbindir)$$dir'"; \
$(INSTALL_SCRIPT) $$files "$(DESTDIR)$(sbindir)$$dir" || exit $$?; \
} \
; done
uninstall-sbinSCRIPTS:
@$(NORMAL_UNINSTALL)
@list='$(sbin_SCRIPTS)'; test -n "$(sbindir)" || exit 0; \
files=`for p in $$list; do echo "$$p"; done | \
sed -e 's,.*/,,;$(transform)'`; \
dir='$(DESTDIR)$(sbindir)'; $(am__uninstall_files_from_dir)
mostlyclean-compile:
-rm -f *.$(OBJEXT)
......@@ -1345,9 +1388,9 @@ distdir-am: $(DISTFILES)
check-am: all-am
check: $(BUILT_SOURCES)
$(MAKE) $(AM_MAKEFLAGS) check-am
all-am: Makefile $(PROGRAMS) $(MANS) $(DATA)
all-am: Makefile $(PROGRAMS) $(SCRIPTS) $(MANS) $(DATA)
installdirs:
for dir in "$(DESTDIR)$(sbindir)" "$(DESTDIR)$(man1dir)" "$(DESTDIR)$(man8dir)" "$(DESTDIR)$(pkgconfigdir)"; do \
for dir in "$(DESTDIR)$(sbindir)" "$(DESTDIR)$(sbindir)" "$(DESTDIR)$(man1dir)" "$(DESTDIR)$(man8dir)" "$(DESTDIR)$(pkgconfigdir)"; do \
test -z "$$dir" || $(MKDIR_P) "$$dir"; \
done
install: $(BUILT_SOURCES)
......@@ -1442,7 +1485,7 @@ install-dvi: install-dvi-am
install-dvi-am:
install-exec-am: install-sbinPROGRAMS
install-exec-am: install-sbinPROGRAMS install-sbinSCRIPTS
@$(NORMAL_INSTALL)
$(MAKE) $(AM_MAKEFLAGS) install-exec-hook
install-html: install-html-am
......@@ -1514,11 +1557,13 @@ ps: ps-am
ps-am:
uninstall-am: uninstall-man uninstall-pkgconfigDATA \
uninstall-sbinPROGRAMS
uninstall-sbinPROGRAMS uninstall-sbinSCRIPTS
@$(NORMAL_INSTALL)
$(MAKE) $(AM_MAKEFLAGS) uninstall-hook
uninstall-man: uninstall-man1 uninstall-man8
.MAKE: all check install install-am install-exec-am install-strip
.MAKE: all check install install-am install-exec-am install-strip \
uninstall-am
.PHONY: CTAGS GTAGS TAGS all all-am am--depfiles check check-am clean \
clean-generic clean-libtool clean-sbinPROGRAMS cscopelist-am \
......@@ -1529,13 +1574,14 @@ uninstall-man: uninstall-man1 uninstall-man8
install-exec-am install-exec-hook install-html install-html-am \
install-info install-info-am install-man install-man1 \
install-man8 install-pdf install-pdf-am install-pkgconfigDATA \
install-ps install-ps-am install-sbinPROGRAMS install-strip \
installcheck installcheck-am installdirs maintainer-clean \
maintainer-clean-generic mostlyclean mostlyclean-compile \
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags tags-am uninstall uninstall-am uninstall-man \
uninstall-man1 uninstall-man8 uninstall-pkgconfigDATA \
uninstall-sbinPROGRAMS
install-ps install-ps-am install-sbinPROGRAMS \
install-sbinSCRIPTS install-strip installcheck installcheck-am \
installdirs maintainer-clean maintainer-clean-generic \
mostlyclean mostlyclean-compile mostlyclean-generic \
mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
uninstall-am uninstall-hook uninstall-man uninstall-man1 \
uninstall-man8 uninstall-pkgconfigDATA uninstall-sbinPROGRAMS \
uninstall-sbinSCRIPTS
.PRECIOUS: Makefile
......@@ -1558,6 +1604,29 @@ install-exec-hook:
for i in ${x_sbin_links}; do ${LN_S} -f xtables-nft-multi "${DESTDIR}${sbindir}/$$i"; done;
${LN_S} -f iptables-apply "${DESTDIR}${sbindir}/ip6tables-apply"
uninstall-hook:
dir=${DESTDIR}${bindir}; { \
test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; \
} || { \
test -z "${vx_bin_links}" || ( \
cd "$$dir" && rm -f ${vx_bin_links} \
) \
}
dir=${DESTDIR}${sbindir}; { \
test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; \
} || { \
test -z "${v4_sbin_links}" || ( \
cd "$$dir" && rm -f ${v4_sbin_links} \
); \
test -z "${v6_sbin_links}" || ( \
cd "$$dir" && rm -f ${v6_sbin_links} \
); \
test -z "${x_sbin_links}" || ( \
cd "$$dir" && rm -f ${x_sbin_links} \
); \
( cd "$$dir" && rm -f ip6tables-apply ); \
}
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
iptables/iptables.8.in
View file @ 9caffe92
......@@ -397,6 +397,14 @@ corresponding to that rule's position in the chain.
\fB\-\-modprobe=\fP\fIcommand\fP
When adding or inserting rules into a chain, use \fIcommand\fP
to load any necessary modules (targets, match extensions, etc).
.SH LOCK FILE
iptables uses the \fI@XT_LOCK_NAME@\fP file to take an exclusive lock at
launch.
The \fBXTABLES_LOCKFILE\fP environment variable can be used to override
the default setting.
.SH MATCH AND TARGET EXTENSIONS
.PP
iptables can use extended packet matching and target modules.
......
iptables/nft-cache.c
View file @ 9caffe92
......@@ -109,48 +109,44 @@ static void mnl_genid_get(struct nft_handle *h, uint32_t *genid)
static int nftnl_table_list_cb(const struct nlmsghdr *nlh, void *data)
{
struct nftnl_table *t;
struct nftnl_table_list *list = data;
struct nftnl_table *nftnl = nftnl_table_alloc();
const struct builtin_table *t;
struct nft_handle *h = data;
const char *name;
t = nftnl_table_alloc();
if (t == NULL)
goto err;
if (!nftnl)
return MNL_CB_OK;
if (nftnl_table_nlmsg_parse(nlh, t) < 0)
if (nftnl_table_nlmsg_parse(nlh, nftnl) < 0)
goto out;
nftnl_table_list_add_tail(t, list);
name = nftnl_table_get_str(nftnl, NFTNL_TABLE_NAME);
if (!name)
goto out;
return MNL_CB_OK;
t = nft_table_builtin_find(h, name);
if (!t)
goto out;
h->cache->table[t->type].exists = true;
out:
nftnl_table_free(t);
err:
nftnl_table_free(nftnl);
return MNL_CB_OK;
}
static int fetch_table_cache(struct nft_handle *h)
{
char buf[16536];
struct nlmsghdr *nlh;
struct nftnl_table_list *list;
char buf[16536];
int i, ret;
if (h->cache->tables)
return 0;
list = nftnl_table_list_alloc();
if (list == NULL)
return 0;
nlh = nftnl_rule_nlmsg_build_hdr(buf, NFT_MSG_GETTABLE, h->family,
NLM_F_DUMP, h->seq);
ret = mnl_talk(h, nlh, nftnl_table_list_cb, list);
ret = mnl_talk(h, nlh, nftnl_table_list_cb, h);
if (ret < 0 && errno == EINTR)
assert(nft_restart(h) >= 0);
h->cache->tables = list;
for (i = 0; i < NFT_TABLE_MAX; i++) {
enum nft_table_type type = h->tables[i].type;
......@@ -180,8 +176,8 @@ static int nftnl_chain_list_cb(const struct nlmsghdr *nlh, void *data)
const struct builtin_table *t = d->t;
struct nftnl_chain_list *list;
struct nft_handle *h = d->h;
const char *tname, *cname;
struct nftnl_chain *c;
const char *tname;
c = nftnl_chain_alloc();
if (c == NULL)
......@@ -201,11 +197,6 @@ static int nftnl_chain_list_cb(const struct nlmsghdr *nlh, void *data)
}
list = h->cache->table[t->type].chains;
cname = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
if (nftnl_chain_list_lookup_byname(list, cname))
goto out;
nftnl_chain_list_add_tail(c, list);
return MNL_CB_OK;
......@@ -511,14 +502,14 @@ retry:
if (req->level >= NFT_CL_TABLES)
fetch_table_cache(h);
if (req->level == NFT_CL_FAKE)
return;
goto genid_check;
if (req->level >= NFT_CL_CHAINS)
fetch_chain_cache(h, t, chains);
if (req->level >= NFT_CL_SETS)
fetch_set_cache(h, t, NULL);
if (req->level >= NFT_CL_RULES)
fetch_rule_cache(h, t);
genid_check:
mnl_genid_get(h, &genid_check);
if (h->nft_genid != genid_check) {
flush_cache(h, h->cache, NULL);
......@@ -612,10 +603,8 @@ static int flush_cache(struct nft_handle *h, struct nft_cache *c,
nftnl_set_list_free(c->table[i].sets);
c->table[i].sets = NULL;
}
}
if (c->tables) {
nftnl_table_list_free(c->tables);
c->tables = NULL;
c->table[i].exists = false;
}
return 1;
......@@ -689,11 +678,6 @@ void nft_release_cache(struct nft_handle *h)
}
}
struct nftnl_table_list *nftnl_table_list_get(struct nft_handle *h)
{
return h->cache->tables;
}
struct nftnl_set_list *
nft_set_list_get(struct nft_handle *h, const char *table, const char *set)
{
......
iptables/nft-cache.h
View file @ 9caffe92
......@@ -17,6 +17,5 @@ struct nftnl_chain_list *
nft_chain_list_get(struct nft_handle *h, const char *table, const char *chain);
struct nftnl_set_list *
nft_set_list_get(struct nft_handle *h, const char *table, const char *set);
struct nftnl_table_list *nftnl_table_list_get(struct nft_handle *h);
#endif /* _NFT_CACHE_H_ */
iptables/nft-cmd.c
View file @ 9caffe92
......@@ -311,10 +311,15 @@ int nft_cmd_chain_set(struct nft_handle *h, const char *table,
return 1;
}
int nft_cmd_table_flush(struct nft_handle *h, const char *table)
int nft_cmd_table_flush(struct nft_handle *h, const char *table, bool verbose)
{
struct nft_cmd *cmd;
if (verbose) {
return nft_cmd_rule_flush(h, NULL, table, verbose) &&
nft_cmd_chain_user_del(h, NULL, table, verbose);
}
cmd = nft_cmd_new(h, NFT_COMPAT_TABLE_FLUSH, table, NULL, NULL, -1,
false);
if (!cmd)
......@@ -388,8 +393,3 @@ int ebt_cmd_user_chain_policy(struct nft_handle *h, const char *table,
return 1;
}
void nft_cmd_table_new(struct nft_handle *h, const char *table)
{
nft_cmd_new(h, NFT_COMPAT_TABLE_NEW, table, NULL, NULL, -1, false);
}
iptables/nft-cmd.h
View file @ 9caffe92
......@@ -65,7 +65,7 @@ int nft_cmd_chain_user_rename(struct nft_handle *h,const char *chain,
int nft_cmd_rule_replace(struct nft_handle *h, const char *chain,
const char *table, void *data, int rulenum,
bool verbose);
int nft_cmd_table_flush(struct nft_handle *h, const char *table);
int nft_cmd_table_flush(struct nft_handle *h, const char *table, bool verbose);
int nft_cmd_chain_restore(struct nft_handle *h, const char *chain,
const char *table);
int nft_cmd_rule_zero_counters(struct nft_handle *h, const char *chain,
......
iptables/nft-shared.c
View file @ 9caffe92
......@@ -165,7 +165,7 @@ void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op)
void add_addr(struct nftnl_rule *r, int offset,
void *data, void *mask, size_t len, uint32_t op)
{
const char *m = mask;
const unsigned char *m = mask;
int i;
add_payload(r, offset, len, NFT_PAYLOAD_NETWORK_HEADER);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment