Skip to content

GitLab

Commit c2d7e04a authored by Arturo Borrero Gonzalez's avatar Arturo Borrero Gonzalez
Browse files

Update upstream source from tag 'upstream/1.8.1' 

Update to upstream version '1.8.1'
with Debian dir f7eefdbc289bc01f3d8a1522cd469a3564de9051
parents 698f2511 dab1e98e
Hide whitespace changes
Inline Side-by-side
configure
View file @ c2d7e04a
#! /bin/sh #! /bin/sh
# Guess values for system-dependent variables and create Makefiles. # Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.69 for iptables 1.8.0. # Generated by GNU Autoconf 2.69 for iptables 1.8.1.
# #
# #
# Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc. # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
...@@ -587,8 +587,8 @@ MAKEFLAGS= ...@@ -587,8 +587,8 @@ MAKEFLAGS=
# Identity of this package. # Identity of this package.
PACKAGE_NAME='iptables' PACKAGE_NAME='iptables'
PACKAGE_TARNAME='iptables' PACKAGE_TARNAME='iptables'
PACKAGE_VERSION='1.8.0' PACKAGE_VERSION='1.8.1'
PACKAGE_STRING='iptables 1.8.0' PACKAGE_STRING='iptables 1.8.1'
PACKAGE_BUGREPORT='' PACKAGE_BUGREPORT=''
PACKAGE_URL='' PACKAGE_URL=''
...@@ -1413,7 +1413,7 @@ if test "$ac_init_help" = "long"; then ...@@ -1413,7 +1413,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing. # Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh. # This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF cat <<_ACEOF
\`configure' configures iptables 1.8.0 to adapt to many kinds of systems. \`configure' configures iptables 1.8.1 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]... Usage: $0 [OPTION]... [VAR=VALUE]...
...@@ -1484,7 +1484,7 @@ fi ...@@ -1484,7 +1484,7 @@ fi
if test -n "$ac_init_help"; then if test -n "$ac_init_help"; then
case $ac_init_help in case $ac_init_help in
short | recursive ) echo "Configuration of iptables 1.8.0:";; short | recursive ) echo "Configuration of iptables 1.8.1:";;
esac esac
cat <<\_ACEOF cat <<\_ACEOF
...@@ -1641,7 +1641,7 @@ fi ...@@ -1641,7 +1641,7 @@ fi
test -n "$ac_init_help" && exit $ac_status test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then if $ac_init_version; then
cat <<\_ACEOF cat <<\_ACEOF
iptables configure 1.8.0 iptables configure 1.8.1
generated by GNU Autoconf 2.69 generated by GNU Autoconf 2.69
Copyright (C) 2012 Free Software Foundation, Inc. Copyright (C) 2012 Free Software Foundation, Inc.
...@@ -2189,7 +2189,7 @@ cat >config.log <<_ACEOF ...@@ -2189,7 +2189,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake. running configure, to aid debugging if configure makes a mistake.
It was created by iptables $as_me 1.8.0, which was It was created by iptables $as_me 1.8.1, which was
generated by GNU Autoconf 2.69. Invocation command line was generated by GNU Autoconf 2.69. Invocation command line was
$ $0 $@ $ $0 $@
...@@ -2539,8 +2539,8 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu ...@@ -2539,8 +2539,8 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
# See libtool.info "Libtool's versioning system" # See libtool.info "Libtool's versioning system"
libxtables_vcurrent=12 libxtables_vcurrent=13
libxtables_vage=0 libxtables_vage=1
ac_aux_dir= ac_aux_dir=
for ac_dir in build-aux "$srcdir"/build-aux; do for ac_dir in build-aux "$srcdir"/build-aux; do
...@@ -3060,7 +3060,7 @@ fi ...@@ -3060,7 +3060,7 @@ fi
# Define the identity of the package. # Define the identity of the package.
PACKAGE='iptables' PACKAGE='iptables'
VERSION='1.8.0' VERSION='1.8.1'
cat >>confdefs.h <<_ACEOF cat >>confdefs.h <<_ACEOF
...@@ -14154,7 +14154,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 ...@@ -14154,7 +14154,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
# report actual input values of CONFIG_FILES etc. instead of their # report actual input values of CONFIG_FILES etc. instead of their
# values after options handling. # values after options handling.
ac_log=" ac_log="
This file was extended by iptables $as_me 1.8.0, which was This file was extended by iptables $as_me 1.8.1, which was
generated by GNU Autoconf 2.69. Invocation command line was generated by GNU Autoconf 2.69. Invocation command line was
CONFIG_FILES = $CONFIG_FILES CONFIG_FILES = $CONFIG_FILES
...@@ -14220,7 +14220,7 @@ _ACEOF ...@@ -14220,7 +14220,7 @@ _ACEOF
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
ac_cs_version="\\ ac_cs_version="\\
iptables config.status 1.8.0 iptables config.status 1.8.1
configured by $0, generated by GNU Autoconf 2.69, configured by $0, generated by GNU Autoconf 2.69,
with options \\"\$ac_cs_config\\" with options \\"\$ac_cs_config\\"
......
configure.ac
View file @ c2d7e04a
AC_INIT([iptables], [1.8.0]) AC_INIT([iptables], [1.8.1])
# See libtool.info "Libtool's versioning system" # See libtool.info "Libtool's versioning system"
libxtables_vcurrent=12 libxtables_vcurrent=13
libxtables_vage=0 libxtables_vage=1
AC_CONFIG_AUX_DIR([build-aux]) AC_CONFIG_AUX_DIR([build-aux])
AC_CONFIG_HEADERS([config.h]) AC_CONFIG_HEADERS([config.h])
......
extensions/GNUmakefile.in
View file @ c2d7e04a
...@@ -40,8 +40,8 @@ endif ...@@ -40,8 +40,8 @@ endif
# Wildcard module list # Wildcard module list
# #
pfx_build_mod := $(patsubst ${srcdir}/libxt_%.c,%,$(sort $(wildcard ${srcdir}/libxt_*.c))) pfx_build_mod := $(patsubst ${srcdir}/libxt_%.c,%,$(sort $(wildcard ${srcdir}/libxt_*.c)))
pfb_build_mod := $(patsubst ${srcdir}/libebt_%.c,%,$(sort $(wildcard ${srcdir}/libebt_*.c))) @ENABLE_NFTABLES_TRUE@ pfb_build_mod := $(patsubst ${srcdir}/libebt_%.c,%,$(sort $(wildcard ${srcdir}/libebt_*.c)))
pfa_build_mod := $(patsubst ${srcdir}/libarpt_%.c,%,$(sort $(wildcard ${srcdir}/libarpt_*.c))) @ENABLE_NFTABLES_TRUE@ pfa_build_mod := $(patsubst ${srcdir}/libarpt_%.c,%,$(sort $(wildcard ${srcdir}/libarpt_*.c)))
pfx_symlinks := NOTRACK state pfx_symlinks := NOTRACK state
@ENABLE_IPV4_TRUE@ pf4_build_mod := $(patsubst ${srcdir}/libipt_%.c,%,$(sort $(wildcard ${srcdir}/libipt_*.c))) @ENABLE_IPV4_TRUE@ pf4_build_mod := $(patsubst ${srcdir}/libipt_%.c,%,$(sort $(wildcard ${srcdir}/libipt_*.c)))
@ENABLE_IPV6_TRUE@ pf6_build_mod := $(patsubst ${srcdir}/libip6t_%.c,%,$(sort $(wildcard ${srcdir}/libip6t_*.c))) @ENABLE_IPV6_TRUE@ pf6_build_mod := $(patsubst ${srcdir}/libip6t_%.c,%,$(sort $(wildcard ${srcdir}/libip6t_*.c)))
......
extensions/libarpt_mangle.c
View file @ c2d7e04a
...@@ -139,47 +139,39 @@ static void print_mac(const unsigned char *mac, int l) ...@@ -139,47 +139,39 @@ static void print_mac(const unsigned char *mac, int l)
(j==l-1) ? "" : ":"); (j==l-1) ? "" : ":");
} }
static const char *ipaddr_to(const struct in_addr *addrp, int numeric)
{
if (numeric)
return xtables_ipaddr_to_numeric(addrp);
else
return xtables_ipaddr_to_anyname(addrp);
}
static void static void
arpmangle_print(const void *ip, const struct xt_entry_target *target, arpmangle_print(const void *ip, const struct xt_entry_target *target,
int numeric) int numeric)
{ {
struct arpt_mangle *m = (struct arpt_mangle *)(target->data); struct arpt_mangle *m = (struct arpt_mangle *)(target->data);
char buf[100];
if (m->flags & ARPT_MANGLE_SIP) { if (m->flags & ARPT_MANGLE_SIP) {
if (numeric) printf(" --mangle-ip-s %s",
sprintf(buf, "%s", ipaddr_to(&(m->u_s.src_ip), numeric));
xtables_ipaddr_to_numeric(&(m->u_s.src_ip)));
else
sprintf(buf, "%s",
xtables_ipaddr_to_anyname(&(m->u_s.src_ip)));
printf("--mangle-ip-s %s ", buf);
} }
if (m->flags & ARPT_MANGLE_SDEV) { if (m->flags & ARPT_MANGLE_SDEV) {
printf("--mangle-mac-s "); printf(" --mangle-mac-s ");
print_mac((unsigned char *)m->src_devaddr, 6); print_mac((unsigned char *)m->src_devaddr, 6);
printf(" ");
} }
if (m->flags & ARPT_MANGLE_TIP) { if (m->flags & ARPT_MANGLE_TIP) {
if (numeric) printf(" --mangle-ip-d %s",
sprintf(buf, "%s", ipaddr_to(&(m->u_t.tgt_ip), numeric));
xtables_ipaddr_to_numeric(&(m->u_t.tgt_ip)));
else
sprintf(buf, "%s",
xtables_ipaddr_to_anyname(&(m->u_t.tgt_ip)));
printf("--mangle-ip-d %s ", buf);
} }
if (m->flags & ARPT_MANGLE_TDEV) { if (m->flags & ARPT_MANGLE_TDEV) {
printf("--mangle-mac-d "); printf(" --mangle-mac-d ");
print_mac((unsigned char *)m->tgt_devaddr, 6); print_mac((unsigned char *)m->tgt_devaddr, 6);
printf(" ");
} }
if (m->target != NF_ACCEPT) { if (m->target != NF_ACCEPT) {
printf("--mangle-target "); printf(" --mangle-target %s",
if (m->target == NF_DROP) m->target == NF_DROP ? "DROP" : "CONTINUE");
printf("DROP ");
else
printf("CONTINUE ");
} }
} }
......
extensions/libebt_arp.c
View file @ c2d7e04a
...@@ -14,7 +14,7 @@ ...@@ -14,7 +14,7 @@
#include <xtables.h> #include <xtables.h>
#include <netinet/ether.h> #include <netinet/ether.h>
#include <ebtables/ethernetdb.h> #include <xtables.h>
#include <net/if_arp.h> #include <net/if_arp.h>
#include <linux/netfilter_bridge/ebt_arp.h> #include <linux/netfilter_bridge/ebt_arp.h>
#include "iptables/nft.h" #include "iptables/nft.h"
...@@ -75,7 +75,7 @@ static void brarp_print_help(void) ...@@ -75,7 +75,7 @@ static void brarp_print_help(void)
printf(" %d = %s\n", i + 1, opcodes[i]); printf(" %d = %s\n", i + 1, opcodes[i]);
printf( printf(
" hardware type string: 1 = Ethernet\n" " hardware type string: 1 = Ethernet\n"
" protocol type string: see "_PATH_ETHERTYPES"\n"); " protocol type string: see "XT_PATH_ETHERTYPES"\n");
} }
#define OPT_OPCODE 0x01 #define OPT_OPCODE 0x01
...@@ -209,76 +209,6 @@ static int brarp_get_mac_and_mask(const char *from, unsigned char *to, unsigned ...@@ -209,76 +209,6 @@ static int brarp_get_mac_and_mask(const char *from, unsigned char *to, unsigned
return 0; return 0;
} }
static struct ethertypeent *brarp_getethertypeent(FILE *etherf, const char *name)
{
static struct ethertypeent et_ent;
char *e, *found_name;
char line[1024];
while ((e = fgets(line, sizeof(line), etherf))) {
char *endptr, *cp;
if (*e == '#')
continue;
cp = strpbrk(e, "#\n");
if (cp == NULL)
continue;
*cp = '\0';
found_name = e;
cp = strpbrk(e, " \t");
if (cp == NULL)
continue;
*cp++ = '\0';
while (*cp == ' ' || *cp == '\t')
cp++;
e = strpbrk(cp, " \t");
if (e != NULL)
*e++ = '\0';
et_ent.e_ethertype = strtol(cp, &endptr, 16);
if (*endptr != '\0' ||
(et_ent.e_ethertype < ETH_ZLEN || et_ent.e_ethertype > 0xFFFF))
continue;
if (strcasecmp(found_name, name) == 0)
return (&et_ent);
if (e != NULL) {
cp = e;
while (cp && *cp) {
if (*cp == ' ' || *cp == '\t') {
cp++;
continue;
}
e = cp;
cp = strpbrk(cp, " \t");
if (cp != NULL)
*cp++ = '\0';
if (strcasecmp(e, name) == 0)
return (&et_ent);
e = cp;
}
}
}
return NULL;
}
static struct ethertypeent *brarp_getethertypebyname(const char *name)
{
struct ethertypeent *e;
FILE *etherf;
etherf = fopen(_PATH_ETHERTYPES, "r");
e = brarp_getethertypeent(etherf, name);
fclose(etherf);
return (e);
}
static int static int
brarp_parse(int c, char **argv, int invert, unsigned int *flags, brarp_parse(int c, char **argv, int invert, unsigned int *flags,
const void *entry, struct xt_entry_match **match) const void *entry, struct xt_entry_match **match)
...@@ -332,9 +262,9 @@ brarp_parse(int c, char **argv, int invert, unsigned int *flags, ...@@ -332,9 +262,9 @@ brarp_parse(int c, char **argv, int invert, unsigned int *flags,
i = strtol(optarg, &end, 16); i = strtol(optarg, &end, 16);
if (i < 0 || i >= (0x1 << 16) || *end !='\0') { if (i < 0 || i >= (0x1 << 16) || *end !='\0') {
struct ethertypeent *ent; struct xt_ethertypeent *ent;
ent = brarp_getethertypebyname(argv[optind - 1]); ent = xtables_getethertypebyname(argv[optind - 1]);
if (!ent) if (!ent)
xtables_error(PARAMETER_PROBLEM, "Problem with specified ARP " xtables_error(PARAMETER_PROBLEM, "Problem with specified ARP "
"protocol type"); "protocol type");
......
extensions/libebt_ip.c
View file @ c2d7e04a
...@@ -437,10 +437,6 @@ brip_parse(int c, char **argv, int invert, unsigned int *flags, ...@@ -437,10 +437,6 @@ brip_parse(int c, char **argv, int invert, unsigned int *flags,
if (invert) if (invert)
info->invflags |= EBT_IP_PROTO; info->invflags |= EBT_IP_PROTO;
info->protocol = xtables_parse_protocol(optarg); info->protocol = xtables_parse_protocol(optarg);
if (info->protocol == -1)
xtables_error(PARAMETER_PROBLEM,
"Unknown specified IP protocol - %s",
optarg);
info->bitmask |= EBT_IP_PROTO; info->bitmask |= EBT_IP_PROTO;
break; break;
default: default:
......
extensions/libebt_ip6.c
View file @ c2d7e04a
...@@ -376,10 +376,6 @@ brip6_parse(int c, char **argv, int invert, unsigned int *flags, ...@@ -376,10 +376,6 @@ brip6_parse(int c, char **argv, int invert, unsigned int *flags,
if (invert) if (invert)
info->invflags |= EBT_IP6_PROTO; info->invflags |= EBT_IP6_PROTO;
info->protocol = xtables_parse_protocol(optarg); info->protocol = xtables_parse_protocol(optarg);
if (info->protocol == -1)
xtables_error(PARAMETER_PROBLEM,
"Unknown specified IP protocol - %s",
optarg);
info->bitmask |= EBT_IP6_PROTO; info->bitmask |= EBT_IP6_PROTO;
break; break;
default: default:
......
extensions/libebt_limit.c deleted 100644 → 0
View file @ 698f2511
/* ebt_limit
*
* Authors:
* Tom Marshall <tommy@home.tig-grr.com>
*
* Mostly copied from iptables' limit match.
*
* September, 2003
*
* Translated to use libxtables for ebtables-compat in 2015 by
* Arturo Borrero Gonzalez <arturo@debian.org>
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <getopt.h>
#include <errno.h>
#include <xtables.h>
#include <linux/netfilter_bridge/ebt_limit.h>
#include "iptables/nft.h"
#include "iptables/nft-bridge.h"
#define EBT_LIMIT_AVG "3/hour"
#define EBT_LIMIT_BURST 5
#define FLAG_LIMIT 0x01
#define FLAG_LIMIT_BURST 0x02
#define ARG_LIMIT '1'
#define ARG_LIMIT_BURST '2'
static const struct option brlimit_opts[] =
{
{ .name = "limit", .has_arg = true, .val = ARG_LIMIT },
{ .name = "limit-burst",.has_arg = true, .val = ARG_LIMIT_BURST },
XT_GETOPT_TABLEEND,
};
static void brlimit_print_help(void)
{
printf(
"limit options:\n"
"--limit avg : max average match rate: default "EBT_LIMIT_AVG"\n"
" [Packets per second unless followed by \n"
" /sec /minute /hour /day postfixes]\n"
"--limit-burst number : number to match in a burst, -1 < number < 10001,\n"
" default %u\n", EBT_LIMIT_BURST);
}
static int parse_rate(const char *rate, uint32_t *val)
{
const char *delim;
uint32_t r;
uint32_t mult = 1; /* Seconds by default. */
delim = strchr(rate, '/');
if (delim) {
if (strlen(delim+1) == 0)
return 0;
if (strncasecmp(delim+1, "second", strlen(delim+1)) == 0)
mult = 1;
else if (strncasecmp(delim+1, "minute", strlen(delim+1)) == 0)
mult = 60;
else if (strncasecmp(delim+1, "hour", strlen(delim+1)) == 0)
mult = 60*60;
else if (strncasecmp(delim+1, "day", strlen(delim+1)) == 0)
mult = 24*60*60;
else
return 0;
}
r = atoi(rate);
if (!r)
return 0;
/* This would get mapped to infinite (1/day is minimum they
can specify, so we're ok at that end). */
if (r / mult > EBT_LIMIT_SCALE)
return 0;
*val = EBT_LIMIT_SCALE * mult / r;
return 1;
}
static void brlimit_init(struct xt_entry_match *match)
{
struct ebt_limit_info *r = (struct ebt_limit_info *)match->data;
parse_rate(EBT_LIMIT_AVG, &r->avg);
r->burst = EBT_LIMIT_BURST;
}
static int brlimit_parse(int c, char **argv, int invert, unsigned int *flags,
const void *entry, struct xt_entry_match **match)
{
struct ebt_limit_info *r = (struct ebt_limit_info *)(*match)->data;
uintmax_t num;
switch (c) {
case ARG_LIMIT:
EBT_CHECK_OPTION(flags, FLAG_LIMIT);
if (invert)
xtables_error(PARAMETER_PROBLEM,
"Unexpected `!' after --limit");
if (!parse_rate(optarg, &r->avg))
xtables_error(PARAMETER_PROBLEM,
"bad rate `%s'", optarg);
break;
case ARG_LIMIT_BURST:
EBT_CHECK_OPTION(flags, FLAG_LIMIT_BURST);
if (invert)
xtables_error(PARAMETER_PROBLEM,
"Unexpected `!' after --limit-burst");
if (!xtables_strtoul(optarg, NULL, &num, 0, 10000))
xtables_error(PARAMETER_PROBLEM,
"bad --limit-burst `%s'", optarg);
r->burst = num;
break;
default:
return 0;
}
return 1;
}
struct rates
{
const char *name;
uint32_t mult;
};
static struct rates g_rates[] =
{
{ "day", EBT_LIMIT_SCALE*24*60*60 },
{ "hour", EBT_LIMIT_SCALE*60*60 },
{ "minute", EBT_LIMIT_SCALE*60 },
{ "second", EBT_LIMIT_SCALE }
};
static void print_rate(uint32_t period)
{
unsigned int i;
for (i = 1; i < sizeof(g_rates)/sizeof(struct rates); i++)
if (period > g_rates[i].mult ||
g_rates[i].mult/period < g_rates[i].mult%period)
break;
printf("%u/%s ", g_rates[i-1].mult / period, g_rates[i-1].name);
}
static void brlimit_print(const void *ip, const struct xt_entry_match *match,
int numeric)
{
struct ebt_limit_info *r = (struct ebt_limit_info *)match->data;
printf("--limit ");
print_rate(r->avg);
printf("--limit-burst %u ", r->burst);
}
static void print_rate_xlate(struct xt_xlate *xl, uint32_t period)
{
unsigned int i;
for (i = 1; i < sizeof(g_rates)/sizeof(struct rates); i++)
if (period > g_rates[i].mult ||
g_rates[i].mult/period < g_rates[i].mult%period)
break;
xt_xlate_add(xl, "%u/%s ", g_rates[i-1].mult / period, g_rates[i-1].name);
}
static int brlimit_xlate(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params)
{
const struct ebt_limit_info *r = (const void *)params->match->data;
xt_xlate_add(xl, "limit rate ");
print_rate_xlate(xl, r->avg);
if (r->burst != 0)
xt_xlate_add(xl, "burst %u packets ", r->burst);
return 1;
}
static struct xtables_match brlimit_match = {
.name = "limit",
.revision = 0,
.version = XTABLES_VERSION,
.family = NFPROTO_BRIDGE,
.size = XT_ALIGN(sizeof(struct ebt_limit_info)),
.userspacesize = offsetof(struct ebt_limit_info, prev),
.init = brlimit_init,
.help = brlimit_print_help,
.parse = brlimit_parse,
.print = brlimit_print,
.xlate = brlimit_xlate,
.extra_opts = brlimit_opts,
};
void _init(void)
{
xtables_register_match(&brlimit_match);
}
extensions/libebt_log.c
View file @ c2d7e04a
...@@ -92,6 +92,14 @@ static void brlog_init(struct xt_entry_target *t) ...@@ -92,6 +92,14 @@ static void brlog_init(struct xt_entry_target *t)
loginfo->loglevel = LOG_NOTICE; loginfo->loglevel = LOG_NOTICE;
} }
static unsigned int log_chk_inv(int inv, unsigned int bit, const char *suffix)
{
if (inv)
xtables_error(PARAMETER_PROBLEM,
"Unexpected `!' after --log%s", suffix);
return bit;
}
static int brlog_parse(int c, char **argv, int invert, unsigned int *flags, static int brlog_parse(int c, char **argv, int invert, unsigned int *flags,
const void *entry, struct xt_entry_target **target) const void *entry, struct xt_entry_target **target)
{ {
...@@ -125,26 +133,16 @@ static int brlog_parse(int c, char **argv, int invert, unsigned int *flags, ...@@ -125,26 +133,16 @@ static int brlog_parse(int c, char **argv, int invert, unsigned int *flags,
"Problem with the log-level"); "Problem with the log-level");
break; break;
case LOG_IP: case LOG_IP:
if (invert) loginfo->bitmask |= log_chk_inv(invert, EBT_LOG_IP, "-ip");
xtables_error(PARAMETER_PROBLEM,
"Unexpected `!' after --log-ip");
loginfo->bitmask |= EBT_LOG_IP;
break; break;
case LOG_ARP: case LOG_ARP:
if (invert) loginfo->bitmask |= log_chk_inv(invert, EBT_LOG_ARP, "-arp");
xtables_error(PARAMETER_PROBLEM, break;
"Unexpected `!' after --log-arp");
loginfo->bitmask |= EBT_LOG_ARP;
case LOG_LOG: case LOG_LOG:
if (invert) loginfo->bitmask |= log_chk_inv(invert, 0, "");
xtables_error(PARAMETER_PROBLEM,
"Unexpected `!' after --log");
break; break;
case LOG_IP6: case LOG_IP6:
if (invert) loginfo->bitmask |= log_chk_inv(invert, EBT_LOG_IP6, "-ip6");
xtables_error(PARAMETER_PROBLEM,
"Unexpected `!' after --log-ip6");
loginfo->bitmask |= EBT_LOG_IP6;
break; break;
default: default:
return 0; return 0;
......
extensions/libebt_mark.c
View file @ c2d7e04a
...@@ -18,8 +18,6 @@ ...@@ -18,8 +18,6 @@
#include "iptables/nft.h" #include "iptables/nft.h"
#include "iptables/nft-bridge.h" #include "iptables/nft-bridge.h"
static int mark_supplied;
#define MARK_TARGET '1' #define MARK_TARGET '1'
#define MARK_SETMARK '2' #define MARK_SETMARK '2'
#define MARK_ORMARK '3' #define MARK_ORMARK '3'
...@@ -54,7 +52,6 @@ static void brmark_init(struct xt_entry_target *target) ...@@ -54,7 +52,6 @@ static void brmark_init(struct xt_entry_target *target)
info->target = EBT_ACCEPT; info->target = EBT_ACCEPT;
info->mark = 0; info->mark = 0;
mark_supplied = 0;
} }
#define OPT_MARK_TARGET 0x01 #define OPT_MARK_TARGET 0x01
...@@ -133,7 +130,6 @@ brmark_parse(int c, char **argv, int invert, unsigned int *flags, ...@@ -133,7 +130,6 @@ brmark_parse(int c, char **argv, int invert, unsigned int *flags,
xtables_error(PARAMETER_PROBLEM, "Bad MARK value '%s'", xtables_error(PARAMETER_PROBLEM, "Bad MARK value '%s'",
optarg); optarg);
mark_supplied = 1;
return 1; return 1;
} }
...@@ -162,9 +158,6 @@ static void brmark_print(const void *ip, const struct xt_entry_target *target, ...@@ -162,9 +158,6 @@ static void brmark_print(const void *ip, const struct xt_entry_target *target,
static void brmark_final_check(unsigned int flags) static void brmark_final_check(unsigned int flags)
{ {
if (mark_supplied == 0)
xtables_error(PARAMETER_PROBLEM, "No mark value supplied");
if (!flags) if (!flags)
xtables_error(PARAMETER_PROBLEM, xtables_error(PARAMETER_PROBLEM,
"You must specify some option"); "You must specify some option");
......
extensions/libebt_vlan.c
View file @ c2d7e04a
...@@ -12,7 +12,6 @@ ...@@ -12,7 +12,6 @@
#include <getopt.h> #include <getopt.h>
#include <ctype.h> #include <ctype.h>
#include <xtables.h> #include <xtables.h>
#include <ebtables/ethernetdb.h>
#include <linux/netfilter_bridge/ebt_vlan.h> #include <linux/netfilter_bridge/ebt_vlan.h>
#include <linux/if_ether.h> #include <linux/if_ether.h>
#include "iptables/nft.h" #include "iptables/nft.h"
...@@ -50,82 +49,12 @@ static void brvlan_print_help(void) ...@@ -50,82 +49,12 @@ static void brvlan_print_help(void)
"--vlan-encap [!] encap : Encapsulated frame protocol (hexadecimal or name)\n"); "--vlan-encap [!] encap : Encapsulated frame protocol (hexadecimal or name)\n");
} }
static struct ethertypeent *vlan_getethertypeent(FILE *etherf, const char *name)
{
static struct ethertypeent et_ent;
char *e, *found_name;
char line[1024];
while ((e = fgets(line, sizeof(line), etherf))) {
char *endptr, *cp;
if (*e == '#')
continue;
cp = strpbrk(e, "#\n");
if (cp == NULL)
continue;
*cp = '\0';
found_name = e;
cp = strpbrk(e, " \t");
if (cp == NULL)
continue;
*cp++ = '\0';
while (*cp == ' ' || *cp == '\t')
cp++;
e = strpbrk(cp, " \t");
if (e != NULL)
*e++ = '\0';
et_ent.e_ethertype = strtol(cp, &endptr, 16);
if (*endptr != '\0' ||
(et_ent.e_ethertype < ETH_ZLEN || et_ent.e_ethertype > 0xFFFF))
continue; // skip invalid etherproto type entry
if (strcasecmp(found_name, name) == 0)
return (&et_ent);
if (e != NULL) {
cp = e;
while (cp && *cp) {
if (*cp == ' ' || *cp == '\t') {
cp++;
continue;
}
e = cp;
cp = strpbrk(cp, " \t");
if (cp != NULL)
*cp++ = '\0';
if (strcasecmp(e, name) == 0)
return (&et_ent);
e = cp;
}
}
}
return NULL;
}
static struct ethertypeent *brvlan_getethertypebyname(const char *name)
{
struct ethertypeent *e;
FILE *etherf;
etherf = fopen(_PATH_ETHERTYPES, "r");
e = vlan_getethertypeent(etherf, name);
fclose(etherf);
return (e);
}
static int static int
brvlan_parse(int c, char **argv, int invert, unsigned int *flags, brvlan_parse(int c, char **argv, int invert, unsigned int *flags,
const void *entry, struct xt_entry_match **match) const void *entry, struct xt_entry_match **match)
{ {
struct ebt_vlan_info *vlaninfo = (struct ebt_vlan_info *) (*match)->data; struct ebt_vlan_info *vlaninfo = (struct ebt_vlan_info *) (*match)->data;
struct ethertypeent *ethent; struct xt_ethertypeent *ethent;
char *end; char *end;
struct ebt_vlan_info local; struct ebt_vlan_info local;
...@@ -156,7 +85,7 @@ brvlan_parse(int c, char **argv, int invert, unsigned int *flags, ...@@ -156,7 +85,7 @@ brvlan_parse(int c, char **argv, int invert, unsigned int *flags,
vlaninfo->invflags |= EBT_VLAN_ENCAP; vlaninfo->invflags |= EBT_VLAN_ENCAP;
local.encap = strtoul(optarg, &end, 16); local.encap = strtoul(optarg, &end, 16);
if (*end != '\0') { if (*end != '\0') {
ethent = brvlan_getethertypebyname(optarg); ethent = xtables_getethertypebyname(optarg);
if (ethent == NULL) if (ethent == NULL)
xtables_error(PARAMETER_PROBLEM, "Unknown --vlan-encap value ('%s')", optarg); xtables_error(PARAMETER_PROBLEM, "Unknown --vlan-encap value ('%s')", optarg);
local.encap = ethent->e_ethertype; local.encap = ethent->e_ethertype;
......
extensions/libip6t_REJECT.c
View file @ c2d7e04a
...@@ -13,13 +13,8 @@ ...@@ -13,13 +13,8 @@
struct reject_names { struct reject_names {
const char *name; const char *name;
const char *alias; const char *alias;
enum ip6t_reject_with with;
const char *desc; const char *desc;
}; const char *xlate;
struct reject_names_xlate {
const char *name;
enum ip6t_reject_with with;
}; };
enum { enum {
...@@ -27,24 +22,50 @@ enum { ...@@ -27,24 +22,50 @@ enum {
}; };
static const struct reject_names reject_table[] = { static const struct reject_names reject_table[] = {
{"icmp6-no-route", "no-route", [IP6T_ICMP6_NO_ROUTE] = {
IP6T_ICMP6_NO_ROUTE, "ICMPv6 no route"}, "icmp6-no-route", "no-route",
{"icmp6-adm-prohibited", "adm-prohibited", "ICMPv6 no route",
IP6T_ICMP6_ADM_PROHIBITED, "ICMPv6 administratively prohibited"}, "no-route",
},
[IP6T_ICMP6_ADM_PROHIBITED] = {
"icmp6-adm-prohibited", "adm-prohibited",
"ICMPv6 administratively prohibited",
"admin-prohibited",
},
#if 0 #if 0
{"icmp6-not-neighbor", "not-neighbor"}, [IP6T_ICMP6_NOT_NEIGHBOR] = {
IP6T_ICMP6_NOT_NEIGHBOR, "ICMPv6 not a neighbor"}, "icmp6-not-neighbor", "not-neighbor",
"ICMPv6 not a neighbor",
},
#endif #endif
{"icmp6-addr-unreachable", "addr-unreach", [IP6T_ICMP6_ADDR_UNREACH] = {
IP6T_ICMP6_ADDR_UNREACH, "ICMPv6 address unreachable"}, "icmp6-addr-unreachable", "addr-unreach",
{"icmp6-port-unreachable", "port-unreach", "ICMPv6 address unreachable",
IP6T_ICMP6_PORT_UNREACH, "ICMPv6 port unreachable"}, "addr-unreachable",
{"tcp-reset", "tcp-reset", },
IP6T_TCP_RESET, "TCP RST packet"}, [IP6T_ICMP6_PORT_UNREACH] = {
{"icmp6-policy-fail", "policy-fail", "icmp6-port-unreachable", "port-unreach",
IP6T_ICMP6_POLICY_FAIL, "ICMPv6 policy fail"}, "ICMPv6 port unreachable",
{"icmp6-reject-route", "reject-route", "port-unreachable",
IP6T_ICMP6_REJECT_ROUTE, "ICMPv6 reject route"} },
#if 0
[IP6T_ICMP6_ECHOREPLY] = {},
#endif
[IP6T_TCP_RESET] = {
"tcp-reset", "tcp-reset",
"TCP RST packet",
"tcp reset",
},
[IP6T_ICMP6_POLICY_FAIL] = {
"icmp6-policy-fail", "policy-fail",
"ICMPv6 policy fail",
"policy-fail",
},
[IP6T_ICMP6_REJECT_ROUTE] = {
"icmp6-reject-route", "reject-route",
"ICMPv6 reject route",
"reject-route",
},
}; };
static void static void
...@@ -55,6 +76,8 @@ print_reject_types(void) ...@@ -55,6 +76,8 @@ print_reject_types(void)
printf("Valid reject types:\n"); printf("Valid reject types:\n");
for (i = 0; i < ARRAY_SIZE(reject_table); ++i) { for (i = 0; i < ARRAY_SIZE(reject_table); ++i) {
if (!reject_table[i].name)
continue;
printf(" %-25s\t%s\n", reject_table[i].name, reject_table[i].desc); printf(" %-25s\t%s\n", reject_table[i].name, reject_table[i].desc);
printf(" %-25s\talias\n", reject_table[i].alias); printf(" %-25s\talias\n", reject_table[i].alias);
} }
...@@ -91,14 +114,17 @@ static void REJECT_parse(struct xt_option_call *cb) ...@@ -91,14 +114,17 @@ static void REJECT_parse(struct xt_option_call *cb)
unsigned int i; unsigned int i;
xtables_option_parse(cb); xtables_option_parse(cb);
for (i = 0; i < ARRAY_SIZE(reject_table); ++i) for (i = 0; i < ARRAY_SIZE(reject_table); ++i) {
if (!reject_table[i].name)
continue;
if (strncasecmp(reject_table[i].name, if (strncasecmp(reject_table[i].name,
cb->arg, strlen(cb->arg)) == 0 || cb->arg, strlen(cb->arg)) == 0 ||
strncasecmp(reject_table[i].alias, strncasecmp(reject_table[i].alias,
cb->arg, strlen(cb->arg)) == 0) { cb->arg, strlen(cb->arg)) == 0) {
reject->with = reject_table[i].with; reject->with = i;
return; return;
} }
}
xtables_error(PARAMETER_PROBLEM, xtables_error(PARAMETER_PROBLEM,
"unknown reject type \"%s\"", cb->arg); "unknown reject type \"%s\"", cb->arg);
} }
...@@ -108,55 +134,32 @@ static void REJECT_print(const void *ip, const struct xt_entry_target *target, ...@@ -108,55 +134,32 @@ static void REJECT_print(const void *ip, const struct xt_entry_target *target,
{ {
const struct ip6t_reject_info *reject const struct ip6t_reject_info *reject
= (const struct ip6t_reject_info *)target->data; = (const struct ip6t_reject_info *)target->data;
unsigned int i;
for (i = 0; i < ARRAY_SIZE(reject_table); ++i) printf(" reject-with %s", reject_table[reject->with].name);
if (reject_table[i].with == reject->with)
break;
printf(" reject-with %s", reject_table[i].name);
} }
static void REJECT_save(const void *ip, const struct xt_entry_target *target) static void REJECT_save(const void *ip, const struct xt_entry_target *target)
{ {
const struct ip6t_reject_info *reject const struct ip6t_reject_info *reject
= (const struct ip6t_reject_info *)target->data; = (const struct ip6t_reject_info *)target->data;
unsigned int i;
for (i = 0; i < ARRAY_SIZE(reject_table); ++i) printf(" --reject-with %s", reject_table[reject->with].name);
if (reject_table[i].with == reject->with)
break;
printf(" --reject-with %s", reject_table[i].name);
} }
static const struct reject_names_xlate reject_table_xlate[] = {
{"no-route", IP6T_ICMP6_NO_ROUTE},
{"admin-prohibited", IP6T_ICMP6_ADM_PROHIBITED},
{"addr-unreachable", IP6T_ICMP6_ADDR_UNREACH},
{"port-unreachable", IP6T_ICMP6_PORT_UNREACH},
{"tcp reset", IP6T_TCP_RESET},
{"policy-fail", IP6T_ICMP6_POLICY_FAIL},
{"reject-route", IP6T_ICMP6_REJECT_ROUTE}
};
static int REJECT_xlate(struct xt_xlate *xl, static int REJECT_xlate(struct xt_xlate *xl,
const struct xt_xlate_tg_params *params) const struct xt_xlate_tg_params *params)
{ {
const struct ip6t_reject_info *reject = const struct ip6t_reject_info *reject =
(const struct ip6t_reject_info *)params->target->data; (const struct ip6t_reject_info *)params->target->data;
unsigned int i;
for (i = 0; i < ARRAY_SIZE(reject_table_xlate); ++i)
if (reject_table_xlate[i].with == reject->with)
break;
if (reject->with == IP6T_ICMP6_PORT_UNREACH) if (reject->with == IP6T_ICMP6_PORT_UNREACH)
xt_xlate_add(xl, "reject"); xt_xlate_add(xl, "reject");
else if (reject->with == IP6T_TCP_RESET) else if (reject->with == IP6T_TCP_RESET)
xt_xlate_add(xl, "reject with %s", reject_table_xlate[i].name); xt_xlate_add(xl, "reject with %s",
reject_table[reject->with].xlate);
else else
xt_xlate_add(xl, "reject with icmpv6 type %s", xt_xlate_add(xl, "reject with icmpv6 type %s",
reject_table_xlate[i].name); reject_table[reject->with].xlate);
return 1; return 1;
} }
......
extensions/libip6t_hbh.c
View file @ c2d7e04a
...@@ -5,8 +5,6 @@ ...@@ -5,8 +5,6 @@
#include <xtables.h> #include <xtables.h>
#include <linux/netfilter_ipv6/ip6t_opts.h> #include <linux/netfilter_ipv6/ip6t_opts.h>
#define DEBUG 0
enum { enum {
O_HBH_LEN = 0, O_HBH_LEN = 0,
O_HBH_OPTS, O_HBH_OPTS,
...@@ -83,7 +81,7 @@ parse_options(const char *optsstr, uint16_t *opts) ...@@ -83,7 +81,7 @@ parse_options(const char *optsstr, uint16_t *opts)
opts[i] |= (0x00FF); opts[i] |= (0x00FF);
} }
#if DEBUG #ifdef DEBUG
printf("opts str: %s %s\n", cp, range); printf("opts str: %s %s\n", cp, range);
printf("opts opt: %04X\n", opts[i]); printf("opts opt: %04X\n", opts[i]);
#endif #endif
...@@ -92,7 +90,7 @@ parse_options(const char *optsstr, uint16_t *opts) ...@@ -92,7 +90,7 @@ parse_options(const char *optsstr, uint16_t *opts)
free(buffer); free(buffer);
#if DEBUG #ifdef DEBUG
printf("addr nr: %d\n", i); printf("addr nr: %d\n", i);
#endif #endif
......
extensions/libip6t_mh.txlate
View file @ c2d7e04a
ip6tables-translate -A INPUT -p mh --mh-type 1 -j ACCEPT ip6tables-translate -A INPUT -p mh --mh-type 1 -j ACCEPT
nft add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter accept nft add rule ip6 filter INPUT meta l4proto 135 mh type 1 counter accept
ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT
nft add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept nft add rule ip6 filter INPUT meta l4proto 135 mh type 1-3 counter accept
extensions/libipt_REJECT.c
View file @ c2d7e04a
...@@ -20,13 +20,8 @@ ...@@ -20,13 +20,8 @@
struct reject_names { struct reject_names {
const char *name; const char *name;
const char *alias; const char *alias;
enum ipt_reject_with with;
const char *desc; const char *desc;
}; const char *xlate;
struct reject_names_xlate {
const char *name;
enum ipt_reject_with with;
}; };
enum { enum {
...@@ -34,26 +29,53 @@ enum { ...@@ -34,26 +29,53 @@ enum {
}; };
static const struct reject_names reject_table[] = { static const struct reject_names reject_table[] = {
{"icmp-net-unreachable", "net-unreach", [IPT_ICMP_NET_UNREACHABLE] = {
IPT_ICMP_NET_UNREACHABLE, "ICMP network unreachable"}, "icmp-net-unreachable", "net-unreach",
{"icmp-host-unreachable", "host-unreach", "ICMP network unreachable",
IPT_ICMP_HOST_UNREACHABLE, "ICMP host unreachable"}, "net-unreachable",
{"icmp-proto-unreachable", "proto-unreach", },
IPT_ICMP_PROT_UNREACHABLE, "ICMP protocol unreachable"}, [IPT_ICMP_HOST_UNREACHABLE] = {
{"icmp-port-unreachable", "port-unreach", "icmp-host-unreachable", "host-unreach",
IPT_ICMP_PORT_UNREACHABLE, "ICMP port unreachable (default)"}, "ICMP host unreachable",
"host-unreachable",
},
[IPT_ICMP_PROT_UNREACHABLE] = {
"icmp-proto-unreachable", "proto-unreach",
"ICMP protocol unreachable",
"prot-unreachable",
},
[IPT_ICMP_PORT_UNREACHABLE] = {
"icmp-port-unreachable", "port-unreach",
"ICMP port unreachable (default)",
"port-unreachable",
},
#if 0 #if 0
{"echo-reply", "echoreply", [IPT_ICMP_ECHOREPLY] = {
IPT_ICMP_ECHOREPLY, "for ICMP echo only: faked ICMP echo reply"}, "echo-reply", "echoreply",
"for ICMP echo only: faked ICMP echo reply",
"echo-reply",
},
#endif #endif
{"icmp-net-prohibited", "net-prohib", [IPT_ICMP_NET_PROHIBITED] = {
IPT_ICMP_NET_PROHIBITED, "ICMP network prohibited"}, "icmp-net-prohibited", "net-prohib",
{"icmp-host-prohibited", "host-prohib", "ICMP network prohibited",
IPT_ICMP_HOST_PROHIBITED, "ICMP host prohibited"}, "net-prohibited",
{"tcp-reset", "tcp-rst", },
IPT_TCP_RESET, "TCP RST packet"}, [IPT_ICMP_HOST_PROHIBITED] = {
{"icmp-admin-prohibited", "admin-prohib", "icmp-host-prohibited", "host-prohib",
IPT_ICMP_ADMIN_PROHIBITED, "ICMP administratively prohibited (*)"} "ICMP host prohibited",
"host-prohibited",
},
[IPT_TCP_RESET] = {
"tcp-reset", "tcp-rst",
"TCP RST packet",
"tcp reset",
},
[IPT_ICMP_ADMIN_PROHIBITED] = {
"icmp-admin-prohibited", "admin-prohib",
"ICMP administratively prohibited (*)",
"admin-prohibited",
},
}; };
static void static void
...@@ -64,6 +86,8 @@ print_reject_types(void) ...@@ -64,6 +86,8 @@ print_reject_types(void)
printf("Valid reject types:\n"); printf("Valid reject types:\n");
for (i = 0; i < ARRAY_SIZE(reject_table); ++i) { for (i = 0; i < ARRAY_SIZE(reject_table); ++i) {
if (!reject_table[i].name)
continue;
printf(" %-25s\t%s\n", reject_table[i].name, reject_table[i].desc); printf(" %-25s\t%s\n", reject_table[i].name, reject_table[i].desc);
printf(" %-25s\talias\n", reject_table[i].alias); printf(" %-25s\talias\n", reject_table[i].alias);
} }
...@@ -102,14 +126,17 @@ static void REJECT_parse(struct xt_option_call *cb) ...@@ -102,14 +126,17 @@ static void REJECT_parse(struct xt_option_call *cb)
unsigned int i; unsigned int i;
xtables_option_parse(cb); xtables_option_parse(cb);
for (i = 0; i < ARRAY_SIZE(reject_table); ++i) for (i = 0; i < ARRAY_SIZE(reject_table); ++i) {
if (!reject_table[i].name)
continue;
if (strncasecmp(reject_table[i].name, if (strncasecmp(reject_table[i].name,
cb->arg, strlen(cb->arg)) == 0 || cb->arg, strlen(cb->arg)) == 0 ||
strncasecmp(reject_table[i].alias, strncasecmp(reject_table[i].alias,
cb->arg, strlen(cb->arg)) == 0) { cb->arg, strlen(cb->arg)) == 0) {
reject->with = reject_table[i].with; reject->with = i;
return; return;
} }
}
/* This due to be dropped late in 2.4 pre-release cycle --RR */ /* This due to be dropped late in 2.4 pre-release cycle --RR */
if (strncasecmp("echo-reply", cb->arg, strlen(cb->arg)) == 0 || if (strncasecmp("echo-reply", cb->arg, strlen(cb->arg)) == 0 ||
strncasecmp("echoreply", cb->arg, strlen(cb->arg)) == 0) strncasecmp("echoreply", cb->arg, strlen(cb->arg)) == 0)
...@@ -124,61 +151,32 @@ static void REJECT_print(const void *ip, const struct xt_entry_target *target, ...@@ -124,61 +151,32 @@ static void REJECT_print(const void *ip, const struct xt_entry_target *target,
{ {
const struct ipt_reject_info *reject const struct ipt_reject_info *reject
= (const struct ipt_reject_info *)target->data; = (const struct ipt_reject_info *)target->data;
unsigned int i;
for (i = 0; i < ARRAY_SIZE(reject_table); ++i) printf(" reject-with %s", reject_table[reject->with].name);
if (reject_table[i].with == reject->with)
break;
printf(" reject-with %s", reject_table[i].name);
} }
static void REJECT_save(const void *ip, const struct xt_entry_target *target) static void REJECT_save(const void *ip, const struct xt_entry_target *target)
{ {
const struct ipt_reject_info *reject = const struct ipt_reject_info *reject =
(const struct ipt_reject_info *)target->data; (const struct ipt_reject_info *)target->data;
unsigned int i;
for (i = 0; i < ARRAY_SIZE(reject_table); ++i)
if (reject_table[i].with == reject->with)
break;
printf(" --reject-with %s", reject_table[i].name); printf(" --reject-with %s", reject_table[reject->with].name);
} }
static const struct reject_names_xlate reject_table_xlate[] = {
{"net-unreachable", IPT_ICMP_NET_UNREACHABLE},
{"host-unreachable", IPT_ICMP_HOST_UNREACHABLE},
{"prot-unreachable", IPT_ICMP_PROT_UNREACHABLE},
{"port-unreachable", IPT_ICMP_PORT_UNREACHABLE},
#if 0
{"echo-reply", IPT_ICMP_ECHOREPLY},
#endif
{"net-prohibited", IPT_ICMP_NET_PROHIBITED},
{"host-prohibited", IPT_ICMP_HOST_PROHIBITED},
{"tcp reset", IPT_TCP_RESET},
{"admin-prohibited", IPT_ICMP_ADMIN_PROHIBITED}
};
static int REJECT_xlate(struct xt_xlate *xl, static int REJECT_xlate(struct xt_xlate *xl,
const struct xt_xlate_tg_params *params) const struct xt_xlate_tg_params *params)
{ {
const struct ipt_reject_info *reject = const struct ipt_reject_info *reject =
(const struct ipt_reject_info *)params->target->data; (const struct ipt_reject_info *)params->target->data;
unsigned int i;
for (i = 0; i < ARRAY_SIZE(reject_table_xlate); ++i) {
if (reject_table_xlate[i].with == reject->with)
break;
}
if (reject->with == IPT_ICMP_PORT_UNREACHABLE) if (reject->with == IPT_ICMP_PORT_UNREACHABLE)
xt_xlate_add(xl, "reject"); xt_xlate_add(xl, "reject");
else if (reject->with == IPT_TCP_RESET) else if (reject->with == IPT_TCP_RESET)
xt_xlate_add(xl, "reject with %s", xt_xlate_add(xl, "reject with %s",
reject_table_xlate[i].name); reject_table[reject->with].xlate);
else else
xt_xlate_add(xl, "reject with icmp type %s", xt_xlate_add(xl, "reject with icmp type %s",
reject_table_xlate[i].name); reject_table[reject->with].xlate);
return 1; return 1;
} }
......
extensions/libxt_AUDIT.c
View file @ c2d7e04a
...@@ -82,6 +82,16 @@ static void audit_save(const void *ip, const struct xt_entry_target *target) ...@@ -82,6 +82,16 @@ static void audit_save(const void *ip, const struct xt_entry_target *target)
} }
} }
static int audit_xlate(struct xt_xlate *xl,
const struct xt_xlate_tg_params *params)
{
/* audit type is merely sanity checked by xt_AUDIT.ko,
* so nftables doesn't even support it */
xt_xlate_add(xl, "log level audit");
return 1;
}
static struct xtables_target audit_tg_reg = { static struct xtables_target audit_tg_reg = {
.name = "AUDIT", .name = "AUDIT",
.version = XTABLES_VERSION, .version = XTABLES_VERSION,
...@@ -93,6 +103,7 @@ static struct xtables_target audit_tg_reg = { ...@@ -93,6 +103,7 @@ static struct xtables_target audit_tg_reg = {
.save = audit_save, .save = audit_save,
.x6_parse = audit_parse, .x6_parse = audit_parse,
.x6_options = audit_opts, .x6_options = audit_opts,
.xlate = audit_xlate,
}; };
void _init(void) void _init(void)
......
extensions/libxt_AUDIT.txlate 0 → 100644
View file @ c2d7e04a
iptables-translate -t filter -A INPUT -j AUDIT --type accept
nft add rule ip filter INPUT counter log level audit
iptables-translate -t filter -A INPUT -j AUDIT --type drop
nft add rule ip filter INPUT counter log level audit
iptables-translate -t filter -A INPUT -j AUDIT --type reject
nft add rule ip filter INPUT counter log level audit
extensions/libxt_LED.c
View file @ c2d7e04a
...@@ -53,8 +53,7 @@ static void LED_parse(struct xt_option_call *cb) ...@@ -53,8 +53,7 @@ static void LED_parse(struct xt_option_call *cb)
xtables_option_parse(cb); xtables_option_parse(cb);
switch (cb->entry->id) { switch (cb->entry->id) {
case O_LED_TRIGGER_ID: case O_LED_TRIGGER_ID:
strcpy(led->id, "netfilter-"); snprintf(led->id, sizeof(led->id), "netfilter-%s", cb->arg);
strcat(led->id, cb->arg);
break; break;
case O_LED_DELAY: case O_LED_DELAY:
if (strncasecmp(cb->arg, "inf", 3) == 0) if (strncasecmp(cb->arg, "inf", 3) == 0)
......
extensions/libxt_cgroup.c
View file @ c2d7e04a
...@@ -51,6 +51,24 @@ static const struct xt_option_entry cgroup_opts_v1[] = { ...@@ -51,6 +51,24 @@ static const struct xt_option_entry cgroup_opts_v1[] = {
XTOPT_TABLEEND, XTOPT_TABLEEND,
}; };
static const struct xt_option_entry cgroup_opts_v2[] = {
{
.name = "path",
.id = O_PATH,
.type = XTTYPE_STRING,
.flags = XTOPT_INVERT | XTOPT_PUT,
XTOPT_POINTER(struct xt_cgroup_info_v2, path)
},
{
.name = "cgroup",
.id = O_CLASSID,
.type = XTTYPE_UINT32,
.flags = XTOPT_INVERT | XTOPT_PUT,
XTOPT_POINTER(struct xt_cgroup_info_v2, classid)
},
XTOPT_TABLEEND,
};
static void cgroup_parse_v0(struct xt_option_call *cb) static void cgroup_parse_v0(struct xt_option_call *cb)
{ {
struct xt_cgroup_info_v0 *cgroupinfo = cb->data; struct xt_cgroup_info_v0 *cgroupinfo = cb->data;
...@@ -80,6 +98,26 @@ static void cgroup_parse_v1(struct xt_option_call *cb) ...@@ -80,6 +98,26 @@ static void cgroup_parse_v1(struct xt_option_call *cb)
} }
} }
static void cgroup_parse_v2(struct xt_option_call *cb)
{
struct xt_cgroup_info_v2 *info = cb->data;
xtables_option_parse(cb);
switch (cb->entry->id) {
case O_PATH:
info->has_path = true;
if (cb->invert)
info->invert_path = true;
break;
case O_CLASSID:
info->has_classid = true;
if (cb->invert)
info->invert_classid = true;
break;
}
}
static void static void
cgroup_print_v0(const void *ip, const struct xt_entry_match *match, int numeric) cgroup_print_v0(const void *ip, const struct xt_entry_match *match, int numeric)
{ {
...@@ -121,6 +159,32 @@ static void cgroup_save_v1(const void *ip, const struct xt_entry_match *match) ...@@ -121,6 +159,32 @@ static void cgroup_save_v1(const void *ip, const struct xt_entry_match *match)
info->classid); info->classid);
} }
static void
cgroup_print_v2(const void *ip, const struct xt_entry_match *match, int numeric)
{
const struct xt_cgroup_info_v2 *info = (void *)match->data;
printf(" cgroup");
if (info->has_path)
printf(" %s%s", info->invert_path ? "! ":"", info->path);
if (info->has_classid)
printf(" %s%u", info->invert_classid ? "! ":"", info->classid);
}
static void cgroup_save_v2(const void *ip, const struct xt_entry_match *match)
{
const struct xt_cgroup_info_v2 *info = (void *)match->data;
if (info->has_path) {
printf("%s --path", info->invert_path ? " !" : "");
xtables_save_string(info->path);
}
if (info->has_classid)
printf("%s --cgroup %u", info->invert_classid ? " !" : "",
info->classid);
}
static int cgroup_xlate_v0(struct xt_xlate *xl, static int cgroup_xlate_v0(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params) const struct xt_xlate_mt_params *params)
{ {
...@@ -147,6 +211,22 @@ static int cgroup_xlate_v1(struct xt_xlate *xl, ...@@ -147,6 +211,22 @@ static int cgroup_xlate_v1(struct xt_xlate *xl,
return 1; return 1;
} }
static int cgroup_xlate_v2(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params)
{
const struct xt_cgroup_info_v2 *info = (void *)params->match->data;
if (info->has_path)
return 0;
if (info->has_classid)
xt_xlate_add(xl, "meta cgroup %s%u",
info->invert_classid ? "!= " : "",
info->classid);
return 1;
}
static struct xtables_match cgroup_match[] = { static struct xtables_match cgroup_match[] = {
{ {
.family = NFPROTO_UNSPEC, .family = NFPROTO_UNSPEC,
...@@ -176,6 +256,20 @@ static struct xtables_match cgroup_match[] = { ...@@ -176,6 +256,20 @@ static struct xtables_match cgroup_match[] = {
.x6_options = cgroup_opts_v1, .x6_options = cgroup_opts_v1,
.xlate = cgroup_xlate_v1, .xlate = cgroup_xlate_v1,
}, },
{
.family = NFPROTO_UNSPEC,
.revision = 2,
.name = "cgroup",
.version = XTABLES_VERSION,
.size = XT_ALIGN(sizeof(struct xt_cgroup_info_v2)),
.userspacesize = offsetof(struct xt_cgroup_info_v2, priv),
.help = cgroup_help_v1,
.print = cgroup_print_v2,
.save = cgroup_save_v2,
.x6_parse = cgroup_parse_v2,
.x6_options = cgroup_opts_v2,
.xlate = cgroup_xlate_v2,
},
}; };
void _init(void) void _init(void)
......
extensions/libxt_conntrack.c
View file @ c2d7e04a
...@@ -673,20 +673,20 @@ static void ...@@ -673,20 +673,20 @@ static void
print_addr(const struct in_addr *addr, const struct in_addr *mask, print_addr(const struct in_addr *addr, const struct in_addr *mask,
int inv, int numeric) int inv, int numeric)
{ {
char buf[BUFSIZ];
if (inv) if (inv)
printf(" !"); printf(" !");
if (mask->s_addr == 0L && !numeric) if (mask->s_addr == 0L && !numeric)
printf(" %s", "anywhere"); printf(" anywhere");
else { else {
if (numeric) if (numeric)
strcpy(buf, xtables_ipaddr_to_numeric(addr)); printf(" %s%s",
xtables_ipaddr_to_numeric(addr),
xtables_ipmask_to_numeric(mask));
else else
strcpy(buf, xtables_ipaddr_to_anyname(addr)); printf(" %s%s",
strcat(buf, xtables_ipmask_to_numeric(mask)); xtables_ipaddr_to_anyname(addr),
printf(" %s", buf); xtables_ipmask_to_numeric(mask));
} }
} }
...@@ -774,14 +774,6 @@ matchinfo_print(const void *ip, const struct xt_entry_match *match, int numeric, ...@@ -774,14 +774,6 @@ matchinfo_print(const void *ip, const struct xt_entry_match *match, int numeric,
else else
printf("%lu:%lu", sinfo->expires_min, sinfo->expires_max); printf("%lu:%lu", sinfo->expires_min, sinfo->expires_max);
} }
if (sinfo->flags & XT_CONNTRACK_DIRECTION) {
if (sinfo->invflags & XT_CONNTRACK_DIRECTION)
printf(" %sctdir REPLY", optpfx);
else
printf(" %sctdir ORIGINAL", optpfx);
}
} }
static void static void
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment