| Age | Commit message (Collapse) | Author |
|---|
|
* Keep the generated files needed for building.
Used
./configure --enable-static --disable-shared
make
* Update the various Android *.mk files.
Change-Id: If0e45cf6289f0e3dcf3adf73e6ccff86d640f1c0
Signed-off-by: JP Abgrall <jpa@google.com>
|
|
Conflicts:
.gitignore
include/linux/types.h
libiptc/libiptc.c
Change-Id: I2c949ba9de090db9ae09d914f4ac5c13e5b7d4da
|
|
|
|
We can just use the uapi headers now.
(This is probably true for most of these header files, but I just want
to undo the changes we made during the uapi transition.)
Change-Id: I4ab0c6f782f73699595a2ce24809a2c0187c98f8
|
|
|
|
local-intermediates-dir doesn't work for multiarch builds, because
each architecture needs a separate intermediates dir. Use
local-generated-sources-dir, which gives a directory under $OUT/gen
that can be shared by both architectures. Files installed into
$OUT/gen/*/*_intermediates and listed in LOCAL_GENERATED_SOURCES
will be copied into $OUT/obj*/*/*_intermediates automatically as
necessary.
(cherry picked from commit b4ad8a418b48b6a7df8f88a276c52f00c1bb43af)
Change-Id: I35ed4bc51e694ca4dc8343bc59977f1daeae3abc
|
|
|
|
This reverts commit b4ad8a418b48b6a7df8f88a276c52f00c1bb43af.
Change-Id: I7870513ad908957a1370cd8e1f7c0a80d8fbb7bb
|
|
* changes:
external/iptables: use local-generated-sources-dir
iptables: rewrite extensions makefile to avoid duplication
|
|
local-intermediates-dir doesn't work for multiarch builds, because
each architecture needs a separate intermediates dir. Use
local-generated-sources-dir, which gives a directory under $OUT/gen
that can be shared by both architectures. Files installed into
$OUT/gen/*/*_intermediates and listed in LOCAL_GENERATED_SOURCES
will be copied into $OUT/obj*/*/*_intermediates automatically as
necessary.
Change-Id: I78e7898147a0e2303e814e8b93f7cd0edbd2914e
|
|
Move the duplicated parts of the extensions makefile into a
separate libext.mk, and include it 3 times from the main makefile.
Change-Id: Idcbe1da8e024af895da33e396595e616f52e25ad
|
|
|
|
The kernel headers are already in the include path, and manually
adding them again will break on a multiarch build, where the
kernel headers may be different for each arch.
Change-Id: I20867af3061bbc86d2205f5479c40f6034a61b72
|
|
|
|
Change-Id: I9d180c2da268117a8774290ba49c8774fabd3272
|
|
|
|
Bug: 11559337
Change-Id: Iefb938b87e1f29cbf45d8833e9416c38004d9b5e
|
|
Linking currently fails in --enable-static case:
../extensions/libext.a(libxt_connlabel.o): In function `connlabel_get_name':
iptables/extensions/libxt_connlabel.c:57: undefined reference to `nfct_labelmap_get_name'
[..]
It's libxtables.la(libxt_connlabel.o) using libnetfilter_conntrack.
If libnetfilter_conntrack is not found, @libnetfilter_conntrack_CFLAGS@
and @libnetfilter_conntrack_LIBS@ (and their ${} ones) should be empty,
therefore producing no harm to include unconditionally.
Reported-and-tested-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
|
|
As reported in Debian bug #718810 [1], state match rules added in < 1.4.16
iptables versions are incorrectly displayed by >= 1.4.16 iptables versions.
Issue bisected to commit 0d701631 (libxt_state: replace as an alias to
xt_conntrack).
Fix this by adding the missing .print and .save functions for state match
aliases in the conntrack match.
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718810
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Since (14bca55 iptables: use autoconf to process .in man pages),
the file "iptables-extensions.8.tmpl" is generated from
"iptables-extensions.8.tmpl.in" and is consequently no
longer found in ${srcdir} but in the build directory.
(Becomes visible with builddir != srcdir)
Signed-off-by: Lutz Jaenicke <ljaenicke@innominate.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Similar to (2165f38 iptables-restore: fix parameter parsing
(shows up with gcc-4.7)), make sure iptables-xml doesn't hit
the same problem.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
There are two bugs in iptables-xml do_rule_part parsing corrected by this patch:
1) Ignore "-A <chain>" instead of just "-A"
2) When checking to see if we need a <match> tag, inversion needs to be taken
into account
This closes netfilter bugzilla #679.
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
The build of utils/nfbpf_compile depends on libpcap. If configure is
run with --enable-bpf-compiler, the script succeeds, but make fails.
This small patch adds a test for the dependency (libpcap) in configure
and fails hard if not found.
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
After kernel commit 607ca46e (UAPI: (Scripted) Disintegrate
include/linux), using the "--with-kernel" argument to build iptables
stopped working due to the missing #ifdefs in the original files.
We need to make sure the UAPI include dir is listed before the
original location. Leaving both allows support for old and new
kernels.
This fixes bug #833.
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Available since Linux kernel 3.8.
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
libipt_LOG is using the xtables_save_string func, which
escapes unsafe characters as needed. libip6t_LOG should
do the same.
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
This checking was accidentally removed in (74ded72 libxt_recent:
add --mask netmask).
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Pablo suggested to make it depend on lnf-conntrack, and get rid of
the example config file as well.
The problem is that the file must be in a fixed path,
/etc/xtables/connlabel.conf, else userspace needs to "guess-the-right-file"
when translating names to their bit values (and vice versa).
Originally "make install" did put an example file into /etc/xtables/,
but distributors complained about iptables ignoring the sysconfdir.
So rather remove the example file, the man-page explains the format,
and connlabels are inherently system-specific anyway.
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
The reap functionality appears to have been accidentally disabled
by (74ded72 libxt_recent: add --mask netmask) since iptables 1.4.15
and later. This adds a patch to restore reap functionality for
recent_opts_v1.
Patch obtained via: http://patchwork.openwrt.org/patch/3812/
Signed-off-by: Russell Senior <russell@personaltelco.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Since (93587a0 ip[6]tables: Add locking to prevent concurrent instances),
ip{6}tables-restore does not work anymore:
iptables-restore < x
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
do_command{6}(...) is called from ip{6}tables-restore for every iptables
command contained in the rule-set file. Thus, hitting the lock error
after the second command.
Fix it by bypassing the locking in the ip{6}tables-restore path.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Similar to how iptables does not print /32 on IPv4 addresses, ip6tables
should not print out /128 on IPv6 addresses.
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
|
|
Signed-off-by: Alexey Perevalov <a.perevalov@samsung.com>
Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org>
|
|
Get c545933 iptables: Fix connlabel.conf install location
|
|
As reported by Danny Rawlins in bug #828, connlabel.conf is
unconditionally installed in /etc/xtables instead of using
prefix set at configure time. Fix to use sysconfdir variable.
This closes bugzilla #828.
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
There have been numerous complaints and bug reports over the years when admins
attempt to run more than one instance of iptables simultaneously. Currently
open bug reports which are related:
325: Parallel execution of the iptables is impossible
758: Retry iptables command on transient failure
764: Doing -Z twice in parallel breaks counters
822: iptables shows negative or other bad packet/byte counts
As Patrick notes in 325: "Since this has been a problem people keep running
into, I'd suggest to simply add some locking to iptables to catch the most
common case."
I started looking into alternatives to add locking, and of course the most
common/obvious solution is to use a pidfile. But this has various downsides,
such as if the application is terminated abnormally and the pidfile isn't
cleaned up. And this also requires a writable filesystem. Using a UNIX domain
socket file (e.g. in /var/run) has similar issues.
Starting in 2.2, Linux added support for abstract sockets. These sockets
require no filesystem, and automatically disappear once the application
terminates. This is the locking solution I chose to implement in ip[6]tables.
As an added bonus, since each network namespace has its own socket pool, an
ip[6]tables instance running in one namespace will not lock out an ip[6]tables
instance running in another namespace. A filesystem approach would have
to recognize and handle multiple network namespaces.
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
The revision add the support of matching the packet/byte counters
if the set was defined with the extension. Also, a new flag is
introduced to suppress updating the packet/byte counters if required.
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
|
|
Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
also update list of protocols valid for port mapping.
Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
This patch adds a message at the end of configure which displays
the different compilation options and system settings.
An example output is the following:
Iptables Configuration:
IPv4 support: yes
IPv6 support: yes
Devel support: yes
IPQ support: no
Large file support: yes
BPF utils support: no
Build parameters:
Put plugins into executable (static): no
Support plugins via dlopen (shared): yes
Installation prefix (--prefix): /usr/local
Xtables extension directory: /usr/local/lib/xtables
Pkg-config directory: /usr/local/lib/pkgconfig
Kernel build directory: /lib/modules/custom
Host: x86_64-unknown-linux-gnu
GCC binary: gcc
Signed-off-by: Eric Leblond <eric@regit.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Get fix for LED extension.
|
|
Closes bugzilla:
https://bugzilla.netfilter.org/show_bug.cgi?id=825
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
In bug #455, Dmitry V. Levin proposed a more robust get_modprobe
implementation. The patch below is a version of his patch,
updated to apply to current git.
This closes bug #455.
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
|
|
This fixes a bug in iptables.8 and ip6tables.8 where @PACKAGE_VERSION@
was not processed in the VERSION section. It also simplifies the
Makefile by avoiding some sed commands.
[ Mangled this patch to rename iptables-extensions.8.in to
iptables-extensions.8.tmpl.in to avoid having a file whose name
is terminated by .in.in --pablo ]
Signed-off-by: Andy Spencer <andy753421@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
This patch renames libipt_SNAT.man to libxt_SNAT.man thus informing
about the IPv6 version.
Also the list of valid protocols for port mapping is updated to:
tcp, udp, dccp and sctp.
Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
This patch renames libipt_NETMAP.man to libxt_NETMAP.man thus informing
about the IPv6 version.
Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
This patch renames libipt_REDIRECT.man to libxt_REDIRECT.man thus
informing about the IPv6 version.
Also the list of valid protocols for port mapping is updated to:
tcp, udp, dccp and sctp.
Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
This patch renames libipt_DNAT.man to libxt_DNAT.man thus informing
about the IPv6 version, as suggested by Patrick McHardy.
Also, it updates the list of valid protocols for port mapping is
updated to: tcp, udp, dccp and sctp.
Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
