extensions: libxt_NFQUEUE: add --queue-cpu-fanout parameter

Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: add copyright statements

Add copyright statements to all extensions authored by myself.

Signed-off-by: Patrick McHardy <kaber@trash.net>
libip6t_mh: Correct command to list named mh types in manpage

Signed-off-by: Patrick McHardy <kaber@trash.net>
extensions: libxt_DNAT: rename IPv4 manpage and tell about IPv6 support

This patch renames libipt_DNAT.man to libxt_DNAT.man thus informing
about the IPv6 version, as suggested by Patrick McHardy.

Also, it updates the list of valid protocols for port mapping is
updated to: tcp, udp, dccp and sctp.

Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: libxt_REDIRECT: rename IPv4 manpage and tell about IPv6 support

This patch renames libipt_REDIRECT.man to libxt_REDIRECT.man thus
informing about the IPv6 version.

Also the list of valid protocols for port mapping is updated to:
tcp, udp, dccp and sctp.

Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: libxt_NETMAP: rename IPv4 manpage and tell about IPv6 support

This patch renames libipt_NETMAP.man to libxt_NETMAP.man thus informing
about the IPv6 version.

Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: libxt_SNAT: rename IPv4 manpage and tell about IPv6 support

This patch renames libipt_SNAT.man to libxt_SNAT.man thus informing
about the IPv6 version.

Also the list of valid protocols for port mapping is updated to:
tcp, udp, dccp and sctp.

Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: use autoconf to process .in man pages

This fixes a bug in iptables.8 and ip6tables.8 where @PACKAGE_VERSION@
was not processed in the VERSION section. It also simplifies the
Makefile by avoiding some sed commands.

[ Mangled this patch to rename iptables-extensions.8.in to
  iptables-extensions.8.tmpl.in to avoid having a file whose name
  is terminated by .in.in --pablo ]

Signed-off-by: Andy Spencer <andy753421@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
xtables: improve get_modprobe handling

In bug #455, Dmitry V. Levin proposed a more robust get_modprobe
implementation.  The patch below is a version of his patch,
updated to apply to current git.

This closes bug #455.

Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
Merge branch 'stable'

Get fix for LED extension.
configure: display summary

This patch adds a message at the end of configure which displays
the different compilation options and system settings.

An example output is the following:

Iptables Configuration:
  IPv4 support:				yes
  IPv6 support:				yes
  Devel support:			yes
  IPQ support:				no
  Large file support:			yes
  BPF utils support:			no

Build parameters:
  Put plugins into executable (static):	no
  Support plugins via dlopen (shared):	yes
  Installation prefix (--prefix):	/usr/local
  Xtables extension directory:		/usr/local/lib/xtables
  Pkg-config directory:			/usr/local/lib/pkgconfig
  Kernel build directory:		/lib/modules/custom
  Host:					x86_64-unknown-linux-gnu
  GCC binary:				gcc

Signed-off-by: Eric Leblond <eric@regit.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: libxt_MASQUERADE: rename IPv4 manpage and tell about IPv6 support

also update list of protocols valid for port mapping.

Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Florian Westphal <fw@strlen.de>
extensions: libxt_LOG: rename IPv4 manpage and tell about IPv6 support

Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Florian Westphal <fw@strlen.de>
Introduce a new revision for the set match with the counters support

The revision add the support of matching the packet/byte counters
if the set was defined with the extension. Also, a new flag is
introduced to suppress updating the packet/byte counters if required.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
ip[6]tables: Add locking to prevent concurrent instances

There have been numerous complaints and bug reports over the years when admins
attempt to run more than one instance of iptables simultaneously.  Currently
open bug reports which are related:

325: Parallel execution of the iptables is impossible
758: Retry iptables command on transient failure
764: Doing -Z twice in parallel breaks counters
822: iptables shows negative or other bad packet/byte counts

As Patrick notes in 325:  "Since this has been a problem people keep running
into, I'd suggest to simply add some locking to iptables to catch the most
common case."

I started looking into alternatives to add locking, and of course the most
common/obvious solution is to use a pidfile.  But this has various downsides,
such as if the application is terminated abnormally and the pidfile isn't
cleaned up.  And this also requires a writable filesystem.  Using a UNIX domain
socket file (e.g. in /var/run) has similar issues.

Starting in 2.2, Linux added support for abstract sockets.  These sockets
require no filesystem, and automatically disappear once the application
terminates.  This is the locking solution I chose to implement in ip[6]tables.
As an added bonus, since each network namespace has its own socket pool, an
ip[6]tables instance running in one namespace will not lock out an ip[6]tables
instance running in another namespace.  A filesystem approach would have
to recognize and handle multiple network namespaces.

Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Merge branch 'stable'

Get c545933 iptables: Fix connlabel.conf install location
doc: clarify DEBUG usage macro

Signed-off-by: Alexey Perevalov <a.perevalov@samsung.com>
Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org>
ip6tables: don't print out /128

Similar to how iptables does not print /32 on IPv4 addresses, ip6tables
should not print out /128 on IPv6 addresses.

Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
ip{6}tables-restore: fix breakage due to new locking approach

Since (93587a0 ip[6]tables: Add locking to prevent concurrent instances),
ip{6}tables-restore does not work anymore:

iptables-restore < x
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

do_command{6}(...) is called from ip{6}tables-restore for every iptables
command contained in the rule-set file. Thus, hitting the lock error
after the second command.

Fix it by bypassing the locking in the ip{6}tables-restore path.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
libxt_recent: restore reap functionality to recent module

The reap functionality appears to have been accidentally disabled
by (74ded72 libxt_recent: add --mask netmask) since iptables 1.4.15
and later.  This adds a patch to restore reap functionality for
recent_opts_v1.

Patch obtained via: http://patchwork.openwrt.org/patch/3812/

Signed-off-by: Russell Senior <russell@personaltelco.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>