iptables 1.4.20 release

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
xt_socket: add --nowildcard flag

xt_socket module can be a nice replacement to conntrack module
in some cases (SYN filtering for example)

But it lacks the ability to match the 3rd packet of TCP
handshake (ACK coming from the client).

Add a XT_SOCKET_NOWILDCARD flag to disable the wildcard mechanism

The wildcard is the legacy socket match behavior, that ignores
LISTEN sockets bound to INADDR_ANY (or ipv6 equivalent)

iptables -I INPUT -p tcp --syn -j SYN_CHAIN
iptables -I INPUT -m socket -j ACCEPT

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Patrick McHardy <kaber@trash.net>
Cc: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: libxt_socket: update man page

Document --nowildcard option and its implications when using -m socket
to intercept packets.

While at it, update man page with Balazs Scheidlers comments from
nf_tproxy_core.h in kernel tree to better explain how lookup is performed.

Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
doc: add libnetfilter_queue pointer to libxt_NFQUEUE.man

... and remove the QUEUE snippets from ip(6)tables man page,
the queue target was replaced by nfqueue years ago.
Fix up a couple of needless differences in ip(6)tables.8, too.

Signed-off-by: Florian Westphal <fw@strlen.de>
doc: merge ip6table man pages into ipv4 ones

a couple of improvements to the iptables man page never made it into
ip6tables version.

The number of differences between these two files is so small that
it seems preferable to alias the ipv6 man pages to their ipv4 counterpart
and change iptables man page to specifically document differences
(e.g. lack of ip6tables -f, etc).

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
xtables: trivial spelling fix

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: correctly reference generated file

Since (14bca55 iptables: use autoconf to process .in man pages),
the file "iptables-extensions.8.tmpl" is generated from
"iptables-extensions.8.tmpl.in" and is consequently no
longer found in ${srcdir} but in the build directory.
(Becomes visible with builddir != srcdir)

Signed-off-by: Lutz Jaenicke <ljaenicke@innominate.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Merge branch 'stable-1.4.20'

To retrieve:

iptables: correctly reference generated file
iptables: state match incompatibilty across versions

As reported in Debian bug #718810 [1], state match rules added in < 1.4.16
iptables versions are incorrectly displayed by >= 1.4.16 iptables versions.
Issue bisected to commit 0d701631 (libxt_state: replace as an alias to
xt_conntrack).

Fix this by adding the missing .print and .save functions for state match
aliases in the conntrack match.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718810

Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Merge branch 'stable-1.4.20'

To retrieve:

iptables: state match incompatibilty across versions
ip[6]tables: fix incorrect alignment in commands_v_options

CMD_ZERO_NUM is 14, so it has to be defined in position 15 in the
commands_v_options array. This does not manifests easily since
commands from 9 to 14 have a very similar pattern in such array.

Based on this patch: http://patchwork.ozlabs.org/patch/188153/

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: libxt_hashlimit.man: correct address

Corrects an example address with subnet mask.

http://bugs.debian.org/698393

Signed-off-by: Laurence J. Lane <ljlane@debian.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: libxt_conntrack.man extraneous commas

The first might work. The second doesn't.

(The other corrections in the bug report are already implemented.)

http://bugs.debian.org/654983

Signed-off-by: Laurence J. Lane <ljlane@debian.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: libip(6)t_REJECT.man default icmp types

The extension man page shows "port-unreach" and "port-unreachable" as
default icmpv6 and icomp reject-with types. Either and variations work
fine for writing rules, but they are displayed as "icmp6-port-unreachable"
and "icmp-port-unreachable". Let's make that consistent.

http://bugs.debian.org/644819

Signed-off-by: Laurence J. Lane <ljlane@debian.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: iptables-xm1.1 correct man section

iptables-xml.8 was moved to iptables-xm1.1.

Signed-off-by: Laurence J. Lane <ljlane@debian.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
build: add software version to manpage first line at configure stage

This patch adds the software version to the first line of the
following manpages:

	iptables-save.8
	iptables-restore.8
	iptables-apply.8
	iptables-xml.1

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>