libip6t_SNPT: add manpage

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
libip6t_DNPT: add manpage

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: add libxt_bpf extension

Add user-space code to support the new BPF iptables extension.

Pablo has mangled the original patch to:

* include a copy of include/linux/netfilter/xt_bpf.h in the tree.
* I have also remove the --bytecode-file option. The original
  proposal was to accept BPF code in a file in human readable
  format. Now, with the nfbpf_compile utility, it's very easy
  to generate the filter using tcpdump-like syntax.
* I have remove the trailing comma in the backtick format, the
  parser works just fine for me here.
* Fix error message if --bytecode is missing.

Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
utils: nfbpf_compile

A BPF compiler to convert tcpdump expressions to the decimal format
accepted by the libxt_bpf.

Generate a file and pass that to iptables:

  nfbpf_compile RAW 'udp dst port 9000' > test.bpf
  iptables -A OUTPUT -m bpf --bytecode-file test.bpf -j LOG

Or pass the output directly to iptables using backticks:

  iptables -A INPUT -m bpf --bytecode \
      "`./nfbpf_compile RAW 'udp dst port 9000'" -j LOG

This utility depends on libpcap. The library is only compiled if the option
--enable-bpf-compiler is explicitly passed to ./configure and libpcap is
found.

Pablo has mangled the original patch to rename the utility to
nfbpf_compile. Also modified the output to match exactly what
-m bpf --bytecode needs.

Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Merge branch 'stable'

Resolve conflict with Nicolas' Dichtel update on utils/Makefile.am
for nfnl_osf.
libxt_recent: Fix missing space in manpage for --mask option

Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
libxt_NFQUEUE: fix bypass option documentation

Steve Caligo points out that the documentation says
'packet will move on to the next rule'.  This is incorrect;
packet moves to the next table.

nf bugzilla #778.

Signed-off-by: Florian Westphal <fw@strlen.de>
utils: updates .gitignore to include nfbpf_compile

Reported-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: libxt_bpf: clarify --bytecode argument

Mart Frauenlob suggested a change to explain the --bytecode
better. I have added some reference to the example bytecode
in the format that this argument accepts.

Reported-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: libxt_multiport: Update manpage to list valid protocols

This patch updates the list of valid protocols in the man page section
of the multiport match to: tcp, udp, udplite, dccp and sctp.

Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
libxt_conntrack: fix state match alias state parsing

The conntrack match uses a different value for the UNTRACKED state than
the state match. Translate states to conntrack states to make sure they
all match.

Signed-off-by: Patrick McHardy <kaber@trash.net>
extensions: add connlabel match

allows to "tag" connections with up to 128 label names.

Labels are defined in /etc/xtables/connlabel.conf, example:
0 from eth0
1 via eth0

Labels can then be attached to flows, e.g.

-A PREROUTING  -i eth0 -m connlabel --label "from eth0" --set

Signed-off-by: Florian Westphal <fw@strlen.de>
extensions: add connlabel match

allows to "tag" connections with up to 128 label names.

Labels are defined in /etc/xtables/connlabel.conf, example:
0 from eth0
1 via eth0

Labels can then be attached to flows, e.g.

-A PREROUTING  -i eth0 -m connlabel --label "from eth0" --set

Signed-off-by: Florian Westphal <fw@strlen.de>
libxtables: fix parsing of dotted network mask format

After upgrade from iptables 1.4.8 to 1.4.18 netmask parsing got broken:

-A foo -m policy --mode tunnel --dir in --tunnel-src 192.168.123.0/255.255.255.0 -j RETURN

With iptables 1.4.18:
iptables-restore v1.4.18: policy: bad value for option "--tunnel-src", or out of range (0-32)

This was probably broken by the augmented parser.

Reported-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Revert "extensions: add connlabel match" duplicate

This reverts commit ca376fcbe51b9a102a490545957d5fee69e253e1
to get rid of the duplicated install-data-hook.

This should get the tree back into the right state.

Conflicts:
	Makefile.am
doc: mention SNAT in INPUT chain since kernel 2.6.36

SNAT in the INPUT chain was added Jun 2010 to the kernel
(commit c68cd6cc21eb329c47ff020ff7412bf58176984e).

Signed-off-by: Michael Roth <mail@mroth.net>
Signed-off-by: Florian Westphal <fw@strlen.de>
build: bump version to 1.4.19

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables 1.4.19.1 release

Unfortunately, previous release was not included two patches
that were applied by Florian recently. This release fixes it.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: libxt_LED: fix parsing of delay

Closes bugzilla:
https://bugzilla.netfilter.org/show_bug.cgi?id=825

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>