GitHub PushEvent at 2014-02-26 08:08:05
Repository: iptables
Actor: gregnietsky
Payload: {"shas":[["384958620abab397062b67fb2763e813b63f74f0","707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","use nf_tables and nf_tables compatibility interface\n\nThis patch adds the following utilities:\n\n* xtables\n* xtables-restore\n* xtables-save\n* xtables-config\n\nThey all use Patrick's nf_tables infrastructure plus my compatibility\nlayer.\n\nxtables, xtables-restore and xtables-save are syntax compatible with\nip[6]tables, ip[6]tables-restore and ip[6]tables-save.\n\nSemantics aims to be similar, still the main exception is that there\nis no commit operation. Thus, we incrementally add/delete rules without\nentire table locking.\n\nThe following options are also not yet implemented:\n\n-Z (this requires adding expr->ops->reset(...) so nft_counters can reset\n    internal state of expressions while dumping it)\n\n-R and -E (this requires adding this feature to nf_tables)\n\n-f (can be implemented with expressions: payload 6 (2-bytes) + bitwise a&b^!b + cmp neq 0)\n\n-IPv6 support.\n\nBut those are a matter of time to get them done.\n\nA new utility, xtables-config, is available to register tables and\nchains. By default there is a configuration file that adds backward\ncompatible tables and chains under iptables/etc/xtables.conf. You have\nto call this utility first to register tables and chains.\n\nHowever, it would be possible to automagically register tables and\nchains while using xtables and xtables-restore to get similar operation\nthan with iptables.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Pablo Neira Ayuso",false],["c74f398c58e7b77ca1c82a15d0b2e9eed4fb82ad","707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","automatic creation of built-in table and chains\n\nIn order to emulate the iptables behaviour, this patch changes\nthe current behaviour to:\n\n1st) check if the table and chains are built-in.\n2nd) If they don't exists, create them. If they exists, don't touch\n     them.\n\nThe automatic creation happens in the -I and -P paths.\n\nWe should provide a new command to allow to delete (unregister)\nbuilt-in tables and chains. It would be similar to unloading\nthe iptable_X module that registers the custom table.\n\nThis is not done for other commands like -C or -D since they\nwill fail while trying to find the rule in the kernel if such\ncombination of chain and table does not exists.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Pablo Neira Ayuso",false],["e17b5f15c2beda86565a8f4e55fdf12ceb20dd59","707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","rework automatic creation of built-in table and chains\n\nThis patch reworks the automatic creation of built-in table and\nchains. Now it initializes all built-in chains belonging a table\nat once.\n\nThis happens with commands: -P, -A, -I, -N\n\nNote that xtables skips chain initialization if it notices that\nthe table already exists in the kernel.\n\nThanks to Tomasz Bursztyka for spotting problems with -N.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Pablo Neira Ayuso",false],["2f1fbab67157624c0171e55bde08e7e5c8d99fff","707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","iptables: nft: add -f support\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Pablo Neira Ayuso",false],["1373cbb1068a1dc57540faebcf2f5f0fcbe83b53","ba81a3a719836727e6857ae83462b9f52ec41006@linux.intel.com","headers: Make nf_tables.h up to date\n\nSigned-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>","Tomasz Bursztyka",false],["4493582ccb60a443fc7efeca78edafbefc689aa3","ba81a3a719836727e6857ae83462b9f52ec41006@linux.intel.com","nft: Add support for chain rename options (-E)\n\nSigned-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>","Tomasz Bursztyka",false],["4acee778f5712c4cc574e328183a3252ad81a802","ba81a3a719836727e6857ae83462b9f52ec41006@linux.intel.com","iptables: nft: Fix -D chain rulenum option\n\nSigned-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>","Tomasz Bursztyka",false],["16db62f9187ec1d62310efea8f0f7f378aee1e89","ba81a3a719836727e6857ae83462b9f52ec41006@linux.intel.com","iptables: nft: Refactor __nft_rule_check to return rule handle when relevant\n\nSigned-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>","Tomasz Bursztyka",false],["0a366d8696582e979d55f6832a797d1217f4b908","ba81a3a719836727e6857ae83462b9f52ec41006@linux.intel.com","iptables: nft: Add support for -R option\n\nSigned-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>","Tomasz Bursztyka",false],["06fc595fa99ab0036d87b259b0d20e4916522969","707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","nft: fix missing rule listing in custom chains with -L\n\nReported-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Pablo Neira Ayuso",false],["42239cb39ecf7650fefb5cc301ab943be11de6fb","707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","headers: remove unused compatibility definitions\n\nThey belong to nf_tables_compat.h\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Pablo Neira Ayuso",false],["5b414b85c33912aec912d260502c8b0c0df794a1","707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","iptables: nft: move priority to chain instead of table\n\nNAT table uses different chain priorities, adapt the existing\ncode to allow this.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Pablo Neira Ayuso",false],["3aea037f359795edeb69426e2dde63c59540ba5f","707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","iptables: nft: remove __nft_check_rule\n\nRework code to remove __nft_check_rule and split it into\nlogical fragments.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Pablo Neira Ayuso",false],["1298a1014bc14c45de50cc242779dfa382c456c9","707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","iptables: nft: use 64-bits handle\n\nNow that we use that in kernel space and in libnftables.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Pablo Neira Ayuso",false],["890fd9ef76ad0c11695fb0d09a88169e6e46584f","707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","iptables: nft: use chain types\n\nWe use the new special chain types defined in the kernel.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Pablo Neira Ayuso",false],["5705ea1f4e3c9cd3d5d9cbcf84b9733ce1f07e57","707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","xtables-restore: add support for dormant tables\n\nThis patch adds support for dormant tables for xtables-restore.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Pablo Neira Ayuso",false],["9c541721d318598db45986ee2fd61491fadb53d0","707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","nft: adapt chain rename to recent Patrick's updates\n\nThis patch gets existing code in sync with Patrick's chain\nrenaming new approach.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Pablo Neira Ayuso",false],["5a1b519d1e26767fa1f0de15b0f7e125531a1719","707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","xtables: fix crash due to using wrong globals\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Pablo Neira Ayuso",false],["0391677c1a0b28c14d01febd9628a543e8e5fd62","ba81a3a719836727e6857ae83462b9f52ec41006@linux.intel.com","xtables: add IPv6 support\n\nSummary of changes to add IPv6 support to the xtables utility:\n\n* modify all commands (add, delete, replace, check and listing) to\n  support IPv6 addresses.\n\nAnd for the internal nft library:\n\n* add family to struct nft_handle and modify all caller to use this\n  family instead of the hardcoded AF_INET.\n* move code that we can re-use for IPv4 and IPv6 into helper functions.\n* add IPv6 rule printing support.\n* add support to parse IPv6 address.\n\nPablo added several improvements to this patch:\n\n* added basic xtables-save and xtables-restore support (so it defaults\n  to IPv4)\n* fixed a couple of bugs found while testing\n* added reference when -f is used to point to -m frag (until we can make\n  this consistent with IPv4).\n\nNote that we use one single xtables binary utility for IPv4 and IPv6.\n\nSigned-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Tomasz Bursztyka",false],["3bbe7c1a0a2a3bab261aeb00cf4c5adcc96bf109","707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","xtables-restore: fix custom user chain restoration\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","Pablo Neira Ayuso",false]],"size":154,"ref":"refs/heads/master","head":"03091e55a0d949e35a723dadbd6fd0f78ddf3a8c"}