Merge branch 'master' of vishnu.netfilter.org:/data/git/iptables
diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
index c37f14d..f7704eb 100644
--- a/extensions/libxt_conntrack.c
+++ b/extensions/libxt_conntrack.c
@@ -801,7 +801,9 @@
if (info->match_flags & XT_CONNTRACK_STATE) {
if (info->invert_flags & XT_CONNTRACK_STATE)
printf(" !");
- printf(" %sctstate", prefix);
+ printf(" %s%s", prefix,
+ info->match_flags & XT_CONNTRACK_STATE_ALIAS
+ ? "state" : "ctstate");
print_state(info->state_mask);
}
@@ -902,6 +904,15 @@
}
}
+static const char *
+conntrack_print_name_alias(const struct xt_entry_match *match)
+{
+ struct xt_conntrack_mtinfo1 *info = (void *)match->data;
+
+ return info->match_flags & XT_CONNTRACK_STATE_ALIAS
+ ? "state" : "conntrack";
+}
+
static void conntrack_print(const void *ip, const struct xt_entry_match *match,
int numeric)
{
@@ -1083,7 +1094,7 @@
struct xt_conntrack_mtinfo1 *sinfo = cb->data;
xtables_option_parse(cb);
- sinfo->match_flags = XT_CONNTRACK_STATE;
+ sinfo->match_flags = XT_CONNTRACK_STATE | XT_CONNTRACK_STATE_ALIAS;
sinfo->state_mask = state_parse_states(cb->arg);
if (cb->invert)
sinfo->invert_flags |= XT_CONNTRACK_STATE;
@@ -1094,7 +1105,7 @@
struct xt_conntrack_mtinfo3 *sinfo = cb->data;
xtables_option_parse(cb);
- sinfo->match_flags = XT_CONNTRACK_STATE;
+ sinfo->match_flags = XT_CONNTRACK_STATE | XT_CONNTRACK_STATE_ALIAS;
sinfo->state_mask = state_parse_states(cb->arg);
if (cb->invert)
sinfo->invert_flags |= XT_CONNTRACK_STATE;
@@ -1158,6 +1169,7 @@
.x6_fcheck = conntrack_mt_check,
.print = conntrack_print,
.save = conntrack_save,
+ .alias = conntrack_print_name_alias,
.x6_options = conntrack_mt_opts_v0,
},
{
@@ -1172,6 +1184,7 @@
.x6_fcheck = conntrack_mt_check,
.print = conntrack1_mt4_print,
.save = conntrack1_mt4_save,
+ .alias = conntrack_print_name_alias,
.x6_options = conntrack2_mt_opts,
},
{
@@ -1186,6 +1199,7 @@
.x6_fcheck = conntrack_mt_check,
.print = conntrack1_mt6_print,
.save = conntrack1_mt6_save,
+ .alias = conntrack_print_name_alias,
.x6_options = conntrack2_mt_opts,
},
{
@@ -1200,6 +1214,7 @@
.x6_fcheck = conntrack_mt_check,
.print = conntrack2_mt_print,
.save = conntrack2_mt_save,
+ .alias = conntrack_print_name_alias,
.x6_options = conntrack2_mt_opts,
},
{
@@ -1214,6 +1229,7 @@
.x6_fcheck = conntrack_mt_check,
.print = conntrack2_mt6_print,
.save = conntrack2_mt6_save,
+ .alias = conntrack_print_name_alias,
.x6_options = conntrack2_mt_opts,
},
{
@@ -1228,6 +1244,7 @@
.x6_fcheck = conntrack_mt_check,
.print = conntrack3_mt_print,
.save = conntrack3_mt_save,
+ .alias = conntrack_print_name_alias,
.x6_options = conntrack3_mt_opts,
},
{
@@ -1242,6 +1259,7 @@
.x6_fcheck = conntrack_mt_check,
.print = conntrack3_mt6_print,
.save = conntrack3_mt6_save,
+ .alias = conntrack_print_name_alias,
.x6_options = conntrack3_mt_opts,
},
{
@@ -1249,6 +1267,7 @@
.name = "state",
.real_name = "conntrack",
.revision = 1,
+ .ext_flags = XTABLES_EXT_ALIAS,
.version = XTABLES_VERSION,
.size = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo1)),
.userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo1)),
@@ -1261,6 +1280,7 @@
.name = "state",
.real_name = "conntrack",
.revision = 2,
+ .ext_flags = XTABLES_EXT_ALIAS,
.version = XTABLES_VERSION,
.size = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo2)),
.userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo2)),
@@ -1273,6 +1293,7 @@
.name = "state",
.real_name = "conntrack",
.revision = 3,
+ .ext_flags = XTABLES_EXT_ALIAS,
.version = XTABLES_VERSION,
.size = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo3)),
.userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo3)),
diff --git a/extensions/libxt_state.man b/extensions/libxt_state.man
index bd60468..ec096ca 100644
--- a/extensions/libxt_state.man
+++ b/extensions/libxt_state.man
@@ -1,4 +1,4 @@
-The "state" module is an obsolete version of "conntrack".
+The "state" extension is a subset of the "conntrack" module.
"state" allows access to the connection tracking state for this packet.
.TP
[\fB!\fP] \fB\-\-state\fP \fIstate\fP
diff --git a/include/linux/netfilter/xt_conntrack.h b/include/linux/netfilter/xt_conntrack.h
index 74b904d..e971501 100644
--- a/include/linux/netfilter/xt_conntrack.h
+++ b/include/linux/netfilter/xt_conntrack.h
@@ -30,6 +30,7 @@
XT_CONNTRACK_REPLSRC_PORT = 1 << 10,
XT_CONNTRACK_REPLDST_PORT = 1 << 11,
XT_CONNTRACK_DIRECTION = 1 << 12,
+ XT_CONNTRACK_STATE_ALIAS = 1 << 13,
};
struct xt_conntrack_mtinfo1 {
diff --git a/include/xtables.h b/include/xtables.h
index 75de958..c35a6e6 100644
--- a/include/xtables.h
+++ b/include/xtables.h
@@ -201,6 +201,10 @@
struct xtables_lmap *next;
};
+enum xtables_ext_flags {
+ XTABLES_EXT_ALIAS = 1 << 0,
+};
+
/* Include file for additions: new matches and targets. */
struct xtables_match
{
@@ -218,6 +222,9 @@
/* Revision of match (0 by default). */
u_int8_t revision;
+ /* Extension flags */
+ u_int8_t ext_flags;
+
u_int16_t family;
/* Size of match data. */
@@ -251,6 +258,9 @@
/* ip is struct ipt_ip * for example */
void (*save)(const void *ip, const struct xt_entry_match *match);
+ /* Print match name or alias */
+ const char *(*alias)(const struct xt_entry_match *match);
+
/* Pointer to list of extra command-line options */
const struct option *extra_opts;
@@ -289,6 +299,9 @@
/* Revision of target (0 by default). */
u_int8_t revision;
+ /* Extension flags */
+ u_int8_t ext_flags;
+
u_int16_t family;
@@ -322,6 +335,9 @@
void (*save)(const void *ip,
const struct xt_entry_target *target);
+ /* Print target name or alias */
+ const char *(*alias)(const struct xt_entry_target *target);
+
/* Pointer to list of extra command-line options */
const struct option *extra_opts;
diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
index 556647f..4cfbea3 100644
--- a/iptables/ip6tables.c
+++ b/iptables/ip6tables.c
@@ -1000,7 +1000,8 @@
xtables_find_match(e->u.user.name, XTF_TRY_LOAD, NULL);
if (match) {
- printf(" -m %s", e->u.user.name);
+ printf(" -m %s",
+ match->alias ? match->alias(e) : e->u.user.name);
/* some matches don't provide a save function */
if (match->save)
@@ -1089,16 +1090,8 @@
if (counters < 0)
printf(" -c %llu %llu", (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt);
- /* Print target name */
+ /* Print target name and targinfo part */
target_name = ip6tc_get_target(e, h);
- if (target_name && (*target_name != '\0'))
-#ifdef IP6T_F_GOTO
- printf(" -%c %s", e->ipv6.flags & IP6T_F_GOTO ? 'g' : 'j', target_name);
-#else
- printf(" -j %s", target_name);
-#endif
-
- /* Print targinfo part */
t = ip6t_get_target((struct ip6t_entry *)e);
if (t->u.user.name[0]) {
struct xtables_target *target =
@@ -1110,6 +1103,7 @@
exit(1);
}
+ printf(" -j %s", target->alias ? target->alias(t) : target_name);
if (target->save)
target->save(&e->ipv6, t);
else {
@@ -1124,7 +1118,13 @@
exit(1);
}
}
- }
+ } else if (target_name && (*target_name != '\0'))
+#ifdef IP6T_F_GOTO
+ printf(" -%c %s", e->ipv6.flags & IP6T_F_GOTO ? 'g' : 'j', target_name);
+#else
+ printf(" -j %s", target_name);
+#endif
+
printf("\n");
}
@@ -1229,9 +1229,10 @@
strcpy(cs->target->t->u.user.name, cs->jumpto);
} else {
strcpy(cs->target->t->u.user.name, cs->target->real_name);
- fprintf(stderr, "WARNING: The %s target is obsolete. "
- "Use %s instead.\n",
- cs->jumpto, cs->target->real_name);
+ if (!(cs->target->ext_flags & XTABLES_EXT_ALIAS))
+ fprintf(stderr, "Notice: The %s target is converted into %s target "
+ "in rule listing and saving.\n",
+ cs->jumpto, cs->target->real_name);
}
cs->target->t->u.user.revision = cs->target->revision;
@@ -1265,8 +1266,9 @@
strcpy(m->m->u.user.name, m->name);
} else {
strcpy(m->m->u.user.name, m->real_name);
- fprintf(stderr, "WARNING: The %s match is obsolete. "
- "Use %s instead.\n", m->name, m->real_name);
+ if (!(m->ext_flags & XTABLES_EXT_ALIAS))
+ fprintf(stderr, "Notice: The %s match is converted into %s match "
+ "in rule listing and saving.\n", m->name, m->real_name);
}
m->m->u.user.revision = m->revision;
diff --git a/iptables/iptables.c b/iptables/iptables.c
index 00e3f01..085eea1 100644
--- a/iptables/iptables.c
+++ b/iptables/iptables.c
@@ -991,7 +991,8 @@
xtables_find_match(e->u.user.name, XTF_TRY_LOAD, NULL);
if (match) {
- printf(" -m %s", e->u.user.name);
+ printf(" -m %s",
+ match->alias ? match->alias(e) : e->u.user.name);
/* some matches don't provide a save function */
if (match->save)
@@ -1080,16 +1081,8 @@
if (counters < 0)
printf(" -c %llu %llu", (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt);
- /* Print target name */
+ /* Print target name and targinfo part */
target_name = iptc_get_target(e, h);
- if (target_name && (*target_name != '\0'))
-#ifdef IPT_F_GOTO
- printf(" -%c %s", e->ip.flags & IPT_F_GOTO ? 'g' : 'j', target_name);
-#else
- printf(" -j %s", target_name);
-#endif
-
- /* Print targinfo part */
t = ipt_get_target((struct ipt_entry *)e);
if (t->u.user.name[0]) {
const struct xtables_target *target =
@@ -1101,6 +1094,7 @@
exit(1);
}
+ printf(" -j %s", target->alias ? target->alias(t) : target_name);
if (target->save)
target->save(&e->ip, t);
else {
@@ -1115,7 +1109,13 @@
exit(1);
}
}
- }
+ } else if (target_name && (*target_name != '\0'))
+#ifdef IPT_F_GOTO
+ printf(" -%c %s", e->ip.flags & IPT_F_GOTO ? 'g' : 'j', target_name);
+#else
+ printf(" -j %s", target_name);
+#endif
+
printf("\n");
}
@@ -1222,9 +1222,10 @@
} else {
/* Alias support for userspace side */
strcpy(cs->target->t->u.user.name, cs->target->real_name);
- fprintf(stderr, "WARNING: The %s target is obsolete. "
- "Use %s instead.\n",
- cs->jumpto, cs->target->real_name);
+ if (!(cs->target->ext_flags & XTABLES_EXT_ALIAS))
+ fprintf(stderr, "Notice: The %s target is converted into %s target "
+ "in rule listing and saving.\n",
+ cs->jumpto, cs->target->real_name);
}
cs->target->t->u.user.revision = cs->target->revision;
@@ -1259,8 +1260,9 @@
strcpy(m->m->u.user.name, m->name);
} else {
strcpy(m->m->u.user.name, m->real_name);
- fprintf(stderr, "WARNING: The %s match is obsolete. "
- "Use %s instead.\n", m->name, m->real_name);
+ if (!(m->ext_flags & XTABLES_EXT_ALIAS))
+ fprintf(stderr, "Notice: the %s match is converted into %s match "
+ "in rule listing and saving.\n", m->name, m->real_name);
}
m->m->u.user.revision = m->revision;
