iptables-1.2.8-CVS-20030715.patch

   1 diff -urN -x CVS -x .cvsignore iptables-1.2.8/INCOMPATIBILITIES userspace/INCOMPATIBILITIES
   2 --- iptables-1.2.8/INCOMPATIBILITIES    Thu Jan  1 01:00:00 1970
   3 +++ userspace/INCOMPATIBILITIES Sat May 24 13:44:18 2003
   4 @@ -0,0 +1,6 @@
   5 +INCOMPATIBILITIES:
   6 +
   7 +- The REJECT target has an '--reject-with admin-prohib' option which used
   8 +  with kernels that do not support it, will result in a plain DROP instead
   9 +  of REJECT.  Use with caution.
  10 +  Kernels that do support it:
  11 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/.IPMARK-test userspace/extensions/.IPMARK-test
  12 --- iptables-1.2.8/extensions/.IPMARK-test      Thu Jan  1 01:00:00 1970
  13 +++ userspace/extensions/.IPMARK-test   Sat May 31 19:31:31 2003
  14 @@ -0,0 +1,3 @@
  15 +#!/bin/sh
  16 +# True if IPMARK patch is applied.
  17 +[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_IPMARK.h ] && echo IPMARK
  18 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/.NETLINK-test userspace/extensions/.NETLINK-test
  19 --- iptables-1.2.8/extensions/.NETLINK-test     Thu Jan  1 01:00:00 1970
  20 +++ userspace/extensions/.NETLINK-test  Thu Feb 15 09:05:09 2001
  21 @@ -0,0 +1,2 @@
  22 +#! /bin/sh
  23 +[ -f $KERNEL_DIR/net/ipv4/netfilter/ipt_NETLINK.c ] && echo NETLINK
  24 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/.NETLINK.test userspace/extensions/.NETLINK.test
  25 --- iptables-1.2.8/extensions/.NETLINK.test     Thu Feb 15 09:05:09 2001
  26 +++ userspace/extensions/.NETLINK.test  Thu Jan  1 01:00:00 1970
  27 @@ -1,2 +0,0 @@
  28 -#! /bin/sh
  29 -[ -f $KERNEL_DIR/net/ipv4/netfilter/ipt_NETLINK.c ] && echo NETLINK
  30 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/.NOTRACK-test userspace/extensions/.NOTRACK-test
  31 --- iptables-1.2.8/extensions/.NOTRACK-test     Thu Jan  1 01:00:00 1970
  32 +++ userspace/extensions/.NOTRACK-test  Wed May 21 12:31:08 2003
  33 @@ -0,0 +1,2 @@
  34 +#! /bin/sh
  35 +[ -f $KERNEL_DIR/net/ipv4/netfilter/ipt_NOTRACK.c ] && echo NOTRACK
  36 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/.TRACE-test userspace/extensions/.TRACE-test
  37 --- iptables-1.2.8/extensions/.TRACE-test       Thu Jan  1 01:00:00 1970
  38 +++ userspace/extensions/.TRACE-test    Wed May 21 12:31:08 2003
  39 @@ -0,0 +1,2 @@
  40 +#! /bin/sh
  41 +[ -f $KERNEL_DIR/net/ipv4/netfilter/ipt_TRACE.c ] && echo TRACE
  42 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/.TRACE-test6 userspace/extensions/.TRACE-test6
  43 --- iptables-1.2.8/extensions/.TRACE-test6      Thu Jan  1 01:00:00 1970
  44 +++ userspace/extensions/.TRACE-test6   Wed May 21 12:31:08 2003
  45 @@ -0,0 +1,2 @@
  46 +#! /bin/sh
  47 +[ -f $KERNEL_DIR/net/ipv4/netfilter/ip6t_TRACE.c ] && echo TRACE
  48 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/.XOR-test userspace/extensions/.XOR-test
  49 --- iptables-1.2.8/extensions/.XOR-test Thu Jan  1 01:00:00 1970
  50 +++ userspace/extensions/.XOR-test      Sat May 31 19:11:49 2003
  51 @@ -0,0 +1,2 @@
  52 +#! /bin/sh
  53 +[ -f $KERNEL_DIR/net/ipv4/netfilter/ipt_XOR.c ] && echo XOR
  54 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/.addrtype-test userspace/extensions/.addrtype-test
  55 --- iptables-1.2.8/extensions/.addrtype-test    Thu Jan  1 01:00:00 1970
  56 +++ userspace/extensions/.addrtype-test Wed May  7 18:51:40 2003
  57 @@ -0,0 +1,5 @@
  58 +#!/bin/bash
  59 +
  60 +if test -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_addrtype.h; then
  61 +       echo "addrtype"
  62 +fi
  63 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/.connbytes-test userspace/extensions/.connbytes-test
  64 --- iptables-1.2.8/extensions/.connbytes-test   Thu Jan  1 01:00:00 1970
  65 +++ userspace/extensions/.connbytes-test        Thu Jun 19 14:23:37 2003
  66 @@ -0,0 +1,2 @@
  67 +#! /bin/sh
  68 +[ -f $KERNEL_DIR/net/ipv4/netfilter/ipt_connbytes.c ] && echo connbytes
  69 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/.iprange-test userspace/extensions/.iprange-test
  70 --- iptables-1.2.8/extensions/.iprange-test     Thu Jan  1 01:00:00 1970
  71 +++ userspace/extensions/.iprange-test  Wed Apr 23 15:27:09 2003
  72 @@ -0,0 +1,2 @@
  73 +#! /bin/sh
  74 +[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_iprange.h ] && echo iprange
  75 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/.nth-test6 userspace/extensions/.nth-test6
  76 --- iptables-1.2.8/extensions/.nth-test6        Thu Jan  1 01:00:00 1970
  77 +++ userspace/extensions/.nth-test6     Sat May  3 15:55:06 2003
  78 @@ -0,0 +1,3 @@
  79 +#!/bin/sh
  80 +# True if nth is applied.
  81 +[ -f $KERNEL_DIR/include/linux/netfilter_ipv6/ip6t_nth.h ] && echo nth
  82 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/.random-test6 userspace/extensions/.random-test6
  83 --- iptables-1.2.8/extensions/.random-test6     Thu Jan  1 01:00:00 1970
  84 +++ userspace/extensions/.random-test6  Sat May  3 15:46:18 2003
  85 @@ -0,0 +1,3 @@
  86 +#!/bin/sh
  87 +# True if random is applied.
  88 +[ -f $KERNEL_DIR/include/linux/netfilter_ipv6/ip6t_random.h ] && echo random
  89 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/Makefile userspace/extensions/Makefile
  90 --- iptables-1.2.8/extensions/Makefile  Wed Mar  5 12:39:31 2003
  91 +++ userspace/extensions/Makefile       Thu May 22 16:33:34 2003
  92 @@ -5,7 +5,7 @@
  93  # header files are present in the include/linux directory of this iptables
  94  # package (HW)
  95  #
  96 -PF_EXT_SLIB:=ah conntrack dscp ecn esp helper stealth icmp length limit mac mark multiport owner physdev pkttype rpc standard state tcp tcpmss tos ttl udp unclean DNAT DSCP ECN LOG MARK MASQUERADE MIRROR REDIRECT REJECT SAME SNAT TARPIT TCPMSS TOS TTL ULOG IMQ
  97 +PF_EXT_SLIB:=ah connlimit conntrack dscp ecn esp helper stealth icmp length limit mac mark multiport owner physdev pkttype rpc standard state tcp tcpmss tos ttl udp unclean DNAT DSCP ECN LOG MARK MASQUERADE MIRROR REDIRECT REJECT SAME SNAT TARPIT TCPMSS TOS TTL ULOG IMQ
  98  PF6_EXT_SLIB:=eui64 hl icmpv6 length limit mac mark multiport owner standard tcp udp HL LOG MARK
  99
 100  # Optionals
 101 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libip6t_LOG.c userspace/extensions/libip6t_LOG.c
 102 --- iptables-1.2.8/extensions/libip6t_LOG.c     Sat Sep  7 16:31:01 2002
 103 +++ userspace/extensions/libip6t_LOG.c  Tue Jul 15 15:29:20 2003
 104 @@ -230,16 +230,8 @@
 105         if (strcmp(loginfo->prefix, "") != 0)
 106                 printf("--log-prefix \"%s\" ", loginfo->prefix);
 107
 108 -       if (loginfo->level != LOG_DEFAULT_LEVEL) {
 109 -               for (i = 0;
 110 -                    i < sizeof(ip6t_log_names) / sizeof(struct ip6t_log_names);
 111 -                    i++) {
 112 -                       if (loginfo->level == ip6t_log_names[i].level) {
 113 -                               printf("--log-level %s ", ip6t_log_names[i].name);
 114 -                               break;
 115 -                       }
 116 -        }
 117 -    }
 118 +       if (loginfo->level != LOG_DEFAULT_LEVEL)
 119 +               printf("--log-level %d ", loginfo->level);
 120
 121         if (loginfo->logflags & IP6T_LOG_TCPSEQ)
 122                 printf("--log-tcp-sequence ");
 123 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libip6t_TRACE.c userspace/extensions/libip6t_TRACE.c
 124 --- iptables-1.2.8/extensions/libip6t_TRACE.c   Thu Jan  1 01:00:00 1970
 125 +++ userspace/extensions/libip6t_TRACE.c        Wed May 21 12:31:08 2003
 126 @@ -0,0 +1,63 @@
 127 +/* Shared library add-on to iptables to add TRACE target support. */
 128 +#include <stdio.h>
 129 +#include <string.h>
 130 +#include <stdlib.h>
 131 +#include <getopt.h>
 132 +
 133 +#include <ip6tables.h>
 134 +#include <linux/netfilter_ipv6/ip6_tables.h>
 135 +
 136 +/* Function which prints out usage message. */
 137 +static void
 138 +help(void)
 139 +{
 140 +       printf(
 141 +"TRACE target v%s takes no options\n",
 142 +IPTABLES_VERSION);
 143 +}
 144 +
 145 +static struct option opts[] = {
 146 +       { 0 }
 147 +};
 148 +
 149 +/* Initialize the target. */
 150 +static void
 151 +init(struct ip6t_entry_target *t, unsigned int *nfcache)
 152 +{
 153 +}
 154 +
 155 +/* Function which parses command options; returns true if it
 156 +   ate an option */
 157 +static int
 158 +parse(int c, char **argv, int invert, unsigned int *flags,
 159 +      const struct ip6t_entry *entry,
 160 +      struct ip6t_entry_target **target)
 161 +{
 162 +       return 0;
 163 +}
 164 +
 165 +static void
 166 +final_check(unsigned int flags)
 167 +{
 168 +}
 169 +
 170 +static
 171 +struct ip6tables_target trace
 172 += {    .next = NULL,
 173 +       .name = "TRACE",
 174 +       .version = IPTABLES_VERSION,
 175 +       .size = IP6T_ALIGN(0),
 176 +       .userspacesize = IP6T_ALIGN(0),
 177 +       .help = &help,
 178 +       .init = &init,
 179 +       .parse = &parse,
 180 +       .final_check = &final_check,
 181 +       .print = NULL, /* print */
 182 +       .save = NULL, /* save */
 183 +       .extra_opts = opts
 184 +};
 185 +
 186 +void _init(void)
 187 +{
 188 +       register_target6(&trace);
 189 +}
 190 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libip6t_condition.c userspace/extensions/libip6t_condition.c
 191 --- iptables-1.2.8/extensions/libip6t_condition.c       Wed Mar 26 15:42:35 2003
 192 +++ userspace/extensions/libip6t_condition.c    Thu May 22 16:33:34 2003
 193 @@ -1,3 +1,4 @@
 194 +/* Shared library add-on to ip6tables for condition match */
 195  #include <stdio.h>
 196  #include <stdlib.h>
 197  #include <string.h>
 198 @@ -39,13 +40,13 @@
 199         struct condition6_info *info =
 200             (struct condition6_info *) (*match)->data;
 201
 202 -       check_inverse(optarg, &invert, &optind, 0);
 203 -
 204         if (c == 'X') {
 205                 if (*flags)
 206                         exit_error(PARAMETER_PROBLEM,
 207                                    "Can't specify multiple conditions");
 208
 209 +               check_inverse(optarg, &invert, &optind, 0);
 210 +
 211                 if (strlen(argv[optind - 1]) < CONDITION6_NAME_LEN)
 212                         strcpy(info->name, argv[optind - 1]);
 213                 else
 214 @@ -88,7 +89,7 @@
 215         const struct condition6_info *info =
 216             (const struct condition6_info *) match->data;
 217
 218 -       printf("--condition %s%s ", (info->invert) ? "! " : "", info->name);
 219 +       printf("--condition %s\"%s\" ", (info->invert) ? "! " : "", info->name);
 220  }
 221
 222
 223 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libip6t_fuzzy.c userspace/extensions/libip6t_fuzzy.c
 224 --- iptables-1.2.8/extensions/libip6t_fuzzy.c   Fri Apr 11 12:30:36 2003
 225 +++ userspace/extensions/libip6t_fuzzy.c        Mon Jun 16 13:39:36 2003
 226 @@ -7,6 +7,9 @@
 227
 228  2002-08-07 Hime Aguiar e Oliveira Jr. <hime@engineer.com> : Initial version.
 229  2003-04-08 Maciej Soltysiak <solt@dns.toxicfilms.tv> : IPv6 Port
 230 +2003-06-09 Hime Aguiar e Oliveira Jr. <hime@engineer.com> : Bug corrections in
 231 +the save function , thanks to information given by Jean-Francois Patenaude.
 232 +
 233  */
 234
 235  #include <stdio.h>
 236 @@ -131,8 +134,8 @@
 237         const struct ip6t_fuzzy_info *fuzzyinfo
 238                 = (const struct ip6t_fuzzy_info *)match->data;
 239
 240 -       printf("--upper-limit %u ",fuzzyinfo->minimum_rate);
 241 -       printf("--lower-limit %u ",fuzzyinfo->maximum_rate);
 242 +       printf("--lower-limit %u ",fuzzyinfo->minimum_rate);
 243 +       printf("--upper-limit %u ",fuzzyinfo->maximum_rate);
 244
 245  }
 246
 247 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libip6t_hl.c userspace/extensions/libip6t_hl.c
 248 --- iptables-1.2.8/extensions/libip6t_hl.c      Wed Jan  8 10:14:20 2003
 249 +++ userspace/extensions/libip6t_hl.c   Thu May 22 16:33:34 2003
 250 @@ -3,6 +3,7 @@
 251   * Maciej Soltysiak <solt@dns.toxicfilms.tv>
 252   * Based on HW's ttl match
 253   * This program is released under the terms of GNU GPL
 254 + * Cleanups by Stephane Ouellette <ouellettes@videotron.ca>
 255   */
 256
 257  #include <stdio.h>
 258 @@ -18,7 +19,7 @@
 259  {
 260         printf(
 261  "HL match v%s options:\n"
 262 -"  --hl-eq value       Match hop limit value\n"
 263 +"  --hl-eq [!] value   Match hop limit value\n"
 264  "  --hl-lt value       Match HL < value\n"
 265  "  --hl-gt value       Match HL > value\n"
 266  , IPTABLES_VERSION);
 267 @@ -81,7 +82,6 @@
 268                         break;
 269                 default:
 270                         return 0;
 271 -
 272         }
 273
 274         return 1;
 275 @@ -92,82 +92,61 @@
 276         if (!flags)
 277                 exit_error(PARAMETER_PROBLEM,
 278                         "HL match: You must specify one of "
 279 -                       "`--hl-eq', `--hl-lt', `--hl-gt");
 280 +                       "`--hl-eq', `--hl-lt', `--hl-gt'");
 281  }
 282
 283  static void print(const struct ip6t_ip6 *ip,
 284                 const struct ip6t_entry_match *match,
 285                 int numeric)
 286  {
 287 +       static const char *op[] = {
 288 +               [IP6T_HL_EQ] = "==",
 289 +               [IP6T_HL_NE] = "!=",
 290 +               [IP6T_HL_LT] = "<",
 291 +               [IP6T_HL_GT] = ">" };
 292 +
 293         const struct ip6t_hl_info *info =
 294                 (struct ip6t_hl_info *) match->data;
 295
 296 -       printf("HL match ");
 297 -       switch (info->mode) {
 298 -               case IP6T_HL_EQ:
 299 -                       printf("HL == ");
 300 -                       break;
 301 -               case IP6T_HL_NE:
 302 -                       printf("HL != ");
 303 -                       break;
 304 -               case IP6T_HL_LT:
 305 -                       printf("HL < ");
 306 -                       break;
 307 -               case IP6T_HL_GT:
 308 -                       printf("HL > ");
 309 -                       break;
 310 -       }
 311 -       printf("%u ", info->hop_limit);
 312 +       printf("HL match HL %s %u ", op[info->mode], info->hop_limit);
 313  }
 314
 315  static void save(const struct ip6t_ip6 *ip,
 316                 const struct ip6t_entry_match *match)
 317  {
 318 +       static const char *op[] = {
 319 +               [IP6T_HL_EQ] = "eq",
 320 +               [IP6T_HL_NE] = "eq !",
 321 +               [IP6T_HL_LT] = "lt",
 322 +               [IP6T_HL_GT] = "gt" };
 323 +
 324         const struct ip6t_hl_info *info =
 325                 (struct ip6t_hl_info *) match->data;
 326
 327 -       switch (info->mode) {
 328 -               case IP6T_HL_EQ:
 329 -                       printf("--hl-eq ");
 330 -                       break;
 331 -               case IP6T_HL_NE:
 332 -                       printf("! --hl-eq ");
 333 -                       break;
 334 -               case IP6T_HL_LT:
 335 -                       printf("--hl-lt ");
 336 -                       break;
 337 -               case IP6T_HL_GT:
 338 -                       printf("--hl-gt ");
 339 -                       break;
 340 -               default:
 341 -                       /* error */
 342 -                       break;
 343 -       }
 344 -       printf("%u ", info->hop_limit);
 345 +       printf("--hl-%s %u ", op[info->mode], info->hop_limit);
 346  }
 347
 348  static struct option opts[] = {
 349 -       { "hl", 1, 0, '2' },
 350 -       { "hl-eq", 1, 0, '2'},
 351 -       { "hl-lt", 1, 0, '3'},
 352 -       { "hl-gt", 1, 0, '4'},
 353 +       { .name = "hl",    .has_arg = 1, .flag = 0, .val = '2' },
 354 +       { .name = "hl-eq", .has_arg = 1, .flag = 0, .val = '2' },
 355 +       { .name = "hl-lt", .has_arg = 1, .flag = 0, .val = '3' },
 356 +       { .name = "hl-gt", .has_arg = 1, .flag = 0, .val = '4' },
 357         { 0 }
 358  };
 359
 360  static
 361  struct ip6tables_match hl = {
 362 -       NULL,
 363 -       "hl",
 364 -       IPTABLES_VERSION,
 365 -       IP6T_ALIGN(sizeof(struct ip6t_hl_info)),
 366 -       IP6T_ALIGN(sizeof(struct ip6t_hl_info)),
 367 -       &help,
 368 -       &init,
 369 -       &parse,
 370 -       &final_check,
 371 -       &print,
 372 -       &save,
 373 -       opts
 374 +       .name          = "hl",
 375 +       .version       = IPTABLES_VERSION,
 376 +       .size          = IP6T_ALIGN(sizeof(struct ip6t_hl_info)),
 377 +       .userspacesize = IP6T_ALIGN(sizeof(struct ip6t_hl_info)),
 378 +       .help          = &help,
 379 +       .init          = &init,
 380 +       .parse         = &parse,
 381 +       .final_check   = &final_check,
 382 +       .print         = &print,
 383 +       .save          = &save,
 384 +       .extra_opts    = opts
 385  };
 386
 387
 388 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libip6t_mac.c userspace/extensions/libip6t_mac.c
 389 --- iptables-1.2.8/extensions/libip6t_mac.c     Mon Jan  6 14:04:53 2003
 390 +++ userspace/extensions/libip6t_mac.c  Mon Jun 16 13:39:36 2003
 391 @@ -86,11 +86,11 @@
 392         return 1;
 393  }
 394
 395 -static void print_mac(unsigned char macaddress[ETH_ALEN], int invert)
 396 +static void print_mac(unsigned char macaddress[ETH_ALEN])
 397  {
 398         unsigned int i;
 399
 400 -       printf("%s%02X", invert ? "! " : "", macaddress[0]);
 401 +       printf("%02X", macaddress[0]);
 402         for (i = 1; i < ETH_ALEN; i++)
 403                 printf(":%02X", macaddress[i]);
 404         printf(" ");
 405 @@ -111,16 +111,21 @@
 406        int numeric)
 407  {
 408         printf("MAC ");
 409 -       print_mac(((struct ip6t_mac_info *)match->data)->srcaddr,
 410 -                 ((struct ip6t_mac_info *)match->data)->invert);
 411 +
 412 +       if (((struct ip6t_mac_info *)match->data)->invert)
 413 +               printf("! ");
 414 +
 415 +       print_mac(((struct ip6t_mac_info *)match->data)->srcaddr);
 416  }
 417
 418  /* Saves the union ip6t_matchinfo in parsable form to stdout. */
 419  static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match)
 420  {
 421 +       if (((struct ip6t_mac_info *)match->data)->invert)
 422 +               printf("! ");
 423 +
 424         printf("--mac-source ");
 425 -       print_mac(((struct ip6t_mac_info *)match->data)->srcaddr,
 426 -                 ((struct ip6t_mac_info *)match->data)->invert);
 427 +       print_mac(((struct ip6t_mac_info *)match->data)->srcaddr);
 428  }
 429
 430  static
 431 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libip6t_multiport.c userspace/extensions/libip6t_multiport.c
 432 --- iptables-1.2.8/extensions/libip6t_multiport.c       Wed May 29 15:08:16 2002
 433 +++ userspace/extensions/libip6t_multiport.c    Tue Jul 15 15:29:20 2003
 434 @@ -237,7 +237,7 @@
 435
 436         for (i=0; i < multiinfo->count; i++) {
 437                 printf("%s", i ? "," : "");
 438 -               print_port(multiinfo->ports[i], ip->proto, 0);
 439 +               print_port(multiinfo->ports[i], ip->proto, 1);
 440         }
 441         printf(" ");
 442  }
 443 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libip6t_nth.c userspace/extensions/libip6t_nth.c
 444 --- iptables-1.2.8/extensions/libip6t_nth.c     Thu Jan  1 01:00:00 1970
 445 +++ userspace/extensions/libip6t_nth.c  Sat May  3 15:55:06 2003
 446 @@ -0,0 +1,238 @@
 447 +/*
 448 +   Shared library add-on to iptables to add match support for every Nth packet
 449 +
 450 +   This file is distributed under the terms of the GNU General Public
 451 +   License (GPL). Copies of the GPL can be obtained from:
 452 +   ftp://prep.ai.mit.edu/pub/gnu/GPL
 453 +
 454 +   2001-07-17 Fabrice MARIE <fabrice@netfilter.org> : initial development.
 455 +   2001-09-20 Richard Wagner (rwagner@cloudnet.com)
 456 +        * added support for multiple counters
 457 +        * added support for matching on individual packets
 458 +          in the counter cycle
 459 +*/
 460 +
 461 +#include <stdio.h>
 462 +#include <netdb.h>
 463 +#include <string.h>
 464 +#include <stdlib.h>
 465 +#include <syslog.h>
 466 +#include <getopt.h>
 467 +#include <ip6tables.h>
 468 +#include <linux/netfilter_ipv6/ip6_tables.h>
 469 +#include <linux/netfilter_ipv6/ip6t_nth.h>
 470 +
 471 +
 472 +/* Function which prints out usage message. */
 473 +static void
 474 +help(void)
 475 +{
 476 +       printf(
 477 +"nth v%s options:\n"
 478 +"   --every     Nth              Match every Nth packet\n"
 479 +"  [--counter]  num              Use counter 0-%u (default:0)\n"
 480 +"  [--start]    num              Initialize the counter at the number 'num'\n"
 481 +"                                instead of 0. Must be between 0 and Nth-1\n"
 482 +"  [--packet]   num              Match on 'num' packet. Must be between 0\n"
 483 +"                                and Nth-1.\n\n"
 484 +"                                If --packet is used for a counter than\n"
 485 +"                                there must be Nth number of --packet\n"
 486 +"                                rules, covering all values between 0 and\n"
 487 +"                                Nth-1 inclusively.\n",
 488 +IPTABLES_VERSION, IP6T_NTH_NUM_COUNTERS-1);
 489 +}
 490 +
 491 +static struct option opts[] = {
 492 +       { "every", 1, 0, '1' },
 493 +       { "start", 1, 0, '2' },
 494 +        { "counter", 1, 0, '3' },
 495 +        { "packet", 1, 0, '4' },
 496 +       { 0 }
 497 +};
 498 +
 499 +/* Initialize the target. */
 500 +static void
 501 +init(struct ip6t_entry_match *m, unsigned int *nfcache)
 502 +{
 503 +       *nfcache |= NFC_UNKNOWN;
 504 +}
 505 +
 506 +#define IP6T_NTH_OPT_EVERY     0x01
 507 +#define IP6T_NTH_OPT_NOT_EVERY 0x02
 508 +#define IP6T_NTH_OPT_START     0x04
 509 +#define IP6T_NTH_OPT_COUNTER     0x08
 510 +#define IP6T_NTH_OPT_PACKET      0x10
 511 +
 512 +/* Function which parses command options; returns true if it
 513 +   ate an option */
 514 +static int
 515 +parse(int c, char **argv, int invert, unsigned int *flags,
 516 +      const struct ip6t_entry *entry,
 517 +      unsigned int *nfcache,
 518 +      struct ip6t_entry_match **match)
 519 +{
 520 +       struct ip6t_nth_info *nthinfo = (struct ip6t_nth_info *)(*match)->data;
 521 +       unsigned int num;
 522 +
 523 +       switch (c) {
 524 +       case '1':
 525 +               /* check for common mistakes... */
 526 +               if ((!invert) && (*flags & IP6T_NTH_OPT_EVERY))
 527 +                       exit_error(PARAMETER_PROBLEM,
 528 +                                  "Can't specify --every twice");
 529 +               if (invert && (*flags & IP6T_NTH_OPT_NOT_EVERY))
 530 +                       exit_error(PARAMETER_PROBLEM,
 531 +                                  "Can't specify ! --every twice");
 532 +               if ((!invert) && (*flags & IP6T_NTH_OPT_NOT_EVERY))
 533 +                       exit_error(PARAMETER_PROBLEM,
 534 +                                  "Can't specify --every with ! --every");
 535 +               if (invert && (*flags & IP6T_NTH_OPT_EVERY))
 536 +                       exit_error(PARAMETER_PROBLEM,
 537 +                                  "Can't specify ! --every with --every");
 538 +
 539 +               /* Remember, this function will interpret a leading 0 to be
 540 +                  Octal, a leading 0x to be hexdecimal... */
 541 +                if (string_to_number(optarg, 2, 100, &num) == -1 || num < 2)
 542 +                        exit_error(PARAMETER_PROBLEM,
 543 +                                   "bad --every `%s', must be between 2 and 100", optarg);
 544 +
 545 +               /* assign the values */
 546 +               nthinfo->every = num-1;
 547 +               nthinfo->startat = 0;
 548 +                nthinfo->packet = 0xFF;
 549 +                if(!(*flags & IP6T_NTH_OPT_EVERY))
 550 +                {
 551 +                        nthinfo->counter = 0;
 552 +                }
 553 +               if (invert)
 554 +               {
 555 +                       *flags |= IP6T_NTH_OPT_NOT_EVERY;
 556 +                       nthinfo->not = 1;
 557 +               }
 558 +               else
 559 +               {
 560 +                       *flags |= IP6T_NTH_OPT_EVERY;
 561 +                       nthinfo->not = 0;
 562 +               }
 563 +               break;
 564 +       case '2':
 565 +               /* check for common mistakes... */
 566 +               if (!((*flags & IP6T_NTH_OPT_EVERY) ||
 567 +                     (*flags & IP6T_NTH_OPT_NOT_EVERY)))
 568 +                       exit_error(PARAMETER_PROBLEM,
 569 +                                  "Can't specify --start before --every");
 570 +               if (invert)
 571 +                       exit_error(PARAMETER_PROBLEM,
 572 +                                  "Can't specify with ! --start");
 573 +               if (*flags & IP6T_NTH_OPT_START)
 574 +                       exit_error(PARAMETER_PROBLEM,
 575 +                                  "Can't specify --start twice");
 576 +               if (string_to_number(optarg, 0, nthinfo->every, &num) == -1)
 577 +                        exit_error(PARAMETER_PROBLEM,
 578 +                                   "bad --start `%s', must between 0 and %u", optarg, nthinfo->every);
 579 +               *flags |= IP6T_NTH_OPT_START;
 580 +               nthinfo->startat = num;
 581 +               break;
 582 +        case '3':
 583 +                /* check for common mistakes... */
 584 +                if (invert)
 585 +                        exit_error(PARAMETER_PROBLEM,
 586 +                                   "Can't specify with ! --counter");
 587 +                if (*flags & IP6T_NTH_OPT_COUNTER)
 588 +                        exit_error(PARAMETER_PROBLEM,
 589 +                                   "Can't specify --counter twice");
 590 +                if (string_to_number(optarg, 0, IP6T_NTH_NUM_COUNTERS-1, &num) == -1)
 591 +                        exit_error(PARAMETER_PROBLEM,
 592 +                                   "bad --counter `%s', must between 0 and %u", optarg, IP6T_NTH_NUM_COUNTERS-1);
 593 +                /* assign the values */
 594 +                *flags |= IP6T_NTH_OPT_COUNTER;
 595 +                nthinfo->counter = num;
 596 +                break;
 597 +        case '4':
 598 +                /* check for common mistakes... */
 599 +                if (!((*flags & IP6T_NTH_OPT_EVERY) ||
 600 +                      (*flags & IP6T_NTH_OPT_NOT_EVERY)))
 601 +                        exit_error(PARAMETER_PROBLEM,
 602 +                                   "Can't specify --packet before --every");
 603 +                if ((*flags & IP6T_NTH_OPT_NOT_EVERY))
 604 +                        exit_error(PARAMETER_PROBLEM,
 605 +                                   "Can't specify --packet with ! --every");
 606 +                if (invert)
 607 +                        exit_error(PARAMETER_PROBLEM,
 608 +                                   "Can't specify with ! --packet");
 609 +                if (*flags & IP6T_NTH_OPT_PACKET)
 610 +                        exit_error(PARAMETER_PROBLEM,
 611 +                                   "Can't specify --packet twice");
 612 +                if (string_to_number(optarg, 0, nthinfo->every, &num) == -1)
 613 +                        exit_error(PARAMETER_PROBLEM,
 614 +                                   "bad --packet `%s', must between 0 and %u", optarg, nthinfo->every);
 615 +                *flags |= IP6T_NTH_OPT_PACKET;
 616 +                nthinfo->packet = num;
 617 +                break;
 618 +       default:
 619 +               return 0;
 620 +       }
 621 +       return 1;
 622 +}
 623 +
 624 +/* Final check; nothing. */
 625 +static void final_check(unsigned int flags)
 626 +{
 627 +}
 628 +
 629 +/* Prints out the targinfo. */
 630 +static void
 631 +print(const struct ip6t_ip6 *ip,
 632 +      const struct ip6t_entry_match *match,
 633 +      int numeric)
 634 +{
 635 +       const struct ip6t_nth_info *nthinfo
 636 +               = (const struct ip6t_nth_info *)match->data;
 637 +
 638 +       if (nthinfo->not == 1)
 639 +               printf(" !");
 640 +       printf("every %uth ", (nthinfo->every +1));
 641 +       if (nthinfo->counter != 0)
 642 +               printf("counter #%u ", (nthinfo->counter));
 643 +        if (nthinfo->packet != 0xFF)
 644 +                printf("packet #%u ", nthinfo->packet);
 645 +       if (nthinfo->startat != 0)
 646 +               printf("start at %u ", nthinfo->startat);
 647 +}
 648 +
 649 +/* Saves the union ip6t_targinfo in parsable form to stdout. */
 650 +static void
 651 +save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match)
 652 +{
 653 +       const struct ip6t_nth_info *nthinfo
 654 +               = (const struct ip6t_nth_info *)match->data;
 655 +
 656 +       if (nthinfo->not == 1)
 657 +               printf("! ");
 658 +       printf("--every %u ", (nthinfo->every +1));
 659 +       printf("--counter %u ", (nthinfo->counter));
 660 +       if (nthinfo->startat != 0)
 661 +               printf("--start %u ", nthinfo->startat );
 662 +        if (nthinfo->packet != 0xFF)
 663 +                printf("--packet %u ", nthinfo->packet );
 664 +}
 665 +
 666 +struct ip6tables_match nth
 667 += { NULL,
 668 +    "nth",
 669 +    IPTABLES_VERSION,
 670 +    IP6T_ALIGN(sizeof(struct ip6t_nth_info)),
 671 +    IP6T_ALIGN(sizeof(struct ip6t_nth_info)),
 672 +    &help,
 673 +    &init,
 674 +    &parse,
 675 +    &final_check,
 676 +    &print,
 677 +    &save,
 678 +    opts
 679 +};
 680 +
 681 +void _init(void)
 682 +{
 683 +       register_match6(&nth);
 684 +}
 685 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libip6t_owner.c userspace/extensions/libip6t_owner.c
 686 --- iptables-1.2.8/extensions/libip6t_owner.c   Wed May 29 15:08:16 2002
 687 +++ userspace/extensions/libip6t_owner.c        Tue Jul 15 15:29:20 2003
 688 @@ -14,14 +14,26 @@
 689  static void
 690  help(void)
 691  {
 692 +#ifdef IP6T_OWNER_COMM
 693         printf(
 694  "OWNER match v%s options:\n"
 695  "[!] --uid-owner userid     Match local uid\n"
 696  "[!] --gid-owner groupid    Match local gid\n"
 697  "[!] --pid-owner processid  Match local pid\n"
 698  "[!] --sid-owner sessionid  Match local sid\n"
 699 +"[!] --cmd-owner name       Match local command name\n"
 700  "\n",
 701  IPTABLES_VERSION);
 702 +#else
 703 +       printf(
 704 +"OWNER match v%s options:\n"
 705 +"[!] --uid-owner userid     Match local uid\n"
 706 +"[!] --gid-owner groupid    Match local gid\n"
 707 +"[!] --pid-owner processid  Match local pid\n"
 708 +"[!] --sid-owner sessionid  Match local sid\n"
 709 +"\n",
 710 +IPTABLES_VERSION);
 711 +#endif /* IP6T_OWNER_COMM */
 712  }
 713
 714  static struct option opts[] = {
 715 @@ -29,6 +41,9 @@
 716         { "gid-owner", 1, 0, '2' },
 717         { "pid-owner", 1, 0, '3' },
 718         { "sid-owner", 1, 0, '4' },
 719 +#ifdef IP6T_OWNER_COMM
 720 +       { "cmd-owner", 1, 0, '5' },
 721 +#endif
 722         {0}
 723  };
 724
 725 @@ -107,6 +122,21 @@
 726                 *flags = 1;
 727                 break;
 728
 729 +#ifdef IP6T_OWNER_COMM
 730 +       case '5':
 731 +               check_inverse(optarg, &invert, &optind, 0);
 732 +               if(strlen(optarg) > sizeof(ownerinfo->comm))
 733 +                       exit_error(PARAMETER_PROBLEM, "OWNER CMD `%s' too long, max %d characters", optarg, sizeof(ownerinfo->comm));
 734 +
 735 +               strncpy(ownerinfo->comm, optarg, sizeof(ownerinfo->comm));
 736 +
 737 +               if (invert)
 738 +                       ownerinfo->invert |= IP6T_OWNER_COMM;
 739 +               ownerinfo->match |= IP6T_OWNER_COMM;
 740 +               *flags = 1;
 741 +               break;
 742 +#endif
 743 +
 744         default:
 745                 return 0;
 746         }
 747 @@ -121,7 +151,7 @@
 748                 printf(label);
 749
 750                 if (info->invert & flag)
 751 -                       fputc('!', stdout);
 752 +                       printf("! ");
 753
 754                 switch(info->match & flag) {
 755                 case IP6T_OWNER_UID:
 756 @@ -154,6 +184,11 @@
 757                 case IP6T_OWNER_SID:
 758                         printf("%u ", info->sid);
 759                         break;
 760 +#ifdef IP6T_OWNER_COMM
 761 +               case IP6T_OWNER_COMM:
 762 +                       printf("%.*s ", (int)sizeof(info->comm), info->comm);
 763 +                       break;
 764 +#endif
 765                 default:
 766                         break;
 767                 }
 768 @@ -181,6 +216,9 @@
 769         print_item(info, IP6T_OWNER_GID, numeric, "OWNER GID match ");
 770         print_item(info, IP6T_OWNER_PID, numeric, "OWNER PID match ");
 771         print_item(info, IP6T_OWNER_SID, numeric, "OWNER SID match ");
 772 +#ifdef IP6T_OWNER_COMM
 773 +       print_item(info, IP6T_OWNER_COMM, numeric, "OWNER CMD match ");
 774 +#endif
 775  }
 776
 777  /* Saves the union ip6t_matchinfo in parsable form to stdout. */
 778 @@ -193,6 +231,9 @@
 779         print_item(info, IP6T_OWNER_GID, 0, "--gid-owner ");
 780         print_item(info, IP6T_OWNER_PID, 0, "--pid-owner ");
 781         print_item(info, IP6T_OWNER_SID, 0, "--sid-owner ");
 782 +#ifdef IP6T_OWNER_COMM
 783 +       print_item(info, IP6T_OWNER_COMM, 0, "--cmd-owner ");
 784 +#endif
 785  }
 786
 787  static
 788 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libip6t_random.c userspace/extensions/libip6t_random.c
 789 --- iptables-1.2.8/extensions/libip6t_random.c  Thu Jan  1 01:00:00 1970
 790 +++ userspace/extensions/libip6t_random.c       Sat May  3 15:46:18 2003
 791 @@ -0,0 +1,152 @@
 792 +/*
 793 +   Shared library add-on to iptables to add match support for random match.
 794 +
 795 +   This file is distributed under the terms of the GNU General Public
 796 +   License (GPL). Copies of the GPL can be obtained from:
 797 +   ftp://prep.ai.mit.edu/pub/gnu/GPL
 798 +
 799 +   2001-10-14 Fabrice MARIE <fabrice@netfilter.org> : initial development.
 800 +   2003-04-30 Maciej Soltysiak <solt@dns.toxicfilms.tv> : IPv6 port.
 801 +*/
 802 +
 803 +#include <stdio.h>
 804 +#include <netdb.h>
 805 +#include <string.h>
 806 +#include <stdlib.h>
 807 +#include <syslog.h>
 808 +#include <getopt.h>
 809 +#include <ip6tables.h>
 810 +#include <linux/netfilter_ipv6/ip6_tables.h>
 811 +#include <linux/netfilter_ipv6/ip6t_random.h>
 812 +
 813 +/**
 814 + * The kernel random routing returns numbers between 0 and 255.
 815 + * To ease the task of the user in choosing the probability
 816 + * of matching, we want him to be able to use percentages.
 817 + * Therefore we have to accept numbers in percentage here,
 818 + * turn them into number between 0 and 255 for the kernel module,
 819 + * and turn them back to percentages when we print/save
 820 + * the rule.
 821 + */
 822 +
 823 +
 824 +/* Function which prints out usage message. */
 825 +static void
 826 +help(void)
 827 +{
 828 +       printf(
 829 +"random v%s options:\n"
 830 +"  [--average]     percent      The probability in percentage of the match\n"
 831 +"                               If ommited, a probability of 50%% percent is set.\n"
 832 +"                               Percentage must be within : 1 <= percent <= 99.\n\n",
 833 +IPTABLES_VERSION);
 834 +}
 835 +
 836 +static struct option opts[] = {
 837 +       { "average", 1, 0, '1' },
 838 +       { 0 }
 839 +};
 840 +
 841 +/* Initialize the target. */
 842 +static void
 843 +init(struct ip6t_entry_match *m, unsigned int *nfcache)
 844 +{
 845 +       struct ip6t_rand_info *randinfo = (struct ip6t_rand_info *)(m)->data;
 846 +       *nfcache |= NFC_UNKNOWN;
 847 +
 848 +       /* We assign the average to be 50 which is our default value */
 849 +       /* 50 * 2.55 = 128 */
 850 +       randinfo->average = 128;
 851 +}
 852 +
 853 +#define IP6T_RAND_OPT_AVERAGE  0x01
 854 +
 855 +/* Function which parses command options; returns true if it
 856 +   ate an option */
 857 +static int
 858 +parse(int c, char **argv, int invert, unsigned int *flags,
 859 +      const struct ip6t_entry *entry,
 860 +      unsigned int *nfcache,
 861 +      struct ip6t_entry_match **match)
 862 +{
 863 +       struct ip6t_rand_info *randinfo = (struct ip6t_rand_info *)(*match)->data;
 864 +       unsigned int num;
 865 +
 866 +       switch (c) {
 867 +       case '1':
 868 +               /* check for common mistakes... */
 869 +               if (invert)
 870 +                       exit_error(PARAMETER_PROBLEM,
 871 +                                  "Can't specify ! --average");
 872 +               if (*flags & IP6T_RAND_OPT_AVERAGE)
 873 +                       exit_error(PARAMETER_PROBLEM,
 874 +                                  "Can't specify --average twice");
 875 +
 876 +               /* Remember, this function will interpret a leading 0 to be
 877 +                  Octal, a leading 0x to be hexdecimal... */
 878 +                if (string_to_number(optarg, 1, 99, &num) == -1 || num < 1)
 879 +                        exit_error(PARAMETER_PROBLEM,
 880 +                                   "bad --average `%s', must be between 1 and 99", optarg);
 881 +
 882 +               /* assign the values */
 883 +               randinfo->average = (int)(num * 2.55);
 884 +               *flags |= IP6T_RAND_OPT_AVERAGE;
 885 +               break;
 886 +       default:
 887 +               return 0;
 888 +       }
 889 +       return 1;
 890 +}
 891 +
 892 +/* Final check; nothing. */
 893 +static void final_check(unsigned int flags)
 894 +{
 895 +}
 896 +
 897 +/* Prints out the targinfo. */
 898 +static void
 899 +print(const struct ip6t_ip6 *ip,
 900 +      const struct ip6t_entry_match *match,
 901 +      int numeric)
 902 +{
 903 +       const struct ip6t_rand_info *randinfo
 904 +               = (const struct ip6t_rand_info *)match->data;
 905 +       div_t result = div((randinfo->average*100), 255);
 906 +       if (result.rem > 127)  /* round up... */
 907 +               ++result.quot;
 908 +
 909 +       printf(" random %u%% ", result.quot);
 910 +}
 911 +
 912 +/* Saves the union ip6t_targinfo in parsable form to stdout. */
 913 +static void
 914 +save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match)
 915 +{
 916 +       const struct ip6t_rand_info *randinfo
 917 +               = (const struct ip6t_rand_info *)match->data;
 918 +       div_t result = div((randinfo->average *100), 255);
 919 +       if (result.rem > 127)  /* round up... */
 920 +               ++result.quot;
 921 +
 922 +       printf("--average %u ", result.quot);
 923 +}
 924 +
 925 +struct ip6tables_match rand_match
 926 += { NULL,
 927 +    "random",
 928 +    IPTABLES_VERSION,
 929 +    IP6T_ALIGN(sizeof(struct ip6t_rand_info)),
 930 +    IP6T_ALIGN(sizeof(struct ip6t_rand_info)),
 931 +    &help,
 932 +    &init,
 933 +    &parse,
 934 +    &final_check,
 935 +    &print,
 936 +    &save,
 937 +    opts
 938 +};
 939 +
 940 +void _init(void)
 941 +{
 942 +       register_match6(&rand_match);
 943 +}
 944 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_IPMARK.c userspace/extensions/libipt_IPMARK.c
 945 --- iptables-1.2.8/extensions/libipt_IPMARK.c   Thu Jan  1 01:00:00 1970
 946 +++ userspace/extensions/libipt_IPMARK.c        Tue Jul 15 15:29:20 2003
 947 @@ -0,0 +1,170 @@
 948 +/* Shared library add-on to iptables to add IPMARK target support.
 949 + * (C) 2003 by Grzegorz Janoszka <Grzegorz.Janoszka@pro.onet.pl>
 950 + *
 951 + * based on original MARK target
 952 + *
 953 + * This program is distributed under the terms of GNU GPL
 954 + */
 955 +#include <stdio.h>
 956 +#include <string.h>
 957 +#include <stdlib.h>
 958 +#include <getopt.h>
 959 +
 960 +#include <iptables.h>
 961 +#include <linux/netfilter_ipv4/ip_tables.h>
 962 +#include <linux/netfilter_ipv4/ipt_IPMARK.h>
 963 +
 964 +#define IPT_ADDR_USED        1
 965 +#define IPT_AND_MASK_USED    2
 966 +#define IPT_OR_MASK_USED     4
 967 +
 968 +struct ipmarkinfo {
 969 +       struct ipt_entry_target t;
 970 +       struct ipt_ipmark_target_info ipmark;
 971 +};
 972 +
 973 +/* Function which prints out usage message. */
 974 +static void
 975 +help(void)
 976 +{
 977 +       printf(
 978 +"IPMARK target v%s options:\n"
 979 +"  --addr src/dst         use source or destination ip address\n"
 980 +"  --and-mask value       logical AND ip address with this value becomes MARK\n"
 981 +"  --or-mask value        logical OR ip address with this value becomes MARK\n"
 982 +"\n",
 983 +IPTABLES_VERSION);
 984 +}
 985 +
 986 +static struct option opts[] = {
 987 +       { "addr", 1, 0, '1' },
 988 +       { "and-mask", 1, 0, '2' },
 989 +       { "or-mask", 1, 0, '3' },
 990 +       { 0 }
 991 +};
 992 +
 993 +/* Initialize the target. */
 994 +static void
 995 +init(struct ipt_entry_target *t, unsigned int *nfcache)
 996 +{
 997 +       struct ipt_ipmark_target_info *ipmarkinfo =
 998 +               (struct ipt_ipmark_target_info *)t->data;
 999 +
1000 +       ipmarkinfo->andmask=0xffffffff;
1001 +       ipmarkinfo->ormask=0;
1002 +
1003 +       *nfcache |= NFC_UNKNOWN;
1004 +}
1005 +
1006 +/* Function which parses command options; returns true if it
1007 +   ate an option */
1008 +static int
1009 +parse(int c, char **argv, int invert, unsigned int *flags,
1010 +      const struct ipt_entry *entry,
1011 +      struct ipt_entry_target **target)
1012 +{
1013 +       struct ipt_ipmark_target_info *ipmarkinfo
1014 +               = (struct ipt_ipmark_target_info *)(*target)->data;
1015 +
1016 +       switch (c) {
1017 +               char *end;
1018 +       case '1':
1019 +               if(!strcmp(optarg, "src")) ipmarkinfo->addr=IPT_IPMARK_SRC;
1020 +                 else if(!strcmp(optarg, "dst")) ipmarkinfo->addr=IPT_IPMARK_DST;
1021 +                   else exit_error(PARAMETER_PROBLEM, "Bad addr value `%s' - should be `src' or `dst'", optarg);
1022 +               if (*flags & IPT_ADDR_USED)
1023 +                       exit_error(PARAMETER_PROBLEM,
1024 +                                  "IPMARK target: Can't specify --addr twice");
1025 +               *flags |= IPT_ADDR_USED;
1026 +               break;
1027 +
1028 +       case '2':
1029 +               ipmarkinfo->andmask = strtoul(optarg, &end, 0);
1030 +               if (*end != '\0' || end == optarg)
1031 +                       exit_error(PARAMETER_PROBLEM, "Bad and-mask value `%s'", optarg);
1032 +               if (*flags & IPT_AND_MASK_USED)
1033 +                       exit_error(PARAMETER_PROBLEM,
1034 +                                  "IPMARK target: Can't specify --and-mask twice");
1035 +               *flags |= IPT_AND_MASK_USED;
1036 +               break;
1037 +       case '3':
1038 +               ipmarkinfo->ormask = strtoul(optarg, &end, 0);
1039 +               if (*end != '\0' || end == optarg)
1040 +                       exit_error(PARAMETER_PROBLEM, "Bad or-mask value `%s'", optarg);
1041 +               if (*flags & IPT_OR_MASK_USED)
1042 +                       exit_error(PARAMETER_PROBLEM,
1043 +                                  "IPMARK target: Can't specify --or-mask twice");
1044 +               *flags |= IPT_OR_MASK_USED;
1045 +               break;
1046 +
1047 +       default:
1048 +               return 0;
1049 +       }
1050 +
1051 +       return 1;
1052 +}
1053 +
1054 +static void
1055 +final_check(unsigned int flags)
1056 +{
1057 +       if (!(flags & IPT_ADDR_USED))
1058 +               exit_error(PARAMETER_PROBLEM,
1059 +                          "IPMARK target: Parameter --addr is required");
1060 +       if (!(flags & (IPT_AND_MASK_USED | IPT_OR_MASK_USED)))
1061 +               exit_error(PARAMETER_PROBLEM,
1062 +                          "IPMARK target: Parameter --and-mask or --or-mask is required");
1063 +}
1064 +
1065 +/* Prints out the targinfo. */
1066 +static void
1067 +print(const struct ipt_ip *ip,
1068 +      const struct ipt_entry_target *target,
1069 +      int numeric)
1070 +{
1071 +       const struct ipt_ipmark_target_info *ipmarkinfo =
1072 +               (const struct ipt_ipmark_target_info *)target->data;
1073 +
1074 +       if(ipmarkinfo->addr == IPT_IPMARK_SRC)
1075 +         printf("IPMARK src");
1076 +       else
1077 +         printf("IPMARK dst");
1078 +       printf(" ip and 0x%lx or 0x%lx", ipmarkinfo->andmask, ipmarkinfo->ormask);
1079 +}
1080 +
1081 +/* Saves the union ipt_targinfo in parsable form to stdout. */
1082 +static void
1083 +save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
1084 +{
1085 +       const struct ipt_ipmark_target_info *ipmarkinfo =
1086 +               (const struct ipt_ipmark_target_info *)target->data;
1087 +
1088 +       if(ipmarkinfo->addr == IPT_IPMARK_SRC)
1089 +         printf("--addr=src ");
1090 +       else
1091 +         printf("--addr=dst ");
1092 +       if(ipmarkinfo->andmask != 0xffffffff)
1093 +         printf("--and-mask 0x%lx ", ipmarkinfo->andmask);
1094 +       if(ipmarkinfo->ormask != 0)
1095 +         printf("--or-mask 0x%lx ", ipmarkinfo->ormask);
1096 +}
1097 +
1098 +static
1099 +struct iptables_target ipmark
1100 += { NULL,
1101 +    "IPMARK",
1102 +    IPTABLES_VERSION,
1103 +    IPT_ALIGN(sizeof(struct ipt_ipmark_target_info)),
1104 +    IPT_ALIGN(sizeof(struct ipt_ipmark_target_info)),
1105 +    &help,
1106 +    &init,
1107 +    &parse,
1108 +    &final_check,
1109 +    &print,
1110 +    &save,
1111 +    opts
1112 +};
1113 +
1114 +void _init(void)
1115 +{
1116 +       register_target(&ipmark);
1117 +}
1118 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_LOG.c userspace/extensions/libipt_LOG.c
1119 --- iptables-1.2.8/extensions/libipt_LOG.c      Sat Sep  7 16:31:01 2002
1120 +++ userspace/extensions/libipt_LOG.c   Tue Jul 15 15:29:20 2003
1121 @@ -230,16 +230,8 @@
1122         if (strcmp(loginfo->prefix, "") != 0)
1123                 printf("--log-prefix \"%s\" ", loginfo->prefix);
1124
1125 -       if (loginfo->level != LOG_DEFAULT_LEVEL) {
1126 -               for (i = 0;
1127 -                    i < sizeof(ipt_log_names) / sizeof(struct ipt_log_names);
1128 -                    i++) {
1129 -                       if (loginfo->level == ipt_log_names[i].level) {
1130 -                               printf("--log-level %s ", ipt_log_names[i].name);
1131 -                               break;
1132 -                       }
1133 -        }
1134 -    }
1135 +       if (loginfo->level != LOG_DEFAULT_LEVEL)
1136 +               printf("--log-level %d ", loginfo->level);
1137
1138         if (loginfo->logflags & IPT_LOG_TCPSEQ)
1139                 printf("--log-tcp-sequence ");
1140 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_NOTRACK.c userspace/extensions/libipt_NOTRACK.c
1141 --- iptables-1.2.8/extensions/libipt_NOTRACK.c  Thu Jan  1 01:00:00 1970
1142 +++ userspace/extensions/libipt_NOTRACK.c       Wed May 21 12:31:08 2003
1143 @@ -0,0 +1,63 @@
1144 +/* Shared library add-on to iptables to add NOTRACK target support. */
1145 +#include <stdio.h>
1146 +#include <string.h>
1147 +#include <stdlib.h>
1148 +#include <getopt.h>
1149 +
1150 +#include <iptables.h>
1151 +#include <linux/netfilter_ipv4/ip_tables.h>
1152 +
1153 +/* Function which prints out usage message. */
1154 +static void
1155 +help(void)
1156 +{
1157 +       printf(
1158 +"NOTRACK target v%s takes no options\n",
1159 +IPTABLES_VERSION);
1160 +}
1161 +
1162 +static struct option opts[] = {
1163 +       { 0 }
1164 +};
1165 +
1166 +/* Initialize the target. */
1167 +static void
1168 +init(struct ipt_entry_target *t, unsigned int *nfcache)
1169 +{
1170 +}
1171 +
1172 +/* Function which parses command options; returns true if it
1173 +   ate an option */
1174 +static int
1175 +parse(int c, char **argv, int invert, unsigned int *flags,
1176 +      const struct ipt_entry *entry,
1177 +      struct ipt_entry_target **target)
1178 +{
1179 +       return 0;
1180 +}
1181 +
1182 +static void
1183 +final_check(unsigned int flags)
1184 +{
1185 +}
1186 +
1187 +static
1188 +struct iptables_target notrack
1189 += {    .next = NULL,
1190 +       .name = "NOTRACK",
1191 +       .version = IPTABLES_VERSION,
1192 +       .size = IPT_ALIGN(0),
1193 +       .userspacesize = IPT_ALIGN(0),
1194 +       .help = &help,
1195 +       .init = &init,
1196 +       .parse = &parse,
1197 +       .final_check = &final_check,
1198 +       .print = NULL, /* print */
1199 +       .save = NULL, /* save */
1200 +       .extra_opts = opts
1201 +};
1202 +
1203 +void _init(void)
1204 +{
1205 +       register_target(&notrack);
1206 +}
1207 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_REJECT.c userspace/extensions/libipt_REJECT.c
1208 --- iptables-1.2.8/extensions/libipt_REJECT.c   Wed May 29 15:08:16 2002
1209 +++ userspace/extensions/libipt_REJECT.c        Tue May 27 19:44:29 2003
1210 @@ -9,6 +9,16 @@
1211  #include <iptables.h>
1212  #include <linux/netfilter_ipv4/ip_tables.h>
1213  #include <linux/netfilter_ipv4/ipt_REJECT.h>
1214 +#include <linux/version.h>
1215 +
1216 +/* If we are compiling against a kernel that does not support
1217 + * IPT_ICMP_ADMIN_PROHIBITED, we are emulating it.
1218 + * The result will be a plain DROP of the packet instead of
1219 + * reject. -- Maciej Soltysiak <solt@dns.toxicfilms.tv>
1220 + */
1221 +#ifndef IPT_ICMP_ADMIN_PROHIBITED
1222 +#define IPT_ICMP_ADMIN_PROHIBITED      IPT_TCP_RESET + 1
1223 +#endif
1224
1225  struct reject_names {
1226         const char *name;
1227 @@ -35,7 +45,9 @@
1228         {"icmp-host-prohibited", "host-prohib",
1229          IPT_ICMP_HOST_PROHIBITED, "ICMP host prohibited"},
1230         {"tcp-reset", "tcp-reset",
1231 -        IPT_TCP_RESET, "TCP RST packet"}
1232 +        IPT_TCP_RESET, "TCP RST packet"},
1233 +       {"icmp-admin-prohibited", "admin-prohib",
1234 +        IPT_ICMP_ADMIN_PROHIBITED, "ICMP administratively prohibited (*)"}
1235  };
1236
1237  static void
1238 @@ -64,6 +76,8 @@
1239  "                                a reply packet according to type:\n");
1240
1241         print_reject_types();
1242 +
1243 +       printf("(*) See man page or read the INCOMPATIBILITES file for compatibility issues.\n");
1244  }
1245
1246  static struct option opts[] = {
1247 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_TRACE.c userspace/extensions/libipt_TRACE.c
1248 --- iptables-1.2.8/extensions/libipt_TRACE.c    Thu Jan  1 01:00:00 1970
1249 +++ userspace/extensions/libipt_TRACE.c Wed May 21 12:31:08 2003
1250 @@ -0,0 +1,63 @@
1251 +/* Shared library add-on to iptables to add TRACE target support. */
1252 +#include <stdio.h>
1253 +#include <string.h>
1254 +#include <stdlib.h>
1255 +#include <getopt.h>
1256 +
1257 +#include <iptables.h>
1258 +#include <linux/netfilter_ipv4/ip_tables.h>
1259 +
1260 +/* Function which prints out usage message. */
1261 +static void
1262 +help(void)
1263 +{
1264 +       printf(
1265 +"TRACE target v%s takes no options\n",
1266 +IPTABLES_VERSION);
1267 +}
1268 +
1269 +static struct option opts[] = {
1270 +       { 0 }
1271 +};
1272 +
1273 +/* Initialize the target. */
1274 +static void
1275 +init(struct ipt_entry_target *t, unsigned int *nfcache)
1276 +{
1277 +}
1278 +
1279 +/* Function which parses command options; returns true if it
1280 +   ate an option */
1281 +static int
1282 +parse(int c, char **argv, int invert, unsigned int *flags,
1283 +      const struct ipt_entry *entry,
1284 +      struct ipt_entry_target **target)
1285 +{
1286 +       return 0;
1287 +}
1288 +
1289 +static void
1290 +final_check(unsigned int flags)
1291 +{
1292 +}
1293 +
1294 +static
1295 +struct iptables_target trace
1296 += {    .next = NULL,
1297 +       .name = "TRACE",
1298 +       .version = IPTABLES_VERSION,
1299 +       .size = IPT_ALIGN(0),
1300 +       .userspacesize = IPT_ALIGN(0),
1301 +       .help = &help,
1302 +       .init = &init,
1303 +       .parse = &parse,
1304 +       .final_check = &final_check,
1305 +       .print = NULL, /* print */
1306 +       .save = NULL, /* save */
1307 +       .extra_opts = opts
1308 +};
1309 +
1310 +void _init(void)
1311 +{
1312 +       register_target(&trace);
1313 +}
1314 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_XOR.c userspace/extensions/libipt_XOR.c
1315 --- iptables-1.2.8/extensions/libipt_XOR.c      Thu Jan  1 01:00:00 1970
1316 +++ userspace/extensions/libipt_XOR.c   Sat May 31 19:11:49 2003
1317 @@ -0,0 +1,112 @@
1318 +/* Shared library add-on to iptables for the XOR target
1319 + * (C) 2000 by Tim Vandermeersch <Tim.Vandermeersch@pandora.be>
1320 + * Based on libipt_TTL.c
1321 + *
1322 + * Version 1.0
1323 + *
1324 + * This program is distributed under the terms of GNU GPL
1325 + */
1326 +
1327 +#include <stdio.h>
1328 +#include <string.h>
1329 +#include <stdlib.h>
1330 +#include <getopt.h>
1331 +#include <iptables.h>
1332 +
1333 +#include <linux/netfilter_ipv4/ip_tables.h>
1334 +#include <linux/netfilter_ipv4/ipt_XOR.h>
1335 +
1336 +#define        IPT_KEY_SET             1
1337 +#define IPT_BLOCKSIZE_SET      2
1338 +
1339 +static void init(struct ipt_entry_target *t, unsigned int *nfcache)
1340 +{
1341 +}
1342 +
1343 +static void help(void)
1344 +{
1345 +       printf(
1346 +               "XOR target v%s options\n"
1347 +               "  --key string           Set key to \"string\"\n"
1348 +               "  --block-size           Set block size\n",
1349 +               IPTABLES_VERSION);
1350 +}
1351 +
1352 +static int parse(int c, char **argv, int invert, unsigned int *flags,
1353 +               const struct ipt_entry *entry,
1354 +               struct ipt_entry_target **target)
1355 +{
1356 +       struct ipt_XOR_info *info = (struct ipt_XOR_info *) (*target)->data;
1357 +
1358 +       if (!optarg)
1359 +               exit_error(PARAMETER_PROBLEM, "XOR: too few arguments");
1360 +
1361 +       if (check_inverse(optarg, &invert, NULL, 0))
1362 +               exit_error(PARAMETER_PROBLEM, "XOR: unexpected '!'");
1363 +
1364 +       switch (c) {
1365 +               case '1':
1366 +                       strncpy(info->key, optarg, 30);
1367 +                       *flags |= IPT_KEY_SET;
1368 +                       break;
1369 +               case '2':
1370 +                       info->block_size = atoi(optarg);
1371 +                       *flags |= IPT_BLOCKSIZE_SET;
1372 +                       break;
1373 +               default:
1374 +                       return 0;
1375 +       }
1376 +
1377 +       return 1;
1378 +}
1379 +
1380 +static void final_check(unsigned int flags)
1381 +{
1382 +       if (!(flags & IPT_KEY_SET))
1383 +               exit_error(PARAMETER_PROBLEM, "XOR: You must specify a key");
1384 +       if (!(flags & IPT_BLOCKSIZE_SET))
1385 +               exit_error(PARAMETER_PROBLEM, "XOR: You must specify a block-size");
1386 +}
1387 +
1388 +static void save (const struct ipt_ip *ip,
1389 +               const struct ipt_entry_target *target)
1390 +{
1391 +       const struct ipt_XOR_info *info = (struct ipt_XOR_info *) target->data;
1392 +
1393 +       printf("--key %s ", info->key);
1394 +       printf("--block-size %u ", info->block_size);
1395 +}
1396 +
1397 +static void print (const struct ipt_ip *ip,
1398 +       const struct ipt_entry_target *target, int numeric)
1399 +{
1400 +       const struct ipt_XOR_info *info = (struct ipt_XOR_info *) target->data;
1401 +
1402 +       printf("key: %s ", info->key);
1403 +       printf("block-size: %u ", info->block_size);
1404 +}
1405 +
1406 +static struct option opts[] = {
1407 +       { "key", 1, 0, '1' },
1408 +       { "block-size", 1, 0, '2' },
1409 +       { 0 }
1410 +};
1411 +
1412 +static struct iptables_target XOR = { NULL,
1413 +       "XOR",
1414 +       IPTABLES_VERSION,
1415 +       IPT_ALIGN(sizeof(struct ipt_XOR_info)),
1416 +       IPT_ALIGN(sizeof(struct ipt_XOR_info)),
1417 +       &help,
1418 +       &init,
1419 +       &parse,
1420 +       &final_check,
1421 +       &print,
1422 +       &save,
1423 +       opts
1424 +};
1425 +
1426 +void _init(void)
1427 +{
1428 +       register_target(&XOR);
1429 +}
1430 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_addrtype.c userspace/extensions/libipt_addrtype.c
1431 --- iptables-1.2.8/extensions/libipt_addrtype.c Thu Jan  1 01:00:00 1970
1432 +++ userspace/extensions/libipt_addrtype.c      Wed May  7 18:51:40 2003
1433 @@ -0,0 +1,214 @@
1434 +/* Shared library add-on to iptables to add addrtype matching support
1435 + *
1436 + * This program is released under the terms of GNU GPL */
1437 +
1438 +#include <stdio.h>
1439 +#include <stdlib.h>
1440 +#include <string.h>
1441 +#include <getopt.h>
1442 +#include <iptables.h>
1443 +
1444 +#include <linux/netfilter_ipv4/ip_tables.h>
1445 +#include <linux/netfilter_ipv4/ipt_addrtype.h>
1446 +
1447 +/* from linux/rtnetlink.h, must match order of enumeration */
1448 +static char *rtn_names[] = {
1449 +       "UNSPEC",
1450 +       "UNICAST",
1451 +       "LOCAL",
1452 +       "BROADCAST",
1453 +       "ANYCAST",
1454 +       "MULTICAST",
1455 +       "BLACKHOLE",
1456 +       "UNREACHABLE",
1457 +       "PROHIBIT",
1458 +       "THROW",
1459 +       "NAT",
1460 +       "XRESOLVE",
1461 +       NULL
1462 +};
1463 +
1464 +static void help_types(void)
1465 +{
1466 +       int i;
1467 +
1468 +       for (i = 0; rtn_names[i]; i++)
1469 +               printf("                                %s\n", rtn_names[i]);
1470 +}
1471 +
1472 +static void help(void)
1473 +{
1474 +       printf(
1475 +"Address type match v%s options:\n"
1476 +" [!] --src-type type[,...]      Match source address type\n"
1477 +" [!] --dst-type type[,...]      Match destination address type\n"
1478 +"\n"
1479 +"Valid types:           \n"
1480 +, IPTABLES_VERSION);
1481 +       help_types();
1482 +}
1483 +
1484 +static void init(struct ipt_entry_match *m, unsigned int *nfcache)
1485 +{
1486 +       /* caching not yet implemented */
1487 +       *nfcache |= NFC_UNKNOWN;
1488 +}
1489 +
1490 +static int
1491 +parse_type(const char *name, size_t strlen, u_int16_t *mask)
1492 +{
1493 +       int i;
1494 +
1495 +       for (i = 0; rtn_names[i]; i++)
1496 +               if (strncasecmp(name, rtn_names[i], strlen) == 0) {
1497 +                       /* build up bitmask for kernel module */
1498 +                       *mask |= (1 << i);
1499 +                       return 1;
1500 +               }
1501 +
1502 +       return 0;
1503 +}
1504 +
1505 +static void parse_types(const char *arg, u_int16_t *mask)
1506 +{
1507 +       const char *comma;
1508 +
1509 +       while ((comma = strchr(arg, ',')) != NULL) {
1510 +               if (comma == arg || !parse_type(arg, comma-arg, mask))
1511 +                       exit_error(PARAMETER_PROBLEM,
1512 +                                  "addrtype: bad type `%s'", arg);
1513 +               arg = comma + 1;
1514 +       }
1515 +
1516 +       if (strlen(arg) == 0 || !parse_type(arg, strlen(arg), mask))
1517 +               exit_error(PARAMETER_PROBLEM, "addrtype: bad type `%s'", arg);
1518 +}
1519 +
1520 +#define IPT_ADDRTYPE_OPT_SRCTYPE       0x1
1521 +#define IPT_ADDRTYPE_OPT_DSTTYPE       0x2
1522 +
1523 +static int parse(int c, char **argv, int invert, unsigned int *flags,
1524 +               const struct ipt_entry *entry, unsigned int *nfcache,
1525 +               struct ipt_entry_match **match)
1526 +{
1527 +       struct ipt_addrtype_info *info =
1528 +               (struct ipt_addrtype_info *) (*match)->data;
1529 +
1530 +       switch (c) {
1531 +       case '1':
1532 +               if (*flags&IPT_ADDRTYPE_OPT_SRCTYPE)
1533 +                       exit_error(PARAMETER_PROBLEM,
1534 +                                  "addrtype: can't specify src-type twice");
1535 +               check_inverse(optarg, &invert, &optind, 0);
1536 +               parse_types(argv[optind-1], &info->source);
1537 +               if (invert)
1538 +                       info->invert_source = 1;
1539 +               *flags |= IPT_ADDRTYPE_OPT_SRCTYPE;
1540 +               break;
1541 +       case '2':
1542 +               if (*flags&IPT_ADDRTYPE_OPT_DSTTYPE)
1543 +                       exit_error(PARAMETER_PROBLEM,
1544 +                                  "addrtype: can't specify dst-type twice");
1545 +               check_inverse(optarg, &invert, &optind, 0);
1546 +               parse_types(argv[optind-1], &info->dest);
1547 +               if (invert)
1548 +                       info->invert_dest = 1;
1549 +               *flags |= IPT_ADDRTYPE_OPT_DSTTYPE;
1550 +               break;
1551 +       default:
1552 +               return 0;
1553 +       }
1554 +
1555 +       return 1;
1556 +}
1557 +
1558 +static void final_check(unsigned int flags)
1559 +{
1560 +       if (!(flags & (IPT_ADDRTYPE_OPT_SRCTYPE|IPT_ADDRTYPE_OPT_DSTTYPE)))
1561 +               exit_error(PARAMETER_PROBLEM,
1562 +                          "addrtype: you must specify --src-type or --dst-type");
1563 +}
1564 +
1565 +static void print_types(u_int16_t mask)
1566 +{
1567 +       const char *sep = "";
1568 +       int i;
1569 +
1570 +       for (i = 0; rtn_names[i]; i++)
1571 +               if (mask & (1 << i)) {
1572 +                       printf("%s%s", sep, rtn_names[i]);
1573 +                       sep = ",";
1574 +               }
1575 +
1576 +       printf(" ");
1577 +}
1578 +
1579 +static void print(const struct ipt_ip *ip,
1580 +               const struct ipt_entry_match *match,
1581 +               int numeric)
1582 +{
1583 +       const struct ipt_addrtype_info *info =
1584 +               (struct ipt_addrtype_info *) match->data;
1585 +
1586 +       printf("ADDRTYPE match ");
1587 +       if (info->source) {
1588 +               printf("src-type ");
1589 +               if (info->invert_source)
1590 +                       printf("!");
1591 +               print_types(info->source);
1592 +       }
1593 +       if (info->dest) {
1594 +               printf("dst-type ");
1595 +               if (info->invert_dest)
1596 +                       printf("!");
1597 +               print_types(info->dest);
1598 +       }
1599 +}
1600 +
1601 +static void save(const struct ipt_ip *ip,
1602 +               const struct ipt_entry_match *match)
1603 +{
1604 +       const struct ipt_addrtype_info *info =
1605 +               (struct ipt_addrtype_info *) match->data;
1606 +
1607 +       if (info->source) {
1608 +               printf("--src-type ");
1609 +               if (info->invert_source)
1610 +                       printf("! ");
1611 +               print_types(info->source);
1612 +       }
1613 +       if (info->dest) {
1614 +               printf("--dst-type ");
1615 +               if (info->invert_dest)
1616 +                       printf("! ");
1617 +               print_types(info->dest);
1618 +       }
1619 +}
1620 +
1621 +static struct option opts[] = {
1622 +       { "src-type", 1, 0, '1' },
1623 +       { "dst-type", 1, 0, '2' },
1624 +       { 0 }
1625 +};
1626 +
1627 +static
1628 +struct iptables_match addrtype = {
1629 +       NULL,
1630 +       "addrtype",
1631 +       IPTABLES_VERSION,
1632 +       IPT_ALIGN(sizeof(struct ipt_addrtype_info)),
1633 +       IPT_ALIGN(sizeof(struct ipt_addrtype_info)),
1634 +       &help,
1635 +       &init,
1636 +       &parse,
1637 +       &final_check,
1638 +       &print,
1639 +       &save,
1640 +       opts
1641 +};
1642 +
1643 +
1644 +void _init(void)
1645 +{
1646 +       register_match(&addrtype);
1647 +}
1648 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_condition.c userspace/extensions/libipt_condition.c
1649 --- iptables-1.2.8/extensions/libipt_condition.c        Wed Mar 26 15:42:35 2003
1650 +++ userspace/extensions/libipt_condition.c     Thu May 22 16:33:34 2003
1651 @@ -1,3 +1,4 @@
1652 +/* Shared library add-on to iptables for condition match */
1653  #include <stdio.h>
1654  #include <stdlib.h>
1655  #include <string.h>
1656 @@ -39,13 +40,13 @@
1657         struct condition_info *info =
1658             (struct condition_info *) (*match)->data;
1659
1660 -       check_inverse(optarg, &invert, &optind, 0);
1661 -
1662         if (c == 'X') {
1663                 if (*flags)
1664                         exit_error(PARAMETER_PROBLEM,
1665                                    "Can't specify multiple conditions");
1666
1667 +               check_inverse(optarg, &invert, &optind, 0);
1668 +
1669                 if (strlen(argv[optind - 1]) < CONDITION_NAME_LEN)
1670                         strcpy(info->name, argv[optind - 1]);
1671                 else
1672 @@ -88,7 +89,7 @@
1673         const struct condition_info *info =
1674             (const struct condition_info *) match->data;
1675
1676 -       printf("--condition %s%s ", (info->invert) ? "! " : "", info->name);
1677 +       printf("--condition %s\"%s\" ", (info->invert) ? "! " : "", info->name);
1678  }
1679
1680
1681 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_connbytes.c userspace/extensions/libipt_connbytes.c
1682 --- iptables-1.2.8/extensions/libipt_connbytes.c        Thu Jan  1 01:00:00 1970
1683 +++ userspace/extensions/libipt_connbytes.c     Thu Jun 19 14:23:37 2003
1684 @@ -0,0 +1,134 @@
1685 +/* Shared library add-on to iptables to add byte tracking support. */
1686 +#include <stdio.h>
1687 +#include <netdb.h>
1688 +#include <string.h>
1689 +#include <stdlib.h>
1690 +#include <getopt.h>
1691 +#include <iptables.h>
1692 +#include <linux/netfilter_ipv4/ip_conntrack.h>
1693 +#include <linux/netfilter_ipv4/ipt_connbytes.h>
1694 +
1695 +/* Function which prints out usage message. */
1696 +static void
1697 +help(void)
1698 +{
1699 +       printf(
1700 +"connbytes v%s options:\n"
1701 +" [!] --connbytes from:[to]\n"
1702 +"                              Transfered byte range to match\n"
1703 +"\n", IPTABLES_VERSION);
1704 +}
1705 +
1706 +static struct option opts[] = {
1707 +       { "connbytes", 1, 0, '1' },
1708 +       {0}
1709 +};
1710 +
1711 +/* Initialize the match. */
1712 +static void
1713 +init(struct ipt_entry_match *m, unsigned int *nfcache)
1714 +{
1715 +       /* Can't cache this */
1716 +       *nfcache |= NFC_UNKNOWN;
1717 +}
1718 +
1719 +static void
1720 +parse_range(const char *arg, struct ipt_connbytes_info *si)
1721 +{
1722 +       char *colon,*p;
1723 +
1724 +       si->from = strtol(arg,&colon,10);
1725 +       if (*colon != ':')
1726 +               exit_error(PARAMETER_PROBLEM, "Bad range `%s'", arg);
1727 +       si->to = strtol(colon+1,&p,10);
1728 +       if (p == colon+1) {
1729 +               /* second number omited */
1730 +               si->to = 0xffffffff;
1731 +       }
1732 +       if (si->from > si->to)
1733 +               exit_error(PARAMETER_PROBLEM, "%lu should be less than %lu", si->from,si->to);
1734 +}
1735 +
1736 +/* Function which parses command options; returns true if it
1737 +   ate an option */
1738 +static int
1739 +parse(int c, char **argv, int invert, unsigned int *flags,
1740 +      const struct ipt_entry *entry,
1741 +      unsigned int *nfcache,
1742 +      struct ipt_entry_match **match)
1743 +{
1744 +       struct ipt_connbytes_info *sinfo = (struct ipt_connbytes_info *)(*match)->data;
1745 +       int i;
1746 +
1747 +       switch (c) {
1748 +       case '1':
1749 +               if (check_inverse(optarg, &invert, optind, 0))
1750 +                       optind++;
1751 +
1752 +               parse_range(argv[optind-1], sinfo);
1753 +               if (invert) {
1754 +                       i = sinfo->from;
1755 +                       sinfo->from = sinfo->to;
1756 +                       sinfo->to = i;
1757 +               }
1758 +               *flags = 1;
1759 +               break;
1760 +
1761 +       default:
1762 +               return 0;
1763 +       }
1764 +
1765 +       return 1;
1766 +}
1767 +
1768 +static void final_check(unsigned int flags)
1769 +{
1770 +       if (!flags)
1771 +               exit_error(PARAMETER_PROBLEM, "You must specify `--connbytes'");
1772 +}
1773 +
1774 +/* Prints out the matchinfo. */
1775 +static void
1776 +print(const struct ipt_ip *ip,
1777 +      const struct ipt_entry_match *match,
1778 +      int numeric)
1779 +{
1780 +       struct ipt_connbytes_info *sinfo = (struct ipt_connbytes_info *)match->data;
1781 +
1782 +       if (sinfo->from > sinfo->to)
1783 +               printf("connbytes ! %lu:%lu",sinfo->to,sinfo->from);
1784 +       else
1785 +               printf("connbytes %lu:%lu",sinfo->from,sinfo->to);
1786 +}
1787 +
1788 +/* Saves the matchinfo in parsable form to stdout. */
1789 +static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
1790 +{
1791 +       struct ipt_connbytes_info *sinfo = (struct ipt_connbytes_info *)match->data;
1792 +
1793 +       if (sinfo->from > sinfo->to)
1794 +               printf("! --connbytes %lu:%lu",sinfo->to,sinfo->from);
1795 +       else
1796 +               printf("--connbytes %lu:%lu",sinfo->from,sinfo->to);
1797 +}
1798 +
1799 +static
1800 +struct iptables_match state
1801 += { NULL,
1802 +    "connbytes",
1803 +    IPTABLES_VERSION,
1804 +    IPT_ALIGN(sizeof(struct ipt_connbytes_info)),
1805 +    IPT_ALIGN(sizeof(struct ipt_connbytes_info)),
1806 +    &help,
1807 +    &init,
1808 +    &parse,
1809 +    &final_check,
1810 +    &print,
1811 +    &save,
1812 +    opts
1813 +};
1814 +
1815 +void _init(void)
1816 +{
1817 +       register_match(&state);
1818 +}
1819 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_connlimit.c userspace/extensions/libipt_connlimit.c
1820 --- iptables-1.2.8/extensions/libipt_connlimit.c        Thu Jan  1 01:00:00 1970
1821 +++ userspace/extensions/libipt_connlimit.c     Wed Apr 30 18:54:48 2003
1822 @@ -0,0 +1,132 @@
1823 +/* Shared library add-on to iptables to add connection limit support. */
1824 +#include <stdio.h>
1825 +#include <netdb.h>
1826 +#include <string.h>
1827 +#include <stdlib.h>
1828 +#include <stddef.h>
1829 +#include <getopt.h>
1830 +#include <iptables.h>
1831 +#include <linux/netfilter_ipv4/ip_conntrack.h>
1832 +#include <linux/netfilter_ipv4/ipt_connlimit.h>
1833 +
1834 +/* Function which prints out usage message. */
1835 +static void
1836 +help(void)
1837 +{
1838 +       printf(
1839 +"connlimit v%s options:\n"
1840 +"[!] --connlimit-above n               match if the number of existing tcp connections is (not) above n\n"
1841 +" --connlimit-mask n           group hosts using mask\n"
1842 +"\n", IPTABLES_VERSION);
1843 +}
1844 +
1845 +static struct option opts[] = {
1846 +       { "connlimit-above", 1, 0, '1' },
1847 +       { "connlimit-mask",  1, 0, '2' },
1848 +       {0}
1849 +};
1850 +
1851 +/* Initialize the match. */
1852 +static void
1853 +init(struct ipt_entry_match *m, unsigned int *nfcache)
1854 +{
1855 +       /* Can't cache this */
1856 +       *nfcache |= NFC_UNKNOWN;
1857 +}
1858 +
1859 +/* Function which parses command options; returns true if it
1860 +   ate an option */
1861 +static int
1862 +parse(int c, char **argv, int invert, unsigned int *flags,
1863 +      const struct ipt_entry *entry,
1864 +      unsigned int *nfcache,
1865 +      struct ipt_entry_match **match)
1866 +{
1867 +       struct ipt_connlimit_info *info = (struct ipt_connlimit_info*)(*match)->data;
1868 +
1869 +       if (0 == (*flags & 2)) {
1870 +               /* set default mask unless we've already seen a mask option */
1871 +               info->mask = htonl(0xFFFFFFFF);
1872 +       }
1873 +
1874 +       switch (c) {
1875 +       case '1':
1876 +               check_inverse(optarg, &invert, &optind, 0);
1877 +               info->limit = atoi(argv[optind-1]);
1878 +               info->inverse = invert;
1879 +               *flags |= 1;
1880 +               break;
1881 +
1882 +       case '2':
1883 +               info->mask = htonl(0xFFFFFFFF << (32 - atoi(argv[optind-1])));
1884 +               *flags |= 2;
1885 +               break;
1886 +
1887 +       default:
1888 +               return 0;
1889 +       }
1890 +
1891 +       return 1;
1892 +}
1893 +
1894 +/* Final check */
1895 +static void final_check(unsigned int flags)
1896 +{
1897 +       if (!flags & 1)
1898 +               exit_error(PARAMETER_PROBLEM, "You must specify `--connlimit-above'");
1899 +}
1900 +
1901 +static int
1902 +count_bits(u_int32_t mask)
1903 +{
1904 +       int i, bits;
1905 +
1906 +       for (bits = 0, i = 31; i >= 0; i--) {
1907 +               if (mask & htonl((u_int32_t)1 << i)) {
1908 +                       bits++;
1909 +                       continue;
1910 +               }
1911 +               break;
1912 +       }
1913 +       return bits;
1914 +}
1915 +
1916 +/* Prints out the matchinfo. */
1917 +static void
1918 +print(const struct ipt_ip *ip,
1919 +      const struct ipt_entry_match *match,
1920 +      int numeric)
1921 +{
1922 +       struct ipt_connlimit_info *info = (struct ipt_connlimit_info*)match->data;
1923 +
1924 +       printf("#conn/%d %s %d ", count_bits(info->mask),
1925 +              info->inverse ? "<" : ">", info->limit);
1926 +}
1927 +
1928 +/* Saves the matchinfo in parsable form to stdout. */
1929 +static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
1930 +{
1931 +       struct ipt_connlimit_info *info = (struct ipt_connlimit_info*)match->data;
1932 +
1933 +       printf("%s--connlimit-above %d ",info->inverse ? "! " : "",info->limit);
1934 +       printf("--connlimit-mask %d ",count_bits(info->mask));
1935 +}
1936 +
1937 +static struct iptables_match connlimit = {
1938 +       name:           "connlimit",
1939 +       version:        IPTABLES_VERSION,
1940 +       size:           IPT_ALIGN(sizeof(struct ipt_connlimit_info)),
1941 +       userspacesize:  offsetof(struct ipt_connlimit_info,data),
1942 +       help:           help,
1943 +       init:           init,
1944 +       parse:          parse,
1945 +       final_check:    final_check,
1946 +       print:          print,
1947 +       save:           save,
1948 +       extra_opts:     opts
1949 +};
1950 +
1951 +void _init(void)
1952 +{
1953 +       register_match(&connlimit);
1954 +}
1955 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_fuzzy.c userspace/extensions/libipt_fuzzy.c
1956 --- iptables-1.2.8/extensions/libipt_fuzzy.c    Mon Aug 26 18:10:30 2002
1957 +++ userspace/extensions/libipt_fuzzy.c Mon Jun 16 13:39:36 2003
1958 @@ -6,6 +6,8 @@
1959     ftp://prep.ai.mit.edu/pub/gnu/GPL
1960
1961  2002-08-07 Hime Aguiar e Oliveira Jr. <hime@engineer.com> : Initial version.
1962 +2003-06-09 Hime Aguiar e Oliveira Jr. <hime@engineer.com> : Bug corrections in
1963 +the save function , thanks to information given by Jean-Francois Patenaude .
1964
1965  */
1966
1967 @@ -131,8 +133,8 @@
1968         const struct ipt_fuzzy_info *fuzzyinfo
1969                 = (const struct ipt_fuzzy_info *)match->data;
1970
1971 -       printf("--upper-limit %u ",fuzzyinfo->minimum_rate);
1972 -       printf("--lower-limit %u ",fuzzyinfo->maximum_rate);
1973 +       printf("--lower-limit %u ",fuzzyinfo->minimum_rate);
1974 +       printf("--upper-limit %u ",fuzzyinfo->maximum_rate);
1975
1976  }
1977
1978 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_iplimit.c userspace/extensions/libipt_iplimit.c
1979 --- iptables-1.2.8/extensions/libipt_iplimit.c  Wed May 29 15:08:16 2002
1980 +++ userspace/extensions/libipt_iplimit.c       Thu Jan  1 01:00:00 1970
1981 @@ -1,132 +0,0 @@
1982 -/* Shared library add-on to iptables to add state tracking support. */
1983 -#include <stdio.h>
1984 -#include <netdb.h>
1985 -#include <string.h>
1986 -#include <stdlib.h>
1987 -#include <stddef.h>
1988 -#include <getopt.h>
1989 -#include <iptables.h>
1990 -#include <linux/netfilter_ipv4/ip_conntrack.h>
1991 -#include <linux/netfilter_ipv4/ipt_iplimit.h>
1992 -
1993 -/* Function which prints out usage message. */
1994 -static void
1995 -help(void)
1996 -{
1997 -       printf(
1998 -"iplimit v%s options:\n"
1999 -"[!] --iplimit-above n         match if the number of existing tcp connections is (not) above n\n"
2000 -" --iplimit-mask n             group hosts using mask\n"
2001 -"\n", IPTABLES_VERSION);
2002 -}
2003 -
2004 -static struct option opts[] = {
2005 -       { "iplimit-above", 1, 0, '1' },
2006 -       { "iplimit-mask",  1, 0, '2' },
2007 -       {0}
2008 -};
2009 -
2010 -/* Initialize the match. */
2011 -static void
2012 -init(struct ipt_entry_match *m, unsigned int *nfcache)
2013 -{
2014 -       /* Can't cache this */
2015 -       *nfcache |= NFC_UNKNOWN;
2016 -}
2017 -
2018 -/* Function which parses command options; returns true if it
2019 -   ate an option */
2020 -static int
2021 -parse(int c, char **argv, int invert, unsigned int *flags,
2022 -      const struct ipt_entry *entry,
2023 -      unsigned int *nfcache,
2024 -      struct ipt_entry_match **match)
2025 -{
2026 -       struct ipt_iplimit_info *info = (struct ipt_iplimit_info*)(*match)->data;
2027 -
2028 -       if (0 == (*flags & 2)) {
2029 -               /* set default mask unless we've already seen a mask option */
2030 -               info->mask = htonl(0xFFFFFFFF);
2031 -       }
2032 -
2033 -       switch (c) {
2034 -       case '1':
2035 -               check_inverse(optarg, &invert, &optind, 0);
2036 -               info->limit = atoi(argv[optind-1]);
2037 -               info->inverse = invert;
2038 -               *flags |= 1;
2039 -               break;
2040 -
2041 -       case '2':
2042 -               info->mask = htonl(0xFFFFFFFF << (32 - atoi(argv[optind-1])));
2043 -               *flags |= 2;
2044 -               break;
2045 -
2046 -       default:
2047 -               return 0;
2048 -       }
2049 -
2050 -       return 1;
2051 -}
2052 -
2053 -/* Final check */
2054 -static void final_check(unsigned int flags)
2055 -{
2056 -       if (!flags & 1)
2057 -               exit_error(PARAMETER_PROBLEM, "You must specify `--iplimit-above'");
2058 -}
2059 -
2060 -static int
2061 -count_bits(u_int32_t mask)
2062 -{
2063 -       int i, bits;
2064 -
2065 -       for (bits = 0, i = 31; i >= 0; i--) {
2066 -               if (mask & htonl((u_int32_t)1 << i)) {
2067 -                       bits++;
2068 -                       continue;
2069 -               }
2070 -               break;
2071 -       }
2072 -       return bits;
2073 -}
2074 -
2075 -/* Prints out the matchinfo. */
2076 -static void
2077 -print(const struct ipt_ip *ip,
2078 -      const struct ipt_entry_match *match,
2079 -      int numeric)
2080 -{
2081 -       struct ipt_iplimit_info *info = (struct ipt_iplimit_info*)match->data;
2082 -
2083 -       printf("#conn/%d %s %d ", count_bits(info->mask),
2084 -              info->inverse ? "<" : ">", info->limit);
2085 -}
2086 -
2087 -/* Saves the matchinfo in parsable form to stdout. */
2088 -static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
2089 -{
2090 -       struct ipt_iplimit_info *info = (struct ipt_iplimit_info*)match->data;
2091 -
2092 -       printf("%s--iplimit-above %d ",info->inverse ? "! " : "",info->limit);
2093 -       printf("--iplimit-mask %d ",count_bits(info->mask));
2094 -}
2095 -
2096 -static struct iptables_match iplimit = {
2097 -       name:           "iplimit",
2098 -       version:        IPTABLES_VERSION,
2099 -       size:           IPT_ALIGN(sizeof(struct ipt_iplimit_info)),
2100 -       userspacesize:  offsetof(struct ipt_iplimit_info,data),
2101 -       help:           help,
2102 -       init:           init,
2103 -       parse:          parse,
2104 -       final_check:    final_check,
2105 -       print:          print,
2106 -       save:           save,
2107 -       extra_opts:     opts
2108 -};
2109 -
2110 -void _init(void)
2111 -{
2112 -       register_match(&iplimit);
2113 -}
2114 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_iprange.c userspace/extensions/libipt_iprange.c
2115 --- iptables-1.2.8/extensions/libipt_iprange.c  Thu Jan  1 01:00:00 1970
2116 +++ userspace/extensions/libipt_iprange.c       Wed Apr 23 15:27:09 2003
2117 @@ -0,0 +1,195 @@
2118 +/* Shared library add-on to iptables to add IP range matching support. */
2119 +#include <stdio.h>
2120 +#include <netdb.h>
2121 +#include <string.h>
2122 +#include <stdlib.h>
2123 +#include <getopt.h>
2124 +
2125 +#include <iptables.h>
2126 +#include <linux/netfilter_ipv4/ipt_iprange.h>
2127 +
2128 +/* Function which prints out usage message. */
2129 +static void
2130 +help(void)
2131 +{
2132 +       printf(
2133 +"iprange match v%s options:\n"
2134 +"[!] --src-range ip-ip        Match source IP in the specified range\n"
2135 +"[!] --dst-range ip-ip        Match destination IP in the specified range\n"
2136 +"\n",
2137 +IPTABLES_VERSION);
2138 +}
2139 +
2140 +static struct option opts[] = {
2141 +       { "src-range", 1, 0, '1' },
2142 +       { "dst-range", 1, 0, '2' },
2143 +       {0}
2144 +};
2145 +
2146 +/* Initialize the match. */
2147 +static void
2148 +init(struct ipt_entry_match *m, unsigned int *nfcache)
2149 +{
2150 +       /* Can't cache this. */
2151 +       *nfcache |= NFC_UNKNOWN;
2152 +}
2153 +
2154 +static void
2155 +parse_iprange(char *arg, struct ipt_iprange *range)
2156 +{
2157 +       char *dash;
2158 +       struct in_addr *ip;
2159 +
2160 +       dash = strchr(arg, '-');
2161 +       if (dash)
2162 +               *dash = '\0';
2163 +
2164 +       ip = dotted_to_addr(arg);
2165 +       if (!ip)
2166 +               exit_error(PARAMETER_PROBLEM, "iprange match: Bad IP address `%s'\n",
2167 +                          arg);
2168 +       range->min_ip = ip->s_addr;
2169 +
2170 +       if (dash) {
2171 +               ip = dotted_to_addr(dash+1);
2172 +               if (!ip)
2173 +                       exit_error(PARAMETER_PROBLEM, "iprange match: Bad IP address `%s'\n",
2174 +                                  dash+1);
2175 +               range->max_ip = ip->s_addr;
2176 +       } else
2177 +               range->max_ip = range->min_ip;
2178 +}
2179 +
2180 +/* Function which parses command options; returns true if it
2181 +   ate an option */
2182 +static int
2183 +parse(int c, char **argv, int invert, unsigned int *flags,
2184 +      const struct ipt_entry *entry,
2185 +      unsigned int *nfcache,
2186 +      struct ipt_entry_match **match)
2187 +{
2188 +       struct ipt_iprange_info *info = (struct ipt_iprange_info *)(*match)->data;
2189 +
2190 +       switch (c) {
2191 +       case '1':
2192 +               if (*flags & IPRANGE_SRC)
2193 +                       exit_error(PARAMETER_PROBLEM,
2194 +                                  "iprange match: Only use --src-range ONCE!");
2195 +               *flags |= IPRANGE_SRC;
2196 +
2197 +               info->flags |= IPRANGE_SRC;
2198 +               check_inverse(optarg, &invert, &optind, 0);
2199 +               if (invert) {
2200 +                       info->flags |= IPRANGE_SRC_INV;
2201 +                       printf("hoho\n");
2202 +               }
2203 +               parse_iprange(optarg, &info->src);
2204 +
2205 +               break;
2206 +
2207 +       case '2':
2208 +               if (*flags & IPRANGE_DST)
2209 +                       exit_error(PARAMETER_PROBLEM,
2210 +                                  "iprange match: Only use --dst-range ONCE!");
2211 +               *flags |= IPRANGE_DST;
2212 +
2213 +               info->flags |= IPRANGE_DST;
2214 +               check_inverse(optarg, &invert, &optind, 0);
2215 +               if (invert)
2216 +                       info->flags |= IPRANGE_DST_INV;
2217 +
2218 +               parse_iprange(optarg, &info->dst);
2219 +               *flags = 1;
2220 +               break;
2221 +
2222 +       default:
2223 +               return 0;
2224 +       }
2225 +       return 1;
2226 +}
2227 +
2228 +/* Final check; must have specified --src-range or --dst-range. */
2229 +static void
2230 +final_check(unsigned int flags)
2231 +{
2232 +       if (!flags)
2233 +               exit_error(PARAMETER_PROBLEM,
2234 +                          "iprange match: You must specify `--src-range' or `--dst-range'");
2235 +}
2236 +
2237 +static void
2238 +print_iprange(const struct ipt_iprange *range)
2239 +{
2240 +       const unsigned char *byte_min, *byte_max;
2241 +
2242 +       byte_min = (const unsigned char *) &(range->min_ip);
2243 +       byte_max = (const unsigned char *) &(range->max_ip);
2244 +       printf("%d.%d.%d.%d-%d.%d.%d.%d ",
2245 +               byte_min[0], byte_min[1], byte_min[2], byte_min[3],
2246 +               byte_max[0], byte_max[1], byte_max[2], byte_max[3]);
2247 +}
2248 +
2249 +/* Prints out the info. */
2250 +static void
2251 +print(const struct ipt_ip *ip,
2252 +      const struct ipt_entry_match *match,
2253 +      int numeric)
2254 +{
2255 +       struct ipt_iprange_info *info = (struct ipt_iprange_info *)match->data;
2256 +
2257 +       if (info->flags & IPRANGE_SRC) {
2258 +               printf("source IP range ");
2259 +               if (info->flags & IPRANGE_SRC_INV)
2260 +                       printf("! ");
2261 +               print_iprange(&info->src);
2262 +       }
2263 +       if (info->flags & IPRANGE_DST) {
2264 +               printf("destination IP range ");
2265 +               if (info->flags & IPRANGE_DST_INV)
2266 +                       printf("! ");
2267 +               print_iprange(&info->dst);
2268 +       }
2269 +}
2270 +
2271 +/* Saves the union ipt_info in parsable form to stdout. */
2272 +static void
2273 +save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
2274 +{
2275 +       struct ipt_iprange_info *info = (struct ipt_iprange_info *)match->data;
2276 +
2277 +       if (info->flags & IPRANGE_SRC) {
2278 +               if (info->flags & IPRANGE_SRC_INV)
2279 +                       printf("! ");
2280 +               printf("--src-range ");
2281 +               print_iprange(&info->src);
2282 +               if (info->flags & IPRANGE_DST)
2283 +                       fputc(' ', stdout);
2284 +       }
2285 +       if (info->flags & IPRANGE_DST) {
2286 +               if (info->flags & IPRANGE_DST_INV)
2287 +                       printf("! ");
2288 +               printf("--dst-range ");
2289 +               print_iprange(&info->dst);
2290 +       }
2291 +}
2292 +
2293 +static
2294 +struct iptables_match iprange
2295 += { NULL,
2296 +    "iprange",
2297 +    IPTABLES_VERSION,
2298 +    IPT_ALIGN(sizeof(struct ipt_iprange_info)),
2299 +    IPT_ALIGN(sizeof(struct ipt_iprange_info)),
2300 +    &help,
2301 +    &init,
2302 +    &parse,
2303 +    &final_check,
2304 +    &print,
2305 +    &save,
2306 +    opts
2307 +};
2308 +
2309 +void _init(void)
2310 +{
2311 +       register_match(&iprange);
2312 +}
2313 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_mac.c userspace/extensions/libipt_mac.c
2314 --- iptables-1.2.8/extensions/libipt_mac.c      Wed Oct  2 15:52:17 2002
2315 +++ userspace/extensions/libipt_mac.c   Mon Jun 16 13:39:36 2003
2316 @@ -86,11 +86,11 @@
2317         return 1;
2318  }
2319
2320 -static void print_mac(unsigned char macaddress[ETH_ALEN], int invert)
2321 +static void print_mac(unsigned char macaddress[ETH_ALEN])
2322  {
2323         unsigned int i;
2324
2325 -       printf("%s%02X", invert ? "! " : "", macaddress[0]);
2326 +       printf("%02X", macaddress[0]);
2327         for (i = 1; i < ETH_ALEN; i++)
2328                 printf(":%02X", macaddress[i]);
2329         printf(" ");
2330 @@ -111,16 +111,21 @@
2331        int numeric)
2332  {
2333         printf("MAC ");
2334 -       print_mac(((struct ipt_mac_info *)match->data)->srcaddr,
2335 -                 ((struct ipt_mac_info *)match->data)->invert);
2336 +
2337 +       if (((struct ipt_mac_info *)match->data)->invert)
2338 +               printf("! ");
2339 +
2340 +       print_mac(((struct ipt_mac_info *)match->data)->srcaddr);
2341  }
2342
2343  /* Saves the union ipt_matchinfo in parsable form to stdout. */
2344  static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
2345  {
2346 +       if (((struct ipt_mac_info *)match->data)->invert)
2347 +               printf("! ");
2348 +
2349         printf("--mac-source ");
2350 -       print_mac(((struct ipt_mac_info *)match->data)->srcaddr,
2351 -                 ((struct ipt_mac_info *)match->data)->invert);
2352 +       print_mac(((struct ipt_mac_info *)match->data)->srcaddr);
2353  }
2354
2355  static
2356 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_mport.c userspace/extensions/libipt_mport.c
2357 --- iptables-1.2.8/extensions/libipt_mport.c    Wed May 29 15:08:16 2002
2358 +++ userspace/extensions/libipt_mport.c Tue Jul 15 15:29:20 2003
2359 @@ -276,10 +276,10 @@
2360                      && minfo->ports[i-1] == minfo->ports[i])
2361                          break;
2362                 printf("%s", i ? "," : "");
2363 -               print_port(minfo->ports[i], ip->proto, 0);
2364 +               print_port(minfo->ports[i], ip->proto, 1);
2365                  if (pflags & (1<<i)) {
2366                          printf(":");
2367 -                        print_port(minfo->ports[++i], ip->proto, 0);
2368 +                        print_port(minfo->ports[++i], ip->proto, 1);
2369                  }
2370         }
2371         printf(" ");
2372 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_multiport.c userspace/extensions/libipt_multiport.c
2373 --- iptables-1.2.8/extensions/libipt_multiport.c        Wed May 29 15:08:16 2002
2374 +++ userspace/extensions/libipt_multiport.c     Tue Jul 15 15:29:20 2003
2375 @@ -237,7 +237,7 @@
2376
2377         for (i=0; i < multiinfo->count; i++) {
2378                 printf("%s", i ? "," : "");
2379 -               print_port(multiinfo->ports[i], ip->proto, 0);
2380 +               print_port(multiinfo->ports[i], ip->proto, 1);
2381         }
2382         printf(" ");
2383  }
2384 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_owner.c userspace/extensions/libipt_owner.c
2385 --- iptables-1.2.8/extensions/libipt_owner.c    Mon Jan  6 13:40:33 2003
2386 +++ userspace/extensions/libipt_owner.c Thu May 22 16:33:34 2003
2387 @@ -148,7 +148,7 @@
2388         if(info->match & flag) {
2389
2390                 if (info->invert & flag)
2391 -                       fputc('!', stdout);
2392 +                       printf("! ");
2393
2394                 printf(label);
2395
2396 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_physdev.c userspace/extensions/libipt_physdev.c
2397 --- iptables-1.2.8/extensions/libipt_physdev.c  Tue Feb 11 21:19:04 2003
2398 +++ userspace/extensions/libipt_physdev.c       Thu May 22 16:33:34 2003
2399 @@ -17,14 +17,20 @@
2400  {
2401         printf(
2402  "physdev v%s options:\n"
2403 -" --physdev-in [!] input name[+]       bridge port name ([+] for wildcard)\n"
2404 +" --physdev-in [!] input name[+]               bridge port name ([+] for wildcard)\n"
2405  " --physdev-out [!] output name[+]     bridge port name ([+] for wildcard)\n"
2406 +" [!] --physdev-is-in                  arrived on a bridge device\n"
2407 +" [!] --physdev-is-out                 will leave on a bridge device\n"
2408 +" [!] --physdev-is-bridged             it's a bridged packet\n"
2409  "\n", IPTABLES_VERSION);
2410  }
2411
2412  static struct option opts[] = {
2413         { "physdev-in", 1, 0, '1' },
2414         { "physdev-out", 1, 0, '2' },
2415 +       { "physdev-is-in", 0, 0, '3' },
2416 +       { "physdev-is-out", 0, 0, '4' },
2417 +       { "physdev-is-bridged", 0, 0, '5' },
2418         {0}
2419  };
2420
2421 @@ -83,26 +89,56 @@
2422
2423         switch (c) {
2424         case '1':
2425 -               if (*flags & IPT_PHYSDEV_OP_MATCH_IN)
2426 -                       exit_error(PARAMETER_PROBLEM,
2427 -                                  "multiple --physdev-in not allowed");
2428 +               if (*flags & IPT_PHYSDEV_OP_IN)
2429 +                       goto multiple_use;
2430                 check_inverse(optarg, &invert, &optind, 0);
2431                 parse_interface(argv[optind-1], info->physindev, info->in_mask);
2432                 if (invert)
2433 -                       info->invert |= IPT_PHYSDEV_OP_MATCH_IN;
2434 -               *flags |= IPT_PHYSDEV_OP_MATCH_IN;
2435 +                       info->invert |= IPT_PHYSDEV_OP_IN;
2436 +               info->bitmask |= IPT_PHYSDEV_OP_IN;
2437 +               *flags |= IPT_PHYSDEV_OP_IN;
2438                 break;
2439
2440         case '2':
2441 -               if (*flags & IPT_PHYSDEV_OP_MATCH_OUT)
2442 -                       exit_error(PARAMETER_PROBLEM,
2443 -                                  "multiple --physdev-out not allowed");
2444 +               if (*flags & IPT_PHYSDEV_OP_OUT)
2445 +                       goto multiple_use;
2446                 check_inverse(optarg, &invert, &optind, 0);
2447                 parse_interface(argv[optind-1], info->physoutdev,
2448                                 info->out_mask);
2449                 if (invert)
2450 -                       info->invert |= IPT_PHYSDEV_OP_MATCH_OUT;
2451 -               *flags |= IPT_PHYSDEV_OP_MATCH_OUT;
2452 +                       info->invert |= IPT_PHYSDEV_OP_OUT;
2453 +               info->bitmask |= IPT_PHYSDEV_OP_OUT;
2454 +               *flags |= IPT_PHYSDEV_OP_OUT;
2455 +               break;
2456 +
2457 +       case '3':
2458 +               if (*flags & IPT_PHYSDEV_OP_ISIN)
2459 +                       goto multiple_use;
2460 +               check_inverse(optarg, &invert, &optind, 0);
2461 +               info->bitmask |= IPT_PHYSDEV_OP_ISIN;
2462 +               if (invert)
2463 +                       info->invert |= IPT_PHYSDEV_OP_ISIN;
2464 +               *flags |= IPT_PHYSDEV_OP_ISIN;
2465 +               break;
2466 +
2467 +       case '4':
2468 +               if (*flags & IPT_PHYSDEV_OP_ISOUT)
2469 +                       goto multiple_use;
2470 +               check_inverse(optarg, &invert, &optind, 0);
2471 +               info->bitmask |= IPT_PHYSDEV_OP_ISOUT;
2472 +               if (invert)
2473 +                       info->invert |= IPT_PHYSDEV_OP_ISOUT;
2474 +               *flags |= IPT_PHYSDEV_OP_ISOUT;
2475 +               break;
2476 +
2477 +       case '5':
2478 +               if (*flags & IPT_PHYSDEV_OP_BRIDGED)
2479 +                       goto multiple_use;
2480 +               check_inverse(optarg, &invert, &optind, 0);
2481 +               if (invert)
2482 +                       info->invert |= IPT_PHYSDEV_OP_BRIDGED;
2483 +               *flags |= IPT_PHYSDEV_OP_BRIDGED;
2484 +               info->bitmask |= IPT_PHYSDEV_OP_BRIDGED;
2485                 break;
2486
2487         default:
2488 @@ -110,26 +146,16 @@
2489         }
2490
2491         return 1;
2492 -}
2493 +multiple_use:
2494 +       exit_error(PARAMETER_PROBLEM,
2495 +          "multiple use of the same physdev option is not allowed");
2496
2497 -static void final_check(unsigned int flags)
2498 -{
2499  }
2500
2501 -static void print_iface(u_int8_t invert, char *dev, char *prefix)
2502 +static void final_check(unsigned int flags)
2503  {
2504 -       char iface[IFNAMSIZ+2];
2505 -
2506 -       if (invert) {
2507 -               iface[0] = '!';
2508 -               iface[1] = '\0';
2509 -       } else
2510 -               iface[0] = '\0';
2511 -
2512 -       if (dev[0] != '\0') {
2513 -               strcat(iface, dev);
2514 -               printf("%s%s", prefix, iface);
2515 -       }
2516 +       if (flags == 0)
2517 +               exit_error(PARAMETER_PROBLEM, "PHYSDEV: no physdev option specified");
2518  }
2519
2520  static void
2521 @@ -141,10 +167,22 @@
2522                 (struct ipt_physdev_info*)match->data;
2523
2524         printf("PHYSDEV match");
2525 -       print_iface(info->invert & IPT_PHYSDEV_OP_MATCH_IN, info->physindev,
2526 -                   " physindev=");
2527 -       print_iface(info->invert & IPT_PHYSDEV_OP_MATCH_OUT, info->physoutdev,
2528 -                   " physoutdev=");
2529 +       if (info->bitmask & IPT_PHYSDEV_OP_ISIN)
2530 +               printf("%s --physdev-is-in",
2531 +                      info->invert & IPT_PHYSDEV_OP_ISIN ? " !":"");
2532 +       if (info->bitmask & IPT_PHYSDEV_OP_IN)
2533 +               printf("%s --physdev-in %s",
2534 +               (info->invert & IPT_PHYSDEV_OP_IN) ? " !":"", info->physindev);
2535 +
2536 +       if (info->bitmask & IPT_PHYSDEV_OP_ISOUT)
2537 +               printf("%s --physdev-is-out",
2538 +                      info->invert & IPT_PHYSDEV_OP_ISOUT ? " !":"");
2539 +       if (info->bitmask & IPT_PHYSDEV_OP_OUT)
2540 +               printf("%s --physdev-out %s",
2541 +               (info->invert & IPT_PHYSDEV_OP_OUT) ? " !":"", info->physoutdev);
2542 +       if (info->bitmask & IPT_PHYSDEV_OP_BRIDGED)
2543 +               printf("%s --physdev-is-bridged",
2544 +                      info->invert & IPT_PHYSDEV_OP_BRIDGED ? " !":"");
2545         printf(" ");
2546  }
2547
2548 @@ -153,10 +191,22 @@
2549         struct ipt_physdev_info *info =
2550                 (struct ipt_physdev_info*)match->data;
2551
2552 -       print_iface(info->invert & IPT_PHYSDEV_OP_MATCH_IN, info->physindev,
2553 -                   "--physdev-in ");
2554 -       print_iface(info->invert & IPT_PHYSDEV_OP_MATCH_OUT, info->physoutdev,
2555 -                   "--physdev-out ");
2556 +       if (info->bitmask & IPT_PHYSDEV_OP_ISIN)
2557 +               printf("%s --physdev-is-in",
2558 +                      info->invert & IPT_PHYSDEV_OP_ISIN ? " !":"");
2559 +       if (info->bitmask & IPT_PHYSDEV_OP_IN)
2560 +               printf("%s --physdev-in %s",
2561 +               (info->invert & IPT_PHYSDEV_OP_IN) ? " !":"", info->physindev);
2562 +
2563 +       if (info->bitmask & IPT_PHYSDEV_OP_ISOUT)
2564 +               printf("%s --physdev-is-out",
2565 +                      info->invert & IPT_PHYSDEV_OP_ISOUT ? " !":"");
2566 +       if (info->bitmask & IPT_PHYSDEV_OP_OUT)
2567 +               printf("%s --physdev-out %s",
2568 +               (info->invert & IPT_PHYSDEV_OP_OUT) ? " !":"", info->physoutdev);
2569 +       if (info->bitmask & IPT_PHYSDEV_OP_BRIDGED)
2570 +               printf("%s --physdev-is-bridged",
2571 +                      info->invert & IPT_PHYSDEV_OP_BRIDGED ? " !":"");
2572         printf(" ");
2573  }
2574
2575 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_psd.c userspace/extensions/libipt_psd.c
2576 --- iptables-1.2.8/extensions/libipt_psd.c      Wed May 29 15:08:16 2002
2577 +++ userspace/extensions/libipt_psd.c   Tue Jul 15 15:29:20 2003
2578 @@ -11,6 +11,7 @@
2579    2000-08-18 Dennis Koslowski <koslowski@astaro.de> : first release
2580    2000-12-01 Dennis Koslowski <koslowski@astaro.de> : UDP scans detection added
2581    2001-02-04 Jan Rekorajski <baggins@pld.org.pl> : converted from target to match
2582 +  2003-03-02 Harald Welte <laforge@netfilter.org>: fix 'storage' bug
2583  */
2584
2585  #include <stdio.h>
2586 @@ -82,11 +83,11 @@
2587  {
2588         struct ipt_psd_info *psdinfo = (struct ipt_psd_info *)(*match)->data;
2589         unsigned int num;
2590 -       char storage[strlen(optarg) + 2];
2591 +
2592 +       if (!optarg)
2593 +               exit_error(PARAMETER_PROBLEM, "missing optarg");
2594
2595         /* string_to_number needs a leading space */
2596 -       storage[0] = ' ';
2597 -       strcpy(&storage[1], optarg);
2598
2599         switch (c) {
2600         /* PSD-weight-threshold */
2601 @@ -95,7 +96,7 @@
2602                         exit_error(PARAMETER_PROBLEM,
2603                                    "Can't specify --psd-weight-threshold "
2604                                    "twice");
2605 -                if (string_to_number(storage, 0, 10000, &num) == -1)
2606 +                if (string_to_number(optarg, 0, 10000, &num) == -1)
2607                          exit_error(PARAMETER_PROBLEM,
2608                                     "bad --psd-weight-threshold `%s'", optarg);
2609                 psdinfo->weight_threshold = num;
2610 @@ -107,7 +108,7 @@
2611                 if (*flags & IPT_PSD_OPT_DTRESH)
2612                         exit_error(PARAMETER_PROBLEM,
2613                                    "Can't specify --psd-delay-threshold twice");
2614 -                if (string_to_number(storage, 0, 10000, &num) == -1)
2615 +                if (string_to_number(optarg, 0, 10000, &num) == -1)
2616                          exit_error(PARAMETER_PROBLEM,
2617                                     "bad --psd-delay-threshold `%s'", optarg);
2618                 psdinfo->delay_threshold = num;
2619 @@ -119,7 +120,7 @@
2620                 if (*flags & IPT_PSD_OPT_LPWEIGHT)
2621                         exit_error(PARAMETER_PROBLEM,
2622                                    "Can't specify --psd-lo-ports-weight twice");
2623 -                if (string_to_number(storage, 0, 10000, &num) == -1)
2624 +                if (string_to_number(optarg, 0, 10000, &num) == -1)
2625                          exit_error(PARAMETER_PROBLEM,
2626                                     "bad --psd-lo-ports-weight `%s'", optarg);
2627                 psdinfo->lo_ports_weight = num;
2628 @@ -131,7 +132,7 @@
2629                 if (*flags & IPT_PSD_OPT_HPWEIGHT)
2630                         exit_error(PARAMETER_PROBLEM,
2631                                    "Can't specify --psd-hi-ports-weight twice");
2632 -                if (string_to_number(storage, 0, 10000, &num) == -1)
2633 +                if (string_to_number(optarg, 0, 10000, &num) == -1)
2634                          exit_error(PARAMETER_PROBLEM,
2635                                     "bad --psd-hi-ports-weight `%s'", optarg);
2636                 psdinfo->hi_ports_weight = num;
2637 @@ -160,10 +161,10 @@
2638                 = (const struct ipt_psd_info *)match->data;
2639
2640         printf("psd ");
2641 -       printf("weight-threshold: %u ",psdinfo->weight_threshold);
2642 -       printf("delay-threshold: %u ",psdinfo->delay_threshold);
2643 -       printf("lo-ports-weight: %u ",psdinfo->lo_ports_weight);
2644 -       printf("hi-ports-weight: %u ",psdinfo->hi_ports_weight);
2645 +       printf("weight-threshold: %u ", psdinfo->weight_threshold);
2646 +       printf("delay-threshold: %u ", psdinfo->delay_threshold);
2647 +       printf("lo-ports-weight: %u ", psdinfo->lo_ports_weight);
2648 +       printf("hi-ports-weight: %u ", psdinfo->hi_ports_weight);
2649  }
2650
2651  /* Saves the union ipt_targinfo in parsable form to stdout. */
2652 @@ -175,8 +176,8 @@
2653
2654         printf("--psd-weight-threshold %u ", psdinfo->weight_threshold);
2655         printf("--psd-delay-threshold %u ", psdinfo->delay_threshold);
2656 -       printf("--psd-lo-ports-weight %u ",psdinfo->lo_ports_weight);
2657 -       printf("--psd-hi-ports-weight %u ",psdinfo->hi_ports_weight);
2658 +       printf("--psd-lo-ports-weight %u ", psdinfo->lo_ports_weight);
2659 +       printf("--psd-hi-ports-weight %u ", psdinfo->hi_ports_weight);
2660  }
2661
2662  static
2663 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_recent.c userspace/extensions/libipt_recent.c
2664 --- iptables-1.2.8/extensions/libipt_recent.c   Sun Mar 30 22:26:42 2003
2665 +++ userspace/extensions/libipt_recent.c        Tue Jun  3 20:18:04 2003
2666 @@ -8,17 +8,34 @@
2667  #include <iptables.h>
2668  #include <linux/netfilter_ipv4/ipt_recent.h>
2669
2670 -/* need thos two to not fail compilation with old kernel, new userspace */
2671 +/* Need these in order to not fail when compiling against an older kernel. */
2672  #ifndef RECENT_NAME
2673  #define RECENT_NAME    "ipt_recent"
2674  #endif /* RECENT_NAME */
2675 +
2676  #ifndef RECENT_VER
2677  #define RECENT_VER     "unknown"
2678  #endif /* RECENT_VER */
2679 +
2680  #ifndef IPT_RECENT_NAME_LEN
2681 -#define        IPT_RECENT_NAME_LEN     200
2682 +#define IPT_RECENT_NAME_LEN    200
2683  #endif /* IPT_RECENT_NAME_LEN */
2684
2685 +/* Options for this module */
2686 +static struct option opts[] = {
2687 +       { .name = "set",      .has_arg = 0, .flag = 0, .val = 201 },
2688 +       { .name = "rcheck",   .has_arg = 0, .flag = 0, .val = 202 },
2689 +       { .name = "update",   .has_arg = 0, .flag = 0, .val = 203 },
2690 +       { .name = "seconds",  .has_arg = 1, .flag = 0, .val = 204 },
2691 +       { .name = "hitcount", .has_arg = 1, .flag = 0, .val = 205 },
2692 +       { .name = "remove",   .has_arg = 0, .flag = 0, .val = 206 },
2693 +       { .name = "rttl",     .has_arg = 0, .flag = 0, .val = 207 },
2694 +       { .name = "name",     .has_arg = 1, .flag = 0, .val = 208 },
2695 +       { .name = "rsource",  .has_arg = 0, .flag = 0, .val = 209 },
2696 +       { .name = "rdest",    .has_arg = 0, .flag = 0, .val = 210 },
2697 +       { .name = 0,          .has_arg = 0, .flag = 0, .val = 0   }
2698 +};
2699 +
2700  /* Function which prints out usage message. */
2701  static void
2702  help(void)
2703 @@ -41,28 +58,14 @@
2704  "                                Useful if you have problems with people spoofing their source address in order\n"
2705  "                                to DoS you via this module.\n"
2706  "    --name name                 Name of the recent list to be used.  DEFAULT used if none given.\n"
2707 -"    --rsource                   Save the source address of each packet in the recent list table (default).\n"
2708 -"    --rdest                     Save the destination address of each packet in the recent list table.\n"
2709 +"    --rsource                   Match/Save the source address of each packet in the recent list table (default).\n"
2710 +"    --rdest                     Match/Save the destination address of each packet in the recent list table.\n"
2711  RECENT_NAME " " RECENT_VER ": Stephen Frost <sfrost@snowman.net>.  http://snowman.net/projects/ipt_recent/\n"
2712  ,
2713  IPTABLES_VERSION);
2714
2715  }
2716
2717 -static struct option opts[] = {
2718 -       { "set", 0, 0, 201 },
2719 -       { "rcheck", 0, 0, 202 },
2720 -       { "update", 0, 0, 203 },
2721 -       { "seconds", 1, 0, 204 },
2722 -       { "hitcount", 1, 0, 205 },
2723 -       { "remove",0, 0, 206 },
2724 -       { "rttl",0, 0, 207},
2725 -       { "name", 1, 0, 208},
2726 -       { "rsource", 0, 0, 209},
2727 -       { "rdest", 0, 0, 210},
2728 -       {0}
2729 -};
2730 -
2731  /* Initialize the match. */
2732  static void
2733  init(struct ipt_entry_match *match, unsigned int *nfcache)
2734 @@ -175,7 +178,8 @@
2735  {
2736         struct ipt_recent_info *info = (struct ipt_recent_info *)match->data;
2737
2738 -       if (info->invert) fputc('!', stdout);
2739 +       if (info->invert)
2740 +               fputc('!', stdout);
2741
2742         printf("recent: ");
2743         if(info->check_set & IPT_RECENT_SET) printf("SET ");
2744 @@ -194,37 +198,37 @@
2745  static void
2746  save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
2747  {
2748 -       struct ipt_recent_info *info = (struct ipt_recent_info *)match;
2749 +       struct ipt_recent_info *info = (struct ipt_recent_info *)match->data;
2750
2751 -       if (info->invert) fputc('!', stdout);
2752 +       if (info->invert)
2753 +               printf("! ");
2754
2755 -       printf("recent: ");
2756         if(info->check_set & IPT_RECENT_SET) printf("--set ");
2757         if(info->check_set & IPT_RECENT_CHECK) printf("--rcheck ");
2758         if(info->check_set & IPT_RECENT_UPDATE) printf("--update ");
2759         if(info->check_set & IPT_RECENT_REMOVE) printf("--remove ");
2760         if(info->seconds) printf("--seconds %d ",info->seconds);
2761         if(info->hit_count) printf("--hitcount %d ",info->hit_count);
2762 -       if(info->check_set & IPT_RECENT_TTL) printf("-rttl ");
2763 +       if(info->check_set & IPT_RECENT_TTL) printf("--rttl ");
2764         if(info->name) printf("--name %s ",info->name);
2765         if(info->side == IPT_RECENT_SOURCE) printf("--rsource ");
2766         if(info->side == IPT_RECENT_DEST) printf("--rdest ");
2767  }
2768
2769 -static
2770 -struct iptables_match recent
2771 -= { NULL,
2772 -    "recent",
2773 -    IPTABLES_VERSION,
2774 -    IPT_ALIGN(sizeof(struct ipt_recent_info)),
2775 -    IPT_ALIGN(sizeof(struct ipt_recent_info)),
2776 -    &help,
2777 -    &init,
2778 -    &parse,
2779 -    &final_check,
2780 -    &print,
2781 -    &save,
2782 -    opts
2783 +/* Structure for iptables to use to communicate with module */
2784 +static struct iptables_match recent = {
2785 +    .next          = NULL,
2786 +    .name          = "recent",
2787 +    .version       = IPTABLES_VERSION,
2788 +    .size          = IPT_ALIGN(sizeof(struct ipt_recent_info)),
2789 +    .userspacesize = IPT_ALIGN(sizeof(struct ipt_recent_info)),
2790 +    .help          = &help,
2791 +    .init          = &init,
2792 +    .parse         = &parse,
2793 +    .final_check   = &final_check,
2794 +    .print         = &print,
2795 +    .save          = &save,
2796 +    .extra_opts    = opts
2797  };
2798
2799  void _init(void)
2800 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_sctp.c userspace/extensions/libipt_sctp.c
2801 --- iptables-1.2.8/extensions/libipt_sctp.c     Thu Jan  1 01:00:00 1970
2802 +++ userspace/extensions/libipt_sctp.c  Sat May  3 20:05:58 2003
2803 @@ -0,0 +1,402 @@
2804 +/* Shared library add-on to iptables for SCTP matching
2805 + *
2806 + * (C) 2003 by Harald Welte <laforge@gnumonks.org>
2807 + *
2808 + * This program is distributed under the terms of GNU GPL v2, 1991
2809 + *
2810 + * libipt_ecn.c borrowed heavily from libipt_dscp.c
2811 + *
2812 + */
2813 +#include <stdio.h>
2814 +#include <string.h>
2815 +#include <stdlib.h>
2816 +#include <getopt.h>
2817 +#include <netdb.h>
2818 +
2819 +#include <iptables.h>
2820 +#include <linux/netfilter_ipv4/ip_tables.h>
2821 +#include <linux/netfilter_ipv4/ipt_sctp.h>
2822 +
2823 +/* Initialize the match. */
2824 +static void
2825 +init(struct ipt_entry_match *m, unsigned int *nfcache)
2826 +{
2827 +       struct ipt_sctp_info *einfo = (struct ipt_sctp_info *)m->data;
2828 +
2829 +       einfo->spts[1] = einfo->dpts[1] = 0xFFFF;
2830 +}
2831 +
2832 +static void help(void)
2833 +{
2834 +       printf(
2835 +"SCTP match v%s options\n"
2836 +" --sctp-chunks [!] mask comp  match when SCTP chunks & mask == comp\n"
2837 +" --source-port [!] port[:port]\n"
2838 +" --sport ...\n"
2839 +"                               match source port(s)"
2840 +" --destination-port [!] port[:port]\n"
2841 +" --dport ...\n\n",
2842 +       IPTABLES_VERSION);
2843 +}
2844 +
2845 +static struct option opts[] = {
2846 +       { .name = "source-port", .has_arg = 1, .flag = 0, .val = '1' },
2847 +       { .name = "sport", .has_arg = 1, .flag = 0, .val = '1' },
2848 +       { .name = "destination-port", .has_arg = 1, .flag = 0, .val = '2' },
2849 +       { .name = "dport", .has_arg = 1, .flag = 0, .val = '2' },
2850 +       { .name = "sctp-chunks", .has_arg = 1, .flag = 0, .val = '3' },
2851 +       { .name = 0 }
2852 +};
2853 +
2854 +static int
2855 +service_to_port(const char *name)
2856 +{
2857 +       struct servent *service;
2858 +
2859 +       if ((service = getservbyname(name, "sctp")) != NULL)
2860 +               return ntohs((unsigned short) service->s_port);
2861 +
2862 +       return -1;
2863 +}
2864 +
2865 +static u_int16_t
2866 +parse_sctp_port(const char *port)
2867 +{
2868 +       unsigned int portnum;
2869 +
2870 +       if (string_to_number(port, 0, 65535, &portnum) != -1 ||
2871 +           (portnum = service_to_port(port)) != -1)
2872 +               return (u_int16_t)portnum;
2873 +
2874 +       exit_error(PARAMETER_PROBLEM,
2875 +                  "invalid TCP port/service `%s' specified", port);
2876 +}
2877 +
2878 +
2879 +static void
2880 +parse_sctp_ports(const char *portstring, u_int16_t *ports)
2881 +{
2882 +       char *buffer;
2883 +       char *cp;
2884 +
2885 +       buffer = strdup(portstring);
2886 +       if ((cp = strchr(buffer, ':')) == NULL)
2887 +               ports[0] = ports[1] = parse_sctp_port(buffer);
2888 +       else {
2889 +               *cp = '\0';
2890 +               cp++;
2891 +
2892 +               ports[0] = buffer[0] ? parse_sctp_port(buffer) : 0;
2893 +               ports[1] = cp[0] ? parse_sctp_port(cp) : 0xFFFF;
2894 +
2895 +               if (ports[0] > ports[1])
2896 +                       exit_error(PARAMETER_PROBLEM,
2897 +                                  "invalid portrange (min > max)");
2898 +       }
2899 +       free(buffer);
2900 +}
2901 +
2902 +struct sctp_chunk_names {
2903 +       const char *name;
2904 +       unsigned int flag;
2905 +};
2906 +
2907 +/* FIXME: */
2908 +#define ALL_CHUNKS     0xabcdef
2909 +static struct sctp_chunk_names sctp_chunk_names[]
2910 += { { .name = "DATA",          .flag = (1 << 0) },
2911 +    { .name = "INIT",          .flag = (1 << 1) },
2912 +    { .name = "INIT_ACK",      .flag = (1 << 2) },
2913 +    { .name = "SACK",          .flag = (1 << 3) },
2914 +    { .name = "HEARTBEAT",     .flag = (1 << 4) },
2915 +    { .name = "HEARTBEAT_ACK", .flag = (1 << 5) },
2916 +    { .name = "ABORT",         .flag = (1 << 6) },
2917 +    { .name = "SHUTDOWN",      .flag = (1 << 7) },
2918 +    { .name = "SHUTDOWN_ACK",  .flag = (1 << 8) },
2919 +    { .name = "ERROR",         .flag = (1 << 9) },
2920 +    { .name = "COOKIE_ECHO",   .flag = (1 << 10) },
2921 +    { .name = "COOKIE_ACK",    .flag = (1 << 11) },
2922 +    { .name = "ECN_ECNE",      .flag = (1 << 12) },
2923 +    { .name = "ECN_CWR",       .flag = (1 << 13) },
2924 +    { .name = "SHUTDOWN_COMPLETE", .flag = (1 << 14) },
2925 +    { .name = "ASCONF",                .flag = (1 << 31) },
2926 +    { .name = "ASCONF_ACK",    .flag = (1 << 30) },
2927 +    { .name = "ALL",           .flag = ALL_CHUNKS },
2928 +    { .name = "NONE",          .flag = 0 },
2929 +};
2930 +
2931 +
2932 +static unsigned int
2933 +parse_sctp_chunk(const char *flags)
2934 +{
2935 +       unsigned int ret = 0;
2936 +       char *ptr;
2937 +       char *buffer;
2938 +
2939 +       buffer = strdup(flags);
2940 +
2941 +       for (ptr = strtok(buffer, ","); ptr; ptr = strtok(NULL, ",")) {
2942 +               unsigned int i;
2943 +               int found = 0;
2944 +               for (i = 0;
2945 +                    i < sizeof(sctp_chunk_names)/sizeof(struct sctp_chunk_names);
2946 +                    i++) {
2947 +                       if (strcasecmp(sctp_chunk_names[i].name, ptr) == 0) {
2948 +                               ret |= sctp_chunk_names[i].flag;
2949 +                               found = 1;
2950 +                               break;
2951 +                       }
2952 +               }
2953 +               if (!found)
2954 +                       exit_error(PARAMETER_PROBLEM,
2955 +                                  "Unknown sctp chunk `%s'", ptr);
2956 +       }
2957 +
2958 +       free(buffer);
2959 +       return ret;
2960 +}
2961 +
2962 +static void
2963 +parse_sctp_chunks(struct ipt_sctp_info *einfo,
2964 +               const char *mask,
2965 +               const char *cmp,
2966 +               int invert)
2967 +{
2968 +       einfo->chunks = parse_sctp_chunk(mask);
2969 +       einfo->chunk_mask = parse_sctp_chunk(cmp);
2970 +
2971 +       if (invert)
2972 +               einfo->invflags |= IPT_SCTP_INV_CHUNKS;
2973 +}
2974 +
2975 +#define SCTP_SRC_PORTS 0x01
2976 +#define SCTP_DST_PORTS 0x02
2977 +#define SCTP_CHUNKS    0x03
2978 +
2979 +static int
2980 +parse(int c, char **argv, int invert, unsigned int *flags,
2981 +      const struct ipt_entry *entry,
2982 +      unsigned int *nfcache,
2983 +      struct ipt_entry_match **match)
2984 +{
2985 +       struct ipt_sctp_info *einfo
2986 +               = (struct ipt_sctp_info *)(*match)->data;
2987 +
2988 +       switch (c) {
2989 +       case '1':
2990 +               if (*flags & SCTP_SRC_PORTS)
2991 +                       exit_error(PARAMETER_PROBLEM,
2992 +                                  "Only one `--source-port' allowed");
2993 +               check_inverse(optarg, &invert, &optind, 0);
2994 +               parse_sctp_ports(argv[optind-1], einfo->spts);
2995 +               if (invert)
2996 +                       einfo->invflags |= IPT_SCTP_INV_SRCPT;
2997 +               *flags |= SCTP_SRC_PORTS;
2998 +               *nfcache |= NFC_IP_SRC_PT;
2999 +               break;
3000 +
3001 +       case '2':
3002 +               if (*flags & SCTP_DST_PORTS)
3003 +                       exit_error(PARAMETER_PROBLEM,
3004 +                                  "Only one `--destination-port' allowed");
3005 +               check_inverse(optarg, &invert, &optind, 0);
3006 +               parse_sctp_ports(argv[optind-1], einfo->dpts);
3007 +               if (invert)
3008 +                       einfo->invflags |= IPT_SCTP_INV_DSTPT;
3009 +               *flags |= SCTP_DST_PORTS;
3010 +               *nfcache |= NFC_IP_DST_PT;
3011 +               break;
3012 +
3013 +       case '3':
3014 +               if (*flags & SCTP_CHUNKS)
3015 +                       exit_error(PARAMETER_PROBLEM,
3016 +                                  "Only one `--sctp-chunks' allowed");
3017 +               check_inverse(optarg, &invert, &optind, 0);
3018 +
3019 +               if (!argv[optind]
3020 +                   || argv[optind][0] == '-' || argv[optind][0] == '!')
3021 +                       exit_error(PARAMETER_PROBLEM,
3022 +                                  "--sctp-chunks requires two args");
3023 +
3024 +               parse_sctp_chunks(einfo, argv[optind-1], argv[optind], invert);
3025 +               optind++;
3026 +               *flags |= SCTP_CHUNKS;
3027 +               break;
3028 +       default:
3029 +               return 0;
3030 +       }
3031 +
3032 +       return 1;
3033 +}
3034 +
3035 +static void
3036 +final_check(unsigned int flags)
3037 +{
3038 +}
3039 +
3040 +static char *
3041 +port_to_service(int port)
3042 +{
3043 +       struct servent *service;
3044 +
3045 +       if ((service = getservbyport(htons(port), "sctp")))
3046 +               return service->s_name;
3047 +
3048 +       return NULL;
3049 +}
3050 +
3051 +static void
3052 +print_port(u_int16_t port, int numeric)
3053 +{
3054 +       char *service;
3055 +
3056 +       if (numeric || (service = port_to_service(port)) == NULL)
3057 +               printf("%u", port);
3058 +       else
3059 +               printf("%s", service);
3060 +}
3061 +
3062 +static void
3063 +print_ports(const char *name, u_int16_t min, u_int16_t max,
3064 +           int invert, int numeric)
3065 +{
3066 +       const char *inv = invert ? "!" : "";
3067 +
3068 +       if (min != 0 || max != 0xFFFF || invert) {
3069 +               printf("%s", name);
3070 +               if (min == max) {
3071 +                       printf(":%s", inv);
3072 +                       print_port(min, numeric);
3073 +               } else {
3074 +                       printf("s:%s", inv);
3075 +                       print_port(min, numeric);
3076 +                       printf(":");
3077 +                       print_port(max, numeric);
3078 +               }
3079 +               printf(" ");
3080 +       }
3081 +}
3082 +
3083 +static void
3084 +print_chunk(u_int32_t chunks)
3085 +{
3086 +       unsigned int have_flag = 0;
3087 +
3088 +       while (chunks) {
3089 +               unsigned int i;
3090 +
3091 +               for (i = 0; (chunks & sctp_chunk_names[i].flag) == 0; i++);
3092 +
3093 +               if (have_flag)
3094 +                       printf(",");
3095 +               printf("%s", sctp_chunk_names[i].name);
3096 +               have_flag = 1;
3097 +
3098 +               chunks &= ~sctp_chunk_names[i].flag;
3099 +       }
3100 +
3101 +       if (!have_flag)
3102 +               printf("NONE");
3103 +}
3104 +
3105 +static void
3106 +print_chunks(u_int32_t mask, u_int32_t cmp, int invert, int numeric)
3107 +{
3108 +       if (mask || invert) {
3109 +               printf("flags:%s", invert ? "!" : "");
3110 +               if (numeric)
3111 +                       printf("0x%04X/0x%04X ", mask, cmp);
3112 +               else {
3113 +                       print_chunk(mask);
3114 +                       printf("/");
3115 +                       print_chunk(cmp);
3116 +                       printf(" ");
3117 +               }
3118 +       }
3119 +}
3120 +
3121 +/* Prints out the matchinfo. */
3122 +static void
3123 +print(const struct ipt_ip *ip,
3124 +      const struct ipt_entry_match *match,
3125 +      int numeric)
3126 +{
3127 +       const struct ipt_sctp_info *einfo =
3128 +               (const struct ipt_sctp_info *)match->data;
3129 +
3130 +       printf("sctp ");
3131 +
3132 +       print_ports("spt", einfo->spts[0], einfo->spts[1],
3133 +                   einfo->invflags & IPT_SCTP_INV_SRCPT,
3134 +                   numeric);
3135 +       print_ports("dpt", einfo->dpts[0], einfo->dpts[1],
3136 +                   einfo->invflags & IPT_SCTP_INV_DSTPT,
3137 +                   numeric);
3138 +
3139 +       print_chunks(einfo->chunks, einfo->chunk_mask,
3140 +                    einfo->invflags & ~IPT_SCTP_INV_MASK,
3141 +                    numeric);
3142 +}
3143 +
3144 +/* Saves the union ipt_matchinfo in parsable form to stdout. */
3145 +static void
3146 +save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
3147 +{
3148 +       const struct ipt_sctp_info *einfo =
3149 +               (const struct ipt_sctp_info *)match->data;
3150 +
3151 +       if (einfo->spts[0] != 0
3152 +           || einfo->spts[1] != 0xFFFF) {
3153 +               if (einfo->invflags & IPT_SCTP_INV_SRCPT)
3154 +                       printf("! ");
3155 +               if (einfo->spts[0] != einfo->spts[1])
3156 +                       printf("--sport %u:%u ",
3157 +                              einfo->spts[0], einfo->spts[1]);
3158 +               else
3159 +                       printf("--sport %u ", einfo->spts[0]);
3160 +       }
3161 +
3162 +       if (einfo->dpts[0] != 0
3163 +           || einfo->dpts[1] != 0xFFFF) {
3164 +               if (einfo->invflags & IPT_SCTP_INV_DSTPT)
3165 +                       printf("! ");
3166 +               if (einfo->dpts[0] != einfo->dpts[1])
3167 +                       printf("--dport %u:%u ",
3168 +                              einfo->dpts[0], einfo->dpts[1]);
3169 +               else
3170 +                       printf("--dport %u ", einfo->dpts[0]);
3171 +       }
3172 +
3173 +       if (einfo->chunks
3174 +           || (einfo->invflags & IPT_SCTP_INV_CHUNKS)) {
3175 +               if (einfo->invflags & IPT_SCTP_INV_CHUNKS)
3176 +                       printf("! ");
3177 +               printf("--sctp-chunks ");
3178 +               if (einfo->chunks != ALL_CHUNKS) {
3179 +                       print_chunk(einfo->chunks);
3180 +               }
3181 +               printf(" ");
3182 +               print_chunk(einfo->chunk_mask);
3183 +               printf(" ");
3184 +       }
3185 +}
3186 +
3187 +static
3188 +struct iptables_match sctp
3189 += { .name          = "sctp",
3190 +    .version       = IPTABLES_VERSION,
3191 +    .size          = IPT_ALIGN(sizeof(struct ipt_sctp_info)),
3192 +    .userspacesize = IPT_ALIGN(sizeof(struct ipt_sctp_info)),
3193 +    .help          = &help,
3194 +    .init          = &init,
3195 +    .parse         = &parse,
3196 +    .final_check   = &final_check,
3197 +    .print         = &print,
3198 +    .save          = &save,
3199 +    .extra_opts    = opts
3200 +};
3201 +
3202 +void _init(void)
3203 +{
3204 +       register_match(&sctp);
3205 +}
3206 diff -urN -x CVS -x .cvsignore iptables-1.2.8/extensions/libipt_string.c userspace/extensions/libipt_string.c
3207 --- iptables-1.2.8/extensions/libipt_string.c   Wed Feb 26 18:34:13 2003
3208 +++ userspace/extensions/libipt_string.c        Thu May 22 16:33:34 2003
3209 @@ -18,23 +18,26 @@
3210  #include <iptables.h>
3211  #include <linux/netfilter_ipv4/ipt_string.h>
3212
3213 +
3214  /* Function which prints out usage message. */
3215  static void
3216  help(void)
3217  {
3218         printf(
3219  "STRING match v%s options:\n"
3220 -"--string [!] string             Match a string in a packet\n",
3221 +"--string [!] string          Match a string in a packet\n"
3222 +"--hex-string [!] string      Match a hex string in a packet\n",
3223  IPTABLES_VERSION);
3224 -
3225 -       fputc('\n', stdout);
3226  }
3227
3228 +
3229  static struct option opts[] = {
3230 -       { "string", 1, 0, '1' },
3231 -       {0}
3232 +       { .name = "string",     .has_arg = 1, .flag = 0, .val = '1' },
3233 +       { .name = "hex-string", .has_arg = 1, .flag = 0, .val = '2' },
3234 +       { .name = 0 }
3235  };
3236
3237 +
3238  /* Initialize the match. */
3239  static void
3240  init(struct ipt_entry_match *m, unsigned int *nfcache)
3241 @@ -42,9 +45,18 @@
3242         *nfcache |= NFC_UNKNOWN;
3243  }
3244
3245 +
3246  static void
3247  parse_string(const unsigned char *s, struct ipt_string_info *info)
3248  {
3249 +       if (strlen(s) <= BM_MAX_NLEN) strcpy(info->string, s);
3250 +       else exit_error(PARAMETER_PROBLEM, "STRING too long `%s'", s);
3251 +}
3252 +
3253 +
3254 +static void
3255 +parse_hex_string(const unsigned char *s, struct ipt_string_info *info)
3256 +{
3257         int i=0, slen, sindex=0, schar;
3258         short hex_f = 0, literal_f = 0;
3259         char hextmp[3];
3260 @@ -90,6 +102,10 @@
3261                                 /* must end with a "|" */
3262                                 exit_error(PARAMETER_PROBLEM, "Invalid hex block");
3263                         }
3264 +                       if (! isxdigit(s[i])) /* check for valid hex char */
3265 +                               exit_error(PARAMETER_PROBLEM, "Invalid hex char `%c'", s[i]);
3266 +                       if (! isxdigit(s[i+1])) /* check for valid hex char */
3267 +                               exit_error(PARAMETER_PROBLEM, "Invalid hex char `%c'", s[i+1]);
3268                         hextmp[0] = s[i];
3269                         hextmp[1] = s[i+1];
3270                         hextmp[2] = '\0';
3271 @@ -109,8 +125,10 @@
3272                         exit_error(PARAMETER_PROBLEM, "STRING too long `%s'", s);
3273                 sindex++;
3274         }
3275 +       info->len = sindex;
3276  }
3277
3278 +
3279  /* Function which parses command options; returns true if it
3280     ate an option */
3281  static int
3282 @@ -123,11 +141,27 @@
3283
3284         switch (c) {
3285         case '1':
3286 +               if (*flags)
3287 +                       exit_error(PARAMETER_PROBLEM,
3288 +                                  "Can't specify multiple strings");
3289 +
3290                 check_inverse(optarg, &invert, &optind, 0);
3291                 parse_string(argv[optind-1], stringinfo);
3292                 if (invert)
3293                         stringinfo->invert = 1;
3294 -                stringinfo->len=strlen((char *)&stringinfo->string);
3295 +               stringinfo->len=strlen((char *)&stringinfo->string);
3296 +               *flags = 1;
3297 +               break;
3298 +
3299 +       case '2':
3300 +               if (*flags)
3301 +                       exit_error(PARAMETER_PROBLEM,
3302 +                                  "Can't specify multiple strings");
3303 +
3304 +               check_inverse(optarg, &invert, &optind, 0);
3305 +               parse_hex_string(argv[optind-1], stringinfo);  /* sets length */
3306 +               if (invert)
3307 +                       stringinfo->invert = 1;
3308                 *flags = 1;
3309                 break;
3310
3311 @@ -137,14 +171,6 @@
3312         return 1;
3313  }
3314
3315 -static void
3316 -print_string(char string[], int invert, int numeric)
3317 -{
3318 -
3319 -       if (invert)
3320 -               fputc('!', stdout);
3321 -       printf("%s ",string);
3322 -}
3323
3324  /* Final check; must have specified --string. */
3325  static void
3326 @@ -155,42 +181,46 @@
3327                            "STRING match: You must specify `--string'");
3328  }
3329
3330 +
3331  /* Prints out the matchinfo. */
3332  static void
3333  print(const struct ipt_ip *ip,
3334        const struct ipt_entry_match *match,
3335        int numeric)
3336  {
3337 -       printf("STRING match ");
3338 -       print_string(((struct ipt_string_info *)match->data)->string,
3339 -                 ((struct ipt_string_info *)match->data)->invert, numeric);
3340 +       const struct ipt_string_info *info =
3341 +           (const struct ipt_string_info*) match->data;
3342 +
3343 +       printf("STRING match %s%s ", (info->invert) ? "!" : "", info->string);
3344  }
3345
3346 -/* Saves the union ipt_matchinfo in parsable form to stdout. */
3347 +
3348 +/* Saves the union ipt_matchinfo in parseable form to stdout. */
3349  static void
3350  save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
3351  {
3352 -       printf("--string ");
3353 -       print_string(((struct ipt_string_info *)match->data)->string,
3354 -                 ((struct ipt_string_info *)match->data)->invert, 0);
3355 -}
3356 -
3357 -static
3358 -struct iptables_match string
3359 -= { NULL,
3360 -    "string",
3361 -    IPTABLES_VERSION,
3362 -    IPT_ALIGN(sizeof(struct ipt_string_info)),
3363 -    IPT_ALIGN(sizeof(struct ipt_string_info)),
3364 -    &help,
3365 -    &init,
3366 -    &parse,
3367 -    &final_check,
3368 -    &print,
3369 -    &save,
3370 -    opts
3371 +       const struct ipt_string_info *info =
3372 +           (const struct ipt_string_info*) match->data;
3373 +
3374 +       printf("--string %s%s ", (info->invert) ? "! ": "", info->string);
3375 +}
3376 +
3377 +
3378 +static struct iptables_match string = {
3379 +    .name          = "string",
3380 +    .version       = IPTABLES_VERSION,
3381 +    .size          = IPT_ALIGN(sizeof(struct ipt_string_info)),
3382 +    .userspacesize = IPT_ALIGN(sizeof(struct ipt_string_info)),
3383 +    .help          = &help,
3384 +    .init          = &init,
3385 +    .parse         = &parse,
3386 +    .final_check   = &final_check,
3387 +    .print         = &print,
3388 +    .save          = &save,
3389 +    .extra_opts    = opts
3390  };
3391
3392 +
3393  void _init(void)
3394  {
3395         register_match(&string);
3396 diff -urN -x CVS -x .cvsignore iptables-1.2.8/include/libiptc/libip6tc.h userspace/include/libiptc/libip6tc.h
3397 --- iptables-1.2.8/include/libiptc/libip6tc.h   Mon Feb 25 10:00:36 2002
3398 +++ userspace/include/libiptc/libip6tc.h        Thu May 22 16:33:34 2003
3399 @@ -26,6 +26,9 @@
3400  /* Take a snapshot of the rules. Returns NULL on error. */
3401  ip6tc_handle_t ip6tc_init(const char *tablename);
3402
3403 +/* Cleanup after ip6tc_init(). */
3404 +void ip6tc_free(ip6tc_handle_t *h);
3405 +
3406  /* Iterator functions to run through the chains.  Returns NULL at end. */
3407  const char *ip6tc_first_chain(ip6tc_handle_t *handle);
3408  const char *ip6tc_next_chain(ip6tc_handle_t *handle);
3409 diff -urN -x CVS -x .cvsignore iptables-1.2.8/include/libiptc/libiptc.h userspace/include/libiptc/libiptc.h
3410 --- iptables-1.2.8/include/libiptc/libiptc.h    Thu Apr 19 18:35:39 2001
3411 +++ userspace/include/libiptc/libiptc.h Thu May 22 16:33:34 2003
3412 @@ -34,6 +34,9 @@
3413  /* Take a snapshot of the rules.  Returns NULL on error. */
3414  iptc_handle_t iptc_init(const char *tablename);
3415
3416 +/* Cleanup after iptc_init(). */
3417 +void iptc_free(iptc_handle_t *h);
3418 +
3419  /* Iterator functions to run through the chains.  Returns NULL at end. */
3420  const char *iptc_first_chain(iptc_handle_t *handle);
3421  const char *iptc_next_chain(iptc_handle_t *handle);
3422 diff -urN -x CVS -x .cvsignore iptables-1.2.8/include/linux/netfilter_ipv4/ipt_connlimit.h userspace/include/linux/netfilter_ipv4/ipt_connlimit.h
3423 --- iptables-1.2.8/include/linux/netfilter_ipv4/ipt_connlimit.h Thu Jan  1 01:00:00 1970
3424 +++ userspace/include/linux/netfilter_ipv4/ipt_connlimit.h      Wed Apr 30 18:54:48 2003
3425 @@ -0,0 +1,12 @@
3426 +#ifndef _IPT_CONNLIMIT_H
3427 +#define _IPT_CONNLIMIT_H
3428 +
3429 +struct ipt_connlimit_data;
3430 +
3431 +struct ipt_connlimit_info {
3432 +       int limit;
3433 +       int inverse;
3434 +       u_int32_t mask;
3435 +       struct ipt_connlimit_data *data;
3436 +};
3437 +#endif /* _IPT_CONNLIMIT_H */
3438 diff -urN -x CVS -x .cvsignore iptables-1.2.8/include/linux/netfilter_ipv4/ipt_iplimit.h userspace/include/linux/netfilter_ipv4/ipt_iplimit.h
3439 --- iptables-1.2.8/include/linux/netfilter_ipv4/ipt_iplimit.h   Wed Feb 28 12:21:54 2001
3440 +++ userspace/include/linux/netfilter_ipv4/ipt_iplimit.h        Thu Jan  1 01:00:00 1970
3441 @@ -1,12 +0,0 @@
3442 -#ifndef _IPT_IPLIMIT_H
3443 -#define _IPT_IPLIMIT_H
3444 -
3445 -struct ipt_iplimit_data;
3446 -
3447 -struct ipt_iplimit_info {
3448 -       int limit;
3449 -       int inverse;
3450 -       u_int32_t mask;
3451 -       struct ipt_iplimit_data *data;
3452 -};
3453 -#endif /* _IPT_IPLIMIT_H */
3454 diff -urN -x CVS -x .cvsignore iptables-1.2.8/include/linux/netfilter_ipv4/ipt_physdev.h userspace/include/linux/netfilter_ipv4/ipt_physdev.h
3455 --- iptables-1.2.8/include/linux/netfilter_ipv4/ipt_physdev.h   Tue Feb 11 21:19:04 2003
3456 +++ userspace/include/linux/netfilter_ipv4/ipt_physdev.h        Thu May 22 16:33:34 2003
3457 @@ -5,11 +5,16 @@
3458  #include <linux/if.h>
3459  #endif
3460
3461 -#define IPT_PHYSDEV_OP_MATCH_IN 0x01
3462 -#define IPT_PHYSDEV_OP_MATCH_OUT 0x02
3463 +#define IPT_PHYSDEV_OP_IN              0x01
3464 +#define IPT_PHYSDEV_OP_OUT             0x02
3465 +#define IPT_PHYSDEV_OP_BRIDGED         0x04
3466 +#define IPT_PHYSDEV_OP_ISIN            0x08
3467 +#define IPT_PHYSDEV_OP_ISOUT           0x10
3468 +#define IPT_PHYSDEV_OP_MASK            (0x20 - 1)
3469
3470  struct ipt_physdev_info {
3471         u_int8_t invert;
3472 +       u_int8_t bitmask;
3473         char physindev[IFNAMSIZ];
3474         char in_mask[IFNAMSIZ];
3475         char physoutdev[IFNAMSIZ];
3476 diff -urN -x CVS -x .cvsignore iptables-1.2.8/include/linux/netfilter_ipv4/ipt_sctp.h userspace/include/linux/netfilter_ipv4/ipt_sctp.h
3477 --- iptables-1.2.8/include/linux/netfilter_ipv4/ipt_sctp.h      Thu Jan  1 01:00:00 1970
3478 +++ userspace/include/linux/netfilter_ipv4/ipt_sctp.h   Sat May  3 20:05:58 2003
3479 @@ -0,0 +1,25 @@
3480 +/* iptables module for matching the SCTP header
3481 + *
3482 + * (C) 2003 Harald Welte <laforge@gnumonks.org>
3483 + *
3484 + * This software is distributed under GNU GPL v2, 1991
3485 + *
3486 + * $Id$
3487 + */
3488 +#ifndef _IPT_SCTP_H
3489 +#define _IPT_SCTP_H
3490 +
3491 +struct ipt_sctp_info {
3492 +       u_int16_t spts[2];                      /* Souce port range */
3493 +       u_int16_t dpts[2];                      /* Destination port range */
3494 +       u_int32_t chunks;                       /* chunks to be matched */
3495 +       u_int32_t chunk_mask;                   /* chunk mask to be matched */
3496 +       u_int8_t invflags;                      /* Inverse flags */
3497 +};
3498 +
3499 +#define IPT_SCTP_INV_SRCPT     0x01    /* Invert the sense of source ports */
3500 +#define IPT_SCTP_INV_DSTPT     0x02    /* Invert the sense of dest ports */
3501 +#define IPT_SCTP_INV_CHUNKS    0x03    /* Invert the sense of chunks */
3502 +#define IPT_SCTP_INV_MASK      0x03    /* All possible flags */
3503 +
3504 +#endif /* _IPT_SCTP_H */
3505 diff -urN -x CVS -x .cvsignore iptables-1.2.8/ip6tables-restore.c userspace/ip6tables-restore.c
3506 --- iptables-1.2.8/ip6tables-restore.c  Wed Mar  5 08:46:15 2003
3507 +++ userspace/ip6tables-restore.c       Thu May 22 16:33:34 2003
3508 @@ -7,7 +7,7 @@
3509   *     Rusty Russell <rusty@linuxcare.com.au>
3510   * This code is distributed under the terms of GNU GPL v2
3511   *
3512 - * $Id$
3513 + * $Id$
3514   */
3515
3516  #include <getopt.h>
3517 @@ -102,7 +102,7 @@
3518
3519  int main(int argc, char *argv[])
3520  {
3521 -       ip6tc_handle_t handle;
3522 +       ip6tc_handle_t handle = NULL;
3523         char buffer[10240];
3524         int c;
3525         char curtable[IP6T_TABLE_MAXNAMELEN + 1];
3526 @@ -183,6 +183,9 @@
3527                         }
3528                         strncpy(curtable, table, IP6T_TABLE_MAXNAMELEN);
3529
3530 +                       if (handle)
3531 +                               ip6tc_free(&handle);
3532 +
3533                         handle = create_handle(table, modprobe);
3534                         if (noflush == 0) {
3535                                 DEBUGP("Cleaning all chains of table '%s'\n",
3536 diff -urN -x CVS -x .cvsignore iptables-1.2.8/ip6tables-save.c userspace/ip6tables-save.c
3537 --- iptables-1.2.8/ip6tables-save.c     Wed Aug 14 13:40:41 2002
3538 +++ userspace/ip6tables-save.c  Thu May 22 16:33:34 2003
3539 @@ -305,6 +305,8 @@
3540                 exit_error(OTHER_PROBLEM, "Binary NYI\n");
3541         }
3542
3543 +       ip6tc_free(&h);
3544 +
3545         return 1;
3546  }
3547
3548 diff -urN -x CVS -x .cvsignore iptables-1.2.8/ip6tables.8 userspace/ip6tables.8
3549 --- iptables-1.2.8/ip6tables.8  Wed Aug  7 11:56:14 2002
3550 +++ userspace/ip6tables.8       Tue Jul 15 15:29:20 2003
3551 @@ -27,7 +27,7 @@
3552  .SH NAME
3553  ip6tables \- IPv6 packet filter administration
3554  .SH SYNOPSIS
3555 -.BR "ip6tables [-t table] -[ADC] " "chain rule-specification [options]"
3556 +.BR "ip6tables [-t table] -[AD] " "chain rule-specification [options]"
3557  .br
3558  .BR "ip6tables [-t table] -I " "chain [rulenum] rule-specification [options]"
3559  .br
3560 @@ -93,8 +93,9 @@
3561  that table if it is not already there.
3562
3563  The tables are as follows:
3564 -.TP
3565 -.B "filter"
3566 +.RS
3567 +.TP .4i
3568 +.BR "filter" :
3569  This is the default table (if no -t option is passed).  It contains
3570  the built-in chains
3571  .B INPUT
3572 @@ -104,7 +105,7 @@
3573  .B OUTPUT
3574  (for locally-generated packets).
3575  .TP
3576 -.B "mangle"
3577 +.BR "mangle" :
3578  This table is used for specialized packet alteration.  Until kernel
3579  2.4.17 it had two built-in chains:
3580  .B PREROUTING
3581 @@ -118,6 +119,7 @@
3582  (for altering packets being routed through the box), and
3583  .B POSTROUTING
3584  (for altering packets as they are about to go out).
3585 +.RE
3586  .SH OPTIONS
3587  The options that are recognized by
3588  .B ip6tables
3589 @@ -157,10 +159,10 @@
3590  .BR "-L, --list " "[\fIchain\fP]"
3591  List all rules in the selected chain.  If no chain is selected, all
3592  chains are listed.  As every other iptables command, it applies to the
3593 -specified table (filter is the default), so NAT rules get listed by
3594 -.br
3595 - iptables -t nat -n -L
3596 -.br
3597 +specified table (filter is the default), so mangle rules get listed by
3598 +.nf
3599 + ip6tables -t mangle -n -L
3600 +.fi
3601  Please note that it is often used with the
3602  .B -n
3603  option, in order to avoid long reverse DNS lookups.
3604 @@ -169,9 +171,9 @@
3605  (zero) option as well, in which case the chain(s) will be atomically
3606  listed and zeroed.  The exact output is affected by the other
3607  arguments given. The exact rules are suppressed until you use
3608 -.br
3609 +.nf
3610   ip6tables -L -v
3611 -.br
3612 +.fi
3613  .TP
3614  .BR "-F, --flush " "[\fIchain\fP]"
3615  Flush the selected chain (all the chains in the table if none is given).
3616 @@ -398,14 +400,14 @@
3617  set.  Flags are:
3618  .BR "SYN ACK FIN RST URG PSH ALL NONE" .
3619  Hence the command
3620 -.br
3621 +.nf
3622   ip6tables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
3623 -.br
3624 +.fi
3625  will only match packets with the SYN flag set, and the ACK, FIN and
3626  RST flags unset.
3627  .TP
3628  .B "[!] --syn"
3629 -Only match TCP packets with the SYN bit set and the ACK and FIN bits
3630 +Only match TCP packets with the SYN bit set and the ACK and RST bits
3631  cleared.  Such packets are used to request TCP connection initiation;
3632  for example, blocking such packets coming in an interface will prevent
3633  incoming TCP connections, but outgoing TCP connections will be
3634 @@ -438,9 +440,9 @@
3635  .BR "--icmpv6-type " "[!] \fItypename\fP"
3636  This allows specification of the ICMP type, which can be a numeric
3637  IPv6-ICMP type, or one of the IPv6-ICMP type names shown by the command
3638 -.br
3639 +.nf
3640   ip6tables -p ipv6-icmp -h
3641 -.br
3642 +.fi
3643  .SS mac
3644  .TP
3645  .BR "--mac-source " "[!] \fIaddress\fP"
3646 @@ -607,15 +609,17 @@
3647  returned:
3648  .TP
3649  .BI "--reject-with " "type"
3650 -The type given can be
3651 -.BR icmp6-no-route ,
3652 -.BR no-route ,
3653 -.BR icmp6-adm-prohibited ,
3654 -.BR adm-prohibited ,
3655 -.BR icmp6-addr-unreachable ,
3656 -.BR addr-unreach ,
3657 -.BR icmp6-port-unreachable ,
3658 -.BR port-unreach ,
3659 +The type given can be
3660 +.nf
3661 +.B " icmp6-no-route"
3662 +.B " no-route"
3663 +.B " icmp6-adm-prohibited"
3664 +.B " adm-prohibited"
3665 +.B " icmp6-addr-unreachable"
3666 +.B " addr-unreach"
3667 +.B " icmp6-port-unreachable"
3668 +.B " port-unreach"
3669 +.fi
3670  which return the appropriate IPv6-ICMP error message (\fBport-unreach\fP is
3671  the default). Finally, the option
3672  .B tcp-reset
3673 @@ -751,7 +755,8 @@
3674  .B OUTPUT
3675  are only traversed for packets coming into the local host and
3676  originating from the local host respectively.  Hence every packet only
3677 -passes through one of the three chains; previously a forwarded packet
3678 +passes through one of the three chains (except loopback traffic, which
3679 +involves both INPUT and OUTPUT chains); previously a forwarded packet
3680  would pass through all three.
3681  .PP
3682  The other main difference is that
3683 @@ -805,12 +810,11 @@
3684  .PP
3685  Harald Welte wrote the ULOG target, TTL match+target and libipulog.
3686  .PP
3687 -The Netfilter Core Team is: Marc Boucher, Jozsef Kadlecsik, James Morris,
3688 -Harald Welte and Rusty Russell.
3689 +The Netfilter Core Team is: Marc Boucher, Martin Josefsson, Jozsef Kadlecsik,
3690 +James Morris, Harald Welte and Rusty Russell.
3691  .PP
3692  ip6tables man page created by Andras Kis-Szabo, based on
3693  iptables man page written by Herve Eychenne <rv@wallfire.org>.
3694 -
3695  .\" .. and did I mention that we are incredibly cool people?
3696  .\" .. sexy, too ..
3697  .\" .. witty, charming, powerful ..
3698 diff -urN -x CVS -x .cvsignore iptables-1.2.8/ip6tables.c userspace/ip6tables.c
3699 --- iptables-1.2.8/ip6tables.c  Wed Mar  5 08:46:15 2003
3700 +++ userspace/ip6tables.c       Tue Jul 15 15:29:20 2003
3701 @@ -578,10 +578,13 @@
3702  static char *
3703  mask_to_numeric(const struct in6_addr *addrp)
3704  {
3705 -       static char buf[20];
3706 +       static char buf[50+2];
3707         int l = ipv6_prefix_length(addrp);
3708 -       if (l == -1)
3709 -               return addr_to_numeric(addrp);
3710 +       if (l == -1) {
3711 +               strcpy(buf, "/");
3712 +               strcat(buf, addr_to_numeric(addrp));
3713 +               return buf;
3714 +       }
3715         sprintf(buf, "/%d", l);
3716         return buf;
3717  }
3718 diff -urN -x CVS -x .cvsignore iptables-1.2.8/iptables-restore.c userspace/iptables-restore.c
3719 --- iptables-1.2.8/iptables-restore.c   Thu Mar  6 12:56:31 2003
3720 +++ userspace/iptables-restore.c        Thu May 22 16:33:34 2003
3721 @@ -4,7 +4,7 @@
3722   *
3723   * This code is distributed under the terms of GNU GPL v2
3724   *
3725 - * $Id$
3726 + * $Id$
3727   */
3728
3729  #include <getopt.h>
3730 @@ -99,7 +99,7 @@
3731
3732  int main(int argc, char *argv[])
3733  {
3734 -       iptc_handle_t handle;
3735 +       iptc_handle_t handle = NULL;
3736         char buffer[10240];
3737         int c;
3738         char curtable[IPT_TABLE_MAXNAMELEN + 1];
3739 @@ -180,6 +180,9 @@
3740                         }
3741                         strncpy(curtable, table, IPT_TABLE_MAXNAMELEN);
3742
3743 +                       if (handle)
3744 +                               iptc_free(&handle);
3745 +
3746                         handle = create_handle(table, modprobe);
3747                         if (noflush == 0) {
3748                                 DEBUGP("Cleaning all chains of table '%s'\n",
3749 diff -urN -x CVS -x .cvsignore iptables-1.2.8/iptables-save.c userspace/iptables-save.c
3750 --- iptables-1.2.8/iptables-save.c      Wed Aug  7 11:07:41 2002
3751 +++ userspace/iptables-save.c   Thu May 22 16:33:34 2003
3752 @@ -304,6 +304,8 @@
3753                 exit_error(OTHER_PROBLEM, "Binary NYI\n");
3754         }
3755
3756 +       iptc_free(&h);
3757 +
3758         return 1;
3759  }
3760
3761 diff -urN -x CVS -x .cvsignore iptables-1.2.8/iptables.8 userspace/iptables.8
3762 --- iptables-1.2.8/iptables.8   Mon Mar  3 23:23:22 2003
3763 +++ userspace/iptables.8        Tue Jul 15 15:29:20 2003
3764 @@ -25,7 +25,7 @@
3765  .SH NAME
3766  iptables \- administration tool for IPv4 packet filtering and NAT
3767  .SH SYNOPSIS
3768 -.BR "iptables [-t table] -[ADC] " "chain rule-specification [options]"
3769 +.BR "iptables [-t table] -[AD] " "chain rule-specification [options]"
3770  .br
3771  .BR "iptables [-t table] -I " "chain [rulenum] rule-specification [options]"
3772  .br
3773 @@ -91,8 +91,9 @@
3774  that table if it is not already there.
3775
3776  The tables are as follows:
3777 -.TP
3778 -.B "filter"
3779 +.RS
3780 +.TP .4i
3781 +.BR "filter" :
3782  This is the default table (if no -t option is passed).  It contains
3783  the built-in chains
3784  .B INPUT
3785 @@ -102,7 +103,7 @@
3786  .B OUTPUT
3787  (for locally-generated packets).
3788  .TP
3789 -.B "nat"
3790 +.BR "nat" :
3791  This table is consulted when a packet that creates a new
3792  connection is encountered.  It consists of three built-ins:
3793  .B PREROUTING
3794 @@ -112,7 +113,7 @@
3795  .B POSTROUTING
3796  (for altering packets as they are about to go out).
3797  .TP
3798 -.B "mangle"
3799 +.BR "mangle" :
3800  This table is used for specialized packet alteration.  Until kernel
3801  2.4.17 it had two built-in chains:
3802  .B PREROUTING
3803 @@ -126,6 +127,7 @@
3804  (for altering packets being routed through the box), and
3805  .B POSTROUTING
3806  (for altering packets as they are about to go out).
3807 +.RE
3808  .SH OPTIONS
3809  The options that are recognized by
3810  .B iptables
3811 @@ -166,9 +168,9 @@
3812  List all rules in the selected chain.  If no chain is selected, all
3813  chains are listed.  As every other iptables command, it applies to the
3814  specified table (filter is the default), so NAT rules get listed by
3815 -.br
3816 +.nf
3817   iptables -t nat -n -L
3818 -.br
3819 +.fi
3820  Please note that it is often used with the
3821  .B -n
3822  option, in order to avoid long reverse DNS lookups.
3823 @@ -177,9 +179,9 @@
3824  (zero) option as well, in which case the chain(s) will be atomically
3825  listed and zeroed.  The exact output is affected by the other
3826  arguments given. The exact rules are suppressed until you use
3827 -.br
3828 +.nf
3829   iptables -L -v
3830 -.br
3831 +.fi
3832  .TP
3833  .BR "-F, --flush " "[\fIchain\fP]"
3834  Flush the selected chain (all the chains in the table if none is given).
3835 @@ -450,12 +452,13 @@
3836  .TP
3837  .BI "--helper " "string"
3838  Matches packets related to the specified conntrack-helper.
3839 -.TP
3840 +.RS
3841 +.PP
3842  string can be "ftp" for packets related to a ftp-session on default port.
3843  For other ports append -portnr to the value, ie. "ftp-2121".
3844 -.br
3845 +.PP
3846  Same rules apply for other conntrack-helpers.
3847 -.br
3848 +.RE
3849  .SS icmp
3850  This extension is loaded if `--protocol icmp' is specified.  It
3851  provides the following option:
3852 @@ -463,9 +466,9 @@
3853  .BR "--icmp-type " "[!] \fItypename\fP"
3854  This allows specification of the ICMP type, which can be a numeric
3855  ICMP type, or one of the ICMP type names shown by the command
3856 -.br
3857 +.nf
3858   iptables -p icmp -h
3859 -.br
3860 +.fi
3861  .SS length
3862  This module matches the length of a packet against a specific value
3863  or range of values.
3864 @@ -557,8 +560,7 @@
3865  supporting this feature)
3866  .SS physdev
3867  This module matches on the bridge port input and output devices enslaved
3868 -to a bridge device. This is only useful if the input device or output device
3869 -is a bridge device. This module is a part of the infrastructure that enables
3870 +to a bridge device. This module is a part of the infrastructure that enables
3871  a transparent bridging IP firewall and is only useful for kernel versions
3872  above version 2.5.44.
3873  .TP
3874 @@ -570,7 +572,8 @@
3875  and
3876  .B PREROUTING
3877  chains). If the interface name ends in a "+", then any
3878 -interface which begins with this name will match.
3879 +interface which begins with this name will match. If the packet didn't arrive
3880 +through a bridge device, this packet won't match this option, unless '!' is used.
3881  .TP
3882  .B --physdev-out name
3883  Name of a bridge port via which a packet is going to be sent (for packets
3884 @@ -585,7 +588,19 @@
3885  .B OUTPUT
3886  chains one cannot match on the bridge output port, however one can in the
3887  .B "filter OUTPUT"
3888 -chain.
3889 +chain. If the packet won't leave by a bridge device or it is yet unknown what
3890 +the output device will be, then the packet won't match this option, unless
3891 +'!' is used.
3892 +.TP
3893 +.B --physdev-is-in
3894 +Matches if the packet has entered through a bridge interface.
3895 +.TP
3896 +.B --physdev-is-out
3897 +Matches if the packet will leave through a bridge interface.
3898 +.TP
3899 +.B --physdev-is-bridged
3900 +Matches if the packet is being bridged and therefore is not being routed.
3901 +This is only useful in the FORWARD and POSTROUTING chains.
3902  .SS pkttype
3903  This module matches the link-layer packet type.
3904  .TP
3905 @@ -598,7 +613,9 @@
3906  Where state is a comma separated list of the connection states to
3907  match.  Possible states are
3908  .B INVALID
3909 -meaning that the packet is associated with no known connection,
3910 +meaning that the packet could not be identified for some reason which
3911 +includes running out of memory and ICMP errors which don't correspond to any
3912 +known connection,
3913  .B ESTABLISHED
3914  meaning that the packet is associated with a connection which has seen
3915  packets in both directions,
3916 @@ -638,9 +655,9 @@
3917  set.  Flags are:
3918  .BR "SYN ACK FIN RST URG PSH ALL NONE" .
3919  Hence the command
3920 -.br
3921 +.nf
3922   iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
3923 -.br
3924 +.fi
3925  will only match packets with the SYN flag set, and the ACK, FIN and
3926  RST flags unset.
3927  .TP
3928 @@ -718,7 +735,8 @@
3929  .BR "-p udp" ).
3930  If no port range is specified, then the destination port will never be
3931  modified.
3932 -.TP
3933 +.RS
3934 +.PP
3935  You can add several --to-destination options.  If you specify more
3936  than one destination address, either via an address range or multiple
3937  --to-destination options, a simple round-robin (one after another in
3938 @@ -848,12 +866,15 @@
3939  .TP
3940  .BI "--reject-with " "type"
3941  The type given can be
3942 -.BR icmp-net-unreachable ,
3943 -.BR icmp-host-unreachable ,
3944 -.BR icmp-port-unreachable ,
3945 -.BR icmp-proto-unreachable ,
3946 -.BR "icmp-net-prohibited or"
3947 -.BR icmp-host-prohibited ,
3948 +.nf
3949 +.B " icmp-net-unreachable"
3950 +.B " icmp-host-unreachable"
3951 +.B " icmp-port-unreachable"
3952 +.B " icmp-proto-unreachable"
3953 +.B " icmp-net-prohibited"
3954 +.B " icmp-host-prohibited or"
3955 +.B " icmp-admin-prohibited (*)"
3956 +.fi
3957  which return the appropriate ICMP error message (\fBport-unreachable\fP is
3958  the default).  The option
3959  .B tcp-reset
3960 @@ -862,6 +883,8 @@
3961  .I ident
3962  (113/tcp) probes which frequently occur when sending mail to broken mail
3963  hosts (which won't accept your mail otherwise).
3964 +.TP
3965 +(*) Using icmp-admin-prohibited with kernels that do not support it will result in a plain DROP instead of REJECT
3966  .SS SNAT
3967  This target is only valid in the
3968  .B nat
3969 @@ -883,7 +906,8 @@
3970  mapped to other ports below 512: those between 512 and 1023 inclusive
3971  will be mapped to ports below 1024, and other ports will be mapped to
3972  1024 or above. Where possible, no port alteration will occur.
3973 -.TP
3974 +.RS
3975 +.PP
3976  You can add several --to-source options.  If you specify more
3977  than one source address, either via an address range or multiple
3978  --to-source options, a simple round-robin (one after another in
3979 @@ -900,19 +924,25 @@
3980  problem are that everything works fine from your Linux
3981  firewall/router, but machines behind it can never exchange large
3982  packets:
3983 -.br
3984 - 1) Web browsers connect, then hang with no data received.
3985 -.br
3986 - 2) Small mail works fine, but large emails hang.
3987 -.br
3988 - 3) ssh works fine, but scp hangs after initial handshaking.
3989 -.br
3990 +.PD 0
3991 +.RS 0.1i
3992 +.TP 0.3i
3993 +1)
3994 +Web browsers connect, then hang with no data received.
3995 +.TP
3996 +2)
3997 +Small mail works fine, but large emails hang.
3998 +.TP
3999 +3)
4000 +ssh works fine, but scp hangs after initial handshaking.
4001 +.RE
4002 +.PD
4003  Workaround: activate this option and add a rule to your firewall
4004  configuration like:
4005 -.br
4006 +.nf
4007   iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \\
4008 -.br
4009               -j TCPMSS --clamp-mss-to-pmtu
4010 +.fi
4011  .TP
4012  .BI "--set-mss " "value"
4013  Explicitly set MSS option to specified value.
4014 @@ -929,9 +959,9 @@
4015  .TP
4016  .BI "--set-tos " "tos"
4017  You can use a numeric TOS values, or use
4018 -.br
4019 +.nf
4020   iptables -j TOS -h
4021 -.br
4022 +.fi
4023  to see the list of valid TOS names.
4024  .SS ULOG
4025  This target provides userspace logging of matching packets.  When this
4026 @@ -979,7 +1009,8 @@
4027  .B OUTPUT
4028  are only traversed for packets coming into the local host and
4029  originating from the local host respectively.  Hence every packet only
4030 -passes through one of the three chains; previously a forwarded packet
4031 +passes through one of the three chains (except loopback traffic, which
4032 +involves both INPUT and OUTPUT chains); previously a forwarded packet
4033  would pass through all three.
4034  .PP
4035  The other main difference is that
4036 @@ -996,13 +1027,11 @@
4037  optional extension modules.  This should simplify much of the previous
4038  confusion over the combination of IP masquerading and packet filtering
4039  seen previously.  So the following options are handled differently:
4040 -.br
4041 +.nf
4042   -j MASQ
4043 -.br
4044   -M -S
4045 -.br
4046   -M -L
4047 -.br
4048 +.fi
4049  There are several other changes in iptables.
4050  .SH SEE ALSO
4051  .BR iptables-save (8),
4052 @@ -1033,11 +1062,10 @@
4053  .PP
4054  Harald Welte wrote the ULOG target, TTL, DSCP, ECN matches and targets.
4055  .PP
4056 -The Netfilter Core Team is: Marc Boucher, Jozsef Kadlecsik, James Morris,
4057 -Harald Welte and Rusty Russell.
4058 +The Netfilter Core Team is: Marc Boucher, Martin Josefsson, Jozsef Kadlecsik,
4059 +James Morris, Harald Welte and Rusty Russell.
4060  .PP
4061  Man page written by Herve Eychenne <rv@wallfire.org>.
4062 -
4063  .\" .. and did I mention that we are incredibly cool people?
4064  .\" .. sexy, too ..
4065  .\" .. witty, charming, powerful ..
4066 diff -urN -x CVS -x .cvsignore iptables-1.2.8/iptables.c userspace/iptables.c
4067 --- iptables-1.2.8/iptables.c   Mon Mar 31 14:11:55 2003
4068 +++ userspace/iptables.c        Tue Jun  3 20:18:04 2003
4069 @@ -337,7 +337,7 @@
4070  exit_tryhelp(int status)
4071  {
4072         if (line != -1)
4073 -               fprintf(stderr, "Error occured at line: %d\n", line);
4074 +               fprintf(stderr, "Error occurred at line: %d\n", line);
4075         fprintf(stderr, "Try `%s -h' or '%s --help' for more information.\n",
4076                         program_name, program_name );
4077         exit(status);
4078 @@ -1254,14 +1254,14 @@
4079
4080         fputc(fw->ip.invflags & IPT_INV_DSTIP ? '!' : ' ', stdout);
4081         if (fw->ip.dmsk.s_addr == 0L && !(format & FMT_NUMERIC))
4082 -               printf(FMT("%-19s","-> %s"), "anywhere");
4083 +               printf(FMT("%-19s ","-> %s"), "anywhere");
4084         else {
4085                 if (format & FMT_NUMERIC)
4086                         sprintf(buf, "%s", addr_to_dotted(&(fw->ip.dst)));
4087                 else
4088                         sprintf(buf, "%s", addr_to_anyname(&(fw->ip.dst)));
4089                 strcat(buf, mask_to_dotted(&(fw->ip.dmsk)));
4090 -               printf(FMT("%-19s","-> %s"), buf);
4091 +               printf(FMT("%-19s ","-> %s"), buf);
4092         }
4093
4094         if (format & FMT_NOTABLE)
4095 diff -urN -x CVS -x .cvsignore iptables-1.2.8/libiptc/libip4tc.c userspace/libiptc/libip4tc.c
4096 --- iptables-1.2.8/libiptc/libip4tc.c   Wed Jun 12 21:22:29 2002
4097 +++ userspace/libiptc/libip4tc.c        Thu May 22 16:33:35 2003
4098 @@ -91,6 +91,7 @@
4099  #define TC_SET_POLICY          iptc_set_policy
4100  #define TC_GET_RAW_SOCKET      iptc_get_raw_socket
4101  #define TC_INIT                        iptc_init
4102 +#define TC_FREE                        iptc_free
4103  #define TC_COMMIT              iptc_commit
4104  #define TC_STRERROR            iptc_strerror
4105
4106 diff -urN -x CVS -x .cvsignore iptables-1.2.8/libiptc/libip6tc.c userspace/libiptc/libip6tc.c
4107 --- iptables-1.2.8/libiptc/libip6tc.c   Thu Feb 14 00:13:23 2002
4108 +++ userspace/libiptc/libip6tc.c        Tue Jul 15 15:29:20 2003
4109 @@ -86,6 +86,7 @@
4110  #define TC_SET_POLICY          ip6tc_set_policy
4111  #define TC_GET_RAW_SOCKET      ip6tc_get_raw_socket
4112  #define TC_INIT                        ip6tc_init
4113 +#define TC_FREE                        ip6tc_free
4114  #define TC_COMMIT              ip6tc_commit
4115  #define TC_STRERROR            ip6tc_strerror
4116
4117 @@ -110,7 +111,7 @@
4118  #include "libiptc.c"
4119
4120  #define BIT6(a, l) \
4121 - (((a->in6_u.u6_addr32[(l) / 32]) >> ((l) & 31)) & 1)
4122 + ((ntohl(a->in6_u.u6_addr32[(l) / 32]) >> (31 - ((l) & 31))) & 1)
4123
4124  int
4125  ipv6_prefix_length(const struct in6_addr *a)
4126 diff -urN -x CVS -x .cvsignore iptables-1.2.8/libiptc/libiptc.c userspace/libiptc/libiptc.c
4127 --- iptables-1.2.8/libiptc/libiptc.c    Wed May 29 15:08:16 2002
4128 +++ userspace/libiptc/libiptc.c Tue Jul 15 15:29:20 2003
4129 @@ -1,4 +1,4 @@
4130 -/* Library which manipulates firewall rules.  Version $Revision$ */
4131 +/* Library which manipulates firewall rules.  Version $Revision$ */
4132
4133  /* Architecture of firewall rules is as follows:
4134   *
4135 @@ -8,8 +8,17 @@
4136   * and a POLICY for built-ins.
4137   */
4138
4139 -/* (C)1999 Paul ``Rusty'' Russell - Placed under the GNU GPL (See
4140 -   COPYING for details). */
4141 +/* (C) 1999 Paul ``Rusty'' Russell - Placed under the GNU GPL (See
4142 + * COPYING for details).
4143 + * (C) 2000-2003 by the Netfilter Core Team <coreteam@netfilter.org>
4144 + *
4145 + * 2003-Jun-20: Harald Welte <laforge@netfilter.org>:
4146 + *     - Reimplementation of chain cache to use offsets instead of entries
4147 + * 2003-Jun-23: Harald Welte <laforge@netfilter.org>:
4148 + *     - performance optimization, sponsored by Astaro AG (http://www.astaro.com/)
4149 + *       don't rebuild the chain cache after every operation, instead fix it
4150 + *       up after a ruleset change.
4151 + */
4152
4153  #ifndef IPT_LIB_DIR
4154  #define IPT_LIB_DIR "/usr/local/lib/iptables"
4155 @@ -59,9 +68,9 @@
4156  {
4157         char name[TABLE_MAXNAMELEN];
4158         /* This is the first rule in chain. */
4159 -       STRUCT_ENTRY *start;
4160 +       unsigned int start_off;
4161         /* Last rule in chain */
4162 -       STRUCT_ENTRY *end;
4163 +       unsigned int end_off;
4164  };
4165
4166  STRUCT_TC_HANDLE
4167 @@ -94,13 +103,6 @@
4168  static void
4169  set_changed(TC_HANDLE_T h)
4170  {
4171 -       if (h->cache_chain_heads) {
4172 -               free(h->cache_chain_heads);
4173 -               h->cache_chain_heads = NULL;
4174 -               h->cache_num_chains = 0;
4175 -               h->cache_chain_iteration = NULL;
4176 -               h->cache_rule_end = NULL;
4177 -       }
4178         h->changed = 1;
4179  }
4180
4181 @@ -171,15 +173,28 @@
4182  static inline unsigned long
4183  entry2offset(const TC_HANDLE_T h, const STRUCT_ENTRY *e)
4184  {
4185 -       return (char *)e - (char *)h->entries.entrytable;
4186 +       return (void *)e - (void *)h->entries.entrytable;
4187  }
4188
4189 -static unsigned long
4190 +static inline unsigned long
4191  index2offset(TC_HANDLE_T h, unsigned int index)
4192  {
4193         return entry2offset(h, index2entry(h, index));
4194  }
4195
4196 +static inline STRUCT_ENTRY *
4197 +offset2entry(TC_HANDLE_T h, unsigned int offset)
4198 +{
4199 +       return (STRUCT_ENTRY *) ((void *)h->entries.entrytable+offset);
4200 +}
4201 +
4202 +static inline unsigned int
4203 +offset2index(const TC_HANDLE_T h, unsigned int offset)
4204 +{
4205 +       return entry2index(h, offset2entry(h, offset));
4206 +}
4207 +
4208 +
4209  static const char *
4210  get_errorlabel(TC_HANDLE_T h, unsigned int offset)
4211  {
4212 @@ -234,25 +249,32 @@
4213
4214         iptc_fn = TC_INIT;
4215
4216 -       if (sockfd != -1)
4217 +       if (sockfd != -1) {
4218                 close(sockfd);
4219 +               sockfd = -1;
4220 +       }
4221
4222 +       if (strlen(tablename) >= TABLE_MAXNAMELEN) {
4223 +               errno = EINVAL;
4224 +               return NULL;
4225 +       }
4226 +
4227         sockfd = socket(TC_AF, SOCK_RAW, IPPROTO_RAW);
4228         if (sockfd < 0)
4229                 return NULL;
4230
4231         s = sizeof(info);
4232 -       if (strlen(tablename) >= TABLE_MAXNAMELEN) {
4233 -               errno = EINVAL;
4234 -               return NULL;
4235 -       }
4236 +
4237         strcpy(info.name, tablename);
4238         if (getsockopt(sockfd, TC_IPPROTO, SO_GET_INFO, &info, &s) < 0)
4239                 return NULL;
4240
4241         if ((h = alloc_handle(info.name, info.size, info.num_entries))
4242 -           == NULL)
4243 +           == NULL) {
4244 +               close(sockfd);
4245 +               sockfd = -1;
4246                 return NULL;
4247 +       }
4248
4249  /* Too hard --RR */
4250  #if 0
4251 @@ -284,6 +306,8 @@
4252
4253         if (getsockopt(sockfd, TC_IPPROTO, SO_GET_ENTRIES, &h->entries,
4254                        &tmp) < 0) {
4255 +               close(sockfd);
4256 +               sockfd = -1;
4257                 free(h);
4258                 return NULL;
4259         }
4260 @@ -292,6 +316,17 @@
4261         return h;
4262  }
4263
4264 +void
4265 +TC_FREE(TC_HANDLE_T *h)
4266 +{
4267 +       close(sockfd);
4268 +       sockfd = -1;
4269 +       if ((*h)->cache_chain_heads)
4270 +               free((*h)->cache_chain_heads);
4271 +       free(*h);
4272 +       *h = NULL;
4273 +}
4274 +
4275  static inline int
4276  print_match(const STRUCT_ENTRY_MATCH *m)
4277  {
4278 @@ -349,7 +384,8 @@
4279         /* Last entry.  End it. */
4280         if (entry2offset(h, e) + e->next_offset == h->entries.size) {
4281                 /* This is the ERROR node at end of the table */
4282 -               h->cache_chain_heads[h->cache_num_chains-1].end = *prev;
4283 +               h->cache_chain_heads[h->cache_num_chains-1].end_off =
4284 +                       entry2offset(h, *prev);
4285                 return 0;
4286         }
4287
4288 @@ -357,24 +393,24 @@
4289            target, or a hook entry point */
4290         if (strcmp(GET_TARGET(e)->u.user.name, ERROR_TARGET) == 0) {
4291                 /* prev was last entry in previous chain */
4292 -               h->cache_chain_heads[h->cache_num_chains-1].end
4293 -                       = *prev;
4294 +               h->cache_chain_heads[h->cache_num_chains-1].end_off
4295 +                       = entry2offset(h, *prev);
4296
4297                 strcpy(h->cache_chain_heads[h->cache_num_chains].name,
4298                        (const char *)GET_TARGET(e)->data);
4299 -               h->cache_chain_heads[h->cache_num_chains].start
4300 -                       = (void *)e + e->next_offset;
4301 +               h->cache_chain_heads[h->cache_num_chains].start_off
4302 +                       = entry2offset(h, (void *)e + e->next_offset);
4303                 h->cache_num_chains++;
4304         } else if ((builtin = is_hook_entry(e, h)) != 0) {
4305                 if (h->cache_num_chains > 0)
4306                         /* prev was last entry in previous chain */
4307 -                       h->cache_chain_heads[h->cache_num_chains-1].end
4308 -                               = *prev;
4309 +                       h->cache_chain_heads[h->cache_num_chains-1].end_off
4310 +                               = entry2offset(h, *prev);
4311
4312                 strcpy(h->cache_chain_heads[h->cache_num_chains].name,
4313                        h->hooknames[builtin-1]);
4314 -               h->cache_chain_heads[h->cache_num_chains].start
4315 -                       = (void *)e;
4316 +               h->cache_chain_heads[h->cache_num_chains].start_off
4317 +                       = entry2offset(h, (void *)e);
4318                 h->cache_num_chains++;
4319         }
4320
4321 @@ -421,6 +457,81 @@
4322         return 1;
4323  }
4324
4325 +static int
4326 +correct_cache(TC_HANDLE_T h, unsigned int offset, int delta)
4327 +{
4328 +       int i;          /* needs to be signed because deleting first
4329 +                          chain can make it drop to -1 */
4330 +
4331 +       if (!delta)
4332 +               return 1;
4333 +
4334 +       for (i = 0; i < h->cache_num_chains; i++) {
4335 +               struct chain_cache *cc = &h->cache_chain_heads[i];
4336 +
4337 +               if (delta < 0) {
4338 +                       /* take care about deleted chains */
4339 +                       if (cc->start_off > offset+delta
4340 +                           && cc->end_off < offset) {
4341 +                               /* this chain is within the deleted range,
4342 +                                * let's remove it from the cache */
4343 +                               void *start;
4344 +                               unsigned int size;
4345 +
4346 +                               h->cache_num_chains--;
4347 +
4348 +                               /* no need for memmove since we are
4349 +                                * removing the last entry */
4350 +                               if (i >= h->cache_num_chains)
4351 +                                       continue;
4352 +
4353 +                               start = &h->cache_chain_heads[i+1];
4354 +                               size = (h->cache_num_chains-i)
4355 +                                       * sizeof(struct chain_cache);
4356 +                               memmove(cc, start, size);
4357 +
4358 +                               /* iterate over same index again, since
4359 +                                * it is now a different chain */
4360 +                               i--;
4361 +                               continue;
4362 +                       }
4363 +               }
4364 +
4365 +               if (cc->start_off > offset)
4366 +                       cc->start_off += delta;
4367 +
4368 +               if (cc->end_off >= offset)
4369 +                       cc->end_off += delta;
4370 +       }
4371 +       /* HW_FIXME: sorting might be needed, but just in case a new chain was
4372 +        * added */
4373 +
4374 +       return 1;
4375 +}
4376 +
4377 +static int
4378 +add_chain_cache(TC_HANDLE_T h, const char *name, unsigned int start_off,
4379 +               unsigned int end_off)
4380 +{
4381 +       struct chain_cache *ccs = realloc(h->cache_chain_heads,
4382 +                                         (h->new_number / 2 + 4 + 1)
4383 +                                          * sizeof(struct chain_cache));
4384 +       struct chain_cache *newcc;
4385 +
4386 +       if (!ccs)
4387 +               return 0;
4388 +
4389 +       h->cache_chain_heads = ccs;
4390 +       newcc = &h->cache_chain_heads[h->cache_num_chains];
4391 +       h->cache_num_chains++;
4392 +
4393 +       strncpy(newcc->name, name, TABLE_MAXNAMELEN-1);
4394 +       newcc->start_off = start_off;
4395 +       newcc->end_off = end_off;
4396 +
4397 +       return 1;
4398 +}
4399 +
4400  /* Returns cache ptr if found, otherwise NULL. */
4401  static struct chain_cache *
4402  find_label(const char *name, TC_HANDLE_T handle)
4403 @@ -523,11 +634,11 @@
4404         }
4405
4406         /* Empty chain: single return/policy rule */
4407 -       if (c->start == c->end)
4408 +       if (c->start_off == c->end_off)
4409                 return NULL;
4410
4411 -       (*handle)->cache_rule_end = c->end;
4412 -       return c->start;
4413 +       (*handle)->cache_rule_end = offset2entry(*handle, c->end_off);
4414 +       return offset2entry(*handle, c->start_off);
4415  }
4416
4417  /* Returns NULL when rules run out. */
4418 @@ -666,7 +777,7 @@
4419         return target_name(*handle, e);
4420  }
4421
4422 -static int
4423 +static inline int
4424  correct_verdict(STRUCT_ENTRY *e,
4425                 char *base,
4426                 unsigned int offset, int delta_offset)
4427 @@ -767,8 +878,16 @@
4428         newh->entries.size = (*handle)->entries.size + rules_size;
4429         newh->hooknames = (*handle)->hooknames;
4430
4431 -       if ((*handle)->cache_chain_heads)
4432 -               free((*handle)->cache_chain_heads);
4433 +       newh->cache_chain_heads = (*handle)->cache_chain_heads;
4434 +       newh->cache_num_builtins = (*handle)->cache_num_builtins;
4435 +       newh->cache_num_chains = (*handle)->cache_num_chains;
4436 +       newh->cache_rule_end = (*handle)->cache_rule_end;
4437 +       newh->cache_chain_iteration = (*handle)->cache_chain_iteration;
4438 +       if (!correct_cache(newh, offset, rules_size)) {
4439 +               free(newh);
4440 +               return 0;
4441 +       }
4442 +
4443         free(*handle);
4444         *handle = newh;
4445
4446 @@ -827,6 +946,10 @@
4447         (*handle)->new_number -= num_rules;
4448         (*handle)->entries.size -= rules_size;
4449
4450 +       /* Fix the chain cache */
4451 +       if (!correct_cache(*handle, offset+rules_size, -(int)rules_size))
4452 +               return 0;
4453 +
4454         return set_verdict(offset, -(int)rules_size, handle);
4455  }
4456
4457 @@ -884,7 +1007,7 @@
4458
4459                 c = find_label(t->u.user.name, handle);
4460                 if (c)
4461 -                       return standard_map(e, entry2offset(handle, c->start));
4462 +                       return standard_map(e, c->start_off);
4463         }
4464
4465         /* Must be a module?  If not, kernel will reject... */
4466 @@ -924,10 +1047,10 @@
4467                 return 0;
4468         }
4469
4470 -       chainindex = entry2index(*handle, c->start);
4471 +       chainindex = offset2index(*handle, c->start_off);
4472
4473         tmp = index2entry(*handle, chainindex + rulenum);
4474 -       if (!tmp || tmp > c->end) {
4475 +       if (!tmp || tmp > offset2entry(*handle, c->end_off)) {
4476                 errno = E2BIG;
4477                 return 0;
4478         }
4479 @@ -964,10 +1087,10 @@
4480                 return 0;
4481         }
4482
4483 -       chainindex = entry2index(*handle, c->start);
4484 +       chainindex = offset2index(*handle, c->start_off);
4485
4486         tmp = index2entry(*handle, chainindex + rulenum);
4487 -       if (!tmp || tmp >= c->end) {
4488 +       if (!tmp || tmp >= offset2entry(*handle, c->end_off)) {
4489                 errno = E2BIG;
4490                 return 0;
4491         }
4492 @@ -1005,13 +1128,11 @@
4493         }
4494
4495         if (!map_target(*handle, (STRUCT_ENTRY *)e,
4496 -                       entry2offset(*handle, c->end), &old))
4497 +                       c->end_off, &old))
4498                 return 0;
4499
4500 -       ret = insert_rules(1, e->next_offset, e,
4501 -                          entry2offset(*handle, c->end),
4502 -                          entry2index(*handle, c->end),
4503 -                          0, handle);
4504 +       ret = insert_rules(1, e->next_offset, e, c->end_off,
4505 +                          offset2index(*handle, c->end_off), 0, handle);
4506         unmap_target((STRUCT_ENTRY *)e, &old);
4507         return ret;
4508  }
4509 @@ -1085,8 +1206,7 @@
4510                 return 0;
4511         }
4512
4513 -       for (offset = entry2offset(*handle, c->start);
4514 -            offset < entry2offset(*handle, c->end);
4515 +       for (offset = c->start_off; offset < c->end_off;
4516              offset += e->next_offset) {
4517                 STRUCT_ENTRY_TARGET discard;
4518
4519 @@ -1135,9 +1255,9 @@
4520                 return 0;
4521         }
4522
4523 -       index = entry2index(*handle, c->start) + rulenum;
4524 +       index = offset2index(*handle, c->start_off) + rulenum;
4525
4526 -       if (index >= entry2index(*handle, c->end)) {
4527 +       if (index >= offset2index(*handle, c->end_off)) {
4528                 errno = E2BIG;
4529                 return 0;
4530         }
4531 @@ -1169,6 +1289,7 @@
4532  TC_FLUSH_ENTRIES(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle)
4533  {
4534         unsigned int startindex, endindex;
4535 +       STRUCT_ENTRY *startentry, *endentry;
4536         struct chain_cache *c;
4537         int ret;
4538
4539 @@ -1177,12 +1298,14 @@
4540                 errno = ENOENT;
4541                 return 0;
4542         }
4543 -       startindex = entry2index(*handle, c->start);
4544 -       endindex = entry2index(*handle, c->end);
4545 +       startindex = offset2index(*handle, c->start_off);
4546 +       endindex = offset2index(*handle, c->end_off);
4547 +       startentry = offset2entry(*handle, c->start_off);
4548 +       endentry = offset2entry(*handle, c->end_off);
4549
4550         ret = delete_rules(endindex - startindex,
4551 -                          (char *)c->end - (char *)c->start,
4552 -                          entry2offset(*handle, c->start), startindex,
4553 +                          (char *)endentry - (char *)startentry,
4554 +                          c->start_off, startindex,
4555                            handle);
4556         return ret;
4557  }
4558 @@ -1199,8 +1322,8 @@
4559                 return 0;
4560         }
4561
4562 -       i = entry2index(*handle, c->start);
4563 -       end = entry2index(*handle, c->end);
4564 +       i = offset2index(*handle, c->start_off);
4565 +       end = offset2index(*handle, c->end_off);
4566
4567         for (; i <= end; i++) {
4568                 if ((*handle)->counter_map[i].maptype ==COUNTER_MAP_NORMAL_MAP)
4569 @@ -1228,8 +1351,8 @@
4570                 return NULL;
4571         }
4572
4573 -       chainindex = entry2index(*handle, c->start);
4574 -       end = entry2index(*handle, c->end);
4575 +       chainindex = offset2index(*handle, c->start_off);
4576 +       end = offset2index(*handle, c->end_off);
4577
4578         if (chainindex + rulenum > end) {
4579                 errno = E2BIG;
4580 @@ -1258,8 +1381,8 @@
4581                 return 0;
4582         }
4583
4584 -       chainindex = entry2index(*handle, c->start);
4585 -       end = entry2index(*handle, c->end);
4586 +       chainindex = offset2index(*handle, c->start_off);
4587 +       end = offset2index(*handle, c->end_off);
4588
4589         if (chainindex + rulenum > end) {
4590                 errno = E2BIG;
4591 @@ -1297,8 +1420,8 @@
4592                 return 0;
4593         }
4594
4595 -       chainindex = entry2index(*handle, c->start);
4596 -       end = entry2index(*handle, c->end);
4597 +       chainindex = offset2index(*handle, c->start_off);
4598 +       end = offset2index(*handle, c->end_off);
4599
4600         if (chainindex + rulenum > end) {
4601                 errno = E2BIG;
4602 @@ -1330,6 +1453,7 @@
4603                 STRUCT_ENTRY ret;
4604                 STRUCT_STANDARD_TARGET target;
4605         } newc;
4606 +       unsigned int destination;
4607
4608         iptc_fn = TC_CREATE_CHAIN;
4609
4610 @@ -1367,11 +1491,21 @@
4611                 = ALIGN(sizeof(STRUCT_STANDARD_TARGET));
4612         newc.target.verdict = RETURN;
4613
4614 +       destination = index2offset(*handle, (*handle)->new_number -1);
4615 +
4616         /* Add just before terminal entry */
4617         ret = insert_rules(2, sizeof(newc), &newc.head,
4618 -                          index2offset(*handle, (*handle)->new_number - 1),
4619 +                          destination,
4620                            (*handle)->new_number - 1,
4621                            0, handle);
4622 +
4623 +       set_changed(*handle);
4624 +
4625 +       /* add chain cache info for this chain */
4626 +       add_chain_cache(*handle, chain,
4627 +                       destination+newc.head.next_offset,
4628 +                       destination+newc.head.next_offset);
4629 +
4630         return ret;
4631  }
4632
4633 @@ -1405,7 +1539,7 @@
4634         *ref = 0;
4635         ENTRY_ITERATE((*handle)->entries.entrytable,
4636                       (*handle)->entries.size,
4637 -                     count_ref, entry2offset(*handle, c->start), ref);
4638 +                     count_ref, c->start_off, ref);
4639         return 1;
4640  }
4641
4642 @@ -1417,6 +1551,7 @@
4643         unsigned int references;
4644         struct chain_cache *c;
4645         int ret;
4646 +       STRUCT_ENTRY *start;
4647
4648         if (!TC_GET_REFERENCES(&references, chain, handle))
4649                 return 0;
4650 @@ -1438,18 +1573,20 @@
4651                 return 0;
4652         }
4653
4654 -       if ((void *)c->start != c->end) {
4655 +       if (c->start_off != c->end_off) {
4656                 errno = ENOTEMPTY;
4657                 return 0;
4658         }
4659
4660         /* Need label index: preceeds chain start */
4661 -       labelidx = entry2index(*handle, c->start) - 1;
4662 +       labelidx = offset2index(*handle, c->start_off) - 1;
4663         labeloff = index2offset(*handle, labelidx);
4664
4665 +       start = offset2entry(*handle, c->start_off);
4666 +
4667         ret = delete_rules(2,
4668                            get_entry(*handle, labeloff)->next_offset
4669 -                          + c->start->next_offset,
4670 +                          + start->next_offset,
4671                            labeloff, labelidx, handle);
4672         return ret;
4673  }
4674 @@ -1488,7 +1625,7 @@
4675         }
4676
4677         /* Need label index: preceeds chain start */
4678 -       labelidx = entry2index(*handle, c->start) - 1;
4679 +       labelidx = offset2index(*handle, c->start_off) - 1;
4680         labeloff = index2offset(*handle, labelidx);
4681
4682         t = (struct ipt_error_target *)
4683 @@ -1496,6 +1633,11 @@
4684
4685         memset(t->error, 0, sizeof(t->error));
4686         strcpy(t->error, newname);
4687 +
4688 +       /* update chain cache */
4689 +       memset(c->name, 0, sizeof(c->name));
4690 +       strcpy(c->name, newname);
4691 +
4692         set_changed(*handle);
4693
4694         return 1;
4695 @@ -1582,11 +1724,13 @@
4696         STRUCT_REPLACE *repl;
4697         STRUCT_COUNTERS_INFO *newcounters;
4698         unsigned int i;
4699 -       size_t counterlen
4700 -               = sizeof(STRUCT_COUNTERS_INFO)
4701 -               + sizeof(STRUCT_COUNTERS) * (*handle)->new_number;
4702 +       size_t counterlen;
4703
4704         CHECK(*handle);
4705 +
4706 +       counterlen = sizeof(STRUCT_COUNTERS_INFO)
4707 +                       + sizeof(STRUCT_COUNTERS) * (*handle)->new_number;
4708 +
4709  #if 0
4710         TC_DUMP_ENTRIES(*handle);
4711  #endif
4712 @@ -1713,10 +1857,7 @@
4713         free(newcounters);
4714
4715   finished:
4716 -       if ((*handle)->cache_chain_heads)
4717 -               free((*handle)->cache_chain_heads);
4718 -       free(*handle);
4719 -       *handle = NULL;
4720 +       TC_FREE(handle);
4721         return 1;
4722  }
4723
4724 diff -urN -x CVS -x .cvsignore iptables-1.2.8/libipulog/Makefile userspace/libipulog/Makefile
4725 --- iptables-1.2.8/libipulog/Makefile   Thu Jan  1 01:00:00 1970
4726 +++ userspace/libipulog/Makefile        Fri Mar 16 14:40:52 2001
4727 @@ -0,0 +1,16 @@
4728 +EXTRAS+=libipulog/libipulog.a
4729 +
4730 +DEVEL_LIBS+=libipulog/libipulog.a
4731 +
4732 +ifndef TOPLEVEL_INCLUDED
4733 +local:
4734 +       cd .. && $(MAKE) $(KERN_TARGETS) $(SHARED_LIBS) $(EXTRAS)
4735 +
4736 +else
4737 +EXTRA_DEPENDS+=echo libipulog/libipulog.d
4738 +
4739 +libipulog/libipulog.a: libipulog/libipulog.a(libipulog/libipulog.o)
4740 +
4741 +libipulog/libipulog.d: %.d: %.c
4742 +       @-$(CC) -M -MG $(CFLAGS) $< | sed -e 's@^.*\.o:@$*.d $*.a($*.o):@' > $@
4743 +endif
4744 diff -urN -x CVS -x .cvsignore iptables-1.2.8/libipulog/libipulog.c userspace/libipulog/libipulog.c
4745 --- iptables-1.2.8/libipulog/libipulog.c        Thu Jan  1 01:00:00 1970
4746 +++ userspace/libipulog/libipulog.c     Tue Jan 30 13:05:43 2001
4747 @@ -0,0 +1,249 @@
4748 +/*
4749 + * libipulog.c, 1.6
4750 + *
4751 + * netfilter ULOG userspace library.
4752 + *
4753 + * (C) 2000 by Harald Welte <laforge@gnumonks.org>
4754 + * released under the terms of GNU GPL
4755 + *
4756 + * This library is still under development, so be aware of sudden interface
4757 + * changes
4758 + *
4759 + * libipulog.c,v 1.6 2001/01/30 09:28:04 laforge Exp
4760 + */
4761 +
4762 +#include <stdlib.h>
4763 +#include <stdio.h>
4764 +#include <string.h>
4765 +#include <unistd.h>
4766 +#include <net/if.h>
4767 +#include <libipulog/libipulog.h>
4768 +
4769 +struct ipulog_handle
4770 +{
4771 +       int fd;
4772 +       u_int8_t blocking;
4773 +       struct sockaddr_nl local;
4774 +       struct sockaddr_nl peer;
4775 +       struct nlmsghdr* last_nlhdr;
4776 +};
4777 +
4778 +/* internal */
4779 +
4780 +enum
4781 +{
4782 +       IPULOG_ERR_NONE = 0,
4783 +       IPULOG_ERR_IMPL,
4784 +       IPULOG_ERR_HANDLE,
4785 +       IPULOG_ERR_SOCKET,
4786 +       IPULOG_ERR_BIND,
4787 +       IPULOG_ERR_RECVBUF,
4788 +       IPULOG_ERR_RECV,
4789 +       IPULOG_ERR_NLEOF,
4790 +       IPULOG_ERR_TRUNC,
4791 +       IPULOG_ERR_INVGR,
4792 +       IPULOG_ERR_INVNL,
4793 +};
4794 +
4795 +#define IPULOG_MAXERR IPULOG_ERR_INVNL
4796 +
4797 +static int ipulog_errno = IPULOG_ERR_NONE;
4798 +
4799 +struct ipulog_errmap_t
4800 +{
4801 +       int errcode;
4802 +       char *message;
4803 +} ipulog_errmap[] =
4804 +{
4805 +       { IPULOG_ERR_NONE, "No error" },
4806 +       { IPULOG_ERR_IMPL, "Not implemented yet" },
4807 +       { IPULOG_ERR_HANDLE, "Unable to create netlink handle" },
4808 +       { IPULOG_ERR_SOCKET, "Unable to create netlink socket" },
4809 +       { IPULOG_ERR_BIND, "Unable to bind netlink socket" },
4810 +       { IPULOG_ERR_RECVBUF, "Receive buffer size invalid" },
4811 +       { IPULOG_ERR_RECV, "Error during netlink receive" },
4812 +       { IPULOG_ERR_NLEOF, "Received EOF on netlink socket" },
4813 +       { IPULOG_ERR_TRUNC, "Receive message truncated" },
4814 +       { IPULOG_ERR_INVGR, "Invalid group specified" },
4815 +       { IPULOG_ERR_INVNL, "Invalid netlink message" },
4816 +};
4817 +
4818 +static ssize_t ipulog_netlink_recvfrom(const struct ipulog_handle *h,
4819 +                       unsigned char *buf, size_t len)
4820 +{
4821 +       int addrlen, status;
4822 +       struct nlmsghdr *nlh;
4823 +
4824 +       if (len < sizeof(struct nlmsgerr)) {
4825 +               ipulog_errno = IPULOG_ERR_RECVBUF;
4826 +               return -1;
4827 +       }
4828 +       addrlen = sizeof(h->peer);
4829 +       status = recvfrom(h->fd, buf, len, 0, (struct sockaddr *)&h->peer,
4830 +                       &addrlen);
4831 +       if (status < 0)
4832 +       {
4833 +               ipulog_errno = IPULOG_ERR_RECV;
4834 +               return status;
4835 +       }
4836 +       if (addrlen != sizeof (h->peer))
4837 +       {
4838 +               ipulog_errno = IPULOG_ERR_RECV;
4839 +               return -1;
4840 +       }
4841 +       if (status == 0)
4842 +       {
4843 +               ipulog_errno = IPULOG_ERR_NLEOF;
4844 +               return -1;
4845 +       }
4846 +       nlh = (struct nlmsghdr *)buf;
4847 +       if (nlh->nlmsg_flags & MSG_TRUNC || status > len)
4848 +       {
4849 +               ipulog_errno = IPULOG_ERR_TRUNC;
4850 +               return -1;
4851 +       }
4852 +       return status;
4853 +}
4854 +
4855 +static char *ipulog_strerror(int errcode)
4856 +{
4857 +       if (errcode < 0 || errcode > IPULOG_MAXERR)
4858 +               errcode = IPULOG_ERR_IMPL;
4859 +       return ipulog_errmap[errcode].message;
4860 +}
4861 +
4862 +
4863 +/* public */
4864 +
4865 +/* convert a netlink group (1-32) to a group_mask suitable for create_handle */
4866 +u_int32_t ipulog_group2gmask(u_int32_t group)
4867 +{
4868 +       if (group < 1 || group > 32)
4869 +       {
4870 +               ipulog_errno = IPULOG_ERR_INVGR;
4871 +               return 0;
4872 +       }
4873 +       return (1 << (group - 1));
4874 +}
4875 +
4876 +/* create a ipulog handle for the reception of packets sent to gmask */
4877 +struct ipulog_handle *ipulog_create_handle(unsigned int gmask)
4878 +{
4879 +       struct ipulog_handle *h;
4880 +       int status;
4881 +
4882 +       h = (struct ipulog_handle *) malloc(sizeof(struct ipulog_handle));
4883 +       if (h == NULL)
4884 +       {
4885 +               ipulog_errno = IPULOG_ERR_HANDLE;
4886 +               return NULL;
4887 +       }
4888 +       memset(h, 0, sizeof(struct ipulog_handle));
4889 +       h->fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_NFLOG);
4890 +       if (h->fd == -1)
4891 +       {
4892 +               ipulog_errno = IPULOG_ERR_SOCKET;
4893 +               close(h->fd);
4894 +               free(h);
4895 +               return NULL;
4896 +       }
4897 +       memset(&h->local, 0, sizeof(struct sockaddr_nl));
4898 +       h->local.nl_family = AF_NETLINK;
4899 +       h->local.nl_pid = getpid();
4900 +       h->local.nl_groups = gmask;
4901 +       status = bind(h->fd, (struct sockaddr *)&h->local, sizeof(h->local));
4902 +       if (status == -1)
4903 +       {
4904 +               ipulog_errno = IPULOG_ERR_BIND;
4905 +               close(h->fd);
4906 +               free(h);
4907 +               return NULL;
4908 +       }
4909 +       memset(&h->peer, 0, sizeof(struct sockaddr_nl));
4910 +       h->peer.nl_family = AF_NETLINK;
4911 +       h->peer.nl_pid = 0;
4912 +       h->peer.nl_groups = gmask;
4913 +
4914 +       return h;
4915 +}
4916 +
4917 +/* destroy a ipulog handle */
4918 +void ipulog_destroy_handle(struct ipulog_handle *h)
4919 +{
4920 +       close(h->fd);
4921 +       free(h);
4922 +}
4923 +
4924 +#if 0
4925 +int ipulog_set_mode()
4926 +{
4927 +}
4928 +#endif
4929 +
4930 +/* do a BLOCKING read on an ipulog handle */
4931 +ssize_t ipulog_read(struct ipulog_handle *h, unsigned char *buf,
4932 +                   size_t len, int timeout)
4933 +{
4934 +       return ipulog_netlink_recvfrom(h, buf, len);
4935 +}
4936 +
4937 +/* get a pointer to the actual start of the ipulog packet,
4938 +   use this to strip netlink header */
4939 +ulog_packet_msg_t *ipulog_get_packet(struct ipulog_handle *h,
4940 +                                    const unsigned char *buf,
4941 +                                    size_t len)
4942 +{
4943 +       struct nlmsghdr *nlh;
4944 +       size_t remain_len;
4945 +
4946 +       /* if last header in handle not inside this buffer,
4947 +        * drop reference to last header */
4948 +       if ((unsigned char *)h->last_nlhdr > (buf + len) ||
4949 +           (unsigned char *)h->last_nlhdr < buf) {
4950 +               h->last_nlhdr = NULL;
4951 +       }
4952 +
4953 +       if (!h->last_nlhdr) {
4954 +               /* fist message in buffer */
4955 +               nlh = (struct nlmsghdr *) buf;
4956 +               if (!NLMSG_OK(nlh, len)) {
4957 +                       /* ERROR */
4958 +                       ipulog_errno = IPULOG_ERR_INVNL;
4959 +                       return NULL;
4960 +               }
4961 +       } else {
4962 +               /* we are in n-th part of multilink message */
4963 +               if (h->last_nlhdr->nlmsg_type == NLMSG_DONE) {
4964 +                       /* if last part in multilink message, return */
4965 +                       h->last_nlhdr = NULL;
4966 +                       return NULL;
4967 +               }
4968 +
4969 +               /* calculate remaining lenght from lasthdr to end of buffer */
4970 +               remain_len = (len -
4971 +                               ((unsigned char *)h->last_nlhdr - buf));
4972 +               nlh = NLMSG_NEXT(h->last_nlhdr, remain_len);
4973 +       }
4974 +
4975 +       /* update last_nlhdr field */
4976 +       if (nlh->nlmsg_flags & NLM_F_MULTI) {
4977 +                       h->last_nlhdr = nlh;
4978 +       }
4979 +
4980 +       return NLMSG_DATA(nlh);
4981 +}
4982 +
4983 +/* print a human readable description of the last error to stderr */
4984 +void ipulog_perror(const char *s)
4985 +{
4986 +       if (s)
4987 +               fputs(s, stderr);
4988 +       else
4989 +               fputs("ERROR", stderr);
4990 +       if (ipulog_errno)
4991 +               fprintf(stderr, ": %s", ipulog_strerror(ipulog_errno));
4992 +       if (errno)
4993 +               fprintf(stderr, ": %s", strerror(errno));
4994 +       fputc('\n', stderr);
4995 +}
4996 +