+++ /dev/null
-diff -Nur iptables.org/extensions/.policy-test iptables/extensions/.policy-test
---- iptables.org/extensions/.policy-test 1970-01-01 01:00:00.000000000 +0100
-+++ iptables/extensions/.policy-test 2004-06-29 12:35:40.000000000 +0200
-@@ -0,0 +1,3 @@
-+#!/bin/sh
-+#
-+[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_policy.h ] && echo policy
-diff -Nur iptables.org/extensions/.policy-test6 iptables/extensions/.policy-test6
---- iptables.org/extensions/.policy-test6 1970-01-01 01:00:00.000000000 +0100
-+++ iptables/extensions/.policy-test6 2004-06-29 12:35:40.000000000 +0200
-@@ -0,0 +1,3 @@
-+#!/bin/sh
-+#
-+[ -f $KERNEL_DIR/include/linux/netfilter_ipv6/ip6t_policy.h ] && echo policy
-diff -Nur iptables.org/extensions/libip6t_policy.c iptables/extensions/libip6t_policy.c
---- iptables.org/extensions/libip6t_policy.c 1970-01-01 01:00:00.000000000 +0100
-+++ iptables/extensions/libip6t_policy.c 2004-06-29 12:35:40.000000000 +0200
-@@ -0,0 +1,471 @@
-+/* Shared library add-on to iptables to add policy support. */
-+
-+#include <stdio.h>
-+#include <netdb.h>
-+#include <string.h>
-+#include <stdlib.h>
-+#include <syslog.h>
-+#include <getopt.h>
-+#include <netdb.h>
-+#include <errno.h>
-+#include <sys/socket.h>
-+#include <netinet/in.h>
-+#include <arpa/inet.h>
-+#include <ip6tables.h>
-+
-+#include <linux/netfilter_ipv6/ip6_tables.h>
-+#include <linux/netfilter_ipv6/ip6t_policy.h>
-+
-+/*
-+ * HACK: global pointer to current matchinfo for making
-+ * final checks and adjustments in final_check.
-+ */
-+static struct ip6t_policy_info *policy_info;
-+
-+static void help(void)
-+{
-+ printf(
-+"policy v%s options:\n"
-+" --dir in|out match policy applied during decapsulation/\n"
-+" policy to be applied during encapsulation\n"
-+" --pol none|ipsec match policy\n"
-+" --strict match entire policy instead of single element\n"
-+" at any position\n"
-+"[!] --reqid reqid match reqid\n"
-+"[!] --spi spi match SPI\n"
-+"[!] --proto proto match protocol (ah/esp/ipcomp)\n"
-+"[!] --mode mode match mode (transport/tunnel)\n"
-+"[!] --tunnel-src addr/masklen match tunnel source\n"
-+"[!] --tunnel-dst addr/masklen match tunnel destination\n"
-+" --next begin next element in policy\n",
-+ IPTABLES_VERSION);
-+}
-+
-+static struct option opts[] =
-+{
-+ {
-+ .name = "dir",
-+ .has_arg = 1,
-+ .val = '1',
-+ },
-+ {
-+ .name = "pol",
-+ .has_arg = 1,
-+ .val = '2',
-+ },
-+ {
-+ .name = "strict",
-+ .val = '3'
-+ },
-+ {
-+ .name = "reqid",
-+ .has_arg = 1,
-+ .val = '4',
-+ },
-+ {
-+ .name = "spi",
-+ .has_arg = 1,
-+ .val = '5'
-+ },
-+ {
-+ .name = "tunnel-src",
-+ .has_arg = 1,
-+ .val = '6'
-+ },
-+ {
-+ .name = "tunnel-dst",
-+ .has_arg = 1,
-+ .val = '7'
-+ },
-+ {
-+ .name = "proto",
-+ .has_arg = 1,
-+ .val = '8'
-+ },
-+ {
-+ .name = "mode",
-+ .has_arg = 1,
-+ .val = '9'
-+ },
-+ {
-+ .name = "next",
-+ .val = 'a'
-+ },
-+ { }
-+};
-+
-+/* FIXME - Duplicated code from ip6tables.c */
-+/* Duplicated to stop too many changes in other files .... */
-+static void
-+in6addrcpy(struct in6_addr *dst, struct in6_addr *src)
-+{
-+ memcpy(dst, src, sizeof(struct in6_addr));
-+ /* dst->s6_addr = src->s6_addr; */
-+}
-+
-+static char *
-+addr_to_numeric(const struct in6_addr *addrp)
-+{
-+ /* 0000:0000:0000:0000:0000:000.000.000.000
-+ * 0000:0000:0000:0000:0000:0000:0000:0000 */
-+ static char buf[50+1];
-+ return (char *)inet_ntop(AF_INET6, addrp, buf, sizeof(buf));
-+}
-+
-+static char *
-+mask_to_numeric(const struct in6_addr *addrp)
-+{
-+ static char buf[50+2];
-+ int l = ipv6_prefix_length(addrp);
-+ if (l == -1) {
-+ strcpy(buf, "/");
-+ strcat(buf, addr_to_numeric(addrp));
-+ return buf;
-+ }
-+ sprintf(buf, "/%d", l);
-+ return buf;
-+}
-+
-+/* These should be in include/ip6tables.h... */
-+extern u_int16_t parse_protocol(const char *s);
-+extern void parse_hostnetworkmask(const char *name, struct in6_addr **addrpp,
-+ struct in6_addr *maskp, unsigned int *naddrs);
-+
-+/* End duplicated code from ip6tables.c */
-+
-+static void init(struct ip6t_entry_match *m, unsigned int *nfcache)
-+{
-+ *nfcache |= NFC_UNKNOWN;
-+}
-+
-+static int parse_direction(char *s)
-+{
-+ if (strcmp(s, "in") == 0)
-+ return POLICY_MATCH_IN;
-+ if (strcmp(s, "out") == 0)
-+ return POLICY_MATCH_OUT;
-+ exit_error(PARAMETER_PROBLEM, "policy_match: invalid dir `%s'", s);
-+}
-+
-+static int parse_policy(char *s)
-+{
-+ if (strcmp(s, "none") == 0)
-+ return POLICY_MATCH_NONE;
-+ if (strcmp(s, "ipsec") == 0)
-+ return 0;
-+ exit_error(PARAMETER_PROBLEM, "policy match: invalid policy `%s'", s);
-+}
-+
-+static int parse_mode(char *s)
-+{
-+ if (strcmp(s, "transport") == 0)
-+ return POLICY_MODE_TRANSPORT;
-+ if (strcmp(s, "tunnel") == 0)
-+ return POLICY_MODE_TUNNEL;
-+ exit_error(PARAMETER_PROBLEM, "policy match: invalid mode `%s'", s);
-+}
-+
-+static int parse(int c, char **argv, int invert, unsigned int *flags,
-+ const struct ip6t_entry *entry,
-+ unsigned int *nfcache,
-+ struct ip6t_entry_match **match)
-+{
-+ struct ip6t_policy_info *info = (void *)(*match)->data;
-+ struct ip6t_policy_elem *e = &info->pol[info->len];
-+ struct in6_addr *addr = NULL, mask;
-+ unsigned int naddr = 0;
-+ int mode;
-+
-+ check_inverse(optarg, &invert, &optind, 0);
-+
-+ switch (c) {
-+ case '1':
-+ if (info->flags & (POLICY_MATCH_IN|POLICY_MATCH_OUT))
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --dir option");
-+ if (invert)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: can't invert --dir option");
-+
-+ info->flags |= parse_direction(argv[optind-1]);
-+ break;
-+ case '2':
-+ if (invert)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: can't invert --policy option");
-+
-+ info->flags |= parse_policy(argv[optind-1]);
-+ break;
-+ case '3':
-+ if (info->flags & POLICY_MATCH_STRICT)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --strict option");
-+
-+ if (invert)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: can't invert --strict option");
-+
-+ info->flags |= POLICY_MATCH_STRICT;
-+ break;
-+ case '4':
-+ if (e->match.reqid)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --reqid option");
-+
-+ e->match.reqid = 1;
-+ e->invert.reqid = invert;
-+ e->reqid = strtol(argv[optind-1], NULL, 10);
-+ break;
-+ case '5':
-+ if (e->match.spi)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --spi option");
-+
-+ e->match.spi = 1;
-+ e->invert.spi = invert;
-+ e->spi = strtol(argv[optind-1], NULL, 0x10);
-+ break;
-+ case '6':
-+ if (e->match.saddr)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --tunnel-src option");
-+
-+ parse_hostnetworkmask(argv[optind-1], &addr, &mask, &naddr);
-+ if (naddr > 1)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: name resolves to multiple IPs");
-+
-+ e->match.saddr = 1;
-+ e->invert.saddr = invert;
-+ in6addrcpy(&e->daddr, addr);
-+ in6addrcpy(&e->dmask, &mask);
-+ break;
-+ case '7':
-+ if (e->match.daddr)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --tunnel-dst option");
-+
-+ parse_hostnetworkmask(argv[optind-1], &addr, &mask, &naddr);
-+ if (naddr > 1)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: name resolves to multiple IPs");
-+
-+ e->match.daddr = 1;
-+ e->invert.daddr = invert;
-+ in6addrcpy(&e->daddr, addr);
-+ in6addrcpy(&e->dmask, &mask);
-+ break;
-+ case '8':
-+ if (e->match.proto)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --proto option");
-+
-+ e->proto = parse_protocol(argv[optind-1]);
-+ if (e->proto != IPPROTO_AH && e->proto != IPPROTO_ESP &&
-+ e->proto != IPPROTO_COMP)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: protocol must ah/esp/ipcomp");
-+ e->match.proto = 1;
-+ e->invert.proto = invert;
-+ break;
-+ case '9':
-+ if (e->match.mode)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --mode option");
-+
-+ mode = parse_mode(argv[optind-1]);
-+ e->match.mode = 1;
-+ e->invert.mode = invert;
-+ e->mode = mode;
-+ break;
-+ case 'a':
-+ if (invert)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: can't invert --next option");
-+
-+ if (++info->len == POLICY_MAX_ELEM)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: maximum policy depth reached");
-+ break;
-+ default:
-+ return 0;
-+ }
-+
-+ policy_info = info;
-+ return 1;
-+}
-+
-+static void final_check(unsigned int flags)
-+{
-+ struct ip6t_policy_info *info = policy_info;
-+ struct ip6t_policy_elem *e;
-+ int i;
-+
-+ if (info == NULL)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: no parameters given");
-+
-+ if (!(info->flags & (POLICY_MATCH_IN|POLICY_MATCH_OUT)))
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: neither --in nor --out specified");
-+
-+ if (info->flags & POLICY_MATCH_NONE) {
-+ if (info->flags & POLICY_MATCH_STRICT)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: policy none but --strict given");
-+
-+ if (info->len != 0)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: policy none but policy given");
-+ } else
-+ info->len++; /* increase len by 1, no --next after last element */
-+
-+ if (!(info->flags & POLICY_MATCH_STRICT) && info->len > 1)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: multiple elements but no --strict");
-+
-+ for (i = 0; i < info->len; i++) {
-+ e = &info->pol[i];
-+ if ((e->match.saddr || e->match.daddr)
-+ && ((e->mode == POLICY_MODE_TUNNEL && e->invert.mode) ||
-+ (e->mode == POLICY_MODE_TRANSPORT && !e->invert.mode)))
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: --tunnel-src/--tunnel-dst "
-+ "is only valid in tunnel mode");
-+ }
-+}
-+
-+static void print_mode(char *prefix, u_int8_t mode, int numeric)
-+{
-+ printf("%smode ", prefix);
-+
-+ switch (mode) {
-+ case POLICY_MODE_TRANSPORT:
-+ printf("transport ");
-+ break;
-+ case POLICY_MODE_TUNNEL:
-+ printf("tunnel ");
-+ break;
-+ default:
-+ printf("??? ");
-+ break;
-+ }
-+}
-+
-+static void print_proto(char *prefix, u_int8_t proto, int numeric)
-+{
-+ struct protoent *p = NULL;
-+
-+ printf("%sproto ", prefix);
-+ if (!numeric)
-+ p = getprotobynumber(proto);
-+ if (p != NULL)
-+ printf("%s ", p->p_name);
-+ else
-+ printf("%u ", proto);
-+}
-+
-+#define PRINT_INVERT(x) \
-+do { \
-+ if (x) \
-+ printf("! "); \
-+} while(0)
-+
-+static void print_entry(char *prefix, const struct ip6t_policy_elem *e,
-+ int numeric)
-+{
-+ if (e->match.reqid) {
-+ PRINT_INVERT(e->invert.reqid);
-+ printf("%sreqid %u ", prefix, e->reqid);
-+ }
-+ if (e->match.spi) {
-+ PRINT_INVERT(e->invert.spi);
-+ printf("%sspi 0x%x ", prefix, e->spi);
-+ }
-+ if (e->match.proto) {
-+ PRINT_INVERT(e->invert.proto);
-+ print_proto(prefix, e->proto, numeric);
-+ }
-+ if (e->match.mode) {
-+ PRINT_INVERT(e->invert.mode);
-+ print_mode(prefix, e->mode, numeric);
-+ }
-+ if (e->match.daddr) {
-+ PRINT_INVERT(e->invert.daddr);
-+ printf("%stunnel-dst %s%s ", prefix,
-+ addr_to_numeric((struct in6_addr *)&e->daddr),
-+ mask_to_numeric((struct in6_addr *)&e->dmask));
-+ }
-+ if (e->match.saddr) {
-+ PRINT_INVERT(e->invert.saddr);
-+ printf("%stunnel-src %s%s ", prefix,
-+ addr_to_numeric((struct in6_addr *)&e->saddr),
-+ mask_to_numeric((struct in6_addr *)&e->smask));
-+ }
-+}
-+
-+static void print_flags(char *prefix, const struct ip6t_policy_info *info)
-+{
-+ if (info->flags & POLICY_MATCH_IN)
-+ printf("%sdir in ", prefix);
-+ else
-+ printf("%sdir out ", prefix);
-+
-+ if (info->flags & POLICY_MATCH_NONE)
-+ printf("%spol none ", prefix);
-+ else
-+ printf("%spol ipsec ", prefix);
-+
-+ if (info->flags & POLICY_MATCH_STRICT)
-+ printf("%sstrict ", prefix);
-+}
-+
-+static void print(const struct ip6t_ip6 *ip,
-+ const struct ip6t_entry_match *match,
-+ int numeric)
-+{
-+ const struct ip6t_policy_info *info = (void *)match->data;
-+ unsigned int i;
-+
-+ printf("policy match ");
-+ print_flags("", info);
-+ for (i = 0; i < info->len; i++) {
-+ if (info->len > 1)
-+ printf("[%u] ", i);
-+ print_entry("", &info->pol[i], numeric);
-+ }
-+
-+ printf("\n");
-+}
-+
-+static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match)
-+{
-+ const struct ip6t_policy_info *info = (void *)match->data;
-+ unsigned int i;
-+
-+ print_flags("--", info);
-+ for (i = 0; i < info->len; i++) {
-+ print_entry("--", &info->pol[i], 0);
-+ if (i + 1 < info->len)
-+ printf("--next ");
-+ }
-+}
-+
-+struct ip6tables_match policy = {
-+ .name = "policy",
-+ .version = IPTABLES_VERSION,
-+ .size = IP6T_ALIGN(sizeof(struct ip6t_policy_info)),
-+ .userspacesize = IP6T_ALIGN(sizeof(struct ip6t_policy_info)),
-+ .help = help,
-+ .init = init,
-+ .parse = parse,
-+ .final_check = final_check,
-+ .print = print,
-+ .save = save,
-+ .extra_opts = opts
-+};
-+
-+void _init(void)
-+{
-+ register_match6(&policy);
-+}
-diff -Nur iptables.org/extensions/libipt_policy.c iptables/extensions/libipt_policy.c
---- iptables.org/extensions/libipt_policy.c 1970-01-01 01:00:00.000000000 +0100
-+++ iptables/extensions/libipt_policy.c 2004-06-29 12:35:40.000000000 +0200
-@@ -0,0 +1,431 @@
-+/* Shared library add-on to iptables to add policy support. */
-+#include <stdio.h>
-+#include <netdb.h>
-+#include <string.h>
-+#include <stdlib.h>
-+#include <syslog.h>
-+#include <getopt.h>
-+#include <netdb.h>
-+#include <errno.h>
-+#include <sys/socket.h>
-+#include <netinet/in.h>
-+#include <arpa/inet.h>
-+#include <iptables.h>
-+
-+#include <linux/netfilter_ipv4/ip_tables.h>
-+#include <linux/netfilter_ipv4/ipt_policy.h>
-+
-+/*
-+ * HACK: global pointer to current matchinfo for making
-+ * final checks and adjustments in final_check.
-+ */
-+static struct ipt_policy_info *policy_info;
-+
-+static void help(void)
-+{
-+ printf(
-+"policy v%s options:\n"
-+" --dir in|out match policy applied during decapsulation/\n"
-+" policy to be applied during encapsulation\n"
-+" --pol none|ipsec match policy\n"
-+" --strict match entire policy instead of single element\n"
-+" at any position\n"
-+"[!] --reqid reqid match reqid\n"
-+"[!] --spi spi match SPI\n"
-+"[!] --proto proto match protocol (ah/esp/ipcomp)\n"
-+"[!] --mode mode match mode (transport/tunnel)\n"
-+"[!] --tunnel-src addr/mask match tunnel source\n"
-+"[!] --tunnel-dst addr/mask match tunnel destination\n"
-+" --next begin next element in policy\n",
-+ IPTABLES_VERSION);
-+}
-+
-+static struct option opts[] =
-+{
-+ {
-+ .name = "dir",
-+ .has_arg = 1,
-+ .val = '1',
-+ },
-+ {
-+ .name = "pol",
-+ .has_arg = 1,
-+ .val = '2',
-+ },
-+ {
-+ .name = "strict",
-+ .val = '3'
-+ },
-+ {
-+ .name = "reqid",
-+ .has_arg = 1,
-+ .val = '4',
-+ },
-+ {
-+ .name = "spi",
-+ .has_arg = 1,
-+ .val = '5'
-+ },
-+ {
-+ .name = "tunnel-src",
-+ .has_arg = 1,
-+ .val = '6'
-+ },
-+ {
-+ .name = "tunnel-dst",
-+ .has_arg = 1,
-+ .val = '7'
-+ },
-+ {
-+ .name = "proto",
-+ .has_arg = 1,
-+ .val = '8'
-+ },
-+ {
-+ .name = "mode",
-+ .has_arg = 1,
-+ .val = '9'
-+ },
-+ {
-+ .name = "next",
-+ .val = 'a'
-+ },
-+ { }
-+};
-+
-+static void init(struct ipt_entry_match *m, unsigned int *nfcache)
-+{
-+ *nfcache |= NFC_UNKNOWN;
-+}
-+
-+static int parse_direction(char *s)
-+{
-+ if (strcmp(s, "in") == 0)
-+ return POLICY_MATCH_IN;
-+ if (strcmp(s, "out") == 0)
-+ return POLICY_MATCH_OUT;
-+ exit_error(PARAMETER_PROBLEM, "policy_match: invalid dir `%s'", s);
-+}
-+
-+static int parse_policy(char *s)
-+{
-+ if (strcmp(s, "none") == 0)
-+ return POLICY_MATCH_NONE;
-+ if (strcmp(s, "ipsec") == 0)
-+ return 0;
-+ exit_error(PARAMETER_PROBLEM, "policy match: invalid policy `%s'", s);
-+}
-+
-+static int parse_mode(char *s)
-+{
-+ if (strcmp(s, "transport") == 0)
-+ return POLICY_MODE_TRANSPORT;
-+ if (strcmp(s, "tunnel") == 0)
-+ return POLICY_MODE_TUNNEL;
-+ exit_error(PARAMETER_PROBLEM, "policy match: invalid mode `%s'", s);
-+}
-+
-+static int parse(int c, char **argv, int invert, unsigned int *flags,
-+ const struct ipt_entry *entry,
-+ unsigned int *nfcache,
-+ struct ipt_entry_match **match)
-+{
-+ struct ipt_policy_info *info = (void *)(*match)->data;
-+ struct ipt_policy_elem *e = &info->pol[info->len];
-+ struct in_addr *addr = NULL, mask;
-+ unsigned int naddr = 0;
-+ int mode;
-+
-+ check_inverse(optarg, &invert, &optind, 0);
-+
-+ switch (c) {
-+ case '1':
-+ if (info->flags & (POLICY_MATCH_IN|POLICY_MATCH_OUT))
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --dir option");
-+ if (invert)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: can't invert --dir option");
-+
-+ info->flags |= parse_direction(argv[optind-1]);
-+ break;
-+ case '2':
-+ if (invert)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: can't invert --policy option");
-+
-+ info->flags |= parse_policy(argv[optind-1]);
-+ break;
-+ case '3':
-+ if (info->flags & POLICY_MATCH_STRICT)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --strict option");
-+
-+ if (invert)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: can't invert --strict option");
-+
-+ info->flags |= POLICY_MATCH_STRICT;
-+ break;
-+ case '4':
-+ if (e->match.reqid)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --reqid option");
-+
-+ e->match.reqid = 1;
-+ e->invert.reqid = invert;
-+ e->reqid = strtol(argv[optind-1], NULL, 10);
-+ break;
-+ case '5':
-+ if (e->match.spi)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --spi option");
-+
-+ e->match.spi = 1;
-+ e->invert.spi = invert;
-+ e->spi = strtol(argv[optind-1], NULL, 0x10);
-+ break;
-+ case '6':
-+ if (e->match.saddr)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --tunnel-src option");
-+
-+ parse_hostnetworkmask(argv[optind-1], &addr, &mask, &naddr);
-+ if (naddr > 1)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: name resolves to multiple IPs");
-+
-+ e->match.saddr = 1;
-+ e->invert.saddr = invert;
-+ e->saddr = addr[0].s_addr;
-+ e->smask = mask.s_addr;
-+ break;
-+ case '7':
-+ if (e->match.daddr)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --tunnel-dst option");
-+
-+ parse_hostnetworkmask(argv[optind-1], &addr, &mask, &naddr);
-+ if (naddr > 1)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: name resolves to multiple IPs");
-+
-+ e->match.daddr = 1;
-+ e->invert.daddr = invert;
-+ e->daddr = addr[0].s_addr;
-+ e->dmask = mask.s_addr;
-+ break;
-+ case '8':
-+ if (e->match.proto)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --proto option");
-+
-+ e->proto = parse_protocol(argv[optind-1]);
-+ if (e->proto != IPPROTO_AH && e->proto != IPPROTO_ESP &&
-+ e->proto != IPPROTO_COMP)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: protocol must ah/esp/ipcomp");
-+ e->match.proto = 1;
-+ e->invert.proto = invert;
-+ break;
-+ case '9':
-+ if (e->match.mode)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: double --mode option");
-+
-+ mode = parse_mode(argv[optind-1]);
-+ e->match.mode = 1;
-+ e->invert.mode = invert;
-+ e->mode = mode;
-+ break;
-+ case 'a':
-+ if (invert)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: can't invert --next option");
-+
-+ if (++info->len == POLICY_MAX_ELEM)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: maximum policy depth reached");
-+ break;
-+ default:
-+ return 0;
-+ }
-+
-+ policy_info = info;
-+ return 1;
-+}
-+
-+static void final_check(unsigned int flags)
-+{
-+ struct ipt_policy_info *info = policy_info;
-+ struct ipt_policy_elem *e;
-+ int i;
-+
-+ if (info == NULL)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: no parameters given");
-+
-+ if (!(info->flags & (POLICY_MATCH_IN|POLICY_MATCH_OUT)))
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: neither --in nor --out specified");
-+
-+ if (info->flags & POLICY_MATCH_NONE) {
-+ if (info->flags & POLICY_MATCH_STRICT)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: policy none but --strict given");
-+
-+ if (info->len != 0)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: policy none but policy given");
-+ } else
-+ info->len++; /* increase len by 1, no --next after last element */
-+
-+ if (!(info->flags & POLICY_MATCH_STRICT) && info->len > 1)
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: multiple elements but no --strict");
-+
-+ for (i = 0; i < info->len; i++) {
-+ e = &info->pol[i];
-+ if ((e->match.saddr || e->match.daddr)
-+ && ((e->mode == POLICY_MODE_TUNNEL && e->invert.mode) ||
-+ (e->mode == POLICY_MODE_TRANSPORT && !e->invert.mode)))
-+ exit_error(PARAMETER_PROBLEM,
-+ "policy match: --tunnel-src/--tunnel-dst "
-+ "is only valid in tunnel mode");
-+ }
-+}
-+
-+static void print_mode(char *prefix, u_int8_t mode, int numeric)
-+{
-+ printf("%smode ", prefix);
-+
-+ switch (mode) {
-+ case POLICY_MODE_TRANSPORT:
-+ printf("transport ");
-+ break;
-+ case POLICY_MODE_TUNNEL:
-+ printf("tunnel ");
-+ break;
-+ default:
-+ printf("??? ");
-+ break;
-+ }
-+}
-+
-+static void print_proto(char *prefix, u_int8_t proto, int numeric)
-+{
-+ struct protoent *p = NULL;
-+
-+ printf("%sproto ", prefix);
-+ if (!numeric)
-+ p = getprotobynumber(proto);
-+ if (p != NULL)
-+ printf("%s ", p->p_name);
-+ else
-+ printf("%u ", proto);
-+}
-+
-+#define PRINT_INVERT(x) \
-+do { \
-+ if (x) \
-+ printf("! "); \
-+} while(0)
-+
-+static void print_entry(char *prefix, const struct ipt_policy_elem *e,
-+ int numeric)
-+{
-+ if (e->match.reqid) {
-+ PRINT_INVERT(e->invert.reqid);
-+ printf("%sreqid %u ", prefix, e->reqid);
-+ }
-+ if (e->match.spi) {
-+ PRINT_INVERT(e->invert.spi);
-+ printf("%sspi 0x%x ", prefix, e->spi);
-+ }
-+ if (e->match.proto) {
-+ PRINT_INVERT(e->invert.proto);
-+ print_proto(prefix, e->proto, numeric);
-+ }
-+ if (e->match.mode) {
-+ PRINT_INVERT(e->invert.mode);
-+ print_mode(prefix, e->mode, numeric);
-+ }
-+ if (e->match.daddr) {
-+ PRINT_INVERT(e->invert.daddr);
-+ printf("%stunnel-dst %s%s ", prefix,
-+ addr_to_dotted((struct in_addr *)&e->daddr),
-+ mask_to_dotted((struct in_addr *)&e->dmask));
-+ }
-+ if (e->match.saddr) {
-+ PRINT_INVERT(e->invert.saddr);
-+ printf("%stunnel-src %s%s ", prefix,
-+ addr_to_dotted((struct in_addr *)&e->saddr),
-+ mask_to_dotted((struct in_addr *)&e->smask));
-+ }
-+}
-+
-+static void print_flags(char *prefix, const struct ipt_policy_info *info)
-+{
-+ if (info->flags & POLICY_MATCH_IN)
-+ printf("%sdir in ", prefix);
-+ else
-+ printf("%sdir out ", prefix);
-+
-+ if (info->flags & POLICY_MATCH_NONE)
-+ printf("%spol none ", prefix);
-+ else
-+ printf("%spol ipsec ", prefix);
-+
-+ if (info->flags & POLICY_MATCH_STRICT)
-+ printf("%sstrict ", prefix);
-+}
-+
-+static void print(const struct ipt_ip *ip,
-+ const struct ipt_entry_match *match,
-+ int numeric)
-+{
-+ const struct ipt_policy_info *info = (void *)match->data;
-+ unsigned int i;
-+
-+ printf("policy match ");
-+ print_flags("", info);
-+ for (i = 0; i < info->len; i++) {
-+ if (info->len > 1)
-+ printf("[%u] ", i);
-+ print_entry("", &info->pol[i], numeric);
-+ }
-+}
-+
-+static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
-+{
-+ const struct ipt_policy_info *info = (void *)match->data;
-+ unsigned int i;
-+
-+ print_flags("--", info);
-+ for (i = 0; i < info->len; i++) {
-+ print_entry("--", &info->pol[i], 0);
-+ if (i + 1 < info->len)
-+ printf("--next ");
-+ }
-+
-+ printf("\n");
-+}
-+
-+struct iptables_match policy = {
-+ .name = "policy",
-+ .version = IPTABLES_VERSION,
-+ .size = IPT_ALIGN(sizeof(struct ipt_policy_info)),
-+ .userspacesize = IPT_ALIGN(sizeof(struct ipt_policy_info)),
-+ .help = help,
-+ .init = init,
-+ .parse = parse,
-+ .final_check = final_check,
-+ .print = print,
-+ .save = save,
-+ .extra_opts = opts
-+};
-+
-+void _init(void)
-+{
-+ register_match(&policy);
-+}
-diff -Nur iptables.org/extensions/libipt_policy.man iptables/extensions/libipt_policy.man
---- iptables.org/extensions/libipt_policy.man 1970-01-01 01:00:00.000000000 +0100
-+++ iptables/extensions/libipt_policy.man 2004-06-29 12:35:40.000000000 +0200
-@@ -0,0 +1,46 @@
-+This modules matches the policy used by IPsec for handling a packet.
-+.TP
-+.BI "--dir " "in|out"
-+Used to select whether to match the policy used for decapsulation or the
-+policy that will be used for encapsulation.
-+.B in
-+is valid in the
-+.B PREROUTING, INPUT and FORWARD
-+chains,
-+.B out
-+is valid in the
-+.B POSTROUTING, OUTPUT and FORWARD
-+chains.
-+.TP
-+.BI "--pol " "none|ipsec"
-+Matches if the packet is subject to IPsec processing.
-+.TP
-+.BI "--strict"
-+Selects whether to match the exact policy or match if any rule of
-+the policy matches the given policy.
-+.TP
-+.BI "--reqid " "id"
-+Matches the reqid of the policy rule. The reqid can be specified with
-+.B setkey(8)
-+using
-+.B unique:id
-+as level.
-+.TP
-+.BI "--spi " "spi"
-+Matches the SPI of the SA.
-+.TP
-+.BI "--proto " "ah|esp|ipcomp"
-+Matches the encapsulation protocol.
-+.TP
-+.BI "--mode " "tunnel|transport"
-+Matches the encapsulation mode.
-+.TP
-+.BI "--tunnel-src " "addr[/mask]"
-+Matches the source address of a tunnel. Only valid with --mode tunnel.
-+.TP
-+.BI "--tunnel-dst " "addr[/mask]"
-+Matches the destination address of a tunnel. Only valid with --mode tunnel.
-+.TP
-+.BI "--next"
-+Start the next element in the policy specification. Can only be used with
-+--strict
-diff -Nur iptables.org/include/libipq/libipq.h iptables/include/libipq/libipq.h
---- iptables.org/include/libipq/libipq.h 2003-09-07 12:09:22.000000000 +0200
-+++ iptables/include/libipq/libipq.h 2004-06-29 12:35:08.000000000 +0200
-@@ -79,6 +79,13 @@
- size_t data_len,
- unsigned char *buf);
-
-+int ipq_set_vwmark(const struct ipq_handle *h,
-+ ipq_id_t id,
-+ unsigned int verdict,
-+ unsigned long nfmark,
-+ size_t data_len,
-+ unsigned char *buf);
-+
- int ipq_ctl(const struct ipq_handle *h, int request, ...);
-
- char *ipq_errstr(void);
-diff -Nur iptables.org/libipq/libipq.c iptables/libipq/libipq.c
---- iptables.org/libipq/libipq.c 2003-11-14 20:17:45.000000000 +0100
-+++ iptables/libipq/libipq.c 2004-06-29 12:35:08.000000000 +0200
-@@ -352,6 +352,54 @@
- return ipq_netlink_sendmsg(h, &msg, 0);
- }
-
-+int ipq_set_vwmark(const struct ipq_handle *h,
-+ ipq_id_t id,
-+ unsigned int verdict,
-+ unsigned long nfmark,
-+ size_t data_len,
-+ unsigned char *buf)
-+{
-+ unsigned char nvecs;
-+ size_t tlen;
-+ struct nlmsghdr nlh;
-+ ipq_peer_msg_t pm;
-+ struct iovec iov[3];
-+ struct msghdr msg;
-+
-+ memset(&nlh, 0, sizeof(nlh));
-+ nlh.nlmsg_flags = NLM_F_REQUEST;
-+ nlh.nlmsg_type = IPQM_VWMARK;
-+ nlh.nlmsg_pid = h->local.nl_pid;
-+ memset(&pm, 0, sizeof(pm));
-+ pm.msg.vwmark.value = verdict;
-+ pm.msg.vwmark.id = id;
-+ pm.msg.vwmark.data_len = data_len;
-+ pm.msg.vwmark.nfmark = nfmark;
-+ iov[0].iov_base = &nlh;
-+ iov[0].iov_len = sizeof(nlh);
-+ iov[1].iov_base = ±
-+ iov[1].iov_len = sizeof(pm);
-+ tlen = sizeof(nlh) + sizeof(pm);
-+ nvecs = 2;
-+ if (data_len && buf) {
-+ iov[2].iov_base = buf;
-+ iov[2].iov_len = data_len;
-+ tlen += data_len;
-+ nvecs++;
-+ }
-+ msg.msg_name = (void *)&h->peer;
-+ msg.msg_namelen = sizeof(h->peer);
-+ msg.msg_iov = iov;
-+ msg.msg_iovlen = nvecs;
-+ msg.msg_control = NULL;
-+ msg.msg_controllen = 0;
-+ msg.msg_flags = 0;
-+ nlh.nlmsg_len = tlen;
-+ return ipq_netlink_sendmsg(h, &msg, 0);
-+}
-+
-+
-+
- /* Not implemented yet */
- int ipq_ctl(const struct ipq_handle *h, int request, ...)
- {
-diff -Nur iptables.org/libipq/libipq.c.orig iptables/libipq/libipq.c.orig
---- iptables.org/libipq/libipq.c.orig 1970-01-01 01:00:00.000000000 +0100
-+++ iptables/libipq/libipq.c.orig 2003-11-14 20:17:45.000000000 +0100
-@@ -0,0 +1,377 @@
-+/*
-+ * libipq.c
-+ *
-+ * IPQ userspace library.
-+ *
-+ * Please note that this library is still developmental, and there may
-+ * be some API changes.
-+ *
-+ * Author: James Morris <jmorris@intercode.com.au>
-+ *
-+ * 07-11-2001 Modified by Fernando Anton to add support for IPv6.
-+ *
-+ * Copyright (c) 2000-2001 Netfilter Core Team
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License as published by
-+ * the Free Software Foundation; either version 2 of the License, or
-+ * (at your option) any later version.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-+ * GNU General Public License for more details.
-+ *
-+ */
-+
-+#include <stdlib.h>
-+#include <stdio.h>
-+#include <string.h>
-+#include <unistd.h>
-+#include <sys/time.h>
-+#include <sys/types.h>
-+
-+#include <libipq/libipq.h>
-+
-+/****************************************************************************
-+ *
-+ * Private interface
-+ *
-+ ****************************************************************************/
-+
-+enum {
-+ IPQ_ERR_NONE = 0,
-+ IPQ_ERR_IMPL,
-+ IPQ_ERR_HANDLE,
-+ IPQ_ERR_SOCKET,
-+ IPQ_ERR_BIND,
-+ IPQ_ERR_BUFFER,
-+ IPQ_ERR_RECV,
-+ IPQ_ERR_NLEOF,
-+ IPQ_ERR_ADDRLEN,
-+ IPQ_ERR_STRUNC,
-+ IPQ_ERR_RTRUNC,
-+ IPQ_ERR_NLRECV,
-+ IPQ_ERR_SEND,
-+ IPQ_ERR_SUPP,
-+ IPQ_ERR_RECVBUF,
-+ IPQ_ERR_TIMEOUT,
-+ IPQ_ERR_PROTOCOL
-+};
-+#define IPQ_MAXERR IPQ_ERR_PROTOCOL
-+
-+struct ipq_errmap_t {
-+ int errcode;
-+ char *message;
-+} ipq_errmap[] = {
-+ { IPQ_ERR_NONE, "Unknown error" },
-+ { IPQ_ERR_IMPL, "Implementation error" },
-+ { IPQ_ERR_HANDLE, "Unable to create netlink handle" },
-+ { IPQ_ERR_SOCKET, "Unable to create netlink socket" },
-+ { IPQ_ERR_BIND, "Unable to bind netlink socket" },
-+ { IPQ_ERR_BUFFER, "Unable to allocate buffer" },
-+ { IPQ_ERR_RECV, "Failed to receive netlink message" },
-+ { IPQ_ERR_NLEOF, "Received EOF on netlink socket" },
-+ { IPQ_ERR_ADDRLEN, "Invalid peer address length" },
-+ { IPQ_ERR_STRUNC, "Sent message truncated" },
-+ { IPQ_ERR_RTRUNC, "Received message truncated" },
-+ { IPQ_ERR_NLRECV, "Received error from netlink" },
-+ { IPQ_ERR_SEND, "Failed to send netlink message" },
-+ { IPQ_ERR_SUPP, "Operation not supported" },
-+ { IPQ_ERR_RECVBUF, "Receive buffer size invalid" },
-+ { IPQ_ERR_TIMEOUT, "Timeout"},
-+ { IPQ_ERR_PROTOCOL, "Invalid protocol specified" }
-+};
-+
-+static int ipq_errno = IPQ_ERR_NONE;
-+
-+static ssize_t ipq_netlink_sendto(const struct ipq_handle *h,
-+ const void *msg, size_t len);
-+
-+static ssize_t ipq_netlink_recvfrom(const struct ipq_handle *h,
-+ unsigned char *buf, size_t len,
-+ int timeout);
-+
-+static ssize_t ipq_netlink_sendmsg(const struct ipq_handle *h,
-+ const struct msghdr *msg,
-+ unsigned int flags);
-+
-+static char *ipq_strerror(int errcode);
-+
-+static ssize_t ipq_netlink_sendto(const struct ipq_handle *h,
-+ const void *msg, size_t len)
-+{
-+ int status = sendto(h->fd, msg, len, 0,
-+ (struct sockaddr *)&h->peer, sizeof(h->peer));
-+ if (status < 0)
-+ ipq_errno = IPQ_ERR_SEND;
-+ return status;
-+}
-+
-+static ssize_t ipq_netlink_sendmsg(const struct ipq_handle *h,
-+ const struct msghdr *msg,
-+ unsigned int flags)
-+{
-+ int status = sendmsg(h->fd, msg, flags);
-+ if (status < 0)
-+ ipq_errno = IPQ_ERR_SEND;
-+ return status;
-+}
-+
-+static ssize_t ipq_netlink_recvfrom(const struct ipq_handle *h,
-+ unsigned char *buf, size_t len,
-+ int timeout)
-+{
-+ int addrlen, status;
-+ struct nlmsghdr *nlh;
-+
-+ if (len < sizeof(struct nlmsgerr)) {
-+ ipq_errno = IPQ_ERR_RECVBUF;
-+ return -1;
-+ }
-+ addrlen = sizeof(h->peer);
-+
-+ if (timeout != 0) {
-+ int ret;
-+ struct timeval tv;
-+ fd_set read_fds;
-+
-+ if (timeout < 0) {
-+ /* non-block non-timeout */
-+ tv.tv_sec = 0;
-+ tv.tv_usec = 0;
-+ } else {
-+ tv.tv_sec = timeout / 1000000;
-+ tv.tv_usec = timeout % 1000000;
-+ }
-+
-+ FD_ZERO(&read_fds);
-+ FD_SET(h->fd, &read_fds);
-+ ret = select(h->fd+1, &read_fds, NULL, NULL, &tv);
-+ if (ret < 0) {
-+ if (errno == EINTR) {
-+ return 0;
-+ } else {
-+ ipq_errno = IPQ_ERR_RECV;
-+ return -1;
-+ }
-+ }
-+ if (!FD_ISSET(h->fd, &read_fds)) {
-+ ipq_errno = IPQ_ERR_TIMEOUT;
-+ return 0;
-+ }
-+ }
-+ status = recvfrom(h->fd, buf, len, 0,
-+ (struct sockaddr *)&h->peer, &addrlen);
-+ if (status < 0) {
-+ ipq_errno = IPQ_ERR_RECV;
-+ return status;
-+ }
-+ if (addrlen != sizeof(h->peer)) {
-+ ipq_errno = IPQ_ERR_RECV;
-+ return -1;
-+ }
-+ if (h->peer.nl_pid != 0) {
-+ ipq_errno = IPQ_ERR_RECV;
-+ return -1;
-+ }
-+ if (status == 0) {
-+ ipq_errno = IPQ_ERR_NLEOF;
-+ return -1;
-+ }
-+ nlh = (struct nlmsghdr *)buf;
-+ if (nlh->nlmsg_flags & MSG_TRUNC || nlh->nlmsg_len > status) {
-+ ipq_errno = IPQ_ERR_RTRUNC;
-+ return -1;
-+ }
-+ return status;
-+}
-+
-+static char *ipq_strerror(int errcode)
-+{
-+ if (errcode < 0 || errcode > IPQ_MAXERR)
-+ errcode = IPQ_ERR_IMPL;
-+ return ipq_errmap[errcode].message;
-+}
-+
-+/****************************************************************************
-+ *
-+ * Public interface
-+ *
-+ ****************************************************************************/
-+
-+/*
-+ * Create and initialise an ipq handle.
-+ */
-+struct ipq_handle *ipq_create_handle(u_int32_t flags, u_int32_t protocol)
-+{
-+ int status;
-+ struct ipq_handle *h;
-+
-+ h = (struct ipq_handle *)malloc(sizeof(struct ipq_handle));
-+ if (h == NULL) {
-+ ipq_errno = IPQ_ERR_HANDLE;
-+ return NULL;
-+ }
-+
-+ memset(h, 0, sizeof(struct ipq_handle));
-+
-+ if (protocol == PF_INET)
-+ h->fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_FIREWALL);
-+ else if (protocol == PF_INET6)
-+ h->fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_IP6_FW);
-+ else {
-+ ipq_errno = IPQ_ERR_PROTOCOL;
-+ free(h);
-+ return NULL;
-+ }
-+
-+ if (h->fd == -1) {
-+ ipq_errno = IPQ_ERR_SOCKET;
-+ close(h->fd);
-+ free(h);
-+ return NULL;
-+ }
-+ memset(&h->local, 0, sizeof(struct sockaddr_nl));
-+ h->local.nl_family = AF_NETLINK;
-+ h->local.nl_pid = getpid();
-+ h->local.nl_groups = 0;
-+ status = bind(h->fd, (struct sockaddr *)&h->local, sizeof(h->local));
-+ if (status == -1) {
-+ ipq_errno = IPQ_ERR_BIND;
-+ close(h->fd);
-+ free(h);
-+ return NULL;
-+ }
-+ memset(&h->peer, 0, sizeof(struct sockaddr_nl));
-+ h->peer.nl_family = AF_NETLINK;
-+ h->peer.nl_pid = 0;
-+ h->peer.nl_groups = 0;
-+ return h;
-+}
-+
-+/*
-+ * No error condition is checked here at this stage, but it may happen
-+ * if/when reliable messaging is implemented.
-+ */
-+int ipq_destroy_handle(struct ipq_handle *h)
-+{
-+ if (h) {
-+ close(h->fd);
-+ free(h);
-+ }
-+ return 0;
-+}
-+
-+int ipq_set_mode(const struct ipq_handle *h,
-+ u_int8_t mode, size_t range)
-+{
-+ struct {
-+ struct nlmsghdr nlh;
-+ ipq_peer_msg_t pm;
-+ } req;
-+
-+ memset(&req, 0, sizeof(req));
-+ req.nlh.nlmsg_len = NLMSG_LENGTH(sizeof(req));
-+ req.nlh.nlmsg_flags = NLM_F_REQUEST;
-+ req.nlh.nlmsg_type = IPQM_MODE;
-+ req.nlh.nlmsg_pid = h->local.nl_pid;
-+ req.pm.msg.mode.value = mode;
-+ req.pm.msg.mode.range = range;
-+ return ipq_netlink_sendto(h, (void *)&req, req.nlh.nlmsg_len);
-+}
-+
-+/*
-+ * timeout is in microseconds (1 second is 1000000 (1 million) microseconds)
-+ *
-+ */
-+ssize_t ipq_read(const struct ipq_handle *h,
-+ unsigned char *buf, size_t len, int timeout)
-+{
-+ return ipq_netlink_recvfrom(h, buf, len, timeout);
-+}
-+
-+int ipq_message_type(const unsigned char *buf)
-+{
-+ return ((struct nlmsghdr*)buf)->nlmsg_type;
-+}
-+
-+int ipq_get_msgerr(const unsigned char *buf)
-+{
-+ struct nlmsghdr *h = (struct nlmsghdr *)buf;
-+ struct nlmsgerr *err = (struct nlmsgerr*)NLMSG_DATA(h);
-+ return -err->error;
-+}
-+
-+ipq_packet_msg_t *ipq_get_packet(const unsigned char *buf)
-+{
-+ return NLMSG_DATA((struct nlmsghdr *)(buf));
-+}
-+
-+int ipq_set_verdict(const struct ipq_handle *h,
-+ ipq_id_t id,
-+ unsigned int verdict,
-+ size_t data_len,
-+ unsigned char *buf)
-+{
-+ unsigned char nvecs;
-+ size_t tlen;
-+ struct nlmsghdr nlh;
-+ ipq_peer_msg_t pm;
-+ struct iovec iov[3];
-+ struct msghdr msg;
-+
-+ memset(&nlh, 0, sizeof(nlh));
-+ nlh.nlmsg_flags = NLM_F_REQUEST;
-+ nlh.nlmsg_type = IPQM_VERDICT;
-+ nlh.nlmsg_pid = h->local.nl_pid;
-+ memset(&pm, 0, sizeof(pm));
-+ pm.msg.verdict.value = verdict;
-+ pm.msg.verdict.id = id;
-+ pm.msg.verdict.data_len = data_len;
-+ iov[0].iov_base = &nlh;
-+ iov[0].iov_len = sizeof(nlh);
-+ iov[1].iov_base = ±
-+ iov[1].iov_len = sizeof(pm);
-+ tlen = sizeof(nlh) + sizeof(pm);
-+ nvecs = 2;
-+ if (data_len && buf) {
-+ iov[2].iov_base = buf;
-+ iov[2].iov_len = data_len;
-+ tlen += data_len;
-+ nvecs++;
-+ }
-+ msg.msg_name = (void *)&h->peer;
-+ msg.msg_namelen = sizeof(h->peer);
-+ msg.msg_iov = iov;
-+ msg.msg_iovlen = nvecs;
-+ msg.msg_control = NULL;
-+ msg.msg_controllen = 0;
-+ msg.msg_flags = 0;
-+ nlh.nlmsg_len = tlen;
-+ return ipq_netlink_sendmsg(h, &msg, 0);
-+}
-+
-+/* Not implemented yet */
-+int ipq_ctl(const struct ipq_handle *h, int request, ...)
-+{
-+ return 1;
-+}
-+
-+char *ipq_errstr(void)
-+{
-+ return ipq_strerror(ipq_errno);
-+}
-+
-+void ipq_perror(const char *s)
-+{
-+ if (s)
-+ fputs(s, stderr);
-+ else
-+ fputs("ERROR", stderr);
-+ if (ipq_errno)
-+ fprintf(stderr, ": %s", ipq_errstr());
-+ if (errno)
-+ fprintf(stderr, ": %s", strerror(errno));
-+ fputc('\n', stderr);
-+}
projects / packages / iptables.git / commitdiff