libxtables: have xtopt_parse_mint interpret partially-spec'd ranges

When ":n" or "n:" is specified, it will now be interpreted as "0:n"
and "n:<max>", respecitvely. nvals will always reflect the number of
(expanded) components. This restores the functionality of options that
take such partially-unspecified ranges.

This makes it possible to nuke the per-matchdata init functions of
some extensions and simply the extensions postparsing to the point
where it only needs to check for nvals==1 or ==2.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: unclutter xtopt_parse_mint

..by moving type-based actions into their own function.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: make multiint parser have greater range

Since parse_mint can handle XTTYPE_UINT64RC, it must allow numbers
larger than UINT32_MAX.

Cc: JP Abgrall <jpa@google.com>
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: use uintmax for xtables_strtoul

Addendum to 2305d5fb42fc059f38fc1bdf53411dbeecdb310b.

I noticed that unsigned long long is not consistently used, for
example, min/max are still just unsigned long, and strtoul is being
called.

Instead of changing it to unsigned long long, just use uintmax
functions right away so this does not need size-related changing in
the future.

Cc: JP Abgrall <jpa@google.com>
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: more detailed error message on multi-int parsing

Now shows where exactly the error is.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libip6t_rt: restore --rt-type storing

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_u32: --u32 option is required

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_ipvs: restore network-byte order

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

doc: remove redundant .IP calls in libxt_time

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

doc: use .IP list for TCPMSS

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

doc: clarify that -p all is a special keyword only

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

doc: make usage of libxt_rateest more obvious

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

doc: add some coded option examples to libxt_hashlimit

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_rateest: streamline case display of units

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: check for negative numbers in xtables_strtou*

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_quota: make sure uint64 is not truncated

The xtables_strtoul() would cram a long long into a long.
The parse_int would try to cram a UINT64 into a long.

libxt_quota: readd missing XTOPT_PUT request

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libipt_REDIRECT: "--to-ports" is not mandatory

The REDIRECT target can be called without the --to-ports option
being specified. From the manual page:
  ...without this, the destination port is never altered.

Signed-off-by: Lutz Jaenicke <ljaenicke@innominate.com>
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: retract _NE types and use a flag instead

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libip6t_rt: rt-0-not-strict should take no arg

This unfortunately got mixed up during the getopt -> guided parser
move.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_conntrack: resolve erroneous rev-2 port range message

  --ctorigdstport 13
ip6tables-restore v1.4.10: conntrack rev 2 does not support port ranges

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_conntrack: fix assignment to wrong member

Of course the range end ought to be set, not doing the start value
twice.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_conntrack: correct printed module name

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libipt_[SD]NAT: avoid false error about multiple destinations specified

iptables-restore v1.4.10: DNAT: Multiple --to-destination not supported

xtables_option_parse sets cb->xflags already, so that it cannot be
directly used to test whether an option is being used for the second
time. Thus use a private option/flag (X_TO_DEST/SRC) that is not under
the control of xtables_option_parse.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libipt_[SD]NAT: flag up module name on error

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: collapse double protocol parsing

Un-dent xtables_parse_protocol, and make xtopt_parse_protocol make use
of it.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_policy: use XTTYPE_PROTOCOL type

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: avoid running into .also checks when option not used

If a particular option was not specified, it should not be subject to
.also checks in xtables_option_fcheck2 either.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_policy: option table fixes, improved error tracking

Most of the flags are multi-use in this extension. Also transfer
--next => --strict requirement to option table.

Furthermore, augment the error messages emitted from fcheck to contain
the policy element number, and elaborate on what an "empty policy
element" is.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

src: combine default_command functions

src: replace old IP*T_ALIGN macros

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

Merge branch 'floating/opts' of git://dev.medozas.de/iptables

Merge branch 'opts' of git://dev.medozas.de/iptables

Merge branch 'master' of git://dev.medozas.de/iptables

Merge branch 'opts' of git://dev.medozas.de/iptables

libipt_SAME: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libipt_REDIRECT: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libipt_MASQUERADE: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libipt_SNAT: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libipt_DNAT: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_iprange: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libipt_CLUSTERIP: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_mac: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: XTTYPE_ETHERMAC support

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libip6t_rt: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libip6t_mh: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_conntrack: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

doc: S/DNAT allows to omit IP addresses

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

iptables: fix the dead loop when meeting unknown options

Signed-off-by: Changli Gao <xiaosuo@gmail.com>

Merge branch 'opts' of git://dev.medozas.de/iptables

libxt_ipvs: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: XTTYPE_PROTOCOL support

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_limit: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libipt_NETMAP: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_multiport: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_osf: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_owner: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_policy: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: XTTYPE_HOSTMASK support

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_hashlimit: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: XTTYPE_PLEN support

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: flag invalid uses of XTOPT_PUT

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: do not overlay addr and mask parts, and cleanup

XTTYPE_HOSTMASK will require that what has now become haddr,
hmask/hlen are not overlays of another. Thus relax the structure and
always set all members of the {haddr, hmask, hlen} triplet now for all
types that touch any of the members.

Add some more comments and clean out ONEHOST.

libxt_recent: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_connlimit: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: support for XTTYPE_PLENMASK

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_NFLOG: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_IDLETIMER: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_statistic: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: XTTYPE_DOUBLE support

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_statistic: increase precision on create and dump

Currently, libxt_statistic only dumps the probability with a
granularity of 1/1000000. Assuming only stuffed packets with 1440
bytes payload, this would match approximately every 1.341 GB, which is
pretty low for a high-volume router. Trying to match any larger
interval than that (e.g. 2 GB) will cause libxt_statistic to output
"--probability 0.000000", and when restored, will cause it to never
match again.

Bump the dump precision to what xt_statistic can really do, and adjust
the manpage to include a word about it.

Furthermore, employ explicit rounding when reading the argument from
the command line, because the previous implicit conversion would use
truncation, which is not very exact.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_statistic: streamline and document possible placement of negation

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

extensions: const annotations

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: output name of extension on rev detect failure

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_owner: remove ifdef IPT_COMM_OWNER

Ever since we keep a copy of the header files anyway, IPT_COMM_OWNER
is always available.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

extensions: remove bogus use of XT_GETOPT_TABLEEND

Commit v1.4.8-36-g32b8e61 added this end marker in a little too many
places: at non-getopt places. Fix that.

Also change the definition of XT_GETOPT_TABLEEND to reference a struct
getopt member by name so that this cannot happen again.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_u32: add missing call to xtables_option_parse

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: fix assignment in wrong offset (XTTYPE_UINT*RC)

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_tos: add inversion support back again

It was unfortunately removed during the option parser switch.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_dccp: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_udp: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: XTTYPE_PORTRC support

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

extensions: remove unused TOS code

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_tos: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_TOS: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

combine ip6?tables-multi into xtables-multi

Signed-off-by: Maciej Zenczykowski <maze@google.com>

Move common parts of libext{4,6}.a into libext.a

Signed-off-by: Maciej Zenczykowski <maze@google.com>

Add --ipv4/-4 and --ipv6/-6 support to ip6?tables{,-restore}.

This enables one to have a single configuration file for both ipv4 and ipv6
firewall rules.

Example:
  iptables-restore config
  ip6tables-restore config

Where the file 'config' contains:
  *filter
  :INPUT ACCEPT [0:0]
  :FORWARD ACCEPT [0:0]
  :OUTPUT ACCEPT [0:0]
  :ssh - [0:0]

  -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  -A INPUT -m state --state INVALID -j DROP
  -A INPUT -i lo -j ACCEPT
  -A INPUT -4 -p icmp -j ACCEPT
  -A INPUT -6 -p icmpv6 -j ACCEPT
  -A INPUT -p tcp --dport 22 -m state --state NEW -j ssh
  -A ssh -j ACCEPT

  COMMIT

Signed-off-by: Maciej Zenczykowski <maze@google.com>

Don't load ip6?_tables module when already loaded

Signed-off-by: Maciej Zenczykowski <maze@google.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>

Merge branch 'floating/opts' of git://dev.medozas.de/iptables

SET target revision 2 added

The new revision of the SET target supports the following new operations

- specifying the timeout value of the entry to be added
- flag to instruct the kernel that if the entry already
  exists then reset the timeout value to the specified one (or
  to the default from the set definition)

xtoptions: respect return value in xtables_getportbyname

If ret was negative, ntohs may make it positive, which is undesired.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_TEE: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

build: bump libxtables ABI version

Adding the x6_* members to struct xtables_{match,target} caused a
change requiring a bump.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libipt_ULOG: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxt_TPROXY: use guided option parser

I am starting with a simple module here that does not require a
final_check function.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: XTTYPE_PORT support

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: XTTYPE_ONEHOST support

The bonus of the POSIX socket API is that it is almost protocol-agnostic
and that there are ready-made functions to take over the gist of address
parsing and packing.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libip[6]t_LOG: use guided option parser

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

libxtables: XTTYPE_SYSLOGLEVEL support

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>