iptables-restore: warn about -t in rule lines

save-restore syntax uses *table, not -t table.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
doc: grammatical updates to libxt_SET

Cherry-picked these from recent patches from Mr Dash Four.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_u32: do bounds checking for @'s operands

Using only strtoul is prone to accept all values, including negative
ones which are not explicitly allowed. Therefore, use xtables_strtoui
with bounds checking.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_devgroup: consolidate devgroup specification parsing

This is a small cleanup, reducing the two copies of X/Y parsing to
one.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_devgroup: guard against negative numbers

More corrections of the strtoul kind.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_LED: guard against negative numbers

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_*limit: avoid division by zero

It was possible to specify -A mychain -m hashlimit --hashlimit
600059/minute; this would convert to r->avg=0, which subsequently
causes a division by zero when printing with -S mychain.

1. Avoid division by zero in print_rate by printing infinity
   instead.
2. Rewrite the test in parse_rate to properly reject too high rates.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
include: add missing linux/netfilter_ipv4/ip_queue.h

This patch fixes compilation of libipq with headers from Linux
kernel 3.5:

 In file included from libipq.c:34:0:
 ../include/libipq/libipq.h:33:43: fatal error: linux/netfilter_ipv4/ip_queue.h: No such file or directory

ip_queue is gone since Linux kernel 3.5. However, you can still use
new iptables versions with old Linux kernels. We have to keep libipq
in this tree for a while (1.5-2 years should be OK).

Reported-by: Arkadiusz Miśkiewicz <arekm@maven.pl>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
ip[6]tables-restore: cleanup to reduce one level of indentation

This patch moves the parameter parsing to one function to reduce
one level of indentation. Jan Engelhardt likes this.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Merge remote-tracking branch 'nf/stable'
libip6t_frag: match any frag id by default

If no --fragid option is given, the frag extension only matches
fragments with a zero-valued "Identification" field. This behavior
deviates from what other extensions do (they match all values in this
case) and is unexpected, and therefore changed by this patch.

Additionally, --fragid 0:4294967295 leads to no output on `iptables
-S` because part of the code thinks that this would be the default,
when it is not.

So, default to match all frag values, such that iptables -S not
outputting anything also becomes correct.

Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_tcp: print space before, not after "flags:"

tcp dpt:10flags: 0x17/0x02
         ^^

Signed-off-by: Andreas Schwab <schwab@linux-m68k.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
build: support for automake-1.12

automake-1.12 wants that AM_PROG_AR be used when LT_INIT is.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
build: separate AC variable replacements from xtables.h

It was/is a bit annoying that modifying xtables.h.in causes configure
to rerun. Split the @foo@ things into a separate file to bypass this.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
iptables: fix wrong error messages

iptables -P INPUT
iptables v1.4.15: -X requires a chain and a policy
Try `iptables -h' or 'iptables --help' for more information.

Note that it says -X when we have used -P.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: libxt_addrtype: fix type in help message

 --limit-iface-out          Match only on the packet's incoming device

Note that it says "incoming" when it should say "outcoming"

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
build: have `make clean` remove dep files too

While changing branches, one can hit errors like:

make[2]: ***   CC       libipt_CLUSTERIP.oo
No hay ninguna regla para construir el objetivo
`../include/net/netfilter/nf_nat.h', necesario para
`libipt_DNAT.oo'. Alto.

Pablo thinks dep files should be removed on `make clean`, and I
concur. (JFI, Note that native automake would not clear its ".deps"
directory.) Keep the "distclean: clean" line to keep invocations by
automake from the parent directory working.

Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
New set match revision with --return-nomatch flag support
libxtables: consolidate preference logic

Alias support will require testing for more conditions, so move the
revision comparison code into a separate function where it can be
shared between matches and targets.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
iptables: support for target aliases

This patch allows for target names listed on the command line to be
rewritten to new names and revisions.

As before, we will pick a revision that is supported by the kernel - now
including real_name in the search. This gives us the possibility to test
for many action names.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>