Revert "iptables-restore: move code to add_param_to_argv, cleanup (fix gcc-4.7)"

This reverts commit 44191bdbd71e685fba9eab864b9df25e63905220.

Apply instead a patch that really clarifies the bug in iptables-restore.
This should be good for the record (specifically, for distributors so
they can find the fix by googling).
iptables-restore: fix parameter parsing (shows up with gcc-4.7)

This patch fixes parameter parsing in iptables-restore since time ago. The
problem has shown up with gcc-4.7. This version of gcc seem to perform more
agressive memory management than previous.

Peter Lekensteyn provided the following sample code similar to the one
in iptables-restore:

int i = 0;

for (;;) {
	char x[5];

	x[i] = '0' + i;
	if (++i == 4) {
		x[i] = '\0'; /* terminate string with null byte */
		printf("%s\n", x);
		break;
	}
}

Many may expect 0123 as output. But GCC 4.7 does not do that when compiling
with optimization enabled (-O1 and higher). It instead puts random data in the
first bytes of the character array, which becomes:

| 0  |  1  |  2  |  3  |  4   |
|     RANDOM     | '3' | '\0' |

Since the array is declared inside the scope of loop's body, you can think of
it as of a new array being allocated in the automatic storage area for each
loop iteration.

The correct code should be:

char x[5];

for (;;) {
	x[i] = '0' + i;
	if (++i == 4) {
		x[i] = '\0'; /* terminate string with null byte */
		printf("%s\n", x);
		break;
	}
}

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
libxt_recent: add --mask netmask

This new option will be available in the Linux kernel 3.5

[ Pablo fixed coding-style issues and cleaned up this. Added
  manpages as well ]

Signed-off-by: Denys Fedoryshchenko <denys@visp.net.lb>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
bump version to 1.4.15

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables-restore: warn about -t in rule lines

save-restore syntax uses *table, not -t table.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
doc: grammatical updates to libxt_SET

Cherry-picked these from recent patches from Mr Dash Four.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_u32: do bounds checking for @'s operands

Using only strtoul is prone to accept all values, including negative
ones which are not explicitly allowed. Therefore, use xtables_strtoui
with bounds checking.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_devgroup: consolidate devgroup specification parsing

This is a small cleanup, reducing the two copies of X/Y parsing to
one.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_devgroup: guard against negative numbers

More corrections of the strtoul kind.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_LED: guard against negative numbers

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_*limit: avoid division by zero

It was possible to specify -A mychain -m hashlimit --hashlimit
600059/minute; this would convert to r->avg=0, which subsequently
causes a division by zero when printing with -S mychain.

1. Avoid division by zero in print_rate by printing infinity
   instead.
2. Rewrite the test in parse_rate to properly reject too high rates.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
include: add missing linux/netfilter_ipv4/ip_queue.h

This patch fixes compilation of libipq with headers from Linux
kernel 3.5:

 In file included from libipq.c:34:0:
 ../include/libipq/libipq.h:33:43: fatal error: linux/netfilter_ipv4/ip_queue.h: No such file or directory

ip_queue is gone since Linux kernel 3.5. However, you can still use
new iptables versions with old Linux kernels. We have to keep libipq
in this tree for a while (1.5-2 years should be OK).

Reported-by: Arkadiusz Miśkiewicz <arekm@maven.pl>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
ip[6]tables-restore: cleanup to reduce one level of indentation

This patch moves the parameter parsing to one function to reduce
one level of indentation. Jan Engelhardt likes this.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>