libip6t_NETMAP: Use xtables_ip6mask_to_cidr and get rid of libip6tc dependency

This patch changes the NETMAP target extension (IPv6 side) to use
the xtables_ip6mask_to_cidr available in libxtables.

As a side effect, we get rid of the libip6tc dependency.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Revert "build: resolve link failure for ip6t_NETMAP"

This reverts commit 68e77a26111ee6b8f10c735a76891a7de6d57ee6.

The use of libtool was introduced to resolve linking problems
in NETMAP (IPv6 version), but that resulted in RPATH problems
reported from distributors and warnings spotted by libtool at
linking stage.

Since (0ca548b libip6t_NETMAP: Use xtables_ip6mask_to_cidr and
get rid of libip6tc dependency) fixed the NETMAP issue, let's
roll back to our previous stage.

A small conflicts in extensions/GNUmakefile.in has been resolved
in this revert.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
ip[6]tables: show --protocol instead of --proto in usage

As the man page shows --protocol not --proto, also do so in the usage
text displayed by ip[6]tables -h.

Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
libxt_osf: fix missing --ttl and --log in save output

closes http://bugzilla.netfilter.org/show_bug.cgi?id=805

Reported-by: Bourne Without <blackhole@airpost.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
libxt_osf: fix bad location for location in --genre

closes http://bugzilla.netfilter.org/show_bug.cgi?id=805

Reported-by: Bourne Without <blackhole@airpost.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
libip6t_SNPT: add manpage

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
libip6t_DNPT: add manpage

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: add libxt_bpf extension

Add user-space code to support the new BPF iptables extension.

Pablo has mangled the original patch to:

* include a copy of include/linux/netfilter/xt_bpf.h in the tree.
* I have also remove the --bytecode-file option. The original
  proposal was to accept BPF code in a file in human readable
  format. Now, with the nfbpf_compile utility, it's very easy
  to generate the filter using tcpdump-like syntax.
* I have remove the trailing comma in the backtick format, the
  parser works just fine for me here.
* Fix error message if --bytecode is missing.

Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
utils: nfbpf_compile

A BPF compiler to convert tcpdump expressions to the decimal format
accepted by the libxt_bpf.

Generate a file and pass that to iptables:

  nfbpf_compile RAW 'udp dst port 9000' > test.bpf
  iptables -A OUTPUT -m bpf --bytecode-file test.bpf -j LOG

Or pass the output directly to iptables using backticks:

  iptables -A INPUT -m bpf --bytecode \
      "`./nfbpf_compile RAW 'udp dst port 9000'" -j LOG

This utility depends on libpcap. The library is only compiled if the option
--enable-bpf-compiler is explicitly passed to ./configure and libpcap is
found.

Pablo has mangled the original patch to rename the utility to
nfbpf_compile. Also modified the output to match exactly what
-m bpf --bytecode needs.

Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>