libxtables: general follow-up cleanup

Kill program_name, program_version and xtables_program_name.

Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
libiptc: make library available as a shared library

Tested-by: Jesper Dangaard Brouer <hawk@comx.dk>
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
build: trigger reconfigure when extensions/GNUmakefile.in changes

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
doc: do not put IPv4 doc into ip6tables.8

Reference: http://bugs.debian.org/515752
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
libxt_policy: cannot set spi/reqid numbers higher than 0x7fffffff

http://bugzilla.netfilter.org/show_bug.cgi?id=577

When using the -m policy match, the option argument for --spi is converted
using strtol(), which returns a signed 32 bit value, so the highest
positive value is 0x7fffffff. Instead strtoul() should be used.
The same applies for the --reqid option argument.

Signed-off-by: Patrick McHardy <kaber@trash.net>
doc: resynchronize manpage with in-code help

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
libxtables: inline and remove unused OPTION_OFFSET macro

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
libxtables: prefix exit_error to xtables_error

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
extensions: remove unwanted/add needed includes for IPv6 exts

Most touched files do not use anything from ip6_tables.h, so
remove that #include. multiport instead, does need it (ip6t_entry).

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
extensions: remove unwanted/add needed includes for IPv4 exts

Most touched files do not use anything from ip_tables.h, so
remove that #include. multiport instead, does need it (ipt_entry).

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
libxt_policy: use bounded strtoui

reqid and SPI can only have a value in the range 0..UINT32_MAX, not
the entire range of the "long" type. Also throw an error if the
incoming string does not look like a pure number.

"Replaces" commit 6db2ded2f22a7e78743c86af523b8430876582e9.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
include: resynchronize headers with 2.6.29-rc5

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
extensions: add missing limits.h include

Thanks to Stephen Hemminger for noticing.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
iptables: Add limits.h to get INT_MIN, INT_MAX, ...

Fix build failure of iptables utilities on debian/ubuntu, maybe other distros.
The values INT_MIN and INT_MAX are used by many filters and these
are defined in limits.h
---
  patch against current iptables.git

Signed-off-by: Patrick McHardy <kaber@trash.net>
string: fix wrong pattern length calculation

This fixes a problem introduced in 37b4bde745698bf140d74e59a2561f34deeb8726
that leads to the wrong calculation of the pattern length in the
string match.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: fix broken options-merging during libxtables rework

This patch fixes options-merging that was broken somewhere
during the libxtables rework. Before this patch, two pointers
were used to keep the current options, however, the options field
in xt_params was not appropritely updated. Thus, xtables_free_opts()
was not restoring the original options.

This patch fixes iptables-restore and ip6tables-restore that
stopped working in my personal firewall.

% iptables-restore
*filter
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables-restore v1.4.3-rc1: Unknown arg `ESTABLISHED,RELATED'
Error occurred at line: 4
Try `iptables-restore -h' or 'iptables-restore --help' for more information.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: turn deprecation warning into enforcing mode

The deprecation warning was added 7 months ago in v1.4.2-rc1-13-g1eada72
with a warning "next release". Next release is coming up, so enforce it.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Merge commit 'nf/master'
libxt_connbytes: minor manpage adustments

Use explicit paragraph separator and conntrack(8).

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
libxt_connbytes: document nf_ct_acct behavior

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>