diff options
Diffstat (limited to 'package/network/utils/iptables/patches')
17 files changed, 2138 insertions, 0 deletions
diff --git a/package/network/utils/iptables/patches/.svn/entries b/package/network/utils/iptables/patches/.svn/entries new file mode 100644 index 0000000..7dfa7cd --- /dev/null +++ b/package/network/utils/iptables/patches/.svn/entries @@ -0,0 +1,300 @@ +10 + +dir +36060 +svn://svn.openwrt.org/openwrt/trunk/package/network/utils/iptables/patches +svn://svn.openwrt.org/openwrt + + + +2013-03-06T17:05:34.161606Z +35896 +cyrus + + + + + + + + + + + + + + +3c298f89-4303-0410-b956-a3cf2f4a3e73 + +100-bash-location.patch +file + + + + +2013-03-17T12:13:16.000000Z +20d2f34d73c618e3d8d29d291f5a202f +2013-03-06T17:05:34.161606Z +35896 +cyrus + + + + + + + + + + + + + + + + + + + + + +177 + +002-layer7_2.22.patch +file + + + + +2013-03-17T12:13:16.000000Z +3d064b3eae52b3e6d3bc25ad1265ccde +2010-12-19T11:16:46.024141Z +24719 +jow + + + + + + + + + + + + + + + + + + + + + +9821 + +200-configurable_builtin.patch +file + + + + +2013-03-17T12:13:16.000000Z +08d618081686e688ed020e9eddb60a23 +2013-03-06T17:05:34.161606Z +35896 +cyrus + + + + + + + + + + + + + + + + + + + + + +2854 + +020-iptables-disable-modprobe.patch +file + + + + +2013-03-17T12:13:16.000000Z +91d944bf4a7839cc813caa21394b7ce3 +2013-03-06T17:05:34.161606Z +35896 +cyrus + + + + + + + + + + + + + + + + + + + + + +409 + +030-no-libnfnetlink.patch +file + + + + +2013-03-17T12:13:16.000000Z +102f2220f30695d3ad8e8d227dd110e0 +2013-03-06T17:05:34.161606Z +35896 +cyrus + + + + + + + + + + + + + + + + + + + + + +3267 + +300-musl_fixes.patch +file + + + + +2013-03-17T12:13:16.000000Z +6e388903e4e73c20f7134df4e3ff3fcd +2013-03-06T17:05:34.161606Z +35896 +cyrus + + + + + + + + + + + + + + + + + + + + + +3001 + +010-use-old-linking.patch +file + + + + +2013-03-17T12:13:16.000000Z +42c805097559addafb45a3a713b23d3e +2013-03-06T17:05:34.161606Z +35896 +cyrus + + + + + + + + + + + + + + + + + + + + + +1973 + +400-lenient-restore.patch +file + + + + +2013-03-17T12:13:16.000000Z +860aad2ebe209f4f1e6dc4eb6db6131c +2013-03-06T17:05:34.161606Z +35896 +cyrus + + + + + + + + + + + + + + + + + + + + + +4867 + diff --git a/package/network/utils/iptables/patches/.svn/text-base/002-layer7_2.22.patch.svn-base b/package/network/utils/iptables/patches/.svn/text-base/002-layer7_2.22.patch.svn-base new file mode 100644 index 0000000..ba4531e --- /dev/null +++ b/package/network/utils/iptables/patches/.svn/text-base/002-layer7_2.22.patch.svn-base @@ -0,0 +1,371 @@ +--- /dev/null ++++ b/extensions/libxt_layer7.c +@@ -0,0 +1,368 @@ ++/* ++ Shared library add-on to iptables for layer 7 matching support. ++ ++ By Matthew Strait <quadong@users.sf.net>, Oct 2003-Aug 2008. ++ ++ http://l7-filter.sf.net ++ ++ This program is free software; you can redistribute it and/or ++ modify it under the terms of the GNU General Public License ++ as published by the Free Software Foundation; either version ++ 2 of the License, or (at your option) any later version. ++ http://www.gnu.org/licenses/gpl.txt ++*/ ++ ++#define _GNU_SOURCE ++#include <stdio.h> ++#include <netdb.h> ++#include <string.h> ++#include <stdlib.h> ++#include <getopt.h> ++#include <ctype.h> ++#include <dirent.h> ++ ++#include <xtables.h> ++#include <linux/netfilter/xt_layer7.h> ++ ++#define MAX_FN_LEN 256 ++ ++static char l7dir[MAX_FN_LEN] = "\0"; ++ ++/* Function which prints out usage message. */ ++static void help(void) ++{ ++ printf( ++ "layer7 match options:\n" ++ " --l7dir <directory> : Look for patterns here instead of /etc/l7-protocols/\n" ++ " (--l7dir must be specified before --l7proto if used)\n" ++ "[!] --l7proto <name>: Match named protocol using /etc/l7-protocols/.../name.pat\n"); ++} ++ ++static const struct option opts[] = { ++ { .name = "l7proto", .has_arg = 1, .val = 'p' }, ++ { .name = "l7dir", .has_arg = 1, .val = 'd' }, ++ { .name = NULL } ++}; ++ ++/* reads filename, puts protocol info into layer7_protocol_info, number of protocols to numprotos */ ++static int parse_protocol_file(char * filename, const char * protoname, struct xt_layer7_info *info) ++{ ++ FILE * f; ++ char * line = NULL; ++ size_t len = 0; ++ ++ enum { protocol, pattern, done } datatype = protocol; ++ ++ f = fopen(filename, "r"); ++ ++ if(!f) ++ return 0; ++ ++ while(getline(&line, &len, f) != -1) ++ { ++ if(strlen(line) < 2 || line[0] == '#') ++ continue; ++ ++ /* strip the pesky newline... */ ++ if(line[strlen(line) - 1] == '\n') ++ line[strlen(line) - 1] = '\0'; ++ ++ if(datatype == protocol) ++ { ++ /* Ignore everything on the line beginning with the ++ first space or tab . For instance, this allows the ++ protocol line in http.pat to be "http " (or ++ "http I am so cool") instead of just "http". */ ++ if(strchr(line, ' ')){ ++ char * space = strchr(line, ' '); ++ space[0] = '\0'; ++ } ++ if(strchr(line, '\t')){ ++ char * space = strchr(line, '\t'); ++ space[0] = '\0'; ++ } ++ ++ /* sanity check. First non-comment non-blank ++ line must be the same as the file name. */ ++ if(strcmp(line, protoname)) ++ xtables_error(OTHER_PROBLEM, ++ "Protocol name (%s) doesn't match file name (%s). Bailing out\n", ++ line, filename); ++ ++ if(strlen(line) >= MAX_PROTOCOL_LEN) ++ xtables_error(PARAMETER_PROBLEM, ++ "Protocol name in %s too long!", filename); ++ strncpy(info->protocol, line, MAX_PROTOCOL_LEN); ++ ++ datatype = pattern; ++ } ++ else if(datatype == pattern) ++ { ++ if(strlen(line) >= MAX_PATTERN_LEN) ++ xtables_error(PARAMETER_PROBLEM, "Pattern in %s too long!", filename); ++ strncpy(info->pattern, line, MAX_PATTERN_LEN); ++ ++ datatype = done; ++ break; ++ } ++ else ++ xtables_error(OTHER_PROBLEM, "Internal error"); ++ } ++ ++ if(datatype != done) ++ xtables_error(OTHER_PROBLEM, "Failed to get all needed data from %s", filename); ++ ++ if(line) free(line); ++ fclose(f); ++ ++ return 1; ++} ++ ++static int hex2dec(char c) ++{ ++ switch (c) ++ { ++ case '0' ... '9': ++ return c - '0'; ++ case 'a' ... 'f': ++ return c - 'a' + 10; ++ case 'A' ... 'F': ++ return c - 'A' + 10; ++ default: ++ xtables_error(OTHER_PROBLEM, "hex2dec: bad value!\n"); ++ return 0; ++ } ++} ++ ++/* takes a string with \xHH escapes and returns one with the characters ++they stand for */ ++static char * pre_process(char * s) ++{ ++ char * result = malloc(strlen(s) + 1); ++ int sindex = 0, rrindex = 0; ++ while( sindex < strlen(s) ) ++ { ++ if( sindex + 3 < strlen(s) && ++ s[sindex] == '\\' && s[sindex+1] == 'x' && ++ isxdigit(s[sindex + 2]) && isxdigit(s[sindex + 3]) ) ++ { ++ /* carefully remember to call tolower here... */ ++ result[rrindex] = tolower( hex2dec(s[sindex + 2])*16 + ++ hex2dec(s[sindex + 3] ) ); ++ ++ switch ( result[rrindex] ) ++ { ++ case 0x24: ++ case 0x28: ++ case 0x29: ++ case 0x2a: ++ case 0x2b: ++ case 0x2e: ++ case 0x3f: ++ case 0x5b: ++ case 0x5c: ++ case 0x5d: ++ case 0x5e: ++ case 0x7c: ++ fprintf(stderr, ++ "Warning: layer7 regexp contains a control character, %c, in hex (\\x%c%c).\n" ++ "I recommend that you write this as %c or \\%c, depending on what you meant.\n", ++ result[rrindex], s[sindex + 2], s[sindex + 3], result[rrindex], result[rrindex]); ++ break; ++ case 0x00: ++ fprintf(stderr, ++ "Warning: null (\\x00) in layer7 regexp. A null terminates the regexp string!\n"); ++ break; ++ default: ++ break; ++ } ++ ++ ++ sindex += 3; /* 4 total */ ++ } ++ else ++ result[rrindex] = tolower(s[sindex]); ++ ++ sindex++; ++ rrindex++; ++ } ++ result[rrindex] = '\0'; ++ ++ return result; ++} ++ ++#define MAX_SUBDIRS 128 ++static char ** readl7dir(char * dirname) ++{ ++ DIR * scratchdir; ++ struct dirent ** namelist; ++ char ** subdirs = malloc(MAX_SUBDIRS * sizeof(char *)); ++ ++ int n, d = 1; ++ subdirs[0] = ""; ++ ++ n = scandir(dirname, &namelist, 0, alphasort); ++ ++ if (n < 0) ++ { ++ perror("scandir"); ++ xtables_error(OTHER_PROBLEM, "Couldn't open %s\n", dirname); ++ } ++ else ++ { ++ while(n--) ++ { ++ char fulldirname[MAX_FN_LEN]; ++ ++ snprintf(fulldirname, MAX_FN_LEN, "%s/%s", dirname, namelist[n]->d_name); ++ ++ if((scratchdir = opendir(fulldirname)) != NULL) ++ { ++ closedir(scratchdir); ++ ++ if(!strcmp(namelist[n]->d_name, ".") || ++ !strcmp(namelist[n]->d_name, "..")) ++ /* do nothing */ ; ++ else ++ { ++ subdirs[d] = malloc(strlen(namelist[n]->d_name) + 1); ++ strcpy(subdirs[d], namelist[n]->d_name); ++ d++; ++ if(d >= MAX_SUBDIRS - 1) ++ { ++ fprintf(stderr, ++ "Too many subdirectories, skipping the rest!\n"); ++ break; ++ } ++ } ++ } ++ free(namelist[n]); ++ } ++ free(namelist); ++ } ++ ++ subdirs[d] = NULL; ++ ++ return subdirs; ++} ++ ++static void parse_layer7_protocol(const char *s, struct xt_layer7_info *info) ++{ ++ char filename[MAX_FN_LEN]; ++ char * dir = NULL; ++ char ** subdirs; ++ int n = 0, done = 0; ++ ++ if(strlen(l7dir) > 0) dir = l7dir; ++ else dir = "/etc/l7-protocols"; ++ ++ subdirs = readl7dir(dir); ++ ++ while(subdirs[n] != NULL) ++ { ++ int c = snprintf(filename, MAX_FN_LEN, "%s/%s/%s.pat", dir, subdirs[n], s); ++ ++ if(c > MAX_FN_LEN) ++ xtables_error(OTHER_PROBLEM, ++ "Filename beginning with %s is too long!\n", filename); ++ ++ /* read in the pattern from the file */ ++ if(parse_protocol_file(filename, s, info)){ ++ done = 1; ++ break; ++ } ++ ++ n++; ++ } ++ ++ if(!done) ++ xtables_error(OTHER_PROBLEM, ++ "Couldn't find a pattern definition file for %s.\n", s); ++ ++ /* process \xHH escapes and tolower everything. (our regex lib has no ++ case insensitivity option.) */ ++ strncpy(info->pattern, pre_process(info->pattern), MAX_PATTERN_LEN); ++} ++ ++/* Function which parses command options; returns true if it ate an option */ ++static int parse(int c, char **argv, int invert, unsigned int *flags, ++ const void *entry, struct xt_entry_match **match) ++{ ++ struct xt_layer7_info *layer7info = ++ (struct xt_layer7_info *)(*match)->data; ++ ++ switch (c) { ++ case 'p': ++ parse_layer7_protocol(argv[optind-1], layer7info); ++ if (invert) ++ layer7info->invert = true; ++ *flags = 1; ++ break; ++ ++ case 'd': ++ if(strlen(argv[optind-1]) >= MAX_FN_LEN) ++ xtables_error(PARAMETER_PROBLEM, "directory name too long\n"); ++ ++ strncpy(l7dir, argv[optind-1], MAX_FN_LEN); ++ ++ *flags = 1; ++ break; ++ ++ default: ++ return 0; ++ } ++ ++ return 1; ++} ++ ++/* Final check; must have specified --l7proto */ ++static void final_check(unsigned int flags) ++{ ++ if (!flags) ++ xtables_error(PARAMETER_PROBLEM, ++ "LAYER7 match: You must specify `--l7proto'"); ++} ++ ++static void print_protocol(char s[], int invert, int numeric) ++{ ++ fputs("l7proto ", stdout); ++ if (invert) fputc('!', stdout); ++ printf("%s ", s); ++} ++ ++/* Prints out the matchinfo. */ ++static void print(const void *ip, ++ const struct xt_entry_match *match, ++ int numeric) ++{ ++ printf("LAYER7 "); ++ print_protocol(((struct xt_layer7_info *)match->data)->protocol, ++ ((struct xt_layer7_info *)match->data)->invert, numeric); ++} ++/* Saves the union ipt_matchinfo in parsable form to stdout. */ ++static void save(const void *ip, const struct xt_entry_match *match) ++{ ++ const struct xt_layer7_info *info = ++ (const struct xt_layer7_info*) match->data; ++ ++ printf("--l7proto %s%s ", (info->invert)? "! ":"", info->protocol); ++} ++ ++static struct xtables_match layer7 = { ++ .family = AF_INET, ++ .name = "layer7", ++ .version = XTABLES_VERSION, ++ .size = XT_ALIGN(sizeof(struct xt_layer7_info)), ++ .userspacesize = XT_ALIGN(sizeof(struct xt_layer7_info)), ++ .help = &help, ++ .parse = &parse, ++ .final_check = &final_check, ++ .print = &print, ++ .save = &save, ++ .extra_opts = opts ++}; ++ ++void _init(void) ++{ ++ xtables_register_match(&layer7); ++} diff --git a/package/network/utils/iptables/patches/.svn/text-base/010-use-old-linking.patch.svn-base b/package/network/utils/iptables/patches/.svn/text-base/010-use-old-linking.patch.svn-base new file mode 100644 index 0000000..a848e1e --- /dev/null +++ b/package/network/utils/iptables/patches/.svn/text-base/010-use-old-linking.patch.svn-base @@ -0,0 +1,51 @@ +Index: iptables-1.4.18/extensions/GNUmakefile.in +=================================================================== +--- iptables-1.4.18.orig/extensions/GNUmakefile.in 2013-03-03 22:40:11.000000000 +0100 ++++ iptables-1.4.18/extensions/GNUmakefile.in 2013-03-06 17:13:04.074584735 +0100 +@@ -33,7 +33,6 @@ + AM_VERBOSE_CXXLD = @echo " CXXLD " $@; + AM_VERBOSE_AR = @echo " AR " $@; + AM_VERBOSE_GEN = @echo " GEN " $@; +-AM_VERBOSE_NULL = @ + endif + + # +@@ -76,7 +75,7 @@ + if test -n "${targets_install}"; then install -pm0755 $^ "${DESTDIR}${xtlibdir}/"; fi; + + clean: +- rm -f *.la *.o *.lo *.so *.a {matches,targets}.man initext.c initext4.c initext6.c; ++ rm -f *.o *.oo *.so *.a {matches,targets}.man initext.c initext4.c initext6.c; + rm -f .*.d .*.dd; + + distclean: clean +@@ -90,22 +89,19 @@ + # + # Shared libraries + # +-lib%.so: lib%.la +- ${AM_VERBOSE_NULL} ln -fs .libs/$@ $@ ++lib%.so: lib%.oo ++ ${AM_VERBOSE_CCLD} ${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $< -L../libxtables/.libs -L../libiptc/.libs -lxtables ${$*_LIBADD}; + +-lib%.la: lib%.lo +- ${AM_VERBOSE_CCLD} ../libtool ${AM_LIBTOOL_SILENT} --tag=CC --mode=link ${CCLD} ${AM_LDFLAGS} -module ${LDFLAGS} -o $@ $< ../libxtables/libxtables.la ${$*_LIBADD} -rpath ${xtlibdir} +- +-lib%.lo: ${srcdir}/lib%.c +- ${AM_VERBOSE_CC} ../libtool ${AM_LIBTOOL_SILENT} --tag=CC --mode=compile ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -D_INIT=lib$*_init ${CFLAGS} -o $@ -c $< ++lib%.oo: ${srcdir}/lib%.c ++ ${AM_VERBOSE_CC} ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -D_INIT=lib$*_init -DPIC -fPIC ${CFLAGS} -o $@ -c $<; + + libxt_NOTRACK.so: libxt_CT.so +- ${AM_VERBOSE_GEN} ln -fs $< $@ ++ ln -fs $< $@ + libxt_state.so: libxt_conntrack.so +- ${AM_VERBOSE_GEN} ln -fs $< $@ ++ ln -fs $< $@ + + # Need the LIBADDs in iptables/Makefile.am too for libxtables_la_LIBADD +-ip6t_NETMAP_LIBADD = ../libiptc/libip6tc.la ++ip6t_NETMAP_LIBADD = -lip6tc + xt_RATEEST_LIBADD = -lm + xt_statistic_LIBADD = -lm + diff --git a/package/network/utils/iptables/patches/.svn/text-base/020-iptables-disable-modprobe.patch.svn-base b/package/network/utils/iptables/patches/.svn/text-base/020-iptables-disable-modprobe.patch.svn-base new file mode 100644 index 0000000..ad4889b --- /dev/null +++ b/package/network/utils/iptables/patches/.svn/text-base/020-iptables-disable-modprobe.patch.svn-base @@ -0,0 +1,18 @@ +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -336,6 +336,7 @@ static char *get_modprobe(void) + + int xtables_insmod(const char *modname, const char *modprobe, bool quiet) + { ++#if 0 + char *buf = NULL; + char *argv[4]; + int status; +@@ -380,6 +381,7 @@ int xtables_insmod(const char *modname, + free(buf); + if (WIFEXITED(status) && WEXITSTATUS(status) == 0) + return 0; ++#endif + return -1; + } + diff --git a/package/network/utils/iptables/patches/.svn/text-base/030-no-libnfnetlink.patch.svn-base b/package/network/utils/iptables/patches/.svn/text-base/030-no-libnfnetlink.patch.svn-base new file mode 100644 index 0000000..f795291 --- /dev/null +++ b/package/network/utils/iptables/patches/.svn/text-base/030-no-libnfnetlink.patch.svn-base @@ -0,0 +1,94 @@ +--- a/configure ++++ b/configure +@@ -12173,77 +12173,7 @@ $as_echo "no" >&6; } + fi + fi + +-pkg_failed=no +-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libnfnetlink" >&5 +-$as_echo_n "checking for libnfnetlink... " >&6; } +- +-if test -n "$libnfnetlink_CFLAGS"; then +- pkg_cv_libnfnetlink_CFLAGS="$libnfnetlink_CFLAGS" +- elif test -n "$PKG_CONFIG"; then +- if test -n "$PKG_CONFIG" && \ +- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libnfnetlink >= 1.0\""; } >&5 +- ($PKG_CONFIG --exists --print-errors "libnfnetlink >= 1.0") 2>&5 +- ac_status=$? +- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 +- test $ac_status = 0; }; then +- pkg_cv_libnfnetlink_CFLAGS=`$PKG_CONFIG --cflags "libnfnetlink >= 1.0" 2>/dev/null` +- test "x$?" != "x0" && pkg_failed=yes +-else +- pkg_failed=yes +-fi +- else +- pkg_failed=untried +-fi +-if test -n "$libnfnetlink_LIBS"; then +- pkg_cv_libnfnetlink_LIBS="$libnfnetlink_LIBS" +- elif test -n "$PKG_CONFIG"; then +- if test -n "$PKG_CONFIG" && \ +- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libnfnetlink >= 1.0\""; } >&5 +- ($PKG_CONFIG --exists --print-errors "libnfnetlink >= 1.0") 2>&5 +- ac_status=$? +- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 +- test $ac_status = 0; }; then +- pkg_cv_libnfnetlink_LIBS=`$PKG_CONFIG --libs "libnfnetlink >= 1.0" 2>/dev/null` +- test "x$?" != "x0" && pkg_failed=yes +-else +- pkg_failed=yes +-fi +- else +- pkg_failed=untried +-fi +- +- +- +-if test $pkg_failed = yes; then +- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +-$as_echo "no" >&6; } +- +-if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then +- _pkg_short_errors_supported=yes +-else +- _pkg_short_errors_supported=no +-fi +- if test $_pkg_short_errors_supported = yes; then +- libnfnetlink_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libnfnetlink >= 1.0" 2>&1` +- else +- libnfnetlink_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libnfnetlink >= 1.0" 2>&1` +- fi +- # Put the nasty error message in config.log where it belongs +- echo "$libnfnetlink_PKG_ERRORS" >&5 +- +- nfnetlink=0 +-elif test $pkg_failed = untried; then +- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +-$as_echo "no" >&6; } +- nfnetlink=0 +-else +- libnfnetlink_CFLAGS=$pkg_cv_libnfnetlink_CFLAGS +- libnfnetlink_LIBS=$pkg_cv_libnfnetlink_LIBS +- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 +-$as_echo "yes" >&6; } +- nfnetlink=1 +-fi +- if test "$nfnetlink" = 1; then ++if false; then + HAVE_LIBNFNETLINK_TRUE= + HAVE_LIBNFNETLINK_FALSE='#' + else +--- a/configure.ac ++++ b/configure.ac +@@ -89,9 +89,7 @@ AM_CONDITIONAL([ENABLE_LARGEFILE], [test + AM_CONDITIONAL([ENABLE_DEVEL], [test "$enable_devel" = "yes"]) + AM_CONDITIONAL([ENABLE_LIBIPQ], [test "$enable_libipq" = "yes"]) + +-PKG_CHECK_MODULES([libnfnetlink], [libnfnetlink >= 1.0], +- [nfnetlink=1], [nfnetlink=0]) +-AM_CONDITIONAL([HAVE_LIBNFNETLINK], [test "$nfnetlink" = 1]) ++AM_CONDITIONAL([HAVE_LIBNFNETLINK], [false]) + + regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \ + -Wmissing-prototypes -Wredundant-decls -Wshadow -Wstrict-prototypes \ diff --git a/package/network/utils/iptables/patches/.svn/text-base/100-bash-location.patch.svn-base b/package/network/utils/iptables/patches/.svn/text-base/100-bash-location.patch.svn-base new file mode 100644 index 0000000..02ee45b --- /dev/null +++ b/package/network/utils/iptables/patches/.svn/text-base/100-bash-location.patch.svn-base @@ -0,0 +1,8 @@ +--- a/iptables/iptables-apply ++++ b/iptables/iptables-apply +@@ -1,4 +1,4 @@ +-#!/bin/bash ++#!/usr/bin/env bash + # + # iptables-apply -- a safer way to update iptables remotely + # diff --git a/package/network/utils/iptables/patches/.svn/text-base/200-configurable_builtin.patch.svn-base b/package/network/utils/iptables/patches/.svn/text-base/200-configurable_builtin.patch.svn-base new file mode 100644 index 0000000..8f095c1 --- /dev/null +++ b/package/network/utils/iptables/patches/.svn/text-base/200-configurable_builtin.patch.svn-base @@ -0,0 +1,62 @@ +Index: iptables-1.4.18/extensions/GNUmakefile.in +=================================================================== +--- iptables-1.4.18.orig/extensions/GNUmakefile.in 2013-03-03 22:40:11.000000000 +0100 ++++ iptables-1.4.18/extensions/GNUmakefile.in 2013-03-05 16:37:07.583256974 +0100 +@@ -46,9 +46,24 @@ + pfx_build_mod := $(filter-out @blacklist_modules@,${pfx_build_mod}) + pf4_build_mod := $(filter-out @blacklist_modules@,${pf4_build_mod}) + pf6_build_mod := $(filter-out @blacklist_modules@,${pf6_build_mod}) +-pfx_objs := $(patsubst %,libxt_%.o,${pfx_build_mod}) +-pf4_objs := $(patsubst %,libipt_%.o,${pf4_build_mod}) +-pf6_objs := $(patsubst %,libip6t_%.o,${pf6_build_mod}) ++ ++ifdef BUILTIN_MODULES ++pfx_build_static := $(filter $(BUILTIN_MODULES),${pfx_build_mod}) ++pf4_build_static := $(filter $(BUILTIN_MODULES),${pf4_build_mod}) ++pf6_build_static := $(filter $(BUILTIN_MODULES),${pf6_build_mod}) ++else ++@ENABLE_STATIC_TRUE@ pfx_build_static := $(pfx_build_mod) ++@ENABLE_STATIC_TRUE@ pf4_build_static := $(pf4_build_mod) ++@ENABLE_STATIC_TRUE@ pf6_build_static := $(pf6_build_mod) ++endif ++ ++pfx_build_mod := $(filter-out $(pfx_build_static),$(pfx_build_mod)) ++pf4_build_mod := $(filter-out $(pf4_build_static),$(pf4_build_mod)) ++pf6_build_mod := $(filter-out $(pf6_build_static),$(pf6_build_mod)) ++ ++pfx_objs := $(patsubst %,libxt_%.o,${pfx_build_static}) ++pf4_objs := $(patsubst %,libipt_%.o,${pf4_build_static}) ++pf6_objs := $(patsubst %,libip6t_%.o,${pf6_build_static}) + pfx_solibs := $(patsubst %,libxt_%.so,${pfx_build_mod} ${pfx_symlinks}) + pf4_solibs := $(patsubst %,libipt_%.so,${pf4_build_mod}) + pf6_solibs := $(patsubst %,libip6t_%.so,${pf6_build_mod}) +@@ -59,11 +74,11 @@ + # + targets := libext.a libext4.a libext6.a matches.man targets.man + targets_install := +-@ENABLE_STATIC_TRUE@ libext_objs := ${pfx_objs} +-@ENABLE_STATIC_TRUE@ libext4_objs := ${pf4_objs} +-@ENABLE_STATIC_TRUE@ libext6_objs := ${pf6_objs} +-@ENABLE_STATIC_FALSE@ targets += ${pfx_solibs} ${pf4_solibs} ${pf6_solibs} +-@ENABLE_STATIC_FALSE@ targets_install += ${pfx_solibs} ${pf4_solibs} ${pf6_solibs} ++libext_objs := ${pfx_objs} ++libext4_objs := ${pf4_objs} ++libext6_objs := ${pf6_objs} ++targets += ${pfx_solibs} ${pf4_solibs} ${pf6_solibs} ++targets_install := $(strip ${targets_install} ${pfx_solibs} ${pf4_solibs} ${pf6_solibs}) + + .SECONDARY: + +@@ -128,9 +143,9 @@ + libext6.a: initext6.o ${libext6_objs} + ${AM_VERBOSE_AR} ${AR} crs $@ $^; + +-initext_func := $(addprefix xt_,${pfx_build_mod}) +-initext4_func := $(addprefix ipt_,${pf4_build_mod}) +-initext6_func := $(addprefix ip6t_,${pf6_build_mod}) ++initext_func := $(addprefix xt_,${pfx_build_static}) ++initext4_func := $(addprefix ipt_,${pf4_build_static}) ++initext6_func := $(addprefix ip6t_,${pf6_build_static}) + + .initext.dd: FORCE + @echo "${initext_func}" >$@.tmp; \ diff --git a/package/network/utils/iptables/patches/.svn/text-base/300-musl_fixes.patch.svn-base b/package/network/utils/iptables/patches/.svn/text-base/300-musl_fixes.patch.svn-base new file mode 100644 index 0000000..039af7c --- /dev/null +++ b/package/network/utils/iptables/patches/.svn/text-base/300-musl_fixes.patch.svn-base @@ -0,0 +1,139 @@ +--- a/extensions/libip6t_ipv6header.c ++++ b/extensions/libip6t_ipv6header.c +@@ -10,6 +10,9 @@ on whether they contain certain headers + #include <netdb.h> + #include <xtables.h> + #include <linux/netfilter_ipv6/ip6t_ipv6header.h> ++#ifndef IPPROTO_HOPOPTS ++# define IPPROTO_HOPOPTS 0 ++#endif + + enum { + O_HEADER = 0, +--- a/extensions/libxt_TCPOPTSTRIP.c ++++ b/extensions/libxt_TCPOPTSTRIP.c +@@ -12,6 +12,21 @@ + #ifndef TCPOPT_MD5SIG + # define TCPOPT_MD5SIG 19 + #endif ++#ifndef TCPOPT_MAXSEG ++# define TCPOPT_MAXSEG 2 ++#endif ++#ifndef TCPOPT_WINDOW ++# define TCPOPT_WINDOW 3 ++#endif ++#ifndef TCPOPT_SACK_PERMITTED ++# define TCPOPT_SACK_PERMITTED 4 ++#endif ++#ifndef TCPOPT_SACK ++# define TCPOPT_SACK 5 ++#endif ++#ifndef TCPOPT_TIMESTAMP ++# define TCPOPT_TIMESTAMP 8 ++#endif + + enum { + O_STRIP_OPTION = 0, +--- a/include/libiptc/ipt_kernel_headers.h ++++ b/include/libiptc/ipt_kernel_headers.h +@@ -5,7 +5,6 @@ + + #include <limits.h> + +-#if defined(__GLIBC__) && __GLIBC__ == 2 + #include <netinet/ip.h> + #include <netinet/in.h> + #include <netinet/ip_icmp.h> +@@ -13,15 +12,4 @@ + #include <netinet/udp.h> + #include <net/if.h> + #include <sys/types.h> +-#else /* libc5 */ +-#include <sys/socket.h> +-#include <linux/ip.h> +-#include <linux/in.h> +-#include <linux/if.h> +-#include <linux/icmp.h> +-#include <linux/tcp.h> +-#include <linux/udp.h> +-#include <linux/types.h> +-#include <linux/in6.h> +-#endif + #endif +--- a/include/linux/netfilter/xt_osf.h ++++ b/include/linux/netfilter/xt_osf.h +@@ -21,6 +21,9 @@ + #define _XT_OSF_H + + #include <linux/types.h> ++#if !defined(__UCLIBC__) && !defined(__GLIBC__) ++#include <linux/tcp.h> ++#endif + + #define MAXGENRELEN 32 + +--- a/include/linux/netfilter_ipv4/ip_tables.h ++++ b/include/linux/netfilter_ipv4/ip_tables.h +@@ -16,6 +16,7 @@ + #define _IPTABLES_H + + #include <linux/types.h> ++#include <sys/types.h> + + #include <linux/netfilter_ipv4.h> + +--- a/iptables/ip6tables-restore.c ++++ b/iptables/ip6tables-restore.c +@@ -9,7 +9,7 @@ + */ + + #include <getopt.h> +-#include <sys/errno.h> ++#include <errno.h> + #include <stdbool.h> + #include <string.h> + #include <stdio.h> +--- a/iptables/ip6tables-save.c ++++ b/iptables/ip6tables-save.c +@@ -6,7 +6,7 @@ + * This code is distributed under the terms of GNU GPL v2 + */ + #include <getopt.h> +-#include <sys/errno.h> ++#include <errno.h> + #include <stdio.h> + #include <fcntl.h> + #include <stdlib.h> +--- a/iptables/iptables-restore.c ++++ b/iptables/iptables-restore.c +@@ -6,7 +6,7 @@ + */ + + #include <getopt.h> +-#include <sys/errno.h> ++#include <errno.h> + #include <stdbool.h> + #include <string.h> + #include <stdio.h> +--- a/iptables/iptables-save.c ++++ b/iptables/iptables-save.c +@@ -6,7 +6,7 @@ + * + */ + #include <getopt.h> +-#include <sys/errno.h> ++#include <errno.h> + #include <stdio.h> + #include <fcntl.h> + #include <stdlib.h> +--- a/iptables/iptables-xml.c ++++ b/iptables/iptables-xml.c +@@ -7,7 +7,7 @@ + */ + + #include <getopt.h> +-#include <sys/errno.h> ++#include <errno.h> + #include <string.h> + #include <stdio.h> + #include <stdlib.h> diff --git a/package/network/utils/iptables/patches/.svn/text-base/400-lenient-restore.patch.svn-base b/package/network/utils/iptables/patches/.svn/text-base/400-lenient-restore.patch.svn-base new file mode 100644 index 0000000..696d733 --- /dev/null +++ b/package/network/utils/iptables/patches/.svn/text-base/400-lenient-restore.patch.svn-base @@ -0,0 +1,176 @@ +Index: iptables-1.4.18/iptables/ip6tables-restore.c +=================================================================== +--- iptables-1.4.18.orig/iptables/ip6tables-restore.c 2013-03-05 16:37:31.000000000 +0100 ++++ iptables-1.4.18/iptables/ip6tables-restore.c 2013-03-05 16:42:57.475249794 +0100 +@@ -14,6 +14,8 @@ + #include <string.h> + #include <stdio.h> + #include <stdlib.h> ++#include <stdarg.h> ++#include <setjmp.h> + #include "ip6tables.h" + #include "xtables.h" + #include "libiptc/libip6tc.h" +@@ -25,6 +27,7 @@ + #define DEBUGP(x, args...) + #endif + ++static jmp_buf jmp; + static int binary = 0, counters = 0, verbose = 0, noflush = 0; + + /* Keeping track of external matches and targets. */ +@@ -35,6 +38,7 @@ + {.name = "test", .has_arg = false, .val = 't'}, + {.name = "help", .has_arg = false, .val = 'h'}, + {.name = "noflush", .has_arg = false, .val = 'n'}, ++ {.name = "lenient", .has_arg = false, .val = 'l'}, + {.name = "modprobe", .has_arg = true, .val = 'M'}, + {.name = "table", .has_arg = true, .val = 'T'}, + {NULL}, +@@ -51,6 +55,7 @@ + " [ --test ]\n" + " [ --help ]\n" + " [ --noflush ]\n" ++ " [ --lenient ]\n" + " [ --modprobe=<command>]\n", name); + + exit(1); +@@ -114,6 +119,17 @@ + free(newargv[i]); + } + ++static void catch_exit_error(enum xtables_exittype status, const char *msg, ...) ++{ ++ va_list args; ++ fprintf(stderr, "line %d: ", line); ++ va_start(args, msg); ++ vfprintf(stderr, msg, args); ++ va_end(args); ++ fprintf(stderr, "\n"); ++ longjmp(jmp, status); ++} ++ + static void add_param_to_argv(char *parsestart) + { + int quote_open = 0, escaped = 0, param_len = 0; +@@ -204,7 +220,7 @@ + init_extensions6(); + #endif + +- while ((c = getopt_long(argc, argv, "bcvthnM:T:", options, NULL)) != -1) { ++ while ((c = getopt_long(argc, argv, "bcvthnlM:T:", options, NULL)) != -1) { + switch (c) { + case 'b': + binary = 1; +@@ -225,6 +241,9 @@ + case 'n': + noflush = 1; + break; ++ case 'l': ++ ip6tables_globals.exit_err = catch_exit_error; ++ break; + case 'M': + xtables_modprobe_program = optarg; + break; +@@ -437,8 +456,11 @@ + for (a = 0; a < newargc; a++) + DEBUGP("argv[%u]: %s\n", a, newargv[a]); + +- ret = do_command6(newargc, newargv, +- &newargv[2], &handle); ++ if (!setjmp(jmp)) ++ ret = do_command6(newargc, newargv, ++ &newargv[2], &handle); ++ else ++ ret = 1; + + free_argv(); + fflush(stdout); +Index: iptables-1.4.18/iptables/iptables-restore.c +=================================================================== +--- iptables-1.4.18.orig/iptables/iptables-restore.c 2013-03-05 16:37:31.000000000 +0100 ++++ iptables-1.4.18/iptables/iptables-restore.c 2013-03-05 16:44:56.303247355 +0100 +@@ -11,6 +11,8 @@ + #include <string.h> + #include <stdio.h> + #include <stdlib.h> ++#include <stdarg.h> ++#include <setjmp.h> + #include "iptables.h" + #include "xtables.h" + #include "libiptc/libiptc.h" +@@ -22,6 +24,7 @@ + #define DEBUGP(x, args...) + #endif + ++static jmp_buf jmp; + static int binary = 0, counters = 0, verbose = 0, noflush = 0; + + /* Keeping track of external matches and targets. */ +@@ -32,6 +35,7 @@ + {.name = "test", .has_arg = false, .val = 't'}, + {.name = "help", .has_arg = false, .val = 'h'}, + {.name = "noflush", .has_arg = false, .val = 'n'}, ++ {.name = "lenient", .has_arg = false, .val = 'l'}, + {.name = "modprobe", .has_arg = true, .val = 'M'}, + {.name = "table", .has_arg = true, .val = 'T'}, + {NULL}, +@@ -50,6 +54,7 @@ + " [ --test ]\n" + " [ --help ]\n" + " [ --noflush ]\n" ++ " [ --lenient ]\n" + " [ --table=<TABLE> ]\n" + " [ --modprobe=<command>]\n", name); + +@@ -113,6 +118,17 @@ + free(newargv[i]); + } + ++static void catch_exit_error(enum xtables_exittype status, const char *msg, ...) ++{ ++ va_list args; ++ fprintf(stderr, "line %d: ", line); ++ va_start(args, msg); ++ vfprintf(stderr, msg, args); ++ va_end(args); ++ fprintf(stderr, "\n"); ++ longjmp(jmp, status); ++} ++ + static void add_param_to_argv(char *parsestart) + { + int quote_open = 0, escaped = 0, param_len = 0; +@@ -204,7 +220,7 @@ + init_extensions4(); + #endif + +- while ((c = getopt_long(argc, argv, "bcvthnM:T:", options, NULL)) != -1) { ++ while ((c = getopt_long(argc, argv, "bcvthnlM:T:", options, NULL)) != -1) { + switch (c) { + case 'b': + binary = 1; +@@ -225,6 +241,9 @@ + case 'n': + noflush = 1; + break; ++ case 'l': ++ iptables_globals.exit_err = catch_exit_error; ++ break; + case 'M': + xtables_modprobe_program = optarg; + break; +@@ -437,8 +456,11 @@ + for (a = 0; a < newargc; a++) + DEBUGP("argv[%u]: %s\n", a, newargv[a]); + +- ret = do_command4(newargc, newargv, +- &newargv[2], &handle); ++ if (!setjmp(jmp)) ++ ret = do_command4(newargc, newargv, ++ &newargv[2], &handle); ++ else ++ ret = 1; + + free_argv(); + fflush(stdout); diff --git a/package/network/utils/iptables/patches/002-layer7_2.22.patch b/package/network/utils/iptables/patches/002-layer7_2.22.patch new file mode 100644 index 0000000..ba4531e --- /dev/null +++ b/package/network/utils/iptables/patches/002-layer7_2.22.patch @@ -0,0 +1,371 @@ +--- /dev/null ++++ b/extensions/libxt_layer7.c +@@ -0,0 +1,368 @@ ++/* ++ Shared library add-on to iptables for layer 7 matching support. ++ ++ By Matthew Strait <quadong@users.sf.net>, Oct 2003-Aug 2008. ++ ++ http://l7-filter.sf.net ++ ++ This program is free software; you can redistribute it and/or ++ modify it under the terms of the GNU General Public License ++ as published by the Free Software Foundation; either version ++ 2 of the License, or (at your option) any later version. ++ http://www.gnu.org/licenses/gpl.txt ++*/ ++ ++#define _GNU_SOURCE ++#include <stdio.h> ++#include <netdb.h> ++#include <string.h> ++#include <stdlib.h> ++#include <getopt.h> ++#include <ctype.h> ++#include <dirent.h> ++ ++#include <xtables.h> ++#include <linux/netfilter/xt_layer7.h> ++ ++#define MAX_FN_LEN 256 ++ ++static char l7dir[MAX_FN_LEN] = "\0"; ++ ++/* Function which prints out usage message. */ ++static void help(void) ++{ ++ printf( ++ "layer7 match options:\n" ++ " --l7dir <directory> : Look for patterns here instead of /etc/l7-protocols/\n" ++ " (--l7dir must be specified before --l7proto if used)\n" ++ "[!] --l7proto <name>: Match named protocol using /etc/l7-protocols/.../name.pat\n"); ++} ++ ++static const struct option opts[] = { ++ { .name = "l7proto", .has_arg = 1, .val = 'p' }, ++ { .name = "l7dir", .has_arg = 1, .val = 'd' }, ++ { .name = NULL } ++}; ++ ++/* reads filename, puts protocol info into layer7_protocol_info, number of protocols to numprotos */ ++static int parse_protocol_file(char * filename, const char * protoname, struct xt_layer7_info *info) ++{ ++ FILE * f; ++ char * line = NULL; ++ size_t len = 0; ++ ++ enum { protocol, pattern, done } datatype = protocol; ++ ++ f = fopen(filename, "r"); ++ ++ if(!f) ++ return 0; ++ ++ while(getline(&line, &len, f) != -1) ++ { ++ if(strlen(line) < 2 || line[0] == '#') ++ continue; ++ ++ /* strip the pesky newline... */ ++ if(line[strlen(line) - 1] == '\n') ++ line[strlen(line) - 1] = '\0'; ++ ++ if(datatype == protocol) ++ { ++ /* Ignore everything on the line beginning with the ++ first space or tab . For instance, this allows the ++ protocol line in http.pat to be "http " (or ++ "http I am so cool") instead of just "http". */ ++ if(strchr(line, ' ')){ ++ char * space = strchr(line, ' '); ++ space[0] = '\0'; ++ } ++ if(strchr(line, '\t')){ ++ char * space = strchr(line, '\t'); ++ space[0] = '\0'; ++ } ++ ++ /* sanity check. First non-comment non-blank ++ line must be the same as the file name. */ ++ if(strcmp(line, protoname)) ++ xtables_error(OTHER_PROBLEM, ++ "Protocol name (%s) doesn't match file name (%s). Bailing out\n", ++ line, filename); ++ ++ if(strlen(line) >= MAX_PROTOCOL_LEN) ++ xtables_error(PARAMETER_PROBLEM, ++ "Protocol name in %s too long!", filename); ++ strncpy(info->protocol, line, MAX_PROTOCOL_LEN); ++ ++ datatype = pattern; ++ } ++ else if(datatype == pattern) ++ { ++ if(strlen(line) >= MAX_PATTERN_LEN) ++ xtables_error(PARAMETER_PROBLEM, "Pattern in %s too long!", filename); ++ strncpy(info->pattern, line, MAX_PATTERN_LEN); ++ ++ datatype = done; ++ break; ++ } ++ else ++ xtables_error(OTHER_PROBLEM, "Internal error"); ++ } ++ ++ if(datatype != done) ++ xtables_error(OTHER_PROBLEM, "Failed to get all needed data from %s", filename); ++ ++ if(line) free(line); ++ fclose(f); ++ ++ return 1; ++} ++ ++static int hex2dec(char c) ++{ ++ switch (c) ++ { ++ case '0' ... '9': ++ return c - '0'; ++ case 'a' ... 'f': ++ return c - 'a' + 10; ++ case 'A' ... 'F': ++ return c - 'A' + 10; ++ default: ++ xtables_error(OTHER_PROBLEM, "hex2dec: bad value!\n"); ++ return 0; ++ } ++} ++ ++/* takes a string with \xHH escapes and returns one with the characters ++they stand for */ ++static char * pre_process(char * s) ++{ ++ char * result = malloc(strlen(s) + 1); ++ int sindex = 0, rrindex = 0; ++ while( sindex < strlen(s) ) ++ { ++ if( sindex + 3 < strlen(s) && ++ s[sindex] == '\\' && s[sindex+1] == 'x' && ++ isxdigit(s[sindex + 2]) && isxdigit(s[sindex + 3]) ) ++ { ++ /* carefully remember to call tolower here... */ ++ result[rrindex] = tolower( hex2dec(s[sindex + 2])*16 + ++ hex2dec(s[sindex + 3] ) ); ++ ++ switch ( result[rrindex] ) ++ { ++ case 0x24: ++ case 0x28: ++ case 0x29: ++ case 0x2a: ++ case 0x2b: ++ case 0x2e: ++ case 0x3f: ++ case 0x5b: ++ case 0x5c: ++ case 0x5d: ++ case 0x5e: ++ case 0x7c: ++ fprintf(stderr, ++ "Warning: layer7 regexp contains a control character, %c, in hex (\\x%c%c).\n" ++ "I recommend that you write this as %c or \\%c, depending on what you meant.\n", ++ result[rrindex], s[sindex + 2], s[sindex + 3], result[rrindex], result[rrindex]); ++ break; ++ case 0x00: ++ fprintf(stderr, ++ "Warning: null (\\x00) in layer7 regexp. A null terminates the regexp string!\n"); ++ break; ++ default: ++ break; ++ } ++ ++ ++ sindex += 3; /* 4 total */ ++ } ++ else ++ result[rrindex] = tolower(s[sindex]); ++ ++ sindex++; ++ rrindex++; ++ } ++ result[rrindex] = '\0'; ++ ++ return result; ++} ++ ++#define MAX_SUBDIRS 128 ++static char ** readl7dir(char * dirname) ++{ ++ DIR * scratchdir; ++ struct dirent ** namelist; ++ char ** subdirs = malloc(MAX_SUBDIRS * sizeof(char *)); ++ ++ int n, d = 1; ++ subdirs[0] = ""; ++ ++ n = scandir(dirname, &namelist, 0, alphasort); ++ ++ if (n < 0) ++ { ++ perror("scandir"); ++ xtables_error(OTHER_PROBLEM, "Couldn't open %s\n", dirname); ++ } ++ else ++ { ++ while(n--) ++ { ++ char fulldirname[MAX_FN_LEN]; ++ ++ snprintf(fulldirname, MAX_FN_LEN, "%s/%s", dirname, namelist[n]->d_name); ++ ++ if((scratchdir = opendir(fulldirname)) != NULL) ++ { ++ closedir(scratchdir); ++ ++ if(!strcmp(namelist[n]->d_name, ".") || ++ !strcmp(namelist[n]->d_name, "..")) ++ /* do nothing */ ; ++ else ++ { ++ subdirs[d] = malloc(strlen(namelist[n]->d_name) + 1); ++ strcpy(subdirs[d], namelist[n]->d_name); ++ d++; ++ if(d >= MAX_SUBDIRS - 1) ++ { ++ fprintf(stderr, ++ "Too many subdirectories, skipping the rest!\n"); ++ break; ++ } ++ } ++ } ++ free(namelist[n]); ++ } ++ free(namelist); ++ } ++ ++ subdirs[d] = NULL; ++ ++ return subdirs; ++} ++ ++static void parse_layer7_protocol(const char *s, struct xt_layer7_info *info) ++{ ++ char filename[MAX_FN_LEN]; ++ char * dir = NULL; ++ char ** subdirs; ++ int n = 0, done = 0; ++ ++ if(strlen(l7dir) > 0) dir = l7dir; ++ else dir = "/etc/l7-protocols"; ++ ++ subdirs = readl7dir(dir); ++ ++ while(subdirs[n] != NULL) ++ { ++ int c = snprintf(filename, MAX_FN_LEN, "%s/%s/%s.pat", dir, subdirs[n], s); ++ ++ if(c > MAX_FN_LEN) ++ xtables_error(OTHER_PROBLEM, ++ "Filename beginning with %s is too long!\n", filename); ++ ++ /* read in the pattern from the file */ ++ if(parse_protocol_file(filename, s, info)){ ++ done = 1; ++ break; ++ } ++ ++ n++; ++ } ++ ++ if(!done) ++ xtables_error(OTHER_PROBLEM, ++ "Couldn't find a pattern definition file for %s.\n", s); ++ ++ /* process \xHH escapes and tolower everything. (our regex lib has no ++ case insensitivity option.) */ ++ strncpy(info->pattern, pre_process(info->pattern), MAX_PATTERN_LEN); ++} ++ ++/* Function which parses command options; returns true if it ate an option */ ++static int parse(int c, char **argv, int invert, unsigned int *flags, ++ const void *entry, struct xt_entry_match **match) ++{ ++ struct xt_layer7_info *layer7info = ++ (struct xt_layer7_info *)(*match)->data; ++ ++ switch (c) { ++ case 'p': ++ parse_layer7_protocol(argv[optind-1], layer7info); ++ if (invert) ++ layer7info->invert = true; ++ *flags = 1; ++ break; ++ ++ case 'd': ++ if(strlen(argv[optind-1]) >= MAX_FN_LEN) ++ xtables_error(PARAMETER_PROBLEM, "directory name too long\n"); ++ ++ strncpy(l7dir, argv[optind-1], MAX_FN_LEN); ++ ++ *flags = 1; ++ break; ++ ++ default: ++ return 0; ++ } ++ ++ return 1; ++} ++ ++/* Final check; must have specified --l7proto */ ++static void final_check(unsigned int flags) ++{ ++ if (!flags) ++ xtables_error(PARAMETER_PROBLEM, ++ "LAYER7 match: You must specify `--l7proto'"); ++} ++ ++static void print_protocol(char s[], int invert, int numeric) ++{ ++ fputs("l7proto ", stdout); ++ if (invert) fputc('!', stdout); ++ printf("%s ", s); ++} ++ ++/* Prints out the matchinfo. */ ++static void print(const void *ip, ++ const struct xt_entry_match *match, ++ int numeric) ++{ ++ printf("LAYER7 "); ++ print_protocol(((struct xt_layer7_info *)match->data)->protocol, ++ ((struct xt_layer7_info *)match->data)->invert, numeric); ++} ++/* Saves the union ipt_matchinfo in parsable form to stdout. */ ++static void save(const void *ip, const struct xt_entry_match *match) ++{ ++ const struct xt_layer7_info *info = ++ (const struct xt_layer7_info*) match->data; ++ ++ printf("--l7proto %s%s ", (info->invert)? "! ":"", info->protocol); ++} ++ ++static struct xtables_match layer7 = { ++ .family = AF_INET, ++ .name = "layer7", ++ .version = XTABLES_VERSION, ++ .size = XT_ALIGN(sizeof(struct xt_layer7_info)), ++ .userspacesize = XT_ALIGN(sizeof(struct xt_layer7_info)), ++ .help = &help, ++ .parse = &parse, ++ .final_check = &final_check, ++ .print = &print, ++ .save = &save, ++ .extra_opts = opts ++}; ++ ++void _init(void) ++{ ++ xtables_register_match(&layer7); ++} diff --git a/package/network/utils/iptables/patches/010-use-old-linking.patch b/package/network/utils/iptables/patches/010-use-old-linking.patch new file mode 100644 index 0000000..a848e1e --- /dev/null +++ b/package/network/utils/iptables/patches/010-use-old-linking.patch @@ -0,0 +1,51 @@ +Index: iptables-1.4.18/extensions/GNUmakefile.in +=================================================================== +--- iptables-1.4.18.orig/extensions/GNUmakefile.in 2013-03-03 22:40:11.000000000 +0100 ++++ iptables-1.4.18/extensions/GNUmakefile.in 2013-03-06 17:13:04.074584735 +0100 +@@ -33,7 +33,6 @@ + AM_VERBOSE_CXXLD = @echo " CXXLD " $@; + AM_VERBOSE_AR = @echo " AR " $@; + AM_VERBOSE_GEN = @echo " GEN " $@; +-AM_VERBOSE_NULL = @ + endif + + # +@@ -76,7 +75,7 @@ + if test -n "${targets_install}"; then install -pm0755 $^ "${DESTDIR}${xtlibdir}/"; fi; + + clean: +- rm -f *.la *.o *.lo *.so *.a {matches,targets}.man initext.c initext4.c initext6.c; ++ rm -f *.o *.oo *.so *.a {matches,targets}.man initext.c initext4.c initext6.c; + rm -f .*.d .*.dd; + + distclean: clean +@@ -90,22 +89,19 @@ + # + # Shared libraries + # +-lib%.so: lib%.la +- ${AM_VERBOSE_NULL} ln -fs .libs/$@ $@ ++lib%.so: lib%.oo ++ ${AM_VERBOSE_CCLD} ${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $< -L../libxtables/.libs -L../libiptc/.libs -lxtables ${$*_LIBADD}; + +-lib%.la: lib%.lo +- ${AM_VERBOSE_CCLD} ../libtool ${AM_LIBTOOL_SILENT} --tag=CC --mode=link ${CCLD} ${AM_LDFLAGS} -module ${LDFLAGS} -o $@ $< ../libxtables/libxtables.la ${$*_LIBADD} -rpath ${xtlibdir} +- +-lib%.lo: ${srcdir}/lib%.c +- ${AM_VERBOSE_CC} ../libtool ${AM_LIBTOOL_SILENT} --tag=CC --mode=compile ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -D_INIT=lib$*_init ${CFLAGS} -o $@ -c $< ++lib%.oo: ${srcdir}/lib%.c ++ ${AM_VERBOSE_CC} ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -D_INIT=lib$*_init -DPIC -fPIC ${CFLAGS} -o $@ -c $<; + + libxt_NOTRACK.so: libxt_CT.so +- ${AM_VERBOSE_GEN} ln -fs $< $@ ++ ln -fs $< $@ + libxt_state.so: libxt_conntrack.so +- ${AM_VERBOSE_GEN} ln -fs $< $@ ++ ln -fs $< $@ + + # Need the LIBADDs in iptables/Makefile.am too for libxtables_la_LIBADD +-ip6t_NETMAP_LIBADD = ../libiptc/libip6tc.la ++ip6t_NETMAP_LIBADD = -lip6tc + xt_RATEEST_LIBADD = -lm + xt_statistic_LIBADD = -lm + diff --git a/package/network/utils/iptables/patches/020-iptables-disable-modprobe.patch b/package/network/utils/iptables/patches/020-iptables-disable-modprobe.patch new file mode 100644 index 0000000..ad4889b --- /dev/null +++ b/package/network/utils/iptables/patches/020-iptables-disable-modprobe.patch @@ -0,0 +1,18 @@ +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -336,6 +336,7 @@ static char *get_modprobe(void) + + int xtables_insmod(const char *modname, const char *modprobe, bool quiet) + { ++#if 0 + char *buf = NULL; + char *argv[4]; + int status; +@@ -380,6 +381,7 @@ int xtables_insmod(const char *modname, + free(buf); + if (WIFEXITED(status) && WEXITSTATUS(status) == 0) + return 0; ++#endif + return -1; + } + diff --git a/package/network/utils/iptables/patches/030-no-libnfnetlink.patch b/package/network/utils/iptables/patches/030-no-libnfnetlink.patch new file mode 100644 index 0000000..f795291 --- /dev/null +++ b/package/network/utils/iptables/patches/030-no-libnfnetlink.patch @@ -0,0 +1,94 @@ +--- a/configure ++++ b/configure +@@ -12173,77 +12173,7 @@ $as_echo "no" >&6; } + fi + fi + +-pkg_failed=no +-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libnfnetlink" >&5 +-$as_echo_n "checking for libnfnetlink... " >&6; } +- +-if test -n "$libnfnetlink_CFLAGS"; then +- pkg_cv_libnfnetlink_CFLAGS="$libnfnetlink_CFLAGS" +- elif test -n "$PKG_CONFIG"; then +- if test -n "$PKG_CONFIG" && \ +- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libnfnetlink >= 1.0\""; } >&5 +- ($PKG_CONFIG --exists --print-errors "libnfnetlink >= 1.0") 2>&5 +- ac_status=$? +- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 +- test $ac_status = 0; }; then +- pkg_cv_libnfnetlink_CFLAGS=`$PKG_CONFIG --cflags "libnfnetlink >= 1.0" 2>/dev/null` +- test "x$?" != "x0" && pkg_failed=yes +-else +- pkg_failed=yes +-fi +- else +- pkg_failed=untried +-fi +-if test -n "$libnfnetlink_LIBS"; then +- pkg_cv_libnfnetlink_LIBS="$libnfnetlink_LIBS" +- elif test -n "$PKG_CONFIG"; then +- if test -n "$PKG_CONFIG" && \ +- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libnfnetlink >= 1.0\""; } >&5 +- ($PKG_CONFIG --exists --print-errors "libnfnetlink >= 1.0") 2>&5 +- ac_status=$? +- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 +- test $ac_status = 0; }; then +- pkg_cv_libnfnetlink_LIBS=`$PKG_CONFIG --libs "libnfnetlink >= 1.0" 2>/dev/null` +- test "x$?" != "x0" && pkg_failed=yes +-else +- pkg_failed=yes +-fi +- else +- pkg_failed=untried +-fi +- +- +- +-if test $pkg_failed = yes; then +- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +-$as_echo "no" >&6; } +- +-if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then +- _pkg_short_errors_supported=yes +-else +- _pkg_short_errors_supported=no +-fi +- if test $_pkg_short_errors_supported = yes; then +- libnfnetlink_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libnfnetlink >= 1.0" 2>&1` +- else +- libnfnetlink_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libnfnetlink >= 1.0" 2>&1` +- fi +- # Put the nasty error message in config.log where it belongs +- echo "$libnfnetlink_PKG_ERRORS" >&5 +- +- nfnetlink=0 +-elif test $pkg_failed = untried; then +- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +-$as_echo "no" >&6; } +- nfnetlink=0 +-else +- libnfnetlink_CFLAGS=$pkg_cv_libnfnetlink_CFLAGS +- libnfnetlink_LIBS=$pkg_cv_libnfnetlink_LIBS +- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 +-$as_echo "yes" >&6; } +- nfnetlink=1 +-fi +- if test "$nfnetlink" = 1; then ++if false; then + HAVE_LIBNFNETLINK_TRUE= + HAVE_LIBNFNETLINK_FALSE='#' + else +--- a/configure.ac ++++ b/configure.ac +@@ -89,9 +89,7 @@ AM_CONDITIONAL([ENABLE_LARGEFILE], [test + AM_CONDITIONAL([ENABLE_DEVEL], [test "$enable_devel" = "yes"]) + AM_CONDITIONAL([ENABLE_LIBIPQ], [test "$enable_libipq" = "yes"]) + +-PKG_CHECK_MODULES([libnfnetlink], [libnfnetlink >= 1.0], +- [nfnetlink=1], [nfnetlink=0]) +-AM_CONDITIONAL([HAVE_LIBNFNETLINK], [test "$nfnetlink" = 1]) ++AM_CONDITIONAL([HAVE_LIBNFNETLINK], [false]) + + regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \ + -Wmissing-prototypes -Wredundant-decls -Wshadow -Wstrict-prototypes \ diff --git a/package/network/utils/iptables/patches/100-bash-location.patch b/package/network/utils/iptables/patches/100-bash-location.patch new file mode 100644 index 0000000..02ee45b --- /dev/null +++ b/package/network/utils/iptables/patches/100-bash-location.patch @@ -0,0 +1,8 @@ +--- a/iptables/iptables-apply ++++ b/iptables/iptables-apply +@@ -1,4 +1,4 @@ +-#!/bin/bash ++#!/usr/bin/env bash + # + # iptables-apply -- a safer way to update iptables remotely + # diff --git a/package/network/utils/iptables/patches/200-configurable_builtin.patch b/package/network/utils/iptables/patches/200-configurable_builtin.patch new file mode 100644 index 0000000..8f095c1 --- /dev/null +++ b/package/network/utils/iptables/patches/200-configurable_builtin.patch @@ -0,0 +1,62 @@ +Index: iptables-1.4.18/extensions/GNUmakefile.in +=================================================================== +--- iptables-1.4.18.orig/extensions/GNUmakefile.in 2013-03-03 22:40:11.000000000 +0100 ++++ iptables-1.4.18/extensions/GNUmakefile.in 2013-03-05 16:37:07.583256974 +0100 +@@ -46,9 +46,24 @@ + pfx_build_mod := $(filter-out @blacklist_modules@,${pfx_build_mod}) + pf4_build_mod := $(filter-out @blacklist_modules@,${pf4_build_mod}) + pf6_build_mod := $(filter-out @blacklist_modules@,${pf6_build_mod}) +-pfx_objs := $(patsubst %,libxt_%.o,${pfx_build_mod}) +-pf4_objs := $(patsubst %,libipt_%.o,${pf4_build_mod}) +-pf6_objs := $(patsubst %,libip6t_%.o,${pf6_build_mod}) ++ ++ifdef BUILTIN_MODULES ++pfx_build_static := $(filter $(BUILTIN_MODULES),${pfx_build_mod}) ++pf4_build_static := $(filter $(BUILTIN_MODULES),${pf4_build_mod}) ++pf6_build_static := $(filter $(BUILTIN_MODULES),${pf6_build_mod}) ++else ++@ENABLE_STATIC_TRUE@ pfx_build_static := $(pfx_build_mod) ++@ENABLE_STATIC_TRUE@ pf4_build_static := $(pf4_build_mod) ++@ENABLE_STATIC_TRUE@ pf6_build_static := $(pf6_build_mod) ++endif ++ ++pfx_build_mod := $(filter-out $(pfx_build_static),$(pfx_build_mod)) ++pf4_build_mod := $(filter-out $(pf4_build_static),$(pf4_build_mod)) ++pf6_build_mod := $(filter-out $(pf6_build_static),$(pf6_build_mod)) ++ ++pfx_objs := $(patsubst %,libxt_%.o,${pfx_build_static}) ++pf4_objs := $(patsubst %,libipt_%.o,${pf4_build_static}) ++pf6_objs := $(patsubst %,libip6t_%.o,${pf6_build_static}) + pfx_solibs := $(patsubst %,libxt_%.so,${pfx_build_mod} ${pfx_symlinks}) + pf4_solibs := $(patsubst %,libipt_%.so,${pf4_build_mod}) + pf6_solibs := $(patsubst %,libip6t_%.so,${pf6_build_mod}) +@@ -59,11 +74,11 @@ + # + targets := libext.a libext4.a libext6.a matches.man targets.man + targets_install := +-@ENABLE_STATIC_TRUE@ libext_objs := ${pfx_objs} +-@ENABLE_STATIC_TRUE@ libext4_objs := ${pf4_objs} +-@ENABLE_STATIC_TRUE@ libext6_objs := ${pf6_objs} +-@ENABLE_STATIC_FALSE@ targets += ${pfx_solibs} ${pf4_solibs} ${pf6_solibs} +-@ENABLE_STATIC_FALSE@ targets_install += ${pfx_solibs} ${pf4_solibs} ${pf6_solibs} ++libext_objs := ${pfx_objs} ++libext4_objs := ${pf4_objs} ++libext6_objs := ${pf6_objs} ++targets += ${pfx_solibs} ${pf4_solibs} ${pf6_solibs} ++targets_install := $(strip ${targets_install} ${pfx_solibs} ${pf4_solibs} ${pf6_solibs}) + + .SECONDARY: + +@@ -128,9 +143,9 @@ + libext6.a: initext6.o ${libext6_objs} + ${AM_VERBOSE_AR} ${AR} crs $@ $^; + +-initext_func := $(addprefix xt_,${pfx_build_mod}) +-initext4_func := $(addprefix ipt_,${pf4_build_mod}) +-initext6_func := $(addprefix ip6t_,${pf6_build_mod}) ++initext_func := $(addprefix xt_,${pfx_build_static}) ++initext4_func := $(addprefix ipt_,${pf4_build_static}) ++initext6_func := $(addprefix ip6t_,${pf6_build_static}) + + .initext.dd: FORCE + @echo "${initext_func}" >$@.tmp; \ diff --git a/package/network/utils/iptables/patches/300-musl_fixes.patch b/package/network/utils/iptables/patches/300-musl_fixes.patch new file mode 100644 index 0000000..039af7c --- /dev/null +++ b/package/network/utils/iptables/patches/300-musl_fixes.patch @@ -0,0 +1,139 @@ +--- a/extensions/libip6t_ipv6header.c ++++ b/extensions/libip6t_ipv6header.c +@@ -10,6 +10,9 @@ on whether they contain certain headers + #include <netdb.h> + #include <xtables.h> + #include <linux/netfilter_ipv6/ip6t_ipv6header.h> ++#ifndef IPPROTO_HOPOPTS ++# define IPPROTO_HOPOPTS 0 ++#endif + + enum { + O_HEADER = 0, +--- a/extensions/libxt_TCPOPTSTRIP.c ++++ b/extensions/libxt_TCPOPTSTRIP.c +@@ -12,6 +12,21 @@ + #ifndef TCPOPT_MD5SIG + # define TCPOPT_MD5SIG 19 + #endif ++#ifndef TCPOPT_MAXSEG ++# define TCPOPT_MAXSEG 2 ++#endif ++#ifndef TCPOPT_WINDOW ++# define TCPOPT_WINDOW 3 ++#endif ++#ifndef TCPOPT_SACK_PERMITTED ++# define TCPOPT_SACK_PERMITTED 4 ++#endif ++#ifndef TCPOPT_SACK ++# define TCPOPT_SACK 5 ++#endif ++#ifndef TCPOPT_TIMESTAMP ++# define TCPOPT_TIMESTAMP 8 ++#endif + + enum { + O_STRIP_OPTION = 0, +--- a/include/libiptc/ipt_kernel_headers.h ++++ b/include/libiptc/ipt_kernel_headers.h +@@ -5,7 +5,6 @@ + + #include <limits.h> + +-#if defined(__GLIBC__) && __GLIBC__ == 2 + #include <netinet/ip.h> + #include <netinet/in.h> + #include <netinet/ip_icmp.h> +@@ -13,15 +12,4 @@ + #include <netinet/udp.h> + #include <net/if.h> + #include <sys/types.h> +-#else /* libc5 */ +-#include <sys/socket.h> +-#include <linux/ip.h> +-#include <linux/in.h> +-#include <linux/if.h> +-#include <linux/icmp.h> +-#include <linux/tcp.h> +-#include <linux/udp.h> +-#include <linux/types.h> +-#include <linux/in6.h> +-#endif + #endif +--- a/include/linux/netfilter/xt_osf.h ++++ b/include/linux/netfilter/xt_osf.h +@@ -21,6 +21,9 @@ + #define _XT_OSF_H + + #include <linux/types.h> ++#if !defined(__UCLIBC__) && !defined(__GLIBC__) ++#include <linux/tcp.h> ++#endif + + #define MAXGENRELEN 32 + +--- a/include/linux/netfilter_ipv4/ip_tables.h ++++ b/include/linux/netfilter_ipv4/ip_tables.h +@@ -16,6 +16,7 @@ + #define _IPTABLES_H + + #include <linux/types.h> ++#include <sys/types.h> + + #include <linux/netfilter_ipv4.h> + +--- a/iptables/ip6tables-restore.c ++++ b/iptables/ip6tables-restore.c +@@ -9,7 +9,7 @@ + */ + + #include <getopt.h> +-#include <sys/errno.h> ++#include <errno.h> + #include <stdbool.h> + #include <string.h> + #include <stdio.h> +--- a/iptables/ip6tables-save.c ++++ b/iptables/ip6tables-save.c +@@ -6,7 +6,7 @@ + * This code is distributed under the terms of GNU GPL v2 + */ + #include <getopt.h> +-#include <sys/errno.h> ++#include <errno.h> + #include <stdio.h> + #include <fcntl.h> + #include <stdlib.h> +--- a/iptables/iptables-restore.c ++++ b/iptables/iptables-restore.c +@@ -6,7 +6,7 @@ + */ + + #include <getopt.h> +-#include <sys/errno.h> ++#include <errno.h> + #include <stdbool.h> + #include <string.h> + #include <stdio.h> +--- a/iptables/iptables-save.c ++++ b/iptables/iptables-save.c +@@ -6,7 +6,7 @@ + * + */ + #include <getopt.h> +-#include <sys/errno.h> ++#include <errno.h> + #include <stdio.h> + #include <fcntl.h> + #include <stdlib.h> +--- a/iptables/iptables-xml.c ++++ b/iptables/iptables-xml.c +@@ -7,7 +7,7 @@ + */ + + #include <getopt.h> +-#include <sys/errno.h> ++#include <errno.h> + #include <string.h> + #include <stdio.h> + #include <stdlib.h> diff --git a/package/network/utils/iptables/patches/400-lenient-restore.patch b/package/network/utils/iptables/patches/400-lenient-restore.patch new file mode 100644 index 0000000..696d733 --- /dev/null +++ b/package/network/utils/iptables/patches/400-lenient-restore.patch @@ -0,0 +1,176 @@ +Index: iptables-1.4.18/iptables/ip6tables-restore.c +=================================================================== +--- iptables-1.4.18.orig/iptables/ip6tables-restore.c 2013-03-05 16:37:31.000000000 +0100 ++++ iptables-1.4.18/iptables/ip6tables-restore.c 2013-03-05 16:42:57.475249794 +0100 +@@ -14,6 +14,8 @@ + #include <string.h> + #include <stdio.h> + #include <stdlib.h> ++#include <stdarg.h> ++#include <setjmp.h> + #include "ip6tables.h" + #include "xtables.h" + #include "libiptc/libip6tc.h" +@@ -25,6 +27,7 @@ + #define DEBUGP(x, args...) + #endif + ++static jmp_buf jmp; + static int binary = 0, counters = 0, verbose = 0, noflush = 0; + + /* Keeping track of external matches and targets. */ +@@ -35,6 +38,7 @@ + {.name = "test", .has_arg = false, .val = 't'}, + {.name = "help", .has_arg = false, .val = 'h'}, + {.name = "noflush", .has_arg = false, .val = 'n'}, ++ {.name = "lenient", .has_arg = false, .val = 'l'}, + {.name = "modprobe", .has_arg = true, .val = 'M'}, + {.name = "table", .has_arg = true, .val = 'T'}, + {NULL}, +@@ -51,6 +55,7 @@ + " [ --test ]\n" + " [ --help ]\n" + " [ --noflush ]\n" ++ " [ --lenient ]\n" + " [ --modprobe=<command>]\n", name); + + exit(1); +@@ -114,6 +119,17 @@ + free(newargv[i]); + } + ++static void catch_exit_error(enum xtables_exittype status, const char *msg, ...) ++{ ++ va_list args; ++ fprintf(stderr, "line %d: ", line); ++ va_start(args, msg); ++ vfprintf(stderr, msg, args); ++ va_end(args); ++ fprintf(stderr, "\n"); ++ longjmp(jmp, status); ++} ++ + static void add_param_to_argv(char *parsestart) + { + int quote_open = 0, escaped = 0, param_len = 0; +@@ -204,7 +220,7 @@ + init_extensions6(); + #endif + +- while ((c = getopt_long(argc, argv, "bcvthnM:T:", options, NULL)) != -1) { ++ while ((c = getopt_long(argc, argv, "bcvthnlM:T:", options, NULL)) != -1) { + switch (c) { + case 'b': + binary = 1; +@@ -225,6 +241,9 @@ + case 'n': + noflush = 1; + break; ++ case 'l': ++ ip6tables_globals.exit_err = catch_exit_error; ++ break; + case 'M': + xtables_modprobe_program = optarg; + break; +@@ -437,8 +456,11 @@ + for (a = 0; a < newargc; a++) + DEBUGP("argv[%u]: %s\n", a, newargv[a]); + +- ret = do_command6(newargc, newargv, +- &newargv[2], &handle); ++ if (!setjmp(jmp)) ++ ret = do_command6(newargc, newargv, ++ &newargv[2], &handle); ++ else ++ ret = 1; + + free_argv(); + fflush(stdout); +Index: iptables-1.4.18/iptables/iptables-restore.c +=================================================================== +--- iptables-1.4.18.orig/iptables/iptables-restore.c 2013-03-05 16:37:31.000000000 +0100 ++++ iptables-1.4.18/iptables/iptables-restore.c 2013-03-05 16:44:56.303247355 +0100 +@@ -11,6 +11,8 @@ + #include <string.h> + #include <stdio.h> + #include <stdlib.h> ++#include <stdarg.h> ++#include <setjmp.h> + #include "iptables.h" + #include "xtables.h" + #include "libiptc/libiptc.h" +@@ -22,6 +24,7 @@ + #define DEBUGP(x, args...) + #endif + ++static jmp_buf jmp; + static int binary = 0, counters = 0, verbose = 0, noflush = 0; + + /* Keeping track of external matches and targets. */ +@@ -32,6 +35,7 @@ + {.name = "test", .has_arg = false, .val = 't'}, + {.name = "help", .has_arg = false, .val = 'h'}, + {.name = "noflush", .has_arg = false, .val = 'n'}, ++ {.name = "lenient", .has_arg = false, .val = 'l'}, + {.name = "modprobe", .has_arg = true, .val = 'M'}, + {.name = "table", .has_arg = true, .val = 'T'}, + {NULL}, +@@ -50,6 +54,7 @@ + " [ --test ]\n" + " [ --help ]\n" + " [ --noflush ]\n" ++ " [ --lenient ]\n" + " [ --table=<TABLE> ]\n" + " [ --modprobe=<command>]\n", name); + +@@ -113,6 +118,17 @@ + free(newargv[i]); + } + ++static void catch_exit_error(enum xtables_exittype status, const char *msg, ...) ++{ ++ va_list args; ++ fprintf(stderr, "line %d: ", line); ++ va_start(args, msg); ++ vfprintf(stderr, msg, args); ++ va_end(args); ++ fprintf(stderr, "\n"); ++ longjmp(jmp, status); ++} ++ + static void add_param_to_argv(char *parsestart) + { + int quote_open = 0, escaped = 0, param_len = 0; +@@ -204,7 +220,7 @@ + init_extensions4(); + #endif + +- while ((c = getopt_long(argc, argv, "bcvthnM:T:", options, NULL)) != -1) { ++ while ((c = getopt_long(argc, argv, "bcvthnlM:T:", options, NULL)) != -1) { + switch (c) { + case 'b': + binary = 1; +@@ -225,6 +241,9 @@ + case 'n': + noflush = 1; + break; ++ case 'l': ++ iptables_globals.exit_err = catch_exit_error; ++ break; + case 'M': + xtables_modprobe_program = optarg; + break; +@@ -437,8 +456,11 @@ + for (a = 0; a < newargc; a++) + DEBUGP("argv[%u]: %s\n", a, newargv[a]); + +- ret = do_command4(newargc, newargv, +- &newargv[2], &handle); ++ if (!setjmp(jmp)) ++ ret = do_command4(newargc, newargv, ++ &newargv[2], &handle); ++ else ++ ret = 1; + + free_argv(); + fflush(stdout); |