diff --git a/.gitmodules b/.gitmodules index 09654aaa..78c3e80d 100644 --- a/.gitmodules +++ b/.gitmodules @@ -5,3 +5,7 @@ path = src/main/jni/badvpn url = https://github.com/Mygod/badvpn.git branch = shadowsocks +[submodule "src/main/jni/iptables"] + path = src/main/jni/iptables + url = https://github.com/Mygod/iptables.git + branch = shadowsocks diff --git a/src/main/jni/iptables b/src/main/jni/iptables new file mode 160000 index 00000000..177a84bc --- /dev/null +++ b/src/main/jni/iptables @@ -0,0 +1 @@ +Subproject commit 177a84bc6b77c53e1ccc22b97170928d54c1ce92 diff --git a/src/main/jni/iptables/Android.mk b/src/main/jni/iptables/Android.mk deleted file mode 100644 index 31eae917..00000000 --- a/src/main/jni/iptables/Android.mk +++ /dev/null @@ -1,5 +0,0 @@ -BUILD_IPTABLES_V14 := 1 - -LOCAL_PATH:= $(call my-dir) - -include $(call all-subdir-makefiles) diff --git a/src/main/jni/iptables/COMMIT_NOTES b/src/main/jni/iptables/COMMIT_NOTES deleted file mode 100644 index 592808c5..00000000 --- a/src/main/jni/iptables/COMMIT_NOTES +++ /dev/null @@ -1,19 +0,0 @@ -A quick list of rules for committing stuff into netfilter git: - -- Always add an appropriate description, in git format - (i.e. first line is a summary) - -- Please try to include references to bugs when the description does not - include total discussion coverage or when the bug report is external to - netfilter-devel, e.g. - "Closes: netfilter bugzilla #123", or - "Reference: http://bugs.{debian,gentoo}.org/..." - -- If you touch any parts of libxtables (xtables.c, include/xtables.h.in), - make sure the so-version is updated _appropriately_ (i.e. read the - libtool manual about Versioning:: first, if need be) in configure.ac. - Adding fields to a struct always entails a vcurrent bump. - - - Check, whether a bump (vcurrent,vage) has already been made since the - last release (no more than one per release), e.g.: - git log v1.4.4.. configure.ac diff --git a/src/main/jni/iptables/COPYING b/src/main/jni/iptables/COPYING deleted file mode 100644 index d159169d..00000000 --- a/src/main/jni/iptables/COPYING +++ /dev/null @@ -1,339 +0,0 @@ - GNU GENERAL PUBLIC LICENSE - Version 2, June 1991 - - Copyright (C) 1989, 1991 Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The licenses for most software are designed to take away your -freedom to share and change it. By contrast, the GNU General Public -License is intended to guarantee your freedom to share and change free -software--to make sure the software is free for all its users. This -General Public License applies to most of the Free Software -Foundation's software and to any other program whose authors commit to -using it. (Some other Free Software Foundation software is covered by -the GNU Lesser General Public License instead.) You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -this service if you wish), that you receive source code or can get it -if you want it, that you can change the software or use pieces of it -in new free programs; and that you know you can do these things. - - To protect your rights, we need to make restrictions that forbid -anyone to deny you these rights or to ask you to surrender the rights. -These restrictions translate to certain responsibilities for you if you -distribute copies of the software, or if you modify it. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must give the recipients all the rights that -you have. You must make sure that they, too, receive or can get the -source code. And you must show them these terms so they know their -rights. - - We protect your rights with two steps: (1) copyright the software, and -(2) offer you this license which gives you legal permission to copy, -distribute and/or modify the software. - - Also, for each author's protection and ours, we want to make certain -that everyone understands that there is no warranty for this free -software. If the software is modified by someone else and passed on, we -want its recipients to know that what they have is not the original, so -that any problems introduced by others will not reflect on the original -authors' reputations. - - Finally, any free program is threatened constantly by software -patents. We wish to avoid the danger that redistributors of a free -program will individually obtain patent licenses, in effect making the -program proprietary. To prevent this, we have made it clear that any -patent must be licensed for everyone's free use or not licensed at all. - - The precise terms and conditions for copying, distribution and -modification follow. - - GNU GENERAL PUBLIC LICENSE - TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION - - 0. This License applies to any program or other work which contains -a notice placed by the copyright holder saying it may be distributed -under the terms of this General Public License. The "Program", below, -refers to any such program or work, and a "work based on the Program" -means either the Program or any derivative work under copyright law: -that is to say, a work containing the Program or a portion of it, -either verbatim or with modifications and/or translated into another -language. (Hereinafter, translation is included without limitation in -the term "modification".) Each licensee is addressed as "you". - -Activities other than copying, distribution and modification are not -covered by this License; they are outside its scope. The act of -running the Program is not restricted, and the output from the Program -is covered only if its contents constitute a work based on the -Program (independent of having been made by running the Program). -Whether that is true depends on what the Program does. - - 1. You may copy and distribute verbatim copies of the Program's -source code as you receive it, in any medium, provided that you -conspicuously and appropriately publish on each copy an appropriate -copyright notice and disclaimer of warranty; keep intact all the -notices that refer to this License and to the absence of any warranty; -and give any other recipients of the Program a copy of this License -along with the Program. - -You may charge a fee for the physical act of transferring a copy, and -you may at your option offer warranty protection in exchange for a fee. - - 2. You may modify your copy or copies of the Program or any portion -of it, thus forming a work based on the Program, and copy and -distribute such modifications or work under the terms of Section 1 -above, provided that you also meet all of these conditions: - - a) You must cause the modified files to carry prominent notices - stating that you changed the files and the date of any change. - - b) You must cause any work that you distribute or publish, that in - whole or in part contains or is derived from the Program or any - part thereof, to be licensed as a whole at no charge to all third - parties under the terms of this License. - - c) If the modified program normally reads commands interactively - when run, you must cause it, when started running for such - interactive use in the most ordinary way, to print or display an - announcement including an appropriate copyright notice and a - notice that there is no warranty (or else, saying that you provide - a warranty) and that users may redistribute the program under - these conditions, and telling the user how to view a copy of this - License. (Exception: if the Program itself is interactive but - does not normally print such an announcement, your work based on - the Program is not required to print an announcement.) - -These requirements apply to the modified work as a whole. If -identifiable sections of that work are not derived from the Program, -and can be reasonably considered independent and separate works in -themselves, then this License, and its terms, do not apply to those -sections when you distribute them as separate works. But when you -distribute the same sections as part of a whole which is a work based -on the Program, the distribution of the whole must be on the terms of -this License, whose permissions for other licensees extend to the -entire whole, and thus to each and every part regardless of who wrote it. - -Thus, it is not the intent of this section to claim rights or contest -your rights to work written entirely by you; rather, the intent is to -exercise the right to control the distribution of derivative or -collective works based on the Program. - -In addition, mere aggregation of another work not based on the Program -with the Program (or with a work based on the Program) on a volume of -a storage or distribution medium does not bring the other work under -the scope of this License. - - 3. You may copy and distribute the Program (or a work based on it, -under Section 2) in object code or executable form under the terms of -Sections 1 and 2 above provided that you also do one of the following: - - a) Accompany it with the complete corresponding machine-readable - source code, which must be distributed under the terms of Sections - 1 and 2 above on a medium customarily used for software interchange; or, - - b) Accompany it with a written offer, valid for at least three - years, to give any third party, for a charge no more than your - cost of physically performing source distribution, a complete - machine-readable copy of the corresponding source code, to be - distributed under the terms of Sections 1 and 2 above on a medium - customarily used for software interchange; or, - - c) Accompany it with the information you received as to the offer - to distribute corresponding source code. (This alternative is - allowed only for noncommercial distribution and only if you - received the program in object code or executable form with such - an offer, in accord with Subsection b above.) - -The source code for a work means the preferred form of the work for -making modifications to it. For an executable work, complete source -code means all the source code for all modules it contains, plus any -associated interface definition files, plus the scripts used to -control compilation and installation of the executable. However, as a -special exception, the source code distributed need not include -anything that is normally distributed (in either source or binary -form) with the major components (compiler, kernel, and so on) of the -operating system on which the executable runs, unless that component -itself accompanies the executable. - -If distribution of executable or object code is made by offering -access to copy from a designated place, then offering equivalent -access to copy the source code from the same place counts as -distribution of the source code, even though third parties are not -compelled to copy the source along with the object code. - - 4. You may not copy, modify, sublicense, or distribute the Program -except as expressly provided under this License. Any attempt -otherwise to copy, modify, sublicense or distribute the Program is -void, and will automatically terminate your rights under this License. -However, parties who have received copies, or rights, from you under -this License will not have their licenses terminated so long as such -parties remain in full compliance. - - 5. You are not required to accept this License, since you have not -signed it. However, nothing else grants you permission to modify or -distribute the Program or its derivative works. These actions are -prohibited by law if you do not accept this License. Therefore, by -modifying or distributing the Program (or any work based on the -Program), you indicate your acceptance of this License to do so, and -all its terms and conditions for copying, distributing or modifying -the Program or works based on it. - - 6. Each time you redistribute the Program (or any work based on the -Program), the recipient automatically receives a license from the -original licensor to copy, distribute or modify the Program subject to -these terms and conditions. You may not impose any further -restrictions on the recipients' exercise of the rights granted herein. -You are not responsible for enforcing compliance by third parties to -this License. - - 7. If, as a consequence of a court judgment or allegation of patent -infringement or for any other reason (not limited to patent issues), -conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot -distribute so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you -may not distribute the Program at all. For example, if a patent -license would not permit royalty-free redistribution of the Program by -all those who receive copies directly or indirectly through you, then -the only way you could satisfy both it and this License would be to -refrain entirely from distribution of the Program. - -If any portion of this section is held invalid or unenforceable under -any particular circumstance, the balance of the section is intended to -apply and the section as a whole is intended to apply in other -circumstances. - -It is not the purpose of this section to induce you to infringe any -patents or other property right claims or to contest validity of any -such claims; this section has the sole purpose of protecting the -integrity of the free software distribution system, which is -implemented by public license practices. Many people have made -generous contributions to the wide range of software distributed -through that system in reliance on consistent application of that -system; it is up to the author/donor to decide if he or she is willing -to distribute software through any other system and a licensee cannot -impose that choice. - -This section is intended to make thoroughly clear what is believed to -be a consequence of the rest of this License. - - 8. If the distribution and/or use of the Program is restricted in -certain countries either by patents or by copyrighted interfaces, the -original copyright holder who places the Program under this License -may add an explicit geographical distribution limitation excluding -those countries, so that distribution is permitted only in or among -countries not thus excluded. In such case, this License incorporates -the limitation as if written in the body of this License. - - 9. The Free Software Foundation may publish revised and/or new versions -of the General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - -Each version is given a distinguishing version number. If the Program -specifies a version number of this License which applies to it and "any -later version", you have the option of following the terms and conditions -either of that version or of any later version published by the Free -Software Foundation. If the Program does not specify a version number of -this License, you may choose any version ever published by the Free Software -Foundation. - - 10. If you wish to incorporate parts of the Program into other free -programs whose distribution conditions are different, write to the author -to ask for permission. For software which is copyrighted by the Free -Software Foundation, write to the Free Software Foundation; we sometimes -make exceptions for this. Our decision will be guided by the two goals -of preserving the free status of all derivatives of our free software and -of promoting the sharing and reuse of software generally. - - NO WARRANTY - - 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY -FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN -OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES -PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED -OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF -MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS -TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE -PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, -REPAIR OR CORRECTION. - - 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR -REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, -INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING -OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED -TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY -YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER -PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE -POSSIBILITY OF SUCH DAMAGES. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -convey the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - - Copyright (C) - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License along - with this program; if not, write to the Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. - -Also add information on how to contact you by electronic and paper mail. - -If the program is interactive, make it output a short notice like this -when it starts in an interactive mode: - - Gnomovision version 69, Copyright (C) year name of author - Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, the commands you use may -be called something other than `show w' and `show c'; they could even be -mouse-clicks or menu items--whatever suits your program. - -You should also get your employer (if you work as a programmer) or your -school, if any, to sign a "copyright disclaimer" for the program, if -necessary. Here is a sample; alter the names: - - Yoyodyne, Inc., hereby disclaims all copyright interest in the program - `Gnomovision' (which makes passes at compilers) written by James Hacker. - - , 1 April 1989 - Ty Coon, President of Vice - -This General Public License does not permit incorporating your program into -proprietary programs. If your program is a subroutine library, you may -consider it more useful to permit linking proprietary applications with the -library. If this is what you want to do, use the GNU Lesser General -Public License instead of this License. diff --git a/src/main/jni/iptables/INCOMPATIBILITIES b/src/main/jni/iptables/INCOMPATIBILITIES deleted file mode 100644 index ddb24087..00000000 --- a/src/main/jni/iptables/INCOMPATIBILITIES +++ /dev/null @@ -1,14 +0,0 @@ -INCOMPATIBILITIES: - -- The REJECT target has an '--reject-with admin-prohib' option which used - with kernels that do not support it, will result in a plain DROP instead - of REJECT. Use with caution. - Kernels that do support it: - 2.4 - since 2.4.22-pre9 - 2.6 - all - -- There are some issues related to upgrading from 1.2.x to 1.3.x on a system - with dynamic ruleset changes during runtime. (Please see - https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=334). - After upgrading from 1.2 to 1.3, it suggest go do an iptables-save, then - iptables-restore to ensure your dynamic rule changes continue to work. diff --git a/src/main/jni/iptables/INSTALL b/src/main/jni/iptables/INSTALL deleted file mode 100644 index acb56cd5..00000000 --- a/src/main/jni/iptables/INSTALL +++ /dev/null @@ -1,99 +0,0 @@ -Installation instructions for iptables -====================================== - -iptables uses the well-known configure(autotools) infrastructure. - - $ ./configure - $ make - # make install - - -Prerequisites -============= - - * no kernel-source required - - * but obviously a compiler, glibc-devel and linux-kernel-headers - (/usr/include/linux) - - -Configuring and compiling -========================= - -./configure [options] - ---prefix= - - The prefix to put all installed files under. It defaults to - /usr/local, so the binaries will go into /usr/local/bin, sbin, - manpages into /usr/local/share/man, etc. - ---with-xtlibdir= - - The path to where Xtables extensions should be installed to. It - defaults to ${prefix}/libexec/xtables. - ---enable-devel (or --disable-devel) - - This option causes development files to be installed to - ${includedir}, which is needed for building additional packages, - such as Xtables-addons or other 3rd-party extensions. - - It is enabled by default. - ---enable-static - - Produce additional binaries, iptables-static/ip6tables-static, - which have all shipped extensions compiled in. - ---disable-shared - - Produce binaries that have dynamic loading of extensions disabled. - This implies --enable-static. - (See some details below.) - ---enable-libipq - - This option causes libipq to be installed into ${libdir} and - ${includedir}. - ---with-ksource= - - Xtables does not depend on kernel headers anymore, but you can - optionally specify a search path to include anyway. This is - probably only useful for development. - -If you want to enable debugging, use - - ./configure CFLAGS="-ggdb3 -O0" - -(-O0 is used to turn off instruction reordering, which makes debugging -much easier.) - - -Other notes -=========== - -The make process will automatically build multipurpose binaries. -These have the core (iptables), -save, -restore and -xml code -compiled into one binary, but extensions remain as modules. - - -Static and shared -================= - -Basically there are three configuration modes defined: - - --disable-static --enable-shared (this is the default) - - Build a binary that relies upon dynamic loading of extensions. - - --enable-static --enable-shared - - Build a binary that has the shipped extensions built-in, but - is still capable of loading additional extensions. - - --enable-static --disable-shared - - Shipped extensions are built-in, and dynamic loading is - deactivated. diff --git a/src/main/jni/iptables/Makefile.am b/src/main/jni/iptables/Makefile.am deleted file mode 100644 index 34b35012..00000000 --- a/src/main/jni/iptables/Makefile.am +++ /dev/null @@ -1,26 +0,0 @@ -# -*- Makefile -*- - -ACLOCAL_AMFLAGS = -I m4 -AUTOMAKE_OPTIONS = foreign subdir-objects - -SUBDIRS = extensions libiptc iptables -if ENABLE_DEVEL -SUBDIRS += include -endif -if ENABLE_LIBIPQ -SUBDIRS += libipq -endif -if HAVE_LIBNFNETLINK -SUBDIRS += utils -endif - -.PHONY: tarball -tarball: - rm -Rf /tmp/${PACKAGE_TARNAME}-${PACKAGE_VERSION}; - pushd ${top_srcdir} && git archive --prefix=${PACKAGE_TARNAME}-${PACKAGE_VERSION}/ HEAD | tar -C /tmp -x && popd; - pushd /tmp/${PACKAGE_TARNAME}-${PACKAGE_VERSION} && ./autogen.sh && popd; - tar -C /tmp -cjf ${PACKAGE_TARNAME}-${PACKAGE_VERSION}.tar.bz2 --owner=root --group=root ${PACKAGE_TARNAME}-${PACKAGE_VERSION}/; - rm -Rf /tmp/${PACKAGE_TARNAME}-${PACKAGE_VERSION}; - -config.status: extensions/GNUmakefile.in \ - include/xtables.h.in include/iptables/internal.h.in diff --git a/src/main/jni/iptables/autogen.sh b/src/main/jni/iptables/autogen.sh deleted file mode 100755 index 62a89e1b..00000000 --- a/src/main/jni/iptables/autogen.sh +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/bash - -autoreconf -fi; -rm -Rf autom4te*.cache; diff --git a/src/main/jni/iptables/configure.ac b/src/main/jni/iptables/configure.ac deleted file mode 100644 index e902ab92..00000000 --- a/src/main/jni/iptables/configure.ac +++ /dev/null @@ -1,117 +0,0 @@ - -AC_INIT([iptables], [1.4.11.1]) - -# See libtool.info "Libtool's versioning system" -libxtables_vcurrent=6 -libxtables_vage=0 - -AC_CONFIG_HEADERS([config.h]) -AC_CONFIG_MACRO_DIR([m4]) -AC_PROG_INSTALL -AM_INIT_AUTOMAKE([-Wall]) -AC_PROG_CC -AM_PROG_CC_C_O -AC_DISABLE_STATIC -AM_PROG_LIBTOOL - -AC_ARG_WITH([kernel], - AS_HELP_STRING([--with-kernel=PATH], - [Path to kernel source/build directory]), - [kbuilddir="$withval"; ksourcedir="$withval";]) -AC_ARG_WITH([kbuild], - AS_HELP_STRING([--with-kbuild=PATH], - [Path to kernel build directory [[/lib/modules/CURRENT/build]]]), - [kbuilddir="$withval"]) -AC_ARG_WITH([ksource], - AS_HELP_STRING([--with-ksource=PATH], - [Path to kernel source directory [[/lib/modules/CURRENT/source]]]), - [ksourcedir="$withval"]) -AC_ARG_WITH([xtlibdir], - AS_HELP_STRING([--with-xtlibdir=PATH], - [Path where to install Xtables extensions [[LIBEXECDIR/xtables]]]), - [xtlibdir="$withval"], - [xtlibdir="${libexecdir}/xtables"]) -AC_ARG_ENABLE([ipv4], - AS_HELP_STRING([--disable-ipv4], [Do not build iptables]), - [enable_ipv4="$enableval"], [enable_ipv4="yes"]) -AC_ARG_ENABLE([ipv6], - AS_HELP_STRING([--disable-ipv6], [Do not build ip6tables]), - [enable_ipv6="$enableval"], [enable_ipv6="yes"]) -AC_ARG_ENABLE([largefile], - AS_HELP_STRING([--disable-largefile], [Do not build largefile support]), - [enable_largefile="$enableval"], - [enable_largefile="yes"; - largefile_cppflags='-D_LARGEFILE_SOURCE=1 -D_LARGE_FILES -D_FILE_OFFSET_BITS=64']) -AC_ARG_ENABLE([devel], - AS_HELP_STRING([--enable-devel], - [Install Xtables development headers]), - [enable_devel="$enableval"], [enable_devel="yes"]) -AC_ARG_ENABLE([libipq], - AS_HELP_STRING([--enable-libipq], [Build and install libipq])) -AC_ARG_WITH([pkgconfigdir], AS_HELP_STRING([--with-pkgconfigdir=PATH], - [Path to the pkgconfig directory [[LIBDIR/pkgconfig]]]), - [pkgconfigdir="$withval"], [pkgconfigdir='${libdir}/pkgconfig']) - -libiptc_LDFLAGS2=""; -AX_CHECK_LINKER_FLAGS([-Wl,--no-as-needed], - [libiptc_LDFLAGS2="-Wl,--no-as-needed"]) -AC_SUBST([libiptc_LDFLAGS2]) - -blacklist_modules=""; - -AC_CHECK_HEADER([linux/dccp.h]) -if test "$ac_cv_header_linux_dccp_h" != "yes"; then - blacklist_modules="$blacklist_modules dccp"; -fi; - -AC_CHECK_HEADER([linux/ip_vs.h]) -if test "$ac_cv_header_linux_ip_vs_h" != "yes"; then - blacklist_modules="$blacklist_modules ipvs"; -fi; - -AC_SUBST([blacklist_modules]) - -AM_CONDITIONAL([ENABLE_STATIC], [test "$enable_static" = "yes"]) -AM_CONDITIONAL([ENABLE_SHARED], [test "$enable_shared" = "yes"]) -AM_CONDITIONAL([ENABLE_IPV4], [test "$enable_ipv4" = "yes"]) -AM_CONDITIONAL([ENABLE_IPV6], [test "$enable_ipv6" = "yes"]) -AM_CONDITIONAL([ENABLE_LARGEFILE], [test "$enable_largefile" = "yes"]) -AM_CONDITIONAL([ENABLE_DEVEL], [test "$enable_devel" = "yes"]) -AM_CONDITIONAL([ENABLE_LIBIPQ], [test "$enable_libipq" = "yes"]) - -PKG_CHECK_MODULES([libnfnetlink], [libnfnetlink >= 1.0], - [nfnetlink=1], [nfnetlink=0]) -AM_CONDITIONAL([HAVE_LIBNFNETLINK], [test "$nfnetlink" = 1]) - -regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \ - -Wmissing-prototypes -Wredundant-decls -Wshadow -Wstrict-prototypes \ - -Winline -pipe"; -regular_CPPFLAGS="${largefile_cppflags} -D_REENTRANT \ - -DXTABLES_LIBDIR=\\\"\${xtlibdir}\\\" -DXTABLES_INTERNAL"; -kinclude_CPPFLAGS=""; -if [[ -n "$kbuilddir" ]]; then - kinclude_CPPFLAGS="$kinclude_CPPFLAGS -I$kbuilddir/include"; -fi; -if [[ -n "$ksourcedir" ]]; then - kinclude_CPPFLAGS="$kinclude_CPPFLAGS -I$ksourcedir/include"; -fi; -pkgdatadir='${datadir}/xtables'; - -AC_SUBST([regular_CFLAGS]) -AC_SUBST([regular_CPPFLAGS]) -AC_SUBST([kinclude_CPPFLAGS]) -AC_SUBST([kbuilddir]) -AC_SUBST([ksourcedir]) -AC_SUBST([xtlibdir]) -AC_SUBST([pkgconfigdir]) -AC_SUBST([pkgdatadir]) -AC_SUBST([libxtables_vcurrent]) -AC_SUBST([libxtables_vage]) -libxtables_vmajor=$(($libxtables_vcurrent - $libxtables_vage)); -AC_SUBST([libxtables_vmajor]) - -AC_CONFIG_FILES([Makefile extensions/GNUmakefile include/Makefile - iptables/Makefile iptables/xtables.pc - libipq/Makefile libiptc/Makefile libiptc/libiptc.pc utils/Makefile - include/xtables.h include/iptables/internal.h]) -AC_OUTPUT diff --git a/src/main/jni/iptables/extensions/Android.mk b/src/main/jni/iptables/extensions/Android.mk deleted file mode 100644 index 2c172b6b..00000000 --- a/src/main/jni/iptables/extensions/Android.mk +++ /dev/null @@ -1,179 +0,0 @@ -LOCAL_PATH:= $(call my-dir) -#---------------------------------------------------------------- -## extension - -MY_srcdir:=$(LOCAL_PATH) -# Exclude some modules that are problematic to compile (types/header). -MY_excluded_modules:=TCPOPTSTRIP - -MY_pfx_build_mod := $(patsubst ${MY_srcdir}/libxt_%.c,%,$(wildcard ${MY_srcdir}/libxt_*.c)) -MY_pf4_build_mod := $(patsubst ${MY_srcdir}/libipt_%.c,%,$(wildcard ${MY_srcdir}/libipt_*.c)) -MY_pf6_build_mod := $(patsubst ${MY_srcdir}/libip6t_%.c,%,$(wildcard ${MY_srcdir}/libip6t_*.c)) -MY_pfx_build_mod := $(filter-out ${MY_excluded_modules} dccp ipvs,${MY_pfx_build_mod}) -MY_pf4_build_mod := $(filter-out ${MY_excluded_modules} dccp ipvs,${MY_pf4_build_mod}) -MY_pf6_build_mod := $(filter-out ${MY_excluded_modules} dccp ipvs,${MY_pf6_build_mod}) -MY_pfx_objs := $(patsubst %,libxt_%.o,${MY_pfx_build_mod}) -MY_pf4_objs := $(patsubst %,libipt_%.o,${MY_pf4_build_mod}) -MY_pf6_objs := $(patsubst %,libip6t_%.o,${MY_pf6_build_mod}) - -#---------------------------------------------------------------- -# libext -# TODO(jpa): Trun this into a function/macro as libext{,4,6} are all the same. - -include $(CLEAR_VARS) - -LOCAL_MODULE_TAGS:= -LOCAL_MODULE:=libext - -# LOCAL_MODULE_CLASS must be defined before calling $(local-intermediates-dir) -# -LOCAL_MODULE_CLASS := STATIC_LIBRARIES - -# LOCAL_PATH needed because of dirty #include "blabla.c" -LOCAL_C_INCLUDES:= \ - $(LOCAL_PATH)/../include/ \ - $(KERNEL_HEADERS) \ - $(LOCAL_PATH) - -LOCAL_CFLAGS:=-DNO_SHARED_LIBS=1 -# The $* does not work as expected. It ends up empty. Even with SECONDEXPANSION. -# LOCAL_CFLAGS+=-D_INIT=lib$*_init -LOCAL_CFLAGS+=-DXTABLES_INTERNAL -# Accommodate arm-eabi-4.4.3 tools that don't set __ANDROID__ -LOCAL_CFLAGS+=-D__ANDROID__ - -MY_initext_func := $(addprefix xt_,${MY_pfx_build_mod}) -MY_GEN_INITEXT:= $(LOCAL_PATH)/gen_initext.c -$(info $(shell \ - if [ ! -e $(MY_GEN_INITEXT) ]; then \ - echo "GEN initext.c"; \ - echo "" >$(MY_GEN_INITEXT); \ - for i in $(MY_initext_func); do \ - echo "extern void lib$${i}_init(void);" >>$(MY_GEN_INITEXT); \ - done; \ - echo "void init_extensions(void);" >>$(MY_GEN_INITEXT); \ - echo "void init_extensions(void)" >>$(MY_GEN_INITEXT); \ - echo "{" >>$(MY_GEN_INITEXT); \ - for i in $(MY_initext_func); do \ - echo " ""lib$${i}_init();" >>$(MY_GEN_INITEXT); \ - sed "s/_init(void)/lib$${i}_init(void)/" $(LOCAL_PATH)/lib$${i}.c > $(LOCAL_PATH)/gen_lib$${i}.c; \ - done; \ - echo "}" >>$(MY_GEN_INITEXT); \ - fi; )) - -MY_lib_sources:= \ - $(patsubst %,gen_libxt_%.c,${MY_pfx_build_mod}) - -LOCAL_SRC_FILES := \ - gen_initext.c \ - $(MY_lib_sources) - -include $(BUILD_STATIC_LIBRARY) - -#---------------------------------------------------------------- -# libext4 - -include $(CLEAR_VARS) - -LOCAL_MODULE_TAGS:= -LOCAL_MODULE:=libext4 - -# LOCAL_MODULE_CLASS must be defined before calling $(local-intermediates-dir) -# -LOCAL_MODULE_CLASS := STATIC_LIBRARIES - -# LOCAL_PATH needed because of dirty #include "blabla.c" -LOCAL_C_INCLUDES:= \ - $(LOCAL_PATH)/../include/ \ - $(KERNEL_HEADERS) \ - $(LOCAL_PATH)/ - -LOCAL_CFLAGS:=-DNO_SHARED_LIBS=1 -# The $* does not work as expected. It ends up empty. Even with SECONDEXPANSION. -# LOCAL_CFLAGS+=-D_INIT=lib$*_init -LOCAL_CFLAGS+=-DXTABLES_INTERNAL -# Accommodate arm-eabi-4.4.3 tools that don't set __ANDROID__ -LOCAL_CFLAGS+=-D__ANDROID__ - -MY_initext4_func := $(addprefix ipt_,${MY_pf4_build_mod}) -MY_GEN_INITEXT4:= $(LOCAL_PATH)/gen_initext4.c -$(info $(shell \ - if [ ! -e $(MY_GEN_INITEXT4) ]; then \ - echo "GEN initext4.c"; \ - echo "" >$(MY_GEN_INITEXT4); \ - for i in $(MY_initext4_func); do \ - echo "extern void lib$${i}_init(void);" >>$(MY_GEN_INITEXT4); \ - done; \ - echo "void init_extensions4(void);" >>$(MY_GEN_INITEXT4); \ - echo "void init_extensions4(void)" >>$(MY_GEN_INITEXT4); \ - echo "{" >>$(MY_GEN_INITEXT4); \ - for i in $(MY_initext4_func); do \ - echo " ""lib$${i}_init();" >>$(MY_GEN_INITEXT4); \ - sed "s/_init(void)/lib$${i}_init(void)/" $(LOCAL_PATH)/lib$${i}.c > $(LOCAL_PATH)/gen_lib$${i}.c; \ - done; \ - echo "}" >>$(MY_GEN_INITEXT4); \ - fi; )) - -MY_lib_sources:= \ - $(patsubst %,gen_libipt_%.c,${MY_pf4_build_mod}) - -LOCAL_SRC_FILES := \ - gen_initext4.c \ - $(MY_lib_sources) - -include $(BUILD_STATIC_LIBRARY) - -#---------------------------------------------------------------- -# libext6 - -include $(CLEAR_VARS) - -LOCAL_MODULE_TAGS:= -LOCAL_MODULE:=libext6 - -# LOCAL_MODULE_CLASS must be defined before calling $(local-intermediates-dir) -# -LOCAL_MODULE_CLASS := STATIC_LIBRARIES - -# LOCAL_PATH needed because of dirty #include "blabla.c" -LOCAL_C_INCLUDES:= \ - $(LOCAL_PATH)/../include/ \ - $(KERNEL_HEADERS) \ - $(LOCAL_PATH) - -LOCAL_CFLAGS:=-DNO_SHARED_LIBS=1 -# The $* does not work as expected. It ends up empty. Even with SECONDEXPANSION. -# LOCAL_CFLAGS+=-D_INIT=lib$*_init -LOCAL_CFLAGS+=-DXTABLES_INTERNAL -# Accommodate arm-eabi-4.4.3 tools that don't set __ANDROID__ -LOCAL_CFLAGS+=-D__ANDROID__ - -MY_initext6_func := $(addprefix ip6t_,${MY_pf6_build_mod}) -MY_GEN_INITEXT6:= $(LOCAL_PATH)/gen_initext6.c -$(info $(shell \ - if [ ! -e $(MY_GEN_INITEXT6) ]; then \ - echo "GEN initext6.c"; \ - echo "" >$(MY_GEN_INITEXT6); \ - for i in $(MY_initext6_func); do \ - echo "extern void lib$${i}_init(void);" >>$(MY_GEN_INITEXT6); \ - done; \ - echo "void init_extensions6(void);" >>$(MY_GEN_INITEXT6); \ - echo "void init_extensions6(void)" >>$(MY_GEN_INITEXT6); \ - echo "{" >>$(MY_GEN_INITEXT6); \ - for i in $(MY_initext6_func); do \ - echo " ""lib$${i}_init();" >>$(MY_GEN_INITEXT6); \ - sed "s/_init(void)/lib$${i}_init(void)/" $(LOCAL_PATH)/lib$${i}.c > $(LOCAL_PATH)/gen_lib$${i}.c; \ - done; \ - echo "}" >>$(MY_GEN_INITEXT6); \ - fi; )) - -MY_lib_sources:= \ - $(patsubst %,gen_libip6t_%.c,${MY_pf6_build_mod}) - -LOCAL_SRC_FILES := \ - gen_initext6.c \ - $(MY_lib_sources) - -include $(BUILD_STATIC_LIBRARY) - -#---------------------------------------------------------------- diff --git a/src/main/jni/iptables/extensions/GNUmakefile.in b/src/main/jni/iptables/extensions/GNUmakefile.in deleted file mode 100644 index fbaf2eca..00000000 --- a/src/main/jni/iptables/extensions/GNUmakefile.in +++ /dev/null @@ -1,220 +0,0 @@ -# -*- Makefile -*- - -top_builddir := @top_builddir@ -builddir := @builddir@ -top_srcdir := @top_srcdir@ -srcdir := @srcdir@ -ksourcedir := @ksourcedir@ -prefix := @prefix@ -exec_prefix := @exec_prefix@ -libdir := @libdir@ -libexecdir := @libexecdir@ -xtlibdir := @xtlibdir@ - -CC := @CC@ -CCLD := ${CC} -CFLAGS := @CFLAGS@ -CPPFLAGS := @CPPFLAGS@ -LDFLAGS := @LDFLAGS@ -regular_CFLAGS := @regular_CFLAGS@ -regular_CPPFLAGS := @regular_CPPFLAGS@ -kinclude_CPPFLAGS := @kinclude_CPPFLAGS@ - -AM_CFLAGS := ${regular_CFLAGS} -AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include -I${top_srcdir}/include ${kinclude_CPPFLAGS} -AM_DEPFLAGS = -Wp,-MMD,$(@D)/.$(@F).d,-MT,$@ - -ifeq (${V},) -AM_LIBTOOL_SILENT = --silent -AM_VERBOSE_CC = @echo " CC " $@; -AM_VERBOSE_CCLD = @echo " CCLD " $@; -AM_VERBOSE_CXX = @echo " CXX " $@; -AM_VERBOSE_CXXLD = @echo " CXXLD " $@; -AM_VERBOSE_AR = @echo " AR " $@; -AM_VERBOSE_GEN = @echo " GEN " $@; -endif - -# -# Wildcard module list -# -pfx_build_mod := $(patsubst ${srcdir}/libxt_%.c,%,$(wildcard ${srcdir}/libxt_*.c)) -@ENABLE_IPV4_TRUE@ pf4_build_mod := $(patsubst ${srcdir}/libipt_%.c,%,$(wildcard ${srcdir}/libipt_*.c)) -@ENABLE_IPV6_TRUE@ pf6_build_mod := $(patsubst ${srcdir}/libip6t_%.c,%,$(wildcard ${srcdir}/libip6t_*.c)) -pfx_build_mod := $(filter-out @blacklist_modules@,${pfx_build_mod}) -pf4_build_mod := $(filter-out @blacklist_modules@,${pf4_build_mod}) -pf6_build_mod := $(filter-out @blacklist_modules@,${pf6_build_mod}) -pfx_objs := $(patsubst %,libxt_%.o,${pfx_build_mod}) -pf4_objs := $(patsubst %,libipt_%.o,${pf4_build_mod}) -pf6_objs := $(patsubst %,libip6t_%.o,${pf6_build_mod}) -pfx_solibs := $(patsubst %,libxt_%.so,${pfx_build_mod}) -pf4_solibs := $(patsubst %,libipt_%.so,${pf4_build_mod}) -pf6_solibs := $(patsubst %,libip6t_%.so,${pf6_build_mod}) - - -# -# Building blocks -# -targets := libext.a libext4.a libext6.a \ - matches4.man matches6.man \ - targets4.man targets6.man -targets_install := -@ENABLE_STATIC_TRUE@ libext_objs := ${pfx_objs} -@ENABLE_STATIC_TRUE@ libext4_objs := ${pf4_objs} -@ENABLE_STATIC_TRUE@ libext6_objs := ${pf6_objs} -@ENABLE_STATIC_FALSE@ targets += ${pfx_solibs} ${pf4_solibs} ${pf6_solibs} -@ENABLE_STATIC_FALSE@ targets_install += ${pfx_solibs} ${pf4_solibs} ${pf6_solibs} - -.SECONDARY: - -.PHONY: all install clean distclean FORCE - -all: ${targets} - -install: ${targets_install} - @mkdir -p "${DESTDIR}${xtlibdir}"; - if test -n "${targets_install}"; then install -pm0755 $^ "${DESTDIR}${xtlibdir}/"; fi; - -clean: - rm -f *.o *.oo *.so *.a {matches,targets}[46].man initext.c initext4.c initext6.c; - -distclean: clean - rm -f .*.d .*.dd; - -init%.o: init%.c - ${AM_VERBOSE_CC} ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -D_INIT=$*_init ${CFLAGS} -o $@ -c $<; - --include .*.d - - -# -# Shared libraries -# -lib%.so: lib%.oo - ${AM_VERBOSE_CCLD} ${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $<; - -lib%.oo: ${srcdir}/lib%.c - ${AM_VERBOSE_CC} ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -D_INIT=lib$*_init -DPIC -fPIC ${CFLAGS} -o $@ -c $<; - - -# -# Static bits -# -# If static building is disabled, libext*.a will still be generated, -# but will be empty. This is good since we can do with less case -# handling code in the Makefiles. -# -lib%.o: ${srcdir}/lib%.c - ${AM_VERBOSE_CC} ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -DNO_SHARED_LIBS=1 -D_INIT=lib$*_init ${CFLAGS} -o $@ -c $<; - -libext.a: initext.o ${libext_objs} - ${AM_VERBOSE_AR} ${AR} crs $@ $^; - -libext4.a: initext4.o ${libext4_objs} - ${AM_VERBOSE_AR} ${AR} crs $@ $^; - -libext6.a: initext6.o ${libext6_objs} - ${AM_VERBOSE_AR} ${AR} crs $@ $^; - -initext_func := $(addprefix xt_,${pfx_build_mod}) -initext4_func := $(addprefix ipt_,${pf4_build_mod}) -initext6_func := $(addprefix ip6t_,${pf6_build_mod}) - -.initext.dd: FORCE - @echo "${initext_func}" >$@.tmp; \ - cmp -s $@ $@.tmp || mv $@.tmp $@; \ - rm -f $@.tmp; - -.initext4.dd: FORCE - @echo "${initext4_func}" >$@.tmp; \ - cmp -s $@ $@.tmp || mv $@.tmp $@; \ - rm -f $@.tmp; - -.initext6.dd: FORCE - @echo "${initext6_func}" >$@.tmp; \ - cmp -s $@ $@.tmp || mv $@.tmp $@; \ - rm -f $@.tmp; - -initext.c: .initext.dd - ${AM_VERBOSE_GEN} - @( \ - echo "" >$@; \ - for i in ${initext_func}; do \ - echo "extern void lib$${i}_init(void);" >>$@; \ - done; \ - echo "void init_extensions(void);" >>$@; \ - echo "void init_extensions(void)" >>$@; \ - echo "{" >>$@; \ - for i in ${initext_func}; do \ - echo " ""lib$${i}_init();" >>$@; \ - done; \ - echo "}" >>$@; \ - ); - -initext4.c: .initext4.dd - ${AM_VERBOSE_GEN} - @( \ - echo "" >$@; \ - for i in ${initext4_func}; do \ - echo "extern void lib$${i}_init(void);" >>$@; \ - done; \ - echo "void init_extensions4(void);" >>$@; \ - echo "void init_extensions4(void)" >>$@; \ - echo "{" >>$@; \ - for i in ${initext4_func}; do \ - echo " ""lib$${i}_init();" >>$@; \ - done; \ - echo "}" >>$@; \ - ); - -initext6.c: .initext6.dd - ${AM_VERBOSE_GEN} - @( \ - echo "" >$@; \ - for i in ${initext6_func}; do \ - echo "extern void lib$${i}_init(void);" >>$@; \ - done; \ - echo "void init_extensions6(void);" >>$@; \ - echo "void init_extensions6(void)" >>$@; \ - echo "{" >>$@; \ - for i in ${initext6_func}; do \ - echo " ""lib$${i}_init();" >>$@; \ - done; \ - echo "}" >>$@; \ - ); - -# -# Manual pages -# -ex_matches = $(sort $(shell echo $(1) | LC_ALL=POSIX grep -Eo '\b[[:lower:][:digit:]_]+\b')) -ex_targets = $(sort $(shell echo $(1) | LC_ALL=POSIX grep -Eo '\b[[:upper:][:digit:]_]+\b')) -man_run = \ - ${AM_VERBOSE_GEN} \ - for ext in $(1); do \ - f="${srcdir}/libxt_$$ext.man"; \ - cf="${srcdir}/libxt_$$ext.c"; \ - if [ -f "$$f" ] && grep -Eq "$(3)|NFPROTO_UNSPEC" "$$cf"; then \ - echo -e "\t+ $$f" >&2; \ - echo ".SS $$ext"; \ - cat "$$f" || exit $$?; \ - continue; \ - fi; \ - f="${srcdir}/lib$(2)t_$$ext.man"; \ - if [ -f "$$f" ]; then \ - echo -e "\t+ $$f" >&2; \ - echo ".SS $$ext"; \ - cat "$$f" || exit $$?; \ - continue; \ - fi; \ - done >$@; - -matches4.man: .initext.dd .initext4.dd $(wildcard ${srcdir}/lib*.man) - $(call man_run,$(call ex_matches,${pfx_build_mod} ${pf4_build_mod}),ip,NFPROTO_IPV4) - -matches6.man: .initext.dd .initext6.dd $(wildcard ${srcdir}/lib*.man) - $(call man_run,$(call ex_matches,${pfx_build_mod} ${pf6_build_mod}),ip6,NFPROTO_IPV6) - -targets4.man: .initext.dd .initext4.dd $(wildcard ${srcdir}/lib*.man) - $(call man_run,$(call ex_targets,${pfx_build_mod} ${pf4_build_mod}),ip,NFPROTO_IPV4) - -targets6.man: .initext.dd .initext6.dd $(wildcard ${srcdir}/lib*.man) - $(call man_run,$(call ex_targets,${pfx_build_mod} ${pf6_build_mod}),ip6,NFPROTO_IPV6) diff --git a/src/main/jni/iptables/extensions/dscp_helper.c b/src/main/jni/iptables/extensions/dscp_helper.c deleted file mode 100644 index 75b1fece..00000000 --- a/src/main/jni/iptables/extensions/dscp_helper.c +++ /dev/null @@ -1,79 +0,0 @@ -/* - * DiffServ classname <-> DiffServ codepoint mapping functions. - * - * The latest list of the mappings can be found at: - * - * - * This code is released under the GNU GPL v2, 1991 - * - * Author: Iain Barnes - */ - -#include -#include -#include - - -static const struct ds_class -{ - const char *name; - unsigned int dscp; -} ds_classes[] = -{ - { "CS0", 0x00 }, - { "CS1", 0x08 }, - { "CS2", 0x10 }, - { "CS3", 0x18 }, - { "CS4", 0x20 }, - { "CS5", 0x28 }, - { "CS6", 0x30 }, - { "CS7", 0x38 }, - { "BE", 0x00 }, - { "AF11", 0x0a }, - { "AF12", 0x0c }, - { "AF13", 0x0e }, - { "AF21", 0x12 }, - { "AF22", 0x14 }, - { "AF23", 0x16 }, - { "AF31", 0x1a }, - { "AF32", 0x1c }, - { "AF33", 0x1e }, - { "AF41", 0x22 }, - { "AF42", 0x24 }, - { "AF43", 0x26 }, - { "EF", 0x2e } -}; - - - -static unsigned int -class_to_dscp(const char *name) -{ - unsigned int i; - - for (i = 0; i < ARRAY_SIZE(ds_classes); i++) { - if (!strncasecmp(name, ds_classes[i].name, - strlen(ds_classes[i].name))) - return ds_classes[i].dscp; - } - - xtables_error(PARAMETER_PROBLEM, - "Invalid DSCP value `%s'\n", name); -} - - -#if 0 -static const char * -dscp_to_name(unsigned int dscp) -{ - int i; - - for (i = 0; i < ARRAY_SIZE(ds_classes); ++i) - if (dscp == ds_classes[i].dscp) - return ds_classes[i].name; - - xtables_error(PARAMETER_PROBLEM, - "Invalid DSCP value `%d'\n", dscp); -} -#endif - diff --git a/src/main/jni/iptables/extensions/filter_init b/src/main/jni/iptables/extensions/filter_init deleted file mode 100755 index 2fcdd6dc..00000000 --- a/src/main/jni/iptables/extensions/filter_init +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/sh -# This is for working around Android.mk's incapability to handle $* in CFLAGS, -# even with SECONDEXPNASION. -# LOCAL_CFLAGS:=-D_INIT=$*_init -f=${1##*/} -f=${f%%.*} -sed "s/\([ ]*\)\(_init\)\(([ ]*void\)/\1${f}_init\3/" $1 diff --git a/src/main/jni/iptables/extensions/libip6t_LOG.c b/src/main/jni/iptables/extensions/libip6t_LOG.c deleted file mode 100644 index a419ec91..00000000 --- a/src/main/jni/iptables/extensions/libip6t_LOG.c +++ /dev/null @@ -1,184 +0,0 @@ -#include -#include -#include -#include -#include - -#ifndef IP6T_LOG_UID /* Old kernel */ -#define IP6T_LOG_UID 0x08 -#undef IP6T_LOG_MASK -#define IP6T_LOG_MASK 0x0f -#endif - -#define LOG_DEFAULT_LEVEL LOG_WARNING - -enum { - O_LOG_LEVEL = 0, - O_LOG_PREFIX, - O_LOG_TCPSEQ, - O_LOG_TCPOPTS, - O_LOG_IPOPTS, - O_LOG_UID, - O_LOG_MAC, -}; - -static void LOG_help(void) -{ - printf( -"LOG target options:\n" -" --log-level level Level of logging (numeric or see syslog.conf)\n" -" --log-prefix prefix Prefix log messages with this prefix.\n" -" --log-tcp-sequence Log TCP sequence numbers.\n" -" --log-tcp-options Log TCP options.\n" -" --log-ip-options Log IP options.\n" -" --log-uid Log UID owning the local socket.\n" -" --log-macdecode Decode MAC addresses and protocol.\n"); -} - -#define s struct ip6t_log_info -static const struct xt_option_entry LOG_opts[] = { - {.name = "log-level", .id = O_LOG_LEVEL, .type = XTTYPE_SYSLOGLEVEL, - .flags = XTOPT_PUT, XTOPT_POINTER(s, level)}, - {.name = "log-prefix", .id = O_LOG_PREFIX, .type = XTTYPE_STRING, - .flags = XTOPT_PUT, XTOPT_POINTER(s, prefix), .min = 1}, - {.name = "log-tcp-sequence", .id = O_LOG_TCPSEQ, .type = XTTYPE_NONE}, - {.name = "log-tcp-options", .id = O_LOG_TCPOPTS, .type = XTTYPE_NONE}, - {.name = "log-ip-options", .id = O_LOG_IPOPTS, .type = XTTYPE_NONE}, - {.name = "log-uid", .id = O_LOG_UID, .type = XTTYPE_NONE}, - {.name = "log-macdecode", .id = O_LOG_MAC, .type = XTTYPE_NONE}, - XTOPT_TABLEEND, -}; -#undef s - -static void LOG_init(struct xt_entry_target *t) -{ - struct ip6t_log_info *loginfo = (struct ip6t_log_info *)t->data; - - loginfo->level = LOG_DEFAULT_LEVEL; - -} - -struct ip6t_log_names { - const char *name; - unsigned int level; -}; - -static const struct ip6t_log_names ip6t_log_names[] -= { { .name = "alert", .level = LOG_ALERT }, - { .name = "crit", .level = LOG_CRIT }, - { .name = "debug", .level = LOG_DEBUG }, - { .name = "emerg", .level = LOG_EMERG }, - { .name = "error", .level = LOG_ERR }, /* DEPRECATED */ - { .name = "info", .level = LOG_INFO }, - { .name = "notice", .level = LOG_NOTICE }, - { .name = "panic", .level = LOG_EMERG }, /* DEPRECATED */ - { .name = "warning", .level = LOG_WARNING } -}; - -static void LOG_parse(struct xt_option_call *cb) -{ - struct ip6t_log_info *info = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_LOG_PREFIX: - if (strchr(cb->arg, '\n') != NULL) - xtables_error(PARAMETER_PROBLEM, - "Newlines not allowed in --log-prefix"); - break; - case O_LOG_TCPSEQ: - info->logflags = IP6T_LOG_TCPSEQ; - break; - case O_LOG_TCPOPTS: - info->logflags = IP6T_LOG_TCPOPT; - break; - case O_LOG_IPOPTS: - info->logflags = IP6T_LOG_IPOPT; - break; - case O_LOG_UID: - info->logflags = IP6T_LOG_UID; - break; - case O_LOG_MAC: - info->logflags = IP6T_LOG_MACDECODE; - break; - } -} - -static void LOG_print(const void *ip, const struct xt_entry_target *target, - int numeric) -{ - const struct ip6t_log_info *loginfo - = (const struct ip6t_log_info *)target->data; - unsigned int i = 0; - - printf(" LOG"); - if (numeric) - printf(" flags %u level %u", - loginfo->logflags, loginfo->level); - else { - for (i = 0; i < ARRAY_SIZE(ip6t_log_names); ++i) - if (loginfo->level == ip6t_log_names[i].level) { - printf(" level %s", ip6t_log_names[i].name); - break; - } - if (i == ARRAY_SIZE(ip6t_log_names)) - printf(" UNKNOWN level %u", loginfo->level); - if (loginfo->logflags & IP6T_LOG_TCPSEQ) - printf(" tcp-sequence"); - if (loginfo->logflags & IP6T_LOG_TCPOPT) - printf(" tcp-options"); - if (loginfo->logflags & IP6T_LOG_IPOPT) - printf(" ip-options"); - if (loginfo->logflags & IP6T_LOG_UID) - printf(" uid"); - if (loginfo->logflags & IP6T_LOG_MACDECODE) - printf(" macdecode"); - if (loginfo->logflags & ~(IP6T_LOG_MASK)) - printf(" unknown-flags"); - } - - if (strcmp(loginfo->prefix, "") != 0) - printf(" prefix \"%s\"", loginfo->prefix); -} - -static void LOG_save(const void *ip, const struct xt_entry_target *target) -{ - const struct ip6t_log_info *loginfo - = (const struct ip6t_log_info *)target->data; - - if (strcmp(loginfo->prefix, "") != 0) - printf(" --log-prefix \"%s\"", loginfo->prefix); - - if (loginfo->level != LOG_DEFAULT_LEVEL) - printf(" --log-level %d", loginfo->level); - - if (loginfo->logflags & IP6T_LOG_TCPSEQ) - printf(" --log-tcp-sequence"); - if (loginfo->logflags & IP6T_LOG_TCPOPT) - printf(" --log-tcp-options"); - if (loginfo->logflags & IP6T_LOG_IPOPT) - printf(" --log-ip-options"); - if (loginfo->logflags & IP6T_LOG_UID) - printf(" --log-uid"); - if (loginfo->logflags & IP6T_LOG_MACDECODE) - printf(" --log-macdecode"); -} - -static struct xtables_target log_tg6_reg = { - .name = "LOG", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV6, - .size = XT_ALIGN(sizeof(struct ip6t_log_info)), - .userspacesize = XT_ALIGN(sizeof(struct ip6t_log_info)), - .help = LOG_help, - .init = LOG_init, - .print = LOG_print, - .save = LOG_save, - .x6_parse = LOG_parse, - .x6_options = LOG_opts, -}; - -void _init(void) -{ - xtables_register_target(&log_tg6_reg); -} diff --git a/src/main/jni/iptables/extensions/libip6t_LOG.man b/src/main/jni/iptables/extensions/libip6t_LOG.man deleted file mode 100644 index b7803fed..00000000 --- a/src/main/jni/iptables/extensions/libip6t_LOG.man +++ /dev/null @@ -1,31 +0,0 @@ -Turn on kernel logging of matching packets. When this option is set -for a rule, the Linux kernel will print some information on all -matching packets (like most IPv6 IPv6-header fields) via the kernel log -(where it can be read with -.I dmesg -or -.IR syslogd (8)). -This is a "non-terminating target", i.e. rule traversal continues at -the next rule. So if you want to LOG the packets you refuse, use two -separate rules with the same matching criteria, first using target LOG -then DROP (or REJECT). -.TP -\fB\-\-log\-level\fP \fIlevel\fP -Level of logging (numeric or see \fIsyslog.conf\fP(5)). -.TP -\fB\-\-log\-prefix\fP \fIprefix\fP -Prefix log messages with the specified prefix; up to 29 letters long, -and useful for distinguishing messages in the logs. -.TP -\fB\-\-log\-tcp\-sequence\fP -Log TCP sequence numbers. This is a security risk if the log is -readable by users. -.TP -\fB\-\-log\-tcp\-options\fP -Log options from the TCP packet header. -.TP -\fB\-\-log\-ip\-options\fP -Log options from the IPv6 packet header. -.TP -\fB\-\-log\-uid\fP -Log the userid of the process which generated the packet. diff --git a/src/main/jni/iptables/extensions/libip6t_REJECT.c b/src/main/jni/iptables/extensions/libip6t_REJECT.c deleted file mode 100644 index 8085321a..00000000 --- a/src/main/jni/iptables/extensions/libip6t_REJECT.c +++ /dev/null @@ -1,140 +0,0 @@ -/* Shared library add-on to ip6tables to add customized REJECT support. - * - * (C) 2000 Jozsef Kadlecsik - * - * ported to IPv6 by Harald Welte - * - */ -#include -#include -#include -#include - -struct reject_names { - const char *name; - const char *alias; - enum ip6t_reject_with with; - const char *desc; -}; - -enum { - O_REJECT_WITH = 0, -}; - -static const struct reject_names reject_table[] = { - {"icmp6-no-route", "no-route", - IP6T_ICMP6_NO_ROUTE, "ICMPv6 no route"}, - {"icmp6-adm-prohibited", "adm-prohibited", - IP6T_ICMP6_ADM_PROHIBITED, "ICMPv6 administratively prohibited"}, -#if 0 - {"icmp6-not-neighbor", "not-neighbor"}, - IP6T_ICMP6_NOT_NEIGHBOR, "ICMPv6 not a neighbor"}, -#endif - {"icmp6-addr-unreachable", "addr-unreach", - IP6T_ICMP6_ADDR_UNREACH, "ICMPv6 address unreachable"}, - {"icmp6-port-unreachable", "port-unreach", - IP6T_ICMP6_PORT_UNREACH, "ICMPv6 port unreachable"}, - {"tcp-reset", "tcp-reset", - IP6T_TCP_RESET, "TCP RST packet"} -}; - -static void -print_reject_types(void) -{ - unsigned int i; - - printf("Valid reject types:\n"); - - for (i = 0; i < ARRAY_SIZE(reject_table); ++i) { - printf(" %-25s\t%s\n", reject_table[i].name, reject_table[i].desc); - printf(" %-25s\talias\n", reject_table[i].alias); - } - printf("\n"); -} - -static void REJECT_help(void) -{ - printf( -"REJECT target options:\n" -"--reject-with type drop input packet and send back\n" -" a reply packet according to type:\n"); - - print_reject_types(); -} - -static const struct xt_option_entry REJECT_opts[] = { - {.name = "reject-with", .id = O_REJECT_WITH, .type = XTTYPE_STRING}, - XTOPT_TABLEEND, -}; - -static void REJECT_init(struct xt_entry_target *t) -{ - struct ip6t_reject_info *reject = (struct ip6t_reject_info *)t->data; - - /* default */ - reject->with = IP6T_ICMP6_PORT_UNREACH; - -} - -static void REJECT_parse(struct xt_option_call *cb) -{ - struct ip6t_reject_info *reject = cb->data; - unsigned int i; - - xtables_option_parse(cb); - for (i = 0; i < ARRAY_SIZE(reject_table); ++i) - if (strncasecmp(reject_table[i].name, - cb->arg, strlen(cb->arg)) == 0 || - strncasecmp(reject_table[i].alias, - cb->arg, strlen(cb->arg)) == 0) { - reject->with = reject_table[i].with; - return; - } - xtables_error(PARAMETER_PROBLEM, - "unknown reject type \"%s\"", cb->arg); -} - -static void REJECT_print(const void *ip, const struct xt_entry_target *target, - int numeric) -{ - const struct ip6t_reject_info *reject - = (const struct ip6t_reject_info *)target->data; - unsigned int i; - - for (i = 0; i < ARRAY_SIZE(reject_table); ++i) - if (reject_table[i].with == reject->with) - break; - printf(" reject-with %s", reject_table[i].name); -} - -static void REJECT_save(const void *ip, const struct xt_entry_target *target) -{ - const struct ip6t_reject_info *reject - = (const struct ip6t_reject_info *)target->data; - unsigned int i; - - for (i = 0; i < ARRAY_SIZE(reject_table); ++i) - if (reject_table[i].with == reject->with) - break; - - printf(" --reject-with %s", reject_table[i].name); -} - -static struct xtables_target reject_tg6_reg = { - .name = "REJECT", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV6, - .size = XT_ALIGN(sizeof(struct ip6t_reject_info)), - .userspacesize = XT_ALIGN(sizeof(struct ip6t_reject_info)), - .help = REJECT_help, - .init = REJECT_init, - .print = REJECT_print, - .save = REJECT_save, - .x6_parse = REJECT_parse, - .x6_options = REJECT_opts, -}; - -void _init(void) -{ - xtables_register_target(&reject_tg6_reg); -} diff --git a/src/main/jni/iptables/extensions/libip6t_REJECT.man b/src/main/jni/iptables/extensions/libip6t_REJECT.man deleted file mode 100644 index 2d09e050..00000000 --- a/src/main/jni/iptables/extensions/libip6t_REJECT.man +++ /dev/null @@ -1,33 +0,0 @@ -This is used to send back an error packet in response to the matched -packet: otherwise it is equivalent to -.B DROP -so it is a terminating TARGET, ending rule traversal. -This target is only valid in the -.BR INPUT , -.B FORWARD -and -.B OUTPUT -chains, and user-defined chains which are only called from those -chains. The following option controls the nature of the error packet -returned: -.TP -\fB\-\-reject\-with\fP \fItype\fP -The type given can be -\fBicmp6\-no\-route\fP, -\fBno\-route\fP, -\fBicmp6\-adm\-prohibited\fP, -\fBadm\-prohibited\fP, -\fBicmp6\-addr\-unreachable\fP, -\fBaddr\-unreach\fP, -\fBicmp6\-port\-unreachable\fP or -\fBport\-unreach\fP -which return the appropriate ICMPv6 error message (\fBport\-unreach\fP is -the default). Finally, the option -\fBtcp\-reset\fP -can be used on rules which only match the TCP protocol: this causes a -TCP RST packet to be sent back. This is mainly useful for blocking -.I ident -(113/tcp) probes which frequently occur when sending mail to broken mail -hosts (which won't accept your mail otherwise). -\fBtcp\-reset\fP -can only be used with kernel versions 2.6.14 or later. diff --git a/src/main/jni/iptables/extensions/libip6t_ah.c b/src/main/jni/iptables/extensions/libip6t_ah.c deleted file mode 100644 index 26f81408..00000000 --- a/src/main/jni/iptables/extensions/libip6t_ah.c +++ /dev/null @@ -1,140 +0,0 @@ -#include -#include -#include - -enum { - O_AHSPI = 0, - O_AHLEN, - O_AHRES, -}; - -static void ah_help(void) -{ - printf( -"ah match options:\n" -"[!] --ahspi spi[:spi] match spi (range)\n" -"[!] --ahlen length total length of this header\n" -" --ahres check the reserved field too\n"); -} - -#define s struct ip6t_ah -static const struct xt_option_entry ah_opts[] = { - {.name = "ahspi", .id = O_AHSPI, .type = XTTYPE_UINT32RC, - .flags = XTOPT_INVERT | XTOPT_PUT, XTOPT_POINTER(s, spis)}, - {.name = "ahlen", .id = O_AHLEN, .type = XTTYPE_UINT32, - .flags = XTOPT_INVERT | XTOPT_PUT, XTOPT_POINTER(s, hdrlen)}, - {.name = "ahres", .id = O_AHRES, .type = XTTYPE_NONE}, - XTOPT_TABLEEND, -}; -#undef s - -static void ah_parse(struct xt_option_call *cb) -{ - struct ip6t_ah *ahinfo = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_AHSPI: - if (cb->nvals == 1) - ahinfo->spis[1] = ahinfo->spis[0]; - if (cb->invert) - ahinfo->invflags |= IP6T_AH_INV_SPI; - break; - case O_AHLEN: - if (cb->invert) - ahinfo->invflags |= IP6T_AH_INV_LEN; - break; - case O_AHRES: - ahinfo->hdrres = 1; - break; - } -} - -static void -print_spis(const char *name, uint32_t min, uint32_t max, - int invert) -{ - const char *inv = invert ? "!" : ""; - - if (min != 0 || max != 0xFFFFFFFF || invert) { - if (min == max) - printf("%s:%s%u", name, inv, min); - else - printf("%ss:%s%u:%u", name, inv, min, max); - } -} - -static void -print_len(const char *name, uint32_t len, int invert) -{ - const char *inv = invert ? "!" : ""; - - if (len != 0 || invert) - printf("%s:%s%u", name, inv, len); -} - -static void ah_print(const void *ip, const struct xt_entry_match *match, - int numeric) -{ - const struct ip6t_ah *ah = (struct ip6t_ah *)match->data; - - printf(" ah "); - print_spis("spi", ah->spis[0], ah->spis[1], - ah->invflags & IP6T_AH_INV_SPI); - print_len("length", ah->hdrlen, - ah->invflags & IP6T_AH_INV_LEN); - - if (ah->hdrres) - printf(" reserved"); - - if (ah->invflags & ~IP6T_AH_INV_MASK) - printf(" Unknown invflags: 0x%X", - ah->invflags & ~IP6T_AH_INV_MASK); -} - -static void ah_save(const void *ip, const struct xt_entry_match *match) -{ - const struct ip6t_ah *ahinfo = (struct ip6t_ah *)match->data; - - if (!(ahinfo->spis[0] == 0 - && ahinfo->spis[1] == 0xFFFFFFFF)) { - printf("%s --ahspi ", - (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !" : ""); - if (ahinfo->spis[0] - != ahinfo->spis[1]) - printf("%u:%u", - ahinfo->spis[0], - ahinfo->spis[1]); - else - printf("%u", - ahinfo->spis[0]); - } - - if (ahinfo->hdrlen != 0 || (ahinfo->invflags & IP6T_AH_INV_LEN) ) { - printf("%s --ahlen %u", - (ahinfo->invflags & IP6T_AH_INV_LEN) ? " !" : "", - ahinfo->hdrlen); - } - - if (ahinfo->hdrres != 0 ) - printf(" --ahres"); -} - -static struct xtables_match ah_mt6_reg = { - .name = "ah", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV6, - .size = XT_ALIGN(sizeof(struct ip6t_ah)), - .userspacesize = XT_ALIGN(sizeof(struct ip6t_ah)), - .help = ah_help, - .print = ah_print, - .save = ah_save, - .x6_parse = ah_parse, - .x6_options = ah_opts, -}; - -void -_init(void) -{ - xtables_register_match(&ah_mt6_reg); -} diff --git a/src/main/jni/iptables/extensions/libip6t_ah.man b/src/main/jni/iptables/extensions/libip6t_ah.man deleted file mode 100644 index 9c24dcf0..00000000 --- a/src/main/jni/iptables/extensions/libip6t_ah.man +++ /dev/null @@ -1,10 +0,0 @@ -This module matches the parameters in Authentication header of IPsec packets. -.TP -[\fB!\fP] \fB\-\-ahspi\fP \fIspi\fP[\fB:\fP\fIspi\fP] -Matches SPI. -.TP -[\fB!\fP] \fB\-\-ahlen\fP \fIlength\fP -Total length of this header in octets. -.TP -\fB\-\-ahres\fP -Matches if the reserved field is filled with zero. diff --git a/src/main/jni/iptables/extensions/libip6t_dst.c b/src/main/jni/iptables/extensions/libip6t_dst.c deleted file mode 100644 index 4125bd3d..00000000 --- a/src/main/jni/iptables/extensions/libip6t_dst.c +++ /dev/null @@ -1,191 +0,0 @@ -#include -#include -#include -#include -#include -#include - -enum { - O_DSTLEN = 0, - O_DSTOPTS, -}; - -static void dst_help(void) -{ - printf( -"dst match options:\n" -"[!] --dst-len length total length of this header\n" -" --dst-opts TYPE[:LEN][,TYPE[:LEN]...]\n" -" Options and its length (list, max: %d)\n", -IP6T_OPTS_OPTSNR); -} - -static const struct xt_option_entry dst_opts[] = { - {.name = "dst-len", .id = O_DSTLEN, .type = XTTYPE_UINT32, - .flags = XTOPT_INVERT | XTOPT_PUT, - XTOPT_POINTER(struct ip6t_opts, hdrlen)}, - {.name = "dst-opts", .id = O_DSTOPTS, .type = XTTYPE_STRING}, - XTOPT_TABLEEND, -}; - -static uint32_t -parse_opts_num(const char *idstr, const char *typestr) -{ - unsigned long int id; - char* ep; - - id = strtoul(idstr, &ep, 0); - - if ( idstr == ep ) { - xtables_error(PARAMETER_PROBLEM, - "dst: no valid digits in %s `%s'", typestr, idstr); - } - if ( id == ULONG_MAX && errno == ERANGE ) { - xtables_error(PARAMETER_PROBLEM, - "%s `%s' specified too big: would overflow", - typestr, idstr); - } - if ( *idstr != '\0' && *ep != '\0' ) { - xtables_error(PARAMETER_PROBLEM, - "dst: error parsing %s `%s'", typestr, idstr); - } - return id; -} - -static int -parse_options(const char *optsstr, uint16_t *opts) -{ - char *buffer, *cp, *next, *range; - unsigned int i; - - buffer = strdup(optsstr); - if (!buffer) - xtables_error(OTHER_PROBLEM, "strdup failed"); - - for (cp = buffer, i = 0; cp && i < IP6T_OPTS_OPTSNR; cp = next, i++) - { - next = strchr(cp, ','); - - if (next) - *next++='\0'; - - range = strchr(cp, ':'); - - if (range) { - if (i == IP6T_OPTS_OPTSNR-1) - xtables_error(PARAMETER_PROBLEM, - "too many ports specified"); - *range++ = '\0'; - } - - opts[i] = (parse_opts_num(cp, "opt") & 0xFF) << 8; - if (range) { - if (opts[i] == 0) - xtables_error(PARAMETER_PROBLEM, - "PAD0 hasn't got length"); - opts[i] |= parse_opts_num(range, "length") & 0xFF; - } else - opts[i] |= (0x00FF); - -#ifdef DEBUG - printf("opts str: %s %s\n", cp, range); - printf("opts opt: %04X\n", opts[i]); -#endif - } - - if (cp) - xtables_error(PARAMETER_PROBLEM, "too many addresses specified"); - - free(buffer); - -#ifdef DEBUG - printf("addr nr: %d\n", i); -#endif - - return i; -} - -static void dst_parse(struct xt_option_call *cb) -{ - struct ip6t_opts *optinfo = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_DSTOPTS: - optinfo->optsnr = parse_options(cb->arg, optinfo->opts); - optinfo->flags |= IP6T_OPTS_OPTS; - break; - } -} - -static void -print_options(unsigned int optsnr, uint16_t *optsp) -{ - unsigned int i; - - printf(" "); - for(i = 0; i < optsnr; i++) { - printf("%d", (optsp[i] & 0xFF00) >> 8); - - if ((optsp[i] & 0x00FF) != 0x00FF) - printf(":%d", (optsp[i] & 0x00FF)); - - printf("%c", (i != optsnr - 1) ? ',' : ' '); - } -} - -static void dst_print(const void *ip, const struct xt_entry_match *match, - int numeric) -{ - const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data; - - printf(" dst"); - if (optinfo->flags & IP6T_OPTS_LEN) - printf(" length:%s%u", - optinfo->invflags & IP6T_OPTS_INV_LEN ? "!" : "", - optinfo->hdrlen); - - if (optinfo->flags & IP6T_OPTS_OPTS) - printf(" opts"); - - print_options(optinfo->optsnr, (uint16_t *)optinfo->opts); - - if (optinfo->invflags & ~IP6T_OPTS_INV_MASK) - printf(" Unknown invflags: 0x%X", - optinfo->invflags & ~IP6T_OPTS_INV_MASK); -} - -static void dst_save(const void *ip, const struct xt_entry_match *match) -{ - const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data; - - if (optinfo->flags & IP6T_OPTS_LEN) { - printf("%s --dst-len %u", - (optinfo->invflags & IP6T_OPTS_INV_LEN) ? " !" : "", - optinfo->hdrlen); - } - - if (optinfo->flags & IP6T_OPTS_OPTS) - printf(" --dst-opts"); - - print_options(optinfo->optsnr, (uint16_t *)optinfo->opts); -} - -static struct xtables_match dst_mt6_reg = { - .name = "dst", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV6, - .size = XT_ALIGN(sizeof(struct ip6t_opts)), - .userspacesize = XT_ALIGN(sizeof(struct ip6t_opts)), - .help = dst_help, - .print = dst_print, - .save = dst_save, - .x6_parse = dst_parse, - .x6_options = dst_opts, -}; - -void -_init(void) -{ - xtables_register_match(&dst_mt6_reg); -} diff --git a/src/main/jni/iptables/extensions/libip6t_dst.man b/src/main/jni/iptables/extensions/libip6t_dst.man deleted file mode 100644 index bfbb5013..00000000 --- a/src/main/jni/iptables/extensions/libip6t_dst.man +++ /dev/null @@ -1,7 +0,0 @@ -This module matches the parameters in Destination Options header -.TP -[\fB!\fP] \fB\-\-dst\-len\fP \fIlength\fP -Total length of this header in octets. -.TP -\fB\-\-dst\-opts\fP \fItype\fP[\fB:\fP\fIlength\fP][\fB,\fP\fItype\fP[\fB:\fP\fIlength\fP]...] -numeric type of option and the length of the option data in octets. diff --git a/src/main/jni/iptables/extensions/libip6t_eui64.c b/src/main/jni/iptables/extensions/libip6t_eui64.c deleted file mode 100644 index 607bf86f..00000000 --- a/src/main/jni/iptables/extensions/libip6t_eui64.c +++ /dev/null @@ -1,15 +0,0 @@ -/* Shared library add-on to ip6tables to add EUI64 address checking support. */ -#include - -static struct xtables_match eui64_mt6_reg = { - .name = "eui64", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV6, - .size = XT_ALIGN(sizeof(int)), - .userspacesize = XT_ALIGN(sizeof(int)), -}; - -void _init(void) -{ - xtables_register_match(&eui64_mt6_reg); -} diff --git a/src/main/jni/iptables/extensions/libip6t_eui64.man b/src/main/jni/iptables/extensions/libip6t_eui64.man deleted file mode 100644 index cd80b98d..00000000 --- a/src/main/jni/iptables/extensions/libip6t_eui64.man +++ /dev/null @@ -1,10 +0,0 @@ -This module matches the EUI-64 part of a stateless autoconfigured IPv6 address. -It compares the EUI-64 derived from the source MAC address in Ethernet frame -with the lower 64 bits of the IPv6 source address. But "Universal/Local" -bit is not compared. This module doesn't match other link layer frame, and -is only valid in the -.BR PREROUTING , -.BR INPUT -and -.BR FORWARD -chains. diff --git a/src/main/jni/iptables/extensions/libip6t_frag.c b/src/main/jni/iptables/extensions/libip6t_frag.c deleted file mode 100644 index 47793860..00000000 --- a/src/main/jni/iptables/extensions/libip6t_frag.c +++ /dev/null @@ -1,170 +0,0 @@ -#include -#include -#include - -enum { - O_FRAGID = 0, - O_FRAGLEN, - O_FRAGRES, - O_FRAGFIRST, - O_FRAGMORE, - O_FRAGLAST, - F_FRAGMORE = 1 << O_FRAGMORE, - F_FRAGLAST = 1 << O_FRAGLAST, -}; - -static void frag_help(void) -{ - printf( -"frag match options:\n" -"[!] --fragid id[:id] match the id (range)\n" -"[!] --fraglen length total length of this header\n" -" --fragres check the reserved field too\n" -" --fragfirst matches on the first fragment\n" -" [--fragmore|--fraglast] there are more fragments or this\n" -" is the last one\n"); -} - -#define s struct ip6t_frag -static const struct xt_option_entry frag_opts[] = { - {.name = "fragid", .id = O_FRAGID, .type = XTTYPE_UINT32RC, - .flags = XTOPT_INVERT | XTOPT_PUT, XTOPT_POINTER(s, ids)}, - {.name = "fraglen", .id = O_FRAGLEN, .type = XTTYPE_UINT32, - .flags = XTOPT_INVERT | XTOPT_PUT, XTOPT_POINTER(s, hdrlen)}, - {.name = "fragres", .id = O_FRAGRES, .type = XTTYPE_NONE}, - {.name = "fragfirst", .id = O_FRAGFIRST, .type = XTTYPE_NONE}, - {.name = "fragmore", .id = O_FRAGMORE, .type = XTTYPE_NONE, - .excl = F_FRAGLAST}, - {.name = "fraglast", .id = O_FRAGLAST, .type = XTTYPE_NONE, - .excl = F_FRAGMORE}, - XTOPT_TABLEEND, -}; -#undef s - -static void frag_parse(struct xt_option_call *cb) -{ - struct ip6t_frag *fraginfo = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_FRAGID: - if (cb->nvals == 1) - fraginfo->ids[1] = fraginfo->ids[0]; - break; - case O_FRAGRES: - fraginfo->flags |= IP6T_FRAG_RES; - break; - case O_FRAGFIRST: - fraginfo->flags |= IP6T_FRAG_FST; - break; - case O_FRAGMORE: - fraginfo->flags |= IP6T_FRAG_MF; - break; - case O_FRAGLAST: - fraginfo->flags |= IP6T_FRAG_NMF; - break; - } -} - -static void -print_ids(const char *name, uint32_t min, uint32_t max, - int invert) -{ - const char *inv = invert ? "!" : ""; - - if (min != 0 || max != 0xFFFFFFFF || invert) { - printf("%s", name); - if (min == max) - printf(":%s%u", inv, min); - else - printf("s:%s%u:%u", inv, min, max); - } -} - -static void frag_print(const void *ip, const struct xt_entry_match *match, - int numeric) -{ - const struct ip6t_frag *frag = (struct ip6t_frag *)match->data; - - printf(" frag "); - print_ids("id", frag->ids[0], frag->ids[1], - frag->invflags & IP6T_FRAG_INV_IDS); - - if (frag->flags & IP6T_FRAG_LEN) { - printf(" length:%s%u", - frag->invflags & IP6T_FRAG_INV_LEN ? "!" : "", - frag->hdrlen); - } - - if (frag->flags & IP6T_FRAG_RES) - printf(" reserved"); - - if (frag->flags & IP6T_FRAG_FST) - printf(" first"); - - if (frag->flags & IP6T_FRAG_MF) - printf(" more"); - - if (frag->flags & IP6T_FRAG_NMF) - printf(" last"); - - if (frag->invflags & ~IP6T_FRAG_INV_MASK) - printf(" Unknown invflags: 0x%X", - frag->invflags & ~IP6T_FRAG_INV_MASK); -} - -static void frag_save(const void *ip, const struct xt_entry_match *match) -{ - const struct ip6t_frag *fraginfo = (struct ip6t_frag *)match->data; - - if (!(fraginfo->ids[0] == 0 - && fraginfo->ids[1] == 0xFFFFFFFF)) { - printf("%s --fragid ", - (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? " !" : ""); - if (fraginfo->ids[0] - != fraginfo->ids[1]) - printf("%u:%u", - fraginfo->ids[0], - fraginfo->ids[1]); - else - printf("%u", - fraginfo->ids[0]); - } - - if (fraginfo->flags & IP6T_FRAG_LEN) { - printf("%s --fraglen %u", - (fraginfo->invflags & IP6T_FRAG_INV_LEN) ? " !" : "", - fraginfo->hdrlen); - } - - if (fraginfo->flags & IP6T_FRAG_RES) - printf(" --fragres"); - - if (fraginfo->flags & IP6T_FRAG_FST) - printf(" --fragfirst"); - - if (fraginfo->flags & IP6T_FRAG_MF) - printf(" --fragmore"); - - if (fraginfo->flags & IP6T_FRAG_NMF) - printf(" --fraglast"); -} - -static struct xtables_match frag_mt6_reg = { - .name = "frag", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV6, - .size = XT_ALIGN(sizeof(struct ip6t_frag)), - .userspacesize = XT_ALIGN(sizeof(struct ip6t_frag)), - .help = frag_help, - .print = frag_print, - .save = frag_save, - .x6_parse = frag_parse, - .x6_options = frag_opts, -}; - -void -_init(void) -{ - xtables_register_match(&frag_mt6_reg); -} diff --git a/src/main/jni/iptables/extensions/libip6t_frag.man b/src/main/jni/iptables/extensions/libip6t_frag.man deleted file mode 100644 index 7bfa227e..00000000 --- a/src/main/jni/iptables/extensions/libip6t_frag.man +++ /dev/null @@ -1,20 +0,0 @@ -This module matches the parameters in Fragment header. -.TP -[\fB!\fP] \fB\-\-fragid\fP \fIid\fP[\fB:\fP\fIid\fP] -Matches the given Identification or range of it. -.TP -[\fB!\fP] \fB\-\-fraglen\fP \fIlength\fP -This option cannot be used with kernel version 2.6.10 or later. The length of -Fragment header is static and this option doesn't make sense. -.TP -\fB\-\-fragres\fP -Matches if the reserved fields are filled with zero. -.TP -\fB\-\-fragfirst\fP -Matches on the first fragment. -.TP -\fB\-\-fragmore\fP -Matches if there are more fragments. -.TP -\fB\-\-fraglast\fP -Matches if this is the last fragment. diff --git a/src/main/jni/iptables/extensions/libip6t_hbh.c b/src/main/jni/iptables/extensions/libip6t_hbh.c deleted file mode 100644 index 809e80d5..00000000 --- a/src/main/jni/iptables/extensions/libip6t_hbh.c +++ /dev/null @@ -1,183 +0,0 @@ -#include -#include -#include -#include -#include -#include - -#define DEBUG 0 - -enum { - O_HBH_LEN = 0, - O_HBH_OPTS, -}; - -static void hbh_help(void) -{ - printf( -"hbh match options:\n" -"[!] --hbh-len length total length of this header\n" -" --hbh-opts TYPE[:LEN][,TYPE[:LEN]...] \n" -" Options and its length (list, max: %d)\n", -IP6T_OPTS_OPTSNR); -} - -static const struct xt_option_entry hbh_opts[] = { - {.name = "hbh-len", .id = O_HBH_LEN, .type = XTTYPE_UINT32, - .flags = XTOPT_INVERT | XTOPT_PUT, - XTOPT_POINTER(struct ip6t_opts, hdrlen)}, - {.name = "hbh-opts", .id = O_HBH_OPTS, .type = XTTYPE_STRING}, - XTOPT_TABLEEND, -}; - -static uint32_t -parse_opts_num(const char *idstr, const char *typestr) -{ - unsigned long int id; - char* ep; - - id = strtoul(idstr,&ep,0) ; - - if ( idstr == ep ) { - xtables_error(PARAMETER_PROBLEM, - "hbh: no valid digits in %s `%s'", typestr, idstr); - } - if ( id == ULONG_MAX && errno == ERANGE ) { - xtables_error(PARAMETER_PROBLEM, - "%s `%s' specified too big: would overflow", - typestr, idstr); - } - if ( *idstr != '\0' && *ep != '\0' ) { - xtables_error(PARAMETER_PROBLEM, - "hbh: error parsing %s `%s'", typestr, idstr); - } - return id; -} - -static int -parse_options(const char *optsstr, uint16_t *opts) -{ - char *buffer, *cp, *next, *range; - unsigned int i; - - buffer = strdup(optsstr); - if (!buffer) xtables_error(OTHER_PROBLEM, "strdup failed"); - - for (cp=buffer, i=0; cp && idata; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_HBH_LEN: - if (cb->invert) - optinfo->invflags |= IP6T_OPTS_INV_LEN; - break; - case O_HBH_OPTS: - optinfo->optsnr = parse_options(cb->arg, optinfo->opts); - optinfo->flags |= IP6T_OPTS_OPTS; - break; - } -} - -static void -print_options(unsigned int optsnr, uint16_t *optsp) -{ - unsigned int i; - - for(i=0; i>8); - if ((optsp[i] & 0x00FF) != 0x00FF){ - printf(":%d", (optsp[i] & 0x00FF)); - } - } -} - -static void hbh_print(const void *ip, const struct xt_entry_match *match, - int numeric) -{ - const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data; - - printf(" hbh"); - if (optinfo->flags & IP6T_OPTS_LEN) { - printf(" length"); - printf(":%s", optinfo->invflags & IP6T_OPTS_INV_LEN ? "!" : ""); - printf("%u", optinfo->hdrlen); - } - if (optinfo->flags & IP6T_OPTS_OPTS) printf(" opts"); - print_options(optinfo->optsnr, (uint16_t *)optinfo->opts); - if (optinfo->invflags & ~IP6T_OPTS_INV_MASK) - printf(" Unknown invflags: 0x%X", - optinfo->invflags & ~IP6T_OPTS_INV_MASK); -} - -static void hbh_save(const void *ip, const struct xt_entry_match *match) -{ - const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data; - - if (optinfo->flags & IP6T_OPTS_LEN) { - printf("%s --hbh-len %u", - (optinfo->invflags & IP6T_OPTS_INV_LEN) ? " !" : "", - optinfo->hdrlen); - } - - if (optinfo->flags & IP6T_OPTS_OPTS) - printf(" --hbh-opts"); - print_options(optinfo->optsnr, (uint16_t *)optinfo->opts); -} - -static struct xtables_match hbh_mt6_reg = { - .name = "hbh", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV6, - .size = XT_ALIGN(sizeof(struct ip6t_opts)), - .userspacesize = XT_ALIGN(sizeof(struct ip6t_opts)), - .help = hbh_help, - .print = hbh_print, - .save = hbh_save, - .x6_parse = hbh_parse, - .x6_options = hbh_opts, -}; - -void -_init(void) -{ - xtables_register_match(&hbh_mt6_reg); -} diff --git a/src/main/jni/iptables/extensions/libip6t_hbh.man b/src/main/jni/iptables/extensions/libip6t_hbh.man deleted file mode 100644 index 2d92e04e..00000000 --- a/src/main/jni/iptables/extensions/libip6t_hbh.man +++ /dev/null @@ -1,7 +0,0 @@ -This module matches the parameters in Hop-by-Hop Options header -.TP -[\fB!\fP] \fB\-\-hbh\-len\fP \fIlength\fP -Total length of this header in octets. -.TP -\fB\-\-hbh\-opts\fP \fItype\fP[\fB:\fP\fIlength\fP][\fB,\fP\fItype\fP[\fB:\fP\fIlength\fP]...] -numeric type of option and the length of the option data in octets. diff --git a/src/main/jni/iptables/extensions/libip6t_hl.c b/src/main/jni/iptables/extensions/libip6t_hl.c deleted file mode 100644 index 3559db46..00000000 --- a/src/main/jni/iptables/extensions/libip6t_hl.c +++ /dev/null @@ -1,118 +0,0 @@ -/* - * IPv6 Hop Limit matching module - * Maciej Soltysiak - * Based on HW's ttl match - * This program is released under the terms of GNU GPL - * Cleanups by Stephane Ouellette - */ -#include -#include -#include - -enum { - O_HL_EQ = 0, - O_HL_LT, - O_HL_GT, - F_HL_EQ = 1 << O_HL_EQ, - F_HL_LT = 1 << O_HL_LT, - F_HL_GT = 1 << O_HL_GT, - F_ANY = F_HL_EQ | F_HL_LT | F_HL_GT, -}; - -static void hl_help(void) -{ - printf( -"hl match options:\n" -"[!] --hl-eq value Match hop limit value\n" -" --hl-lt value Match HL < value\n" -" --hl-gt value Match HL > value\n"); -} - -static void hl_parse(struct xt_option_call *cb) -{ - struct ip6t_hl_info *info = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_HL_EQ: - info->mode = cb->invert ? IP6T_HL_NE : IP6T_HL_EQ; - break; - case O_HL_LT: - info->mode = IP6T_HL_LT; - break; - case O_HL_GT: - info->mode = IP6T_HL_GT; - break; - } -} - -static void hl_check(struct xt_fcheck_call *cb) -{ - if (!(cb->xflags & F_ANY)) - xtables_error(PARAMETER_PROBLEM, - "HL match: You must specify one of " - "`--hl-eq', `--hl-lt', `--hl-gt'"); -} - -static void hl_print(const void *ip, const struct xt_entry_match *match, - int numeric) -{ - static const char *const op[] = { - [IP6T_HL_EQ] = "==", - [IP6T_HL_NE] = "!=", - [IP6T_HL_LT] = "<", - [IP6T_HL_GT] = ">" }; - - const struct ip6t_hl_info *info = - (struct ip6t_hl_info *) match->data; - - printf(" HL match HL %s %u", op[info->mode], info->hop_limit); -} - -static void hl_save(const void *ip, const struct xt_entry_match *match) -{ - static const char *const op[] = { - [IP6T_HL_EQ] = "--hl-eq", - [IP6T_HL_NE] = "! --hl-eq", - [IP6T_HL_LT] = "--hl-lt", - [IP6T_HL_GT] = "--hl-gt" }; - - const struct ip6t_hl_info *info = - (struct ip6t_hl_info *) match->data; - - printf(" %s %u", op[info->mode], info->hop_limit); -} - -#define s struct ip6t_hl_info -static const struct xt_option_entry hl_opts[] = { - {.name = "hl-lt", .id = O_HL_LT, .excl = F_ANY, .type = XTTYPE_UINT8, - .flags = XTOPT_PUT, XTOPT_POINTER(s, hop_limit)}, - {.name = "hl-gt", .id = O_HL_GT, .excl = F_ANY, .type = XTTYPE_UINT8, - .flags = XTOPT_PUT, XTOPT_POINTER(s, hop_limit)}, - {.name = "hl-eq", .id = O_HL_EQ, .excl = F_ANY, .type = XTTYPE_UINT8, - .flags = XTOPT_INVERT | XTOPT_PUT, XTOPT_POINTER(s, hop_limit)}, - {.name = "hl", .id = O_HL_EQ, .excl = F_ANY, .type = XTTYPE_UINT8, - .flags = XTOPT_PUT, XTOPT_POINTER(s, hop_limit)}, - XTOPT_TABLEEND, -}; -#undef s - -static struct xtables_match hl_mt6_reg = { - .name = "hl", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV6, - .size = XT_ALIGN(sizeof(struct ip6t_hl_info)), - .userspacesize = XT_ALIGN(sizeof(struct ip6t_hl_info)), - .help = hl_help, - .print = hl_print, - .save = hl_save, - .x6_parse = hl_parse, - .x6_fcheck = hl_check, - .x6_options = hl_opts, -}; - - -void _init(void) -{ - xtables_register_match(&hl_mt6_reg); -} diff --git a/src/main/jni/iptables/extensions/libip6t_hl.man b/src/main/jni/iptables/extensions/libip6t_hl.man deleted file mode 100644 index dfbfaf89..00000000 --- a/src/main/jni/iptables/extensions/libip6t_hl.man +++ /dev/null @@ -1,10 +0,0 @@ -This module matches the Hop Limit field in the IPv6 header. -.TP -[\fB!\fP] \fB\-\-hl\-eq\fP \fIvalue\fP -Matches if Hop Limit equals \fIvalue\fP. -.TP -\fB\-\-hl\-lt\fP \fIvalue\fP -Matches if Hop Limit is less than \fIvalue\fP. -.TP -\fB\-\-hl\-gt\fP \fIvalue\fP -Matches if Hop Limit is greater than \fIvalue\fP. diff --git a/src/main/jni/iptables/extensions/libip6t_icmp6.c b/src/main/jni/iptables/extensions/libip6t_icmp6.c deleted file mode 100644 index 68b940bd..00000000 --- a/src/main/jni/iptables/extensions/libip6t_icmp6.c +++ /dev/null @@ -1,239 +0,0 @@ -#include -#include -#include -#include -#include /* INT_MAX in ip6_tables.h */ -#include - -enum { - O_ICMPV6_TYPE = 0, -}; - -struct icmpv6_names { - const char *name; - uint8_t type; - uint8_t code_min, code_max; -}; - -static const struct icmpv6_names icmpv6_codes[] = { - { "destination-unreachable", 1, 0, 0xFF }, - { "no-route", 1, 0, 0 }, - { "communication-prohibited", 1, 1, 1 }, - { "address-unreachable", 1, 3, 3 }, - { "port-unreachable", 1, 4, 4 }, - - { "packet-too-big", 2, 0, 0xFF }, - - { "time-exceeded", 3, 0, 0xFF }, - /* Alias */ { "ttl-exceeded", 3, 0, 0xFF }, - { "ttl-zero-during-transit", 3, 0, 0 }, - { "ttl-zero-during-reassembly", 3, 1, 1 }, - - { "parameter-problem", 4, 0, 0xFF }, - { "bad-header", 4, 0, 0 }, - { "unknown-header-type", 4, 1, 1 }, - { "unknown-option", 4, 2, 2 }, - - { "echo-request", 128, 0, 0xFF }, - /* Alias */ { "ping", 128, 0, 0xFF }, - - { "echo-reply", 129, 0, 0xFF }, - /* Alias */ { "pong", 129, 0, 0xFF }, - - { "router-solicitation", 133, 0, 0xFF }, - - { "router-advertisement", 134, 0, 0xFF }, - - { "neighbour-solicitation", 135, 0, 0xFF }, - /* Alias */ { "neighbor-solicitation", 135, 0, 0xFF }, - - { "neighbour-advertisement", 136, 0, 0xFF }, - /* Alias */ { "neighbor-advertisement", 136, 0, 0xFF }, - - { "redirect", 137, 0, 0xFF }, - -}; - -static void -print_icmpv6types(void) -{ - unsigned int i; - printf("Valid ICMPv6 Types:"); - - for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i) { - if (i && icmpv6_codes[i].type == icmpv6_codes[i-1].type) { - if (icmpv6_codes[i].code_min == icmpv6_codes[i-1].code_min - && (icmpv6_codes[i].code_max - == icmpv6_codes[i-1].code_max)) - printf(" (%s)", icmpv6_codes[i].name); - else - printf("\n %s", icmpv6_codes[i].name); - } - else - printf("\n%s", icmpv6_codes[i].name); - } - printf("\n"); -} - -static void icmp6_help(void) -{ - printf( -"icmpv6 match options:\n" -"[!] --icmpv6-type typename match icmpv6 type\n" -" (or numeric type or type/code)\n"); - print_icmpv6types(); -} - -static const struct xt_option_entry icmp6_opts[] = { - {.name = "icmpv6-type", .id = O_ICMPV6_TYPE, .type = XTTYPE_STRING, - .flags = XTOPT_MAND | XTOPT_INVERT}, - XTOPT_TABLEEND, -}; - -static void -parse_icmpv6(const char *icmpv6type, uint8_t *type, uint8_t code[]) -{ - static const unsigned int limit = ARRAY_SIZE(icmpv6_codes); - unsigned int match = limit; - unsigned int i; - - for (i = 0; i < limit; i++) { - if (strncasecmp(icmpv6_codes[i].name, icmpv6type, strlen(icmpv6type)) - == 0) { - if (match != limit) - xtables_error(PARAMETER_PROBLEM, - "Ambiguous ICMPv6 type `%s':" - " `%s' or `%s'?", - icmpv6type, - icmpv6_codes[match].name, - icmpv6_codes[i].name); - match = i; - } - } - - if (match != limit) { - *type = icmpv6_codes[match].type; - code[0] = icmpv6_codes[match].code_min; - code[1] = icmpv6_codes[match].code_max; - } else { - char *slash; - char buffer[strlen(icmpv6type) + 1]; - unsigned int number; - - strcpy(buffer, icmpv6type); - slash = strchr(buffer, '/'); - - if (slash) - *slash = '\0'; - - if (!xtables_strtoui(buffer, NULL, &number, 0, UINT8_MAX)) - xtables_error(PARAMETER_PROBLEM, - "Invalid ICMPv6 type `%s'\n", buffer); - *type = number; - if (slash) { - if (!xtables_strtoui(slash+1, NULL, &number, 0, UINT8_MAX)) - xtables_error(PARAMETER_PROBLEM, - "Invalid ICMPv6 code `%s'\n", - slash+1); - code[0] = code[1] = number; - } else { - code[0] = 0; - code[1] = 0xFF; - } - } -} - -static void icmp6_init(struct xt_entry_match *m) -{ - struct ip6t_icmp *icmpv6info = (struct ip6t_icmp *)m->data; - - icmpv6info->code[1] = 0xFF; -} - -static void icmp6_parse(struct xt_option_call *cb) -{ - struct ip6t_icmp *icmpv6info = cb->data; - - xtables_option_parse(cb); - parse_icmpv6(cb->arg, &icmpv6info->type, icmpv6info->code); - if (cb->invert) - icmpv6info->invflags |= IP6T_ICMP_INV; -} - -static void print_icmpv6type(uint8_t type, - uint8_t code_min, uint8_t code_max, - int invert, - int numeric) -{ - if (!numeric) { - unsigned int i; - - for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i) - if (icmpv6_codes[i].type == type - && icmpv6_codes[i].code_min == code_min - && icmpv6_codes[i].code_max == code_max) - break; - - if (i != ARRAY_SIZE(icmpv6_codes)) { - printf(" %s%s", - invert ? "!" : "", - icmpv6_codes[i].name); - return; - } - } - - if (invert) - printf(" !"); - - printf("type %u", type); - if (code_min == code_max) - printf(" code %u", code_min); - else if (code_min != 0 || code_max != 0xFF) - printf(" codes %u-%u", code_min, code_max); -} - -static void icmp6_print(const void *ip, const struct xt_entry_match *match, - int numeric) -{ - const struct ip6t_icmp *icmpv6 = (struct ip6t_icmp *)match->data; - - printf(" ipv6-icmp"); - print_icmpv6type(icmpv6->type, icmpv6->code[0], icmpv6->code[1], - icmpv6->invflags & IP6T_ICMP_INV, - numeric); - - if (icmpv6->invflags & ~IP6T_ICMP_INV) - printf(" Unknown invflags: 0x%X", - icmpv6->invflags & ~IP6T_ICMP_INV); -} - -static void icmp6_save(const void *ip, const struct xt_entry_match *match) -{ - const struct ip6t_icmp *icmpv6 = (struct ip6t_icmp *)match->data; - - if (icmpv6->invflags & IP6T_ICMP_INV) - printf(" !"); - - printf(" --icmpv6-type %u", icmpv6->type); - if (icmpv6->code[0] != 0 || icmpv6->code[1] != 0xFF) - printf("/%u", icmpv6->code[0]); -} - -static struct xtables_match icmp6_mt6_reg = { - .name = "icmp6", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV6, - .size = XT_ALIGN(sizeof(struct ip6t_icmp)), - .userspacesize = XT_ALIGN(sizeof(struct ip6t_icmp)), - .help = icmp6_help, - .init = icmp6_init, - .print = icmp6_print, - .save = icmp6_save, - .x6_parse = icmp6_parse, - .x6_options = icmp6_opts, -}; - -void _init(void) -{ - xtables_register_match(&icmp6_mt6_reg); -} diff --git a/src/main/jni/iptables/extensions/libip6t_icmp6.man b/src/main/jni/iptables/extensions/libip6t_icmp6.man deleted file mode 100644 index 817e21ca..00000000 --- a/src/main/jni/iptables/extensions/libip6t_icmp6.man +++ /dev/null @@ -1,14 +0,0 @@ -This extension can be used if `\-\-protocol ipv6\-icmp' or `\-\-protocol icmpv6' is -specified. It provides the following option: -.TP -[\fB!\fP] \fB\-\-icmpv6\-type\fP \fItype\fP[\fB/\fP\fIcode\fP]|\fItypename\fP -This allows specification of the ICMPv6 type, which can be a numeric -ICMPv6 -.IR type , -.IR type -and -.IR code , -or one of the ICMPv6 type names shown by the command -.nf - ip6tables \-p ipv6\-icmp \-h -.fi diff --git a/src/main/jni/iptables/extensions/libip6t_ipv6header.c b/src/main/jni/iptables/extensions/libip6t_ipv6header.c deleted file mode 100644 index 00d5d5b4..00000000 --- a/src/main/jni/iptables/extensions/libip6t_ipv6header.c +++ /dev/null @@ -1,245 +0,0 @@ -/* ipv6header match - matches IPv6 packets based -on whether they contain certain headers */ - -/* Original idea: Brad Chapman - * Rewritten by: Andras Kis-Szabo */ -#include -#include -#include -#include -#include -#include -#include - -enum { - O_HEADER = 0, - O_SOFT, -}; - -/* A few hardcoded protocols for 'all' and in case the user has no - * /etc/protocols */ -struct pprot { - char *name; - uint8_t num; -}; - -struct numflag { - uint8_t proto; - uint8_t flag; -}; - -static const struct pprot chain_protos[] = { - { "hop-by-hop", IPPROTO_HOPOPTS }, - { "protocol", IPPROTO_RAW }, - { "hop", IPPROTO_HOPOPTS }, - { "dst", IPPROTO_DSTOPTS }, - { "route", IPPROTO_ROUTING }, - { "frag", IPPROTO_FRAGMENT }, - { "auth", IPPROTO_AH }, - { "esp", IPPROTO_ESP }, - { "none", IPPROTO_NONE }, - { "prot", IPPROTO_RAW }, - { "0", IPPROTO_HOPOPTS }, - { "60", IPPROTO_DSTOPTS }, - { "43", IPPROTO_ROUTING }, - { "44", IPPROTO_FRAGMENT }, - { "51", IPPROTO_AH }, - { "50", IPPROTO_ESP }, - { "59", IPPROTO_NONE }, - { "255", IPPROTO_RAW }, - /* { "all", 0 }, */ -}; - -static const struct numflag chain_flags[] = { - { IPPROTO_HOPOPTS, MASK_HOPOPTS }, - { IPPROTO_DSTOPTS, MASK_DSTOPTS }, - { IPPROTO_ROUTING, MASK_ROUTING }, - { IPPROTO_FRAGMENT, MASK_FRAGMENT }, - { IPPROTO_AH, MASK_AH }, - { IPPROTO_ESP, MASK_ESP }, - { IPPROTO_NONE, MASK_NONE }, - { IPPROTO_RAW, MASK_PROTO }, -}; - -static const char * -proto_to_name(uint8_t proto, int nolookup) -{ - unsigned int i; - - if (proto && !nolookup) { - const struct protoent *pent = getprotobynumber(proto); - if (pent) - return pent->p_name; - } - - for (i = 0; i < ARRAY_SIZE(chain_protos); ++i) - if (chain_protos[i].num == proto) - return chain_protos[i].name; - - return NULL; -} - -static uint16_t -name_to_proto(const char *s) -{ - unsigned int proto=0; - const struct protoent *pent; - - if ((pent = getprotobyname(s))) - proto = pent->p_proto; - else { - unsigned int i; - for (i = 0; i < ARRAY_SIZE(chain_protos); ++i) - if (strcmp(s, chain_protos[i].name) == 0) { - proto = chain_protos[i].num; - break; - } - - if (i == ARRAY_SIZE(chain_protos)) - xtables_error(PARAMETER_PROBLEM, - "unknown header `%s' specified", - s); - } - - return proto; -} - -static unsigned int -add_proto_to_mask(int proto){ - unsigned int i=0, flag=0; - - for (i = 0; i < ARRAY_SIZE(chain_flags); ++i) - if (proto == chain_flags[i].proto){ - flag = chain_flags[i].flag; - break; - } - - if (i == ARRAY_SIZE(chain_flags)) - xtables_error(PARAMETER_PROBLEM, - "unknown header `%d' specified", - proto); - - return flag; -} - -static void ipv6header_help(void) -{ - printf( -"ipv6header match options:\n" -"[!] --header headers Type of header to match, by name\n" -" names: hop,dst,route,frag,auth,esp,none,proto\n" -" long names: hop-by-hop,ipv6-opts,ipv6-route,\n" -" ipv6-frag,ah,esp,ipv6-nonxt,protocol\n" -" numbers: 0,60,43,44,51,50,59\n" -"--soft The header CONTAINS the specified extensions\n"); -} - -static const struct xt_option_entry ipv6header_opts[] = { - {.name = "header", .id = O_HEADER, .type = XTTYPE_STRING, - .flags = XTOPT_MAND | XTOPT_INVERT}, - {.name = "soft", .id = O_SOFT, .type = XTTYPE_NONE}, - XTOPT_TABLEEND, -}; - -static unsigned int -parse_header(const char *flags) { - unsigned int ret = 0; - char *ptr; - char *buffer; - - buffer = strdup(flags); - - for (ptr = strtok(buffer, ","); ptr; ptr = strtok(NULL, ",")) - ret |= add_proto_to_mask(name_to_proto(ptr)); - - free(buffer); - return ret; -} - -static void ipv6header_parse(struct xt_option_call *cb) -{ - struct ip6t_ipv6header_info *info = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_HEADER: - if (!(info->matchflags = parse_header(cb->arg))) - xtables_error(PARAMETER_PROBLEM, "ip6t_ipv6header: cannot parse header names"); - if (cb->invert) - info->invflags |= 0xFF; - break; - case O_SOFT: - info->modeflag |= 0xFF; - break; - } -} - -static void -print_header(uint8_t flags){ - int have_flag = 0; - - while (flags) { - unsigned int i; - - for (i = 0; (flags & chain_flags[i].flag) == 0; i++); - - if (have_flag) - printf(","); - - printf("%s", proto_to_name(chain_flags[i].proto,0)); - have_flag = 1; - - flags &= ~chain_flags[i].flag; - } - - if (!have_flag) - printf("NONE"); -} - -static void ipv6header_print(const void *ip, - const struct xt_entry_match *match, int numeric) -{ - const struct ip6t_ipv6header_info *info = (const struct ip6t_ipv6header_info *)match->data; - printf(" ipv6header"); - - if (info->matchflags || info->invflags) { - printf(" flags:%s", info->invflags ? "!" : ""); - if (numeric) - printf("0x%02X", info->matchflags); - else { - print_header(info->matchflags); - } - } - - if (info->modeflag) - printf(" soft"); -} - -static void ipv6header_save(const void *ip, const struct xt_entry_match *match) -{ - - const struct ip6t_ipv6header_info *info = (const struct ip6t_ipv6header_info *)match->data; - - printf("%s --header ", info->invflags ? " !" : ""); - print_header(info->matchflags); - if (info->modeflag) - printf(" --soft"); -} - -static struct xtables_match ipv6header_mt6_reg = { - .name = "ipv6header", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV6, - .size = XT_ALIGN(sizeof(struct ip6t_ipv6header_info)), - .userspacesize = XT_ALIGN(sizeof(struct ip6t_ipv6header_info)), - .help = ipv6header_help, - .print = ipv6header_print, - .save = ipv6header_save, - .x6_parse = ipv6header_parse, - .x6_options = ipv6header_opts, -}; - -void _init(void) -{ - xtables_register_match(&ipv6header_mt6_reg); -} diff --git a/src/main/jni/iptables/extensions/libip6t_ipv6header.man b/src/main/jni/iptables/extensions/libip6t_ipv6header.man deleted file mode 100644 index a9988614..00000000 --- a/src/main/jni/iptables/extensions/libip6t_ipv6header.man +++ /dev/null @@ -1,37 +0,0 @@ -This module matches IPv6 extension headers and/or upper layer header. -.TP -\fB\-\-soft\fP -Matches if the packet includes \fBany\fP of the headers specified with -\fB\-\-header\fP. -.TP -[\fB!\fP] \fB\-\-header\fP \fIheader\fP[\fB,\fP\fIheader\fP...] -Matches the packet which EXACTLY includes all specified headers. The headers -encapsulated with ESP header are out of scope. -Possible \fIheader\fP types can be: -.TP -\fBhop\fP|\fBhop\-by\-hop\fP -Hop-by-Hop Options header -.TP -\fBdst\fP -Destination Options header -.TP -\fBroute\fP -Routing header -.TP -\fBfrag\fP -Fragment header -.TP -\fBauth\fP -Authentication header -.TP -\fBesp\fP -Encapsulating Security Payload header -.TP -\fBnone\fP -No Next header which matches 59 in the 'Next Header field' of IPv6 header or -any IPv6 extension headers -.TP -\fBproto\fP -which matches any upper layer protocol header. A protocol name from -/etc/protocols and numeric value also allowed. The number 255 is equivalent to -\fBproto\fP. diff --git a/src/main/jni/iptables/extensions/libip6t_mh.c b/src/main/jni/iptables/extensions/libip6t_mh.c deleted file mode 100644 index 686a2932..00000000 --- a/src/main/jni/iptables/extensions/libip6t_mh.c +++ /dev/null @@ -1,228 +0,0 @@ -/* Shared library add-on to ip6tables to add mobility header support. */ -/* - * Copyright (C)2006 USAGI/WIDE Project - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 as - * published by the Free Software Foundation. - * - * Author: - * Masahide NAKAMURA @USAGI - * - * Based on libip6t_{icmpv6,udp}.c - */ -#include -#include -#include -#include -#include -#include - -enum { - O_MH_TYPE = 0, -}; - -struct mh_name { - const char *name; - uint8_t type; -}; - -static const struct mh_name mh_names[] = { - { "binding-refresh-request", 0, }, - /* Alias */ { "brr", 0, }, - { "home-test-init", 1, }, - /* Alias */ { "hoti", 1, }, - { "careof-test-init", 2, }, - /* Alias */ { "coti", 2, }, - { "home-test", 3, }, - /* Alias */ { "hot", 3, }, - { "careof-test", 4, }, - /* Alias */ { "cot", 4, }, - { "binding-update", 5, }, - /* Alias */ { "bu", 5, }, - { "binding-acknowledgement", 6, }, - /* Alias */ { "ba", 6, }, - { "binding-error", 7, }, - /* Alias */ { "be", 7, }, -}; - -static void print_types_all(void) -{ - unsigned int i; - printf("Valid MH types:"); - - for (i = 0; i < ARRAY_SIZE(mh_names); ++i) { - if (i && mh_names[i].type == mh_names[i-1].type) - printf(" (%s)", mh_names[i].name); - else - printf("\n%s", mh_names[i].name); - } - printf("\n"); -} - -static void mh_help(void) -{ - printf( -"mh match options:\n" -"[!] --mh-type type[:type] match mh type\n"); - print_types_all(); -} - -static void mh_init(struct xt_entry_match *m) -{ - struct ip6t_mh *mhinfo = (struct ip6t_mh *)m->data; - - mhinfo->types[1] = 0xFF; -} - -static unsigned int name_to_type(const char *name) -{ - int namelen = strlen(name); - static const unsigned int limit = ARRAY_SIZE(mh_names); - unsigned int match = limit; - unsigned int i; - - for (i = 0; i < limit; i++) { - if (strncasecmp(mh_names[i].name, name, namelen) == 0) { - int len = strlen(mh_names[i].name); - if (match == limit || len == namelen) - match = i; - } - } - - if (match != limit) { - return mh_names[match].type; - } else { - unsigned int number; - - if (!xtables_strtoui(name, NULL, &number, 0, UINT8_MAX)) - xtables_error(PARAMETER_PROBLEM, - "Invalid MH type `%s'\n", name); - return number; - } -} - -static void parse_mh_types(const char *mhtype, uint8_t *types) -{ - char *buffer; - char *cp; - - buffer = strdup(mhtype); - if ((cp = strchr(buffer, ':')) == NULL) - types[0] = types[1] = name_to_type(buffer); - else { - *cp = '\0'; - cp++; - - types[0] = buffer[0] ? name_to_type(buffer) : 0; - types[1] = cp[0] ? name_to_type(cp) : 0xFF; - - if (types[0] > types[1]) - xtables_error(PARAMETER_PROBLEM, - "Invalid MH type range (min > max)"); - } - free(buffer); -} - -static void mh_parse(struct xt_option_call *cb) -{ - struct ip6t_mh *mhinfo = cb->data; - - xtables_option_parse(cb); - parse_mh_types(cb->arg, mhinfo->types); - if (cb->invert) - mhinfo->invflags |= IP6T_MH_INV_TYPE; -} - -static const char *type_to_name(uint8_t type) -{ - unsigned int i; - - for (i = 0; i < ARRAY_SIZE(mh_names); ++i) - if (mh_names[i].type == type) - return mh_names[i].name; - - return NULL; -} - -static void print_type(uint8_t type, int numeric) -{ - const char *name; - if (numeric || !(name = type_to_name(type))) - printf("%u", type); - else - printf("%s", name); -} - -static void print_types(uint8_t min, uint8_t max, int invert, int numeric) -{ - const char *inv = invert ? "!" : ""; - - if (min != 0 || max != 0xFF || invert) { - printf(" "); - if (min == max) { - printf("%s", inv); - print_type(min, numeric); - } else { - printf("%s", inv); - print_type(min, numeric); - printf(":"); - print_type(max, numeric); - } - } -} - -static void mh_print(const void *ip, const struct xt_entry_match *match, - int numeric) -{ - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)match->data; - - printf(" mh"); - print_types(mhinfo->types[0], mhinfo->types[1], - mhinfo->invflags & IP6T_MH_INV_TYPE, - numeric); - if (mhinfo->invflags & ~IP6T_MH_INV_MASK) - printf(" Unknown invflags: 0x%X", - mhinfo->invflags & ~IP6T_MH_INV_MASK); -} - -static void mh_save(const void *ip, const struct xt_entry_match *match) -{ - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)match->data; - - if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xFF) - return; - - if (mhinfo->invflags & IP6T_MH_INV_TYPE) - printf(" !"); - - if (mhinfo->types[0] != mhinfo->types[1]) - printf(" --mh-type %u:%u", mhinfo->types[0], mhinfo->types[1]); - else - printf(" --mh-type %u", mhinfo->types[0]); -} - -static const struct xt_option_entry mh_opts[] = { - {.name = "mh-type", .id = O_MH_TYPE, .type = XTTYPE_STRING, - .flags = XTOPT_INVERT}, - XTOPT_TABLEEND, -}; - -static struct xtables_match mh_mt6_reg = { - .name = "mh", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV6, - .size = XT_ALIGN(sizeof(struct ip6t_mh)), - .userspacesize = XT_ALIGN(sizeof(struct ip6t_mh)), - .help = mh_help, - .init = mh_init, - .x6_parse = mh_parse, - .print = mh_print, - .save = mh_save, - .x6_options = mh_opts, -}; - -void _init(void) -{ - xtables_register_match(&mh_mt6_reg); -} diff --git a/src/main/jni/iptables/extensions/libip6t_mh.man b/src/main/jni/iptables/extensions/libip6t_mh.man deleted file mode 100644 index 4559e783..00000000 --- a/src/main/jni/iptables/extensions/libip6t_mh.man +++ /dev/null @@ -1,12 +0,0 @@ -This extension is loaded if `\-\-protocol ipv6\-mh' or `\-\-protocol mh' is -specified. It provides the following option: -.TP -[\fB!\fP] \fB\-\-mh\-type\fP \fItype\fP[\fB:\fP\fItype\fP] -This allows specification of the Mobility Header(MH) type, which can be -a numeric MH -.IR type , -.IR type -or one of the MH type names shown by the command -.nf - ip6tables \-p ipv6\-mh \-h -.fi diff --git a/src/main/jni/iptables/extensions/libip6t_rt.c b/src/main/jni/iptables/extensions/libip6t_rt.c deleted file mode 100644 index d470488d..00000000 --- a/src/main/jni/iptables/extensions/libip6t_rt.c +++ /dev/null @@ -1,258 +0,0 @@ -#include -#include -#include -#include -#include -#include - -enum { - O_RT_TYPE = 0, - O_RT_SEGSLEFT, - O_RT_LEN, - O_RT0RES, - O_RT0ADDRS, - O_RT0NSTRICT, - F_RT_TYPE = 1 << O_RT_TYPE, - F_RT0ADDRS = 1 << O_RT0ADDRS, -}; - -static void rt_help(void) -{ - printf( -"rt match options:\n" -"[!] --rt-type type match the type\n" -"[!] --rt-segsleft num[:num] match the Segments Left field (range)\n" -"[!] --rt-len length total length of this header\n" -" --rt-0-res check the reserved field too (type 0)\n" -" --rt-0-addrs ADDR[,ADDR...] Type=0 addresses (list, max: %d)\n" -" --rt-0-not-strict List of Type=0 addresses not a strict list\n", -IP6T_RT_HOPS); -} - -#define s struct ip6t_rt -static const struct xt_option_entry rt_opts[] = { - {.name = "rt-type", .id = O_RT_TYPE, .type = XTTYPE_UINT32, - .flags = XTOPT_INVERT | XTOPT_PUT, XTOPT_POINTER(s, rt_type)}, - {.name = "rt-segsleft", .id = O_RT_SEGSLEFT, .type = XTTYPE_UINT32RC, - .flags = XTOPT_INVERT | XTOPT_PUT, XTOPT_POINTER(s, segsleft)}, - {.name = "rt-len", .id = O_RT_LEN, .type = XTTYPE_UINT32, - .flags = XTOPT_INVERT | XTOPT_PUT, XTOPT_POINTER(s, hdrlen)}, - {.name = "rt-0-res", .id = O_RT0RES, .type = XTTYPE_NONE}, - {.name = "rt-0-addrs", .id = O_RT0ADDRS, .type = XTTYPE_STRING}, - {.name = "rt-0-not-strict", .id = O_RT0NSTRICT, .type = XTTYPE_NONE}, - XTOPT_TABLEEND, -}; -#undef s - -static const char * -addr_to_numeric(const struct in6_addr *addrp) -{ - static char buf[50+1]; - return inet_ntop(AF_INET6, addrp, buf, sizeof(buf)); -} - -static struct in6_addr * -numeric_to_addr(const char *num) -{ - static struct in6_addr ap; - int err; - - if ((err=inet_pton(AF_INET6, num, &ap)) == 1) - return ≈ -#ifdef DEBUG - fprintf(stderr, "\nnumeric2addr: %d\n", err); -#endif - xtables_error(PARAMETER_PROBLEM, "bad address: %s", num); - - return (struct in6_addr *)NULL; -} - - -static int -parse_addresses(const char *addrstr, struct in6_addr *addrp) -{ - char *buffer, *cp, *next; - unsigned int i; - - buffer = strdup(addrstr); - if (!buffer) xtables_error(OTHER_PROBLEM, "strdup failed"); - - for (cp=buffer, i=0; cp && idata; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_RT_TYPE: - if (cb->invert) - rtinfo->invflags |= IP6T_RT_INV_TYP; - rtinfo->flags |= IP6T_RT_TYP; - break; - case O_RT_SEGSLEFT: - if (cb->nvals == 1) - rtinfo->segsleft[1] = rtinfo->segsleft[0]; - if (cb->invert) - rtinfo->invflags |= IP6T_RT_INV_SGS; - rtinfo->flags |= IP6T_RT_SGS; - break; - case O_RT_LEN: - if (cb->invert) - rtinfo->invflags |= IP6T_RT_INV_LEN; - rtinfo->flags |= IP6T_RT_LEN; - break; - case O_RT0RES: - if (!(cb->xflags & F_RT_TYPE) || rtinfo->rt_type != 0 || - rtinfo->invflags & IP6T_RT_INV_TYP) - xtables_error(PARAMETER_PROBLEM, - "`--rt-type 0' required before `--rt-0-res'"); - rtinfo->flags |= IP6T_RT_RES; - break; - case O_RT0ADDRS: - if (!(cb->xflags & F_RT_TYPE) || rtinfo->rt_type != 0 || - rtinfo->invflags & IP6T_RT_INV_TYP) - xtables_error(PARAMETER_PROBLEM, - "`--rt-type 0' required before `--rt-0-addrs'"); - rtinfo->addrnr = parse_addresses(cb->arg, rtinfo->addrs); - rtinfo->flags |= IP6T_RT_FST; - break; - case O_RT0NSTRICT: - if (!(cb->xflags & F_RT0ADDRS)) - xtables_error(PARAMETER_PROBLEM, - "`--rt-0-addr ...' required before `--rt-0-not-strict'"); - rtinfo->flags |= IP6T_RT_FST_NSTRICT; - break; - } -} - -static void -print_nums(const char *name, uint32_t min, uint32_t max, - int invert) -{ - const char *inv = invert ? "!" : ""; - - if (min != 0 || max != 0xFFFFFFFF || invert) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); - printf("%u", min); - } else { - printf("s:%s", inv); - printf("%u",min); - printf(":"); - printf("%u",max); - } - } -} - -static void -print_addresses(unsigned int addrnr, struct in6_addr *addrp) -{ - unsigned int i; - - for(i=0; idata; - - printf(" rt"); - if (rtinfo->flags & IP6T_RT_TYP) - printf(" type:%s%d", rtinfo->invflags & IP6T_RT_INV_TYP ? "!" : "", - rtinfo->rt_type); - print_nums("segsleft", rtinfo->segsleft[0], rtinfo->segsleft[1], - rtinfo->invflags & IP6T_RT_INV_SGS); - if (rtinfo->flags & IP6T_RT_LEN) { - printf(" length"); - printf(":%s", rtinfo->invflags & IP6T_RT_INV_LEN ? "!" : ""); - printf("%u", rtinfo->hdrlen); - } - if (rtinfo->flags & IP6T_RT_RES) printf(" reserved"); - if (rtinfo->flags & IP6T_RT_FST) printf(" 0-addrs"); - print_addresses(rtinfo->addrnr, (struct in6_addr *)rtinfo->addrs); - if (rtinfo->flags & IP6T_RT_FST_NSTRICT) printf(" 0-not-strict"); - if (rtinfo->invflags & ~IP6T_RT_INV_MASK) - printf(" Unknown invflags: 0x%X", - rtinfo->invflags & ~IP6T_RT_INV_MASK); -} - -static void rt_save(const void *ip, const struct xt_entry_match *match) -{ - const struct ip6t_rt *rtinfo = (struct ip6t_rt *)match->data; - - if (rtinfo->flags & IP6T_RT_TYP) { - printf("%s --rt-type %u", - (rtinfo->invflags & IP6T_RT_INV_TYP) ? " !" : "", - rtinfo->rt_type); - } - - if (!(rtinfo->segsleft[0] == 0 - && rtinfo->segsleft[1] == 0xFFFFFFFF)) { - printf("%s --rt-segsleft ", - (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !" : ""); - if (rtinfo->segsleft[0] - != rtinfo->segsleft[1]) - printf("%u:%u", - rtinfo->segsleft[0], - rtinfo->segsleft[1]); - else - printf("%u", - rtinfo->segsleft[0]); - } - - if (rtinfo->flags & IP6T_RT_LEN) { - printf("%s --rt-len %u", - (rtinfo->invflags & IP6T_RT_INV_LEN) ? " !" : "", - rtinfo->hdrlen); - } - - if (rtinfo->flags & IP6T_RT_RES) printf(" --rt-0-res"); - if (rtinfo->flags & IP6T_RT_FST) printf(" --rt-0-addrs"); - print_addresses(rtinfo->addrnr, (struct in6_addr *)rtinfo->addrs); - if (rtinfo->flags & IP6T_RT_FST_NSTRICT) printf(" --rt-0-not-strict"); - -} - -static struct xtables_match rt_mt6_reg = { - .name = "rt", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV6, - .size = XT_ALIGN(sizeof(struct ip6t_rt)), - .userspacesize = XT_ALIGN(sizeof(struct ip6t_rt)), - .help = rt_help, - .x6_parse = rt_parse, - .print = rt_print, - .save = rt_save, - .x6_options = rt_opts, -}; - -void -_init(void) -{ - xtables_register_match(&rt_mt6_reg); -} diff --git a/src/main/jni/iptables/extensions/libip6t_rt.man b/src/main/jni/iptables/extensions/libip6t_rt.man deleted file mode 100644 index 0443e0a4..00000000 --- a/src/main/jni/iptables/extensions/libip6t_rt.man +++ /dev/null @@ -1,19 +0,0 @@ -Match on IPv6 routing header -.TP -[\fB!\fP] \fB\-\-rt\-type\fP \fItype\fP -Match the type (numeric). -.TP -[\fB!\fP] \fB\-\-rt\-segsleft\fP \fInum\fP[\fB:\fP\fInum\fP] -Match the `segments left' field (range). -.TP -[\fB!\fP] \fB\-\-rt\-len\fP \fIlength\fP -Match the length of this header. -.TP -\fB\-\-rt\-0\-res\fP -Match the reserved field, too (type=0) -.TP -\fB\-\-rt\-0\-addrs\fP \fIaddr\fP[\fB,\fP\fIaddr\fP...] -Match type=0 addresses (list). -.TP -\fB\-\-rt\-0\-not\-strict\fP -List of type=0 addresses is not a strict list. diff --git a/src/main/jni/iptables/extensions/libipt_CLUSTERIP.c b/src/main/jni/iptables/extensions/libipt_CLUSTERIP.c deleted file mode 100644 index 301e0e1d..00000000 --- a/src/main/jni/iptables/extensions/libipt_CLUSTERIP.c +++ /dev/null @@ -1,195 +0,0 @@ -/* Shared library add-on to iptables to add CLUSTERIP target support. - * (C) 2003 by Harald Welte - * - * Development of this code was funded by SuSE AG, http://www.suse.com/ - */ -#include -#include -#include -#include -#include -#include - -#if defined(__GLIBC__) && __GLIBC__ == 2 -#include -#else -#include -#endif - -#include -#include - -enum { - O_NEW = 0, - O_HASHMODE, - O_CLUSTERMAC, - O_TOTAL_NODES, - O_LOCAL_NODE, - O_HASH_INIT, - F_NEW = 1 << O_NEW, - F_HASHMODE = 1 << O_HASHMODE, - F_CLUSTERMAC = 1 << O_CLUSTERMAC, - F_TOTAL_NODES = 1 << O_TOTAL_NODES, - F_LOCAL_NODE = 1 << O_LOCAL_NODE, - F_FULL = F_NEW | F_HASHMODE | F_CLUSTERMAC | - F_TOTAL_NODES | F_LOCAL_NODE, -}; - -static void CLUSTERIP_help(void) -{ - printf( -"CLUSTERIP target options:\n" -" --new Create a new ClusterIP\n" -" --hashmode Specify hashing mode\n" -" sourceip\n" -" sourceip-sourceport\n" -" sourceip-sourceport-destport\n" -" --clustermac Set clusterIP MAC address\n" -" --total-nodes Set number of total nodes in cluster\n" -" --local-node Set the local node number\n" -" --hash-init Set init value of the Jenkins hash\n"); -} - -#define s struct ipt_clusterip_tgt_info -static const struct xt_option_entry CLUSTERIP_opts[] = { - {.name = "new", .id = O_NEW, .type = XTTYPE_NONE}, - {.name = "hashmode", .id = O_HASHMODE, .type = XTTYPE_STRING, - .also = O_NEW}, - {.name = "clustermac", .id = O_CLUSTERMAC, .type = XTTYPE_ETHERMAC, - .also = O_NEW, .flags = XTOPT_PUT, XTOPT_POINTER(s, clustermac)}, - {.name = "total-nodes", .id = O_TOTAL_NODES, .type = XTTYPE_UINT16, - .flags = XTOPT_PUT, XTOPT_POINTER(s, num_total_nodes), - .also = O_NEW, .max = CLUSTERIP_MAX_NODES}, - {.name = "local-node", .id = O_LOCAL_NODE, .type = XTTYPE_UINT16, - .flags = XTOPT_PUT, XTOPT_POINTER(s, local_nodes[0]), - .also = O_NEW, .max = CLUSTERIP_MAX_NODES}, - {.name = "hash-init", .id = O_HASH_INIT, .type = XTTYPE_UINT32, - .flags = XTOPT_PUT, XTOPT_POINTER(s, hash_initval), - .also = O_NEW, .max = UINT_MAX}, - XTOPT_TABLEEND, -}; -#undef s - -static void CLUSTERIP_parse(struct xt_option_call *cb) -{ - struct ipt_clusterip_tgt_info *cipinfo = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_NEW: - cipinfo->flags |= CLUSTERIP_FLAG_NEW; - break; - case O_HASHMODE: - if (strcmp(cb->arg, "sourceip") == 0) - cipinfo->hash_mode = CLUSTERIP_HASHMODE_SIP; - else if (strcmp(cb->arg, "sourceip-sourceport") == 0) - cipinfo->hash_mode = CLUSTERIP_HASHMODE_SIP_SPT; - else if (strcmp(cb->arg, "sourceip-sourceport-destport") == 0) - cipinfo->hash_mode = CLUSTERIP_HASHMODE_SIP_SPT_DPT; - else - xtables_error(PARAMETER_PROBLEM, "Unknown hashmode \"%s\"\n", - cb->arg); - break; - case O_CLUSTERMAC: - if (!(cipinfo->clustermac[0] & 0x01)) - xtables_error(PARAMETER_PROBLEM, "MAC has to be a multicast ethernet address\n"); - break; - case O_LOCAL_NODE: - cipinfo->num_local_nodes = 1; - break; - } -} - -static void CLUSTERIP_check(struct xt_fcheck_call *cb) -{ - if (cb->xflags == 0) - return; - if ((cb->xflags & F_FULL) == F_FULL) - return; - - xtables_error(PARAMETER_PROBLEM, "CLUSTERIP target: Invalid parameter combination\n"); -} - -static const char *hashmode2str(enum clusterip_hashmode mode) -{ - const char *retstr; - switch (mode) { - case CLUSTERIP_HASHMODE_SIP: - retstr = "sourceip"; - break; - case CLUSTERIP_HASHMODE_SIP_SPT: - retstr = "sourceip-sourceport"; - break; - case CLUSTERIP_HASHMODE_SIP_SPT_DPT: - retstr = "sourceip-sourceport-destport"; - break; - default: - retstr = "unknown-error"; - break; - } - return retstr; -} - -static const char *mac2str(const uint8_t mac[ETH_ALEN]) -{ - static char buf[ETH_ALEN*3]; - sprintf(buf, "%02X:%02X:%02X:%02X:%02X:%02X", - mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]); - return buf; -} - -static void CLUSTERIP_print(const void *ip, - const struct xt_entry_target *target, int numeric) -{ - const struct ipt_clusterip_tgt_info *cipinfo = - (const struct ipt_clusterip_tgt_info *)target->data; - - if (!cipinfo->flags & CLUSTERIP_FLAG_NEW) { - printf(" CLUSTERIP"); - return; - } - - printf(" CLUSTERIP hashmode=%s clustermac=%s total_nodes=%u local_node=%u hash_init=%u", - hashmode2str(cipinfo->hash_mode), - mac2str(cipinfo->clustermac), - cipinfo->num_total_nodes, - cipinfo->local_nodes[0], - cipinfo->hash_initval); -} - -static void CLUSTERIP_save(const void *ip, const struct xt_entry_target *target) -{ - const struct ipt_clusterip_tgt_info *cipinfo = - (const struct ipt_clusterip_tgt_info *)target->data; - - /* if this is not a new entry, we don't need to save target - * parameters */ - if (!cipinfo->flags & CLUSTERIP_FLAG_NEW) - return; - - printf(" --new --hashmode %s --clustermac %s --total-nodes %d --local-node %d --hash-init %u", - hashmode2str(cipinfo->hash_mode), - mac2str(cipinfo->clustermac), - cipinfo->num_total_nodes, - cipinfo->local_nodes[0], - cipinfo->hash_initval); -} - -static struct xtables_target clusterip_tg_reg = { - .name = "CLUSTERIP", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct ipt_clusterip_tgt_info)), - .userspacesize = offsetof(struct ipt_clusterip_tgt_info, config), - .help = CLUSTERIP_help, - .x6_parse = CLUSTERIP_parse, - .x6_fcheck = CLUSTERIP_check, - .print = CLUSTERIP_print, - .save = CLUSTERIP_save, - .x6_options = CLUSTERIP_opts, -}; - -void _init(void) -{ - xtables_register_target(&clusterip_tg_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_CLUSTERIP.man b/src/main/jni/iptables/extensions/libipt_CLUSTERIP.man deleted file mode 100644 index 8ec6d6b6..00000000 --- a/src/main/jni/iptables/extensions/libipt_CLUSTERIP.man +++ /dev/null @@ -1,24 +0,0 @@ -This module allows you to configure a simple cluster of nodes that share -a certain IP and MAC address without an explicit load balancer in front of -them. Connections are statically distributed between the nodes in this -cluster. -.TP -\fB\-\-new\fP -Create a new ClusterIP. You always have to set this on the first rule -for a given ClusterIP. -.TP -\fB\-\-hashmode\fP \fImode\fP -Specify the hashing mode. Has to be one of -\fBsourceip\fP, \fBsourceip\-sourceport\fP, \fBsourceip\-sourceport\-destport\fP. -.TP -\fB\-\-clustermac\fP \fImac\fP -Specify the ClusterIP MAC address. Has to be a link\-layer multicast address -.TP -\fB\-\-total\-nodes\fP \fInum\fP -Number of total nodes within this cluster. -.TP -\fB\-\-local\-node\fP \fInum\fP -Local node number within this cluster. -.TP -\fB\-\-hash\-init\fP \fIrnd\fP -Specify the random seed used for hash initialization. diff --git a/src/main/jni/iptables/extensions/libipt_DNAT.c b/src/main/jni/iptables/extensions/libipt_DNAT.c deleted file mode 100644 index 3b55c69c..00000000 --- a/src/main/jni/iptables/extensions/libipt_DNAT.c +++ /dev/null @@ -1,259 +0,0 @@ -#include -#include -#include -#include -#include -#include /* get_kernel_version */ -#include /* INT_MAX in ip_tables.h */ -#include -#include - -enum { - O_TO_DEST = 0, - O_RANDOM, - O_PERSISTENT, - O_X_TO_DEST, /* hidden flag */ - F_TO_DEST = 1 << O_TO_DEST, - F_RANDOM = 1 << O_RANDOM, - F_X_TO_DEST = 1 << O_X_TO_DEST, -}; - -/* Dest NAT data consists of a multi-range, indicating where to map - to. */ -struct ipt_natinfo -{ - struct xt_entry_target t; - struct nf_nat_multi_range mr; -}; - -static void DNAT_help(void) -{ - printf( -"DNAT target options:\n" -" --to-destination [[-]][:port[-port]]\n" -" Address to map destination to.\n" -"[--random] [--persistent]\n"); -} - -static const struct xt_option_entry DNAT_opts[] = { - {.name = "to-destination", .id = O_TO_DEST, .type = XTTYPE_STRING, - .flags = XTOPT_MAND | XTOPT_MULTI}, - {.name = "random", .id = O_RANDOM, .type = XTTYPE_NONE}, - {.name = "persistent", .id = O_PERSISTENT, .type = XTTYPE_NONE}, - XTOPT_TABLEEND, -}; - -static struct ipt_natinfo * -append_range(struct ipt_natinfo *info, const struct nf_nat_range *range) -{ - unsigned int size; - - /* One rangesize already in struct ipt_natinfo */ - size = XT_ALIGN(sizeof(*info) + info->mr.rangesize * sizeof(*range)); - - info = realloc(info, size); - if (!info) - xtables_error(OTHER_PROBLEM, "Out of memory\n"); - - info->t.u.target_size = size; - info->mr.range[info->mr.rangesize] = *range; - info->mr.rangesize++; - - return info; -} - -/* Ranges expected in network order. */ -static struct xt_entry_target * -parse_to(const char *orig_arg, int portok, struct ipt_natinfo *info) -{ - struct nf_nat_range range; - char *arg, *colon, *dash, *error; - const struct in_addr *ip; - - arg = strdup(orig_arg); - if (arg == NULL) - xtables_error(RESOURCE_PROBLEM, "strdup"); - memset(&range, 0, sizeof(range)); - colon = strchr(arg, ':'); - - if (colon) { - int port; - - if (!portok) - xtables_error(PARAMETER_PROBLEM, - "Need TCP, UDP, SCTP or DCCP with port specification"); - - range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED; - - port = atoi(colon+1); - if (port <= 0 || port > 65535) - xtables_error(PARAMETER_PROBLEM, - "Port `%s' not valid\n", colon+1); - - error = strchr(colon+1, ':'); - if (error) - xtables_error(PARAMETER_PROBLEM, - "Invalid port:port syntax - use dash\n"); - - dash = strchr(colon, '-'); - if (!dash) { - range.min.tcp.port - = range.max.tcp.port - = htons(port); - } else { - int maxport; - - maxport = atoi(dash + 1); - if (maxport <= 0 || maxport > 65535) - xtables_error(PARAMETER_PROBLEM, - "Port `%s' not valid\n", dash+1); - if (maxport < port) - /* People are stupid. */ - xtables_error(PARAMETER_PROBLEM, - "Port range `%s' funky\n", colon+1); - range.min.tcp.port = htons(port); - range.max.tcp.port = htons(maxport); - } - /* Starts with a colon? No IP info...*/ - if (colon == arg) { - free(arg); - return &(append_range(info, &range)->t); - } - *colon = '\0'; - } - - range.flags |= IP_NAT_RANGE_MAP_IPS; - dash = strchr(arg, '-'); - if (colon && dash && dash > colon) - dash = NULL; - - if (dash) - *dash = '\0'; - - ip = xtables_numeric_to_ipaddr(arg); - if (!ip) - xtables_error(PARAMETER_PROBLEM, "Bad IP address \"%s\"\n", - arg); - range.min_ip = ip->s_addr; - if (dash) { - ip = xtables_numeric_to_ipaddr(dash+1); - if (!ip) - xtables_error(PARAMETER_PROBLEM, "Bad IP address \"%s\"\n", - dash+1); - range.max_ip = ip->s_addr; - } else - range.max_ip = range.min_ip; - - free(arg); - return &(append_range(info, &range)->t); -} - -static void DNAT_parse(struct xt_option_call *cb) -{ - const struct ipt_entry *entry = cb->xt_entry; - struct ipt_natinfo *info = (void *)(*cb->target); - int portok; - - if (entry->ip.proto == IPPROTO_TCP - || entry->ip.proto == IPPROTO_UDP - || entry->ip.proto == IPPROTO_SCTP - || entry->ip.proto == IPPROTO_DCCP - || entry->ip.proto == IPPROTO_ICMP) - portok = 1; - else - portok = 0; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_TO_DEST: - if (cb->xflags & F_X_TO_DEST) { - if (!kernel_version) - get_kernel_version(); - if (kernel_version > LINUX_VERSION(2, 6, 10)) - xtables_error(PARAMETER_PROBLEM, - "DNAT: Multiple --to-destination not supported"); - } - *cb->target = parse_to(cb->arg, portok, info); - /* WTF do we need this for?? */ - if (cb->xflags & F_RANDOM) - info->mr.range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; - cb->xflags |= F_X_TO_DEST; - break; - case O_RANDOM: - if (cb->xflags & F_TO_DEST) - info->mr.range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; - break; - case O_PERSISTENT: - info->mr.range[0].flags |= IP_NAT_RANGE_PERSISTENT; - break; - } -} - -static void print_range(const struct nf_nat_range *r) -{ - if (r->flags & IP_NAT_RANGE_MAP_IPS) { - struct in_addr a; - - a.s_addr = r->min_ip; - printf("%s", xtables_ipaddr_to_numeric(&a)); - if (r->max_ip != r->min_ip) { - a.s_addr = r->max_ip; - printf("-%s", xtables_ipaddr_to_numeric(&a)); - } - } - if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) { - printf(":"); - printf("%hu", ntohs(r->min.tcp.port)); - if (r->max.tcp.port != r->min.tcp.port) - printf("-%hu", ntohs(r->max.tcp.port)); - } -} - -static void DNAT_print(const void *ip, const struct xt_entry_target *target, - int numeric) -{ - const struct ipt_natinfo *info = (const void *)target; - unsigned int i = 0; - - printf(" to:"); - for (i = 0; i < info->mr.rangesize; i++) { - print_range(&info->mr.range[i]); - if (info->mr.range[i].flags & IP_NAT_RANGE_PROTO_RANDOM) - printf(" random"); - if (info->mr.range[i].flags & IP_NAT_RANGE_PERSISTENT) - printf(" persistent"); - } -} - -static void DNAT_save(const void *ip, const struct xt_entry_target *target) -{ - const struct ipt_natinfo *info = (const void *)target; - unsigned int i = 0; - - for (i = 0; i < info->mr.rangesize; i++) { - printf(" --to-destination "); - print_range(&info->mr.range[i]); - if (info->mr.range[i].flags & IP_NAT_RANGE_PROTO_RANDOM) - printf(" --random"); - if (info->mr.range[i].flags & IP_NAT_RANGE_PERSISTENT) - printf(" --persistent"); - } -} - -static struct xtables_target dnat_tg_reg = { - .name = "DNAT", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct nf_nat_multi_range)), - .userspacesize = XT_ALIGN(sizeof(struct nf_nat_multi_range)), - .help = DNAT_help, - .x6_parse = DNAT_parse, - .print = DNAT_print, - .save = DNAT_save, - .x6_options = DNAT_opts, -}; - -void _init(void) -{ - xtables_register_target(&dnat_tg_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_DNAT.man b/src/main/jni/iptables/extensions/libipt_DNAT.man deleted file mode 100644 index d5ded35b..00000000 --- a/src/main/jni/iptables/extensions/libipt_DNAT.man +++ /dev/null @@ -1,39 +0,0 @@ -This target is only valid in the -.B nat -table, in the -.B PREROUTING -and -.B OUTPUT -chains, and user-defined chains which are only called from those -chains. It specifies that the destination address of the packet -should be modified (and all future packets in this connection will -also be mangled), and rules should cease being examined. It takes one -type of option: -.TP -\fB\-\-to\-destination\fP [\fIipaddr\fP[\fB\-\fP\fIipaddr\fP]][\fB:\fP\fIport\fP[\fB\-\fP\fIport\fP]] -which can specify a single new destination IP address, an inclusive -range of IP addresses, and optionally, a port range (which is only -valid if the rule also specifies -\fB\-p tcp\fP -or -\fB\-p udp\fP). -If no port range is specified, then the destination port will never be -modified. If no IP address is specified then only the destination port -will be modified. - -In Kernels up to 2.6.10 you can add several \-\-to\-destination options. For -those kernels, if you specify more than one destination address, either via an -address range or multiple \-\-to\-destination options, a simple round-robin (one -after another in cycle) load balancing takes place between these addresses. -Later Kernels (>= 2.6.11-rc1) don't have the ability to NAT to multiple ranges -anymore. -.TP -\fB\-\-random\fP -If option -\fB\-\-random\fP -is used then port mapping will be randomized (kernel >= 2.6.22). -.TP -\fB\-\-persistent\fP -Gives a client the same source-/destination-address for each connection. -This supersedes the SAME target. Support for persistent mappings is available -from 2.6.29-rc2. diff --git a/src/main/jni/iptables/extensions/libipt_LOG.c b/src/main/jni/iptables/extensions/libipt_LOG.c deleted file mode 100644 index b270bcf6..00000000 --- a/src/main/jni/iptables/extensions/libipt_LOG.c +++ /dev/null @@ -1,186 +0,0 @@ -#include -#include -#include -#include -#include - -#define LOG_DEFAULT_LEVEL LOG_WARNING - -#ifndef IPT_LOG_UID /* Old kernel */ -#define IPT_LOG_UID 0x08 /* Log UID owning local socket */ -#undef IPT_LOG_MASK -#define IPT_LOG_MASK 0x0f -#endif - -enum { - O_LOG_LEVEL = 0, - O_LOG_PREFIX, - O_LOG_TCPSEQ, - O_LOG_TCPOPTS, - O_LOG_IPOPTS, - O_LOG_UID, - O_LOG_MAC, -}; - -static void LOG_help(void) -{ - printf( -"LOG target options:\n" -" --log-level level Level of logging (numeric or see syslog.conf)\n" -" --log-prefix prefix Prefix log messages with this prefix.\n\n" -" --log-tcp-sequence Log TCP sequence numbers.\n\n" -" --log-tcp-options Log TCP options.\n\n" -" --log-ip-options Log IP options.\n\n" -" --log-uid Log UID owning the local socket.\n\n" -" --log-macdecode Decode MAC addresses and protocol.\n\n"); -} - -#define s struct ipt_log_info -static const struct xt_option_entry LOG_opts[] = { - {.name = "log-level", .id = O_LOG_LEVEL, .type = XTTYPE_SYSLOGLEVEL, - .flags = XTOPT_PUT, XTOPT_POINTER(s, level)}, - {.name = "log-prefix", .id = O_LOG_PREFIX, .type = XTTYPE_STRING, - .flags = XTOPT_PUT, XTOPT_POINTER(s, prefix), .min = 1}, - {.name = "log-tcp-sequence", .id = O_LOG_TCPSEQ, .type = XTTYPE_NONE}, - {.name = "log-tcp-options", .id = O_LOG_TCPOPTS, .type = XTTYPE_NONE}, - {.name = "log-ip-options", .id = O_LOG_IPOPTS, .type = XTTYPE_NONE}, - {.name = "log-uid", .id = O_LOG_UID, .type = XTTYPE_NONE}, - {.name = "log-macdecode", .id = O_LOG_MAC, .type = XTTYPE_NONE}, - XTOPT_TABLEEND, -}; -#undef s - -static void LOG_init(struct xt_entry_target *t) -{ - struct ipt_log_info *loginfo = (struct ipt_log_info *)t->data; - - loginfo->level = LOG_DEFAULT_LEVEL; - -} - -struct ipt_log_names { - const char *name; - unsigned int level; -}; - -static const struct ipt_log_names ipt_log_names[] -= { { .name = "alert", .level = LOG_ALERT }, - { .name = "crit", .level = LOG_CRIT }, - { .name = "debug", .level = LOG_DEBUG }, - { .name = "emerg", .level = LOG_EMERG }, - { .name = "error", .level = LOG_ERR }, /* DEPRECATED */ - { .name = "info", .level = LOG_INFO }, - { .name = "notice", .level = LOG_NOTICE }, - { .name = "panic", .level = LOG_EMERG }, /* DEPRECATED */ - { .name = "warning", .level = LOG_WARNING } -}; - -static void LOG_parse(struct xt_option_call *cb) -{ - struct ipt_log_info *info = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_LOG_PREFIX: - if (strchr(cb->arg, '\n') != NULL) - xtables_error(PARAMETER_PROBLEM, - "Newlines not allowed in --log-prefix"); - break; - case O_LOG_TCPSEQ: - info->logflags = IPT_LOG_TCPSEQ; - break; - case O_LOG_TCPOPTS: - info->logflags = IPT_LOG_TCPOPT; - break; - case O_LOG_IPOPTS: - info->logflags = IPT_LOG_IPOPT; - break; - case O_LOG_UID: - info->logflags = IPT_LOG_UID; - break; - case O_LOG_MAC: - info->logflags = IPT_LOG_MACDECODE; - break; - } -} - -static void LOG_print(const void *ip, const struct xt_entry_target *target, - int numeric) -{ - const struct ipt_log_info *loginfo - = (const struct ipt_log_info *)target->data; - unsigned int i = 0; - - printf(" LOG"); - if (numeric) - printf(" flags %u level %u", - loginfo->logflags, loginfo->level); - else { - for (i = 0; i < ARRAY_SIZE(ipt_log_names); ++i) - if (loginfo->level == ipt_log_names[i].level) { - printf(" level %s", ipt_log_names[i].name); - break; - } - if (i == ARRAY_SIZE(ipt_log_names)) - printf(" UNKNOWN level %u", loginfo->level); - if (loginfo->logflags & IPT_LOG_TCPSEQ) - printf(" tcp-sequence"); - if (loginfo->logflags & IPT_LOG_TCPOPT) - printf(" tcp-options"); - if (loginfo->logflags & IPT_LOG_IPOPT) - printf(" ip-options"); - if (loginfo->logflags & IPT_LOG_UID) - printf(" uid"); - if (loginfo->logflags & IPT_LOG_MACDECODE) - printf(" macdecode"); - if (loginfo->logflags & ~(IPT_LOG_MASK)) - printf(" unknown-flags"); - } - - if (strcmp(loginfo->prefix, "") != 0) - printf(" prefix \"%s\"", loginfo->prefix); -} - -static void LOG_save(const void *ip, const struct xt_entry_target *target) -{ - const struct ipt_log_info *loginfo - = (const struct ipt_log_info *)target->data; - - if (strcmp(loginfo->prefix, "") != 0) { - printf(" --log-prefix"); - xtables_save_string(loginfo->prefix); - } - - if (loginfo->level != LOG_DEFAULT_LEVEL) - printf(" --log-level %d", loginfo->level); - - if (loginfo->logflags & IPT_LOG_TCPSEQ) - printf(" --log-tcp-sequence"); - if (loginfo->logflags & IPT_LOG_TCPOPT) - printf(" --log-tcp-options"); - if (loginfo->logflags & IPT_LOG_IPOPT) - printf(" --log-ip-options"); - if (loginfo->logflags & IPT_LOG_UID) - printf(" --log-uid"); - if (loginfo->logflags & IPT_LOG_MACDECODE) - printf(" --log-macdecode"); -} - -static struct xtables_target log_tg_reg = { - .name = "LOG", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct ipt_log_info)), - .userspacesize = XT_ALIGN(sizeof(struct ipt_log_info)), - .help = LOG_help, - .init = LOG_init, - .print = LOG_print, - .save = LOG_save, - .x6_parse = LOG_parse, - .x6_options = LOG_opts, -}; - -void _init(void) -{ - xtables_register_target(&log_tg_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_LOG.man b/src/main/jni/iptables/extensions/libipt_LOG.man deleted file mode 100644 index 47c35e0e..00000000 --- a/src/main/jni/iptables/extensions/libipt_LOG.man +++ /dev/null @@ -1,31 +0,0 @@ -Turn on kernel logging of matching packets. When this option is set -for a rule, the Linux kernel will print some information on all -matching packets (like most IP header fields) via the kernel log -(where it can be read with -.I dmesg -or -.IR syslogd (8)). -This is a "non-terminating target", i.e. rule traversal continues at -the next rule. So if you want to LOG the packets you refuse, use two -separate rules with the same matching criteria, first using target LOG -then DROP (or REJECT). -.TP -\fB\-\-log\-level\fP \fIlevel\fP -Level of logging (numeric or see \fIsyslog.conf\fP(5)). -.TP -\fB\-\-log\-prefix\fP \fIprefix\fP -Prefix log messages with the specified prefix; up to 29 letters long, -and useful for distinguishing messages in the logs. -.TP -\fB\-\-log\-tcp\-sequence\fP -Log TCP sequence numbers. This is a security risk if the log is -readable by users. -.TP -\fB\-\-log\-tcp\-options\fP -Log options from the TCP packet header. -.TP -\fB\-\-log\-ip\-options\fP -Log options from the IP packet header. -.TP -\fB\-\-log\-uid\fP -Log the userid of the process which generated the packet. diff --git a/src/main/jni/iptables/extensions/libipt_MASQUERADE.c b/src/main/jni/iptables/extensions/libipt_MASQUERADE.c deleted file mode 100644 index 7ba42dfd..00000000 --- a/src/main/jni/iptables/extensions/libipt_MASQUERADE.c +++ /dev/null @@ -1,154 +0,0 @@ -#include -#include -#include -#include -#include -#include -#include /* INT_MAX in ip_tables.h */ -#include -#include - -enum { - O_TO_PORTS = 0, - O_RANDOM, -}; - -static void MASQUERADE_help(void) -{ - printf( -"MASQUERADE target options:\n" -" --to-ports [-]\n" -" Port (range) to map to.\n" -" --random\n" -" Randomize source port.\n"); -} - -static const struct xt_option_entry MASQUERADE_opts[] = { - {.name = "to-ports", .id = O_TO_PORTS, .type = XTTYPE_STRING}, - {.name = "random", .id = O_RANDOM, .type = XTTYPE_NONE}, - XTOPT_TABLEEND, -}; - -static void MASQUERADE_init(struct xt_entry_target *t) -{ - struct nf_nat_multi_range *mr = (struct nf_nat_multi_range *)t->data; - - /* Actually, it's 0, but it's ignored at the moment. */ - mr->rangesize = 1; -} - -/* Parses ports */ -static void -parse_ports(const char *arg, struct nf_nat_multi_range *mr) -{ - char *end; - unsigned int port, maxport; - - mr->range[0].flags |= IP_NAT_RANGE_PROTO_SPECIFIED; - - if (!xtables_strtoui(arg, &end, &port, 0, UINT16_MAX)) - xtables_param_act(XTF_BAD_VALUE, "MASQUERADE", "--to-ports", arg); - - switch (*end) { - case '\0': - mr->range[0].min.tcp.port - = mr->range[0].max.tcp.port - = htons(port); - return; - case '-': - if (!xtables_strtoui(end + 1, NULL, &maxport, 0, UINT16_MAX)) - break; - - if (maxport < port) - break; - - mr->range[0].min.tcp.port = htons(port); - mr->range[0].max.tcp.port = htons(maxport); - return; - default: - break; - } - xtables_param_act(XTF_BAD_VALUE, "MASQUERADE", "--to-ports", arg); -} - -static void MASQUERADE_parse(struct xt_option_call *cb) -{ - const struct ipt_entry *entry = cb->xt_entry; - int portok; - struct nf_nat_multi_range *mr = cb->data; - - if (entry->ip.proto == IPPROTO_TCP - || entry->ip.proto == IPPROTO_UDP - || entry->ip.proto == IPPROTO_SCTP - || entry->ip.proto == IPPROTO_DCCP - || entry->ip.proto == IPPROTO_ICMP) - portok = 1; - else - portok = 0; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_TO_PORTS: - if (!portok) - xtables_error(PARAMETER_PROBLEM, - "Need TCP, UDP, SCTP or DCCP with port specification"); - parse_ports(cb->arg, mr); - break; - case O_RANDOM: - mr->range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; - break; - } -} - -static void -MASQUERADE_print(const void *ip, const struct xt_entry_target *target, - int numeric) -{ - const struct nf_nat_multi_range *mr = (const void *)target->data; - const struct nf_nat_range *r = &mr->range[0]; - - if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) { - printf(" masq ports: "); - printf("%hu", ntohs(r->min.tcp.port)); - if (r->max.tcp.port != r->min.tcp.port) - printf("-%hu", ntohs(r->max.tcp.port)); - } - - if (r->flags & IP_NAT_RANGE_PROTO_RANDOM) - printf(" random"); -} - -static void -MASQUERADE_save(const void *ip, const struct xt_entry_target *target) -{ - const struct nf_nat_multi_range *mr = (const void *)target->data; - const struct nf_nat_range *r = &mr->range[0]; - - if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) { - printf(" --to-ports %hu", ntohs(r->min.tcp.port)); - if (r->max.tcp.port != r->min.tcp.port) - printf("-%hu", ntohs(r->max.tcp.port)); - } - - if (r->flags & IP_NAT_RANGE_PROTO_RANDOM) - printf(" --random"); -} - -static struct xtables_target masquerade_tg_reg = { - .name = "MASQUERADE", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct nf_nat_multi_range)), - .userspacesize = XT_ALIGN(sizeof(struct nf_nat_multi_range)), - .help = MASQUERADE_help, - .init = MASQUERADE_init, - .x6_parse = MASQUERADE_parse, - .print = MASQUERADE_print, - .save = MASQUERADE_save, - .x6_options = MASQUERADE_opts, -}; - -void _init(void) -{ - xtables_register_target(&masquerade_tg_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_MASQUERADE.man b/src/main/jni/iptables/extensions/libipt_MASQUERADE.man deleted file mode 100644 index 2dae9640..00000000 --- a/src/main/jni/iptables/extensions/libipt_MASQUERADE.man +++ /dev/null @@ -1,30 +0,0 @@ -This target is only valid in the -.B nat -table, in the -.B POSTROUTING -chain. It should only be used with dynamically assigned IP (dialup) -connections: if you have a static IP address, you should use the SNAT -target. Masquerading is equivalent to specifying a mapping to the IP -address of the interface the packet is going out, but also has the -effect that connections are -.I forgotten -when the interface goes down. This is the correct behavior when the -next dialup is unlikely to have the same interface address (and hence -any established connections are lost anyway). -.TP -\fB\-\-to\-ports\fP \fIport\fP[\fB\-\fP\fIport\fP] -This specifies a range of source ports to use, overriding the default -.B SNAT -source port-selection heuristics (see above). This is only valid -if the rule also specifies -\fB\-p tcp\fP -or -\fB\-p udp\fP. -.TP -\fB\-\-random\fP -Randomize source port mapping -If option -\fB\-\-random\fP -is used then port mapping will be randomized (kernel >= 2.6.21). -.RS -.PP diff --git a/src/main/jni/iptables/extensions/libipt_MIRROR.c b/src/main/jni/iptables/extensions/libipt_MIRROR.c deleted file mode 100644 index fb78751d..00000000 --- a/src/main/jni/iptables/extensions/libipt_MIRROR.c +++ /dev/null @@ -1,15 +0,0 @@ -/* Shared library add-on to iptables to add MIRROR target support. */ -#include - -static struct xtables_target mirror_tg_reg = { - .name = "MIRROR", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(0), - .userspacesize = XT_ALIGN(0), -}; - -void _init(void) -{ - xtables_register_target(&mirror_tg_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_MIRROR.man b/src/main/jni/iptables/extensions/libipt_MIRROR.man deleted file mode 100644 index 7b720bcb..00000000 --- a/src/main/jni/iptables/extensions/libipt_MIRROR.man +++ /dev/null @@ -1,12 +0,0 @@ -This is an experimental demonstration target which inverts the source -and destination fields in the IP header and retransmits the packet. -It is only valid in the -.BR INPUT , -.B FORWARD -and -.B PREROUTING -chains, and user-defined chains which are only called from those -chains. Note that the outgoing packets are -.B NOT -seen by any packet filtering chains, connection tracking or NAT, to -avoid loops and other problems. diff --git a/src/main/jni/iptables/extensions/libipt_NETMAP.c b/src/main/jni/iptables/extensions/libipt_NETMAP.c deleted file mode 100644 index 5c4471a9..00000000 --- a/src/main/jni/iptables/extensions/libipt_NETMAP.c +++ /dev/null @@ -1,106 +0,0 @@ -/* Shared library add-on to iptables to add static NAT support. - Author: Svenning Soerensen -*/ -#include -#include -#include -#include -#include -#include -#include - -#define MODULENAME "NETMAP" - -enum { - O_TO = 0, -}; - -static const struct xt_option_entry NETMAP_opts[] = { - {.name = "to", .id = O_TO, .type = XTTYPE_HOSTMASK, - .flags = XTOPT_MAND}, - XTOPT_TABLEEND, -}; - -static void NETMAP_help(void) -{ - printf(MODULENAME" target options:\n" - " --%s address[/mask]\n" - " Network address to map to.\n\n", - NETMAP_opts[0].name); -} - -static int -netmask2bits(uint32_t netmask) -{ - uint32_t bm; - int bits; - - netmask = ntohl(netmask); - for (bits = 0, bm = 0x80000000; netmask & bm; netmask <<= 1) - bits++; - if (netmask) - return -1; /* holes in netmask */ - return bits; -} - -static void NETMAP_init(struct xt_entry_target *t) -{ - struct nf_nat_multi_range *mr = (struct nf_nat_multi_range *)t->data; - - /* Actually, it's 0, but it's ignored at the moment. */ - mr->rangesize = 1; -} - -static void NETMAP_parse(struct xt_option_call *cb) -{ - struct nf_nat_multi_range *mr = cb->data; - struct nf_nat_range *range = &mr->range[0]; - - xtables_option_parse(cb); - range->flags |= IP_NAT_RANGE_MAP_IPS; - range->min_ip = cb->val.haddr.ip & cb->val.hmask.ip; - range->max_ip = range->min_ip | ~cb->val.hmask.ip; -} - -static void NETMAP_print(const void *ip, const struct xt_entry_target *target, - int numeric) -{ - const struct nf_nat_multi_range *mr = (const void *)target->data; - const struct nf_nat_range *r = &mr->range[0]; - struct in_addr a; - int bits; - - a.s_addr = r->min_ip; - printf("%s", xtables_ipaddr_to_numeric(&a)); - a.s_addr = ~(r->min_ip ^ r->max_ip); - bits = netmask2bits(a.s_addr); - if (bits < 0) - printf("/%s", xtables_ipaddr_to_numeric(&a)); - else - printf("/%d", bits); -} - -static void NETMAP_save(const void *ip, const struct xt_entry_target *target) -{ - printf(" --%s ", NETMAP_opts[0].name); - NETMAP_print(ip, target, 0); -} - -static struct xtables_target netmap_tg_reg = { - .name = MODULENAME, - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct nf_nat_multi_range)), - .userspacesize = XT_ALIGN(sizeof(struct nf_nat_multi_range)), - .help = NETMAP_help, - .init = NETMAP_init, - .x6_parse = NETMAP_parse, - .print = NETMAP_print, - .save = NETMAP_save, - .x6_options = NETMAP_opts, -}; - -void _init(void) -{ - xtables_register_target(&netmap_tg_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_NETMAP.man b/src/main/jni/iptables/extensions/libipt_NETMAP.man deleted file mode 100644 index a7e90b8d..00000000 --- a/src/main/jni/iptables/extensions/libipt_NETMAP.man +++ /dev/null @@ -1,9 +0,0 @@ -This target allows you to statically map a whole network of addresses onto -another network of addresses. It can only be used from rules in the -.B nat -table. -.TP -\fB\-\-to\fP \fIaddress\fP[\fB/\fP\fImask\fP] -Network address to map to. The resulting address will be constructed in the -following way: All 'one' bits in the mask are filled in from the new `address'. -All bits that are zero in the mask are filled in from the original address. diff --git a/src/main/jni/iptables/extensions/libipt_REDIRECT.c b/src/main/jni/iptables/extensions/libipt_REDIRECT.c deleted file mode 100644 index e67360a0..00000000 --- a/src/main/jni/iptables/extensions/libipt_REDIRECT.c +++ /dev/null @@ -1,155 +0,0 @@ -#include -#include -#include -#include -#include /* INT_MAX in ip_tables.h */ -#include -#include - -enum { - O_TO_PORTS = 0, - O_RANDOM, - F_TO_PORTS = 1 << O_TO_PORTS, - F_RANDOM = 1 << O_RANDOM, -}; - -static void REDIRECT_help(void) -{ - printf( -"REDIRECT target options:\n" -" --to-ports [-]\n" -" Port (range) to map to.\n" -" [--random]\n"); -} - -static const struct xt_option_entry REDIRECT_opts[] = { - {.name = "to-ports", .id = O_TO_PORTS, .type = XTTYPE_STRING}, - {.name = "random", .id = O_RANDOM, .type = XTTYPE_NONE}, - XTOPT_TABLEEND, -}; - -static void REDIRECT_init(struct xt_entry_target *t) -{ - struct nf_nat_multi_range *mr = (struct nf_nat_multi_range *)t->data; - - /* Actually, it's 0, but it's ignored at the moment. */ - mr->rangesize = 1; -} - -/* Parses ports */ -static void -parse_ports(const char *arg, struct nf_nat_multi_range *mr) -{ - char *end = ""; - unsigned int port, maxport; - - mr->range[0].flags |= IP_NAT_RANGE_PROTO_SPECIFIED; - - if (!xtables_strtoui(arg, &end, &port, 0, UINT16_MAX) && - (port = xtables_service_to_port(arg, NULL)) == (unsigned)-1) - xtables_param_act(XTF_BAD_VALUE, "REDIRECT", "--to-ports", arg); - - switch (*end) { - case '\0': - mr->range[0].min.tcp.port - = mr->range[0].max.tcp.port - = htons(port); - return; - case '-': - if (!xtables_strtoui(end + 1, NULL, &maxport, 0, UINT16_MAX) && - (maxport = xtables_service_to_port(end + 1, NULL)) == (unsigned)-1) - break; - - if (maxport < port) - break; - - mr->range[0].min.tcp.port = htons(port); - mr->range[0].max.tcp.port = htons(maxport); - return; - default: - break; - } - xtables_param_act(XTF_BAD_VALUE, "REDIRECT", "--to-ports", arg); -} - -static void REDIRECT_parse(struct xt_option_call *cb) -{ - const struct ipt_entry *entry = cb->xt_entry; - struct nf_nat_multi_range *mr = (void *)(*cb->target)->data; - int portok; - - if (entry->ip.proto == IPPROTO_TCP - || entry->ip.proto == IPPROTO_UDP - || entry->ip.proto == IPPROTO_SCTP - || entry->ip.proto == IPPROTO_DCCP - || entry->ip.proto == IPPROTO_ICMP) - portok = 1; - else - portok = 0; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_TO_PORTS: - if (!portok) - xtables_error(PARAMETER_PROBLEM, - "Need TCP, UDP, SCTP or DCCP with port specification"); - parse_ports(cb->arg, mr); - if (cb->xflags & F_RANDOM) - mr->range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; - break; - case O_RANDOM: - if (cb->xflags & F_TO_PORTS) - mr->range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; - break; - } -} - -static void REDIRECT_print(const void *ip, const struct xt_entry_target *target, - int numeric) -{ - const struct nf_nat_multi_range *mr = (const void *)target->data; - const struct nf_nat_range *r = &mr->range[0]; - - if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) { - printf(" redir ports "); - printf("%hu", ntohs(r->min.tcp.port)); - if (r->max.tcp.port != r->min.tcp.port) - printf("-%hu", ntohs(r->max.tcp.port)); - if (mr->range[0].flags & IP_NAT_RANGE_PROTO_RANDOM) - printf(" random"); - } -} - -static void REDIRECT_save(const void *ip, const struct xt_entry_target *target) -{ - const struct nf_nat_multi_range *mr = (const void *)target->data; - const struct nf_nat_range *r = &mr->range[0]; - - if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) { - printf(" --to-ports "); - printf("%hu", ntohs(r->min.tcp.port)); - if (r->max.tcp.port != r->min.tcp.port) - printf("-%hu", ntohs(r->max.tcp.port)); - if (mr->range[0].flags & IP_NAT_RANGE_PROTO_RANDOM) - printf(" --random"); - } -} - -static struct xtables_target redirect_tg_reg = { - .name = "REDIRECT", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct nf_nat_multi_range)), - .userspacesize = XT_ALIGN(sizeof(struct nf_nat_multi_range)), - .help = REDIRECT_help, - .init = REDIRECT_init, - .x6_parse = REDIRECT_parse, - .print = REDIRECT_print, - .save = REDIRECT_save, - .x6_options = REDIRECT_opts, -}; - -void _init(void) -{ - xtables_register_target(&redirect_tg_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_REDIRECT.man b/src/main/jni/iptables/extensions/libipt_REDIRECT.man deleted file mode 100644 index 90ab19d7..00000000 --- a/src/main/jni/iptables/extensions/libipt_REDIRECT.man +++ /dev/null @@ -1,25 +0,0 @@ -This target is only valid in the -.B nat -table, in the -.B PREROUTING -and -.B OUTPUT -chains, and user-defined chains which are only called from those -chains. It redirects the packet to the machine itself by changing the -destination IP to the primary address of the incoming interface -(locally-generated packets are mapped to the 127.0.0.1 address). -.TP -\fB\-\-to\-ports\fP \fIport\fP[\fB\-\fP\fIport\fP] -This specifies a destination port or range of ports to use: without -this, the destination port is never altered. This is only valid -if the rule also specifies -\fB\-p tcp\fP -or -\fB\-p udp\fP. -.TP -\fB\-\-random\fP -If option -\fB\-\-random\fP -is used then port mapping will be randomized (kernel >= 2.6.22). -.RS -.PP diff --git a/src/main/jni/iptables/extensions/libipt_REJECT.c b/src/main/jni/iptables/extensions/libipt_REJECT.c deleted file mode 100644 index 362c65ed..00000000 --- a/src/main/jni/iptables/extensions/libipt_REJECT.c +++ /dev/null @@ -1,160 +0,0 @@ -/* Shared library add-on to iptables to add customized REJECT support. - * - * (C) 2000 Jozsef Kadlecsik - */ -#include -#include -#include -#include -#include - -/* If we are compiling against a kernel that does not support - * IPT_ICMP_ADMIN_PROHIBITED, we are emulating it. - * The result will be a plain DROP of the packet instead of - * reject. -- Maciej Soltysiak - */ -#ifndef IPT_ICMP_ADMIN_PROHIBITED -#define IPT_ICMP_ADMIN_PROHIBITED IPT_TCP_RESET + 1 -#endif - -struct reject_names { - const char *name; - const char *alias; - enum ipt_reject_with with; - const char *desc; -}; - -enum { - O_REJECT_WITH = 0, -}; - -static const struct reject_names reject_table[] = { - {"icmp-net-unreachable", "net-unreach", - IPT_ICMP_NET_UNREACHABLE, "ICMP network unreachable"}, - {"icmp-host-unreachable", "host-unreach", - IPT_ICMP_HOST_UNREACHABLE, "ICMP host unreachable"}, - {"icmp-proto-unreachable", "proto-unreach", - IPT_ICMP_PROT_UNREACHABLE, "ICMP protocol unreachable"}, - {"icmp-port-unreachable", "port-unreach", - IPT_ICMP_PORT_UNREACHABLE, "ICMP port unreachable (default)"}, -#if 0 - {"echo-reply", "echoreply", - IPT_ICMP_ECHOREPLY, "for ICMP echo only: faked ICMP echo reply"}, -#endif - {"icmp-net-prohibited", "net-prohib", - IPT_ICMP_NET_PROHIBITED, "ICMP network prohibited"}, - {"icmp-host-prohibited", "host-prohib", - IPT_ICMP_HOST_PROHIBITED, "ICMP host prohibited"}, - {"tcp-reset", "tcp-rst", - IPT_TCP_RESET, "TCP RST packet"}, - {"icmp-admin-prohibited", "admin-prohib", - IPT_ICMP_ADMIN_PROHIBITED, "ICMP administratively prohibited (*)"} -}; - -static void -print_reject_types(void) -{ - unsigned int i; - - printf("Valid reject types:\n"); - - for (i = 0; i < ARRAY_SIZE(reject_table); ++i) { - printf(" %-25s\t%s\n", reject_table[i].name, reject_table[i].desc); - printf(" %-25s\talias\n", reject_table[i].alias); - } - printf("\n"); -} - -static void REJECT_help(void) -{ - printf( -"REJECT target options:\n" -"--reject-with type drop input packet and send back\n" -" a reply packet according to type:\n"); - - print_reject_types(); - - printf("(*) See man page or read the INCOMPATIBILITES file for compatibility issues.\n"); -} - -static const struct xt_option_entry REJECT_opts[] = { - {.name = "reject-with", .id = O_REJECT_WITH, .type = XTTYPE_STRING}, - XTOPT_TABLEEND, -}; - -static void REJECT_init(struct xt_entry_target *t) -{ - struct ipt_reject_info *reject = (struct ipt_reject_info *)t->data; - - /* default */ - reject->with = IPT_ICMP_PORT_UNREACHABLE; - -} - -static void REJECT_parse(struct xt_option_call *cb) -{ - struct ipt_reject_info *reject = cb->data; - unsigned int i; - - xtables_option_parse(cb); - for (i = 0; i < ARRAY_SIZE(reject_table); ++i) - if (strncasecmp(reject_table[i].name, - cb->arg, strlen(cb->arg)) == 0 || - strncasecmp(reject_table[i].alias, - cb->arg, strlen(cb->arg)) == 0) { - reject->with = reject_table[i].with; - return; - } - /* This due to be dropped late in 2.4 pre-release cycle --RR */ - if (strncasecmp("echo-reply", cb->arg, strlen(cb->arg)) == 0 || - strncasecmp("echoreply", cb->arg, strlen(cb->arg)) == 0) - fprintf(stderr, "--reject-with echo-reply no longer" - " supported\n"); - xtables_error(PARAMETER_PROBLEM, - "unknown reject type \"%s\"", cb->arg); -} - -static void REJECT_print(const void *ip, const struct xt_entry_target *target, - int numeric) -{ - const struct ipt_reject_info *reject - = (const struct ipt_reject_info *)target->data; - unsigned int i; - - for (i = 0; i < ARRAY_SIZE(reject_table); ++i) - if (reject_table[i].with == reject->with) - break; - printf(" reject-with %s", reject_table[i].name); -} - -static void REJECT_save(const void *ip, const struct xt_entry_target *target) -{ - const struct ipt_reject_info *reject - = (const struct ipt_reject_info *)target->data; - unsigned int i; - - for (i = 0; i < ARRAY_SIZE(reject_table); ++i) - if (reject_table[i].with == reject->with) - break; - - printf(" --reject-with %s", reject_table[i].name); -} - -static struct xtables_target reject_tg_reg = { - .name = "REJECT", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct ipt_reject_info)), - .userspacesize = XT_ALIGN(sizeof(struct ipt_reject_info)), - .help = REJECT_help, - .init = REJECT_init, - .print = REJECT_print, - .save = REJECT_save, - .x6_parse = REJECT_parse, - .x6_options = REJECT_opts, -}; - -void _init(void) -{ - xtables_register_target(&reject_tg_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_REJECT.man b/src/main/jni/iptables/extensions/libipt_REJECT.man deleted file mode 100644 index c419a85e..00000000 --- a/src/main/jni/iptables/extensions/libipt_REJECT.man +++ /dev/null @@ -1,32 +0,0 @@ -This is used to send back an error packet in response to the matched -packet: otherwise it is equivalent to -.B DROP -so it is a terminating TARGET, ending rule traversal. -This target is only valid in the -.BR INPUT , -.B FORWARD -and -.B OUTPUT -chains, and user-defined chains which are only called from those -chains. The following option controls the nature of the error packet -returned: -.TP -\fB\-\-reject\-with\fP \fItype\fP -The type given can be -\fBicmp\-net\-unreachable\fP, -\fBicmp\-host\-unreachable\fP, -\fBicmp\-port\-unreachable\fP, -\fBicmp\-proto\-unreachable\fP, -\fBicmp\-net\-prohibited\fP, -\fBicmp\-host\-prohibited\fP or -\fBicmp\-admin\-prohibited\fP (*) -which return the appropriate ICMP error message (\fBport\-unreachable\fP is -the default). The option -\fBtcp\-reset\fP -can be used on rules which only match the TCP protocol: this causes a -TCP RST packet to be sent back. This is mainly useful for blocking -.I ident -(113/tcp) probes which frequently occur when sending mail to broken mail -hosts (which won't accept your mail otherwise). -.PP -(*) Using icmp\-admin\-prohibited with kernels that do not support it will result in a plain DROP instead of REJECT diff --git a/src/main/jni/iptables/extensions/libipt_SAME.c b/src/main/jni/iptables/extensions/libipt_SAME.c deleted file mode 100644 index 2ff6c82e..00000000 --- a/src/main/jni/iptables/extensions/libipt_SAME.c +++ /dev/null @@ -1,177 +0,0 @@ -#include -#include -#include -#include -#include -#include - -enum { - O_TO_ADDR = 0, - O_NODST, - O_RANDOM, - F_RANDOM = 1 << O_RANDOM, -}; - -static void SAME_help(void) -{ - printf( -"SAME target options:\n" -" --to -\n" -" Addresses to map source to.\n" -" May be specified more than\n" -" once for multiple ranges.\n" -" --nodst\n" -" Don't use destination-ip in\n" -" source selection\n" -" --random\n" -" Randomize source port\n"); -} - -static const struct xt_option_entry SAME_opts[] = { - {.name = "to", .id = O_TO_ADDR, .type = XTTYPE_STRING, - .flags = XTOPT_MAND}, - {.name = "nodst", .id = O_NODST, .type = XTTYPE_NONE}, - {.name = "random", .id = O_RANDOM, .type = XTTYPE_NONE}, - XTOPT_TABLEEND, -}; - -/* Parses range of IPs */ -static void parse_to(const char *orig_arg, struct nf_nat_range *range) -{ - char *dash, *arg; - const struct in_addr *ip; - - arg = strdup(orig_arg); - if (arg == NULL) - xtables_error(RESOURCE_PROBLEM, "strdup"); - range->flags |= IP_NAT_RANGE_MAP_IPS; - dash = strchr(arg, '-'); - - if (dash) - *dash = '\0'; - - ip = xtables_numeric_to_ipaddr(arg); - if (!ip) - xtables_error(PARAMETER_PROBLEM, "Bad IP address \"%s\"\n", - arg); - range->min_ip = ip->s_addr; - - if (dash) { - ip = xtables_numeric_to_ipaddr(dash+1); - if (!ip) - xtables_error(PARAMETER_PROBLEM, "Bad IP address \"%s\"\n", - dash+1); - } - range->max_ip = ip->s_addr; - if (dash) - if (range->min_ip > range->max_ip) - xtables_error(PARAMETER_PROBLEM, "Bad IP range \"%s-%s\"\n", - arg, dash+1); - free(arg); -} - -static void SAME_parse(struct xt_option_call *cb) -{ - struct ipt_same_info *mr = cb->data; - unsigned int count; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_TO_ADDR: - if (mr->rangesize == IPT_SAME_MAX_RANGE) - xtables_error(PARAMETER_PROBLEM, - "Too many ranges specified, maximum " - "is %i ranges.\n", - IPT_SAME_MAX_RANGE); - parse_to(cb->arg, &mr->range[mr->rangesize]); - /* WTF do we need this for? */ - if (cb->xflags & F_RANDOM) - mr->range[mr->rangesize].flags - |= IP_NAT_RANGE_PROTO_RANDOM; - mr->rangesize++; - break; - case O_NODST: - mr->info |= IPT_SAME_NODST; - break; - case O_RANDOM: - for (count=0; count < mr->rangesize; count++) - mr->range[count].flags |= IP_NAT_RANGE_PROTO_RANDOM; - break; - } -} - -static void SAME_print(const void *ip, const struct xt_entry_target *target, - int numeric) -{ - unsigned int count; - const struct ipt_same_info *mr = (const void *)target->data; - int random_selection = 0; - - printf(" same:"); - - for (count = 0; count < mr->rangesize; count++) { - const struct nf_nat_range *r = &mr->range[count]; - struct in_addr a; - - a.s_addr = r->min_ip; - - printf("%s", xtables_ipaddr_to_numeric(&a)); - a.s_addr = r->max_ip; - - if (r->min_ip != r->max_ip) - printf("-%s", xtables_ipaddr_to_numeric(&a)); - if (r->flags & IP_NAT_RANGE_PROTO_RANDOM) - random_selection = 1; - } - - if (mr->info & IPT_SAME_NODST) - printf(" nodst"); - - if (random_selection) - printf(" random"); -} - -static void SAME_save(const void *ip, const struct xt_entry_target *target) -{ - unsigned int count; - const struct ipt_same_info *mr = (const void *)target->data; - int random_selection = 0; - - for (count = 0; count < mr->rangesize; count++) { - const struct nf_nat_range *r = &mr->range[count]; - struct in_addr a; - - a.s_addr = r->min_ip; - printf(" --to %s", xtables_ipaddr_to_numeric(&a)); - a.s_addr = r->max_ip; - - if (r->min_ip != r->max_ip) - printf("-%s", xtables_ipaddr_to_numeric(&a)); - if (r->flags & IP_NAT_RANGE_PROTO_RANDOM) - random_selection = 1; - } - - if (mr->info & IPT_SAME_NODST) - printf(" --nodst"); - - if (random_selection) - printf(" --random"); -} - -static struct xtables_target same_tg_reg = { - .name = "SAME", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct ipt_same_info)), - .userspacesize = XT_ALIGN(sizeof(struct ipt_same_info)), - .help = SAME_help, - .x6_parse = SAME_parse, - .print = SAME_print, - .save = SAME_save, - .x6_options = SAME_opts, -}; - -void _init(void) -{ - xtables_register_target(&same_tg_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_SAME.man b/src/main/jni/iptables/extensions/libipt_SAME.man deleted file mode 100644 index a99dc73f..00000000 --- a/src/main/jni/iptables/extensions/libipt_SAME.man +++ /dev/null @@ -1,17 +0,0 @@ -Similar to SNAT/DNAT depending on chain: it takes a range of addresses -(`\-\-to 1.2.3.4\-1.2.3.7') and gives a client the same -source-/destination-address for each connection. -.PP -N.B.: The DNAT target's \fB\-\-persistent\fP option replaced the SAME target. -.TP -\fB\-\-to\fP \fIipaddr\fP[\fB\-\fP\fIipaddr\fP] -Addresses to map source to. May be specified more than once for -multiple ranges. -.TP -\fB\-\-nodst\fP -Don't use the destination-ip in the calculations when selecting the -new source-ip -.TP -\fB\-\-random\fP -Port mapping will be forcibly randomized to avoid attacks based on -port prediction (kernel >= 2.6.21). diff --git a/src/main/jni/iptables/extensions/libipt_SNAT.c b/src/main/jni/iptables/extensions/libipt_SNAT.c deleted file mode 100644 index 80233060..00000000 --- a/src/main/jni/iptables/extensions/libipt_SNAT.c +++ /dev/null @@ -1,259 +0,0 @@ -#include -#include -#include -#include -#include -#include -#include /* INT_MAX in ip_tables.h */ -#include -#include - -enum { - O_TO_SRC = 0, - O_RANDOM, - O_PERSISTENT, - O_X_TO_SRC, - F_TO_SRC = 1 << O_TO_SRC, - F_RANDOM = 1 << O_RANDOM, - F_X_TO_SRC = 1 << O_X_TO_SRC, -}; - -/* Source NAT data consists of a multi-range, indicating where to map - to. */ -struct ipt_natinfo -{ - struct xt_entry_target t; - struct nf_nat_multi_range mr; -}; - -static void SNAT_help(void) -{ - printf( -"SNAT target options:\n" -" --to-source [[-]][:port[-port]]\n" -" Address to map source to.\n" -"[--random] [--persistent]\n"); -} - -static const struct xt_option_entry SNAT_opts[] = { - {.name = "to-source", .id = O_TO_SRC, .type = XTTYPE_STRING, - .flags = XTOPT_MAND | XTOPT_MULTI}, - {.name = "random", .id = O_RANDOM, .type = XTTYPE_NONE}, - {.name = "persistent", .id = O_PERSISTENT, .type = XTTYPE_NONE}, - XTOPT_TABLEEND, -}; - -static struct ipt_natinfo * -append_range(struct ipt_natinfo *info, const struct nf_nat_range *range) -{ - unsigned int size; - - /* One rangesize already in struct ipt_natinfo */ - size = XT_ALIGN(sizeof(*info) + info->mr.rangesize * sizeof(*range)); - - info = realloc(info, size); - if (!info) - xtables_error(OTHER_PROBLEM, "Out of memory\n"); - - info->t.u.target_size = size; - info->mr.range[info->mr.rangesize] = *range; - info->mr.rangesize++; - - return info; -} - -/* Ranges expected in network order. */ -static struct xt_entry_target * -parse_to(const char *orig_arg, int portok, struct ipt_natinfo *info) -{ - struct nf_nat_range range; - char *arg, *colon, *dash, *error; - const struct in_addr *ip; - - arg = strdup(orig_arg); - if (arg == NULL) - xtables_error(RESOURCE_PROBLEM, "strdup"); - memset(&range, 0, sizeof(range)); - colon = strchr(arg, ':'); - - if (colon) { - int port; - - if (!portok) - xtables_error(PARAMETER_PROBLEM, - "Need TCP, UDP, SCTP or DCCP with port specification"); - - range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED; - - port = atoi(colon+1); - if (port <= 0 || port > 65535) - xtables_error(PARAMETER_PROBLEM, - "Port `%s' not valid\n", colon+1); - - error = strchr(colon+1, ':'); - if (error) - xtables_error(PARAMETER_PROBLEM, - "Invalid port:port syntax - use dash\n"); - - dash = strchr(colon, '-'); - if (!dash) { - range.min.tcp.port - = range.max.tcp.port - = htons(port); - } else { - int maxport; - - maxport = atoi(dash + 1); - if (maxport <= 0 || maxport > 65535) - xtables_error(PARAMETER_PROBLEM, - "Port `%s' not valid\n", dash+1); - if (maxport < port) - /* People are stupid. */ - xtables_error(PARAMETER_PROBLEM, - "Port range `%s' funky\n", colon+1); - range.min.tcp.port = htons(port); - range.max.tcp.port = htons(maxport); - } - /* Starts with a colon? No IP info...*/ - if (colon == arg) { - free(arg); - return &(append_range(info, &range)->t); - } - *colon = '\0'; - } - - range.flags |= IP_NAT_RANGE_MAP_IPS; - dash = strchr(arg, '-'); - if (colon && dash && dash > colon) - dash = NULL; - - if (dash) - *dash = '\0'; - - ip = xtables_numeric_to_ipaddr(arg); - if (!ip) - xtables_error(PARAMETER_PROBLEM, "Bad IP address \"%s\"\n", - arg); - range.min_ip = ip->s_addr; - if (dash) { - ip = xtables_numeric_to_ipaddr(dash+1); - if (!ip) - xtables_error(PARAMETER_PROBLEM, "Bad IP address \"%s\"\n", - dash+1); - range.max_ip = ip->s_addr; - } else - range.max_ip = range.min_ip; - - free(arg); - return &(append_range(info, &range)->t); -} - -static void SNAT_parse(struct xt_option_call *cb) -{ - const struct ipt_entry *entry = cb->xt_entry; - struct ipt_natinfo *info = (void *)(*cb->target); - int portok; - - if (entry->ip.proto == IPPROTO_TCP - || entry->ip.proto == IPPROTO_UDP - || entry->ip.proto == IPPROTO_SCTP - || entry->ip.proto == IPPROTO_DCCP - || entry->ip.proto == IPPROTO_ICMP) - portok = 1; - else - portok = 0; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_TO_SRC: - if (cb->xflags & F_X_TO_SRC) { - if (!kernel_version) - get_kernel_version(); - if (kernel_version > LINUX_VERSION(2, 6, 10)) - xtables_error(PARAMETER_PROBLEM, - "SNAT: Multiple --to-source not supported"); - } - *cb->target = parse_to(cb->arg, portok, info); - /* WTF do we need this for?? */ - if (cb->xflags & F_RANDOM) - info->mr.range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; - cb->xflags |= F_X_TO_SRC; - break; - case O_RANDOM: - if (cb->xflags & F_TO_SRC) - info->mr.range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; - break; - case O_PERSISTENT: - info->mr.range[0].flags |= IP_NAT_RANGE_PERSISTENT; - break; - } -} - -static void print_range(const struct nf_nat_range *r) -{ - if (r->flags & IP_NAT_RANGE_MAP_IPS) { - struct in_addr a; - - a.s_addr = r->min_ip; - printf("%s", xtables_ipaddr_to_numeric(&a)); - if (r->max_ip != r->min_ip) { - a.s_addr = r->max_ip; - printf("-%s", xtables_ipaddr_to_numeric(&a)); - } - } - if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) { - printf(":"); - printf("%hu", ntohs(r->min.tcp.port)); - if (r->max.tcp.port != r->min.tcp.port) - printf("-%hu", ntohs(r->max.tcp.port)); - } -} - -static void SNAT_print(const void *ip, const struct xt_entry_target *target, - int numeric) -{ - const struct ipt_natinfo *info = (const void *)target; - unsigned int i = 0; - - printf(" to:"); - for (i = 0; i < info->mr.rangesize; i++) { - print_range(&info->mr.range[i]); - if (info->mr.range[i].flags & IP_NAT_RANGE_PROTO_RANDOM) - printf(" random"); - if (info->mr.range[i].flags & IP_NAT_RANGE_PERSISTENT) - printf(" persistent"); - } -} - -static void SNAT_save(const void *ip, const struct xt_entry_target *target) -{ - const struct ipt_natinfo *info = (const void *)target; - unsigned int i = 0; - - for (i = 0; i < info->mr.rangesize; i++) { - printf(" --to-source "); - print_range(&info->mr.range[i]); - if (info->mr.range[i].flags & IP_NAT_RANGE_PROTO_RANDOM) - printf(" --random"); - if (info->mr.range[i].flags & IP_NAT_RANGE_PERSISTENT) - printf(" --persistent"); - } -} - -static struct xtables_target snat_tg_reg = { - .name = "SNAT", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct nf_nat_multi_range)), - .userspacesize = XT_ALIGN(sizeof(struct nf_nat_multi_range)), - .help = SNAT_help, - .x6_parse = SNAT_parse, - .print = SNAT_print, - .save = SNAT_save, - .x6_options = SNAT_opts, -}; - -void _init(void) -{ - xtables_register_target(&snat_tg_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_SNAT.man b/src/main/jni/iptables/extensions/libipt_SNAT.man deleted file mode 100644 index 626b5929..00000000 --- a/src/main/jni/iptables/extensions/libipt_SNAT.man +++ /dev/null @@ -1,37 +0,0 @@ -This target is only valid in the -.B nat -table, in the -.B POSTROUTING -chain. It specifies that the source address of the packet should be -modified (and all future packets in this connection will also be -mangled), and rules should cease being examined. It takes one type -of option: -.TP -\fB\-\-to\-source\fP [\fIipaddr\fP[\fB\-\fP\fIipaddr\fP]][\fB:\fP\fIport\fP[\fB\-\fP\fIport\fP]] -which can specify a single new source IP address, an inclusive range -of IP addresses, and optionally, a port range (which is only valid if -the rule also specifies -\fB\-p tcp\fP -or -\fB\-p udp\fP). -If no port range is specified, then source ports below 512 will be -mapped to other ports below 512: those between 512 and 1023 inclusive -will be mapped to ports below 1024, and other ports will be mapped to -1024 or above. Where possible, no port alteration will occur. - -In Kernels up to 2.6.10, you can add several \-\-to\-source options. For those -kernels, if you specify more than one source address, either via an address -range or multiple \-\-to\-source options, a simple round-robin (one after another -in cycle) takes place between these addresses. -Later Kernels (>= 2.6.11-rc1) don't have the ability to NAT to multiple ranges -anymore. -.TP -\fB\-\-random\fP -If option -\fB\-\-random\fP -is used then port mapping will be randomized (kernel >= 2.6.21). -.TP -\fB\-\-persistent\fP -Gives a client the same source-/destination-address for each connection. -This supersedes the SAME target. Support for persistent mappings is available -from 2.6.29-rc2. diff --git a/src/main/jni/iptables/extensions/libipt_ULOG.c b/src/main/jni/iptables/extensions/libipt_ULOG.c deleted file mode 100644 index e08ae056..00000000 --- a/src/main/jni/iptables/extensions/libipt_ULOG.c +++ /dev/null @@ -1,128 +0,0 @@ -/* Shared library add-on to iptables to add ULOG support. - * - * (C) 2000 by Harald Welte - * - * multipart netlink support based on ideas by Sebastian Zander - * - * - * This software is released under the terms of GNU GPL - * - * libipt_ULOG.c,v 1.7 2001/01/30 11:55:02 laforge Exp - */ -#include -#include -#include -/* For 64bit kernel / 32bit userspace */ -#include - -enum { - O_ULOG_NLGROUP = 0, - O_ULOG_PREFIX, - O_ULOG_CPRANGE, - O_ULOG_QTHR, -}; - -static void ULOG_help(void) -{ - printf("ULOG target options:\n" - " --ulog-nlgroup nlgroup NETLINK group used for logging\n" - " --ulog-cprange size Bytes of each packet to be passed\n" - " --ulog-qthreshold Threshold of in-kernel queue\n" - " --ulog-prefix prefix Prefix log messages with this prefix.\n"); -} - -static const struct xt_option_entry ULOG_opts[] = { - {.name = "ulog-nlgroup", .id = O_ULOG_NLGROUP, .type = XTTYPE_UINT8, - .min = 1, .max = 32}, - {.name = "ulog-prefix", .id = O_ULOG_PREFIX, .type = XTTYPE_STRING, - .flags = XTOPT_PUT, XTOPT_POINTER(struct ipt_ulog_info, prefix), - .min = 1}, - {.name = "ulog-cprange", .id = O_ULOG_CPRANGE, .type = XTTYPE_UINT64, - .min = 1, .max = ULOG_MAX_QLEN}, - {.name = "ulog-qthreshold", .id = O_ULOG_QTHR, .type = XTTYPE_UINT64}, - XTOPT_TABLEEND, -}; - -static void ULOG_init(struct xt_entry_target *t) -{ - struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) t->data; - - loginfo->nl_group = ULOG_DEFAULT_NLGROUP; - loginfo->qthreshold = ULOG_DEFAULT_QTHRESHOLD; - -} - -static void ULOG_parse(struct xt_option_call *cb) -{ - struct ipt_ulog_info *loginfo = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_ULOG_NLGROUP: - loginfo->nl_group = 1 << (cb->val.u8 - 1); - break; - case O_ULOG_PREFIX: - if (strchr(cb->arg, '\n') != NULL) - xtables_error(PARAMETER_PROBLEM, - "Newlines not allowed in --ulog-prefix"); - break; - case O_ULOG_CPRANGE: - loginfo->copy_range = cb->val.u64; - break; - case O_ULOG_QTHR: - loginfo->qthreshold = cb->val.u64; - break; - } -} - -static void ULOG_save(const void *ip, const struct xt_entry_target *target) -{ - const struct ipt_ulog_info *loginfo - = (const struct ipt_ulog_info *) target->data; - - if (strcmp(loginfo->prefix, "") != 0) { - fputs(" --ulog-prefix", stdout); - xtables_save_string(loginfo->prefix); - } - - if (loginfo->nl_group != ULOG_DEFAULT_NLGROUP) - printf(" --ulog-nlgroup %d", ffs(loginfo->nl_group)); - if (loginfo->copy_range) - printf(" --ulog-cprange %u", (unsigned int)loginfo->copy_range); - - if (loginfo->qthreshold != ULOG_DEFAULT_QTHRESHOLD) - printf(" --ulog-qthreshold %u", (unsigned int)loginfo->qthreshold); -} - -static void ULOG_print(const void *ip, const struct xt_entry_target *target, - int numeric) -{ - const struct ipt_ulog_info *loginfo - = (const struct ipt_ulog_info *) target->data; - - printf(" ULOG "); - printf("copy_range %u nlgroup %d", (unsigned int)loginfo->copy_range, - ffs(loginfo->nl_group)); - if (strcmp(loginfo->prefix, "") != 0) - printf(" prefix \"%s\"", loginfo->prefix); - printf(" queue_threshold %u", (unsigned int)loginfo->qthreshold); -} - -static struct xtables_target ulog_tg_reg = { - .name = "ULOG", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct ipt_ulog_info)), - .userspacesize = XT_ALIGN(sizeof(struct ipt_ulog_info)), - .help = ULOG_help, - .init = ULOG_init, - .print = ULOG_print, - .save = ULOG_save, - .x6_parse = ULOG_parse, - .x6_options = ULOG_opts, -}; - -void _init(void) -{ - xtables_register_target(&ulog_tg_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_ULOG.man b/src/main/jni/iptables/extensions/libipt_ULOG.man deleted file mode 100644 index 649b6e3e..00000000 --- a/src/main/jni/iptables/extensions/libipt_ULOG.man +++ /dev/null @@ -1,27 +0,0 @@ -This target provides userspace logging of matching packets. When this -target is set for a rule, the Linux kernel will multicast this packet -through a -.IR netlink -socket. One or more userspace processes may then subscribe to various -multicast groups and receive the packets. -Like LOG, this is a "non-terminating target", i.e. rule traversal -continues at the next rule. -.TP -\fB\-\-ulog\-nlgroup\fP \fInlgroup\fP -This specifies the netlink group (1-32) to which the packet is sent. -Default value is 1. -.TP -\fB\-\-ulog\-prefix\fP \fIprefix\fP -Prefix log messages with the specified prefix; up to 32 characters -long, and useful for distinguishing messages in the logs. -.TP -\fB\-\-ulog\-cprange\fP \fIsize\fP -Number of bytes to be copied to userspace. A value of 0 always copies -the entire packet, regardless of its size. Default is 0. -.TP -\fB\-\-ulog\-qthreshold\fP \fIsize\fP -Number of packet to queue inside kernel. Setting this value to, e.g. 10 -accumulates ten packets inside the kernel and transmits them as one -netlink multipart message to userspace. Default is 1 (for backwards -compatibility). -.br diff --git a/src/main/jni/iptables/extensions/libipt_addrtype.c b/src/main/jni/iptables/extensions/libipt_addrtype.c deleted file mode 100644 index 3dec626b..00000000 --- a/src/main/jni/iptables/extensions/libipt_addrtype.c +++ /dev/null @@ -1,308 +0,0 @@ -/* Shared library add-on to iptables to add addrtype matching support - * - * This program is released under the terms of GNU GPL */ -#include -#include -#include -#include - -enum { - O_SRC_TYPE = 0, - O_DST_TYPE, - O_LIMIT_IFACE_IN, - O_LIMIT_IFACE_OUT, - F_SRC_TYPE = 1 << O_SRC_TYPE, - F_DST_TYPE = 1 << O_DST_TYPE, - F_LIMIT_IFACE_IN = 1 << O_LIMIT_IFACE_IN, - F_LIMIT_IFACE_OUT = 1 << O_LIMIT_IFACE_OUT, -}; - -/* from linux/rtnetlink.h, must match order of enumeration */ -static const char *const rtn_names[] = { - "UNSPEC", - "UNICAST", - "LOCAL", - "BROADCAST", - "ANYCAST", - "MULTICAST", - "BLACKHOLE", - "UNREACHABLE", - "PROHIBIT", - "THROW", - "NAT", - "XRESOLVE", - NULL -}; - -static void addrtype_help_types(void) -{ - int i; - - for (i = 0; rtn_names[i]; i++) - printf(" %s\n", rtn_names[i]); -} - -static void addrtype_help_v0(void) -{ - printf( -"Address type match options:\n" -" [!] --src-type type[,...] Match source address type\n" -" [!] --dst-type type[,...] Match destination address type\n" -"\n" -"Valid types: \n"); - addrtype_help_types(); -} - -static void addrtype_help_v1(void) -{ - printf( -"Address type match options:\n" -" [!] --src-type type[,...] Match source address type\n" -" [!] --dst-type type[,...] Match destination address type\n" -" --limit-iface-in Match only on the packet's incoming device\n" -" --limit-iface-out Match only on the packet's incoming device\n" -"\n" -"Valid types: \n"); - addrtype_help_types(); -} - -static int -parse_type(const char *name, size_t len, uint16_t *mask) -{ - int i; - - for (i = 0; rtn_names[i]; i++) - if (strncasecmp(name, rtn_names[i], len) == 0) { - /* build up bitmask for kernel module */ - *mask |= (1 << i); - return 1; - } - - return 0; -} - -static void parse_types(const char *arg, uint16_t *mask) -{ - const char *comma; - - while ((comma = strchr(arg, ',')) != NULL) { - if (comma == arg || !parse_type(arg, comma-arg, mask)) - xtables_error(PARAMETER_PROBLEM, - "addrtype: bad type `%s'", arg); - arg = comma + 1; - } - - if (strlen(arg) == 0 || !parse_type(arg, strlen(arg), mask)) - xtables_error(PARAMETER_PROBLEM, "addrtype: bad type \"%s\"", arg); -} - -static void addrtype_parse_v0(struct xt_option_call *cb) -{ - struct ipt_addrtype_info *info = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_SRC_TYPE: - parse_types(cb->arg, &info->source); - if (cb->invert) - info->invert_source = 1; - break; - case O_DST_TYPE: - parse_types(cb->arg, &info->dest); - if (cb->invert) - info->invert_dest = 1; - break; - } -} - -static void addrtype_parse_v1(struct xt_option_call *cb) -{ - struct ipt_addrtype_info_v1 *info = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_SRC_TYPE: - parse_types(cb->arg, &info->source); - if (cb->invert) - info->flags |= IPT_ADDRTYPE_INVERT_SOURCE; - break; - case O_DST_TYPE: - parse_types(cb->arg, &info->dest); - if (cb->invert) - info->flags |= IPT_ADDRTYPE_INVERT_DEST; - break; - case O_LIMIT_IFACE_IN: - info->flags |= IPT_ADDRTYPE_LIMIT_IFACE_IN; - break; - case O_LIMIT_IFACE_OUT: - info->flags |= IPT_ADDRTYPE_LIMIT_IFACE_OUT; - break; - } -} - -static void addrtype_check(struct xt_fcheck_call *cb) -{ - if (!(cb->xflags & (F_SRC_TYPE | F_DST_TYPE))) - xtables_error(PARAMETER_PROBLEM, - "addrtype: you must specify --src-type or --dst-type"); -} - -static void print_types(uint16_t mask) -{ - const char *sep = ""; - int i; - - for (i = 0; rtn_names[i]; i++) - if (mask & (1 << i)) { - printf("%s%s", sep, rtn_names[i]); - sep = ","; - } -} - -static void addrtype_print_v0(const void *ip, const struct xt_entry_match *match, - int numeric) -{ - const struct ipt_addrtype_info *info = - (struct ipt_addrtype_info *) match->data; - - printf(" ADDRTYPE match"); - if (info->source) { - printf(" src-type "); - if (info->invert_source) - printf("!"); - print_types(info->source); - } - if (info->dest) { - printf(" dst-type"); - if (info->invert_dest) - printf("!"); - print_types(info->dest); - } -} - -static void addrtype_print_v1(const void *ip, const struct xt_entry_match *match, - int numeric) -{ - const struct ipt_addrtype_info_v1 *info = - (struct ipt_addrtype_info_v1 *) match->data; - - printf(" ADDRTYPE match"); - if (info->source) { - printf(" src-type "); - if (info->flags & IPT_ADDRTYPE_INVERT_SOURCE) - printf("!"); - print_types(info->source); - } - if (info->dest) { - printf(" dst-type "); - if (info->flags & IPT_ADDRTYPE_INVERT_DEST) - printf("!"); - print_types(info->dest); - } - if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_IN) { - printf(" limit-in"); - } - if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_OUT) { - printf(" limit-out"); - } -} - -static void addrtype_save_v0(const void *ip, const struct xt_entry_match *match) -{ - const struct ipt_addrtype_info *info = - (struct ipt_addrtype_info *) match->data; - - if (info->source) { - if (info->invert_source) - printf(" !"); - printf(" --src-type "); - print_types(info->source); - } - if (info->dest) { - if (info->invert_dest) - printf(" !"); - printf(" --dst-type "); - print_types(info->dest); - } -} - -static void addrtype_save_v1(const void *ip, const struct xt_entry_match *match) -{ - const struct ipt_addrtype_info_v1 *info = - (struct ipt_addrtype_info_v1 *) match->data; - - if (info->source) { - if (info->flags & IPT_ADDRTYPE_INVERT_SOURCE) - printf(" !"); - printf(" --src-type "); - print_types(info->source); - } - if (info->dest) { - if (info->flags & IPT_ADDRTYPE_INVERT_DEST) - printf(" !"); - printf(" --dst-type "); - print_types(info->dest); - } - if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_IN) { - printf(" --limit-iface-in"); - } - if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_OUT) { - printf(" --limit-iface-out"); - } -} - -static const struct xt_option_entry addrtype_opts_v0[] = { - {.name = "src-type", .id = O_SRC_TYPE, .type = XTTYPE_STRING, - .flags = XTOPT_INVERT}, - {.name = "dst-type", .id = O_DST_TYPE, .type = XTTYPE_STRING, - .flags = XTOPT_INVERT}, - XTOPT_TABLEEND, -}; - -static const struct xt_option_entry addrtype_opts_v1[] = { - {.name = "src-type", .id = O_SRC_TYPE, .type = XTTYPE_STRING, - .flags = XTOPT_INVERT}, - {.name = "dst-type", .id = O_DST_TYPE, .type = XTTYPE_STRING, - .flags = XTOPT_INVERT}, - {.name = "limit-iface-in", .id = O_LIMIT_IFACE_IN, - .type = XTTYPE_NONE, .excl = F_LIMIT_IFACE_OUT}, - {.name = "limit-iface-out", .id = O_LIMIT_IFACE_OUT, - .type = XTTYPE_NONE, .excl = F_LIMIT_IFACE_IN}, - XTOPT_TABLEEND, -}; - -static struct xtables_match addrtype_mt_reg[] = { - { - .name = "addrtype", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct ipt_addrtype_info)), - .userspacesize = XT_ALIGN(sizeof(struct ipt_addrtype_info)), - .help = addrtype_help_v0, - .print = addrtype_print_v0, - .save = addrtype_save_v0, - .x6_parse = addrtype_parse_v0, - .x6_fcheck = addrtype_check, - .x6_options = addrtype_opts_v0, - }, - { - .name = "addrtype", - .revision = 1, - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct ipt_addrtype_info_v1)), - .userspacesize = XT_ALIGN(sizeof(struct ipt_addrtype_info_v1)), - .help = addrtype_help_v1, - .print = addrtype_print_v1, - .save = addrtype_save_v1, - .x6_parse = addrtype_parse_v1, - .x6_fcheck = addrtype_check, - .x6_options = addrtype_opts_v1, - }, -}; - - -void _init(void) -{ - xtables_register_matches(addrtype_mt_reg, ARRAY_SIZE(addrtype_mt_reg)); -} diff --git a/src/main/jni/iptables/extensions/libipt_addrtype.man b/src/main/jni/iptables/extensions/libipt_addrtype.man deleted file mode 100644 index 16fd9dfd..00000000 --- a/src/main/jni/iptables/extensions/libipt_addrtype.man +++ /dev/null @@ -1,69 +0,0 @@ -This module matches packets based on their -.B address type. -Address types are used within the kernel networking stack and categorize -addresses into various groups. The exact definition of that group depends on the specific layer three protocol. -.PP -The following address types are possible: -.TP -.BI "UNSPEC" -an unspecified address (i.e. 0.0.0.0) -.TP -.BI "UNICAST" -an unicast address -.TP -.BI "LOCAL" -a local address -.TP -.BI "BROADCAST" -a broadcast address -.TP -.BI "ANYCAST" -an anycast packet -.TP -.BI "MULTICAST" -a multicast address -.TP -.BI "BLACKHOLE" -a blackhole address -.TP -.BI "UNREACHABLE" -an unreachable address -.TP -.BI "PROHIBIT" -a prohibited address -.TP -.BI "THROW" -FIXME -.TP -.BI "NAT" -FIXME -.TP -.BI "XRESOLVE" -.TP -[\fB!\fP] \fB\-\-src\-type\fP \fItype\fP -Matches if the source address is of given type -.TP -[\fB!\fP] \fB\-\-dst\-type\fP \fItype\fP -Matches if the destination address is of given type -.TP -.BI "\-\-limit\-iface\-in" -The address type checking can be limited to the interface the packet is coming -in. This option is only valid in the -.BR PREROUTING , -.B INPUT -and -.B FORWARD -chains. It cannot be specified with the -\fB\-\-limit\-iface\-out\fP -option. -.TP -\fB\-\-limit\-iface\-out\fP -The address type checking can be limited to the interface the packet is going -out. This option is only valid in the -.BR POSTROUTING , -.B OUTPUT -and -.B FORWARD -chains. It cannot be specified with the -\fB\-\-limit\-iface\-in\fP -option. diff --git a/src/main/jni/iptables/extensions/libipt_ah.c b/src/main/jni/iptables/extensions/libipt_ah.c deleted file mode 100644 index 8cf167c4..00000000 --- a/src/main/jni/iptables/extensions/libipt_ah.c +++ /dev/null @@ -1,105 +0,0 @@ -#include -#include -#include - -enum { - O_AHSPI = 0, -}; - -static void ah_help(void) -{ - printf( -"ah match options:\n" -"[!] --ahspi spi[:spi]\n" -" match spi (range)\n"); -} - -static const struct xt_option_entry ah_opts[] = { - {.name = "ahspi", .id = O_AHSPI, .type = XTTYPE_UINT32RC, - .flags = XTOPT_INVERT | XTOPT_PUT, - XTOPT_POINTER(struct ipt_ah, spis)}, - XTOPT_TABLEEND, -}; - -static void ah_parse(struct xt_option_call *cb) -{ - struct ipt_ah *ahinfo = cb->data; - - xtables_option_parse(cb); - if (cb->nvals == 1) - ahinfo->spis[1] = ahinfo->spis[0]; - if (cb->invert) - ahinfo->invflags |= IPT_AH_INV_SPI; -} - -static void -print_spis(const char *name, uint32_t min, uint32_t max, - int invert) -{ - const char *inv = invert ? "!" : ""; - - if (min != 0 || max != 0xFFFFFFFF || invert) { - printf("%s", name); - if (min == max) { - printf(":%s", inv); - printf("%u", min); - } else { - printf("s:%s", inv); - printf("%u",min); - printf(":"); - printf("%u",max); - } - } -} - -static void ah_print(const void *ip, const struct xt_entry_match *match, - int numeric) -{ - const struct ipt_ah *ah = (struct ipt_ah *)match->data; - - printf(" ah "); - print_spis("spi", ah->spis[0], ah->spis[1], - ah->invflags & IPT_AH_INV_SPI); - if (ah->invflags & ~IPT_AH_INV_MASK) - printf(" Unknown invflags: 0x%X", - ah->invflags & ~IPT_AH_INV_MASK); -} - -static void ah_save(const void *ip, const struct xt_entry_match *match) -{ - const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data; - - if (!(ahinfo->spis[0] == 0 - && ahinfo->spis[1] == 0xFFFFFFFF)) { - printf("%s --ahspi ", - (ahinfo->invflags & IPT_AH_INV_SPI) ? " !" : ""); - if (ahinfo->spis[0] - != ahinfo->spis[1]) - printf("%u:%u", - ahinfo->spis[0], - ahinfo->spis[1]); - else - printf("%u", - ahinfo->spis[0]); - } - -} - -static struct xtables_match ah_mt_reg = { - .name = "ah", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct ipt_ah)), - .userspacesize = XT_ALIGN(sizeof(struct ipt_ah)), - .help = ah_help, - .print = ah_print, - .save = ah_save, - .x6_parse = ah_parse, - .x6_options = ah_opts, -}; - -void -_init(void) -{ - xtables_register_match(&ah_mt_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_ah.man b/src/main/jni/iptables/extensions/libipt_ah.man deleted file mode 100644 index d26455e9..00000000 --- a/src/main/jni/iptables/extensions/libipt_ah.man +++ /dev/null @@ -1,3 +0,0 @@ -This module matches the SPIs in Authentication header of IPsec packets. -.TP -[\fB!\fP] \fB\-\-ahspi\fP \fIspi\fP[\fB:\fP\fIspi\fP] diff --git a/src/main/jni/iptables/extensions/libipt_ecn.c b/src/main/jni/iptables/extensions/libipt_ecn.c deleted file mode 100644 index 56a0347e..00000000 --- a/src/main/jni/iptables/extensions/libipt_ecn.c +++ /dev/null @@ -1,137 +0,0 @@ -/* Shared library add-on to iptables for ECN matching - * - * (C) 2002 by Harald Welte - * - * This program is distributed under the terms of GNU GPL v2, 1991 - * - * libipt_ecn.c borrowed heavily from libipt_dscp.c - * - */ -#include -#include -#include - -enum { - O_ECN_TCP_CWR = 0, - O_ECN_TCP_ECE, - O_ECN_IP_ECT, -}; - -static void ecn_help(void) -{ - printf( -"ECN match options\n" -"[!] --ecn-tcp-cwr Match CWR bit of TCP header\n" -"[!] --ecn-tcp-ece Match ECE bit of TCP header\n" -"[!] --ecn-ip-ect [0..3] Match ECN codepoint in IPv4 header\n"); -} - -static const struct xt_option_entry ecn_opts[] = { - {.name = "ecn-tcp-cwr", .id = O_ECN_TCP_CWR, .type = XTTYPE_NONE, - .flags = XTOPT_INVERT}, - {.name = "ecn-tcp-ece", .id = O_ECN_TCP_ECE, .type = XTTYPE_NONE, - .flags = XTOPT_INVERT}, - {.name = "ecn-ip-ect", .id = O_ECN_IP_ECT, .type = XTTYPE_UINT8, - .min = 0, .max = 3, .flags = XTOPT_INVERT}, - XTOPT_TABLEEND, -}; - -static void ecn_parse(struct xt_option_call *cb) -{ - struct ipt_ecn_info *einfo = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_ECN_TCP_CWR: - einfo->operation |= IPT_ECN_OP_MATCH_CWR; - if (cb->invert) - einfo->invert |= IPT_ECN_OP_MATCH_CWR; - break; - case O_ECN_TCP_ECE: - einfo->operation |= IPT_ECN_OP_MATCH_ECE; - if (cb->invert) - einfo->invert |= IPT_ECN_OP_MATCH_ECE; - break; - case O_ECN_IP_ECT: - if (cb->invert) - einfo->invert |= IPT_ECN_OP_MATCH_IP; - einfo->operation |= IPT_ECN_OP_MATCH_IP; - einfo->ip_ect = cb->val.u8; - break; - } -} - -static void ecn_check(struct xt_fcheck_call *cb) -{ - if (cb->xflags == 0) - xtables_error(PARAMETER_PROBLEM, - "ECN match: some option required"); -} - -static void ecn_print(const void *ip, const struct xt_entry_match *match, - int numeric) -{ - const struct ipt_ecn_info *einfo = - (const struct ipt_ecn_info *)match->data; - - printf(" ECN match"); - - if (einfo->operation & IPT_ECN_OP_MATCH_ECE) { - printf(" %sECE", - (einfo->invert & IPT_ECN_OP_MATCH_ECE) ? "!" : ""); - } - - if (einfo->operation & IPT_ECN_OP_MATCH_CWR) { - printf(" %sCWR", - (einfo->invert & IPT_ECN_OP_MATCH_CWR) ? "!" : ""); - } - - if (einfo->operation & IPT_ECN_OP_MATCH_IP) { - printf(" %sECT=%d", - (einfo->invert & IPT_ECN_OP_MATCH_IP) ? "!" : "", - einfo->ip_ect); - } -} - -static void ecn_save(const void *ip, const struct xt_entry_match *match) -{ - const struct ipt_ecn_info *einfo = - (const struct ipt_ecn_info *)match->data; - - if (einfo->operation & IPT_ECN_OP_MATCH_ECE) { - if (einfo->invert & IPT_ECN_OP_MATCH_ECE) - printf(" !"); - printf(" --ecn-tcp-ece"); - } - - if (einfo->operation & IPT_ECN_OP_MATCH_CWR) { - if (einfo->invert & IPT_ECN_OP_MATCH_CWR) - printf(" !"); - printf(" --ecn-tcp-cwr"); - } - - if (einfo->operation & IPT_ECN_OP_MATCH_IP) { - if (einfo->invert & IPT_ECN_OP_MATCH_IP) - printf(" !"); - printf(" --ecn-ip-ect %d", einfo->ip_ect); - } -} - -static struct xtables_match ecn_mt_reg = { - .name = "ecn", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct ipt_ecn_info)), - .userspacesize = XT_ALIGN(sizeof(struct ipt_ecn_info)), - .help = ecn_help, - .print = ecn_print, - .save = ecn_save, - .x6_parse = ecn_parse, - .x6_fcheck = ecn_check, - .x6_options = ecn_opts, -}; - -void _init(void) -{ - xtables_register_match(&ecn_mt_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_ecn.man b/src/main/jni/iptables/extensions/libipt_ecn.man deleted file mode 100644 index 7f806477..00000000 --- a/src/main/jni/iptables/extensions/libipt_ecn.man +++ /dev/null @@ -1,11 +0,0 @@ -This allows you to match the ECN bits of the IPv4 and TCP header. ECN is the Explicit Congestion Notification mechanism as specified in RFC3168 -.TP -[\fB!\fP] \fB\-\-ecn\-tcp\-cwr\fP -This matches if the TCP ECN CWR (Congestion Window Received) bit is set. -.TP -[\fB!\fP] \fB\-\-ecn\-tcp\-ece\fP -This matches if the TCP ECN ECE (ECN Echo) bit is set. -.TP -[\fB!\fP] \fB\-\-ecn\-ip\-ect\fP \fInum\fP -This matches a particular IPv4 ECT (ECN-Capable Transport). You have to specify -a number between `0' and `3'. diff --git a/src/main/jni/iptables/extensions/libipt_icmp.c b/src/main/jni/iptables/extensions/libipt_icmp.c deleted file mode 100644 index 666e7daf..00000000 --- a/src/main/jni/iptables/extensions/libipt_icmp.c +++ /dev/null @@ -1,269 +0,0 @@ -#include -#include -#include -#include -#include /* INT_MAX in ip6_tables.h */ -#include - -/* special hack for icmp-type 'any': - * Up to kernel <=2.4.20 the problem was: - * '-p icmp ' matches all icmp packets - * '-p icmp -m icmp' matches _only_ ICMP type 0 :( - * This is now fixed by initializing the field * to icmp type 0xFF - * See: https://bugzilla.netfilter.org/cgi-bin/bugzilla/show_bug.cgi?id=37 - */ - -enum { - O_ICMP_TYPE = 0, -}; - -struct icmp_names { - const char *name; - uint8_t type; - uint8_t code_min, code_max; -}; - -static const struct icmp_names icmp_codes[] = { - { "any", 0xFF, 0, 0xFF }, - { "echo-reply", 0, 0, 0xFF }, - /* Alias */ { "pong", 0, 0, 0xFF }, - - { "destination-unreachable", 3, 0, 0xFF }, - { "network-unreachable", 3, 0, 0 }, - { "host-unreachable", 3, 1, 1 }, - { "protocol-unreachable", 3, 2, 2 }, - { "port-unreachable", 3, 3, 3 }, - { "fragmentation-needed", 3, 4, 4 }, - { "source-route-failed", 3, 5, 5 }, - { "network-unknown", 3, 6, 6 }, - { "host-unknown", 3, 7, 7 }, - { "network-prohibited", 3, 9, 9 }, - { "host-prohibited", 3, 10, 10 }, - { "TOS-network-unreachable", 3, 11, 11 }, - { "TOS-host-unreachable", 3, 12, 12 }, - { "communication-prohibited", 3, 13, 13 }, - { "host-precedence-violation", 3, 14, 14 }, - { "precedence-cutoff", 3, 15, 15 }, - - { "source-quench", 4, 0, 0xFF }, - - { "redirect", 5, 0, 0xFF }, - { "network-redirect", 5, 0, 0 }, - { "host-redirect", 5, 1, 1 }, - { "TOS-network-redirect", 5, 2, 2 }, - { "TOS-host-redirect", 5, 3, 3 }, - - { "echo-request", 8, 0, 0xFF }, - /* Alias */ { "ping", 8, 0, 0xFF }, - - { "router-advertisement", 9, 0, 0xFF }, - - { "router-solicitation", 10, 0, 0xFF }, - - { "time-exceeded", 11, 0, 0xFF }, - /* Alias */ { "ttl-exceeded", 11, 0, 0xFF }, - { "ttl-zero-during-transit", 11, 0, 0 }, - { "ttl-zero-during-reassembly", 11, 1, 1 }, - - { "parameter-problem", 12, 0, 0xFF }, - { "ip-header-bad", 12, 0, 0 }, - { "required-option-missing", 12, 1, 1 }, - - { "timestamp-request", 13, 0, 0xFF }, - - { "timestamp-reply", 14, 0, 0xFF }, - - { "address-mask-request", 17, 0, 0xFF }, - - { "address-mask-reply", 18, 0, 0xFF } -}; - -static void -print_icmptypes(void) -{ - unsigned int i; - printf("Valid ICMP Types:"); - - for (i = 0; i < ARRAY_SIZE(icmp_codes); ++i) { - if (i && icmp_codes[i].type == icmp_codes[i-1].type) { - if (icmp_codes[i].code_min == icmp_codes[i-1].code_min - && (icmp_codes[i].code_max - == icmp_codes[i-1].code_max)) - printf(" (%s)", icmp_codes[i].name); - else - printf("\n %s", icmp_codes[i].name); - } - else - printf("\n%s", icmp_codes[i].name); - } - printf("\n"); -} - -static void icmp_help(void) -{ - printf( -"icmp match options:\n" -"[!] --icmp-type typename match icmp type\n" -"[!] --icmp-type type[/code] (or numeric type or type/code)\n"); - print_icmptypes(); -} - -static const struct xt_option_entry icmp_opts[] = { - {.name = "icmp-type", .id = O_ICMP_TYPE, .type = XTTYPE_STRING, - .flags = XTOPT_MAND | XTOPT_INVERT}, - XTOPT_TABLEEND, -}; - -static void -parse_icmp(const char *icmptype, uint8_t *type, uint8_t code[]) -{ - static const unsigned int limit = ARRAY_SIZE(icmp_codes); - unsigned int match = limit; - unsigned int i; - - for (i = 0; i < limit; i++) { - if (strncasecmp(icmp_codes[i].name, icmptype, strlen(icmptype)) - == 0) { - if (match != limit) - xtables_error(PARAMETER_PROBLEM, - "Ambiguous ICMP type `%s':" - " `%s' or `%s'?", - icmptype, - icmp_codes[match].name, - icmp_codes[i].name); - match = i; - } - } - - if (match != limit) { - *type = icmp_codes[match].type; - code[0] = icmp_codes[match].code_min; - code[1] = icmp_codes[match].code_max; - } else { - char *slash; - char buffer[strlen(icmptype) + 1]; - unsigned int number; - - strcpy(buffer, icmptype); - slash = strchr(buffer, '/'); - - if (slash) - *slash = '\0'; - - if (!xtables_strtoui(buffer, NULL, &number, 0, UINT8_MAX)) - xtables_error(PARAMETER_PROBLEM, - "Invalid ICMP type `%s'\n", buffer); - *type = number; - if (slash) { - if (!xtables_strtoui(slash+1, NULL, &number, 0, UINT8_MAX)) - xtables_error(PARAMETER_PROBLEM, - "Invalid ICMP code `%s'\n", - slash+1); - code[0] = code[1] = number; - } else { - code[0] = 0; - code[1] = 0xFF; - } - } -} - -static void icmp_init(struct xt_entry_match *m) -{ - struct ipt_icmp *icmpinfo = (struct ipt_icmp *)m->data; - - icmpinfo->type = 0xFF; - icmpinfo->code[1] = 0xFF; -} - -static void icmp_parse(struct xt_option_call *cb) -{ - struct ipt_icmp *icmpinfo = cb->data; - - xtables_option_parse(cb); - parse_icmp(cb->arg, &icmpinfo->type, icmpinfo->code); - if (cb->invert) - icmpinfo->invflags |= IPT_ICMP_INV; -} - -static void print_icmptype(uint8_t type, - uint8_t code_min, uint8_t code_max, - int invert, - int numeric) -{ - if (!numeric) { - unsigned int i; - - for (i = 0; i < ARRAY_SIZE(icmp_codes); ++i) - if (icmp_codes[i].type == type - && icmp_codes[i].code_min == code_min - && icmp_codes[i].code_max == code_max) - break; - - if (i != ARRAY_SIZE(icmp_codes)) { - printf(" %s%s", - invert ? "!" : "", - icmp_codes[i].name); - return; - } - } - - if (invert) - printf(" !"); - - printf("type %u", type); - if (code_min == code_max) - printf(" code %u", code_min); - else if (code_min != 0 || code_max != 0xFF) - printf(" codes %u-%u", code_min, code_max); -} - -static void icmp_print(const void *ip, const struct xt_entry_match *match, - int numeric) -{ - const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data; - - printf(" icmp"); - print_icmptype(icmp->type, icmp->code[0], icmp->code[1], - icmp->invflags & IPT_ICMP_INV, - numeric); - - if (icmp->invflags & ~IPT_ICMP_INV) - printf(" Unknown invflags: 0x%X", - icmp->invflags & ~IPT_ICMP_INV); -} - -static void icmp_save(const void *ip, const struct xt_entry_match *match) -{ - const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data; - - if (icmp->invflags & IPT_ICMP_INV) - printf(" !"); - - /* special hack for 'any' case */ - if (icmp->type == 0xFF) { - printf(" --icmp-type any"); - } else { - printf(" --icmp-type %u", icmp->type); - if (icmp->code[0] != 0 || icmp->code[1] != 0xFF) - printf("/%u", icmp->code[0]); - } -} - -static struct xtables_match icmp_mt_reg = { - .name = "icmp", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct ipt_icmp)), - .userspacesize = XT_ALIGN(sizeof(struct ipt_icmp)), - .help = icmp_help, - .init = icmp_init, - .print = icmp_print, - .save = icmp_save, - .x6_parse = icmp_parse, - .x6_options = icmp_opts, -}; - -void _init(void) -{ - xtables_register_match(&icmp_mt_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_icmp.man b/src/main/jni/iptables/extensions/libipt_icmp.man deleted file mode 100644 index 1039704f..00000000 --- a/src/main/jni/iptables/extensions/libipt_icmp.man +++ /dev/null @@ -1,9 +0,0 @@ -This extension can be used if `\-\-protocol icmp' is specified. It -provides the following option: -.TP -[\fB!\fP] \fB\-\-icmp\-type\fP {\fItype\fP[\fB/\fP\fIcode\fP]|\fItypename\fP} -This allows specification of the ICMP type, which can be a numeric -ICMP type, type/code pair, or one of the ICMP type names shown by the command -.nf - iptables \-p icmp \-h -.fi diff --git a/src/main/jni/iptables/extensions/libipt_realm.c b/src/main/jni/iptables/extensions/libipt_realm.c deleted file mode 100644 index b60c57ee..00000000 --- a/src/main/jni/iptables/extensions/libipt_realm.c +++ /dev/null @@ -1,127 +0,0 @@ -#include -#include -#include -#include -#if defined(__GLIBC__) && __GLIBC__ == 2 -#include -#else -#include -#endif -#include -#include - -enum { - O_REALM = 0, -}; - -static void realm_help(void) -{ - printf( -"realm match options:\n" -"[!] --realm value[/mask]\n" -" Match realm\n"); -} - -static const struct xt_option_entry realm_opts[] = { - {.name = "realm", .id = O_REALM, .type = XTTYPE_STRING, - .flags = XTOPT_MAND | XTOPT_INVERT}, - XTOPT_TABLEEND, -}; - -/* array of realms from /etc/iproute2/rt_realms */ -static struct xtables_lmap *realms; - -static void realm_init(struct xt_entry_match *m) -{ - const char file[] = "/etc/iproute2/rt_realms"; - realms = xtables_lmap_init(file); - if (realms == NULL && errno != ENOENT) - fprintf(stderr, "Warning: %s: %s\n", file, strerror(errno)); -} - -static void realm_parse(struct xt_option_call *cb) -{ - struct ipt_realm_info *realminfo = cb->data; - int id; - char *end; - - xtables_option_parse(cb); - realminfo->id = strtoul(cb->arg, &end, 0); - if (end != cb->arg && (*end == '/' || *end == '\0')) { - if (*end == '/') - realminfo->mask = strtoul(end+1, &end, 0); - else - realminfo->mask = 0xffffffff; - if (*end != '\0' || end == cb->arg) - xtables_error(PARAMETER_PROBLEM, - "Bad realm value \"%s\"", cb->arg); - } else { - id = xtables_lmap_name2id(realms, cb->arg); - if (id == -1) - xtables_error(PARAMETER_PROBLEM, - "Realm \"%s\" not found", cb->arg); - realminfo->id = id; - realminfo->mask = 0xffffffff; - } - if (cb->invert) - realminfo->invert = 1; -} - -static void -print_realm(unsigned long id, unsigned long mask, int numeric) -{ - const char* name = NULL; - - if (mask != 0xffffffff) - printf(" 0x%lx/0x%lx", id, mask); - else { - if (numeric == 0) - name = xtables_lmap_id2name(realms, id); - if (name) - printf(" %s", name); - else - printf(" 0x%lx", id); - } -} - -static void realm_print(const void *ip, const struct xt_entry_match *match, - int numeric) -{ - const struct ipt_realm_info *ri = (const void *)match->data; - - if (ri->invert) - printf(" !"); - - printf(" realm"); - print_realm(ri->id, ri->mask, numeric); -} - -static void realm_save(const void *ip, const struct xt_entry_match *match) -{ - const struct ipt_realm_info *ri = (const void *)match->data; - - if (ri->invert) - printf(" !"); - - printf(" --realm"); - print_realm(ri->id, ri->mask, 0); -} - -static struct xtables_match realm_mt_reg = { - .name = "realm", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct ipt_realm_info)), - .userspacesize = XT_ALIGN(sizeof(struct ipt_realm_info)), - .help = realm_help, - .init = realm_init, - .print = realm_print, - .save = realm_save, - .x6_parse = realm_parse, - .x6_options = realm_opts, -}; - -void _init(void) -{ - xtables_register_match(&realm_mt_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_realm.man b/src/main/jni/iptables/extensions/libipt_realm.man deleted file mode 100644 index a40b1adc..00000000 --- a/src/main/jni/iptables/extensions/libipt_realm.man +++ /dev/null @@ -1,7 +0,0 @@ -This matches the routing realm. Routing realms are used in complex routing -setups involving dynamic routing protocols like BGP. -.TP -[\fB!\fP] \fB\-\-realm\fP \fIvalue\fP[\fB/\fP\fImask\fP] -Matches a given realm number (and optionally mask). If not a number, value -can be a named realm from /etc/iproute2/rt_realms (mask can not be used in -that case). diff --git a/src/main/jni/iptables/extensions/libipt_ttl.c b/src/main/jni/iptables/extensions/libipt_ttl.c deleted file mode 100644 index 6370cb67..00000000 --- a/src/main/jni/iptables/extensions/libipt_ttl.c +++ /dev/null @@ -1,135 +0,0 @@ -/* Shared library add-on to iptables to add TTL matching support - * (C) 2000 by Harald Welte - * - * This program is released under the terms of GNU GPL */ -#include -#include -#include - -enum { - O_TTL_EQ = 0, - O_TTL_LT, - O_TTL_GT, - F_TTL_EQ = 1 << O_TTL_EQ, - F_TTL_LT = 1 << O_TTL_LT, - F_TTL_GT = 1 << O_TTL_GT, - F_ANY = F_TTL_EQ | F_TTL_LT | F_TTL_GT, -}; - -static void ttl_help(void) -{ - printf( -"ttl match options:\n" -" --ttl-eq value Match time to live value\n" -" --ttl-lt value Match TTL < value\n" -" --ttl-gt value Match TTL > value\n"); -} - -static void ttl_parse(struct xt_option_call *cb) -{ - struct ipt_ttl_info *info = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_TTL_EQ: - info->mode = cb->invert ? IPT_TTL_NE : IPT_TTL_EQ; - break; - case O_TTL_LT: - info->mode = IPT_TTL_LT; - break; - case O_TTL_GT: - info->mode = IPT_TTL_GT; - break; - } -} - -static void ttl_check(struct xt_fcheck_call *cb) -{ - if (!(cb->xflags & F_ANY)) - xtables_error(PARAMETER_PROBLEM, - "TTL match: You must specify one of " - "`--ttl-eq', `--ttl-lt', `--ttl-gt"); -} - -static void ttl_print(const void *ip, const struct xt_entry_match *match, - int numeric) -{ - const struct ipt_ttl_info *info = - (struct ipt_ttl_info *) match->data; - - printf(" TTL match "); - switch (info->mode) { - case IPT_TTL_EQ: - printf("TTL =="); - break; - case IPT_TTL_NE: - printf("TTL !="); - break; - case IPT_TTL_LT: - printf("TTL <"); - break; - case IPT_TTL_GT: - printf("TTL >"); - break; - } - printf(" %u", info->ttl); -} - -static void ttl_save(const void *ip, const struct xt_entry_match *match) -{ - const struct ipt_ttl_info *info = - (struct ipt_ttl_info *) match->data; - - switch (info->mode) { - case IPT_TTL_EQ: - printf(" --ttl-eq"); - break; - case IPT_TTL_NE: - printf(" ! --ttl-eq"); - break; - case IPT_TTL_LT: - printf(" --ttl-lt"); - break; - case IPT_TTL_GT: - printf(" --ttl-gt"); - break; - default: - /* error */ - break; - } - printf(" %u", info->ttl); -} - -#define s struct ipt_ttl_info -static const struct xt_option_entry ttl_opts[] = { - {.name = "ttl-lt", .id = O_TTL_LT, .excl = F_ANY, .type = XTTYPE_UINT8, - .flags = XTOPT_PUT, XTOPT_POINTER(s, ttl)}, - {.name = "ttl-gt", .id = O_TTL_GT, .excl = F_ANY, .type = XTTYPE_UINT8, - .flags = XTOPT_PUT, XTOPT_POINTER(s, ttl)}, - {.name = "ttl-eq", .id = O_TTL_EQ, .excl = F_ANY, .type = XTTYPE_UINT8, - .flags = XTOPT_INVERT | XTOPT_PUT, XTOPT_POINTER(s, ttl)}, - {.name = "ttl", .id = O_TTL_EQ, .excl = F_ANY, .type = XTTYPE_UINT8, - .flags = XTOPT_PUT, XTOPT_POINTER(s, ttl)}, - XTOPT_TABLEEND, -}; -#undef s - -static struct xtables_match ttl_mt_reg = { - .name = "ttl", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct ipt_ttl_info)), - .userspacesize = XT_ALIGN(sizeof(struct ipt_ttl_info)), - .help = ttl_help, - .print = ttl_print, - .save = ttl_save, - .x6_parse = ttl_parse, - .x6_fcheck = ttl_check, - .x6_options = ttl_opts, -}; - - -void _init(void) -{ - xtables_register_match(&ttl_mt_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_ttl.man b/src/main/jni/iptables/extensions/libipt_ttl.man deleted file mode 100644 index 849f7042..00000000 --- a/src/main/jni/iptables/extensions/libipt_ttl.man +++ /dev/null @@ -1,10 +0,0 @@ -This module matches the time to live field in the IP header. -.TP -\fB\-\-ttl\-eq\fP \fIttl\fP -Matches the given TTL value. -.TP -\fB\-\-ttl\-gt\fP \fIttl\fP -Matches if TTL is greater than the given TTL value. -.TP -\fB\-\-ttl\-lt\fP \fIttl\fP -Matches if TTL is less than the given TTL value. diff --git a/src/main/jni/iptables/extensions/libipt_unclean.c b/src/main/jni/iptables/extensions/libipt_unclean.c deleted file mode 100644 index bc4a4a08..00000000 --- a/src/main/jni/iptables/extensions/libipt_unclean.c +++ /dev/null @@ -1,15 +0,0 @@ -/* Shared library add-on to iptables for unclean. */ -#include - -static struct xtables_match unclean_mt_reg = { - .name = "unclean", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(0), - .userspacesize = XT_ALIGN(0), -}; - -void _init(void) -{ - xtables_register_match(&unclean_mt_reg); -} diff --git a/src/main/jni/iptables/extensions/libipt_unclean.man b/src/main/jni/iptables/extensions/libipt_unclean.man deleted file mode 100644 index 3fecd554..00000000 --- a/src/main/jni/iptables/extensions/libipt_unclean.man +++ /dev/null @@ -1,2 +0,0 @@ -This module takes no options, but attempts to match packets which seem -malformed or unusual. This is regarded as experimental. diff --git a/src/main/jni/iptables/extensions/libxt_AUDIT.c b/src/main/jni/iptables/extensions/libxt_AUDIT.c deleted file mode 100644 index 86a61cbe..00000000 --- a/src/main/jni/iptables/extensions/libxt_AUDIT.c +++ /dev/null @@ -1,101 +0,0 @@ -/* Shared library add-on to xtables for AUDIT - * - * (C) 2010-2011, Thomas Graf - * (C) 2010-2011, Red Hat, Inc. - * - * This program is distributed under the terms of GNU GPL v2, 1991 - */ -#include -#include -#include -#include - -enum { - O_AUDIT_TYPE = 0, -}; - -static void audit_help(void) -{ - printf( -"AUDIT target options\n" -" --type TYPE Action type to be recorded.\n"); -} - -static const struct xt_option_entry audit_opts[] = { - {.name = "type", .id = O_AUDIT_TYPE, .type = XTTYPE_STRING, - .flags = XTOPT_MAND}, - XTOPT_TABLEEND, -}; - -static void audit_parse(struct xt_option_call *cb) -{ - struct xt_audit_info *einfo = cb->data; - - xtables_option_parse(cb); - if (strcasecmp(cb->arg, "accept") == 0) - einfo->type = XT_AUDIT_TYPE_ACCEPT; - else if (strcasecmp(cb->arg, "drop") == 0) - einfo->type = XT_AUDIT_TYPE_DROP; - else if (strcasecmp(cb->arg, "reject") == 0) - einfo->type = XT_AUDIT_TYPE_REJECT; - else - xtables_error(PARAMETER_PROBLEM, - "Bad action type value \"%s\"", cb->arg); -} - -static void audit_print(const void *ip, const struct xt_entry_target *target, - int numeric) -{ - const struct xt_audit_info *einfo = - (const struct xt_audit_info *)target->data; - - printf(" AUDIT "); - - switch(einfo->type) { - case XT_AUDIT_TYPE_ACCEPT: - printf("accept"); - break; - case XT_AUDIT_TYPE_DROP: - printf("drop"); - break; - case XT_AUDIT_TYPE_REJECT: - printf("reject"); - break; - } -} - -static void audit_save(const void *ip, const struct xt_entry_target *target) -{ - const struct xt_audit_info *einfo = - (const struct xt_audit_info *)target->data; - - switch(einfo->type) { - case XT_AUDIT_TYPE_ACCEPT: - printf(" --type accept"); - break; - case XT_AUDIT_TYPE_DROP: - printf(" --type drop"); - break; - case XT_AUDIT_TYPE_REJECT: - printf(" --type reject"); - break; - } -} - -static struct xtables_target audit_tg_reg = { - .name = "AUDIT", - .version = XTABLES_VERSION, - .family = NFPROTO_UNSPEC, - .size = XT_ALIGN(sizeof(struct xt_audit_info)), - .userspacesize = XT_ALIGN(sizeof(struct xt_audit_info)), - .help = audit_help, - .print = audit_print, - .save = audit_save, - .x6_parse = audit_parse, - .x6_options = audit_opts, -}; - -void _init(void) -{ - xtables_register_target(&audit_tg_reg); -} diff --git a/src/main/jni/iptables/extensions/libxt_AUDIT.man b/src/main/jni/iptables/extensions/libxt_AUDIT.man deleted file mode 100644 index cd796967..00000000 --- a/src/main/jni/iptables/extensions/libxt_AUDIT.man +++ /dev/null @@ -1,14 +0,0 @@ -This target allows to create audit records for packets hitting the target. -It can be used to record accepted, dropped, and rejected packets. See -auditd(8) for additional details. -.TP -\fB\-\-type\fP {\fBaccept\fP|\fBdrop\fP|\fBreject\fP} -Set type of audit record. -.PP -Example: -.IP -iptables \-N AUDIT_DROP -.IP -iptables \-A AUDIT_DROP \-j AUDIT \-\-type drop -.IP -iptables \-A AUDIT_DROP \-j DROP diff --git a/src/main/jni/iptables/extensions/libxt_CHECKSUM.c b/src/main/jni/iptables/extensions/libxt_CHECKSUM.c deleted file mode 100644 index df9f9b3c..00000000 --- a/src/main/jni/iptables/extensions/libxt_CHECKSUM.c +++ /dev/null @@ -1,77 +0,0 @@ -/* Shared library add-on to xtables for CHECKSUM - * - * (C) 2002 by Harald Welte - * (C) 2010 by Red Hat, Inc - * Author: Michael S. Tsirkin - * - * This program is distributed under the terms of GNU GPL v2, 1991 - * - * libxt_CHECKSUM.c borrowed some bits from libipt_ECN.c - */ -#include -#include -#include - -enum { - O_CHECKSUM_FILL = 0, -}; - -static void CHECKSUM_help(void) -{ - printf( -"CHECKSUM target options\n" -" --checksum-fill Fill in packet checksum.\n"); -} - -static const struct xt_option_entry CHECKSUM_opts[] = { - {.name = "checksum-fill", .id = O_CHECKSUM_FILL, - .flags = XTOPT_MAND, .type = XTTYPE_NONE}, - XTOPT_TABLEEND, -}; - -static void CHECKSUM_parse(struct xt_option_call *cb) -{ - struct xt_CHECKSUM_info *einfo = cb->data; - - xtables_option_parse(cb); - einfo->operation = XT_CHECKSUM_OP_FILL; -} - -static void CHECKSUM_print(const void *ip, const struct xt_entry_target *target, - int numeric) -{ - const struct xt_CHECKSUM_info *einfo = - (const struct xt_CHECKSUM_info *)target->data; - - printf(" CHECKSUM"); - - if (einfo->operation & XT_CHECKSUM_OP_FILL) - printf(" fill"); -} - -static void CHECKSUM_save(const void *ip, const struct xt_entry_target *target) -{ - const struct xt_CHECKSUM_info *einfo = - (const struct xt_CHECKSUM_info *)target->data; - - if (einfo->operation & XT_CHECKSUM_OP_FILL) - printf(" --checksum-fill"); -} - -static struct xtables_target checksum_tg_reg = { - .name = "CHECKSUM", - .version = XTABLES_VERSION, - .family = NFPROTO_UNSPEC, - .size = XT_ALIGN(sizeof(struct xt_CHECKSUM_info)), - .userspacesize = XT_ALIGN(sizeof(struct xt_CHECKSUM_info)), - .help = CHECKSUM_help, - .print = CHECKSUM_print, - .save = CHECKSUM_save, - .x6_parse = CHECKSUM_parse, - .x6_options = CHECKSUM_opts, -}; - -void _init(void) -{ - xtables_register_target(&checksum_tg_reg); -} diff --git a/src/main/jni/iptables/extensions/libxt_CHECKSUM.man b/src/main/jni/iptables/extensions/libxt_CHECKSUM.man deleted file mode 100644 index 92ae700f..00000000 --- a/src/main/jni/iptables/extensions/libxt_CHECKSUM.man +++ /dev/null @@ -1,8 +0,0 @@ -This target allows to selectively work around broken/old applications. -It can only be used in the mangle table. -.TP -\fB\-\-checksum\-fill\fP -Compute and fill in the checksum in a packet that lacks a checksum. -This is particularly useful, if you need to work around old applications -such as dhcp clients, that do not work well with checksum offloads, -but don't want to disable checksum offload in your device. diff --git a/src/main/jni/iptables/extensions/libxt_CLASSIFY.c b/src/main/jni/iptables/extensions/libxt_CLASSIFY.c deleted file mode 100644 index ee0f9e1c..00000000 --- a/src/main/jni/iptables/extensions/libxt_CLASSIFY.c +++ /dev/null @@ -1,88 +0,0 @@ -#include -#include -#include -#include - -enum { - O_SET_CLASS = 0, -}; - -static void -CLASSIFY_help(void) -{ - printf( -"CLASSIFY target options:\n" -"--set-class MAJOR:MINOR Set skb->priority value (always hexadecimal!)\n"); -} - -static const struct xt_option_entry CLASSIFY_opts[] = { - {.name = "set-class", .id = O_SET_CLASS, .type = XTTYPE_STRING, - .flags = XTOPT_MAND}, - XTOPT_TABLEEND, -}; - -static int CLASSIFY_string_to_priority(const char *s, unsigned int *p) -{ - unsigned int i, j; - - if (sscanf(s, "%x:%x", &i, &j) != 2) - return 1; - - *p = TC_H_MAKE(i<<16, j); - return 0; -} - -static void CLASSIFY_parse(struct xt_option_call *cb) -{ - struct xt_classify_target_info *clinfo = cb->data; - - xtables_option_parse(cb); - if (CLASSIFY_string_to_priority(cb->arg, &clinfo->priority)) - xtables_error(PARAMETER_PROBLEM, - "Bad class value \"%s\"", cb->arg); -} - -static void -CLASSIFY_print_class(unsigned int priority, int numeric) -{ - printf(" %x:%x", TC_H_MAJ(priority)>>16, TC_H_MIN(priority)); -} - -static void -CLASSIFY_print(const void *ip, - const struct xt_entry_target *target, - int numeric) -{ - const struct xt_classify_target_info *clinfo = - (const struct xt_classify_target_info *)target->data; - printf(" CLASSIFY set"); - CLASSIFY_print_class(clinfo->priority, numeric); -} - -static void -CLASSIFY_save(const void *ip, const struct xt_entry_target *target) -{ - const struct xt_classify_target_info *clinfo = - (const struct xt_classify_target_info *)target->data; - - printf(" --set-class %.4x:%.4x", - TC_H_MAJ(clinfo->priority)>>16, TC_H_MIN(clinfo->priority)); -} - -static struct xtables_target classify_target = { - .family = NFPROTO_UNSPEC, - .name = "CLASSIFY", - .version = XTABLES_VERSION, - .size = XT_ALIGN(sizeof(struct xt_classify_target_info)), - .userspacesize = XT_ALIGN(sizeof(struct xt_classify_target_info)), - .help = CLASSIFY_help, - .print = CLASSIFY_print, - .save = CLASSIFY_save, - .x6_parse = CLASSIFY_parse, - .x6_options = CLASSIFY_opts, -}; - -void _init(void) -{ - xtables_register_target(&classify_target); -} diff --git a/src/main/jni/iptables/extensions/libxt_CLASSIFY.man b/src/main/jni/iptables/extensions/libxt_CLASSIFY.man deleted file mode 100644 index 0270fd18..00000000 --- a/src/main/jni/iptables/extensions/libxt_CLASSIFY.man +++ /dev/null @@ -1,5 +0,0 @@ -This module allows you to set the skb\->priority value (and thus classify the packet into a specific CBQ class). -.TP -\fB\-\-set\-class\fP \fImajor\fP\fB:\fP\fIminor\fP -Set the major and minor class value. The values are always interpreted as -hexadecimal even if no 0x prefix is given. diff --git a/src/main/jni/iptables/extensions/libxt_CONNSECMARK.c b/src/main/jni/iptables/extensions/libxt_CONNSECMARK.c deleted file mode 100644 index df2e6b82..00000000 --- a/src/main/jni/iptables/extensions/libxt_CONNSECMARK.c +++ /dev/null @@ -1,112 +0,0 @@ -/* - * Shared library add-on to iptables to add CONNSECMARK target support. - * - * Based on the MARK and CONNMARK targets. - * - * Copyright (C) 2006 Red Hat, Inc., James Morris - */ -#include -#include -#include - -#define PFX "CONNSECMARK target: " - -enum { - O_SAVE = 0, - O_RESTORE, - F_SAVE = 1 << O_SAVE, - F_RESTORE = 1 << O_RESTORE, -}; - -static void CONNSECMARK_help(void) -{ - printf( -"CONNSECMARK target options:\n" -" --save Copy security mark from packet to conntrack\n" -" --restore Copy security mark from connection to packet\n"); -} - -static const struct xt_option_entry CONNSECMARK_opts[] = { - {.name = "save", .id = O_SAVE, .excl = F_RESTORE, .type = XTTYPE_NONE}, - {.name = "restore", .id = O_RESTORE, .excl = F_SAVE, - .type = XTTYPE_NONE}, - XTOPT_TABLEEND, -}; - -static void CONNSECMARK_parse(struct xt_option_call *cb) -{ - struct xt_connsecmark_target_info *info = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_SAVE: - info->mode = CONNSECMARK_SAVE; - break; - case O_RESTORE: - info->mode = CONNSECMARK_RESTORE; - break; - } -} - -static void CONNSECMARK_check(struct xt_fcheck_call *cb) -{ - if (cb->xflags == 0) - xtables_error(PARAMETER_PROBLEM, PFX "parameter required"); -} - -static void print_connsecmark(const struct xt_connsecmark_target_info *info) -{ - switch (info->mode) { - case CONNSECMARK_SAVE: - printf("save"); - break; - - case CONNSECMARK_RESTORE: - printf("restore"); - break; - - default: - xtables_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode); - } -} - -static void -CONNSECMARK_print(const void *ip, const struct xt_entry_target *target, - int numeric) -{ - const struct xt_connsecmark_target_info *info = - (struct xt_connsecmark_target_info*)(target)->data; - - printf(" CONNSECMARK "); - print_connsecmark(info); -} - -static void -CONNSECMARK_save(const void *ip, const struct xt_entry_target *target) -{ - const struct xt_connsecmark_target_info *info = - (struct xt_connsecmark_target_info*)target->data; - - printf("--"); - print_connsecmark(info); -} - -static struct xtables_target connsecmark_target = { - .family = NFPROTO_UNSPEC, - .name = "CONNSECMARK", - .version = XTABLES_VERSION, - .revision = 0, - .size = XT_ALIGN(sizeof(struct xt_connsecmark_target_info)), - .userspacesize = XT_ALIGN(sizeof(struct xt_connsecmark_target_info)), - .help = CONNSECMARK_help, - .print = CONNSECMARK_print, - .save = CONNSECMARK_save, - .x6_parse = CONNSECMARK_parse, - .x6_fcheck = CONNSECMARK_check, - .x6_options = CONNSECMARK_opts, -}; - -void _init(void) -{ - xtables_register_target(&connsecmark_target); -} diff --git a/src/main/jni/iptables/extensions/libxt_CONNSECMARK.man b/src/main/jni/iptables/extensions/libxt_CONNSECMARK.man deleted file mode 100644 index 2616ab99..00000000 --- a/src/main/jni/iptables/extensions/libxt_CONNSECMARK.man +++ /dev/null @@ -1,18 +0,0 @@ -This module copies security markings from packets to connections -(if unlabeled), and from connections back to packets (also only -if unlabeled). Typically used in conjunction with SECMARK, it is -valid in the -.B security -table (for backwards compatibility with older kernels, it is also -valid in the -.B mangle -table). -.TP -\fB\-\-save\fP -If the packet has a security marking, copy it to the connection -if the connection is not marked. -.TP -\fB\-\-restore\fP -If the packet does not have a security marking, and the connection -does, copy the security marking from the connection to the packet. - diff --git a/src/main/jni/iptables/extensions/libxt_CT.c b/src/main/jni/iptables/extensions/libxt_CT.c deleted file mode 100644 index 7b93bfaf..00000000 --- a/src/main/jni/iptables/extensions/libxt_CT.c +++ /dev/null @@ -1,172 +0,0 @@ -#include -#include -#include -#include -#include - -static void ct_help(void) -{ - printf( -"CT target options:\n" -" --notrack Don't track connection\n" -" --helper name Use conntrack helper 'name' for connection\n" -" --ctevents event[,event...] Generate specified conntrack events for connection\n" -" --expevents event[,event...] Generate specified expectation events for connection\n" -" --zone ID Assign/Lookup connection in zone ID\n" - ); -} - -enum { - O_NOTRACK = 0, - O_HELPER, - O_CTEVENTS, - O_EXPEVENTS, - O_ZONE, -}; - -#define s struct xt_ct_target_info -static const struct xt_option_entry ct_opts[] = { - {.name = "notrack", .id = O_NOTRACK, .type = XTTYPE_NONE}, - {.name = "helper", .id = O_HELPER, .type = XTTYPE_STRING, - .flags = XTOPT_PUT, XTOPT_POINTER(s, helper)}, - {.name = "ctevents", .id = O_CTEVENTS, .type = XTTYPE_STRING}, - {.name = "expevents", .id = O_EXPEVENTS, .type = XTTYPE_STRING}, - {.name = "zone", .id = O_ZONE, .type = XTTYPE_UINT16, - .flags = XTOPT_PUT, XTOPT_POINTER(s, zone)}, - XTOPT_TABLEEND, -}; -#undef s - -struct event_tbl { - const char *name; - unsigned int event; -}; - -static const struct event_tbl ct_event_tbl[] = { - { "new", IPCT_NEW }, - { "related", IPCT_RELATED }, - { "destroy", IPCT_DESTROY }, - { "reply", IPCT_REPLY }, - { "assured", IPCT_ASSURED }, - { "protoinfo", IPCT_PROTOINFO }, - { "helper", IPCT_HELPER }, - { "mark", IPCT_MARK }, - { "natseqinfo", IPCT_NATSEQADJ }, - { "secmark", IPCT_SECMARK }, -}; - -static const struct event_tbl exp_event_tbl[] = { - { "new", IPEXP_NEW }, -}; - -static uint32_t ct_parse_events(const struct event_tbl *tbl, unsigned int size, - const char *events) -{ - char str[strlen(events) + 1], *e = str, *t; - unsigned int mask = 0, i; - - strcpy(str, events); - while ((t = strsep(&e, ","))) { - for (i = 0; i < size; i++) { - if (strcmp(t, tbl[i].name)) - continue; - mask |= 1 << tbl[i].event; - break; - } - - if (i == size) - xtables_error(PARAMETER_PROBLEM, "Unknown event type \"%s\"", t); - } - - return mask; -} - -static void ct_print_events(const char *pfx, const struct event_tbl *tbl, - unsigned int size, uint32_t mask) -{ - const char *sep = ""; - unsigned int i; - - printf(" %s ", pfx); - for (i = 0; i < size; i++) { - if (mask & (1 << tbl[i].event)) { - printf("%s%s", sep, tbl[i].name); - sep = ","; - } - } -} - -static void ct_parse(struct xt_option_call *cb) -{ - struct xt_ct_target_info *info = cb->data; - - xtables_option_parse(cb); - switch (cb->entry->id) { - case O_NOTRACK: - info->flags |= XT_CT_NOTRACK; - break; - case O_CTEVENTS: - info->ct_events = ct_parse_events(ct_event_tbl, ARRAY_SIZE(ct_event_tbl), cb->arg); - break; - case O_EXPEVENTS: - info->exp_events = ct_parse_events(exp_event_tbl, ARRAY_SIZE(exp_event_tbl), cb->arg); - break; - } -} - -static void ct_print(const void *ip, const struct xt_entry_target *target, int numeric) -{ - const struct xt_ct_target_info *info = - (const struct xt_ct_target_info *)target->data; - - printf(" CT"); - if (info->flags & XT_CT_NOTRACK) - printf(" notrack"); - if (info->helper[0]) - printf(" helper %s", info->helper); - if (info->ct_events) - ct_print_events("ctevents", ct_event_tbl, - ARRAY_SIZE(ct_event_tbl), info->ct_events); - if (info->exp_events) - ct_print_events("expevents", exp_event_tbl, - ARRAY_SIZE(exp_event_tbl), info->exp_events); - if (info->zone) - printf("zone %u ", info->zone); -} - -static void ct_save(const void *ip, const struct xt_entry_target *target) -{ - const struct xt_ct_target_info *info = - (const struct xt_ct_target_info *)target->data; - - if (info->flags & XT_CT_NOTRACK) - printf(" --notrack"); - if (info->helper[0]) - printf(" --helper %s", info->helper); - if (info->ct_events) - ct_print_events("--ctevents", ct_event_tbl, - ARRAY_SIZE(ct_event_tbl), info->ct_events); - if (info->exp_events) - ct_print_events("--expevents", exp_event_tbl, - ARRAY_SIZE(exp_event_tbl), info->exp_events); - if (info->zone) - printf(" --zone %u", info->zone); -} - -static struct xtables_target ct_target = { - .family = NFPROTO_UNSPEC, - .name = "CT", - .version = XTABLES_VERSION, - .size = XT_ALIGN(sizeof(struct xt_ct_target_info)), - .userspacesize = offsetof(struct xt_ct_target_info, ct), - .help = ct_help, - .print = ct_print, - .save = ct_save, - .x6_parse = ct_parse, - .x6_options = ct_opts, -}; - -void _init(void) -{ - xtables_register_target(&ct_target); -} diff --git a/src/main/jni/iptables/extensions/libxt_CT.man b/src/main/jni/iptables/extensions/libxt_CT.man deleted file mode 100644 index ff258b79..00000000 --- a/src/main/jni/iptables/extensions/libxt_CT.man +++ /dev/null @@ -1,25 +0,0 @@ -The CT target allows to set parameters for a packet or its associated -connection. The target attaches a "template" connection tracking entry to -the packet, which is then used by the conntrack core when initializing -a new ct entry. This target is thus only valid in the "raw" table. -.TP -\fB\-\-notrack\fP -Disables connection tracking for this packet. -.TP -\fB\-\-helper\fP \fIname\fP -Use the helper identified by \fIname\fP for the connection. This is more -flexible than loading the conntrack helper modules with preset ports. -.TP -\fB\-\-ctevents\fP \fIevent\fP[\fB,\fP...] -Only generate the specified conntrack events for this connection. Possible -event types are: \fBnew\fP, \fBrelated\fP, \fBdestroy\fP, \fBreply\fP, -\fBassured\fP, \fBprotoinfo\fP, \fBhelper\fP, \fBmark\fP (this refers to -the ctmark, not nfmark), \fBnatseqinfo\fP, \fBsecmark\fP (ctsecmark). -.TP -\fB\-\-expevents\fP \fIevent\fP[\fB,\fP...] -Only generate the specified expectation events for this connection. -Possible event types are: \fBnew\fP. -.TP -\fB\-\-zone\fP \fIid\fP -Assign this packet to zone \fIid\fP and only have lookups done in that zone. -By default, packets have zone 0. diff --git a/src/main/jni/iptables/extensions/libxt_IDLETIMER.c b/src/main/jni/iptables/extensions/libxt_IDLETIMER.c deleted file mode 100644 index 5f1b9fe7..00000000 --- a/src/main/jni/iptables/extensions/libxt_IDLETIMER.c +++ /dev/null @@ -1,96 +0,0 @@ -/* - * Shared library add-on for iptables to add IDLETIMER support. - * - * Copyright (C) 2010 Nokia Corporation. All rights reserved. - * - * Contact: Luciano Coelho - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU General Public License - * version 2 as published by the Free Software Foundation. - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA - * 02110-1301 USA - * - */ -#include -#include -#include - -enum { - O_TIMEOUT = 0, - O_LABEL, - O_NETLINK, -}; - -#define s struct idletimer_tg_info -static const struct xt_option_entry idletimer_tg_opts[] = { - {.name = "timeout", .id = O_TIMEOUT, .type = XTTYPE_UINT32, - .flags = XTOPT_MAND | XTOPT_PUT, XTOPT_POINTER(s, timeout)}, - {.name = "label", .id = O_LABEL, .type = XTTYPE_STRING, - .flags = XTOPT_MAND | XTOPT_PUT, XTOPT_POINTER(s, label)}, - {.name = "send_nl_msg", .id = O_NETLINK, .type = XTTYPE_UINT8, - .flags = XTOPT_PUT, XTOPT_POINTER(s, send_nl_msg)}, - XTOPT_TABLEEND, -}; -#undef s - -static void idletimer_tg_help(void) -{ - printf( -"IDLETIMER target options:\n" -" --timeout time Timeout until the notification is sent (in seconds)\n" -" --label string Unique rule identifier\n" -" --send_nl_msg (0/1) Enable netlink messages," - " and show remaining time in sysfs. Defaults to 0.\n" -"\n"); -} - -static void idletimer_tg_print(const void *ip, - const struct xt_entry_target *target, - int numeric) -{ - struct idletimer_tg_info *info = - (struct idletimer_tg_info *) target->data; - - printf(" timeout:%u", info->timeout); - printf(" label:%s", info->label); - printf(" send_nl_msg:%u", info->send_nl_msg); -} - -static void idletimer_tg_save(const void *ip, - const struct xt_entry_target *target) -{ - struct idletimer_tg_info *info = - (struct idletimer_tg_info *) target->data; - - printf(" --timeout %u", info->timeout); - printf(" --label %s", info->label); - printf(" --send_nl_msg %u", info->send_nl_msg); -} - -static struct xtables_target idletimer_tg_reg = { - .family = NFPROTO_UNSPEC, - .name = "IDLETIMER", - .version = XTABLES_VERSION, - .revision = 1, - .size = XT_ALIGN(sizeof(struct idletimer_tg_info)), - .userspacesize = offsetof(struct idletimer_tg_info, timer), - .help = idletimer_tg_help, - .x6_parse = xtables_option_parse, - .print = idletimer_tg_print, - .save = idletimer_tg_save, - .x6_options = idletimer_tg_opts, -}; - -void _init(void) -{ - xtables_register_target(&idletimer_tg_reg); -} diff --git a/src/main/jni/iptables/extensions/libxt_IDLETIMER.man b/src/main/jni/iptables/extensions/libxt_IDLETIMER.man deleted file mode 100644 index 3b5188d9..00000000 --- a/src/main/jni/iptables/extensions/libxt_IDLETIMER.man +++ /dev/null @@ -1,24 +0,0 @@ -This target can be used to identify when interfaces have been idle for a -certain period of time. Timers are identified by labels and are created when -a rule is set with a new label. The rules also take a timeout value (in -seconds) as an option. If more than one rule uses the same timer label, the -timer will be restarted whenever any of the rules get a hit. One entry for -each timer is created in sysfs. This attribute contains the timer remaining -for the timer to expire. The attributes are located under the xt_idletimer -class: -.PP -/sys/class/xt_idletimer/timers/