SOURCES: iptables-comment-20060504.patch (NEW), iptables-expire-20...
cieciwa
cieciwa at pld-linux.org
Sun May 7 23:02:08 CEST 2006
Author: cieciwa Date: Sun May 7 21:02:08 2006 GMT
Module: SOURCES Tag: HEAD
---- Log message:
- snap 20060504.
---- Files affected:
SOURCES:
iptables-comment-20060504.patch (NONE -> 1.1) (NEW), iptables-expire-20060504.patch (NONE -> 1.1) (NEW)
---- Diffs:
================================================================
Index: SOURCES/iptables-comment-20060504.patch
diff -u /dev/null SOURCES/iptables-comment-20060504.patch:1.1
--- /dev/null Sun May 7 23:02:08 2006
+++ SOURCES/iptables-comment-20060504.patch Sun May 7 23:02:02 2006
@@ -0,0 +1,115 @@
+ .comment-test | 2 +
+ libipt_comment.c | 58 ++++++++++++++++++++++++++++++-------------------------
+ 2 files changed, 34 insertions(+), 26 deletions(-)
+
+diff -urN --exclude '*.orig' iptables.org/extensions/.comment-test iptables/extensions/.comment-test
+--- iptables.org/extensions/.comment-test 1970-01-01 01:00:00.000000000 +0100
++++ iptables/extensions/.comment-test 2006-05-04 09:44:32.000000000 +0200
+@@ -0,0 +1,2 @@
++#!/bin/sh
++[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_comment.h ] && echo comment
+diff -urN --exclude '*.orig' iptables.org/extensions/libipt_comment.c iptables/extensions/libipt_comment.c
+--- iptables.org/extensions/libipt_comment.c 2006-05-04 09:32:52.000000000 +0200
++++ iptables/extensions/libipt_comment.c 2006-05-04 09:44:32.000000000 +0200
+@@ -1,5 +1,5 @@
+-/* Shared library add-on to iptables to add comment match support.
+- *
++/* Shared library add-on to iptables to add comment match support.
++ *
+ * ChangeLog
+ * 2003-05-13: Brad Fisher <brad at info-link.net>
+ * Initial comment match
+@@ -29,16 +29,24 @@
+ {0}
+ };
+
++/* Initialize the match. */
+ static void
+-parse_comment(const char *s, struct ipt_comment_info *info)
++init(struct ipt_entry_match *m, unsigned int *nfcache)
++{
++ *nfcache |= NFC_UNKNOWN;
++}
++
++static void
++parse_comment(const unsigned char *s, struct ipt_comment_info *info)
+ {
+ int slen = strlen(s);
+
+- if (slen >= IPT_MAX_COMMENT_LEN) {
++ if (slen > IPT_MAX_COMMENT_LEN) {
+ exit_error(PARAMETER_PROBLEM,
+ "COMMENT must be shorter than %i characters", IPT_MAX_COMMENT_LEN);
+ }
+- strcpy((char *)info->comment, s);
++
++ strcpy(info->comment, s);
+ }
+
+ /* Function which parses command options; returns true if it
+@@ -53,11 +61,12 @@
+
+ switch (c) {
+ case '1':
+- check_inverse(argv[optind-1], &invert, &optind, 0);
++ check_inverse(optarg, &invert, &optind, 0);
+ if (invert) {
+ exit_error(PARAMETER_PROBLEM,
+ "Sorry, you can't have an inverted comment");
+ }
++
+ parse_comment(argv[optind-1], commentinfo);
+ *flags = 1;
+ break;
+@@ -83,34 +92,31 @@
+ const struct ipt_entry_match *match,
+ int numeric)
+ {
+- struct ipt_comment_info *commentinfo = (struct ipt_comment_info *)match->data;
+-
+- commentinfo->comment[IPT_MAX_COMMENT_LEN-1] = '\0';
+- printf("/* %s */ ", commentinfo->comment);
++ printf("/* %s */ ", ((struct ipt_comment_info *)match->data)->comment);
+ }
+
+ /* Saves the union ipt_matchinfo in parsable form to stdout. */
+ static void
+ save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
+ {
+- struct ipt_comment_info *commentinfo = (struct ipt_comment_info *)match->data;
+-
+- commentinfo->comment[IPT_MAX_COMMENT_LEN-1] = '\0';
+- printf("--comment \"%s\" ", commentinfo->comment);
++/* I wonder whether this works? */
++ printf("--comment \"%s\" ", ((struct ipt_comment_info *)match->data)->comment );
+ }
+
+-static struct iptables_match comment = {
+- .next = NULL,
+- .name = "comment",
+- .version = IPTABLES_VERSION,
+- .size = IPT_ALIGN(sizeof(struct ipt_comment_info)),
+- .userspacesize = IPT_ALIGN(sizeof(struct ipt_comment_info)),
+- .help = &help,
+- .parse = &parse,
+- .final_check = &final_check,
+- .print = &print,
+- .save = &save,
+- .extra_opts = opts
++static
++struct iptables_match comment
++= { .next = NULL,
++ .name = "comment",
++ .version = IPTABLES_VERSION,
++ .size = IPT_ALIGN(sizeof(struct ipt_comment_info)),
++ .userspacesize = IPT_ALIGN(sizeof(struct ipt_comment_info)),
++ .help = &help,
++ .init = &init,
++ .parse = &parse,
++ .final_check = &final_check,
++ .print = &print,
++ .save = &save,
++ .extra_opts = opts
+ };
+
+ void _init(void)
================================================================
Index: SOURCES/iptables-expire-20060504.patch
diff -u /dev/null SOURCES/iptables-expire-20060504.patch:1.1
--- /dev/null Sun May 7 23:02:08 2006
+++ SOURCES/iptables-expire-20060504.patch Sun May 7 23:02:02 2006
@@ -0,0 +1,388 @@
+ .expire-test | 3
+ .expire-test6 | 3
+ libip6t_expire.c | 170 +++++++++++++++++++++++++++++++++++++++++++++++++++++
+ libip6t_expire.man | 5 +
+ libipt_expire.c | 170 +++++++++++++++++++++++++++++++++++++++++++++++++++++
+ libipt_expire.man | 5 +
+ 6 files changed, 356 insertions(+)
+
+diff -urN --exclude '*.orig' iptables.org/extensions/.expire-test iptables/extensions/.expire-test
+--- iptables.org/extensions/.expire-test 1970-01-01 01:00:00.000000000 +0100
++++ iptables/extensions/.expire-test 2006-05-04 10:04:04.000000000 +0200
+@@ -0,0 +1,3 @@
++#!/bin/sh
++
++[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_expire.h ] && echo expire
+diff -urN --exclude '*.orig' iptables.org/extensions/.expire-test6 iptables/extensions/.expire-test6
+--- iptables.org/extensions/.expire-test6 1970-01-01 01:00:00.000000000 +0100
++++ iptables/extensions/.expire-test6 2006-05-04 10:04:04.000000000 +0200
+@@ -0,0 +1,3 @@
++#!/bin/sh
++
++[ -f $KERNEL_DIR/include/linux/netfilter_ipv6/ip6t_expire.h ] && echo expire
+diff -urN --exclude '*.orig' iptables.org/extensions/libip6t_expire.c iptables/extensions/libip6t_expire.c
+--- iptables.org/extensions/libip6t_expire.c 1970-01-01 01:00:00.000000000 +0100
++++ iptables/extensions/libip6t_expire.c 2006-05-04 10:04:04.000000000 +0200
+@@ -0,0 +1,170 @@
++/* This library manipulates expiring firewall rules
++ *
++ * This library is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this library; if not, write to:
++ * The Free Software Foundation, Inc.
++ * 59 Temple Place, Suite 330
++ * Boston, MA 02111-1307 USA
++ *
++ * Copyright Š 2005 Bryan Cardillo <dillo at seas.upenn.edu>
++ */
++
++#include <stdio.h>
++#include <string.h>
++#include <stdlib.h>
++#include <getopt.h>
++#include <time.h>
++
++#include <ip6tables.h>
++#include <linux/netfilter_ipv6/ip6t_expire.h>
++
++static void ip6t_exp_help(void);
++static int ip6t_exp_parse(int, char **, int, unsigned int *,
++ const struct ip6t_entry *, unsigned int *,
++ struct ip6t_entry_match **);
++static void ip6t_exp_final_check(unsigned int);
++static void ip6t_exp_print(const struct ip6t_ip *,
++ const struct ip6t_entry_match *, int);
++static void ip6t_exp_save(const struct ip6t_ip *, const struct ip6t_entry_match *);
++
++/**
++ * options
++ */
++static struct option ip6t_exp_opts[] = {
++ { "expiration", 1, 0, 'e' },
++ { 0 }
++};
++
++/**
++ * match
++ */
++static struct iptables_match ip6t_expire_match = {
++ .next = NULL,
++ .name = "expire",
++ .version = IPTABLES_VERSION,
++ .size = IP6T_ALIGN(sizeof(struct ip6t_exp_info)),
++ .userspacesize = IP6T_ALIGN(sizeof(struct ip6t_exp_info)),
++ .help = &ip6t_exp_help,
++ .parse = &ip6t_exp_parse,
++ .final_check = &ip6t_exp_final_check,
++ .print = &ip6t_exp_print,
++ .save = &ip6t_exp_save,
++ .extra_opts = ip6t_exp_opts
++};
++
++/**
++ * shared library initialization
++ * @see register_match()
++ */
++void
++_init(void)
++{
++ register_match(&ip6t_expire_match);
++}
++
++/**
++ * print usage information
++ */
++static void
++ip6t_exp_help(void)
++{
++ printf("EXPIRE match options\n"
++ " --expiration [+]TIME\t\t"
++ "rule expires at [in] TIME\n\n");
++}
++
++/**
++ * parse module specific options
++ * @param c the short option character
++ * @param argv the arguments array
++ * @param invert is this an inverted argument
++ * @param flags module specific flags
++ * @param entry the entry
++ * @param nfcache netfilter cache flags
++ * @param match the match
++ * @return zero if an option was found, non-zero otherwise
++ */
++static int
++ip6t_exp_parse(int c, char **argv, int invert, unsigned int *flags,
++ const struct ip6t_entry *entry, unsigned int *nfcache,
++ struct ip6t_entry_match **match)
++{
++ char *arg;
++ struct ip6t_exp_info *info;
++
++ info = (struct ip6t_exp_info *)(*match)->data;
++ info->expiration = 0;
++ switch (c) {
++ case 'e':
++ arg = argv[optind-1];
++ check_inverse(arg, &invert, &optind, 0);
++ if (invert)
++ exit_error(PARAMETER_PROBLEM,
++ "--expiration cannot be inverted");
++ if (*arg == '+')
++ arg++;
++ if (string_to_number_l(
++ arg, 1, 0, &info->expiration) < 0)
++ exit_error(PARAMETER_PROBLEM,
++ "invalid expiration time");
++ *flags = 1;
++ if (*argv[optind-1] == '+')
++ info->expiration += time(NULL);
++ break;
++ default:
++ return 0;
++ }
++ return 1;
++}
++
++/**
++ * ensures an expiration was specified
++ * @param flags module specific flags from options parsing
++ */
++static void
++ip6t_exp_final_check(unsigned int flags)
++{
++ if (flags != 1)
++ exit_error(PARAMETER_PROBLEM,
++ "you must specify an expiration time (--expiration)");
++}
++
++/**
++ * print information about an expiring match
++ * in a format suitable for viewing
++ * @param ip the address information
++ * @param match the match
++ * @param numeric the verbose level (?)
++ */
++static void
++ip6t_exp_print(const struct ip6t_ip *ip,
++ const struct ip6t_entry_match *match, int numeric)
++{
++ struct ip6t_exp_info *info;
++ info = (struct ip6t_exp_info *)match->data;
++ printf("expires in %lds ", info->expiration - time(NULL));
++}
++
++/**
++ * print information about an expiring match
++ * in a format suitable for reconstructing the match
++ * @param ip the address information
++ * @param match the match
++ */
++static void
++ip6t_exp_save(const struct ip6t_ip *ip, const struct ip6t_entry_match *match)
++{
++ struct ip6t_exp_info *info;
++ info = (struct ip6t_exp_info *)match->data;
++ printf("-m expire --expiration %ld ", info->expiration);
++}
+diff -urN --exclude '*.orig' iptables.org/extensions/libip6t_expire.man iptables/extensions/libip6t_expire.man
+--- iptables.org/extensions/libip6t_expire.man 1970-01-01 01:00:00.000000000 +0100
++++ iptables/extensions/libip6t_expire.man 2006-05-04 10:04:04.000000000 +0200
+@@ -0,0 +1,5 @@
++This module matches until its expiration time.
++.TP
++.BI "--expiration " "[\fItime\fP]"
++Match against the other rule criteria until the expiration time. After
++the expiration time, the entire rule will be removed from the table.
+diff -urN --exclude '*.orig' iptables.org/extensions/libipt_expire.c iptables/extensions/libipt_expire.c
+--- iptables.org/extensions/libipt_expire.c 1970-01-01 01:00:00.000000000 +0100
++++ iptables/extensions/libipt_expire.c 2006-05-04 10:04:04.000000000 +0200
+@@ -0,0 +1,170 @@
++/* This library manipulates expiring firewall rules
++ *
++ * This library is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this library; if not, write to:
++ * The Free Software Foundation, Inc.
++ * 59 Temple Place, Suite 330
++ * Boston, MA 02111-1307 USA
++ *
++ * Copyright Š 2005 Bryan Cardillo <dillo at seas.upenn.edu>
++ */
++
++#include <stdio.h>
++#include <string.h>
++#include <stdlib.h>
++#include <getopt.h>
++#include <time.h>
++
++#include <iptables.h>
++#include <linux/netfilter_ipv4/ipt_expire.h>
++
++static void ipt_exp_help(void);
++static int ipt_exp_parse(int, char **, int, unsigned int *,
++ const struct ipt_entry *, unsigned int *,
++ struct ipt_entry_match **);
++static void ipt_exp_final_check(unsigned int);
++static void ipt_exp_print(const struct ipt_ip *,
++ const struct ipt_entry_match *, int);
++static void ipt_exp_save(const struct ipt_ip *, const struct ipt_entry_match *);
++
++/**
++ * options
++ */
++static struct option ipt_exp_opts[] = {
++ { "expiration", 1, 0, 'e' },
++ { 0 }
++};
++
++/**
++ * match
++ */
++static struct iptables_match ipt_expire_match = {
++ .next = NULL,
++ .name = "expire",
++ .version = IPTABLES_VERSION,
++ .size = IPT_ALIGN(sizeof(struct ipt_exp_info)),
++ .userspacesize = IPT_ALIGN(sizeof(struct ipt_exp_info)),
++ .help = &ipt_exp_help,
++ .parse = &ipt_exp_parse,
++ .final_check = &ipt_exp_final_check,
++ .print = &ipt_exp_print,
++ .save = &ipt_exp_save,
++ .extra_opts = ipt_exp_opts
++};
++
++/**
++ * shared library initialization
++ * @see register_match()
++ */
++void
++_init(void)
++{
++ register_match(&ipt_expire_match);
++}
++
++/**
++ * print usage information
++ */
++static void
++ipt_exp_help(void)
++{
++ printf("EXPIRE match options\n"
++ " --expiration [+]TIME\t\t"
++ "rule expires at [in] TIME\n\n");
++}
++
++/**
++ * parse module specific options
++ * @param c the short option character
++ * @param argv the arguments array
++ * @param invert is this an inverted argument
++ * @param flags module specific flags
++ * @param entry the entry
++ * @param nfcache netfilter cache flags
++ * @param match the match
++ * @return zero if an option was found, non-zero otherwise
++ */
++static int
++ipt_exp_parse(int c, char **argv, int invert, unsigned int *flags,
++ const struct ipt_entry *entry, unsigned int *nfcache,
++ struct ipt_entry_match **match)
++{
++ char *arg;
++ struct ipt_exp_info *info;
++
++ info = (struct ipt_exp_info *)(*match)->data;
++ info->expiration = 0;
++ switch (c) {
++ case 'e':
++ arg = argv[optind-1];
++ check_inverse(arg, &invert, &optind, 0);
++ if (invert)
++ exit_error(PARAMETER_PROBLEM,
++ "--expiration cannot be inverted");
++ if (*arg == '+')
++ arg++;
++ if (string_to_number_l(
++ arg, 1, 0, &info->expiration) < 0)
++ exit_error(PARAMETER_PROBLEM,
++ "invalid expiration time");
++ *flags = 1;
++ if (*argv[optind-1] == '+')
++ info->expiration += time(NULL);
++ break;
++ default:
++ return 0;
++ }
++ return 1;
++}
++
++/**
++ * ensures an expiration was specified
++ * @param flags module specific flags from options parsing
++ */
++static void
++ipt_exp_final_check(unsigned int flags)
++{
++ if (flags != 1)
++ exit_error(PARAMETER_PROBLEM,
++ "you must specify an expiration time (--expiration)");
++}
++
++/**
++ * print information about an expiring match
++ * in a format suitable for viewing
++ * @param ip the address information
++ * @param match the match
++ * @param numeric the verbose level (?)
++ */
++static void
++ipt_exp_print(const struct ipt_ip *ip,
++ const struct ipt_entry_match *match, int numeric)
++{
++ struct ipt_exp_info *info;
++ info = (struct ipt_exp_info *)match->data;
++ printf("expires in %lds ", info->expiration - time(NULL));
++}
++
++/**
++ * print information about an expiring match
++ * in a format suitable for reconstructing the match
++ * @param ip the address information
++ * @param match the match
++ */
++static void
++ipt_exp_save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
++{
++ struct ipt_exp_info *info;
++ info = (struct ipt_exp_info *)match->data;
++ printf("-m expire --expiration %ld ", info->expiration);
++}
+diff -urN --exclude '*.orig' iptables.org/extensions/libipt_expire.man iptables/extensions/libipt_expire.man
+--- iptables.org/extensions/libipt_expire.man 1970-01-01 01:00:00.000000000 +0100
++++ iptables/extensions/libipt_expire.man 2006-05-04 10:04:04.000000000 +0200
+@@ -0,0 +1,5 @@
++This module matches until its expiration time.
++.TP
++.BI "--expiration " "[\fItime\fP]"
++Match against the other rule criteria until the expiration time. After
++the expiration time, the entire rule will be removed from the table.
================================================================
More information about the pld-cvs-commit
mailing list