summaryrefslogtreecommitdiffstats
path: root/iptables/xtables.c
Commit message (Collapse)AuthorAgeFilesLines
* iptables: Remove const qualifier from struct option.Varsha Rao2017-12-211-1/+1
| | | | | | | | | | | | | As opts is reassigned multiple times, it cannot be made constant. So remove const qualifier from structure option. This patch fixes the following warning: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] .orig_opts = original_opts, Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Constify option structHarsha Sharma2017-10-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The struct of type option is only used to initialise a field inside the xtables_globals struct and is not modified anywhere. Done using following coccinelle semantic patch @r1 disable optional_qualifier@ identifier s,i; position p; @@ static struct option i@p[] ={...}; @ok1@ identifier r1.i; expression e; position p; @@ e = i@p @bad@ position p != {r1.p,ok1.p}; identifier r1.i; @@ e@i@p @depends on !bad disable optional_qualifier@ identifier r1.i; @@ static +const struct option i[] = { ... }; Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat-restore: fix several memory leaksPablo M. Bermudo Garay2017-08-141-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following memory leaks are detected by valgrind when ip[6]tables-compat-restore is executed: valgrind --leak-check=full iptables-compat-restore test-ruleset ==2548== 16 bytes in 1 blocks are definitely lost in loss record 1 of 20 ==2548== at 0x4C2DBC5: calloc (vg_replace_malloc.c:711) ==2548== by 0x4E39D67: __mnl_socket_open (socket.c:110) ==2548== by 0x4E39DDE: mnl_socket_open (socket.c:133) ==2548== by 0x11A48E: nft_init (nft.c:765) ==2548== by 0x11589F: xtables_restore_main (xtables-restore.c:463) ==2548== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) ==2548== by 0x12FF39: subcmd_main (xshared.c:211) ==2548== by 0x10F63C: main (xtables-compat-multi.c:41) ==2548== ==2548== 16 bytes in 1 blocks are definitely lost in loss record 2 of 20 ==2548== at 0x4C2DBC5: calloc (vg_replace_malloc.c:711) ==2548== by 0x504C7CD: nftnl_chain_list_alloc (chain.c:874) ==2548== by 0x11B2DB: nftnl_chain_list_get (nft.c:1194) ==2548== by 0x11B377: nft_chain_dump (nft.c:1210) ==2548== by 0x114DF9: get_chain_list (xtables-restore.c:167) ==2548== by 0x114EF8: xtables_restore_parse (xtables-restore.c:217) ==2548== by 0x115B43: xtables_restore_main (xtables-restore.c:526) ==2548== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) ==2548== by 0x12FF39: subcmd_main (xshared.c:211) ==2548== by 0x10F63C: main (xtables-compat-multi.c:41) ==2548== ==2548== 40 bytes in 1 blocks are definitely lost in loss record 5 of 20 ==2548== at 0x4C2DBC5: calloc (vg_replace_malloc.c:711) ==2548== by 0x56ABB99: xtables_calloc (xtables.c:291) ==2548== by 0x116DA7: command_jump (xtables.c:623) ==2548== by 0x117D5B: do_parse (xtables.c:923) ==2548== by 0x1188BA: do_commandx (xtables.c:1183) ==2548== by 0x115655: xtables_restore_parse (xtables-restore.c:405) ==2548== by 0x115B43: xtables_restore_main (xtables-restore.c:526) ==2548== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) ==2548== by 0x12FF39: subcmd_main (xshared.c:211) ==2548== by 0x10F63C: main (xtables-compat-multi.c:41) ==2548== ==2548== 40 bytes in 1 blocks are definitely lost in loss record 6 of 20 ==2548== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==2548== by 0x4E3AE07: mnl_nlmsg_batch_start (nlmsg.c:441) ==2548== by 0x1192B7: mnl_nftnl_batch_alloc (nft.c:106) ==2548== by 0x11931A: mnl_nftnl_batch_page_add (nft.c:122) ==2548== by 0x11DB0C: nft_action (nft.c:2402) ==2548== by 0x11DB65: nft_commit (nft.c:2413) ==2548== by 0x114FBB: xtables_restore_parse (xtables-restore.c:238) ==2548== by 0x115B43: xtables_restore_main (xtables-restore.c:526) ==2548== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) ==2548== by 0x12FF39: subcmd_main (xshared.c:211) ==2548== by 0x10F63C: main (xtables-compat-multi.c:41) ==2548== ==2548== 80 bytes in 5 blocks are definitely lost in loss record 8 of 20 ==2548== at 0x4C2DBC5: calloc (vg_replace_malloc.c:711) ==2548== by 0x50496FE: nftnl_table_list_alloc (table.c:433) ==2548== by 0x11DF88: nft_xtables_config_load (nft.c:2539) ==2548== by 0x11B037: nft_rule_append (nft.c:1116) ==2548== by 0x116639: add_entry (xtables.c:429) ==2548== by 0x118A3B: do_commandx (xtables.c:1187) ==2548== by 0x115655: xtables_restore_parse (xtables-restore.c:405) ==2548== by 0x115B43: xtables_restore_main (xtables-restore.c:526) ==2548== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) ==2548== by 0x12FF39: subcmd_main (xshared.c:211) ==2548== by 0x10F63C: main (xtables-compat-multi.c:41) ==2548== ==2548== 80 bytes in 5 blocks are definitely lost in loss record 9 of 20 ==2548== at 0x4C2DBC5: calloc (vg_replace_malloc.c:711) ==2548== by 0x504C7CD: nftnl_chain_list_alloc (chain.c:874) ==2548== by 0x11DF91: nft_xtables_config_load (nft.c:2540) ==2548== by 0x11B037: nft_rule_append (nft.c:1116) ==2548== by 0x116639: add_entry (xtables.c:429) ==2548== by 0x118A3B: do_commandx (xtables.c:1187) ==2548== by 0x115655: xtables_restore_parse (xtables-restore.c:405) ==2548== by 0x115B43: xtables_restore_main (xtables-restore.c:526) ==2548== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) ==2548== by 0x12FF39: subcmd_main (xshared.c:211) ==2548== by 0x10F63C: main (xtables-compat-multi.c:41) ==2548== ==2548== 135,168 bytes in 1 blocks are definitely lost in loss record 19 of 20 ==2548== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==2548== by 0x119280: mnl_nftnl_batch_alloc (nft.c:102) ==2548== by 0x11A51F: nft_init (nft.c:777) ==2548== by 0x11589F: xtables_restore_main (xtables-restore.c:463) ==2548== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) ==2548== by 0x12FF39: subcmd_main (xshared.c:211) ==2548== by 0x10F63C: main (xtables-compat-multi.c:41) An additional leak occurs if a rule-set already exits: ==2735== 375 (312 direct, 63 indirect) bytes in 3 blocks are definitely lost in loss record 19 of 24 ==2735== at 0x4C2DBC5: calloc (vg_replace_malloc.c:711) ==2735== by 0x504AAE9: nftnl_chain_alloc (chain.c:92) ==2735== by 0x11B1F1: nftnl_chain_list_cb (nft.c:1172) ==2735== by 0x4E3A2E8: __mnl_cb_run (callback.c:78) ==2735== by 0x4E3A4A7: mnl_cb_run (callback.c:162) ==2735== by 0x11920D: mnl_talk (nft.c:70) ==2735== by 0x11B343: nftnl_chain_list_get (nft.c:1203) ==2735== by 0x11B377: nft_chain_dump (nft.c:1210) ==2735== by 0x114DF9: get_chain_list (xtables-restore.c:167) ==2735== by 0x114EF8: xtables_restore_parse (xtables-restore.c:217) ==2735== by 0x115B43: xtables_restore_main (xtables-restore.c:526) ==2735== by 0x115B88: xtables_ip4_restore_main (xtables-restore.c:534) Fix these memory leaks. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: remove duplicated argument parsing codeLorenzo Colitti2017-03-171-45/+17
| | | | | | | | | | 1. Factor out repeated code to a new xs_has_arg function. 2. Add a new parse_wait_time option to parse the value of -w. 3. Make parse_wait_interval take argc and argv so its callers can be simpler. Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: check if nft ruleset is compatiblePablo M. Bermudo Garay2016-08-261-0/+5
| | | | | | | | | | | | | This patch adds a verification of the compatibility between the nft ruleset and iptables. Nft tables, chains and rules are checked to be compatible with iptables. If something is not compatible, the execution stops and an error message is displayed to the user. This checking is triggered by xtables-compat -L and xtables-compat-save commands. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Add an interval option for xtables lock waitSubash Abhinov Kasiviswanathan2016-07-031-1/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ip[6]tables currently waits for 1 second for the xtables lock to be freed if the -w option is used. We have seen that the lock is held much less than that resulting in unnecessary delay when trying to acquire the lock. This problem is even severe in case of latency sensitive applications. Introduce a new option 'W' to specify the wait interval in microseconds. If this option is not specified, the command sleeps for 1 second by default. v1->v2: Change behavior to take millisecond sleep as an argument to -w as suggested by Pablo. Also maintain current behavior for -w to sleep for 1 second as mentioned by Liping. v2->v3: Move the millisecond behavior to a new option as suggested by Pablo. v3->v4: Use select instead of usleep. Sleep every iteration for the time specified in the "-W" argument. Update man page. v4->v5: Fix compilation error when enabling nftables v5->v6: Simplify -W so it only takes the interval wait in microseconds. Bail out if -W is specific but -w is not. Joint work with Pablo Neira. Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: xtables: add generic parsing infrastructure to interpret commandsPablo Neira Ayuso2016-02-161-212/+235
| | | | | | | Split the code to parse arguments and to issue command so we reuse this for the iptables to nft translation infrastructure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: add optional [seconds] argument to -wJiri Popelka2014-07-251-1/+12
| | | | | | | | | | | | | | | | | | | | | | This patch adds an optional numeric argument to -w option (added with 93587a0) so one can specify how long to wait for an exclusive lock. If the value isn't specified it works as before, i.e. program waits indefinitely. If user specifies it, program exits after the given time interval passes. This patch also adds the -w/--wait to nftables compat code, so the parser doesn't complain. [ In the original patch, iptables-compat -w X was not working, I have fixed by adding the dummy code not to break scripts using the new optional argument --pablo ] Signed-off-by: Jiri Popelka <jpopelka@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-compat: fix wrong protocol context in initializationPablo Neira Ayuso2014-02-111-3/+2
| | | | | | | | | | | | This fixes matches/targets that are dependent on that IPv4/Ipv6 context, eg. # ip6tables-compat -I INPUT -j REJECT --reject-with icmp6-addr-unreachable # ip6tables-compat-save ... -A INPUT -j REJECT --reject-with icmp6-port-unreachable Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Add backward compatibility with -w optionTomasz Bursztyka2014-02-111-1/+10
| | | | | | | Just to keep aligned with iptables legacy tool. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: fix missing ipt_entry for MASQUERADE targetPablo Neira Ayuso2013-12-301-4/+15
| | | | | | | | | | | | | | | | | The MASQUERADE target relies on the ipt_entry information that is set in ->post_parse, which is too late. Add a new hook called ->pre_parse, that sets the protocol information accordingly. Thus: xtables -4 -A POSTROUTING -t nat -p tcp \ -j MASQUERADE --to-ports 1024 works again. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: allow to reset the counters of an existing ruleTomasz Bursztyka2013-12-301-8/+7
| | | | | | | | | Now that we convert nft rules to native xt command structure, it's easier to reset the counters by replacing the existing rule by a new one with all counters set to zero. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: use xtables_rule_matches_freePablo Neira Ayuso2013-12-301-22/+1
| | | | | | | Thus, we can kill clear_rule_matches. Not required since we are based upon 1.4.19.1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix family operation lookupGiuseppe Longo2013-12-301-1/+1
| | | | | | | | xtables-restore -6 was using the IPv4 family, instead of IPv6 as it should be. Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: fix typo in add_entry for the IPv6 casePablo Neira Ayuso2013-12-301-1/+1
| | | | | | It should pass zero, instead of the 'append' boolean. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: remove bogus comment regarding rule replacementPablo Neira Ayuso2013-12-301-1/+0
| | | | | | We support rule replacement since quite some time, remove it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add -I chain rulenumPablo Neira Ayuso2013-12-301-8/+21
| | | | | | | | | | | | This patch adds the nft_rule_insert function, which allows us to insert rules at a given position. The function nft_rule_add has been renamed to nft_rule_append. This is possible thanks to Eric Leblond's (netfilter: nf_tables: add insert operation) kernel patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: nft: display rule number via -SPablo Neira Ayuso2013-12-301-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: nft: display rule by number via -LGiuseppe Longo2013-12-301-1/+0
| | | | | | | | | | This patch fixes the display of rule by number. [ Mangled this patch not to display the header, to mimic iptables --pablo ] Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: fix missing afinfo configurationPablo Neira Ayuso2013-12-301-0/+1
| | | | | | | I noticed that the iprange match in IPv6 was broken, fix it by overriding the default family (IPv4) if -6 is passed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: remove bogus comment on chain renamePablo Neira Ayuso2013-12-301-1/+0
| | | | | | | No longer true since Patrick added the chain rename approach back in September 2012. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: allow to zero chains via -ZGiuseppe Longo2013-12-301-20/+9
| | | | | Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: remove unused leftover definitionsPablo Neira Ayuso2013-12-301-16/+0
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add new nft_ops->post_parse hookPablo Neira Ayuso2013-12-301-129/+2
| | | | | | | Move specific layer 3 protocol post argument parsing code to the respective nft-ipv[4|6].c files. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add new container xtables_args structurePablo Neira Ayuso2013-12-301-136/+117
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: fix missing xtables_exit_error definitionPablo Neira Ayuso2013-12-301-2/+22
| | | | | | | iptables_exit_error is defined in iptables/iptables.c, that symbol cannot be used by iptables/xtables.c Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: add -4 and -6 supportPablo Neira Ayuso2013-12-301-1/+4
| | | | | | | | | | Now you can specify: xtables-restore -6 < my-ip6tables-ruleset to restore the IPv6 rule-set. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Split nft core to become family independantTomasz Bursztyka2013-12-301-15/+4
| | | | | | | | | | | | This makes nft core code independant from the family. Each family needs to implement and provide a struct nft_family_ops {}. This split will ease the future support of bridge and arp rules manipulations. [ updated header files and rebased upon the current tree --pablo ] Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: ipv6: fix wrong error if -p is usedPablo Neira Ayuso2013-12-301-4/+0
| | | | | | | | shell$ xtables -6 -I INPUT -p tcp --dport 22 -j ACCEPT xtables v1.4.15: -f is not valid on IPv6 Try `xtables -h' or 'xtables --help' for more information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add IPv6 supportTomasz Bursztyka2013-12-301-117/+283
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary of changes to add IPv6 support to the xtables utility: * modify all commands (add, delete, replace, check and listing) to support IPv6 addresses. And for the internal nft library: * add family to struct nft_handle and modify all caller to use this family instead of the hardcoded AF_INET. * move code that we can re-use for IPv4 and IPv6 into helper functions. * add IPv6 rule printing support. * add support to parse IPv6 address. Pablo added several improvements to this patch: * added basic xtables-save and xtables-restore support (so it defaults to IPv4) * fixed a couple of bugs found while testing * added reference when -f is used to point to -m frag (until we can make this consistent with IPv4). Note that we use one single xtables binary utility for IPv4 and IPv6. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: fix crash due to using wrong globalsPablo Neira Ayuso2013-12-301-5/+5
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: Add support for -R optionTomasz Bursztyka2013-12-301-1/+2
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* use nf_tables and nf_tables compatibility interfacePablo Neira Ayuso2013-12-301-0/+1251
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the following utilities: * xtables * xtables-restore * xtables-save * xtables-config They all use Patrick's nf_tables infrastructure plus my compatibility layer. xtables, xtables-restore and xtables-save are syntax compatible with ip[6]tables, ip[6]tables-restore and ip[6]tables-save. Semantics aims to be similar, still the main exception is that there is no commit operation. Thus, we incrementally add/delete rules without entire table locking. The following options are also not yet implemented: -Z (this requires adding expr->ops->reset(...) so nft_counters can reset internal state of expressions while dumping it) -R and -E (this requires adding this feature to nf_tables) -f (can be implemented with expressions: payload 6 (2-bytes) + bitwise a&b^!b + cmp neq 0) -IPv6 support. But those are a matter of time to get them done. A new utility, xtables-config, is available to register tables and chains. By default there is a configuration file that adds backward compatible tables and chains under iptables/etc/xtables.conf. You have to call this utility first to register tables and chains. However, it would be possible to automagically register tables and chains while using xtables and xtables-restore to get similar operation than with iptables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: restore build order of modulesJan Engelhardt2011-09-191-1832/+0
| | | | | | | | iptables(exe) requires libext.a, but extensions/ require libxtables.la (in iptables/). This circular dependency does not work out, so separate libxtables into its own directory and put it in front. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: move kernel version find routing into libxtablesJan Engelhardt2011-09-031-0/+18
| | | | | | | | That way, the remaining unreferenced symbols that do appear in libipt_DNAT and libipt_SNAT as part of the new check can be resolved, and the ugly -rdynamic hack can finally be removed. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* xtoptions: simplify xtables_parse_interfaceRichard Weinberger2011-08-271-3/+1
| | | | | | | mask is already filled with zeros, there is no need to zero it again. References: http://marc.info/?l=netfilter-devel&m=131445196526269&w=2 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: workaround broken linux-headers on RHEL-5Jan Engelhardt2011-08-011-0/+2
| | | | | | | maigc.h was not invented yet, but they do not ship proc_fs.h either, duh. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: set clone's initial data to NULLJan Engelhardt2011-07-101-0/+1
| | | | | | | Avoid a crash in xs_init_match when a clone's m->udata points at the parent. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* option: remove last traces of intrapositional negationJan Engelhardt2011-07-101-29/+0
| | | | | | Intrapositional negation was deprecated in 1.4.3. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: ignore whitespace in the multiaddress argument parserJan Engelhardt2011-07-091-0/+4
| | | | | References: http://bugzilla.netfilter.org/show_bug.cgi?id=727 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: properly reject empty hostnamesJan Engelhardt2011-07-091-26/+20
| | | | | | | | | An empty hostname in the address list of an -s/-d argument, which may be the result of a typo, is interpreted as 0/0, which, when combined with -j ACCEPT, leads to an undesired opening of the firewall. References: http://bugzilla.netfilter.org/show_bug.cgi?id=727 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: attempt to fix building under Linux 2.4Jan Engelhardt2011-06-241-1/+6
| | | | | | | | | | | | | | | | iptables no longer compiles for Linux 2.4 because it uses linux/magic.h. This header and the PROC_SUPER_MAGIC macro are only for Linux 2.6. xtables.c:35:52: error: linux/magic.h: No such file or directory xtables.c: In function 'proc_file_exists': xtables.c:389: error: 'PROC_SUPER_MAGIC' undeclared (first use in this function) xtables.c:389: error: (Each undeclared identifier is reported only once for each function it appears in.) References: http://bugzilla.netfilter.org/show_bug.cgi?id=720 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: Coverity: RESOURCE_LEAKJiri Popelka2011-06-221-0/+1
| | | | | | | | | | | | | | | xtables.c:320: alloc_fn: Calling allocation function "get_modprobe". xtables.c:294: alloc_fn: Storage is returned from allocation function "malloc". xtables.c:294: var_assign: Assigning: "ret" = "malloc(1024UL)". xtables.c:304: return_alloc: Returning allocated memory "ret". xtables.c:320: var_assign: Assigning: "buf" = storage returned from "get_modprobe()". xtables.c:323: var_assign: Assigning: "modprobe" = "buf". xtables.c:348: leaked_storage: Variable "buf" going out of scope leaks the storage it points to. xtables.c:348: leaked_storage: Returning without freeing "modprobe" leaks the storage that it points to. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: Coverity: VARARGSJiri Popelka2011-06-221-3/+9
| | | | | | | | | xtables.c:931: va_init: Initializing va_list "args". xtables.c:938: missing_va_end: va_end was not called for "args". xtables.c:947: missing_va_end: va_end was not called for "args". xtables.c:961: missing_va_end: va_end was not called for "args". Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: move all iptables pieces into a separate directoryJan Engelhardt2011-06-071-0/+1832
(Unclutter top-level dir) Signed-off-by: Jan Engelhardt <jengelh@medozas.de>