Hello community,
here is the log from the commit of package arptables
checked in at Tue Sep 16 16:39:56 CEST 2008.
--------
New Changes file:
--- /dev/null 2008-04-22 03:09:48.000000000 +0200
+++ /mounts/work_src_done/STABLE/arptables/arptables.changes 2008-09-05 16:23:48.000000000 +0200
@@ -0,0 +1,5 @@
+-------------------------------------------------------------------
+Fri Sep 5 16:23:41 CEST 2008 - mt@suse.de
+
+- Initial arptables_jf-0.0.8 package (fate#303394).
+
New:
----
arptables.changes
arptables_jf-0.0.8-2.6-kernel.patch
arptables_jf-0.0.8-header.patch
arptables_jf-0.0.8-man.patch
arptables_jf-0.0.8-no-script.patch
arptables_jf-0.0.8.tbz
arptables_jf-0.0.8-warnings.patch
arptables.spec
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ arptables.spec ++++++
#
# spec file for package arptables (Version 0.0.8)
#
# Copyright (c) 2008 SUSE LINUX Products GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/
#
# norootforbuild
Url: http://ebtables.sourceforge.net/
Name: arptables
Version: 0.0.8
Release: 2
License: GPL v2 or later
Group: Productivity/Networking/Security
Summary: User Space Tool to Set Up and Maintain ARP Filtering Tables
PreReq: %insserv_prereq %fillup_prereq
AutoReqProv: on
Source0: %{name}_jf-%{version}.tbz
Patch1: %{name}_jf-%{version}-2.6-kernel.patch
Patch2: %{name}_jf-%{version}-man.patch
Patch3: %{name}_jf-%{version}-warnings.patch
Patch4: %{name}_jf-%{version}-header.patch
Patch5: %{name}_jf-%{version}-no-script.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRequires: perl
%description
arptables is a user space tool used to set up and maintain thetables of
ARP rules in the Linux kernel. These rules inspect the ARPframes.
arptables is similar to the iptables userspace tool, but less
complicated.
Authors:
--------
Jay Fenlason
and others
%prep
%setup -q -n %{name}_jf-%{version}
%patch1 -p1
%patch2 -p1
%patch3 -p1
%patch4 -p1
%patch5 -p0
%build
export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -W -Wall"
export CFLAGS="$RPM_OPT_FLAGS"
make all LIBDIR=/%{_lib}
%install
make install DESTDIR=%{buildroot} LIBDIR=/%{_lib}
%clean
if [ -n "$RPM_BUILD_ROOT" ] && [ "$RPM_BUILD_ROOT" != "/" ] ; then
rm -rf "$RPM_BUILD_ROOT"
fi
%files
%defattr(-,root,root)
/sbin/arptables*
%{_mandir}/*/arptables*
%changelog
* Fri Sep 05 2008 mt@suse.de
- Initial arptables_jf-0.0.8 package (fate#303394).
++++++ arptables_jf-0.0.8-2.6-kernel.patch ++++++
diff -N -u arptables_jf-0.0.8/arp_tables.h arptables_jf-0.0.8-new/arp_tables.h
--- arptables_jf-0.0.8/arp_tables.h 1969-12-31 19:00:00.000000000 -0500
+++ arptables_jf-0.0.8-new/arp_tables.h 2004-08-31 14:33:14.000000000 -0400
@@ -0,0 +1,342 @@
+/*
+ * Format of an ARP firewall descriptor
+ *
+ * src, tgt, src_mask, tgt_mask, arpop, arpop_mask are always stored in
+ * network byte order.
+ * flags are stored in host byte order (of course).
+ */
+
+#ifndef _ARPTABLES_H
+#define _ARPTABLES_H
+
+#ifdef __KERNEL__
+#include
+#include
+#include
+#include
+#include
+#endif
+#include
+#include "netfilter_arp.h"
+
+#define ARPT_FUNCTION_MAXNAMELEN 30
+#define ARPT_TABLE_MAXNAMELEN 32
+
+#define ARPT_DEV_ADDR_LEN_MAX 16
+
+struct arpt_devaddr_info {
+ char addr[ARPT_DEV_ADDR_LEN_MAX];
+ char mask[ARPT_DEV_ADDR_LEN_MAX];
+};
+
+/* Yes, Virginia, you have to zero the padding. */
+struct arpt_arp {
+ /* Source and target IP addr */
+ struct in_addr src, tgt;
+ /* Mask for src and target IP addr */
+ struct in_addr smsk, tmsk;
+
+ /* Device hw address length, src+target device addresses */
+ u_int8_t arhln, arhln_mask;
+ struct arpt_devaddr_info src_devaddr;
+ struct arpt_devaddr_info tgt_devaddr;
+
+ /* ARP operation code. */
+ u_int16_t arpop, arpop_mask;
+
+ /* ARP hardware address and protocol address format. */
+ u_int16_t arhrd, arhrd_mask;
+ u_int16_t arpro, arpro_mask;
+
+ /* The protocol address length is only accepted if it is 4
+ * so there is no use in offering a way to do filtering on it.
+ */
+
+ char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
+ unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
+
+ /* Flags word */
+ u_int8_t flags;
+ /* Inverse flags */
+ u_int16_t invflags;
+};
+
+struct arpt_entry_target
+{
+ union {
+ struct {
+ u_int16_t target_size;
+
+ /* Used by userspace */
+ char name[ARPT_FUNCTION_MAXNAMELEN];
+ } user;
+ struct {
+ u_int16_t target_size;
+
+ /* Used inside the kernel */
+ struct arpt_target *target;
+ } kernel;
+
+ /* Total length */
+ u_int16_t target_size;
+ } u;
+
+ unsigned char data[0];
+};
+
+struct arpt_standard_target
+{
+ struct arpt_entry_target target;
+ int verdict;
+};
+
+struct arpt_counters
+{
+ u_int64_t pcnt, bcnt; /* Packet and byte counters */
+};
+
+/* Values for "flag" field in struct arpt_ip (general arp structure).
+ * No flags defined yet.
+ */
+#define ARPT_F_MASK 0x00 /* All possible flag bits mask. */
+
+/* Values for "inv" field in struct arpt_arp. */
+#define ARPT_INV_VIA_IN 0x0001 /* Invert the sense of IN IFACE. */
+#define ARPT_INV_VIA_OUT 0x0002 /* Invert the sense of OUT IFACE */
+#define ARPT_INV_SRCIP 0x0004 /* Invert the sense of SRC IP. */
+#define ARPT_INV_TGTIP 0x0008 /* Invert the sense of TGT IP. */
+#define ARPT_INV_SRCDEVADDR 0x0010 /* Invert the sense of SRC DEV ADDR. */
+#define ARPT_INV_TGTDEVADDR 0x0020 /* Invert the sense of TGT DEV ADDR. */
+#define ARPT_INV_ARPOP 0x0040 /* Invert the sense of ARP OP. */
+#define ARPT_INV_ARPHRD 0x0080 /* Invert the sense of ARP HRD. */
+#define ARPT_INV_ARPPRO 0x0100 /* Invert the sense of ARP PRO. */
+#define ARPT_INV_ARPHLN 0x0200 /* Invert the sense of ARP HLN. */
+#define ARPT_INV_MASK 0x03FF /* All possible flag bits mask. */
+
+/* This structure defines each of the firewall rules. Consists of 3
+ parts which are 1) general ARP header stuff 2) match specific
+ stuff 3) the target to perform if the rule matches */
+struct arpt_entry
+{
+ struct arpt_arp arp;
+
+ /* Size of arpt_entry + matches */
+ u_int16_t target_offset;
+ /* Size of arpt_entry + matches + target */
+ u_int16_t next_offset;
+
+ /* Back pointer */
+ unsigned int comefrom;
+
+ /* Packet and byte counters. */
+ struct arpt_counters counters;
+
+ /* The matches (if any), then the target. */
+ unsigned char elems[0];
+};
+
+/*
+ * New IP firewall options for [gs]etsockopt at the RAW IP level.
+ * Unlike BSD Linux inherits IP options so you don't have to use a raw
+ * socket for this. Instead we check rights in the calls.
+ */
+#define ARPT_BASE_CTL 96 /* base for firewall socket options */
+
+#define ARPT_SO_SET_REPLACE (ARPT_BASE_CTL)
+#define ARPT_SO_SET_ADD_COUNTERS (ARPT_BASE_CTL + 1)
+#define ARPT_SO_SET_MAX ARPT_SO_SET_ADD_COUNTERS
+
+#define ARPT_SO_GET_INFO (ARPT_BASE_CTL)
+#define ARPT_SO_GET_ENTRIES (ARPT_BASE_CTL + 1)
+#define ARPT_SO_GET_MAX ARPT_SO_GET_ENTRIES
+
+/* CONTINUE verdict for targets */
+#define ARPT_CONTINUE 0xFFFFFFFF
+
+/* For standard target */
+#define ARPT_RETURN (-NF_MAX_VERDICT - 1)
+
+/* The argument to ARPT_SO_GET_INFO */
+struct arpt_getinfo
+{
+ /* Which table: caller fills this in. */
+ char name[ARPT_TABLE_MAXNAMELEN];
+
+ /* Kernel fills these in. */
+ /* Which hook entry points are valid: bitmask */
+ unsigned int valid_hooks;
+
+ /* Hook entry points: one per netfilter hook. */
+ unsigned int hook_entry[NF_ARP_NUMHOOKS];
+
+ /* Underflow points. */
+ unsigned int underflow[NF_ARP_NUMHOOKS];
+
+ /* Number of entries */
+ unsigned int num_entries;
+
+ /* Size of entries. */
+ unsigned int size;
+};
+
+/* The argument to ARPT_SO_SET_REPLACE. */
+struct arpt_replace
+{
+ /* Which table. */
+ char name[ARPT_TABLE_MAXNAMELEN];
+
+ /* Which hook entry points are valid: bitmask. You can't
+ change this. */
+ unsigned int valid_hooks;
+
+ /* Number of entries */
+ unsigned int num_entries;
+
+ /* Total size of new entries */
+ unsigned int size;
+
+ /* Hook entry points. */
+ unsigned int hook_entry[NF_ARP_NUMHOOKS];
+
+ /* Underflow points. */
+ unsigned int underflow[NF_ARP_NUMHOOKS];
+
+ /* Information about old entries: */
+ /* Number of counters (must be equal to current number of entries). */
+ unsigned int num_counters;
+ /* The old entries' counters. */
+ struct arpt_counters __user *counters;
+
+ /* The entries (hang off end: not really an array). */
+ struct arpt_entry entries[0];
+};
+
+/* The argument to ARPT_SO_ADD_COUNTERS. */
+struct arpt_counters_info
+{
+ /* Which table. */
+ char name[ARPT_TABLE_MAXNAMELEN];
+
+ unsigned int num_counters;
+
+ /* The counters (actually `number' of these). */
+ struct arpt_counters counters[0];
+};
+
+/* The argument to ARPT_SO_GET_ENTRIES. */
+struct arpt_get_entries
+{
+ /* Which table: user fills this in. */
+ char name[ARPT_TABLE_MAXNAMELEN];
+
+ /* User fills this in: total entry size. */
+ unsigned int size;
+
+ /* The entries. */
+ struct arpt_entry entrytable[0];
+};
+
+/* Standard return verdict, or do jump. */
+#define ARPT_STANDARD_TARGET ""
+/* Error verdict. */
+#define ARPT_ERROR_TARGET "ERROR"
+
+/* Helper functions */
+static __inline__ struct arpt_entry_target *arpt_get_target(struct arpt_entry *e)
+{
+ return (void *)e + e->target_offset;
+}
+
+/* fn returns 0 to continue iteration */
+#define ARPT_ENTRY_ITERATE(entries, size, fn, args...) \
+({ \
+ unsigned int __i; \
+ int __ret = 0; \
+ struct arpt_entry *__entry; \
+ \
+ for (__i = 0; __i < (size); __i += __entry->next_offset) { \
+ __entry = (void *)(entries) + __i; \
+ \
+ __ret = fn(__entry , ## args); \
+ if (__ret != 0) \
+ break; \
+ } \
+ __ret; \
+})
+
+/*
+ * Main firewall chains definitions and global var's definitions.
+ */
+#ifdef __KERNEL__
+
+/* Registration hooks for targets. */
+struct arpt_target
+{
+ struct list_head list;
+
+ const char name[ARPT_FUNCTION_MAXNAMELEN];
+
+ /* Returns verdict. */
+ unsigned int (*target)(struct sk_buff **pskb,
+ unsigned int hooknum,
+ const struct net_device *in,
+ const struct net_device *out,
+ const void *targinfo,
+ void *userdata);
+
+ /* Called when user tries to insert an entry of this type:
+ hook_mask is a bitmask of hooks from which it can be
+ called. */
+ /* Should return true or false. */
+ int (*checkentry)(const char *tablename,
+ const struct arpt_entry *e,
+ void *targinfo,
+ unsigned int targinfosize,
+ unsigned int hook_mask);
+
+ /* Called when entry of this type deleted. */
+ void (*destroy)(void *targinfo, unsigned int targinfosize);
+
+ /* Set this to THIS_MODULE if you are a module, otherwise NULL */
+ struct module *me;
+};
+
+extern int arpt_register_target(struct arpt_target *target);
+extern void arpt_unregister_target(struct arpt_target *target);
+
+/* Furniture shopping... */
+struct arpt_table
+{
+ struct list_head list;
+
+ /* A unique name... */
+ char name[ARPT_TABLE_MAXNAMELEN];
+
+ /* Seed table: copied in register_table */
+ struct arpt_replace *table;
+
+ /* What hooks you will enter on */
+ unsigned int valid_hooks;
+
+ /* Lock for the curtain */
+ rwlock_t lock;
+
+ /* Man behind the curtain... */
+ struct arpt_table_info *private;
+
+ /* Set this to THIS_MODULE if you are a module, otherwise NULL */
+ struct module *me;
+};
+
+extern int arpt_register_table(struct arpt_table *table);
+extern void arpt_unregister_table(struct arpt_table *table);
+extern unsigned int arpt_do_table(struct sk_buff **pskb,
+ unsigned int hook,
+ const struct net_device *in,
+ const struct net_device *out,
+ struct arpt_table *table,
+ void *userdata);
+
+#define ARPT_ALIGN(s) (((s) + (__alignof__(struct arpt_entry)-1)) & ~(__alignof__(struct arpt_entry)-1))
+#endif /*__KERNEL__*/
+#endif /* _ARPTABLES_H */
diff -N -u arptables_jf-0.0.8/arpt_mangle.h arptables_jf-0.0.8-new/arpt_mangle.h
--- arptables_jf-0.0.8/arpt_mangle.h 2004-01-23 13:52:36.000000000 -0500
+++ arptables_jf-0.0.8-new/arpt_mangle.h 2004-08-31 14:33:14.000000000 -0400
@@ -1,6 +1,6 @@
#ifndef _ARPT_MANGLE_H
#define _ARPT_MANGLE_H
-#include
+#include "arp_tables.h"
#define ARPT_MANGLE_ADDR_LEN_MAX sizeof(struct in_addr)
struct arpt_mangle
diff -N -u arptables_jf-0.0.8/common.h arptables_jf-0.0.8-new/common.h
--- arptables_jf-0.0.8/common.h 2003-07-07 14:36:45.000000000 -0400
+++ arptables_jf-0.0.8-new/common.h 2004-08-31 14:37:36.000000000 -0400
@@ -10,6 +10,7 @@
#endif
#include
-#include
+#define __user
+#include "arp_tables.h"
#endif
diff -N -u arptables_jf-0.0.8/debugfiles.list arptables_jf-0.0.8-new/debugfiles.list
--- arptables_jf-0.0.8/debugfiles.list 1969-12-31 19:00:00.000000000 -0500
+++ arptables_jf-0.0.8-new/debugfiles.list 2004-08-31 11:47:42.000000000 -0400
@@ -0,0 +1,4 @@
+/usr/lib/debug/sbin/arptables-save.debug
+/usr/lib/debug/sbin/arptables.debug
+/usr/lib/debug/sbin/arptables-restore.debug
+/usr/src/debug/arptables_jf-0.0.8
Binary files arptables_jf-0.0.8/debugsources.list and arptables_jf-0.0.8-new/debugsources.list differ
diff -N -u arptables_jf-0.0.8/libarptc.c arptables_jf-0.0.8-new/libarptc.c
--- arptables_jf-0.0.8/libarptc.c 2003-07-07 14:37:40.000000000 -0400
+++ arptables_jf-0.0.8-new/libarptc.c 2004-08-31 14:46:19.000000000 -0400
@@ -193,6 +193,7 @@
#define HOOK_IN NF_ARP_IN
#define HOOK_OUT NF_ARP_OUT
+#define HOOK_FORWARD NF_ARP_FORWARD
#define STRUCT_ENTRY_TARGET struct arpt_entry_target
#define STRUCT_ENTRY struct arpt_entry
@@ -299,6 +300,7 @@
static const char *hooknames[]
= { [HOOK_IN] "IN",
[HOOK_OUT] "OUT",
+ [HOOK_FORWARD] "FORWARD",
};
struct counter_map
diff -N -u arptables_jf-0.0.8/libarptc.h arptables_jf-0.0.8-new/libarptc.h
--- arptables_jf-0.0.8/libarptc.h 2003-07-07 14:36:45.000000000 -0400
+++ arptables_jf-0.0.8-new/libarptc.h 2004-08-31 14:41:50.000000000 -0400
@@ -17,7 +17,7 @@
#define ARPT_ALIGN(s) (((s) + ((ARPT_MIN_ALIGN)-1)) & ~((ARPT_MIN_ALIGN)-1))
-typedef char arpt_chainlabel[32];
+typedef char arpt_chainlabel[ARPT_TABLE_MAXNAMELEN];
#define ARPTC_LABEL_ACCEPT "ACCEPT"
#define ARPTC_LABEL_DROP "DROP"
diff -N -u arptables_jf-0.0.8/netfilter_arp.h arptables_jf-0.0.8-new/netfilter_arp.h
--- arptables_jf-0.0.8/netfilter_arp.h 1969-12-31 19:00:00.000000000 -0500
+++ arptables_jf-0.0.8-new/netfilter_arp.h 2004-08-31 14:31:26.000000000 -0400
@@ -0,0 +1,20 @@
+#ifndef __LINUX_ARP_NETFILTER_H
+#define __LINUX_ARP_NETFILTER_H
+
+/* ARP-specific defines for netfilter.
+ * (C)2002 Rusty Russell IBM -- This code is GPL.
+ */
+
+#include
+#include
+
+/* There is no PF_ARP. */
+#define NF_ARP 0
+
+/* ARP Hooks */
+#define NF_ARP_IN 0
+#define NF_ARP_OUT 1
+#define NF_ARP_FORWARD 2
+#define NF_ARP_NUMHOOKS 3
+
+#endif /* __LINUX_ARP_NETFILTER_H */
++++++ arptables_jf-0.0.8-header.patch ++++++
--- arptables_jf-0.0.8/arp_tables.h.jk 2006-07-13 13:42:11.000000000 -0400
+++ arptables_jf-0.0.8/arp_tables.h 2006-07-13 13:42:25.000000000 -0400
@@ -16,7 +16,6 @@
#include
#include
#endif
-#include
#include "netfilter_arp.h"
#define ARPT_FUNCTION_MAXNAMELEN 30
++++++ arptables_jf-0.0.8-man.patch ++++++
--- arptables_jf-0.0.8/arptables.8.man 2005-06-09 11:18:29.000000000 -0400
+++ arptables_jf-0.0.8/arptables.8 2005-06-09 11:18:33.000000000 -0400
@@ -97,9 +97,9 @@
.B "filter"
This is the default table (if no -t option is passed). It contains
the built-in chains
-.B INPUT
+.B IN
(for ARP packets entering the box),
-.B OUTPUT
+.B OUT
(for locally-generated ARP packets).
.TP
.SH OPTIONS
@@ -255,7 +255,7 @@
.BR "-i, --in-interface " "[!] \fIname\fP"
Name of an interface via which a packet is going to be received (only for
packets entering the
-.B INPUT
+.B IN
chain). When the "!" argument is used before the interface name, the
sense is inverted. If the interface name ends in a "+", then any
interface which begins with this name will match. If this option is
@@ -264,7 +264,7 @@
.BR "-o, --out-interface " "[!] \fIname\fP"
Name of an interface via which a packet is going to be sent (for packets
entering the
-.B OUTPUT
+.B OUT
chain). When the "!" argument is used before the interface name, the
sense is inverted. If the interface name ends in a "+", then any
interface which begins with this name will match. If this option is
++++++ arptables_jf-0.0.8-no-script.patch ++++++
--- Makefile
+++ Makefile 2008/09/05 14:03:11
@@ -31,7 +31,7 @@ install: $(DESTDIR)$(BINDIR)/arptables-r
install: $(DESTDIR)$(MANDIR)/man8/arptables.8
install: $(DESTDIR)$(MANDIR)/man8/arptables-save.8
install: $(DESTDIR)$(MANDIR)/man8/arptables-restore.8
-install: $(DESTDIR)$(RCDIR)/arptables_jf
+#install: $(DESTDIR)$(RCDIR)/arptables_jf
#install: $(DESTDIR)$(ARPT_LIBDIR)/libarpt_standard.so
#install: $(DESTDIR)$(ARPT_LIBDIR)/libarpt_mangle.so
++++++ arptables_jf-0.0.8-warnings.patch ++++++
diff -r -u arptables_jf-0.0.8/arptables.c arptables_jf-0.0.8.new/arptables.c
--- arptables_jf-0.0.8/arptables.c 2004-01-23 15:22:27.000000000 -0500
+++ arptables_jf-0.0.8.new/arptables.c 2006-05-16 11:54:05.000000000 -0400
@@ -505,7 +505,7 @@
}
static void
-add_command(int *cmd, const int newcmd, const int othercmds, int invert)
+add_command(unsigned int *cmd, const int newcmd, const int othercmds, int invert)
{
if (invert)
exit_error(PARAMETER_PROBLEM, "unexpected ! flag");
diff -r -u arptables_jf-0.0.8/netfilter_arp.h arptables_jf-0.0.8.new/netfilter_arp.h
--- arptables_jf-0.0.8/netfilter_arp.h 2006-05-26 17:07:41.000000000 -0400
+++ arptables_jf-0.0.8.new/netfilter_arp.h 2006-05-26 17:17:00.000000000 -0400
@@ -5,7 +5,6 @@
* (C)2002 Rusty Russell IBM -- This code is GPL.
*/
-#include
#include
/* There is no PF_ARP. */
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Remember to have fun...
---------------------------------------------------------------------
To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-commit+help@opensuse.org