static int is_same(const STRUCT_ENTRY *a, const STRUCT_ENTRY *b, unsigned char *matchmask) { unsigned int i; STRUCT_ENTRY_TARGET *ta, *tb; unsigned char *mptr; /* Always compare head structures: ignore mask here. */ if (memcmp(&a->ipv6.src, &b->ipv6.src, sizeof(struct in6_addr)) || memcmp(&a->ipv6.dst, &b->ipv6.dst, sizeof(struct in6_addr)) || memcmp(&a->ipv6.smsk, &b->ipv6.smsk, sizeof(struct in6_addr)) || memcmp(&a->ipv6.dmsk, &b->ipv6.dmsk, sizeof(struct in6_addr)) || a->ipv6.proto != b->ipv6.proto || a->ipv6.tos != b->ipv6.tos || a->ipv6.flags != b->ipv6.flags || a->ipv6.invflags != b->ipv6.invflags) return 0; for (i = 0; i < IFNAMSIZ; i++) { if (a->ipv6.iniface_mask[i] != b->ipv6.iniface_mask[i]) return 0; if ((a->ipv6.iniface[i] & a->ipv6.iniface_mask[i]) != (b->ipv6.iniface[i] & b->ipv6.iniface_mask[i])) return 0; if (a->ipv6.outiface_mask[i] != b->ipv6.outiface_mask[i]) return 0; if ((a->ipv6.outiface[i] & a->ipv6.outiface_mask[i]) != (b->ipv6.outiface[i] & b->ipv6.outiface_mask[i])) return 0; } if (a->nfcache != b->nfcache || a->target_offset != b->target_offset || a->next_offset != b->next_offset) return 0; mptr = matchmask + sizeof(STRUCT_ENTRY); if (IP6T_MATCH_ITERATE(a, match_different, a->elems, b->elems, &mptr)) return 0; ta = GET_TARGET((STRUCT_ENTRY *)a); tb = GET_TARGET((STRUCT_ENTRY *)b); if (ta->u.target_size != tb->u.target_size) return 0; if (strcmp(ta->u.user.name, tb->u.user.name) != 0) return 0; mptr += sizeof(*ta); if (target_different(ta->data, tb->data, ta->u.target_size - sizeof(*ta), mptr)) return 0; return 1; }
static const char * get_errorlabel(TC_HANDLE_T h, unsigned int offset) { STRUCT_ENTRY *e; e = get_entry(h, offset); if (strcmp(GET_TARGET(e)->u.user.name, ERROR_TARGET) != 0) { fprintf(stderr, "ERROR: offset %u not an error node!\n", offset); abort(); } return (const char *)GET_TARGET(e)->data; }
int dump_entry(STRUCT_ENTRY *e, const TC_HANDLE_T handle) { size_t i; STRUCT_ENTRY_TARGET *t; printf("Entry %u (%lu):\n", entry2index(handle, e), entry2offset(handle, e)); printf("SRC IP: %u.%u.%u.%u/%u.%u.%u.%u\n", IP_PARTS(e->ip.src.s_addr),IP_PARTS(e->ip.smsk.s_addr)); printf("DST IP: %u.%u.%u.%u/%u.%u.%u.%u\n", IP_PARTS(e->ip.dst.s_addr),IP_PARTS(e->ip.dmsk.s_addr)); printf("Interface: `%s'/", e->ip.iniface); for (i = 0; i < IFNAMSIZ; i++) printf("%c", e->ip.iniface_mask[i] ? 'X' : '.'); printf("to `%s'/", e->ip.outiface); for (i = 0; i < IFNAMSIZ; i++) printf("%c", e->ip.outiface_mask[i] ? 'X' : '.'); printf("\nProtocol: %u\n", e->ip.proto); printf("Flags: %02X\n", e->ip.flags); printf("Invflags: %02X\n", e->ip.invflags); printf("Counters: %llu packets, %llu bytes\n", e->counters.pcnt, e->counters.bcnt); printf("Cache: %08X ", e->nfcache); if (e->nfcache & NFC_ALTERED) printf("ALTERED "); if (e->nfcache & NFC_UNKNOWN) printf("UNKNOWN "); if (e->nfcache & NFC_IP_SRC) printf("IP_SRC "); if (e->nfcache & NFC_IP_DST) printf("IP_DST "); if (e->nfcache & NFC_IP_IF_IN) printf("IP_IF_IN "); if (e->nfcache & NFC_IP_IF_OUT) printf("IP_IF_OUT "); if (e->nfcache & NFC_IP_TOS) printf("IP_TOS "); if (e->nfcache & NFC_IP_PROTO) printf("IP_PROTO "); if (e->nfcache & NFC_IP_OPTIONS) printf("IP_OPTIONS "); if (e->nfcache & NFC_IP_TCPFLAGS) printf("IP_TCPFLAGS "); if (e->nfcache & NFC_IP_SRC_PT) printf("IP_SRC_PT "); if (e->nfcache & NFC_IP_DST_PT) printf("IP_DST_PT "); if (e->nfcache & NFC_IP_PROTO_UNKNOWN) printf("IP_PROTO_UNKNOWN "); printf("\n"); IPT_MATCH_ITERATE(e, print_match); t = GET_TARGET(e); printf("Target name: `%s' [%u]\n", t->u.user.name, t->u.target_size); if (strcmp(t->u.user.name, STANDARD_TARGET) == 0) { int pos = *(int *)t->data; if (pos < 0) printf("verdict=%s\n", pos == -NF_ACCEPT-1 ? "NF_ACCEPT" : pos == -NF_DROP-1 ? "NF_DROP" : pos == -NF_QUEUE-1 ? "NF_QUEUE" : pos == RETURN ? "RETURN" : "UNKNOWN"); else printf("verdict=%u\n", pos); } else if (strcmp(t->u.user.name, IPT_ERROR_TARGET) == 0) printf("error=`%s'\n", t->data); printf("\n"); return 0; }
static int dump_entry(struct ipt_entry *e, struct iptc_handle *const handle) { size_t i; STRUCT_ENTRY_TARGET *t; printf("Entry %u (%lu):\n", iptcb_entry2index(handle, e), iptcb_entry2offset(handle, e)); printf("SRC IP: %u.%u.%u.%u/%u.%u.%u.%u\n", IP_PARTS(e->ip.src.s_addr),IP_PARTS(e->ip.smsk.s_addr)); printf("DST IP: %u.%u.%u.%u/%u.%u.%u.%u\n", IP_PARTS(e->ip.dst.s_addr),IP_PARTS(e->ip.dmsk.s_addr)); printf("Interface: `%s'/", e->ip.iniface); for (i = 0; i < IFNAMSIZ; i++) printf("%c", e->ip.iniface_mask[i] ? 'X' : '.'); printf("to `%s'/", e->ip.outiface); for (i = 0; i < IFNAMSIZ; i++) printf("%c", e->ip.outiface_mask[i] ? 'X' : '.'); printf("\nProtocol: %u\n", e->ip.proto); printf("Flags: %02X\n", e->ip.flags); printf("Invflags: %02X\n", e->ip.invflags); printf("Counters: %llu packets, %llu bytes\n", (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt); printf("Cache: %08X\n", e->nfcache); IPT_MATCH_ITERATE(e, print_match); t = GET_TARGET(e); printf("Target name: `%s' [%u]\n", t->u.user.name, t->u.target_size); if (strcmp(t->u.user.name, STANDARD_TARGET) == 0) { const unsigned char *data = t->data; int pos = *(const int *)data; if (pos < 0) printf("verdict=%s\n", pos == -NF_ACCEPT-1 ? "NF_ACCEPT" : pos == -NF_DROP-1 ? "NF_DROP" : pos == -NF_QUEUE-1 ? "NF_QUEUE" : pos == RETURN ? "RETURN" : "UNKNOWN"); else printf("verdict=%u\n", pos); } else if (strcmp(t->u.user.name, IPT_ERROR_TARGET) == 0) printf("error=`%s'\n", t->data); printf("\n"); return 0; }
int sp_check_event(int filter) { int port; int bit = (1 << GT_SHIFT) | (1 << LT_SHIFT); int changed = 0; int target = GET_TARGET(filter); int tolerance = GET_TOLERANCE(filter); for(port = 0; port < N_SENSORS; port++, bit <<= 1) if (filter & bit) { U16 val = sensor_adc(port); if ((filter & bit & GT_EVENTS) && (val > (target + tolerance))) changed |= (bit & GT_EVENTS); if ((filter & bit & LT_EVENTS) && (val < (target - tolerance))) changed |= (bit & LT_EVENTS); } return changed; }
/* Do every conceivable sanity check on the handle */ static void do_check(struct iptc_handle *h, unsigned int line) { unsigned int i, n; unsigned int user_offset; /* Offset of first user chain */ int was_return; assert(h->changed == 0 || h->changed == 1); if (strcmp(h->info.name, "filter") == 0) { assert(h->info.valid_hooks == (1 << NF_IP_LOCAL_IN | 1 << NF_IP_FORWARD | 1 << NF_IP_LOCAL_OUT)); /* Hooks should be first three */ assert(h->info.hook_entry[NF_IP_LOCAL_IN] == 0); n = get_chain_end(h, 0); n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_FORWARD] == n); n = get_chain_end(h, n); n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n); user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT]; } else if (strcmp(h->info.name, "nat") == 0) { assert((h->info.valid_hooks == (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_POST_ROUTING | 1 << NF_IP_LOCAL_OUT)) || (h->info.valid_hooks == (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_LOCAL_IN | 1 << NF_IP_POST_ROUTING | 1 << NF_IP_LOCAL_OUT))); assert(h->info.hook_entry[NF_IP_PRE_ROUTING] == 0); n = get_chain_end(h, 0); n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_POST_ROUTING] == n); n = get_chain_end(h, n); n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n); user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT]; if (h->info.valid_hooks & (1 << NF_IP_LOCAL_IN)) { n = get_chain_end(h, n); n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_LOCAL_IN] == n); user_offset = h->info.hook_entry[NF_IP_LOCAL_IN]; } } else if (strcmp(h->info.name, "mangle") == 0) { /* This code is getting ugly because linux < 2.4.18-pre6 had * two mangle hooks, linux >= 2.4.18-pre6 has five mangle hooks * */ assert((h->info.valid_hooks == (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_LOCAL_OUT)) || (h->info.valid_hooks == (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_LOCAL_IN | 1 << NF_IP_FORWARD | 1 << NF_IP_LOCAL_OUT | 1 << NF_IP_POST_ROUTING))); /* Hooks should be first five */ assert(h->info.hook_entry[NF_IP_PRE_ROUTING] == 0); n = get_chain_end(h, 0); if (h->info.valid_hooks & (1 << NF_IP_LOCAL_IN)) { n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_LOCAL_IN] == n); n = get_chain_end(h, n); } if (h->info.valid_hooks & (1 << NF_IP_FORWARD)) { n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_FORWARD] == n); n = get_chain_end(h, n); } n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n); user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT]; if (h->info.valid_hooks & (1 << NF_IP_POST_ROUTING)) { n = get_chain_end(h, n); n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_POST_ROUTING] == n); user_offset = h->info.hook_entry[NF_IP_POST_ROUTING]; } } else if (strcmp(h->info.name, "raw") == 0) { assert(h->info.valid_hooks == (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_LOCAL_OUT)); /* Hooks should be first three */ assert(h->info.hook_entry[NF_IP_PRE_ROUTING] == 0); n = get_chain_end(h, n); n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n); user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT]; #ifdef NF_IP_DROPPING } else if (strcmp(h->info.name, "drop") == 0) { assert(h->info.valid_hooks == (1 << NF_IP_DROPPING)); /* Hook should be first */ assert(h->info.hook_entry[NF_IP_DROPPING] == 0); user_offset = 0; #endif } else { fprintf(stderr, "Unknown table `%s'\n", h->info.name); abort(); } /* User chain == end of last builtin + policy entry */ user_offset = get_chain_end(h, user_offset); user_offset += get_entry(h, user_offset)->next_offset; /* Overflows should be end of entry chains, and unconditional policy nodes. */ for (i = 0; i < NUMHOOKS; i++) { STRUCT_ENTRY *e; STRUCT_STANDARD_TARGET *t; if (!(h->info.valid_hooks & (1 << i))) continue; assert(h->info.underflow[i] == get_chain_end(h, h->info.hook_entry[i])); e = get_entry(h, get_chain_end(h, h->info.hook_entry[i])); assert(unconditional(&e->ip)); assert(e->target_offset == sizeof(*e)); t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e); assert(t->target.u.target_size == ALIGN(sizeof(*t))); assert(e->next_offset == sizeof(*e) + ALIGN(sizeof(*t))); assert(strcmp(t->target.u.user.name, STANDARD_TARGET)==0); assert(t->verdict == -NF_DROP-1 || t->verdict == -NF_ACCEPT-1); /* Hooks and underflows must be valid entries */ entry2index(h, get_entry(h, h->info.hook_entry[i])); entry2index(h, get_entry(h, h->info.underflow[i])); } assert(h->info.size >= h->info.num_entries * (sizeof(STRUCT_ENTRY) +sizeof(STRUCT_STANDARD_TARGET))); assert(h->entries.size >= (h->new_number * (sizeof(STRUCT_ENTRY) + sizeof(STRUCT_STANDARD_TARGET)))); assert(strcmp(h->info.name, h->entries.name) == 0); i = 0; n = 0; was_return = 0; /* Check all the entries. */ ENTRY_ITERATE(h->entries.entrytable, h->entries.size, check_entry, &i, &n, user_offset, &was_return, h); assert(i == h->new_number); assert(n == h->entries.size); /* Final entry must be error node */ assert(strcmp(GET_TARGET(index2entry(h, h->new_number-1)) ->u.user.name, ERROR_TARGET) == 0); }
static inline int check_entry(const STRUCT_ENTRY *e, unsigned int *i, unsigned int *off, unsigned int user_offset, int *was_return, struct iptc_handle *h) { unsigned int toff; STRUCT_STANDARD_TARGET *t; assert(e->target_offset >= sizeof(STRUCT_ENTRY)); assert(e->next_offset >= e->target_offset + sizeof(STRUCT_ENTRY_TARGET)); toff = sizeof(STRUCT_ENTRY); IPT_MATCH_ITERATE(e, check_match, &toff); assert(toff == e->target_offset); t = (STRUCT_STANDARD_TARGET *) GET_TARGET((STRUCT_ENTRY *)e); /* next_offset will have to be multiple of entry alignment. */ assert(e->next_offset == ALIGN(e->next_offset)); assert(e->target_offset == ALIGN(e->target_offset)); assert(t->target.u.target_size == ALIGN(t->target.u.target_size)); assert(!TC_IS_CHAIN(t->target.u.user.name, h)); if (strcmp(t->target.u.user.name, STANDARD_TARGET) == 0) { assert(t->target.u.target_size == ALIGN(sizeof(STRUCT_STANDARD_TARGET))); assert(t->verdict == -NF_DROP-1 || t->verdict == -NF_ACCEPT-1 || t->verdict == RETURN || t->verdict < (int)h->entries->size); if (t->verdict >= 0) { STRUCT_ENTRY *te = get_entry(h, t->verdict); int idx; idx = iptcb_entry2index(h, te); assert(strcmp(GET_TARGET(te)->u.user.name, IPT_ERROR_TARGET) != 0); assert(te != e); /* Prior node must be error node, or this node. */ assert(t->verdict == iptcb_entry2offset(h, e)+e->next_offset || strcmp(GET_TARGET(index2entry(h, idx-1)) ->u.user.name, IPT_ERROR_TARGET) == 0); } if (t->verdict == RETURN && unconditional(&e->ip) && e->target_offset == sizeof(*e)) *was_return = 1; else *was_return = 0; } else if (strcmp(t->target.u.user.name, IPT_ERROR_TARGET) == 0) { assert(t->target.u.target_size == ALIGN(sizeof(struct ipt_error_target))); /* If this is in user area, previous must have been return */ if (*off > user_offset) assert(*was_return); *was_return = 0; } else *was_return = 0; if (*off == user_offset) assert(strcmp(t->target.u.user.name, IPT_ERROR_TARGET) == 0); (*off) += e->next_offset; (*i)++; return 0; }
static int is_same(const STRUCT_ENTRY *a, const STRUCT_ENTRY *b, unsigned char *matchmask) { unsigned int i; STRUCT_ENTRY_TARGET *ta, *tb; unsigned char *mptr; /* Always compare head structures: ignore mask here. */ if (a->arp.src.s_addr != b->arp.src.s_addr || a->arp.tgt.s_addr != b->arp.tgt.s_addr || a->arp.smsk.s_addr != b->arp.smsk.s_addr || a->arp.tmsk.s_addr != b->arp.tmsk.s_addr || a->arp.arhln != b->arp.arhln || a->arp.arhln_mask != b->arp.arhln_mask || a->arp.arpop != b->arp.arpop || a->arp.arpop_mask != b->arp.arpop_mask || a->arp.arhrd != b->arp.arhrd || a->arp.arhrd_mask != b->arp.arhrd_mask || a->arp.arpro != b->arp.arpro || a->arp.arpro_mask != b->arp.arpro_mask || a->arp.flags != b->arp.flags || a->arp.invflags != b->arp.invflags) return 0; for (i = 0; i < ARPT_DEV_ADDR_LEN_MAX; i++) { if (a->arp.src_devaddr.addr[i] != b->arp.src_devaddr.addr[i] || a->arp.src_devaddr.mask[i] != b->arp.src_devaddr.mask[i]) return 0; if (a->arp.tgt_devaddr.addr[i] != b->arp.tgt_devaddr.addr[i] || a->arp.tgt_devaddr.mask[i] != b->arp.tgt_devaddr.mask[i]) return 0; } for (i = 0; i < IFNAMSIZ; i++) { if (a->arp.iniface_mask[i] != b->arp.iniface_mask[i]) return 0; if ((a->arp.iniface[i] & a->arp.iniface_mask[i]) != (b->arp.iniface[i] & b->arp.iniface_mask[i])) return 0; if (a->arp.outiface_mask[i] != b->arp.outiface_mask[i]) return 0; if ((a->arp.outiface[i] & a->arp.outiface_mask[i]) != (b->arp.outiface[i] & b->arp.outiface_mask[i])) return 0; } if (/* a->nfcache != b->nfcache || */a->target_offset != b->target_offset || a->next_offset != b->next_offset) return 0; mptr = matchmask + sizeof(STRUCT_ENTRY); /* if (ARPT_MATCH_ITERATE(a, match_different, a->elems, b->elems, &mptr)) return 0; */ ta = GET_TARGET((STRUCT_ENTRY *)a); tb = GET_TARGET((STRUCT_ENTRY *)b); if (ta->u.target_size != tb->u.target_size) return 0; if (strcmp(ta->u.user.name, tb->u.user.name) != 0) return 0; mptr += sizeof(*ta); if (target_different(ta->data, tb->data, ta->u.target_size - sizeof(*ta), mptr)) return 0; return 1; }
static void do_check(struct iptc_handle *h, unsigned int line) { unsigned int i, n; unsigned int user_offset; int was_return; assert(h->changed == 0 || h->changed == 1); if (strcmp(h->info.name, "filter") == 0) { assert(h->info.valid_hooks == (1 << NF_IP_LOCAL_IN | 1 << NF_IP_FORWARD | 1 << NF_IP_LOCAL_OUT)); assert(h->info.hook_entry[NF_IP_LOCAL_IN] == 0); n = get_chain_end(h, 0); n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_FORWARD] == n); n = get_chain_end(h, n); n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n); user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT]; } else if (strcmp(h->info.name, "nat") == 0) { assert((h->info.valid_hooks == (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_POST_ROUTING | 1 << NF_IP_LOCAL_OUT)) || (h->info.valid_hooks == (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_LOCAL_IN | 1 << NF_IP_POST_ROUTING | 1 << NF_IP_LOCAL_OUT))); assert(h->info.hook_entry[NF_IP_PRE_ROUTING] == 0); n = get_chain_end(h, 0); n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_POST_ROUTING] == n); n = get_chain_end(h, n); n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n); user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT]; if (h->info.valid_hooks & (1 << NF_IP_LOCAL_IN)) { n = get_chain_end(h, n); n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_LOCAL_IN] == n); user_offset = h->info.hook_entry[NF_IP_LOCAL_IN]; } } else if (strcmp(h->info.name, "mangle") == 0) { assert((h->info.valid_hooks == (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_LOCAL_OUT)) || (h->info.valid_hooks == (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_LOCAL_IN | 1 << NF_IP_FORWARD | 1 << NF_IP_LOCAL_OUT | 1 << NF_IP_POST_ROUTING))); assert(h->info.hook_entry[NF_IP_PRE_ROUTING] == 0); n = get_chain_end(h, 0); if (h->info.valid_hooks & (1 << NF_IP_LOCAL_IN)) { n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_LOCAL_IN] == n); n = get_chain_end(h, n); } if (h->info.valid_hooks & (1 << NF_IP_FORWARD)) { n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_FORWARD] == n); n = get_chain_end(h, n); } n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n); user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT]; if (h->info.valid_hooks & (1 << NF_IP_POST_ROUTING)) { n = get_chain_end(h, n); n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_POST_ROUTING] == n); user_offset = h->info.hook_entry[NF_IP_POST_ROUTING]; } } else if (strcmp(h->info.name, "raw") == 0) { assert(h->info.valid_hooks == (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_LOCAL_OUT)); assert(h->info.hook_entry[NF_IP_PRE_ROUTING] == 0); n = get_chain_end(h, n); n += get_entry(h, n)->next_offset; assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n); user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT]; #ifdef NF_IP_DROPPING } else if (strcmp(h->info.name, "drop") == 0) { assert(h->info.valid_hooks == (1 << NF_IP_DROPPING)); assert(h->info.hook_entry[NF_IP_DROPPING] == 0); user_offset = 0; #endif } else { fprintf(stderr, "Unknown table `%s'\n", h->info.name); abort(); } user_offset = get_chain_end(h, user_offset); user_offset += get_entry(h, user_offset)->next_offset; for (i = 0; i < NUMHOOKS; i++) { STRUCT_ENTRY *e; STRUCT_STANDARD_TARGET *t; if (!(h->info.valid_hooks & (1 << i))) continue; assert(h->info.underflow[i] == get_chain_end(h, h->info.hook_entry[i])); e = get_entry(h, get_chain_end(h, h->info.hook_entry[i])); assert(unconditional(&e->ip)); assert(e->target_offset == sizeof(*e)); t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e); assert(t->target.u.target_size == ALIGN(sizeof(*t))); assert(e->next_offset == sizeof(*e) + ALIGN(sizeof(*t))); assert(strcmp(t->target.u.user.name, STANDARD_TARGET)==0); assert(t->verdict == -NF_DROP-1 || t->verdict == -NF_ACCEPT-1); entry2index(h, get_entry(h, h->info.hook_entry[i])); entry2index(h, get_entry(h, h->info.underflow[i])); } assert(h->info.size >= h->info.num_entries * (sizeof(STRUCT_ENTRY) +sizeof(STRUCT_STANDARD_TARGET))); assert(h->entries.size >= (h->new_number * (sizeof(STRUCT_ENTRY) + sizeof(STRUCT_STANDARD_TARGET)))); assert(strcmp(h->info.name, h->entries.name) == 0); i = 0; n = 0; was_return = 0; ENTRY_ITERATE(h->entries.entrytable, h->entries.size, check_entry, &i, &n, user_offset, &was_return, h); assert(i == h->new_number); assert(n == h->entries.size); assert(strcmp(GET_TARGET(index2entry(h, h->new_number-1)) ->u.user.name, ERROR_TARGET) == 0); }