/*

 * (C) 2000-2006 by the netfilter coreteam <coreteam@netfilter.org>:

 *

 *	This program is free software; you can redistribute it and/or modify

 *	it under the terms of the GNU General Public License as published by

 *	the Free Software Foundation; either version 2 of the License, or

 *	(at your option) any later version.

 *

 *	This program is distributed in the hope that it will be useful,

 *	but WITHOUT ANY WARRANTY; without even the implied warranty of

 *	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 *	GNU General Public License for more details.

 *

 *	You should have received a copy of the GNU General Public License

 *	along with this program; if not, write to the Free Software

 *	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 */

#include "config.h"

#include <ctype.h>

#include <errno.h>

#include <fcntl.h>

#include <inttypes.h>

#include <netdb.h>

#include <spawn.h>

#include <stdarg.h>

#include <stdbool.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <unistd.h>

#include <sys/socket.h>

#include <sys/stat.h>

#include <sys/statfs.h>

#include <sys/types.h>

#include <sys/utsname.h>

#include <sys/wait.h>

#include <arpa/inet.h>

#if defined(HAVE_LINUX_MAGIC_H)

#	include <linux/magic.h> /* for PROC_SUPER_MAGIC */

#elif defined(HAVE_LINUX_PROC_FS_H)

#	include <linux/proc_fs.h>	/* Linux 2.4 */

#else

#	define PROC_SUPER_MAGIC	0x9fa0

#endif

#include <xtables.h>

#include <limits.h> /* INT_MAX in ip_tables.h/ip6_tables.h */

#include <linux/netfilter_ipv4/ip_tables.h>

#include <linux/netfilter_ipv6/ip6_tables.h>

#include <libiptc/libxtc.h>

#ifndef NO_SHARED_LIBS

#include <dlfcn.h>

#endif

#ifndef IPT_SO_GET_REVISION_MATCH /* Old kernel source. */

#	define IPT_SO_GET_REVISION_MATCH	(IPT_BASE_CTL + 2)

#	define IPT_SO_GET_REVISION_TARGET	(IPT_BASE_CTL + 3)

#endif

#ifndef IP6T_SO_GET_REVISION_MATCH /* Old kernel source. */

#	define IP6T_SO_GET_REVISION_MATCH	68

#	define IP6T_SO_GET_REVISION_TARGET	69

#endif

#include <getopt.h>

#include "iptables/internal.h"

#include "xshared.h"

#define NPROTO	255

#ifndef PROC_SYS_MODPROBE

#define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe"

#endif

/* we need this for ip6?tables-restore.  ip6?tables-restore.c sets line to the

 * current line of the input file, in order  to give a more precise error

 * message.  ip6?tables itself doesn't need this, so it is initialized to the

 * magic number of -1 */

int line = -1;

void basic_exit_err(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3)));

struct xtables_globals *xt_params = NULL;

void basic_exit_err(enum xtables_exittype status, const char *msg, ...)

{

	va_list args;

	va_start(args, msg);

	fprintf(stderr, "%s v%s: ", xt_params->program_name, xt_params->program_version);

	vfprintf(stderr, msg, args);

	va_end(args);

	fprintf(stderr, "\n");

	exit(status);

}

void xtables_free_opts(int unused)

{

	if (xt_params->opts != xt_params->orig_opts) {

		free(xt_params->opts);

		xt_params->opts = NULL;

	}

}

struct option *xtables_merge_options(struct option *orig_opts,

				     struct option *oldopts,

				     const struct option *newopts,

				     unsigned int *option_offset)

{

	unsigned int num_oold = 0, num_old = 0, num_new = 0, i;

	struct option *merge, *mp;

	if (newopts == NULL)

		return oldopts;

	for (num_oold = 0; orig_opts[num_oold].name; num_oold++) ;

	if (oldopts != NULL)

		for (num_old = 0; oldopts[num_old].name; num_old++) ;

	for (num_new = 0; newopts[num_new].name; num_new++) ;

	/*

	 * Since @oldopts also has @orig_opts already (and does so at the

	 * start), skip these entries.

	 */

	if (oldopts != NULL) {

		oldopts += num_oold;

		num_old -= num_oold;

	}

	merge = malloc(sizeof(*mp) * (num_oold + num_old + num_new + 1));

	if (merge == NULL)

		return NULL;

	/* Let the base options -[ADI...] have precedence over everything */

	memcpy(merge, orig_opts, sizeof(*mp) * num_oold);

	mp = merge + num_oold;

	/* Second, the new options */

	xt_params->option_offset += XT_OPTION_OFFSET_SCALE;

	*option_offset = xt_params->option_offset;

	memcpy(mp, newopts, sizeof(*mp) * num_new);

	for (i = 0; i < num_new; ++i, ++mp)

		mp->val += *option_offset;

	/* Third, the old options */

	if (oldopts != NULL) {

		memcpy(mp, oldopts, sizeof(*mp) * num_old);

		mp += num_old;

	}

	xtables_free_opts(0);

	/* Clear trailing entry */

	memset(mp, 0, sizeof(*mp));

	return merge;

}

static const struct xtables_afinfo afinfo_ipv4 = {

	.kmod          = "ip_tables",

	.proc_exists   = "/proc/net/ip_tables_names",

	.libprefix     = "libipt_",

	.family	       = NFPROTO_IPV4,

	.ipproto       = IPPROTO_IP,

	.so_rev_match  = IPT_SO_GET_REVISION_MATCH,

	.so_rev_target = IPT_SO_GET_REVISION_TARGET,

};

static const struct xtables_afinfo afinfo_ipv6 = {

	.kmod          = "ip6_tables",

	.proc_exists   = "/proc/net/ip6_tables_names",

	.libprefix     = "libip6t_",

	.family        = NFPROTO_IPV6,

	.ipproto       = IPPROTO_IPV6,

	.so_rev_match  = IP6T_SO_GET_REVISION_MATCH,

	.so_rev_target = IP6T_SO_GET_REVISION_TARGET,

};

/* Dummy families for arptables-compat and ebtables-compat. Leave structure

 * fields that we don't use unset.

 */

static const struct xtables_afinfo afinfo_bridge = {

	.libprefix     = "libebt_",

	.family        = NFPROTO_BRIDGE,

};

static const struct xtables_afinfo afinfo_arp = {

	.libprefix     = "libarpt_",

	.family        = NFPROTO_ARP,

};

const struct xtables_afinfo *afinfo;

/* Search path for Xtables .so files */

static const char *xtables_libdir;

/* the path to command to load kernel module */

const char *xtables_modprobe_program;

/* Keep track of matches/targets pending full registration: linked lists. */

struct xtables_match *xtables_pending_matches;

struct xtables_target *xtables_pending_targets;

/* Keep track of fully registered external matches/targets: linked lists. */

struct xtables_match *xtables_matches;

struct xtables_target *xtables_targets;

/* Fully register a match/target which was previously partially registered. */

static bool xtables_fully_register_pending_match(struct xtables_match *me,

						 struct xtables_match *prev);

static bool xtables_fully_register_pending_target(struct xtables_target *me,

						  struct xtables_target *prev);

void xtables_init(void)

{

	xtables_libdir = getenv("XTABLES_LIBDIR");

	if (xtables_libdir != NULL)

		return;

	xtables_libdir = getenv("IPTABLES_LIB_DIR");

	if (xtables_libdir != NULL) {

		fprintf(stderr, "IPTABLES_LIB_DIR is deprecated, "

		        "use XTABLES_LIBDIR.\n");

		return;

	}

	/*

	 * Well yes, IP6TABLES_LIB_DIR is of lower priority over

	 * IPTABLES_LIB_DIR since this moved to libxtables; I think that is ok

	 * for these env vars are deprecated anyhow, and in light of the

	 * (shared) libxt_*.so files, makes less sense to have

	 * IPTABLES_LIB_DIR != IP6TABLES_LIB_DIR.

	 */

	xtables_libdir = getenv("IP6TABLES_LIB_DIR");

	if (xtables_libdir != NULL) {

		fprintf(stderr, "IP6TABLES_LIB_DIR is deprecated, "

		        "use XTABLES_LIBDIR.\n");

		return;

	}

	xtables_libdir = XTABLES_LIBDIR;

}

void xtables_set_nfproto(uint8_t nfproto)

{

	switch (nfproto) {

	case NFPROTO_IPV4:

		afinfo = &afinfo_ipv4;

		break;

	case NFPROTO_IPV6:

		afinfo = &afinfo_ipv6;

		break;

	case NFPROTO_BRIDGE:

		afinfo = &afinfo_bridge;

		break;

	case NFPROTO_ARP:

		afinfo = &afinfo_arp;

		break;

	default:

		fprintf(stderr, "libxtables: unhandled NFPROTO in %s\n",

		        __func__);

	}

}

/**

 * xtables_set_params - set the global parameters used by xtables

 * @xtp:	input xtables_globals structure

 *

 * The app is expected to pass a valid xtables_globals data-filled

 * with proper values

 * @xtp cannot be NULL

 *

 * Returns -1 on failure to set and 0 on success

 */

int xtables_set_params(struct xtables_globals *xtp)

{

	if (!xtp) {

		fprintf(stderr, "%s: Illegal global params\n",__func__);

		return -1;

	}

	xt_params = xtp;

	if (!xt_params->exit_err)

		xt_params->exit_err = basic_exit_err;

	return 0;

}

int xtables_init_all(struct xtables_globals *xtp, uint8_t nfproto)

{

	xtables_init();

	xtables_set_nfproto(nfproto);

	return xtables_set_params(xtp);

}

/**

 * xtables_*alloc - wrappers that exit on failure

 */

void *xtables_calloc(size_t count, size_t size)

{

	void *p;

	if ((p = calloc(count, size)) == NULL) {

		perror("ip[6]tables: calloc failed");

		exit(1);

	}

	return p;

}

void *xtables_malloc(size_t size)

{

	void *p;

	if ((p = malloc(size)) == NULL) {

		perror("ip[6]tables: malloc failed");

		exit(1);

	}

	return p;

}

void *xtables_realloc(void *ptr, size_t size)

{

	void *p;

	if ((p = realloc(ptr, size)) == NULL) {

		perror("ip[6]tables: realloc failed");

		exit(1);

	}

	return p;

}

static char *get_modprobe(void)

{

	int procfile;

	char *ret;

	int count;

	procfile = open(PROC_SYS_MODPROBE, O_RDONLY);

	if (procfile < 0)

		return NULL;

	if (fcntl(procfile, F_SETFD, FD_CLOEXEC) == -1) {

		fprintf(stderr, "Could not set close on exec: %s\n",

			strerror(errno));

		exit(1);

	}

	ret = malloc(PATH_MAX);

	if (ret) {

		count = read(procfile, ret, PATH_MAX);

		if (count > 0 && count < PATH_MAX)

		{

			if (ret[count - 1] == '\n')

				ret[count - 1] = '\0';

			else

				ret[count] = '\0';

			close(procfile);

			return ret;

		}

	}

	free(ret);

	close(procfile);

	return NULL;

}

int xtables_insmod(const char *modname, const char *modprobe, bool quiet)

{

	char *buf = NULL;

	char *argv[4];

	int status;

	pid_t pid;

	/* If they don't explicitly set it, read out of kernel */

	if (!modprobe) {

		buf = get_modprobe();

		if (!buf)

			return -1;

		modprobe = buf;

	}

	argv[0] = (char *)modprobe;

	argv[1] = (char *)modname;

	argv[2] = quiet ? "-q" : NULL;

	argv[3] = NULL;

	/*

	 * Need to flush the buffer, or the child may output it again

	 * when switching the program thru execv.

	 */

	fflush(stdout);

	if (posix_spawn(&pid, argv[0], NULL, NULL, argv, NULL)) {

		free(buf);

		return -1;

	} else {

		waitpid(pid, &status, 0);

	}

	free(buf);

	if (WIFEXITED(status) && WEXITSTATUS(status) == 0)

		return 0;

	return -1;

}

/* return true if a given file exists within procfs */

static bool proc_file_exists(const char *filename)

{

	struct stat s;

	struct statfs f;

	if (lstat(filename, &s))

		return false;

	if (!S_ISREG(s.st_mode))

		return false;

	if (statfs(filename, &f))

		return false;

	if (f.f_type != PROC_SUPER_MAGIC)

		return false;

	return true;

}

int xtables_load_ko(const char *modprobe, bool quiet)

{

	static bool loaded = false;

	int ret;

	if (loaded)

		return 0;

	if (proc_file_exists(afinfo->proc_exists)) {

		loaded = true;

		return 0;

	};

	ret = xtables_insmod(afinfo->kmod, modprobe, quiet);

	if (ret == 0)

		loaded = true;

	return ret;

}

/**

 * xtables_strtou{i,l} - string to number conversion

 * @s:	input string

 * @end:	like strtoul's "end" pointer

 * @value:	pointer for result

 * @min:	minimum accepted value

 * @max:	maximum accepted value

 *

 * If @end is NULL, we assume the caller wants a "strict strtoul", and hence

 * "15a" is rejected.

 * In either case, the value obtained is compared for min-max compliance.

 * Base is always 0, i.e. autodetect depending on @s.

 *

 * Returns true/false whether number was accepted. On failure, *value has

 * undefined contents.

 */

bool xtables_strtoul(const char *s, char **end, uintmax_t *value,

                     uintmax_t min, uintmax_t max)

{

	uintmax_t v;

	const char *p;

	char *my_end;

	errno = 0;

	/* Since strtoul allows leading minus, we have to check for ourself. */

	for (p = s; isspace(*p); ++p)

		;

	if (*p == '-')

		return false;

	v = strtoumax(s, &my_end, 0);

	if (my_end == s)

		return false;

	if (end != NULL)

		*end = my_end;

	if (errno != ERANGE && min <= v && (max == 0 || v <= max)) {

		if (value != NULL)

			*value = v;

		if (end == NULL)

			return *my_end == '\0';

		return true;

	}

	return false;

}

bool xtables_strtoui(const char *s, char **end, unsigned int *value,

                     unsigned int min, unsigned int max)

{

	uintmax_t v;

	bool ret;

	ret = xtables_strtoul(s, end, &v, min, max);

	if (ret && value != NULL)

		*value = v;

	return ret;

}

int xtables_service_to_port(const char *name, const char *proto)

{

	struct servent *service;

	if ((service = getservbyname(name, proto)) != NULL)

		return ntohs((unsigned short) service->s_port);

	return -1;

}

uint16_t xtables_parse_port(const char *port, const char *proto)

{

	unsigned int portnum;

	if (xtables_strtoui(port, NULL, &portnum, 0, UINT16_MAX) ||

	    (portnum = xtables_service_to_port(port, proto)) != (unsigned)-1)

		return portnum;

	xt_params->exit_err(PARAMETER_PROBLEM,

		   "invalid port/service `%s' specified", port);

}

void xtables_parse_interface(const char *arg, char *vianame,

			     unsigned char *mask)

{

	unsigned int vialen = strlen(arg);

	unsigned int i;

	memset(mask, 0, IFNAMSIZ);

	memset(vianame, 0, IFNAMSIZ);

	if (vialen + 1 > IFNAMSIZ)

		xt_params->exit_err(PARAMETER_PROBLEM,

			   "interface name `%s' must be shorter than IFNAMSIZ"

			   " (%i)", arg, IFNAMSIZ-1);

	strcpy(vianame, arg);

	if (vialen == 0)

		return;

	else if (vianame[vialen - 1] == '+') {

		memset(mask, 0xFF, vialen - 1);

		/* Don't remove `+' here! -HW */

	} else {

		/* Include nul-terminator in match */

		memset(mask, 0xFF, vialen + 1);

	}

	/* Display warning on invalid characters */

	for (i = 0; vianame[i]; i++) {

		if (vianame[i] == '/' || vianame[i] == ' ') {

			fprintf(stderr,	"Warning: weird character in interface"

				" `%s' ('/' and ' ' are not allowed by the kernel).\n",

				vianame);

			break;

		}

	}

}

#ifndef NO_SHARED_LIBS

static void *load_extension(const char *search_path, const char *af_prefix,

    const char *name, bool is_target)

{

	const char *all_prefixes[] = {af_prefix, "libxt_", NULL};

	const char **prefix;

	const char *dir = search_path, *next;

	void *ptr = NULL;

	struct stat sb;

	char path[256];

	do {

		next = strchr(dir, ':');

		if (next == NULL)

			next = dir + strlen(dir);

		for (prefix = all_prefixes; *prefix != NULL; ++prefix) {

			snprintf(path, sizeof(path), "%.*s/%s%s.so",

			         (unsigned int)(next - dir), dir,

			         *prefix, name);

			if (stat(path, &sb) != 0) {

				if (errno == ENOENT)

					continue;

				fprintf(stderr, "%s: %s\n", path,

					strerror(errno));

				return NULL;

			}

			if (dlopen(path, RTLD_NOW) == NULL) {

				fprintf(stderr, "%s: %s\n", path, dlerror());

				break;

			}

			if (is_target)

				ptr = xtables_find_target(name, XTF_DONT_LOAD);

			else

				ptr = xtables_find_match(name,

				      XTF_DONT_LOAD, NULL);

			if (ptr != NULL)

				return ptr;

			errno = ENOENT;

			return NULL;

		}

		dir = next + 1;

	} while (*next != '\0');

	return NULL;

}

#endif

static bool extension_cmp(const char *name1, const char *name2, uint32_t family)

{

	if (strcmp(name1, name2) == 0 &&

	    (family == afinfo->family ||

	     family == NFPROTO_UNSPEC))

		return true;

	return false;

}

struct xtables_match *

xtables_find_match(const char *name, enum xtables_tryload tryload,

		   struct xtables_rule_match **matches)

{

	struct xtables_match *prev = NULL;

	struct xtables_match **dptr;

	struct xtables_match *ptr;

	const char *icmp6 = "icmp6";

	if (strlen(name) >= XT_EXTENSION_MAXNAMELEN)

		xtables_error(PARAMETER_PROBLEM,

			   "Invalid match name \"%s\" (%u chars max)",

			   name, XT_EXTENSION_MAXNAMELEN - 1);

	/* This is ugly as hell. Nonetheless, there is no way of changing

	 * this without hurting backwards compatibility */

	if ( (strcmp(name,"icmpv6") == 0) ||

	     (strcmp(name,"ipv6-icmp") == 0) ||

	     (strcmp(name,"icmp6") == 0) )

		name = icmp6;

	/* Trigger delayed initialization */

	for (dptr = &xtables_pending_matches; *dptr; ) {

		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {

			ptr = *dptr;

			*dptr = (*dptr)->next;

			if (xtables_fully_register_pending_match(ptr, prev)) {

				prev = ptr;

				continue;

			} else if (prev) {

				continue;

			}

			*dptr = ptr;

		}

		dptr = &((*dptr)->next);

	}

	for (ptr = xtables_matches; ptr; ptr = ptr->next) {

		if (extension_cmp(name, ptr->name, ptr->family)) {

			struct xtables_match *clone;

			/* First match of this type: */

			if (ptr->m == NULL)

				break;

			/* Second and subsequent clones */

			clone = xtables_malloc(sizeof(struct xtables_match));

			memcpy(clone, ptr, sizeof(struct xtables_match));

			clone->udata = NULL;

			clone->mflags = 0;

			/* This is a clone: */

			clone->next = clone;

			ptr = clone;

			break;

		}

	}

#ifndef NO_SHARED_LIBS

	if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) {

		ptr = load_extension(xtables_libdir, afinfo->libprefix,

		      name, false);

		if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED)

			xt_params->exit_err(PARAMETER_PROBLEM,

				   "Couldn't load match `%s':%s\n",

				   name, strerror(errno));

	}

#else

	if (ptr && !ptr->loaded) {

		if (tryload != XTF_DONT_LOAD)

			ptr->loaded = 1;

		else

			ptr = NULL;

	}

	if(!ptr && (tryload == XTF_LOAD_MUST_SUCCEED)) {

		xt_params->exit_err(PARAMETER_PROBLEM,

			   "Couldn't find match `%s'\n", name);

	}

#endif

	if (ptr && matches) {

		struct xtables_rule_match **i;

		struct xtables_rule_match *newentry;

		newentry = xtables_malloc(sizeof(struct xtables_rule_match));

		for (i = matches; *i; i = &(*i)->next) {

			if (extension_cmp(name, (*i)->match->name,

					  (*i)->match->family))

				(*i)->completed = true;

		}

		newentry->match = ptr;

		newentry->completed = false;

		newentry->next = NULL;

		*i = newentry;

	}

	return ptr;

}

struct xtables_match *

xtables_find_match_revision(const char *name, enum xtables_tryload tryload,

			    struct xtables_match *match, int revision)

{

	if (!match) {

		match = xtables_find_match(name, tryload, NULL);

		if (!match)

			return NULL;

	}

	while (1) {

		if (match->revision == revision)

			return match;

		match = match->next;

		if (!match)

			return NULL;

		if (!extension_cmp(name, match->name, match->family))

			return NULL;

	}

}

struct xtables_target *

xtables_find_target(const char *name, enum xtables_tryload tryload)

{

	struct xtables_target *prev = NULL;

	struct xtables_target **dptr;

	struct xtables_target *ptr;

	/* Standard target? */

	if (strcmp(name, "") == 0

	    || strcmp(name, XTC_LABEL_ACCEPT) == 0

	    || strcmp(name, XTC_LABEL_DROP) == 0

	    || strcmp(name, XTC_LABEL_QUEUE) == 0

	    || strcmp(name, XTC_LABEL_RETURN) == 0)

		name = "standard";

	/* Trigger delayed initialization */

	for (dptr = &xtables_pending_targets; *dptr; ) {

		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {

			ptr = *dptr;

			*dptr = (*dptr)->next;

			if (xtables_fully_register_pending_target(ptr, prev)) {

				prev = ptr;

				continue;

			} else if (prev) {

				continue;

			}

			*dptr = ptr;

		}

		dptr = &((*dptr)->next);

	}

	for (ptr = xtables_targets; ptr; ptr = ptr->next) {

		if (extension_cmp(name, ptr->name, ptr->family)) {

			struct xtables_target *clone;

			/* First target of this type: */

			if (ptr->t == NULL)

				break;

			/* Second and subsequent clones */

			clone = xtables_malloc(sizeof(struct xtables_target));

			memcpy(clone, ptr, sizeof(struct xtables_target));

			clone->udata = NULL;

			clone->tflags = 0;

			/* This is a clone: */

			clone->next = clone;

			ptr = clone;

			break;

		}

	}

#ifndef NO_SHARED_LIBS

	if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) {

		ptr = load_extension(xtables_libdir, afinfo->libprefix,

		      name, true);

		if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED)

			xt_params->exit_err(PARAMETER_PROBLEM,

				   "Couldn't load target `%s':%s\n",

				   name, strerror(errno));

	}

#else

	if (ptr && !ptr->loaded) {

		if (tryload != XTF_DONT_LOAD)

			ptr->loaded = 1;

		else

			ptr = NULL;

	}

	if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) {

		xt_params->exit_err(PARAMETER_PROBLEM,

			   "Couldn't find target `%s'\n", name);

	}

#endif

	if (ptr)

		ptr->used = 1;

	return ptr;

}

struct xtables_target *

xtables_find_target_revision(const char *name, enum xtables_tryload tryload,

			     struct xtables_target *target, int revision)

{

	if (!target) {

		target = xtables_find_target(name, tryload);

		if (!target)

			return NULL;

	}

	while (1) {

		if (target->revision == revision)

			return target;

		target = target->next;

		if (!target)

			return NULL;

		if (!extension_cmp(name, target->name, target->family))

			return NULL;

	}

}

int xtables_compatible_revision(const char *name, uint8_t revision, int opt)

{

	struct xt_get_revision rev;

	socklen_t s = sizeof(rev);

	int max_rev, sockfd;

	sockfd = socket(afinfo->family, SOCK_RAW, IPPROTO_RAW);

	if (sockfd < 0) {

		if (errno == EPERM) {

			/* revision 0 is always supported. */

			if (revision != 0)

				fprintf(stderr, "%s: Could not determine whether "

						"revision %u is supported, "

						"assuming it is.\n",

					name, revision);

			return 1;

		}

		fprintf(stderr, "Could not open socket to kernel: %s\n",

			strerror(errno));

		exit(1);

	}

	if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) {

		fprintf(stderr, "Could not set close on exec: %s\n",

			strerror(errno));

		exit(1);

	}

	xtables_load_ko(xtables_modprobe_program, true);

	strncpy(rev.name, name, XT_EXTENSION_MAXNAMELEN - 1);

	rev.name[XT_EXTENSION_MAXNAMELEN - 1] = '\0';

	rev.revision = revision;

	max_rev = getsockopt(sockfd, afinfo->ipproto, opt, &rev, &s);

	if (max_rev < 0) {

		/* Definitely don't support this? */

		if (errno == ENOENT || errno == EPROTONOSUPPORT) {

			close(sockfd);

			return 0;