[iptables PATCH 00/11] Support 'make dist' and 'make check'

[iptables PATCH 00/11] Support 'make dist' and 'make check'

[Phil Sutter]

The goal of this series is to replace the custom 'tarball' Makefile
target by automake's standard 'dist' target. Due to the special
non-automake extensions/GNUMakefile.in and some other minor details,
this hasn't been functional.

Patches 1-6 are preparation work and cleanup of left-overs noticed when
comparing final tarball contents.

Patches 7 and 8 then enable 'dist' and 'distcheck' targets.

Finally, patches 9 and 10 integrate testsuite scripts for use with 'make
check'. The 'distcheck' target triggers them, too. But since one doesn't
do that as uid 0, only xlate-test.py actually executes and the others
are skipped.

Phil Sutter (11):
  Drop INCOMPATIBILITIES file
  Drop libiptc/linux_stddef.h
  Makefile: Generate ip6tables man pages on the fly
  extensions: Makefile: Merge initext targets
  iptables/Makefile: Reorg variable assignments
  iptables/Makefile: Split nft-variant man page list
  Makefile: Fix for 'make distcheck'
  Makefile: Generate .tar.bz2 archive with 'make dist'
  include/Makefile: xtables-version.h is generated
  tests: Adjust testsuite return codes to automake guidelines
  Makefile.am: Integrate testsuites

 .gitignore                        |  12 +++
 INCOMPATIBILITIES                 |  14 ----
 Makefile.am                       |   8 +-
 extensions/GNUmakefile.in         | 121 +++++++-----------------------
 include/Makefile.am               |   8 +-
 iptables-test.py                  |   2 +-
 iptables/Makefile.am              |  84 +++++++++++----------
 iptables/ip6tables-apply.8        |   1 -
 iptables/ip6tables-restore.8      |   1 -
 iptables/ip6tables-save.8         |   1 -
 iptables/ip6tables.8              |   1 -
 iptables/tests/shell/run-tests.sh |   4 +-
 libipq/Makefile.am                |   2 +-
 libiptc/Makefile.am               |   2 +
 libiptc/linux_stddef.h            |  39 ----------
 utils/Makefile.am                 |   4 +-
 xlate-test.py                     |   2 +-
 17 files changed, 107 insertions(+), 199 deletions(-)
 delete mode 100644 INCOMPATIBILITIES
 delete mode 100644 iptables/ip6tables-apply.8
 delete mode 100644 iptables/ip6tables-restore.8
 delete mode 100644 iptables/ip6tables-save.8
 delete mode 100644 iptables/ip6tables.8
 delete mode 100644 libiptc/linux_stddef.h

-- 
2.38.0

[iptables PATCH 01/11] Drop INCOMPATIBILITIES file

[Phil Sutter]

The problems described in there were relevant 17 years ago.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 INCOMPATIBILITIES | 14 --------------
 1 file changed, 14 deletions(-)
 delete mode 100644 INCOMPATIBILITIES

diff --git a/INCOMPATIBILITIES b/INCOMPATIBILITIES
deleted file mode 100644
index ddb24087c9696..0000000000000
--- a/INCOMPATIBILITIES
+++ /dev/null
@@ -1,14 +0,0 @@
-INCOMPATIBILITIES:
-
-- The REJECT target has an '--reject-with admin-prohib' option which used
-  with kernels that do not support it, will result in a plain DROP instead
-  of REJECT.  Use with caution.
-  Kernels that do support it:
-  	2.4 - since 2.4.22-pre9
-	2.6 - all
-
-- There are some issues related to upgrading from 1.2.x to 1.3.x on a system
-  with dynamic ruleset changes during runtime. (Please see 
-  https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=334).
-  After upgrading from 1.2 to 1.3, it suggest go do an iptables-save, then
-  iptables-restore to ensure your dynamic rule changes continue to work.
-- 
2.38.0

[iptables PATCH 02/11] Drop libiptc/linux_stddef.h

[Phil Sutter]

This header was never included anywhere.

Fixes: aae69bed01982 ("complete libiptc rewrite.  Time to load 10k rules goes down from 2.20 minutes to 1.255 seconds (!).  Might still contain bugs, use with caution.")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 libiptc/linux_stddef.h | 39 ---------------------------------------
 1 file changed, 39 deletions(-)
 delete mode 100644 libiptc/linux_stddef.h

diff --git a/libiptc/linux_stddef.h b/libiptc/linux_stddef.h
deleted file mode 100644
index 56416f104ecfc..0000000000000
--- a/libiptc/linux_stddef.h
+++ /dev/null
@@ -1,39 +0,0 @@
-#ifndef _LINUX_STDDEF_H
-#define _LINUX_STDDEF_H
-
-#undef NULL
-#if defined(__cplusplus)
-#define NULL 0
-#else
-#define NULL ((void *)0)
-#endif
-
-#undef offsetof
-#define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)
-
-
-/**
- * container_of - cast a member of a structure out to the containing structure
- *
- * @ptr:	the pointer to the member.
- * @type:	the type of the container struct this is embedded in.
- * @member:	the name of the member within the struct.
- *
- */
-#define container_of(ptr, type, member) ({			\
-        const typeof( ((type *)0)->member ) *__mptr = (ptr);	\
-        (type *)( (char *)__mptr - offsetof(type,member) );})
-
-/*
- * Check at compile time that something is of a particular type.
- * Always evaluates to 1 so you may use it easily in comparisons.
- */
-#define typecheck(type,x) \
-({	type __dummy; \
-	typeof(x) __dummy2; \
-	(void)(&__dummy == &__dummy2); \
-	1; \
-})
-
-
-#endif
-- 
2.38.0

[iptables PATCH 03/11] Makefile: Generate ip6tables man pages on the fly

[Phil Sutter]

No need to drag them around, creating them is simple.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 iptables/Makefile.am         | 3 +++
 iptables/ip6tables-apply.8   | 1 -
 iptables/ip6tables-restore.8 | 1 -
 iptables/ip6tables-save.8    | 1 -
 iptables/ip6tables.8         | 1 -
 5 files changed, 3 insertions(+), 4 deletions(-)
 delete mode 100644 iptables/ip6tables-apply.8
 delete mode 100644 iptables/ip6tables-restore.8
 delete mode 100644 iptables/ip6tables-save.8
 delete mode 100644 iptables/ip6tables.8

diff --git a/iptables/Makefile.am b/iptables/Makefile.am
index 23f8352d30610..acd3ce0c438e1 100644
--- a/iptables/Makefile.am
+++ b/iptables/Makefile.am
@@ -105,6 +105,9 @@ iptables-extensions.8: iptables-extensions.8.tmpl ../extensions/matches.man ../e
 iptables-translate.8 ip6tables-translate.8 iptables-restore-translate.8 ip6tables-restore-translate.8:
 	${AM_VERBOSE_GEN} echo '.so man8/xtables-translate.8' >$@
 
+ip6tables.8 ip6tables-apply.8 ip6tables-restore.8 ip6tables-save.8:
+	${AM_VERBOSE_GEN} sed 's|^ip6|.so man8/ip|' <<<$@ >$@
+
 pkgconfig_DATA = xtables.pc
 
 # Using if..fi avoids an ugly "error (ignored)" message :)
diff --git a/iptables/ip6tables-apply.8 b/iptables/ip6tables-apply.8
deleted file mode 100644
index 994b487a43598..0000000000000
--- a/iptables/ip6tables-apply.8
+++ /dev/null
@@ -1 +0,0 @@
-.so man8/iptables-apply.8
diff --git a/iptables/ip6tables-restore.8 b/iptables/ip6tables-restore.8
deleted file mode 100644
index cf4ea3e7926c4..0000000000000
--- a/iptables/ip6tables-restore.8
+++ /dev/null
@@ -1 +0,0 @@
-.so man8/iptables-restore.8
diff --git a/iptables/ip6tables-save.8 b/iptables/ip6tables-save.8
deleted file mode 100644
index 182f55c12f962..0000000000000
--- a/iptables/ip6tables-save.8
+++ /dev/null
@@ -1 +0,0 @@
-.so man8/iptables-save.8
diff --git a/iptables/ip6tables.8 b/iptables/ip6tables.8
deleted file mode 100644
index 0dee41adb3965..0000000000000
--- a/iptables/ip6tables.8
+++ /dev/null
@@ -1 +0,0 @@
-.so man8/iptables.8
-- 
2.38.0

Re: [iptables PATCH 03/11] Makefile: Generate ip6tables man pages on the fly

[Jan Engelhardt]

On Wednesday 2022-12-07 18:44, Phil Sutter wrote:
> 	${AM_VERBOSE_GEN} echo '.so man8/xtables-translate.8' >$@
> 
>+ip6tables.8 ip6tables-apply.8 ip6tables-restore.8 ip6tables-save.8:
>+	${AM_VERBOSE_GEN} sed 's|^ip6|.so man8/ip|' <<<$@ >$@

<<< is not sh-compatible

Re: [iptables PATCH 03/11] Makefile: Generate ip6tables man pages on the fly

[Phil Sutter]

On Wed, Dec 07, 2022 at 07:36:50PM +0100, Jan Engelhardt wrote:
> 
> On Wednesday 2022-12-07 18:44, Phil Sutter wrote:
> > 	${AM_VERBOSE_GEN} echo '.so man8/xtables-translate.8' >$@
> > 
> >+ip6tables.8 ip6tables-apply.8 ip6tables-restore.8 ip6tables-save.8:
> >+	${AM_VERBOSE_GEN} sed 's|^ip6|.so man8/ip|' <<<$@ >$@
> 
> <<< is not sh-compatible

Oh, thanks. I'll resubmit using 'echo "$@" | sed ...' then.

Thanks, Phil

[iptables PATCH 04/11] extensions: Makefile: Merge initext targets

[Phil Sutter]

Abstract initext*.c and .initext*.dd stamp file recipes so a single one
serves for all variants.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 extensions/GNUmakefile.in | 106 +++++---------------------------------
 1 file changed, 14 insertions(+), 92 deletions(-)

diff --git a/extensions/GNUmakefile.in b/extensions/GNUmakefile.in
index 0239a06a90cd1..188e7a7902566 100644
--- a/extensions/GNUmakefile.in
+++ b/extensions/GNUmakefile.in
@@ -175,111 +175,33 @@ initexta_func := $(addprefix arpt_,${pfa_build_mod})
 initext4_func := $(addprefix ipt_,${pf4_build_mod})
 initext6_func := $(addprefix ip6t_,${pf6_build_mod})
 
-.initext.dd: FORCE
-	@echo "${initext_func}" >$@.tmp; \
-	cmp -s $@ $@.tmp || mv $@.tmp $@; \
-	rm -f $@.tmp;
-
-.initextb.dd: FORCE
-	@echo "${initextb_func}" >$@.tmp; \
-	cmp -s $@ $@.tmp || mv $@.tmp $@; \
-	rm -f $@.tmp;
-
-.initexta.dd: FORCE
-	@echo "${initexta_func}" >$@.tmp; \
-	cmp -s $@ $@.tmp || mv $@.tmp $@; \
-	rm -f $@.tmp;
-
-.initext4.dd: FORCE
-	@echo "${initext4_func}" >$@.tmp; \
-	cmp -s $@ $@.tmp || mv $@.tmp $@; \
-	rm -f $@.tmp;
+initexts := ext exta extb ext4 ext6
+initext_depfiles = $(patsubst %,.init%.dd,${initexts})
+initext_sources = $(patsubst %,init%.c,${initexts})
 
-.initext6.dd: FORCE
-	@echo "${initext6_func}" >$@.tmp; \
+${initext_depfiles}: FORCE
+	@echo "$(value $(patsubst .%.dd,%,$@)_func)" >$@.tmp; \
 	cmp -s $@ $@.tmp || mv $@.tmp $@; \
 	rm -f $@.tmp;
 
-initext.c: .initext.dd
-	${AM_VERBOSE_GEN}
-	@( \
-	echo "" >$@; \
-	for i in ${initext_func}; do \
-		echo "extern void lib$${i}_init(void);" >>$@; \
-	done; \
-	echo "void init_extensions(void);" >>$@; \
-	echo "void init_extensions(void)" >>$@; \
-	echo "{" >>$@; \
-	for i in ${initext_func}; do \
-		echo  " ""lib$${i}_init();" >>$@; \
-	done; \
-	echo "}" >>$@; \
-	);
-
-initextb.c: .initextb.dd
-	${AM_VERBOSE_GEN}
-	@( \
-	echo "" >$@; \
-	for i in ${initextb_func}; do \
-		echo "extern void lib$${i}_init(void);" >>$@; \
-	done; \
-	echo "void init_extensionsb(void);" >>$@; \
-	echo "void init_extensionsb(void)" >>$@; \
-	echo "{" >>$@; \
-	for i in ${initextb_func}; do \
-		echo  " ""lib$${i}_init();" >>$@; \
-	done; \
-	echo "}" >>$@; \
-	);
-
-initexta.c: .initexta.dd
+${initext_sources}: %.c: .%.dd
 	${AM_VERBOSE_GEN}
 	@( \
+	initext_func="$(value $(basename $@)_func)"; \
+	funcname="init_extensions$(patsubst initext%.c,%,$@)"; \
 	echo "" >$@; \
-	for i in ${initexta_func}; do \
+	for i in $${initext_func}; do \
 		echo "extern void lib$${i}_init(void);" >>$@; \
 	done; \
-	echo "void init_extensionsa(void);" >>$@; \
-	echo "void init_extensionsa(void)" >>$@; \
+	echo "void $${funcname}(void);" >>$@; \
+	echo "void $${funcname}(void)" >>$@; \
 	echo "{" >>$@; \
-	for i in ${initexta_func}; do \
+	for i in $${initext_func}; do \
 		echo  " ""lib$${i}_init();" >>$@; \
 	done; \
 	echo "}" >>$@; \
 	);
 
-initext4.c: .initext4.dd
-	${AM_VERBOSE_GEN}
-	@( \
-	echo "" >$@; \
-	for i in ${initext4_func}; do \
-		echo "extern void lib$${i}_init(void);" >>$@; \
-	done; \
-	echo "void init_extensions4(void);" >>$@; \
-	echo "void init_extensions4(void)" >>$@; \
-	echo "{" >>$@; \
-	for i in ${initext4_func}; do \
-		echo  " ""lib$${i}_init();" >>$@; \
-	done; \
-	echo "}" >>$@; \
-	);
-
-initext6.c: .initext6.dd
-	${AM_VERBOSE_GEN}
-	@( \
-	echo "" >$@; \
-	for i in ${initext6_func}; do \
-		echo "extern void lib$${i}_init(void);" >>$@; \
-	done; \
-	echo "void init_extensions6(void);" >>$@; \
-	echo "void init_extensions6(void)" >>$@; \
-	echo "{" >>$@; \
-	for i in ${initext6_func}; do \
-		echo " ""lib$${i}_init();" >>$@; \
-	done; \
-	echo "}" >>$@; \
-	);
-
 #
 #	Manual pages
 #
@@ -308,8 +230,8 @@ man_run    = \
 		fi; \
 	done >$@;
 
-matches.man: .initext.dd .initextb.dd .initexta.dd .initext4.dd .initext6.dd $(wildcard ${srcdir}/lib*.man)
+matches.man: ${initext_depfiles} $(wildcard ${srcdir}/lib*.man)
 	$(call man_run,$(call ex_matches,${pfx_build_mod} ${pfb_build_mod} ${pfa_build_mod} ${pf4_build_mod} ${pf6_build_mod} ${pfx_symlinks}))
 
-targets.man: .initext.dd .initextb.dd .initexta.dd .initext4.dd .initext6.dd $(wildcard ${srcdir}/lib*.man)
+targets.man: ${initext_depfiles} $(wildcard ${srcdir}/lib*.man)
 	$(call man_run,$(call ex_targets,${pfx_build_mod} ${pfb_build_mod} ${pfa_build_mod} ${pf4_build_mod} ${pf6_build_mod} ${pfx_symlinks}))
-- 
2.38.0

[iptables PATCH 05/11] iptables/Makefile: Reorg variable assignments

[Phil Sutter]

Introduce helper variables holding SOURCES, LDADD and CFLAGS used by
both legacy and nft builds. Specify also internal header files, builds
should depend on them. Doing that, reorder lists for clarity.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 iptables/Makefile.am | 58 ++++++++++++++++++++++++--------------------
 1 file changed, 32 insertions(+), 26 deletions(-)

diff --git a/iptables/Makefile.am b/iptables/Makefile.am
index acd3ce0c438e1..406147f00f43d 100644
--- a/iptables/Makefile.am
+++ b/iptables/Makefile.am
@@ -6,46 +6,52 @@ AM_LDFLAGS       = ${regular_LDFLAGS}
 
 BUILT_SOURCES =
 
-xtables_legacy_multi_SOURCES  = xtables-legacy-multi.c iptables-xml.c
-xtables_legacy_multi_CFLAGS   = ${AM_CFLAGS}
-xtables_legacy_multi_LDADD    = ../extensions/libext.a
+common_sources = iptables-xml.c xtables-multi.h xshared.c xshared.h
+common_ldadd   = ../extensions/libext.a ../libxtables/libxtables.la -lm
+common_cflags  = ${AM_CFLAGS}
 if ENABLE_STATIC
-xtables_legacy_multi_CFLAGS  += -DALL_INCLUSIVE
+common_cflags += -DALL_INCLUSIVE
 endif
+
+xtables_legacy_multi_SOURCES  = ${common_sources} xtables-legacy-multi.c \
+				iptables-restore.c iptables-save.c
+xtables_legacy_multi_CFLAGS   = ${common_cflags}
+xtables_legacy_multi_LDADD    = ${common_ldadd}
 if ENABLE_IPV4
-xtables_legacy_multi_SOURCES += iptables-standalone.c iptables.c
+xtables_legacy_multi_SOURCES += iptables-standalone.c iptables.c iptables-multi.h
 xtables_legacy_multi_CFLAGS  += -DENABLE_IPV4
 xtables_legacy_multi_LDADD   += ../libiptc/libip4tc.la ../extensions/libext4.a
 endif
 if ENABLE_IPV6
-xtables_legacy_multi_SOURCES += ip6tables-standalone.c ip6tables.c
+xtables_legacy_multi_SOURCES += ip6tables-standalone.c ip6tables.c ip6tables-multi.h
 xtables_legacy_multi_CFLAGS  += -DENABLE_IPV6
 xtables_legacy_multi_LDADD   += ../libiptc/libip6tc.la ../extensions/libext6.a
 endif
-xtables_legacy_multi_SOURCES += xshared.c iptables-restore.c iptables-save.c
-xtables_legacy_multi_LDADD   += ../libxtables/libxtables.la -lm
 
 # iptables using nf_tables api
 if ENABLE_NFTABLES
-xtables_nft_multi_SOURCES  = xtables-nft-multi.c iptables-xml.c
-xtables_nft_multi_CFLAGS   = ${AM_CFLAGS}
-xtables_nft_multi_LDADD    = ../extensions/libext.a ../extensions/libext_ebt.a
-if ENABLE_STATIC
-xtables_nft_multi_CFLAGS  += -DALL_INCLUSIVE
-endif
+xtables_nft_multi_SOURCES  = ${common_sources} xtables-nft-multi.c
+xtables_nft_multi_CFLAGS   = ${common_cflags}
+xtables_nft_multi_LDADD    = ${common_ldadd} \
+			     ../extensions/libext_arpt.a \
+			     ../extensions/libext_ebt.a \
+			     ../extensions/libext4.a \
+			     ../extensions/libext6.a \
+			     ${libmnl_LIBS} ${libnftnl_LIBS} \
+			     ${libnetfilter_conntrack_LIBS}
 xtables_nft_multi_CFLAGS  += -DENABLE_NFTABLES -DENABLE_IPV4 -DENABLE_IPV6
-xtables_nft_multi_SOURCES += xtables-save.c xtables-restore.c \
-				xtables-standalone.c xtables.c nft.c \
-				nft-shared.c nft-ipv4.c nft-ipv6.c nft-arp.c \
-				xtables-monitor.c nft-cache.c \
-				xtables-arp.c \
-				nft-bridge.c nft-cmd.c nft-chain.c \
-				xtables-eb-standalone.c xtables-eb.c \
-				xtables-eb-translate.c \
-				xtables-translate.c
-xtables_nft_multi_LDADD   += ${libmnl_LIBS} ${libnftnl_LIBS} ${libnetfilter_conntrack_LIBS} ../extensions/libext4.a ../extensions/libext6.a ../extensions/libext_ebt.a ../extensions/libext_arpt.a
-xtables_nft_multi_SOURCES += xshared.c
-xtables_nft_multi_LDADD   += ../libxtables/libxtables.la -lm
+xtables_nft_multi_SOURCES += nft.c nft.h \
+			     nft-arp.c nft-ipv4.c nft-ipv6.c \
+			     nft-bridge.c nft-bridge.h \
+			     nft-cache.c nft-cache.h \
+			     nft-chain.c nft-chain.h \
+			     nft-cmd.c nft-cmd.h \
+			     nft-shared.c nft-shared.h \
+			     xtables-monitor.c \
+			     xtables.c xtables-arp.c xtables-eb.c \
+			     xtables-standalone.c xtables-eb-standalone.c \
+			     xtables-translate.c xtables-eb-translate.c \
+			     xtables-save.c xtables-restore.c
 endif
 
 sbin_PROGRAMS    = xtables-legacy-multi
-- 
2.38.0

[iptables PATCH 06/11] iptables/Makefile: Split nft-variant man page list

[Phil Sutter]

Some of them are not generated and must therefore be distributed. Hence
add them to a 'dist_man_MANS' variable. This leaves only generated
entries in the non-dist one, so use that to reduce the CLEANFILES list.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 iptables/Makefile.am | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/iptables/Makefile.am b/iptables/Makefile.am
index 406147f00f43d..b0f81d14a6451 100644
--- a/iptables/Makefile.am
+++ b/iptables/Makefile.am
@@ -66,19 +66,15 @@ man_MANS         = iptables.8 iptables-restore.8 iptables-save.8 \
 sbin_SCRIPTS     = iptables-apply
 
 if ENABLE_NFTABLES
-man_MANS	+= xtables-nft.8 xtables-translate.8 xtables-legacy.8 \
-                   iptables-translate.8 ip6tables-translate.8 \
+man_MANS	+= iptables-translate.8 ip6tables-translate.8 \
 		   iptables-restore-translate.8 ip6tables-restore-translate.8 \
-                   xtables-monitor.8 \
-                   arptables-nft.8 arptables-nft-restore.8 arptables-nft-save.8 \
-                   ebtables-nft.8
+		   xtables-monitor.8
+
+dist_man_MANS	 = xtables-nft.8 xtables-translate.8 xtables-legacy.8 \
+		   arptables-nft.8 arptables-nft-restore.8 arptables-nft-save.8 \
+		   ebtables-nft.8
 endif
-CLEANFILES       = iptables.8 xtables-monitor.8 \
-		   iptables-xml.1 iptables-apply.8 \
-		   iptables-extensions.8 iptables-extensions.8.tmpl \
-		   iptables-restore.8 iptables-save.8 \
-		   iptables-restore-translate.8 ip6tables-restore-translate.8 \
-		   iptables-translate.8 ip6tables-translate.8
+CLEANFILES       = ${man_MANS} iptables-extensions.8.tmpl
 
 vx_bin_links   = iptables-xml
 if ENABLE_IPV4
-- 
2.38.0

[iptables PATCH 07/11] Makefile: Fix for 'make distcheck'

[Phil Sutter]

Since extensions/ directory does not use automake, some targets have to
be added manually. Apart from that, several Makefiles either missed to
specify relevant files or did not specify them correctly for 'make dist'
to add them to the tarball.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 Makefile.am               |  4 +++-
 extensions/GNUmakefile.in | 15 ++++++++++++++-
 include/Makefile.am       |  2 ++
 iptables/Makefile.am      |  5 ++++-
 libipq/Makefile.am        |  2 +-
 libiptc/Makefile.am       |  2 ++
 utils/Makefile.am         |  4 ++--
 7 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 799bf8b81c74a..1292f4b7065f4 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -16,9 +16,11 @@ SUBDIRS         += extensions
 # Depends on extensions/libext.a:
 SUBDIRS         += iptables
 
+EXTRA_DIST	= autogen.sh iptables-test.py xlate-test.py
+
 if ENABLE_NFTABLES
 confdir		= $(sysconfdir)
-dist_conf_DATA	= etc/ethertypes
+dist_conf_DATA	= etc/ethertypes etc/xtables.conf
 endif
 
 .PHONY: tarball
diff --git a/extensions/GNUmakefile.in b/extensions/GNUmakefile.in
index 188e7a7902566..c37e4619f91f9 100644
--- a/extensions/GNUmakefile.in
+++ b/extensions/GNUmakefile.in
@@ -79,7 +79,7 @@ targets_install :=
 
 .SECONDARY:
 
-.PHONY: all install uninstall clean distclean FORCE
+.PHONY: all install uninstall clean distclean FORCE dvi check installcheck
 
 all: ${targets}
 
@@ -235,3 +235,16 @@ matches.man: ${initext_depfiles} $(wildcard ${srcdir}/lib*.man)
 
 targets.man: ${initext_depfiles} $(wildcard ${srcdir}/lib*.man)
 	$(call man_run,$(call ex_targets,${pfx_build_mod} ${pfb_build_mod} ${pfa_build_mod} ${pf4_build_mod} ${pf6_build_mod} ${pfx_symlinks}))
+
+dist_initext_src = $(addprefix $(srcdir)/,${initext_sources})
+dist_sources = $(filter-out ${dist_initext_src},$(wildcard $(srcdir)/*.[ch]))
+
+distdir:
+	mkdir -p $(distdir)
+	cp -p ${dist_sources} $(distdir)/
+	cp -p $(wildcard ${srcdir}/lib*.man) $(distdir)/
+	cp -p $(srcdir)/*.{t,txlate} $(distdir)/
+
+dvi:
+check: all
+installcheck:
diff --git a/include/Makefile.am b/include/Makefile.am
index ea34c2fef0d98..348488a45ce84 100644
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -11,6 +11,8 @@ nobase_include_HEADERS += \
 	libiptc/ipt_kernel_headers.h libiptc/libiptc.h \
 	libiptc/libip6tc.h libiptc/libxtc.h libiptc/xtcshared.h
 
+EXTRA_DIST = iptables linux iptables.h ip6tables.h
+
 uninstall-hook:
 	dir=${includedir}/libiptc; { \
 		test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; \
diff --git a/iptables/Makefile.am b/iptables/Makefile.am
index b0f81d14a6451..ec3895e9cba30 100644
--- a/iptables/Makefile.am
+++ b/iptables/Makefile.am
@@ -63,7 +63,8 @@ man_MANS         = iptables.8 iptables-restore.8 iptables-save.8 \
                    ip6tables-save.8 iptables-extensions.8 \
                    iptables-apply.8 ip6tables-apply.8
 
-sbin_SCRIPTS     = iptables-apply
+dist_sbin_SCRIPTS = iptables-apply
+dist_pkgdata_DATA = iptables.xslt
 
 if ENABLE_NFTABLES
 man_MANS	+= iptables-translate.8 ip6tables-translate.8 \
@@ -144,3 +145,5 @@ pkgconfig_DATA = xtables.pc
 		); \
 		( cd "$$dir" && rm -f ip6tables-apply ); \
 	}
+
+EXTRA_DIST = tests
diff --git a/libipq/Makefile.am b/libipq/Makefile.am
index 2cdaf32e03292..68da15fe56439 100644
--- a/libipq/Makefile.am
+++ b/libipq/Makefile.am
@@ -6,7 +6,7 @@ AM_LDFLAGS = ${regular_LDFLAGS}
 
 libipq_la_SOURCES = libipq.c
 lib_LTLIBRARIES   = libipq.la
-man_MANS         = ipq_create_handle.3 ipq_destroy_handle.3 ipq_errstr.3 \
+dist_man_MANS    = ipq_create_handle.3 ipq_destroy_handle.3 ipq_errstr.3 \
                    ipq_get_msgerr.3 ipq_get_packet.3 ipq_message_type.3 \
                    ipq_perror.3 ipq_read.3 ipq_set_mode.3 ipq_set_verdict.3 \
                    libipq.3
diff --git a/libiptc/Makefile.am b/libiptc/Makefile.am
index 097842f212bb5..d8fe169e32487 100644
--- a/libiptc/Makefile.am
+++ b/libiptc/Makefile.am
@@ -11,3 +11,5 @@ libip4tc_la_SOURCES = libip4tc.c
 libip4tc_la_LDFLAGS = -version-info 2:0:0
 libip6tc_la_SOURCES = libip6tc.c
 libip6tc_la_LDFLAGS = -version-info 2:0:0
+
+EXTRA_DIST = libiptc.c linux_list.h
diff --git a/utils/Makefile.am b/utils/Makefile.am
index 327a29e028c4d..e9eec48ffc3b5 100644
--- a/utils/Makefile.am
+++ b/utils/Makefile.am
@@ -6,13 +6,13 @@ AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include \
 AM_LDFLAGS = ${regular_LDFLAGS}
 
 sbin_PROGRAMS =
-pkgdata_DATA =
+dist_pkgdata_DATA =
 man_MANS =
 
 if HAVE_LIBNFNETLINK
 man_MANS += nfnl_osf.8
 sbin_PROGRAMS += nfnl_osf
-pkgdata_DATA += pf.os
+dist_pkgdata_DATA += pf.os
 
 nfnl_osf_LDADD = ${libnfnetlink_LIBS}
 
-- 
2.38.0

[iptables PATCH 08/11] Makefile: Generate .tar.bz2 archive with 'make dist'

[Phil Sutter]

Instead of the default .tar.gz one.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 Makefile.am | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile.am b/Makefile.am
index 1292f4b7065f4..4a5c6fd41e8fd 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1,7 +1,7 @@
 # -*- Makefile -*-
 
 ACLOCAL_AMFLAGS  = -I m4
-AUTOMAKE_OPTIONS = foreign subdir-objects
+AUTOMAKE_OPTIONS = foreign subdir-objects dist-bzip2 no-dist-gzip
 
 SUBDIRS          = libiptc libxtables
 if ENABLE_DEVEL
-- 
2.38.0

Re: [iptables PATCH 08/11] Makefile: Generate .tar.bz2 archive with 'make dist'

[Jan Engelhardt]

On Wednesday 2022-12-07 18:44, Phil Sutter wrote:

>Instead of the default .tar.gz one.

I get the feeling that at this point (in time), bzip2 as compression 
does not make much sense anymore. If targeting size, the win goes to 
LZMA-class compressors (e.g. xz), if targeting speed, the win goes to 
LZ/deflate-ish compressors (e.g. gzip, zstd).

Re: [iptables PATCH 08/11] Makefile: Generate .tar.bz2 archive with 'make dist'

[Phil Sutter]

On Wed, Dec 07, 2022 at 07:45:30PM +0100, Jan Engelhardt wrote:
> On Wednesday 2022-12-07 18:44, Phil Sutter wrote:
> 
> >Instead of the default .tar.gz one.
> 
> I get the feeling that at this point (in time), bzip2 as compression 
> does not make much sense anymore. If targeting size, the win goes to 
> LZMA-class compressors (e.g. xz), if targeting speed, the win goes to 
> LZ/deflate-ish compressors (e.g. gzip, zstd).

Yes, the discussion is moot with only 4.6MB to be compressed. FWIW:

| 4.6M	iptables-1.8.8.tar
| 984K	iptables-1.8.8.tar.gz
| 772K	iptables-1.8.8.tar.bz2
| 636K	iptables-1.8.8.tar.xz

Moving to LZMA is trivial from a Makefile's point of view, but most
packagers will have extra work adjusting for the new file name if we
move away from bzip2.

Cheers, Phil

Re: [iptables PATCH 08/11] Makefile: Generate .tar.bz2 archive with 'make dist'

[Jan Engelhardt]

On Wednesday 2022-12-07 19:56, Phil Sutter wrote:
>On Wed, Dec 07, 2022 at 07:45:30PM +0100, Jan Engelhardt wrote:
>
>| 984K	iptables-1.8.8.tar.gz
>| 772K	iptables-1.8.8.tar.bz2
>| 636K	iptables-1.8.8.tar.xz
>
>Moving to LZMA is trivial from a Makefile's point of view, but
>most packagers will have extra work adjusting for the new file name

How hard could it be? Surely they'll manage to change _three
characters_ (or perhaps even ten, to manually run /usr/bin/<thing> if
there's no suffix autodetection) in their build recipe, right?

Re: [iptables PATCH 08/11] Makefile: Generate .tar.bz2 archive with 'make dist'

[Phil Sutter]

On Wed, Dec 07, 2022 at 08:13:56PM +0100, Jan Engelhardt wrote:
> 
> On Wednesday 2022-12-07 19:56, Phil Sutter wrote:
> >On Wed, Dec 07, 2022 at 07:45:30PM +0100, Jan Engelhardt wrote:
> >
> >| 984K	iptables-1.8.8.tar.gz
> >| 772K	iptables-1.8.8.tar.bz2
> >| 636K	iptables-1.8.8.tar.xz
> >
> >Moving to LZMA is trivial from a Makefile's point of view, but
> >most packagers will have extra work adjusting for the new file name
> 
> How hard could it be? Surely they'll manage to change _three
> characters_ (or perhaps even ten, to manually run /usr/bin/<thing> if
> there's no suffix autodetection) in their build recipe, right?

Hey, if we're discussing almost negligible size reduction, I want to
discuss almost negligible extra effort, too! :D

Pablo, you're doing the legwork when it comes to releases, what's your
opinion?

Cheers, Phil

Re: [iptables PATCH 08/11] Makefile: Generate .tar.bz2 archive with 'make dist'

[Pablo Neira Ayuso]

On Wed, Dec 07, 2022 at 09:55:46PM +0100, Phil Sutter wrote:
> On Wed, Dec 07, 2022 at 08:13:56PM +0100, Jan Engelhardt wrote:
> > 
> > On Wednesday 2022-12-07 19:56, Phil Sutter wrote:
> > >On Wed, Dec 07, 2022 at 07:45:30PM +0100, Jan Engelhardt wrote:
> > >
> > >| 984K	iptables-1.8.8.tar.gz
> > >| 772K	iptables-1.8.8.tar.bz2
> > >| 636K	iptables-1.8.8.tar.xz
> > >
> > >Moving to LZMA is trivial from a Makefile's point of view, but
> > >most packagers will have extra work adjusting for the new file name
> > 
> > How hard could it be? Surely they'll manage to change _three
> > characters_ (or perhaps even ten, to manually run /usr/bin/<thing> if
> > there's no suffix autodetection) in their build recipe, right?
> 
> Hey, if we're discussing almost negligible size reduction, I want to
> discuss almost negligible extra effort, too! :D
> 
> Pablo, you're doing the legwork when it comes to releases, what's your
> opinion?

Please, whoever feels like, go ahead and just send patches to generate
lzma files in userspace netfilter tree wide, I remember this was
discussed in the past.

Thanks.

[iptables PATCH 09/11] include/Makefile: xtables-version.h is generated

[Phil Sutter]

List it in nodist_include_HEADERS so it is installed but not
distributed - configure generates it from xtables-version.h.in.

While being at it, list xtables.h in plain include_HEADERS. It doesn't
sit in a sub-dir, so the nobase prefix does not make a difference.

Fixes: df60a301bf24c ("build: separate AC variable replacements from xtables.h")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 include/Makefile.am | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/Makefile.am b/include/Makefile.am
index 348488a45ce84..07c88b901e808 100644
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -1,13 +1,13 @@
 # -*- Makefile -*-
 
-include_HEADERS =
-nobase_include_HEADERS = xtables.h xtables-version.h
+include_HEADERS = xtables.h
+nodist_include_HEADERS = xtables-version.h
 
 if ENABLE_LIBIPQ
 include_HEADERS += libipq/libipq.h
 endif
 
-nobase_include_HEADERS += \
+nobase_include_HEADERS = \
 	libiptc/ipt_kernel_headers.h libiptc/libiptc.h \
 	libiptc/libip6tc.h libiptc/libxtc.h libiptc/xtcshared.h
 
-- 
2.38.0

[iptables PATCH 10/11] tests: Adjust testsuite return codes to automake guidelines

[Phil Sutter]

As per the manual[1]:

"When no test protocol is in use, an exit status of 0 from a test script
will denote a success, an exit status of 77 a skipped test, an exit
status of 99 a hard error, and any other exit status will denote a
failure."

[1] https://www.gnu.org/software/automake/manual/html_node/Scripts_002dbased-Testsuites.html

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 iptables-test.py                  | 2 +-
 iptables/tests/shell/run-tests.sh | 4 +++-
 xlate-test.py                     | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/iptables-test.py b/iptables-test.py
index dc031c2b60450..de1e1e95fda55 100755
--- a/iptables-test.py
+++ b/iptables-test.py
@@ -579,7 +579,7 @@ STDERR_IS_TTY = sys.stderr.isatty()
 
     if os.getuid() != 0:
         print("You need to be root to run this, sorry", file=sys.stderr)
-        return
+        return 77
 
     if not args.netns and not args.no_netns and not spawn_netns():
         print("Cannot run in own namespace, connectivity might break",
diff --git a/iptables/tests/shell/run-tests.sh b/iptables/tests/shell/run-tests.sh
index 7a80af3432285..1125690583b46 100755
--- a/iptables/tests/shell/run-tests.sh
+++ b/iptables/tests/shell/run-tests.sh
@@ -21,7 +21,6 @@ EOF
 
 msg_error() {
         echo "E: $1 ..." >&2
-        exit 1
 }
 
 msg_warn() {
@@ -34,10 +33,12 @@ msg_info() {
 
 if [ "$(id -u)" != "0" ] ; then
         msg_error "this requires root!"
+        exit 77
 fi
 
 if [ ! -d "$TESTDIR" ] ; then
         msg_error "missing testdir $TESTDIR"
+        exit 99
 fi
 
 # support matching repeated pattern in SINGLE check below
@@ -76,6 +77,7 @@ while [ -n "$1" ]; do
 		;;
 	*)
 		msg_error "unknown parameter '$1'"
+		exit 99
 		;;
 	esac
 done
diff --git a/xlate-test.py b/xlate-test.py
index 4f037ef6ed96d..4cb1401b71677 100755
--- a/xlate-test.py
+++ b/xlate-test.py
@@ -250,7 +250,7 @@ xtables_nft_multi = 'xtables-nft-multi'
                 tests, passed, failed, errors = run_test(args.test, payload)
         except IOError:
             print(red("Error: ") + "test file does not exist", file=sys.stderr)
-            return -1
+            return 99
     else:
         files, tests, passed, failed, errors = load_test_files()
 
-- 
2.38.0

[iptables PATCH 11/11] Makefile.am: Integrate testsuites

[Phil Sutter]

Support calling 'make check' in topdir to run all three testsuites.
While updating .gitignore, also add 'configure~' my autotools create and
the tags file.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 .gitignore  | 12 ++++++++++++
 Makefile.am |  2 ++
 2 files changed, 14 insertions(+)

diff --git a/.gitignore b/.gitignore
index a206fb4870bc8..ec4e44cad8aa7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,6 +20,7 @@ Makefile.in
 /build-aux/
 /config.*
 /configure
+/configure~
 /libtool
 /stamp-h1
 /iptables/iptables-apply.8
@@ -29,3 +30,14 @@ Makefile.in
 
 # vim/nano swap file
 *.swp
+
+/tags
+
+# make check results
+/test-suite.log
+/iptables-test.py.log
+/iptables-test.py.trs
+/xlate-test.py.log
+/xlate-test.py.trs
+iptables/tests/shell/run-tests.sh.log
+iptables/tests/shell/run-tests.sh.trs
diff --git a/Makefile.am b/Makefile.am
index 4a5c6fd41e8fd..b2f4b9f599ceb 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -33,3 +33,5 @@ endif
 
 config.status: extensions/GNUmakefile.in \
 	include/xtables-version.h.in
+
+TESTS = xlate-test.py iptables-test.py iptables/tests/shell/run-tests.sh
-- 
2.38.0