+static struct xtables_match *prepare_matches(struct connman_iptables *table,
+ struct xtables_rule_match **xt_rm, char *match_name)
+{
+ struct xtables_match *xt_m;
+ size_t match_size;
+
+ if (match_name == NULL)
+ return NULL;
+
+ xt_m = xtables_find_match(match_name, XTF_LOAD_MUST_SUCCEED, xt_rm);
+ match_size = ALIGN(sizeof(struct ipt_entry_match)) + xt_m->size;
+
+ xt_m->m = g_try_malloc0(match_size);
+ if (xt_m->m == NULL)
+ return NULL;
+
+ xt_m->m->u.match_size = match_size;
+ strcpy(xt_m->m->u.user.name, xt_m->name);
+ xt_m->m->u.user.revision = xt_m->revision;
+
+ if (xt_m->init != NULL)
+ xt_m->init(xt_m->m);
+
+ if (xt_m == xt_m->next)
+ goto done;
+
+#if XTABLES_VERSION_CODE > 5
+ if (xt_m->x6_options != NULL)
+ iptables_globals.opts =
+ xtables_options_xfrm(
+ iptables_globals.orig_opts,
+ iptables_globals.opts,
+ xt_m->x6_options,
+ &xt_m->option_offset);
+ else
+#endif
+ iptables_globals.opts =
+ xtables_merge_options(
+#if XTABLES_VERSION_CODE > 5
+ iptables_globals.orig_opts,
+#endif
+ iptables_globals.opts,
+ xt_m->extra_opts,
+ &xt_m->option_offset);
+
+ if (iptables_globals.opts == NULL) {
+ g_free(xt_m->m);
+ xt_m = NULL;
+ }
+
+done:
+ return xt_m;
+}
+
+static int parse_ip_and_mask(const char *str, struct in_addr *ip, struct in_addr *mask)
+{
+ char **tokens;
+ uint32_t prefixlength;
+ uint32_t tmp;
+ int err;
+
+ tokens = g_strsplit(str, "/", 2);
+ if (tokens == NULL)
+ return -1;
+
+ if (!inet_pton(AF_INET, tokens[0], ip)) {
+ err = -1;
+ goto out;
+ }
+
+ if (tokens[1] != NULL) {
+ prefixlength = strtol(tokens[1], NULL, 10);
+ if (prefixlength > 31) {
+ err = -1;
+ goto out;
+ }
+
+ tmp = ~(0xffffffff >> prefixlength);
+ } else {
+ tmp = 0xffffffff;
+ }
+
+ mask->s_addr = htonl(tmp);
+ ip->s_addr = ip->s_addr & mask->s_addr;
+ err = 0;
+out:
+ g_strfreev(tokens);
+
+ return err;
+}
+