]> git.pld-linux.org Git - packages/kernel.git/blame - 2.6.5-patch-o-matic-ng-base-20040330.patch
projects / packages / kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- CSZ scheduler removed from kernel tree.
[packages/kernel.git] / 2.6.5-patch-o-matic-ng-base-20040330.patch
CommitLineData
8cc4a74e 1diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter.h linux-2.6.5-rc3/include/linux/netfilter.h
2--- linux-2.6.5-rc3.org/include/linux/netfilter.h 2004-03-30 05:26:16.000000000 +0200
3+++ linux-2.6.5-rc3/include/linux/netfilter.h 2004-03-30 11:10:29.000000000 +0200
4@@ -99,6 +99,24 @@
5
6 extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
7
8+typedef void nf_logfn(unsigned int hooknum,
9+ const struct sk_buff *skb,
10+ const struct net_device *in,
11+ const struct net_device *out,
12+ const char *prefix);
13+
14+/* Function to register/unregister log function. */
15+int nf_log_register(int pf, nf_logfn *logfn);
16+void nf_log_unregister(int pf, nf_logfn *logfn);
17+
18+/* Calls the registered backend logging function */
19+void nf_log_packet(int pf,
20+ unsigned int hooknum,
21+ const struct sk_buff *skb,
22+ const struct net_device *in,
23+ const struct net_device *out,
24+ const char *fmt, ...);
25+
26 /* Activate hook; either okfn or kfree_skb called, unless a hook
27 returns NF_STOLEN (in which case, it's up to the hook to deal with
28 the consequences).
29diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ip_conntrack.h
30--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ip_conntrack.h 2004-03-30 05:27:17.000000000 +0200
31+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ip_conntrack.h 2004-03-30 11:11:27.000000000 +0200
32@@ -251,6 +251,9 @@
33 /* Call me when a conntrack is destroyed. */
34 extern void (*ip_conntrack_destroyed)(struct ip_conntrack *conntrack);
35
36+/* Fake conntrack entry for untracked connections */
37+extern struct ip_conntrack ip_conntrack_untracked;
38+
39 /* Returns new sk_buff, or NULL */
40 struct sk_buff *
41 ip_ct_gather_frags(struct sk_buff *skb);
42diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ip_pool.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ip_pool.h
43--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ip_pool.h 1970-01-01 01:00:00.000000000 +0100
44+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ip_pool.h 2004-03-30 11:11:17.000000000 +0200
45@@ -0,0 +1,64 @@
46+#ifndef _IP_POOL_H
47+#define _IP_POOL_H
48+
49+/***************************************************************************/
50+/* This program is free software; you can redistribute it and/or modify */
51+/* it under the terms of the GNU General Public License as published by */
52+/* the Free Software Foundation; either version 2 of the License, or */
53+/* (at your option) any later version. */
54+/* */
55+/* This program is distributed in the hope that it will be useful, */
56+/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
57+/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
58+/* GNU General Public License for more details. */
59+/* */
60+/* You should have received a copy of the GNU General Public License */
61+/* along with this program; if not, write to the Free Software */
62+/* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA*/
63+/***************************************************************************/
64+
65+/* A sockopt of such quality has hardly ever been seen before on the open
66+ * market! This little beauty, hardly ever used: above 64, so it's
67+ * traditionally used for firewalling, not touched (even once!) by the
68+ * 2.0, 2.2 and 2.4 kernels!
69+ *
70+ * Comes with its own certificate of authenticity, valid anywhere in the
71+ * Free world!
72+ *
73+ * Rusty, 19.4.2000
74+ */
75+#define SO_IP_POOL 81
76+
77+typedef int ip_pool_t; /* pool index */
78+#define IP_POOL_NONE ((ip_pool_t)-1)
79+
80+struct ip_pool_request {
81+ int op;
82+ ip_pool_t index;
83+ u_int32_t addr;
84+ u_int32_t addr2;
85+};
86+
87+/* NOTE: I deliberately break the first cut ippool utility. Nobody uses it. */
88+
89+#define IP_POOL_BAD001 0x00000010
90+
91+#define IP_POOL_FLUSH 0x00000011 /* req.index, no arguments */
92+#define IP_POOL_INIT 0x00000012 /* from addr to addr2 incl. */
93+#define IP_POOL_DESTROY 0x00000013 /* req.index, no arguments */
94+#define IP_POOL_ADD_ADDR 0x00000014 /* add addr to pool */
95+#define IP_POOL_DEL_ADDR 0x00000015 /* del addr from pool */
96+#define IP_POOL_HIGH_NR 0x00000016 /* result in req.index */
97+#define IP_POOL_LOOKUP 0x00000017 /* result in addr and addr2 */
98+#define IP_POOL_USAGE 0x00000018 /* result in addr */
99+#define IP_POOL_TEST_ADDR 0x00000019 /* result (0/1) returned */
100+
101+#ifdef __KERNEL__
102+
103+/* NOTE: ip_pool_match() and ip_pool_mod() expect ADDR to be host byte order */
104+extern int ip_pool_match(ip_pool_t pool, u_int32_t addr);
105+extern int ip_pool_mod(ip_pool_t pool, u_int32_t addr, int isdel);
106+
107+#endif
108+
109+#endif /*_IP_POOL_H*/
110diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_NETLINK.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_NETLINK.h
111--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_NETLINK.h 1970-01-01 01:00:00.000000000 +0100
112+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_NETLINK.h 2004-03-30 11:10:39.000000000 +0200
113@@ -0,0 +1,27 @@
114+#ifndef _IPT_FWMON_H
115+#define _IPT_FWMON_H
116+
117+/* Bitmask macros */
118+#define MASK(x,y) (x & y)
119+#define MASK_SET(x,y) x |= y
120+#define MASK_UNSET(x,y) x &= ~y
121+
122+#define USE_MARK 0x00000001
123+#define USE_DROP 0x00000002
124+#define USE_SIZE 0x00000004
125+
126+struct ipt_nldata
127+{
128+ unsigned int flags;
129+ unsigned int mark;
130+ unsigned int size;
131+};
132+
133+/* Old header */
134+struct netlink_t {
135+ unsigned int len;
136+ unsigned int mark;
137+ char iface[IFNAMSIZ];
138+};
139+
140+#endif /*_IPT_FWMON_H*/
141diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_TTL.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_TTL.h
142--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_TTL.h 1970-01-01 01:00:00.000000000 +0100
143+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_TTL.h 2004-03-30 11:10:42.000000000 +0200
144@@ -0,0 +1,21 @@
145+/* TTL modification module for IP tables
146+ * (C) 2000 by Harald Welte <laforge@gnumonks.org> */
147+
148+#ifndef _IPT_TTL_H
149+#define _IPT_TTL_H
150+
151+enum {
152+ IPT_TTL_SET = 0,
153+ IPT_TTL_INC,
154+ IPT_TTL_DEC
155+};
156+
157+#define IPT_TTL_MAXMODE IPT_TTL_DEC
158+
159+struct ipt_TTL_info {
160+ u_int8_t mode;
161+ u_int8_t ttl;
162+};
163+
164+
165+#endif
166diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_ULOG.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_ULOG.h
167--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_ULOG.h 2004-03-30 05:26:10.000000000 +0200
168+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_ULOG.h 2004-03-30 11:10:29.000000000 +0200
169@@ -11,6 +11,9 @@
170 #define NETLINK_NFLOG 5
171 #endif
172
173+#define ULOG_DEFAULT_NLGROUP 1
174+#define ULOG_DEFAULT_QTHRESHOLD 1
175+
176 #define ULOG_MAC_LEN 80
177 #define ULOG_PREFIX_LEN 32
178
179diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_connlimit.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_connlimit.h
180--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_connlimit.h 1970-01-01 01:00:00.000000000 +0100
181+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_connlimit.h 2004-03-30 11:10:45.000000000 +0200
182@@ -0,0 +1,12 @@
183+#ifndef _IPT_CONNLIMIT_H
184+#define _IPT_CONNLIMIT_H
185+
186+struct ipt_connlimit_data;
187+
188+struct ipt_connlimit_info {
189+ int limit;
190+ int inverse;
191+ u_int32_t mask;
192+ struct ipt_connlimit_data *data;
193+};
194+#endif /* _IPT_CONNLIMIT_H */
195diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_conntrack.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_conntrack.h
196--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_conntrack.h 2004-03-30 05:27:00.000000000 +0200
197+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_conntrack.h 2004-03-30 11:11:27.000000000 +0200
198@@ -10,6 +10,7 @@
199
200 #define IPT_CONNTRACK_STATE_SNAT (1 << (IP_CT_NUMBER + 1))
201 #define IPT_CONNTRACK_STATE_DNAT (1 << (IP_CT_NUMBER + 2))
202+#define IPT_CONNTRACK_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 3))
203
204 /* flags, invflags: */
205 #define IPT_CONNTRACK_STATE 0x01
206diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_dstlimit.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_dstlimit.h
207--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_dstlimit.h 1970-01-01 01:00:00.000000000 +0100
208+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_dstlimit.h 2004-03-30 11:10:47.000000000 +0200
209@@ -0,0 +1,39 @@
210+#ifndef _IPT_DSTLIMIT_H
211+#define _IPT_DSTLIMIT_H
212+
213+/* timings are in milliseconds. */
214+#define IPT_DSTLIMIT_SCALE 10000
215+/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
216+ seconds, or one every 59 hours. */
217+
218+/* details of this structure hidden by the implementation */
219+struct ipt_dstlimit_htable;
220+
221+#define IPT_DSTLIMIT_HASH_DIP 0x0001
222+#define IPT_DSTLIMIT_HASH_DPT 0x0002
223+#define IPT_DSTLIMIT_HASH_SIP 0x0004
224+
225+struct dstlimit_cfg {
226+ u_int32_t mode; /* bitmask of IPT_DSTLIMIT_HASH_* */
227+ u_int32_t avg; /* Average secs between packets * scale */
228+ u_int32_t burst; /* Period multiplier for upper limit. */
229+
230+ /* user specified */
231+ u_int32_t size; /* how many buckets */
232+ u_int32_t max; /* max number of entries */
233+ u_int32_t gc_interval; /* gc interval */
234+ u_int32_t expire; /* when do entries expire? */
235+};
236+
237+struct ipt_dstlimit_info {
238+ char name [IFNAMSIZ]; /* name */
239+ struct dstlimit_cfg cfg;
240+ struct ipt_dstlimit_htable *hinfo;
241+
242+ /* Used internally by the kernel */
243+ union {
244+ void *ptr;
245+ struct ipt_dstlimit_info *master;
246+ } u;
247+};
248+#endif /*_IPT_DSTLIMIT_H*/
249diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_fuzzy.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_fuzzy.h
250--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_fuzzy.h 1970-01-01 01:00:00.000000000 +0100
251+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_fuzzy.h 2004-03-30 11:11:06.000000000 +0200
252@@ -0,0 +1,21 @@
253+#ifndef _IPT_FUZZY_H
254+#define _IPT_FUZZY_H
255+
256+#include <linux/param.h>
257+#include <linux/types.h>
258+
259+#define MAXFUZZYRATE 10000000
260+#define MINFUZZYRATE 3
261+
262+struct ipt_fuzzy_info {
263+ u_int32_t minimum_rate;
264+ u_int32_t maximum_rate;
265+ u_int32_t packets_total;
266+ u_int32_t bytes_total;
267+ u_int32_t previous_time;
268+ u_int32_t present_time;
269+ u_int32_t mean_rate;
270+ u_int8_t acceptance_rate;
271+};
272+
273+#endif /*_IPT_FUZZY_H*/
274diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_ipv4options.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_ipv4options.h
275--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_ipv4options.h 1970-01-01 01:00:00.000000000 +0100
276+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_ipv4options.h 2004-03-30 11:11:08.000000000 +0200
277@@ -0,0 +1,21 @@
278+#ifndef __ipt_ipv4options_h_included__
279+#define __ipt_ipv4options_h_included__
280+
281+#define IPT_IPV4OPTION_MATCH_SSRR 0x01 /* For strict source routing */
282+#define IPT_IPV4OPTION_MATCH_LSRR 0x02 /* For loose source routing */
283+#define IPT_IPV4OPTION_DONT_MATCH_SRR 0x04 /* any source routing */
284+#define IPT_IPV4OPTION_MATCH_RR 0x08 /* For Record route */
285+#define IPT_IPV4OPTION_DONT_MATCH_RR 0x10
286+#define IPT_IPV4OPTION_MATCH_TIMESTAMP 0x20 /* For timestamp request */
287+#define IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP 0x40
288+#define IPT_IPV4OPTION_MATCH_ROUTER_ALERT 0x80 /* For router-alert */
289+#define IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT 0x100
290+#define IPT_IPV4OPTION_MATCH_ANY_OPT 0x200 /* match packet with any option */
291+#define IPT_IPV4OPTION_DONT_MATCH_ANY_OPT 0x400 /* match packet with no option */
292+
293+struct ipt_ipv4options_info {
294+ u_int16_t options;
295+};
296+
297+
298+#endif /* __ipt_ipv4options_h_included__ */
299diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_mport.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_mport.h
300--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_mport.h 1970-01-01 01:00:00.000000000 +0100
301+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_mport.h 2004-03-30 11:11:11.000000000 +0200
302@@ -0,0 +1,24 @@
303+#ifndef _IPT_MPORT_H
304+#define _IPT_MPORT_H
305+#include <linux/netfilter_ipv4/ip_tables.h>
306+
307+#define IPT_MPORT_SOURCE (1<<0)
308+#define IPT_MPORT_DESTINATION (1<<1)
309+#define IPT_MPORT_EITHER (IPT_MPORT_SOURCE|IPT_MPORT_DESTINATION)
310+
311+#define IPT_MULTI_PORTS 15
312+
313+/* Must fit inside union ipt_matchinfo: 32 bytes */
314+/* every entry in ports[] except for the last one has one bit in pflags
315+ * associated with it. If this bit is set, the port is the first port of
316+ * a portrange, with the next entry being the last.
317+ * End of list is marked with pflags bit set and port=65535.
318+ * If 14 ports are used (last one does not have a pflag), the last port
319+ * is repeated to fill the last entry in ports[] */
320+struct ipt_mport
321+{
322+ u_int8_t flags:2; /* Type of comparison */
323+ u_int16_t pflags:14; /* Port flags */
324+ u_int16_t ports[IPT_MULTI_PORTS]; /* Ports */
325+};
326+#endif /*_IPT_MPORT_H*/
327diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_nth.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_nth.h
328--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_nth.h 1970-01-01 01:00:00.000000000 +0100
329+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_nth.h 2004-03-30 11:11:13.000000000 +0200
330@@ -0,0 +1,19 @@
331+#ifndef _IPT_NTH_H
332+#define _IPT_NTH_H
333+
334+#include <linux/param.h>
335+#include <linux/types.h>
336+
337+#ifndef IPT_NTH_NUM_COUNTERS
338+#define IPT_NTH_NUM_COUNTERS 16
339+#endif
340+
341+struct ipt_nth_info {
342+ u_int8_t every;
343+ u_int8_t not;
344+ u_int8_t startat;
345+ u_int8_t counter;
346+ u_int8_t packet;
347+};
348+
349+#endif /*_IPT_NTH_H*/
350diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_osf.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_osf.h
351--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_osf.h 1970-01-01 01:00:00.000000000 +0100
352+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_osf.h 2004-03-30 11:11:15.000000000 +0200
353@@ -0,0 +1,148 @@
354+/*
355+ * ipt_osf.h
356+ *
357+ * Copyright (c) 2003 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
358+ *
359+ *
360+ * This program is free software; you can redistribute it and/or modify
361+ * it under the terms of the GNU General Public License as published by
362+ * the Free Software Foundation; either version 2 of the License, or
363+ * (at your option) any later version.
364+ *
365+ * This program is distributed in the hope that it will be useful,
366+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
367+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
368+ * GNU General Public License for more details.
369+ *
370+ * You should have received a copy of the GNU General Public License
371+ * along with this program; if not, write to the Free Software
372+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
373+ */
374+
375+#ifndef _IPT_OSF_H
376+#define _IPT_OSF_H
377+
378+#define MAXGENRELEN 32
379+#define MAXDETLEN 64
380+
381+#define IPT_OSF_GENRE 1
382+#define IPT_OSF_SMART 2
383+#define IPT_OSF_LOG 4
384+#define IPT_OSF_NETLINK 8
385+
386+#define IPT_OSF_LOGLEVEL_ALL 0
387+#define IPT_OSF_LOGLEVEL_FIRST 1
388+
389+#include <linux/list.h>
390+
391+#ifndef __KERNEL__
392+#include <netinet/ip.h>
393+#include <netinet/tcp.h>
394+
395+struct list_head
396+{
397+ struct list_head *prev, *next;
398+};
399+#endif
400+
401+struct ipt_osf_info
402+{
403+ char genre[MAXGENRELEN];
404+ int len;
405+ unsigned long flags;
406+ int loglevel;
407+ int invert; /* UNSUPPORTED */
408+};
409+
410+struct osf_wc
411+{
412+ char wc;
413+ unsigned long val;
414+};
415+
416+/* This struct represents IANA options
417+ * http://www.iana.org/assignments/tcp-parameters
418+ */
419+struct osf_opt
420+{
421+ unsigned char kind;
422+ unsigned char length;
423+ struct osf_wc wc;
424+};
425+
426+struct osf_finger
427+{
428+ struct list_head flist;
429+ struct osf_wc wss;
430+ unsigned char ttl;
431+ unsigned char df;
432+ unsigned long ss;
433+ unsigned char genre[MAXGENRELEN];
434+ unsigned char version[MAXGENRELEN], subtype[MAXGENRELEN];
435+
436+ /* Not needed, but for consistency with original table from Michal Zalewski */
437+ unsigned char details[MAXDETLEN];
438+
439+ int opt_num;
440+ struct osf_opt opt[MAX_IPOPTLEN]; /* In case it is all NOP or EOL */
441+
442+};
443+
444+struct ipt_osf_nlmsg
445+{
446+ struct osf_finger f;
447+ struct iphdr ip;
448+ struct tcphdr tcp;
449+};
450+
451+#ifdef __KERNEL__
452+
453+/* Defines for IANA option kinds */
454+
455+#define OSFOPT_EOL 0 /* End of options */
456+#define OSFOPT_NOP 1 /* NOP */
457+#define OSFOPT_MSS 2 /* Maximum segment size */
458+#define OSFOPT_WSO 3 /* Window scale option */
459+#define OSFOPT_SACKP 4 /* SACK permitted */
460+#define OSFOPT_SACK 5 /* SACK */
461+#define OSFOPT_ECHO 6
462+#define OSFOPT_ECHOREPLY 7
463+#define OSFOPT_TS 8 /* Timestamp option */
464+#define OSFOPT_POCP 9 /* Partial Order Connection Permitted */
465+#define OSFOPT_POSP 10 /* Partial Order Service Profile */
466+/* Others are not used in current OSF */
467+
468+static struct osf_opt IANA_opts[] =
469+{
470+ {0, 1,},
471+ {1, 1,},
472+ {2, 4,},
473+ {3, 3,},
474+ {4, 2,},
475+ {5, 1 ,}, /* SACK length is not defined */
476+ {6, 6,},
477+ {7, 6,},
478+ {8, 10,},
479+ {9, 2,},
480+ {10, 3,},
481+ {11, 1,}, /* CC: Suppose 1 */
482+ {12, 1,}, /* the same */
483+ {13, 1,}, /* and here too */
484+ {14, 3,},
485+ {15, 1,}, /* TCP Alternate Checksum Data. Length is not defined */
486+ {16, 1,},
487+ {17, 1,},
488+ {18, 3,},
489+ {19, 18,},
490+ {20, 1,},
491+ {21, 1,},
492+ {22, 1,},
493+ {23, 1,},
494+ {24, 1,},
495+ {25, 1,},
496+ {26, 1,},
497+};
498+
499+#endif /* __KERNEL__ */
500+
501+#endif /* _IPT_OSF_H */
502diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_pool.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_pool.h
503--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_pool.h 1970-01-01 01:00:00.000000000 +0100
504+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_pool.h 2004-03-30 11:11:17.000000000 +0200
505@@ -0,0 +1,25 @@
506+#ifndef _IPT_POOL_H
507+#define _IPT_POOL_H
508+
509+#include <linux/netfilter_ipv4/ip_pool.h>
510+
511+#define IPT_POOL_INV_SRC 0x00000001
512+#define IPT_POOL_INV_DST 0x00000002
513+#define IPT_POOL_DEL_SRC 0x00000004
514+#define IPT_POOL_DEL_DST 0x00000008
515+#define IPT_POOL_INV_MOD_SRC 0x00000010
516+#define IPT_POOL_INV_MOD_DST 0x00000020
517+#define IPT_POOL_MOD_SRC_ACCEPT 0x00000040
518+#define IPT_POOL_MOD_DST_ACCEPT 0x00000080
519+#define IPT_POOL_MOD_SRC_DROP 0x00000100
520+#define IPT_POOL_MOD_DST_DROP 0x00000200
521+
522+/* match info */
523+struct ipt_pool_info
524+{
525+ ip_pool_t src;
526+ ip_pool_t dst;
527+ unsigned flags;
528+};
529+
530+#endif /*_IPT_POOL_H*/
531diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_psd.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_psd.h
532--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_psd.h 1970-01-01 01:00:00.000000000 +0100
533+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_psd.h 2004-03-30 11:11:18.000000000 +0200
534@@ -0,0 +1,40 @@
535+#ifndef _IPT_PSD_H
536+#define _IPT_PSD_H
537+
538+#include <linux/param.h>
539+#include <linux/types.h>
540+
541+/*
542+ * High port numbers have a lower weight to reduce the frequency of false
543+ * positives, such as from passive mode FTP transfers.
544+ */
545+#define PORT_WEIGHT_PRIV 3
546+#define PORT_WEIGHT_HIGH 1
547+
548+/*
549+ * Port scan detection thresholds: at least COUNT ports need to be scanned
550+ * from the same source, with no longer than DELAY ticks between ports.
551+ */
552+#define SCAN_MIN_COUNT 7
553+#define SCAN_MAX_COUNT (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
554+#define SCAN_WEIGHT_THRESHOLD SCAN_MAX_COUNT
555+#define SCAN_DELAY_THRESHOLD (HZ * 3)
556+
557+/*
558+ * Keep track of up to LIST_SIZE source addresses, using a hash table of
559+ * HASH_SIZE entries for faster lookups, but limiting hash collisions to
560+ * HASH_MAX source addresses per the same hash value.
561+ */
562+#define LIST_SIZE 0x100
563+#define HASH_LOG 9
564+#define HASH_SIZE (1 << HASH_LOG)
565+#define HASH_MAX 0x10
566+
567+struct ipt_psd_info {
568+ unsigned int weight_threshold;
569+ unsigned int delay_threshold;
570+ unsigned short lo_ports_weight;
571+ unsigned short hi_ports_weight;
572+};
573+
574+#endif /*_IPT_PSD_H*/
575diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_quota.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_quota.h
576--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_quota.h 1970-01-01 01:00:00.000000000 +0100
577+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_quota.h 2004-03-30 11:11:23.000000000 +0200
578@@ -0,0 +1,11 @@
579+#ifndef _IPT_QUOTA_H
580+#define _IPT_QUOTA_H
581+
582+/* print debug info in both kernel/netfilter module & iptable library */
583+//#define DEBUG_IPT_QUOTA
584+
585+struct ipt_quota_info {
586+ u_int64_t quota;
587+};
588+
589+#endif /*_IPT_QUOTA_H*/
590diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_random.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_random.h
591--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_random.h 1970-01-01 01:00:00.000000000 +0100
592+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_random.h 2004-03-30 11:11:26.000000000 +0200
593@@ -0,0 +1,11 @@
594+#ifndef _IPT_RAND_H
595+#define _IPT_RAND_H
596+
597+#include <linux/param.h>
598+#include <linux/types.h>
599+
600+struct ipt_rand_info {
601+ u_int8_t average;
602+};
603+
604+#endif /*_IPT_RAND_H*/
605diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_realm.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_realm.h
606--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_realm.h 1970-01-01 01:00:00.000000000 +0100
607+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_realm.h 2004-03-30 11:11:29.000000000 +0200
608@@ -0,0 +1,9 @@
609+#ifndef _IPT_REALM_H
610+#define _IPT_REALM_H
611+
612+struct ipt_realm_info {
613+ u_int32_t id;
614+ u_int32_t mask;
615+ u_int8_t invert;
616+};
617+#endif /*_IPT_REALM_H*/
618diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_sctp.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_sctp.h
619--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_sctp.h 1970-01-01 01:00:00.000000000 +0100
620+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_sctp.h 2004-03-30 11:11:32.000000000 +0200
621@@ -0,0 +1,107 @@
622+#ifndef _IPT_SCTP_H_
623+#define _IPT_SCTP_H_
624+
625+#define IPT_SCTP_SRC_PORTS 0x01
626+#define IPT_SCTP_DEST_PORTS 0x02
627+#define IPT_SCTP_CHUNK_TYPES 0x04
628+
629+#define IPT_SCTP_VALID_FLAGS 0x07
630+
631+#define ELEMCOUNT(x) (sizeof(x)/sizeof(x[0]))
632+
633+
634+struct ipt_sctp_flag_info {
635+ u_int8_t chunktype;
636+ u_int8_t flag;
637+ u_int8_t flag_mask;
638+};
639+
640+#define IPT_NUM_SCTP_FLAGS 4
641+
642+struct ipt_sctp_info {
643+ u_int16_t dpts[2]; /* Min, Max */
644+ u_int16_t spts[2]; /* Min, Max */
645+
646+ u_int32_t chunkmap[256 / sizeof (u_int32_t)]; /* Bit mask of chunks to be matched according to RFC 2960 */
647+
648+#define SCTP_CHUNK_MATCH_ANY 0x01 /* Match if any of the chunk types are present */
649+#define SCTP_CHUNK_MATCH_ALL 0x02 /* Match if all of the chunk types are present */
650+#define SCTP_CHUNK_MATCH_ONLY 0x04 /* Match if these are the only chunk types present */
651+
652+ u_int32_t chunk_match_type;
653+ struct ipt_sctp_flag_info flag_info[IPT_NUM_SCTP_FLAGS];
654+ int flag_count;
655+
656+ u_int32_t flags;
657+ u_int32_t invflags;
658+};
659+
660+#define bytes(type) (sizeof(type) * 8)
661+
662+#define SCTP_CHUNKMAP_SET(chunkmap, type) \
663+ do { \
664+ chunkmap[type / bytes(u_int32_t)] |= \
665+ 1 << (type % bytes(u_int32_t)); \
666+ } while (0)
667+
668+#define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \
669+ do { \
670+ chunkmap[type / bytes(u_int32_t)] &= \
671+ ~(1 << (type % bytes(u_int32_t))); \
672+ } while (0)
673+
674+#define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \
675+({ \
676+ (chunkmap[type / bytes (u_int32_t)] & \
677+ (1 << (type % bytes (u_int32_t)))) ? 1: 0; \
678+})
679+
680+#define SCTP_CHUNKMAP_RESET(chunkmap) \
681+ do { \
682+ int i; \
683+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
684+ chunkmap[i] = 0; \
685+ } while (0)
686+
687+#define SCTP_CHUNKMAP_SET_ALL(chunkmap) \
688+ do { \
689+ int i; \
690+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
691+ chunkmap[i] = ~0; \
692+ } while (0)
693+
694+#define SCTP_CHUNKMAP_COPY(destmap, srcmap) \
695+ do { \
696+ int i; \
697+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
698+ destmap[i] = srcmap[i]; \
699+ } while (0)
700+
701+#define SCTP_CHUNKMAP_IS_CLEAR(chunkmap) \
702+({ \
703+ int i; \
704+ int flag = 1; \
705+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) { \
706+ if (chunkmap[i]) { \
707+ flag = 0; \
708+ break; \
709+ } \
710+ } \
711+ flag; \
712+})
713+
714+#define SCTP_CHUNKMAP_IS_ALL_SET(chunkmap) \
715+({ \
716+ int i; \
717+ int flag = 1; \
718+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) { \
719+ if (chunkmap[i] != ~0) { \
720+ flag = 0; \
721+ break; \
722+ } \
723+ } \
724+ flag; \
725+})
726+
727+#endif /* _IPT_SCTP_H_ */
728+
729diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_state.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_state.h
730--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_state.h 2004-03-30 05:27:06.000000000 +0200
731+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_state.h 2004-03-30 11:11:27.000000000 +0200
732@@ -4,6 +4,8 @@
733 #define IPT_STATE_BIT(ctinfo) (1 << ((ctinfo)%IP_CT_IS_REPLY+1))
734 #define IPT_STATE_INVALID (1 << 0)
735
736+#define IPT_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 1))
737+
738 struct ipt_state_info
739 {
740 unsigned int statemask;
741diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_time.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_time.h
742--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_time.h 1970-01-01 01:00:00.000000000 +0100
743+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_time.h 2004-03-30 11:11:33.000000000 +0200
744@@ -0,0 +1,13 @@
745+#ifndef __ipt_time_h_included__
746+#define __ipt_time_h_included__
747+
748+
749+struct ipt_time_info {
750+ u_int8_t days_match; /* 1 bit per day. -SMTWTFS */
751+ u_int16_t time_start; /* 0 < time_start < 23*60+59 = 1439 */
752+ u_int16_t time_stop; /* 0:0 < time_stat < 23:59 */
753+ u_int8_t kerneltime; /* ignore skb time (and use kerneltime) or not. */
754+};
755+
756+
757+#endif /* __ipt_time_h_included__ */
758diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_u32.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_u32.h
759--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_u32.h 1970-01-01 01:00:00.000000000 +0100
760+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_u32.h 2004-03-30 11:11:35.000000000 +0200
761@@ -0,0 +1,40 @@
762+#ifndef _IPT_U32_H
763+#define _IPT_U32_H
764+#include <linux/netfilter_ipv4/ip_tables.h>
765+
766+enum ipt_u32_ops
767+{
768+ IPT_U32_AND,
769+ IPT_U32_LEFTSH,
770+ IPT_U32_RIGHTSH,
771+ IPT_U32_AT
772+};
773+
774+struct ipt_u32_location_element
775+{
776+ u_int32_t number;
777+ u_int8_t nextop;
778+};
779+struct ipt_u32_value_element
780+{
781+ u_int32_t min;
782+ u_int32_t max;
783+};
784+/* *** any way to allow for an arbitrary number of elements?
785+ for now I settle for a limit of 10 of each */
786+#define U32MAXSIZE 10
787+struct ipt_u32_test
788+{
789+ u_int8_t nnums;
790+ struct ipt_u32_location_element location[U32MAXSIZE+1];
791+ u_int8_t nvalues;
792+ struct ipt_u32_value_element value[U32MAXSIZE+1];
793+};
794+
795+struct ipt_u32
796+{
797+ u_int8_t ntests;
798+ struct ipt_u32_test tests[U32MAXSIZE+1];
799+};
800+
801+#endif /*_IPT_U32_H*/
802diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4.h linux-2.6.5-rc3/include/linux/netfilter_ipv4.h
803--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4.h 2004-03-30 05:27:05.000000000 +0200
804+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4.h 2004-03-30 11:11:27.000000000 +0200
805@@ -51,6 +51,8 @@
806
807 enum nf_ip_hook_priorities {
808 NF_IP_PRI_FIRST = INT_MIN,
809+ NF_IP_PRI_CONNTRACK_DEFRAG = -400,
810+ NF_IP_PRI_RAW = -300,
811 NF_IP_PRI_SELINUX_FIRST = -225,
812 NF_IP_PRI_CONNTRACK = -200,
813 NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
814diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_HL.h linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_HL.h
815--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_HL.h 1970-01-01 01:00:00.000000000 +0100
816+++ linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_HL.h 2004-03-30 11:10:35.000000000 +0200
817@@ -0,0 +1,22 @@
818+/* Hop Limit modification module for ip6tables
819+ * Maciej Soltysiak <solt@dns.toxicfilms.tv>
820+ * Based on HW's TTL module */
821+
822+#ifndef _IP6T_HL_H
823+#define _IP6T_HL_H
824+
825+enum {
826+ IP6T_HL_SET = 0,
827+ IP6T_HL_INC,
828+ IP6T_HL_DEC
829+};
830+
831+#define IP6T_HL_MAXMODE IP6T_HL_DEC
832+
833+struct ip6t_HL_info {
834+ u_int8_t mode;
835+ u_int8_t hop_limit;
836+};
837+
838+
839+#endif
840diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_REJECT.h linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_REJECT.h
841--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_REJECT.h 2004-03-30 05:25:30.000000000 +0200
842+++ linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_REJECT.h 2004-03-30 11:10:40.000000000 +0200
843@@ -2,15 +2,17 @@
844 #define _IP6T_REJECT_H
845
846 enum ip6t_reject_with {
847- IP6T_ICMP_NET_UNREACHABLE,
848- IP6T_ICMP_HOST_UNREACHABLE,
849- IP6T_ICMP_PROT_UNREACHABLE,
850- IP6T_ICMP_PORT_UNREACHABLE,
851- IP6T_ICMP_ECHOREPLY
852+ IP6T_ICMP6_NO_ROUTE,
853+ IP6T_ICMP6_ADM_PROHIBITED,
854+ IP6T_ICMP6_NOT_NEIGHBOUR,
855+ IP6T_ICMP6_ADDR_UNREACH,
856+ IP6T_ICMP6_PORT_UNREACH,
857+ IP6T_ICMP6_ECHOREPLY,
858+ IP6T_TCP_RESET
859 };
860
861 struct ip6t_reject_info {
862 enum ip6t_reject_with with; /* reject type */
863 };
864
865-#endif /*_IPT_REJECT_H*/
866+#endif /*_IP6T_REJECT_H*/
867diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_fuzzy.h linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_fuzzy.h
868--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_fuzzy.h 1970-01-01 01:00:00.000000000 +0100
869+++ linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_fuzzy.h 2004-03-30 11:11:06.000000000 +0200
870@@ -0,0 +1,21 @@
871+#ifndef _IP6T_FUZZY_H
872+#define _IP6T_FUZZY_H
873+
874+#include <linux/param.h>
875+#include <linux/types.h>
876+
877+#define MAXFUZZYRATE 10000000
878+#define MINFUZZYRATE 3
879+
880+struct ip6t_fuzzy_info {
881+ u_int32_t minimum_rate;
882+ u_int32_t maximum_rate;
883+ u_int32_t packets_total;
884+ u_int32_t bytes_total;
885+ u_int32_t previous_time;
886+ u_int32_t present_time;
887+ u_int32_t mean_rate;
888+ u_int8_t acceptance_rate;
889+};
890+
891+#endif /*_IP6T_FUZZY_H*/
892diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_nth.h linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_nth.h
893--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_nth.h 1970-01-01 01:00:00.000000000 +0100
894+++ linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_nth.h 2004-03-30 11:11:13.000000000 +0200
895@@ -0,0 +1,19 @@
896+#ifndef _IP6T_NTH_H
897+#define _IP6T_NTH_H
898+
899+#include <linux/param.h>
900+#include <linux/types.h>
901+
902+#ifndef IP6T_NTH_NUM_COUNTERS
903+#define IP6T_NTH_NUM_COUNTERS 16
904+#endif
905+
906+struct ip6t_nth_info {
907+ u_int8_t every;
908+ u_int8_t not;
909+ u_int8_t startat;
910+ u_int8_t counter;
911+ u_int8_t packet;
912+};
913+
914+#endif /*_IP6T_NTH_H*/
915diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_random.h linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_random.h
916--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_random.h 1970-01-01 01:00:00.000000000 +0100
917+++ linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_random.h 2004-03-30 11:11:26.000000000 +0200
918@@ -0,0 +1,11 @@
919+#ifndef _IP6T_RAND_H
920+#define _IP6T_RAND_H
921+
922+#include <linux/param.h>
923+#include <linux/types.h>
924+
925+struct ip6t_rand_info {
926+ u_int8_t average;
927+};
928+
929+#endif /*_IP6T_RAND_H*/
930diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/core/netfilter.c linux-2.6.5-rc3/net/core/netfilter.c
931--- linux-2.6.5-rc3.org/net/core/netfilter.c 2004-03-30 05:26:13.000000000 +0200
932+++ linux-2.6.5-rc3/net/core/netfilter.c 2004-03-30 11:10:29.000000000 +0200
933@@ -8,8 +8,10 @@
934 *
935 * February 2000: Modified by James Morris to have 1 queue per protocol.
936 * 15-Mar-2000: Added NF_REPEAT --RR.
937+ * 08-May-2003: Internal logging interface added by Jozsef Kadlecsik.
938 */
939 #include <linux/config.h>
940+#include <linux/kernel.h>
941 #include <linux/netfilter.h>
942 #include <net/protocol.h>
943 #include <linux/init.h>
944@@ -741,6 +743,72 @@
945 EXPORT_SYMBOL(skb_ip_make_writable);
946 #endif /*CONFIG_INET*/
947
948+/* Internal logging interface, which relies on the real
949+ LOG target modules */
950+
951+#define NF_LOG_PREFIXLEN 128
952+
953+static nf_logfn *nf_logging[NPROTO]; /* = NULL */
954+static int reported = 0;
955+static spinlock_t nf_log_lock = SPIN_LOCK_UNLOCKED;
956+
957+int nf_log_register(int pf, nf_logfn *logfn)
958+{
959+ int ret = -EBUSY;
960+
961+ /* Any setup of logging members must be done before
962+ * substituting pointer. */
963+ smp_wmb();
964+ spin_lock(&nf_log_lock);
965+ if (!nf_logging[pf]) {
966+ nf_logging[pf] = logfn;
967+ ret = 0;
968+ }
969+ spin_unlock(&nf_log_lock);
970+ return ret;
971+}
972+
973+void nf_log_unregister(int pf, nf_logfn *logfn)
974+{
975+ spin_lock(&nf_log_lock);
976+ if (nf_logging[pf] == logfn)
977+ nf_logging[pf] = NULL;
978+ spin_unlock(&nf_log_lock);
979+
980+ /* Give time to concurrent readers. */
981+ synchronize_net();
982+}
983+
984+void nf_log_packet(int pf,
985+ unsigned int hooknum,
986+ const struct sk_buff *skb,
987+ const struct net_device *in,
988+ const struct net_device *out,
989+ const char *fmt, ...)
990+{
991+ va_list args;
992+ char prefix[NF_LOG_PREFIXLEN];
993+ nf_logfn *logfn;
994+
995+ rcu_read_lock();
996+ logfn = nf_logging[pf];
997+ if (logfn) {
998+ va_start(args, fmt);
999+ vsnprintf(prefix, sizeof(prefix), fmt, args);
1000+ va_end(args);
1001+ /* We must read logging before nf_logfn[pf] */
1002+ smp_read_barrier_depends();
1003+ logfn(hooknum, skb, in, out, prefix);
1004+ } else if (!reported) {
1005+ printk(KERN_WARNING "nf_log_packet: can\'t log yet, "
1006+ "no backend logging module loaded in!\n");
1007+ reported++;
1008+ }
1009+ rcu_read_unlock();
1010+}
1011+EXPORT_SYMBOL(nf_log_register);
1012+EXPORT_SYMBOL(nf_log_unregister);
1013+EXPORT_SYMBOL(nf_log_packet);
1014
1015 /* This does not belong here, but ipt_REJECT needs it if connection
1016 tracking in use: without this, connection may not be in hash table,
1017diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/Kconfig linux-2.6.5-rc3/net/ipv4/netfilter/Kconfig
1018--- linux-2.6.5-rc3.org/net/ipv4/netfilter/Kconfig 2004-03-30 05:27:03.000000000 +0200
1019+++ linux-2.6.5-rc3/net/ipv4/netfilter/Kconfig 2004-03-30 11:11:35.000000000 +0200
1020@@ -579,5 +579,123 @@
1021
1022 To compile it as a module, choose M here. If unsure, say N.
1023
1024+config IP_NF_TARGET_IPV4OPTSSTRIP
1025+ tristate 'IPV4OPTSSTRIP target support'
1026+ depends on IP_NF_MANGLE
1027+ help
1028+
1029+config IP_NF_TARGET_NETLINK
1030+ tristate 'NETLINK target support'
1031+ depends on IP_NF_FILTER
1032+ help
1033+
1034+config IP_NF_TARGET_TTL
1035+ tristate 'TTL target support'
1036+ depends on IP_NF_MANGLE
1037+ help
1038+
1039+config IP_NF_MATCH_CONNLIMIT
1040+ tristate 'Connections/IP limit match support'
1041+ depends on IP_NF_IPTABLES
1042+ help
1043+
1044+config IP_NF_MATCH_DSTLIMIT
1045+ tristate 'dstlimit match support'
1046+ depends on IP_NF_IPTABLES
1047+ help
1048+
1049+config IP_NF_MATCH_FUZZY
1050+ tristate 'fuzzy match support'
1051+ depends on IP_NF_IPTABLES
1052+ help
1053+
1054+config IP_NF_MATCH_IPV4OPTIONS
1055+ tristate 'IPV4OPTIONS match support'
1056+ depends on IP_NF_IPTABLES
1057+ help
1058+
1059+config IP_NF_MATCH_MPORT
1060+ tristate 'Multiple port with ranges match support'
1061+ depends on IP_NF_IPTABLES
1062+ help
1063+
1064+config IP_NF_MATCH_NTH
1065+ tristate 'Nth match support'
1066+ depends on IP_NF_IPTABLES
1067+ help
1068+
1069+config IP_NF_MATCH_OSF
1070+ tristate 'OSF match support'
1071+ depends on IP_NF_IPTABLES
1072+ help
1073+
1074+config IP_POOL_STATISTICS
1075+ bool 'enable statistics on pool usage'
1076+ depends on IP_NF_POOL!=n
1077+
1078+config IP_NF_POOL
1079+ tristate 'IP address pool support'
1080+ depends on IP_NF_IPTABLES
1081+ help
1082+
1083+config IP_NF_MATCH_PSD
1084+ tristate 'psd match support'
1085+ depends on IP_NF_IPTABLES
1086+ help
1087+
1088+config IP_NF_MATCH_QUOTA
1089+ tristate 'quota match support'
1090+ depends on IP_NF_IPTABLES
1091+ help
1092+
1093+config IP_NF_MATCH_RANDOM
1094+ tristate 'random match support'
1095+ depends on IP_NF_IPTABLES
1096+ help
1097+
1098+config IP_NF_TARGET_NOTRACK
1099+ tristate 'NOTRACK target support'
1100+ depends on IP_NF_RAW
1101+ help
1102+ The NOTRACK target allows a select rule to specify
1103+ which packets *not* to enter the conntrack/NAT
1104+ subsystem with all the consequences (no ICMP error tracking,
1105+ no protocol helpers for the selected packets).
1106+
1107+ If you want to compile it as a module, say M here and read
1108+ <file:Documentation/modules.txt>. If unsure, say `N'.
1109+
1110+config IP_NF_RAW
1111+ tristate 'raw table support (required for NOTRACK/TRACE)'
1112+ depends on IP_NF_IPTABLES
1113+ help
1114+ This option adds a `raw' table to iptables. This table is the very
1115+ first in the netfilter framework and hooks in at the PREROUTING
1116+ and OUTPUT chains.
1117+
1118+ If you want to compile it as a module, say M here and read
1119+ <file:Documentation/modules.txt>. If unsure, say `N'.
1120+ help
1121+
1122+config IP_NF_MATCH_REALM
1123+ tristate 'realm match support'
1124+ depends on IP_NF_IPTABLES && NET_CLS_ROUTE
1125+ help
1126+
1127+config IP_NF_MATCH_SCTP
1128+ tristate 'SCTP protocol match support'
1129+ depends on IP_NF_IPTABLES
1130+ help
1131+
1132+config IP_NF_MATCH_TIME
1133+ tristate 'TIME match support'
1134+ depends on IP_NF_IPTABLES
1135+ help
1136+
1137+config IP_NF_MATCH_U32
1138+ tristate 'U32 match support'
1139+ depends on IP_NF_IPTABLES
1140+ help
1141+
1142 endmenu
1143
1144diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/Makefile linux-2.6.5-rc3/net/ipv4/netfilter/Makefile
1145--- linux-2.6.5-rc3.org/net/ipv4/netfilter/Makefile 2004-03-30 05:25:35.000000000 +0200
1146+++ linux-2.6.5-rc3/net/ipv4/netfilter/Makefile 2004-03-30 11:11:35.000000000 +0200
1147@@ -38,19 +38,44 @@
1148 obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
1149 obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
1150 obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
1151+obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
1152
1153 # matches
1154 obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
1155 obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
1156+obj-$(CONFIG_IP_NF_MATCH_SCTP) += ipt_sctp.o
1157+obj-$(CONFIG_IP_NF_MATCH_QUOTA) += ipt_quota.o
1158+obj-$(CONFIG_IP_NF_MATCH_DSTLIMIT) += ipt_dstlimit.o
1159 obj-$(CONFIG_IP_NF_MATCH_MARK) += ipt_mark.o
1160+obj-$(CONFIG_IP_NF_POOL) += ipt_pool.o ipt_POOL.o ip_pool.o
1161 obj-$(CONFIG_IP_NF_MATCH_MAC) += ipt_mac.o
1162 obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
1163
1164 obj-$(CONFIG_IP_NF_MATCH_PKTTYPE) += ipt_pkttype.o
1165 obj-$(CONFIG_IP_NF_MATCH_MULTIPORT) += ipt_multiport.o
1166+
1167+obj-$(CONFIG_IP_NF_MATCH_MPORT) += ipt_mport.o
1168+
1169 obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
1170 obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
1171
1172+obj-$(CONFIG_IP_NF_MATCH_TIME) += ipt_time.o
1173+
1174+
1175+obj-$(CONFIG_IP_NF_MATCH_RANDOM) += ipt_random.o
1176+
1177+obj-$(CONFIG_IP_NF_MATCH_PSD) += ipt_psd.o
1178+
1179+obj-$(CONFIG_IP_NF_MATCH_OSF) += ipt_osf.o
1180+
1181+
1182+obj-$(CONFIG_IP_NF_MATCH_NTH) += ipt_nth.o
1183+
1184+obj-$(CONFIG_IP_NF_MATCH_IPV4OPTIONS) += ipt_ipv4options.o
1185+
1186+
1187+obj-$(CONFIG_IP_NF_MATCH_FUZZY) += ipt_fuzzy.o
1188+
1189 obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
1190
1191 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
1192@@ -59,10 +84,15 @@
1193
1194 obj-$(CONFIG_IP_NF_MATCH_LENGTH) += ipt_length.o
1195
1196+obj-$(CONFIG_IP_NF_MATCH_U32) += ipt_u32.o
1197+
1198+
1199 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
1200 obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
1201+obj-$(CONFIG_IP_NF_MATCH_CONNLIMIT) += ipt_connlimit.o
1202 obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
1203 obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
1204+obj-$(CONFIG_IP_NF_MATCH_REALM) += ipt_realm.o
1205
1206 obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o
1207
1208@@ -79,8 +109,12 @@
1209 obj-$(CONFIG_IP_NF_TARGET_CLASSIFY) += ipt_CLASSIFY.o
1210 obj-$(CONFIG_IP_NF_NAT_SNMP_BASIC) += ip_nat_snmp_basic.o
1211 obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
1212+obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
1213+obj-$(CONFIG_IP_NF_TARGET_NETLINK) += ipt_NETLINK.o
1214+obj-$(CONFIG_IP_NF_TARGET_IPV4OPTSSTRIP) += ipt_IPV4OPTSSTRIP.o
1215 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
1216 obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
1217+obj-$(CONFIG_IP_NF_TARGET_NOTRACK) += ipt_NOTRACK.o
1218
1219 # generic ARP tables
1220 obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
1221diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_conntrack_core.c linux-2.6.5-rc3/net/ipv4/netfilter/ip_conntrack_core.c
1222--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_conntrack_core.c 2004-03-30 05:25:30.000000000 +0200
1223+++ linux-2.6.5-rc3/net/ipv4/netfilter/ip_conntrack_core.c 2004-03-30 11:11:27.000000000 +0200
1224@@ -67,6 +67,7 @@
1225 static atomic_t ip_conntrack_count = ATOMIC_INIT(0);
1226 struct list_head *ip_conntrack_hash;
1227 static kmem_cache_t *ip_conntrack_cachep;
1228+struct ip_conntrack ip_conntrack_untracked;
1229
1230 extern struct ip_conntrack_protocol ip_conntrack_generic_protocol;
1231
1232@@ -691,42 +692,50 @@
1233 struct ip_conntrack_expect *, tuple);
1234 READ_UNLOCK(&ip_conntrack_expect_tuple_lock);
1235
1236- /* If master is not in hash table yet (ie. packet hasn't left
1237- this machine yet), how can other end know about expected?
1238- Hence these are not the droids you are looking for (if
1239- master ct never got confirmed, we'd hold a reference to it
1240- and weird things would happen to future packets). */
1241- if (expected && !is_confirmed(expected->expectant))
1242- expected = NULL;
1243-
1244- /* Look up the conntrack helper for master connections only */
1245- if (!expected)
1246- conntrack->helper = ip_ct_find_helper(&repl_tuple);
1247-
1248- /* If the expectation is dying, then this is a loser. */
1249- if (expected
1250- && expected->expectant->helper->timeout
1251- && ! del_timer(&expected->timeout))
1252- expected = NULL;
1253-
1254 if (expected) {
1255- DEBUGP("conntrack: expectation arrives ct=%p exp=%p\n",
1256- conntrack, expected);
1257- /* Welcome, Mr. Bond. We've been expecting you... */
1258- IP_NF_ASSERT(master_ct(conntrack));
1259- __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
1260- conntrack->master = expected;
1261- expected->sibling = conntrack;
1262- LIST_DELETE(&ip_conntrack_expect_list, expected);
1263- expected->expectant->expecting--;
1264- nf_conntrack_get(&master_ct(conntrack)->infos[0]);
1265- }
1266- atomic_inc(&ip_conntrack_count);
1267+ /* If master is not in hash table yet (ie. packet hasn't left
1268+ this machine yet), how can other end know about expected?
1269+ Hence these are not the droids you are looking for (if
1270+ master ct never got confirmed, we'd hold a reference to it
1271+ and weird things would happen to future packets). */
1272+ if (!is_confirmed(expected->expectant)) {
1273+
1274+ conntrack->helper = ip_ct_find_helper(&repl_tuple);
1275+ goto end;
1276+ }
1277+
1278+ /* Expectation is dying... */
1279+ if (expected->expectant->helper->timeout
1280+ && ! del_timer(&expected->timeout)) {
1281+ goto end;
1282+ }
1283+
1284+ DEBUGP("conntrack: expectation arrives ct=%p exp=%p\n",
1285+ conntrack, expected);
1286+ /* Welcome, Mr. Bond. We've been expecting you... */
1287+ IP_NF_ASSERT(master_ct(conntrack));
1288+ __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
1289+ conntrack->master = expected;
1290+ expected->sibling = conntrack;
1291+ LIST_DELETE(&ip_conntrack_expect_list, expected);
1292+ expected->expectant->expecting--;
1293+ nf_conntrack_get(&master_ct(conntrack)->infos[0]);
1294+
1295+ /* this is a braindead... --pablo */
1296+ atomic_inc(&ip_conntrack_count);
1297+ WRITE_UNLOCK(&ip_conntrack_lock);
1298+
1299+ if (expected->expectfn)
1300+ expected->expectfn(conntrack);
1301+
1302+ goto ret;
1303+ } else
1304+ conntrack->helper = ip_ct_find_helper(&repl_tuple);
1305+
1306+end: atomic_inc(&ip_conntrack_count);
1307 WRITE_UNLOCK(&ip_conntrack_lock);
1308
1309- if (expected && expected->expectfn)
1310- expected->expectfn(conntrack);
1311- return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
1312+ret: return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
1313 }
1314
1315 /* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
1316@@ -794,6 +803,15 @@
1317 int set_reply;
1318 int ret;
1319
1320+ /* Never happen */
1321+ if ((*pskb)->nh.iph->frag_off & htons(IP_OFFSET)) {
1322+ if (net_ratelimit()) {
1323+ printk(KERN_ERR "ip_conntrack_in: Frag of proto %u (hook=%u)\n",
1324+ (*pskb)->nh.iph->protocol, hooknum);
1325+ }
1326+ return NF_DROP;
1327+ }
1328+
1329 /* FIXME: Do this right please. --RR */
1330 (*pskb)->nfcache |= NFC_UNKNOWN;
1331
1332@@ -812,18 +830,10 @@
1333 }
1334 #endif
1335
1336- /* Previously seen (loopback)? Ignore. Do this before
1337- fragment check. */
1338+ /* Previously seen (loopback or untracked)? Ignore. */
1339 if ((*pskb)->nfct)
1340 return NF_ACCEPT;
1341
1342- /* Gather fragments. */
1343- if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
1344- *pskb = ip_ct_gather_frags(*pskb);
1345- if (!*pskb)
1346- return NF_STOLEN;
1347- }
1348-
1349 proto = ip_ct_find_proto((*pskb)->nh.iph->protocol);
1350
1351 /* It may be an icmp error... */
1352@@ -1422,6 +1432,18 @@
1353
1354 /* For use by ipt_REJECT */
1355 ip_ct_attach = ip_conntrack_attach;
1356+
1357+ /* Set up fake conntrack:
1358+ - to never be deleted, not in any hashes */
1359+ atomic_set(&ip_conntrack_untracked.ct_general.use, 1);
1360+ /* - and look it like as a confirmed connection */
1361+ set_bit(IPS_CONFIRMED_BIT, &ip_conntrack_untracked.status);
1362+ /* - and prepare the ctinfo field for REJECT & NAT. */
1363+ ip_conntrack_untracked.infos[IP_CT_NEW].master =
1364+ ip_conntrack_untracked.infos[IP_CT_RELATED].master =
1365+ ip_conntrack_untracked.infos[IP_CT_RELATED + IP_CT_IS_REPLY].master =
1366+ &ip_conntrack_untracked.ct_general;
1367+
1368 return ret;
1369
1370 err_free_hash:
1371diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.6.5-rc3/net/ipv4/netfilter/ip_conntrack_standalone.c
1372--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-03-30 05:26:11.000000000 +0200
1373+++ linux-2.6.5-rc3/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-03-30 11:11:27.000000000 +0200
1374@@ -194,6 +194,26 @@
1375 return ip_conntrack_confirm(*pskb);
1376 }
1377
1378+static unsigned int ip_conntrack_defrag(unsigned int hooknum,
1379+ struct sk_buff **pskb,
1380+ const struct net_device *in,
1381+ const struct net_device *out,
1382+ int (*okfn)(struct sk_buff *))
1383+{
1384+ /* Previously seen (loopback)? Ignore. Do this before
1385+ fragment check. */
1386+ if ((*pskb)->nfct)
1387+ return NF_ACCEPT;
1388+
1389+ /* Gather fragments. */
1390+ if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
1391+ *pskb = ip_ct_gather_frags(*pskb);
1392+ if (!*pskb)
1393+ return NF_STOLEN;
1394+ }
1395+ return NF_ACCEPT;
1396+}
1397+
1398 static unsigned int ip_refrag(unsigned int hooknum,
1399 struct sk_buff **pskb,
1400 const struct net_device *in,
1401@@ -236,6 +256,14 @@
1402
1403 /* Connection tracking may drop packets, but never alters them, so
1404 make it the first hook. */
1405+static struct nf_hook_ops ip_conntrack_defrag_ops = {
1406+ .hook = ip_conntrack_defrag,
1407+ .owner = THIS_MODULE,
1408+ .pf = PF_INET,
1409+ .hooknum = NF_IP_PRE_ROUTING,
1410+ .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
1411+};
1412+
1413 static struct nf_hook_ops ip_conntrack_in_ops = {
1414 .hook = ip_conntrack_in,
1415 .owner = THIS_MODULE,
1416@@ -244,6 +272,14 @@
1417 .priority = NF_IP_PRI_CONNTRACK,
1418 };
1419
1420+static struct nf_hook_ops ip_conntrack_defrag_local_out_ops = {
1421+ .hook = ip_conntrack_defrag,
1422+ .owner = THIS_MODULE,
1423+ .pf = PF_INET,
1424+ .hooknum = NF_IP_LOCAL_OUT,
1425+ .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
1426+};
1427+
1428 static struct nf_hook_ops ip_conntrack_local_out_ops = {
1429 .hook = ip_conntrack_local,
1430 .owner = THIS_MODULE,
1431@@ -470,10 +506,20 @@
1432 if (!proc) goto cleanup_init;
1433 proc->owner = THIS_MODULE;
1434
1435+ ret = nf_register_hook(&ip_conntrack_defrag_ops);
1436+ if (ret < 0) {
1437+ printk("ip_conntrack: can't register pre-routing defrag hook.\n");
1438+ goto cleanup_proc;
1439+ }
1440+ ret = nf_register_hook(&ip_conntrack_defrag_local_out_ops);
1441+ if (ret < 0) {
1442+ printk("ip_conntrack: can't register local_out defrag hook.\n");
1443+ goto cleanup_defragops;
1444+ }
1445 ret = nf_register_hook(&ip_conntrack_in_ops);
1446 if (ret < 0) {
1447 printk("ip_conntrack: can't register pre-routing hook.\n");
1448- goto cleanup_proc;
1449+ goto cleanup_defraglocalops;
1450 }
1451 ret = nf_register_hook(&ip_conntrack_local_out_ops);
1452 if (ret < 0) {
1453@@ -511,6 +557,10 @@
1454 nf_unregister_hook(&ip_conntrack_local_out_ops);
1455 cleanup_inops:
1456 nf_unregister_hook(&ip_conntrack_in_ops);
1457+ cleanup_defraglocalops:
1458+ nf_unregister_hook(&ip_conntrack_defrag_local_out_ops);
1459+ cleanup_defragops:
1460+ nf_unregister_hook(&ip_conntrack_defrag_ops);
1461 cleanup_proc:
1462 proc_net_remove("ip_conntrack");
1463 cleanup_init:
1464@@ -602,5 +652,6 @@
1465 EXPORT_SYMBOL(ip_conntrack_expect_list);
1466 EXPORT_SYMBOL(ip_conntrack_lock);
1467 EXPORT_SYMBOL(ip_conntrack_hash);
1468+EXPORT_SYMBOL(ip_conntrack_untracked);
1469 EXPORT_SYMBOL_GPL(ip_conntrack_find_get);
1470 EXPORT_SYMBOL_GPL(ip_conntrack_put);
1471diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_nat_core.c linux-2.6.5-rc3/net/ipv4/netfilter/ip_nat_core.c
1472--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_nat_core.c 2004-03-30 05:25:33.000000000 +0200
1473+++ linux-2.6.5-rc3/net/ipv4/netfilter/ip_nat_core.c 2004-03-30 11:11:27.000000000 +0200
1474@@ -1016,6 +1016,10 @@
1475 /* FIXME: Man, this is a hack. <SIGH> */
1476 IP_NF_ASSERT(ip_conntrack_destroyed == NULL);
1477 ip_conntrack_destroyed = &ip_nat_cleanup_conntrack;
1478+
1479+ /* Initialize fake conntrack so that NAT will skip it */
1480+ ip_conntrack_untracked.nat.info.initialized |=
1481+ (1 << IP_NAT_MANIP_SRC) | (1 << IP_NAT_MANIP_DST);
1482
1483 return 0;
1484 }
1485diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_pool.c linux-2.6.5-rc3/net/ipv4/netfilter/ip_pool.c
1486--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_pool.c 1970-01-01 01:00:00.000000000 +0100
1487+++ linux-2.6.5-rc3/net/ipv4/netfilter/ip_pool.c 2004-03-30 11:11:17.000000000 +0200
4867a0a7 1488@@ -0,0 +1,334 @@
8cc4a74e 1489+/* Kernel module for IP pool management */
1490+
1491+#include <linux/module.h>
1492+#include <linux/ip.h>
1493+#include <linux/skbuff.h>
1494+#include <linux/netfilter_ipv4/ip_tables.h>
1495+#include <linux/netfilter_ipv4/ip_pool.h>
1496+#include <linux/errno.h>
1497+#include <asm/uaccess.h>
1498+#include <asm/bitops.h>
1499+#include <linux/interrupt.h>
1500+#include <linux/spinlock.h>
1501+
1502+#if 0
1503+#define DP printk
1504+#else
1505+#define DP(format, args...)
1506+#endif
1507+
1508+MODULE_LICENSE("GPL");
1509+
1510+#define NR_POOL 16
1511+static int nr_pool = NR_POOL;/* overwrite this when loading module */
1512+
1513+struct ip_pool {
1514+ u_int32_t first_ip; /* host byte order, included in range */
1515+ u_int32_t last_ip; /* host byte order, included in range */
1516+ void *members; /* the bitmap proper */
1517+ int nr_use; /* total nr. of tests through this */
1518+ int nr_match; /* total nr. of matches through this */
1519+ rwlock_t lock;
1520+};
1521+
1522+static struct ip_pool *POOL;
1523+
1524+static inline struct ip_pool *lookup(ip_pool_t index)
1525+{
1526+ if (index < 0 || index >= nr_pool) {
1527+ DP("ip_pool:lookup: bad index %d\n", index);
1528+ return 0;
1529+ }
1530+ return POOL+index;
1531+}
1532+
1533+int ip_pool_match(ip_pool_t index, u_int32_t addr)
1534+{
1535+ struct ip_pool *pool = lookup(index);
1536+ int res = 0;
1537+
1538+ if (!pool || !pool->members)
1539+ return 0;
1540+ read_lock_bh(&pool->lock);
1541+ if (pool->members) {
1542+ if (addr >= pool->first_ip && addr <= pool->last_ip) {
1543+ addr -= pool->first_ip;
1544+ if (test_bit(addr, pool->members)) {
1545+ res = 1;
1546+#ifdef CONFIG_IP_POOL_STATISTICS
1547+ pool->nr_match++;
1548+#endif
1549+ }
1550+ }
1551+#ifdef CONFIG_IP_POOL_STATISTICS
1552+ pool->nr_use++;
1553+#endif
1554+ }
1555+ read_unlock_bh(&pool->lock);
1556+ return res;
1557+}
4867a0a7 1558+EXPORT_SYMBOL(ip_pool_match);
8cc4a74e 1559+
1560+static int pool_change(ip_pool_t index, u_int32_t addr, int isdel)
1561+{
1562+ struct ip_pool *pool;
1563+ int res = -1;
1564+
1565+ pool = lookup(index);
1566+ if ( !pool || !pool->members
1567+ || addr < pool->first_ip || addr > pool->last_ip)
1568+ return -1;
1569+ read_lock_bh(&pool->lock);
1570+ if (pool->members && addr >= pool->first_ip && addr <= pool->last_ip) {
1571+ addr -= pool->first_ip;
1572+ res = isdel
1573+ ? (0 != test_and_clear_bit(addr, pool->members))
1574+ : (0 != test_and_set_bit(addr, pool->members));
1575+ }
1576+ read_unlock_bh(&pool->lock);
1577+ return res;
1578+}
1579+
1580+int ip_pool_mod(ip_pool_t index, u_int32_t addr, int isdel)
1581+{
1582+ int res = pool_change(index,addr,isdel);
1583+
1584+ if (!isdel) res = !res;
1585+ return res;
1586+}
4867a0a7 1587+EXPORT_SYMBOL(ip_pool_mod);
8cc4a74e 1588+
1589+static inline int bitmap_bytes(u_int32_t a, u_int32_t b)
1590+{
1591+ return 4*((((b-a+8)/8)+3)/4);
1592+}
1593+
1594+static inline int poolbytes(ip_pool_t index)
1595+{
1596+ struct ip_pool *pool = lookup(index);
1597+
1598+ return pool ? bitmap_bytes(pool->first_ip, pool->last_ip) : 0;
1599+}
1600+
1601+static int setpool(
1602+ struct sock *sk,
1603+ int optval,
1604+ void *user,
1605+ unsigned int len
1606+) {
1607+ struct ip_pool_request req;
1608+
1609+ DP("ip_pool:setpool: optval=%d, user=%p, len=%d\n", optval, user, len);
1610+ if (!capable(CAP_NET_ADMIN))
1611+ return -EPERM;
1612+ if (optval != SO_IP_POOL)
1613+ return -EBADF;
1614+ if (len != sizeof(req))
1615+ return -EINVAL;
1616+ if (copy_from_user(&req, user, sizeof(req)) != 0)
1617+ return -EFAULT;
1618+ printk("obsolete op - upgrade your ippool(8) utility.\n");
1619+ return -EINVAL;
1620+}
1621+
1622+static int getpool(
1623+ struct sock *sk,
1624+ int optval,
1625+ void *user,
1626+ int *len
1627+) {
1628+ struct ip_pool_request req;
1629+ struct ip_pool *pool;
1630+ ip_pool_t i;
1631+ int newbytes;
1632+ void *newmembers;
1633+ int res;
1634+
1635+ DP("ip_pool:getpool: optval=%d, user=%p\n", optval, user);
1636+ if (!capable(CAP_NET_ADMIN))
1637+ return -EINVAL;
1638+ if (optval != SO_IP_POOL)
1639+ return -EINVAL;
1640+ if (*len != sizeof(req)) {
1641+ return -EFAULT;
1642+ }
1643+ if (copy_from_user(&req, user, sizeof(req)) != 0)
1644+ return -EFAULT;
1645+ DP("ip_pool:getpool op=%d, index=%d\n", req.op, req.index);
1646+ if (req.op < IP_POOL_BAD001) {
1647+ printk("obsolete op - upgrade your ippool(8) utility.\n");
1648+ return -EFAULT;
1649+ }
1650+ switch(req.op) {
1651+ case IP_POOL_HIGH_NR:
1652+ DP("ip_pool HIGH_NR\n");
1653+ req.index = IP_POOL_NONE;
1654+ for (i=0; i<nr_pool; i++)
1655+ if (POOL[i].members)
1656+ req.index = i;
1657+ return copy_to_user(user, &req, sizeof(req));
1658+ case IP_POOL_LOOKUP:
1659+ DP("ip_pool LOOKUP\n");
1660+ pool = lookup(req.index);
1661+ if (!pool)
1662+ return -EINVAL;
1663+ if (!pool->members)
1664+ return -EBADF;
1665+ req.addr = htonl(pool->first_ip);
1666+ req.addr2 = htonl(pool->last_ip);
1667+ return copy_to_user(user, &req, sizeof(req));
1668+ case IP_POOL_USAGE:
1669+ DP("ip_pool USE\n");
1670+ pool = lookup(req.index);
1671+ if (!pool)
1672+ return -EINVAL;
1673+ if (!pool->members)
1674+ return -EBADF;
1675+ req.addr = pool->nr_use;
1676+ req.addr2 = pool->nr_match;
1677+ return copy_to_user(user, &req, sizeof(req));
1678+ case IP_POOL_TEST_ADDR:
1679+ DP("ip_pool TEST 0x%08x\n", req.addr);
1680+ pool = lookup(req.index);
1681+ if (!pool)
1682+ return -EINVAL;
1683+ res = 0;
1684+ read_lock_bh(&pool->lock);
1685+ if (!pool->members) {
1686+ DP("ip_pool TEST_ADDR no members in pool\n");
1687+ res = -EBADF;
1688+ goto unlock_and_return_res;
1689+ }
1690+ req.addr = ntohl(req.addr);
1691+ if (req.addr < pool->first_ip) {
1692+ DP("ip_pool TEST_ADDR address < pool bounds\n");
1693+ res = -ERANGE;
1694+ goto unlock_and_return_res;
1695+ }
1696+ if (req.addr > pool->last_ip) {
1697+ DP("ip_pool TEST_ADDR address > pool bounds\n");
1698+ res = -ERANGE;
1699+ goto unlock_and_return_res;
1700+ }
1701+ req.addr = (0 != test_bit((req.addr - pool->first_ip),
1702+ pool->members));
1703+ read_unlock_bh(&pool->lock);
1704+ return copy_to_user(user, &req, sizeof(req));
1705+ case IP_POOL_FLUSH:
1706+ DP("ip_pool FLUSH not yet implemented.\n");
1707+ return -EBUSY;
1708+ case IP_POOL_DESTROY:
1709+ DP("ip_pool DESTROY not yet implemented.\n");
1710+ return -EBUSY;
1711+ case IP_POOL_INIT:
1712+ DP("ip_pool INIT 0x%08x-0x%08x\n", req.addr, req.addr2);
1713+ pool = lookup(req.index);
1714+ if (!pool)
1715+ return -EINVAL;
1716+ req.addr = ntohl(req.addr);
1717+ req.addr2 = ntohl(req.addr2);
1718+ if (req.addr > req.addr2) {
1719+ DP("ip_pool INIT bad ip range\n");
1720+ return -EINVAL;
1721+ }
1722+ newbytes = bitmap_bytes(req.addr, req.addr2);
1723+ newmembers = kmalloc(newbytes, GFP_KERNEL);
1724+ if (!newmembers) {
1725+ DP("ip_pool INIT out of mem for %d bytes\n", newbytes);
1726+ return -ENOMEM;
1727+ }
1728+ memset(newmembers, 0, newbytes);
1729+ write_lock_bh(&pool->lock);
1730+ if (pool->members) {
1731+ DP("ip_pool INIT pool %d exists\n", req.index);
1732+ kfree(newmembers);
1733+ res = -EBUSY;
1734+ goto unlock_and_return_res;
1735+ }
1736+ pool->first_ip = req.addr;
1737+ pool->last_ip = req.addr2;
1738+ pool->nr_use = 0;
1739+ pool->nr_match = 0;
1740+ pool->members = newmembers;
1741+ write_unlock_bh(&pool->lock);
1742+ return 0;
1743+ case IP_POOL_ADD_ADDR:
1744+ DP("ip_pool ADD_ADDR 0x%08x\n", req.addr);
1745+ req.addr = pool_change(req.index, ntohl(req.addr), 0);
1746+ return copy_to_user(user, &req, sizeof(req));
1747+ case IP_POOL_DEL_ADDR:
1748+ DP("ip_pool DEL_ADDR 0x%08x\n", req.addr);
1749+ req.addr = pool_change(req.index, ntohl(req.addr), 1);
1750+ return copy_to_user(user, &req, sizeof(req));
1751+ default:
1752+ DP("ip_pool:getpool bad op %d\n", req.op);
1753+ return -EINVAL;
1754+ }
1755+ return -EINVAL;
1756+
1757+unlock_and_return_res:
1758+ if (pool)
1759+ read_unlock_bh(&pool->lock);
1760+ return res;
1761+}
1762+
1763+static struct nf_sockopt_ops so_pool
1764+= { { NULL, NULL }, PF_INET,
1765+ SO_IP_POOL, SO_IP_POOL+1, &setpool,
1766+ SO_IP_POOL, SO_IP_POOL+1, &getpool,
1767+ 0, NULL };
1768+
1769+MODULE_PARM(nr_pool, "i");
1770+
1771+static int __init init(void)
1772+{
1773+ ip_pool_t i;
1774+ int res;
1775+
1776+ if (nr_pool < 1) {
1777+ printk("ip_pool module init: bad nr_pool %d\n", nr_pool);
1778+ return -EINVAL;
1779+ }
1780+ POOL = kmalloc(nr_pool * sizeof(*POOL), GFP_KERNEL);
1781+ if (!POOL) {
1782+ printk("ip_pool module init: out of memory for nr_pool %d\n",
1783+ nr_pool);
1784+ return -ENOMEM;
1785+ }
1786+ for (i=0; i<nr_pool; i++) {
1787+ POOL[i].first_ip = 0;
1788+ POOL[i].last_ip = 0;
1789+ POOL[i].members = 0;
1790+ POOL[i].nr_use = 0;
1791+ POOL[i].nr_match = 0;
1792+ POOL[i].lock = RW_LOCK_UNLOCKED;
1793+ }
1794+ res = nf_register_sockopt(&so_pool);
1795+ DP("ip_pool:init %d pools, result %d\n", nr_pool, res);
1796+ if (res != 0) {
1797+ kfree(POOL);
1798+ POOL = 0;
1799+ }
1800+ return res;
1801+}
1802+
1803+static void __exit fini(void)
1804+{
1805+ ip_pool_t i;
1806+
1807+ DP("ip_pool:fini BYEBYE\n");
1808+ nf_unregister_sockopt(&so_pool);
1809+ for (i=0; i<nr_pool; i++) {
1810+ if (POOL[i].members) {
1811+ kfree(POOL[i].members);
1812+ POOL[i].members = 0;
1813+ }
1814+ }
1815+ kfree(POOL);
1816+ POOL = 0;
1817+ DP("ip_pool:fini these are the famous last words\n");
1818+ return;
1819+}
1820+
1821+module_init(init);
1822+module_exit(fini);
1823diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_tables.c linux-2.6.5-rc3/net/ipv4/netfilter/ip_tables.c
1824--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_tables.c 2004-03-30 05:25:36.000000000 +0200
1825+++ linux-2.6.5-rc3/net/ipv4/netfilter/ip_tables.c 2004-03-30 11:10:33.000000000 +0200
1826@@ -1716,9 +1716,9 @@
1827 };
1828
1829 #ifdef CONFIG_PROC_FS
1830-static inline int print_name(const char *i,
1831- off_t start_offset, char *buffer, int length,
1832- off_t *pos, unsigned int *count)
1833+static int print_name(const char *i,
1834+ off_t start_offset, char *buffer, int length,
1835+ off_t *pos, unsigned int *count)
1836 {
1837 if ((*count)++ >= start_offset) {
1838 unsigned int namelen;
1839@@ -1752,6 +1752,15 @@
1840 return pos;
1841 }
1842
1843+static inline int print_target(const struct ipt_target *t,
1844+ off_t start_offset, char *buffer, int length,
1845+ off_t *pos, unsigned int *count)
1846+{
1847+ if (t != &ipt_standard_target && t != &ipt_error_target)
1848+ return 0;
1849+ return print_name((char *)t, start_offset, buffer, length, pos, count);
1850+}
1851+
1852 static int ipt_get_targets(char *buffer, char **start, off_t offset, int length)
1853 {
1854 off_t pos = 0;
1855@@ -1760,7 +1769,7 @@
1856 if (down_interruptible(&ipt_mutex) != 0)
1857 return 0;
1858
1859- LIST_FIND(&ipt_target, print_name, void *,
1860+ LIST_FIND(&ipt_target, print_target, struct ipt_target *,
1861 offset, buffer, length, &pos, &count);
1862
1863 up(&ipt_mutex);
1864diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c
1865--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c 1970-01-01 01:00:00.000000000 +0100
1866+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c 2004-03-30 11:10:37.000000000 +0200
1867@@ -0,0 +1,89 @@
1868+/**
1869+ * Strip all IP options in the IP packet header.
1870+ *
1871+ * (C) 2001 by Fabrice MARIE <fabrice@netfilter.org>
1872+ * This software is distributed under GNU GPL v2, 1991
1873+ */
1874+
1875+#include <linux/module.h>
1876+#include <linux/skbuff.h>
1877+#include <linux/ip.h>
1878+#include <net/checksum.h>
1879+
1880+#include <linux/netfilter_ipv4/ip_tables.h>
1881+
1882+MODULE_AUTHOR("Fabrice MARIE <fabrice@netfilter.org>");
1883+MODULE_DESCRIPTION("Strip all options in IPv4 packets");
1884+MODULE_LICENSE("GPL");
1885+
1886+static unsigned int
1887+target(struct sk_buff **pskb,
1888+ const struct net_device *in,
1889+ const struct net_device *out,
1890+ unsigned int hooknum,
1891+ const void *targinfo,
1892+ void *userinfo)
1893+{
1894+ struct iphdr *iph;
1895+ struct sk_buff *skb;
1896+ struct ip_options *opt;
1897+ unsigned char *optiph;
1898+ int l;
1899+
1900+ if (!skb_ip_make_writable(pskb, (*pskb)->len))
1901+ return NF_DROP;
1902+
1903+ skb = (*pskb);
1904+ iph = (*pskb)->nh.iph;
1905+ optiph = skb->nh.raw;
1906+ l = ((struct ip_options *)(&(IPCB(skb)->opt)))->optlen;
1907+
1908+ /* if no options in packet then nothing to clear. */
1909+ if (iph->ihl * 4 == sizeof(struct iphdr))
1910+ return IPT_CONTINUE;
1911+
1912+ /* else clear all options */
1913+ memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
1914+ memset(optiph+sizeof(struct iphdr), IPOPT_NOOP, l);
1915+ opt = &(IPCB(skb)->opt);
1916+ opt->is_data = 0;
1917+ opt->optlen = l;
1918+
1919+ skb->nfcache |= NFC_ALTERED;
1920+
1921+ return IPT_CONTINUE;
1922+}
1923+
1924+static int
1925+checkentry(const char *tablename,
1926+ const struct ipt_entry *e,
1927+ void *targinfo,
1928+ unsigned int targinfosize,
1929+ unsigned int hook_mask)
1930+{
1931+ if (strcmp(tablename, "mangle")) {
1932+ printk(KERN_WARNING "IPV4OPTSSTRIP: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
1933+ return 0;
1934+ }
1935+ /* nothing else to check because no parameters */
1936+ return 1;
1937+}
1938+
1939+static struct ipt_target ipt_ipv4optsstrip_reg = {
1940+ .name = "IPV4OPTSSTRIP",
1941+ .target = target,
1942+ .checkentry = checkentry,
1943+ .me = THIS_MODULE };
1944+
1945+static int __init init(void)
1946+{
1947+ return ipt_register_target(&ipt_ipv4optsstrip_reg);
1948+}
1949+
1950+static void __exit fini(void)
1951+{
1952+ ipt_unregister_target(&ipt_ipv4optsstrip_reg);
1953+}
1954+
1955+module_init(init);
1956+module_exit(fini);
1957diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_LOG.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_LOG.c
1958--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_LOG.c 2004-03-30 05:27:07.000000000 +0200
1959+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_LOG.c 2004-03-30 11:10:29.000000000 +0200
1960@@ -19,6 +19,7 @@
1961 #include <net/tcp.h>
1962 #include <net/route.h>
1963
1964+#include <linux/netfilter.h>
1965 #include <linux/netfilter_ipv4/ip_tables.h>
1966 #include <linux/netfilter_ipv4/ipt_LOG.h>
1967
1968@@ -26,6 +27,10 @@
1969 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1970 MODULE_DESCRIPTION("iptables syslog logging module");
1971
1972+static unsigned int nflog = 1;
1973+MODULE_PARM(nflog, "i");
1974+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
1975+
1976 #if 0
1977 #define DEBUGP printk
1978 #else
1979@@ -324,28 +329,25 @@
1980 /* maxlen = 230+ 91 + 230 + 252 = 803 */
1981 }
1982
1983-static unsigned int
1984-ipt_log_target(struct sk_buff **pskb,
1985+static void
1986+ipt_log_packet(unsigned int hooknum,
1987+ const struct sk_buff *skb,
1988 const struct net_device *in,
1989 const struct net_device *out,
1990- unsigned int hooknum,
1991- const void *targinfo,
1992- void *userinfo)
1993+ const struct ipt_log_info *loginfo,
1994+ const char *level_string,
1995+ const char *prefix)
1996 {
1997- const struct ipt_log_info *loginfo = targinfo;
1998- char level_string[4] = "< >";
1999-
2000- level_string[1] = '0' + (loginfo->level % 8);
2001 spin_lock_bh(&log_lock);
2002 printk(level_string);
2003 printk("%sIN=%s OUT=%s ",
2004- loginfo->prefix,
2005+ prefix == NULL ? loginfo->prefix : prefix,
2006 in ? in->name : "",
2007 out ? out->name : "");
2008 #ifdef CONFIG_BRIDGE_NETFILTER
2009- if ((*pskb)->nf_bridge) {
2010- struct net_device *physindev = (*pskb)->nf_bridge->physindev;
2011- struct net_device *physoutdev = (*pskb)->nf_bridge->physoutdev;
2012+ if (skb->nf_bridge) {
2013+ struct net_device *physindev = skb->nf_bridge->physindev;
2014+ struct net_device *physoutdev = skb->nf_bridge->physoutdev;
2015
2016 if (physindev && in != physindev)
2017 printk("PHYSIN=%s ", physindev->name);
2018@@ -357,25 +359,56 @@
2019 if (in && !out) {
2020 /* MAC logging for input chain only. */
2021 printk("MAC=");
2022- if ((*pskb)->dev && (*pskb)->dev->hard_header_len
2023- && (*pskb)->mac.raw != (void*)(*pskb)->nh.iph) {
2024+ if (skb->dev && skb->dev->hard_header_len
2025+ && skb->mac.raw != (void*)skb->nh.iph) {
2026 int i;
2027- unsigned char *p = (*pskb)->mac.raw;
2028- for (i = 0; i < (*pskb)->dev->hard_header_len; i++,p++)
2029+ unsigned char *p = skb->mac.raw;
2030+ for (i = 0; i < skb->dev->hard_header_len; i++,p++)
2031 printk("%02x%c", *p,
2032- i==(*pskb)->dev->hard_header_len - 1
2033+ i==skb->dev->hard_header_len - 1
2034 ? ' ':':');
2035 } else
2036 printk(" ");
2037 }
2038
2039- dump_packet(loginfo, *pskb, 0);
2040+ dump_packet(loginfo, skb, 0);
2041 printk("\n");
2042 spin_unlock_bh(&log_lock);
2043+}
2044+
2045+static unsigned int
2046+ipt_log_target(struct sk_buff **pskb,
2047+ const struct net_device *in,
2048+ const struct net_device *out,
2049+ unsigned int hooknum,
2050+ const void *targinfo,
2051+ void *userinfo)
2052+{
2053+ const struct ipt_log_info *loginfo = targinfo;
2054+ char level_string[4] = "< >";
2055+
2056+ level_string[1] = '0' + (loginfo->level % 8);
2057+ ipt_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
2058
2059 return IPT_CONTINUE;
2060 }
2061
2062+static void
2063+ipt_logfn(unsigned int hooknum,
2064+ const struct sk_buff *skb,
2065+ const struct net_device *in,
2066+ const struct net_device *out,
2067+ const char *prefix)
2068+{
2069+ struct ipt_log_info loginfo = {
2070+ .level = 0,
2071+ .logflags = IPT_LOG_MASK,
2072+ .prefix = ""
2073+ };
2074+
2075+ ipt_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
2076+}
2077+
2078 static int ipt_log_checkentry(const char *tablename,
2079 const struct ipt_entry *e,
2080 void *targinfo,
2081@@ -413,11 +446,18 @@
2082
2083 static int __init init(void)
2084 {
2085- return ipt_register_target(&ipt_log_reg);
2086+ if (ipt_register_target(&ipt_log_reg))
2087+ return -EINVAL;
2088+ if (nflog)
2089+ nf_log_register(PF_INET, &ipt_logfn);
2090+
2091+ return 0;
2092 }
2093
2094 static void __exit fini(void)
2095 {
2096+ if (nflog)
2097+ nf_log_unregister(PF_INET, &ipt_logfn);
2098 ipt_unregister_target(&ipt_log_reg);
2099 }
2100
2101diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_NETLINK.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_NETLINK.c
2102--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_NETLINK.c 1970-01-01 01:00:00.000000000 +0100
2103+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_NETLINK.c 2004-03-30 11:10:39.000000000 +0200
2104@@ -0,0 +1,119 @@
2105+#include <linux/module.h>
2106+#include <linux/version.h>
2107+#include <linux/config.h>
2108+#include <linux/socket.h>
2109+#include <linux/skbuff.h>
2110+#include <linux/kernel.h>
2111+#include <linux/netlink.h>
2112+#include <linux/netdevice.h>
2113+#include <linux/mm.h>
2114+#include <linux/socket.h>
2115+#include <linux/netfilter_ipv4/ip_tables.h>
2116+#include <linux/netfilter_ipv4/ipt_NETLINK.h>
2117+#include <net/sock.h>
2118+
2119+MODULE_AUTHOR("Gianni Tedesco <gianni@ecsc.co.uk>");
2120+MODULE_DESCRIPTION("Provides iptables NETLINK target similar to ipchains -o");
2121+MODULE_LICENSE("GPL");
2122+
2123+#if 0
2124+#define DEBUGP printk
2125+#else
2126+#define DEBUGP(format, args...)
2127+#endif
2128+
2129+static struct sock *ipfwsk;
2130+
2131+static unsigned int ipt_netlink_target(struct sk_buff **pskb,
2132+ unsigned int hooknum,
2133+ const struct net_device *in,
2134+ const struct net_device *out,
2135+ const void *targinfo, void *userinfo)
2136+{
2137+ struct ipt_nldata *nld = (struct ipt_nldata *)targinfo;
2138+ struct iphdr *ip = (*pskb)->nh.iph;
2139+ struct sk_buff *outskb;
2140+ struct netlink_t nlhdr;
2141+ size_t len=0;
2142+
2143+ /* Allocate a socket buffer */
2144+ if ( MASK(nld->flags, USE_SIZE) )
2145+ len = nld->size+sizeof(nlhdr);
2146+ else
2147+ len = ntohs(ip->tot_len)+sizeof(nlhdr);
2148+
2149+ outskb=alloc_skb(len, GFP_ATOMIC);
2150+
2151+ if (outskb) {
2152+ nlhdr.len=len;
2153+
2154+ if ( MASK(nld->flags, USE_MARK) )
2155+ nlhdr.mark=(*pskb)->nfmark=nld->mark;
2156+ else
2157+ nlhdr.mark=(*pskb)->nfmark;
2158+
2159+ if ( in && in->name ) {
2160+ strncpy((char *)&nlhdr.iface, in->name, IFNAMSIZ);
2161+ }else if ( out && out->name ){
2162+ strncpy((char *)&nlhdr.iface, out->name, IFNAMSIZ);
2163+ }
2164+
2165+ skb_put(outskb, len);
2166+ memcpy(outskb->data, &nlhdr, sizeof(nlhdr));
2167+ memcpy((outskb->data)+sizeof(nlhdr), ip, len-sizeof(nlhdr));
2168+ netlink_broadcast(ipfwsk, outskb, 0, ~0, GFP_ATOMIC);
2169+ }else{
2170+ if (net_ratelimit())
2171+ printk(KERN_WARNING "ipt_NETLINK: packet drop due to netlink failure\n");
2172+ }
2173+
2174+ if ( MASK(nld->flags, USE_DROP) )
2175+ return NF_DROP;
2176+
2177+ return IPT_CONTINUE;
2178+}
2179+
2180+static int ipt_netlink_checkentry(const char *tablename,
2181+ const struct ipt_entry *e,
2182+ void *targinfo,
2183+ unsigned int targinfosize,
2184+ unsigned int hookmask)
2185+{
2186+ //struct ipt_nldata *nld = (struct ipt_nldata *)targinfo;
2187+
2188+ return 1;
2189+}
2190+
2191+static struct ipt_target ipt_netlink_reg = {
2192+ {NULL, NULL},
2193+ "NETLINK",
2194+ ipt_netlink_target,
2195+ ipt_netlink_checkentry,
2196+ NULL,
2197+ THIS_MODULE
2198+};
2199+
2200+static int __init init(void)
2201+{
2202+ DEBUGP("ipt_NETLINK: init module\n");
2203+
2204+ if (ipt_register_target(&ipt_netlink_reg) != 0) {
2205+ return -EINVAL;
2206+ }
2207+
2208+ if ( !(ipfwsk=netlink_kernel_create(NETLINK_FIREWALL, NULL)) ){
2209+ return -EINVAL;
2210+ }
2211+
2212+ return 0;
2213+}
2214+
2215+static void __exit fini(void)
2216+{
2217+ DEBUGP("ipt_NETLINK: cleanup_module\n");
2218+ ipt_unregister_target(&ipt_netlink_reg);
4867a0a7 2219+// if(ipfwsk->socket) sock_release(ipfwsk->socket);
8cc4a74e 2220+}
2221+
2222+module_init(init);
2223+module_exit(fini);
2224diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_NOTRACK.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_NOTRACK.c
2225--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_NOTRACK.c 1970-01-01 01:00:00.000000000 +0100
2226+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_NOTRACK.c 2004-03-30 11:11:27.000000000 +0200
2227@@ -0,0 +1,75 @@
2228+/* This is a module which is used for setting up fake conntracks
2229+ * on packets so that they are not seen by the conntrack/NAT code.
2230+ */
2231+#include <linux/module.h>
2232+#include <linux/skbuff.h>
2233+
2234+#include <linux/netfilter_ipv4/ip_tables.h>
2235+#include <linux/netfilter_ipv4/ip_conntrack.h>
2236+
2237+static unsigned int
2238+target(struct sk_buff **pskb,
2239+ const struct net_device *in,
2240+ const struct net_device *out,
2241+ unsigned int hooknum,
2242+ const void *targinfo,
2243+ void *userinfo)
2244+{
2245+ /* Previously seen (loopback)? Ignore. */
2246+ if ((*pskb)->nfct != NULL)
2247+ return IPT_CONTINUE;
2248+
2249+ /* Attach fake conntrack entry.
2250+ If there is a real ct entry correspondig to this packet,
2251+ it'll hang aroun till timing out. We don't deal with it
2252+ for performance reasons. JK */
2253+ (*pskb)->nfct = &ip_conntrack_untracked.infos[IP_CT_NEW];
2254+ nf_conntrack_get((*pskb)->nfct);
2255+
2256+ return IPT_CONTINUE;
2257+}
2258+
2259+static int
2260+checkentry(const char *tablename,
2261+ const struct ipt_entry *e,
2262+ void *targinfo,
2263+ unsigned int targinfosize,
2264+ unsigned int hook_mask)
2265+{
2266+ if (targinfosize != 0) {
2267+ printk(KERN_WARNING "NOTRACK: targinfosize %u != 0\n",
2268+ targinfosize);
2269+ return 0;
2270+ }
2271+
2272+ if (strcmp(tablename, "raw") != 0) {
2273+ printk(KERN_WARNING "NOTRACK: can only be called from \"raw\" table, not \"%s\"\n", tablename);
2274+ return 0;
2275+ }
2276+
2277+ return 1;
2278+}
2279+
2280+static struct ipt_target ipt_notrack_reg = {
2281+ .name = "NOTRACK",
2282+ .target = target,
2283+ .checkentry = checkentry,
2284+ .me = THIS_MODULE
2285+};
2286+
2287+static int __init init(void)
2288+{
2289+ if (ipt_register_target(&ipt_notrack_reg))
2290+ return -EINVAL;
2291+
2292+ return 0;
2293+}
2294+
2295+static void __exit fini(void)
2296+{
2297+ ipt_unregister_target(&ipt_notrack_reg);
2298+}
2299+
2300+module_init(init);
2301+module_exit(fini);
2302+MODULE_LICENSE("GPL");
2303diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_POOL.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_POOL.c
2304--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_POOL.c 1970-01-01 01:00:00.000000000 +0100
2305+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_POOL.c 2004-03-30 11:11:17.000000000 +0200
2306@@ -0,0 +1,116 @@
2307+/* ipt_POOL.c - netfilter target to manipulate IP pools
2308+ *
2309+ * This target can be used almost everywhere. It acts on some specified
2310+ * IP pool, adding or deleting some IP address in the pool. The address
2311+ * can be either the source (--addsrc, --delsrc), or destination (--add/deldst)
2312+ * of the packet under inspection.
2313+ *
2314+ * The target normally returns IPT_CONTINUE.
2315+ */
2316+
2317+#include <linux/types.h>
2318+#include <linux/ip.h>
2319+#include <linux/timer.h>
2320+#include <linux/module.h>
2321+#include <linux/netfilter.h>
2322+#include <linux/netdevice.h>
2323+#include <linux/if.h>
2324+#include <linux/inetdevice.h>
2325+#include <net/protocol.h>
2326+#include <net/checksum.h>
2327+#include <linux/netfilter_ipv4.h>
2328+#include <linux/netfilter_ipv4/ip_nat_rule.h>
2329+#include <linux/netfilter_ipv4/ipt_pool.h>
2330+
2331+#if 0
2332+#define DEBUGP printk
2333+#else
2334+#define DEBUGP(format, args...)
2335+#endif
2336+
2337+/*** NOTE NOTE NOTE NOTE ***
2338+**
2339+** By sheer luck, I get away with using the "struct ipt_pool_info", as defined
2340+** in <linux/netfilter_ipv4/ipt_pool.h>, both as the match and target info.
2341+** Here, in the target implementation, ipt_pool_info.src, if not IP_POOL_NONE,
2342+** is modified for the source IP address of the packet under inspection.
2343+** The same way, the ipt_pool_info.dst pool is modified for the destination.
2344+**
2345+** The address is added to the pool normally. However, if IPT_POOL_DEL_dir
2346+** flag is set in ipt_pool_info.flags, the address is deleted from the pool.
2347+**
2348+** If a modification was done to the pool, we possibly return ACCEPT or DROP,
2349+** if the right IPT_POOL_MOD_dir_ACCEPT or _MOD_dir_DROP flags are set.
2350+** The IPT_POOL_INV_MOD_dir flag inverts the sense of the check (i.e. the
2351+** ACCEPT and DROP flags are evaluated when the pool was not modified.)
2352+*/
2353+
2354+static int
2355+do_check(const char *tablename,
2356+ const struct ipt_entry *e,
2357+ void *targinfo,
2358+ unsigned int targinfosize,
2359+ unsigned int hook_mask)
2360+{
2361+ const struct ipt_pool_info *ipi = targinfo;
2362+
2363+ if (targinfosize != IPT_ALIGN(sizeof(*ipi))) {
2364+ DEBUGP("POOL_check: size %u.\n", targinfosize);
2365+ return 0;
2366+ }
2367+ DEBUGP("ipt_POOL:do_check(%d,%d,%d)\n",ipi->src,ipi->dst,ipi->flags);
2368+ return 1;
2369+}
2370+
2371+static unsigned int
2372+do_target(struct sk_buff **pskb,
2373+ unsigned int hooknum,
2374+ const struct net_device *in,
2375+ const struct net_device *out,
2376+ const void *targinfo,
2377+ void *userinfo)
2378+{
2379+ const struct ipt_pool_info *ipi = targinfo;
2380+ int modified;
2381+ unsigned int verdict = IPT_CONTINUE;
2382+
2383+ if (ipi->src != IP_POOL_NONE) {
2384+ modified = ip_pool_mod(ipi->src, ntohl((*pskb)->nh.iph->saddr),
2385+ ipi->flags & IPT_POOL_DEL_SRC);
2386+ if (!!modified ^ !!(ipi->flags & IPT_POOL_INV_MOD_SRC)) {
2387+ if (ipi->flags & IPT_POOL_MOD_SRC_ACCEPT)
2388+ verdict = NF_ACCEPT;
2389+ else if (ipi->flags & IPT_POOL_MOD_SRC_DROP)
2390+ verdict = NF_DROP;
2391+ }
2392+ }
2393+ if (verdict == IPT_CONTINUE && ipi->dst != IP_POOL_NONE) {
2394+ modified = ip_pool_mod(ipi->dst, ntohl((*pskb)->nh.iph->daddr),
2395+ ipi->flags & IPT_POOL_DEL_DST);
2396+ if (!!modified ^ !!(ipi->flags & IPT_POOL_INV_MOD_DST)) {
2397+ if (ipi->flags & IPT_POOL_MOD_DST_ACCEPT)
2398+ verdict = NF_ACCEPT;
2399+ else if (ipi->flags & IPT_POOL_MOD_DST_DROP)
2400+ verdict = NF_DROP;
2401+ }
2402+ }
2403+ return verdict;
2404+}
2405+
2406+static struct ipt_target pool_reg
2407+= { { NULL, NULL }, "POOL", do_target, do_check, NULL, THIS_MODULE };
2408+
2409+static int __init init(void)
2410+{
2411+ DEBUGP("init ipt_POOL\n");
2412+ return ipt_register_target(&pool_reg);
2413+}
2414+
2415+static void __exit fini(void)
2416+{
2417+ DEBUGP("fini ipt_POOL\n");
2418+ ipt_unregister_target(&pool_reg);
2419+}
2420+
2421+module_init(init);
2422+module_exit(fini);
2423diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_TTL.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_TTL.c
2424--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_TTL.c 1970-01-01 01:00:00.000000000 +0100
2425+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_TTL.c 2004-03-30 11:10:42.000000000 +0200
2426@@ -0,0 +1,120 @@
2427+/* TTL modification target for IP tables
2428+ * (C) 2000 by Harald Welte <laforge@gnumonks.org>
2429+ *
2430+ * Version: $Revision$
2431+ *
2432+ * This software is distributed under the terms of GNU GPL
2433+ */
2434+
2435+#include <linux/module.h>
2436+#include <linux/skbuff.h>
2437+#include <linux/ip.h>
2438+#include <net/checksum.h>
2439+
2440+#include <linux/netfilter_ipv4/ip_tables.h>
2441+#include <linux/netfilter_ipv4/ipt_TTL.h>
2442+
2443+MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
2444+MODULE_DESCRIPTION("IP tables TTL modification module");
2445+MODULE_LICENSE("GPL");
2446+
2447+static unsigned int
2448+ipt_ttl_target(struct sk_buff **pskb, const struct net_device *in,
2449+ const struct net_device *out, unsigned int hooknum,
2450+ const void *targinfo, void *userinfo)
2451+{
2452+ struct iphdr *iph;
2453+ const struct ipt_TTL_info *info = targinfo;
2454+ u_int16_t diffs[2];
2455+ int new_ttl;
2456+
2457+ if (!skb_ip_make_writable(pskb, (*pskb)->len))
2458+ return NF_DROP;
2459+
2460+ iph = (*pskb)->nh.iph;
2461+
2462+ switch (info->mode) {
2463+ case IPT_TTL_SET:
2464+ new_ttl = info->ttl;
2465+ break;
2466+ case IPT_TTL_INC:
2467+ new_ttl = iph->ttl + info->ttl;
2468+ if (new_ttl > 255)
2469+ new_ttl = 255;
2470+ break;
2471+ case IPT_TTL_DEC:
2472+ new_ttl = iph->ttl + info->ttl;
2473+ if (new_ttl < 0)
2474+ new_ttl = 0;
2475+ break;
2476+ default:
2477+ new_ttl = iph->ttl;
2478+ break;
2479+ }
2480+
2481+ if (new_ttl != iph->ttl) {
2482+ diffs[0] = htons(((unsigned)iph->ttl) << 8) ^ 0xFFFF;
2483+ iph->ttl = new_ttl;
2484+ diffs[1] = htons(((unsigned)iph->ttl) << 8);
2485+ iph->check = csum_fold(csum_partial((char *)diffs,
2486+ sizeof(diffs),
2487+ iph->check^0xFFFF));
2488+ (*pskb)->nfcache |= NFC_ALTERED;
2489+ }
2490+
2491+ return IPT_CONTINUE;
2492+}
2493+
2494+static int ipt_ttl_checkentry(const char *tablename,
2495+ const struct ipt_entry *e,
2496+ void *targinfo,
2497+ unsigned int targinfosize,
2498+ unsigned int hook_mask)
2499+{
2500+ struct ipt_TTL_info *info = targinfo;
2501+
2502+ if (targinfosize != IPT_ALIGN(sizeof(struct ipt_TTL_info))) {
2503+ printk(KERN_WARNING "TTL: targinfosize %u != %Zu\n",
2504+ targinfosize,
2505+ IPT_ALIGN(sizeof(struct ipt_TTL_info)));
2506+ return 0;
2507+ }
2508+
2509+ if (strcmp(tablename, "mangle")) {
2510+ printk(KERN_WARNING "TTL: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
2511+ return 0;
2512+ }
2513+
2514+ if (info->mode > IPT_TTL_MAXMODE) {
2515+ printk(KERN_WARNING "TTL: invalid or unknown Mode %u\n",
2516+ info->mode);
2517+ return 0;
2518+ }
2519+
2520+ if ((info->mode != IPT_TTL_SET) && (info->ttl == 0)) {
2521+ printk(KERN_WARNING "TTL: increment/decrement doesn't make sense with value 0\n");
2522+ return 0;
2523+ }
2524+
2525+ return 1;
2526+}
2527+
2528+static struct ipt_target ipt_TTL = {
2529+ .name = "TTL",
2530+ .target = ipt_ttl_target,
2531+ .checkentry = ipt_ttl_checkentry,
2532+ .me = THIS_MODULE
2533+};
2534+
2535+static int __init init(void)
2536+{
2537+ return ipt_register_target(&ipt_TTL);
2538+}
2539+
2540+static void __exit fini(void)
2541+{
2542+ ipt_unregister_target(&ipt_TTL);
2543+}
2544+
2545+module_init(init);
2546+module_exit(fini);
2547diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_ULOG.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_ULOG.c
2548--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_ULOG.c 2004-03-30 05:26:06.000000000 +0200
2549+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_ULOG.c 2004-03-30 11:10:29.000000000 +0200
2550@@ -50,6 +50,7 @@
2551 #include <linux/netlink.h>
2552 #include <linux/netdevice.h>
2553 #include <linux/mm.h>
2554+#include <linux/netfilter.h>
2555 #include <linux/netfilter_ipv4/ip_tables.h>
2556 #include <linux/netfilter_ipv4/ipt_ULOG.h>
2557 #include <linux/netfilter_ipv4/lockhelp.h>
2558@@ -80,6 +81,10 @@
2559 MODULE_PARM(flushtimeout, "i");
2560 MODULE_PARM_DESC(flushtimeout, "buffer flush timeout");
2561
2562+static unsigned int nflog = 1;
2563+MODULE_PARM(nflog, "i");
2564+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
2565+
2566 /* global data structures */
2567
2568 typedef struct {
2569@@ -157,17 +162,17 @@
2570 return skb;
2571 }
2572
2573-static unsigned int ipt_ulog_target(struct sk_buff **pskb,
2574- const struct net_device *in,
2575- const struct net_device *out,
2576- unsigned int hooknum,
2577- const void *targinfo, void *userinfo)
2578+static void ipt_ulog_packet(unsigned int hooknum,
2579+ const struct sk_buff *skb,
2580+ const struct net_device *in,
2581+ const struct net_device *out,
2582+ const struct ipt_ulog_info *loginfo,
2583+ const char *prefix)
2584 {
2585 ulog_buff_t *ub;
2586 ulog_packet_msg_t *pm;
2587 size_t size, copy_len;
2588 struct nlmsghdr *nlh;
2589- struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
2590
2591 /* ffs == find first bit set, necessary because userspace
2592 * is already shifting groupnumber, but we need unshifted.
2593@@ -176,8 +181,8 @@
2594
2595 /* calculate the size of the skb needed */
2596 if ((loginfo->copy_range == 0) ||
2597- (loginfo->copy_range > (*pskb)->len)) {
2598- copy_len = (*pskb)->len;
2599+ (loginfo->copy_range > skb->len)) {
2600+ copy_len = skb->len;
2601 } else {
2602 copy_len = loginfo->copy_range;
2603 }
2604@@ -214,19 +219,21 @@
2605
2606 /* copy hook, prefix, timestamp, payload, etc. */
2607 pm->data_len = copy_len;
2608- pm->timestamp_sec = (*pskb)->stamp.tv_sec;
2609- pm->timestamp_usec = (*pskb)->stamp.tv_usec;
2610- pm->mark = (*pskb)->nfmark;
2611+ pm->timestamp_sec = skb->stamp.tv_sec;
2612+ pm->timestamp_usec = skb->stamp.tv_usec;
2613+ pm->mark = skb->nfmark;
2614 pm->hook = hooknum;
2615- if (loginfo->prefix[0] != '\0')
2616+ if (prefix != NULL)
2617+ strncpy(pm->prefix, prefix, sizeof(pm->prefix));
2618+ else if (loginfo->prefix[0] != '\0')
2619 strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
2620 else
2621 *(pm->prefix) = '\0';
2622
2623 if (in && in->hard_header_len > 0
2624- && (*pskb)->mac.raw != (void *) (*pskb)->nh.iph
2625+ && skb->mac.raw != (void *) skb->nh.iph
2626 && in->hard_header_len <= ULOG_MAC_LEN) {
2627- memcpy(pm->mac, (*pskb)->mac.raw, in->hard_header_len);
2628+ memcpy(pm->mac, skb->mac.raw, in->hard_header_len);
2629 pm->mac_len = in->hard_header_len;
2630 } else
2631 pm->mac_len = 0;
2632@@ -241,8 +248,8 @@
2633 else
2634 pm->outdev_name[0] = '\0';
2635
2636- /* copy_len <= (*pskb)->len, so can't fail. */
2637- if (skb_copy_bits(*pskb, 0, pm->payload, copy_len) < 0)
2638+ /* copy_len <= skb->len, so can't fail. */
2639+ if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0)
2640 BUG();
2641
2642 /* check if we are building multi-part messages */
2643@@ -266,8 +273,7 @@
2644
2645 UNLOCK_BH(&ulog_lock);
2646
2647- return IPT_CONTINUE;
2648-
2649+ return;
2650
2651 nlmsg_failure:
2652 PRINTR("ipt_ULOG: error during NLMSG_PUT\n");
2653@@ -276,8 +282,35 @@
2654 PRINTR("ipt_ULOG: Error building netlink message\n");
2655
2656 UNLOCK_BH(&ulog_lock);
2657+}
2658+
2659+static unsigned int ipt_ulog_target(struct sk_buff **pskb,
2660+ const struct net_device *in,
2661+ const struct net_device *out,
2662+ unsigned int hooknum,
2663+ const void *targinfo, void *userinfo)
2664+{
2665+ struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
2666
2667- return IPT_CONTINUE;
2668+ ipt_ulog_packet(hooknum, *pskb, in, out, loginfo, NULL);
2669+
2670+ return IPT_CONTINUE;
2671+}
2672+
2673+static void ipt_logfn(unsigned int hooknum,
2674+ const struct sk_buff *skb,
2675+ const struct net_device *in,
2676+ const struct net_device *out,
2677+ const char *prefix)
2678+{
2679+ struct ipt_ulog_info loginfo = {
2680+ .nl_group = ULOG_DEFAULT_NLGROUP,
2681+ .copy_range = 0,
2682+ .qthreshold = ULOG_DEFAULT_QTHRESHOLD,
2683+ .prefix = ""
2684+ };
2685+
2686+ ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
2687 }
2688
2689 static int ipt_ulog_checkentry(const char *tablename,
2690@@ -341,7 +374,9 @@
2691 sock_release(nflognl->sk_socket);
2692 return -EINVAL;
2693 }
2694-
2695+ if (nflog)
2696+ nf_log_register(PF_INET, &ipt_logfn);
2697+
2698 return 0;
2699 }
2700
2701@@ -352,6 +387,8 @@
2702
2703 DEBUGP("ipt_ULOG: cleanup_module\n");
2704
2705+ if (nflog)
2706+ nf_log_unregister(PF_INET, &ipt_logfn);
2707 ipt_unregister_target(&ipt_ulog_reg);
2708 sock_release(nflognl->sk_socket);
2709
2710diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_connlimit.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_connlimit.c
2711--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_connlimit.c 1970-01-01 01:00:00.000000000 +0100
2712+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_connlimit.c 2004-03-30 11:10:45.000000000 +0200
2713@@ -0,0 +1,230 @@
2714+/*
2715+ * netfilter module to limit the number of parallel tcp
2716+ * connections per IP address.
2717+ * (c) 2000 Gerd Knorr <kraxel@bytesex.org>
2718+ * Nov 2002: Martin Bene <martin.bene@icomedias.com>:
2719+ * only ignore TIME_WAIT or gone connections
2720+ *
2721+ * based on ...
2722+ *
2723+ * Kernel module to match connection tracking information.
2724+ * GPL (C) 1999 Rusty Russell (rusty@rustcorp.com.au).
2725+ */
2726+#include <linux/module.h>
2727+#include <linux/skbuff.h>
2728+#include <linux/list.h>
2729+#include <linux/netfilter_ipv4/ip_conntrack.h>
2730+#include <linux/netfilter_ipv4/ip_conntrack_core.h>
2731+#include <linux/netfilter_ipv4/ip_conntrack_tcp.h>
2732+#include <linux/netfilter_ipv4/ip_tables.h>
2733+#include <linux/netfilter_ipv4/ipt_connlimit.h>
2734+
2735+#define DEBUG 0
2736+
2737+MODULE_LICENSE("GPL");
2738+
2739+/* we'll save the tuples of all connections we care about */
2740+struct ipt_connlimit_conn
2741+{
2742+ struct list_head list;
2743+ struct ip_conntrack_tuple tuple;
2744+};
2745+
2746+struct ipt_connlimit_data {
2747+ spinlock_t lock;
2748+ struct list_head iphash[256];
2749+};
2750+
2751+static int ipt_iphash(u_int32_t addr)
2752+{
2753+ int hash;
2754+
2755+ hash = addr & 0xff;
2756+ hash ^= (addr >> 8) & 0xff;
2757+ hash ^= (addr >> 16) & 0xff;
2758+ hash ^= (addr >> 24) & 0xff;
2759+ return hash;
2760+}
2761+
2762+static int count_them(struct ipt_connlimit_data *data,
2763+ u_int32_t addr, u_int32_t mask,
2764+ struct ip_conntrack *ct)
2765+{
2766+#if DEBUG
2767+ const static char *tcp[] = { "none", "established", "syn_sent", "syn_recv",
2768+ "fin_wait", "time_wait", "close", "close_wait",
2769+ "last_ack", "listen" };
2770+#endif
2771+ int addit = 1, matches = 0;
2772+ struct ip_conntrack_tuple tuple;
2773+ struct ip_conntrack_tuple_hash *found;
2774+ struct ipt_connlimit_conn *conn;
2775+ struct list_head *hash,*lh;
2776+
2777+ spin_lock(&data->lock);
2778+ tuple = ct->tuplehash[0].tuple;
2779+ hash = &data->iphash[ipt_iphash(addr & mask)];
2780+
2781+ /* check the saved connections */
2782+ for (lh = hash->next; lh != hash; lh = lh->next) {
2783+ conn = list_entry(lh,struct ipt_connlimit_conn,list);
2784+ found = ip_conntrack_find_get(&conn->tuple,ct);
2785+ if (0 == memcmp(&conn->tuple,&tuple,sizeof(tuple)) &&
2786+ found != NULL &&
2787+ found->ctrack->proto.tcp.state != TCP_CONNTRACK_TIME_WAIT) {
2788+ /* Just to be sure we have it only once in the list.
2789+ We should'nt see tuples twice unless someone hooks this
2790+ into a table without "-p tcp --syn" */
2791+ addit = 0;
2792+ }
2793+#if DEBUG
2794+ printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d %s\n",
2795+ ipt_iphash(addr & mask),
2796+ NIPQUAD(conn->tuple.src.ip), ntohs(conn->tuple.src.u.tcp.port),
2797+ NIPQUAD(conn->tuple.dst.ip), ntohs(conn->tuple.dst.u.tcp.port),
2798+ (NULL != found) ? tcp[found->ctrack->proto.tcp.state] : "gone");
2799+#endif
2800+ if (NULL == found) {
2801+ /* this one is gone */
2802+ lh = lh->prev;
2803+ list_del(lh->next);
2804+ kfree(conn);
2805+ continue;
2806+ }
2807+ if (found->ctrack->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT) {
2808+ /* we don't care about connections which are
2809+ closed already -> ditch it */
2810+ lh = lh->prev;
2811+ list_del(lh->next);
2812+ kfree(conn);
2813+ nf_conntrack_put(&found->ctrack->infos[0]);
2814+ continue;
2815+ }
2816+ if ((addr & mask) == (conn->tuple.src.ip & mask)) {
2817+ /* same source IP address -> be counted! */
2818+ matches++;
2819+ }
2820+ nf_conntrack_put(&found->ctrack->infos[0]);
2821+ }
2822+ if (addit) {
2823+ /* save the new connection in our list */
2824+#if DEBUG
2825+ printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d new\n",
2826+ ipt_iphash(addr & mask),
2827+ NIPQUAD(tuple.src.ip), ntohs(tuple.src.u.tcp.port),
2828+ NIPQUAD(tuple.dst.ip), ntohs(tuple.dst.u.tcp.port));
2829+#endif
2830+ conn = kmalloc(sizeof(*conn),GFP_ATOMIC);
2831+ if (NULL == conn)
2832+ return -1;
2833+ memset(conn,0,sizeof(*conn));
2834+ INIT_LIST_HEAD(&conn->list);
2835+ conn->tuple = tuple;
2836+ list_add(&conn->list,hash);
2837+ matches++;
2838+ }
2839+ spin_unlock(&data->lock);
2840+ return matches;
2841+}
2842+
2843+static int
2844+match(const struct sk_buff *skb,
2845+ const struct net_device *in,
2846+ const struct net_device *out,
2847+ const void *matchinfo,
2848+ int offset,
2849+ int *hotdrop)
2850+{
2851+ const struct ipt_connlimit_info *info = matchinfo;
2852+ int connections, match;
2853+ struct ip_conntrack *ct;
2854+ enum ip_conntrack_info ctinfo;
2855+
2856+ ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
2857+ if (NULL == ct) {
2858+ printk("ipt_connlimit: Oops: invalid ct state ?\n");
2859+ *hotdrop = 1;
2860+ return 0;
2861+ }
2862+ connections = count_them(info->data,skb->nh.iph->saddr,info->mask,ct);
2863+ if (-1 == connections) {
2864+ printk("ipt_connlimit: Hmm, kmalloc failed :-(\n");
2865+ *hotdrop = 1; /* let's free some memory :-) */
2866+ return 0;
2867+ }
2868+ match = (info->inverse) ? (connections <= info->limit) : (connections > info->limit);
2869+#if DEBUG
2870+ printk("ipt_connlimit: src=%u.%u.%u.%u mask=%u.%u.%u.%u "
2871+ "connections=%d limit=%d match=%s\n",
2872+ NIPQUAD(skb->nh.iph->saddr), NIPQUAD(info->mask),
2873+ connections, info->limit, match ? "yes" : "no");
2874+#endif
2875+
2876+ return match;
2877+}
2878+
2879+static int check(const char *tablename,
2880+ const struct ipt_ip *ip,
2881+ void *matchinfo,
2882+ unsigned int matchsize,
2883+ unsigned int hook_mask)
2884+{
2885+ struct ipt_connlimit_info *info = matchinfo;
2886+ int i;
2887+
2888+ /* verify size */
2889+ if (matchsize != IPT_ALIGN(sizeof(struct ipt_connlimit_info)))
2890+ return 0;
2891+
2892+ /* refuse anything but tcp */
2893+ if (ip->proto != IPPROTO_TCP)
2894+ return 0;
2895+
2896+ /* init private data */
2897+ info->data = kmalloc(sizeof(struct ipt_connlimit_data),GFP_KERNEL);
2898+ spin_lock_init(&(info->data->lock));
2899+ for (i = 0; i < 256; i++)
2900+ INIT_LIST_HEAD(&(info->data->iphash[i]));
2901+
2902+ return 1;
2903+}
2904+
2905+static void destroy(void *matchinfo, unsigned int matchinfosize)
2906+{
2907+ struct ipt_connlimit_info *info = matchinfo;
2908+ struct ipt_connlimit_conn *conn;
2909+ struct list_head *hash;
2910+ int i;
2911+
2912+ /* cleanup */
2913+ for (i = 0; i < 256; i++) {
2914+ hash = &(info->data->iphash[i]);
2915+ while (hash != hash->next) {
2916+ conn = list_entry(hash->next,struct ipt_connlimit_conn,list);
2917+ list_del(hash->next);
2918+ kfree(conn);
2919+ }
2920+ }
2921+ kfree(info->data);
2922+}
2923+
2924+static struct ipt_match connlimit_match = {
2925+ .name = "connlimit",
2926+ .match = &match,
2927+ .checkentry = &check,
2928+ .destroy = &destroy,
2929+ .me = THIS_MODULE
2930+};
2931+
2932+static int __init init(void)
2933+{
2934+ return ipt_register_match(&connlimit_match);
2935+}
2936+
2937+static void __exit fini(void)
2938+{
2939+ ipt_unregister_match(&connlimit_match);
2940+}
2941+
2942+module_init(init);
2943+module_exit(fini);
2944diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_conntrack.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_conntrack.c
2945--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_conntrack.c 2004-03-30 05:27:15.000000000 +0200
2946+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_conntrack.c 2004-03-30 11:11:27.000000000 +0200
2947@@ -35,11 +35,13 @@
2948
2949 #define FWINV(bool,invflg) ((bool) ^ !!(sinfo->invflags & invflg))
2950
2951- if (ct)
2952- statebit = IPT_CONNTRACK_STATE_BIT(ctinfo);
2953- else
2954- statebit = IPT_CONNTRACK_STATE_INVALID;
2955-
2956+ if (skb->nfct == &ip_conntrack_untracked.infos[IP_CT_NEW])
2957+ statebit = IPT_CONNTRACK_STATE_UNTRACKED;
2958+ else if (ct)
2959+ statebit = IPT_CONNTRACK_STATE_BIT(ctinfo);
2960+ else
2961+ statebit = IPT_CONNTRACK_STATE_INVALID;
2962+
2963 if(sinfo->flags & IPT_CONNTRACK_STATE) {
2964 if (ct) {
2965 if(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip !=
2966diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_dstlimit.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_dstlimit.c
2967--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_dstlimit.c 1970-01-01 01:00:00.000000000 +0100
2968+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_dstlimit.c 2004-03-30 11:10:47.000000000 +0200
2969@@ -0,0 +1,690 @@
2970+/* iptables match extension to limit the number of packets per second
2971+ * seperately for each destination.
2972+ *
2973+ * (C) 2003 by Harald Welte <laforge@netfilter.org>
2974+ *
2975+ * $Id$
2976+ *
2977+ * Development of this code was funded by Astaro AG, http://www.astaro.com/
2978+ *
2979+ * based on ipt_limit.c by:
2980