]> git.pld-linux.org Git - packages/kernel.git/blame - 2.6.6-rc3-patch-o-matic-ng-base-20040429.patch
projects / packages / kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- minor fix. it builds but linking needs fix.
[packages/kernel.git] / 2.6.6-rc3-patch-o-matic-ng-base-20040429.patch
CommitLineData
384c1045 1diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ip_pool.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ip_pool.h
2--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ip_pool.h 1970-01-01 01:00:00.000000000 +0100
3+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ip_pool.h 2004-04-29 09:49:29.000000000 +0200
4@@ -0,0 +1,64 @@
5+#ifndef _IP_POOL_H
6+#define _IP_POOL_H
7+
8+/***************************************************************************/
9+/* This program is free software; you can redistribute it and/or modify */
10+/* it under the terms of the GNU General Public License as published by */
11+/* the Free Software Foundation; either version 2 of the License, or */
12+/* (at your option) any later version. */
13+/* */
14+/* This program is distributed in the hope that it will be useful, */
15+/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
16+/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
17+/* GNU General Public License for more details. */
18+/* */
19+/* You should have received a copy of the GNU General Public License */
20+/* along with this program; if not, write to the Free Software */
21+/* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA*/
22+/***************************************************************************/
23+
24+/* A sockopt of such quality has hardly ever been seen before on the open
25+ * market! This little beauty, hardly ever used: above 64, so it's
26+ * traditionally used for firewalling, not touched (even once!) by the
27+ * 2.0, 2.2 and 2.4 kernels!
28+ *
29+ * Comes with its own certificate of authenticity, valid anywhere in the
30+ * Free world!
31+ *
32+ * Rusty, 19.4.2000
33+ */
34+#define SO_IP_POOL 81
35+
36+typedef int ip_pool_t; /* pool index */
37+#define IP_POOL_NONE ((ip_pool_t)-1)
38+
39+struct ip_pool_request {
40+ int op;
41+ ip_pool_t index;
42+ u_int32_t addr;
43+ u_int32_t addr2;
44+};
45+
46+/* NOTE: I deliberately break the first cut ippool utility. Nobody uses it. */
47+
48+#define IP_POOL_BAD001 0x00000010
49+
50+#define IP_POOL_FLUSH 0x00000011 /* req.index, no arguments */
51+#define IP_POOL_INIT 0x00000012 /* from addr to addr2 incl. */
52+#define IP_POOL_DESTROY 0x00000013 /* req.index, no arguments */
53+#define IP_POOL_ADD_ADDR 0x00000014 /* add addr to pool */
54+#define IP_POOL_DEL_ADDR 0x00000015 /* del addr from pool */
55+#define IP_POOL_HIGH_NR 0x00000016 /* result in req.index */
56+#define IP_POOL_LOOKUP 0x00000017 /* result in addr and addr2 */
57+#define IP_POOL_USAGE 0x00000018 /* result in addr */
58+#define IP_POOL_TEST_ADDR 0x00000019 /* result (0/1) returned */
59+
60+#ifdef __KERNEL__
61+
62+/* NOTE: ip_pool_match() and ip_pool_mod() expect ADDR to be host byte order */
63+extern int ip_pool_match(ip_pool_t pool, u_int32_t addr);
64+extern int ip_pool_mod(ip_pool_t pool, u_int32_t addr, int isdel);
65+
66+#endif
67+
68+#endif /*_IP_POOL_H*/
69diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_NETLINK.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_NETLINK.h
70--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_NETLINK.h 1970-01-01 01:00:00.000000000 +0100
71+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_NETLINK.h 2004-04-29 09:47:00.000000000 +0200
72@@ -0,0 +1,27 @@
73+#ifndef _IPT_FWMON_H
74+#define _IPT_FWMON_H
75+
76+/* Bitmask macros */
77+#define MASK(x,y) (x & y)
78+#define MASK_SET(x,y) x |= y
79+#define MASK_UNSET(x,y) x &= ~y
80+
81+#define USE_MARK 0x00000001
82+#define USE_DROP 0x00000002
83+#define USE_SIZE 0x00000004
84+
85+struct ipt_nldata
86+{
87+ unsigned int flags;
88+ unsigned int mark;
89+ unsigned int size;
90+};
91+
92+/* Old header */
93+struct netlink_t {
94+ unsigned int len;
95+ unsigned int mark;
96+ char iface[IFNAMSIZ];
97+};
98+
99+#endif /*_IPT_FWMON_H*/
100diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_TTL.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_TTL.h
101--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_TTL.h 1970-01-01 01:00:00.000000000 +0100
102+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_TTL.h 2004-04-29 09:47:42.000000000 +0200
103@@ -0,0 +1,21 @@
104+/* TTL modification module for IP tables
105+ * (C) 2000 by Harald Welte <laforge@gnumonks.org> */
106+
107+#ifndef _IPT_TTL_H
108+#define _IPT_TTL_H
109+
110+enum {
111+ IPT_TTL_SET = 0,
112+ IPT_TTL_INC,
113+ IPT_TTL_DEC
114+};
115+
116+#define IPT_TTL_MAXMODE IPT_TTL_DEC
117+
118+struct ipt_TTL_info {
119+ u_int8_t mode;
120+ u_int8_t ttl;
121+};
122+
123+
124+#endif
125diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_connlimit.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_connlimit.h
126--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_connlimit.h 1970-01-01 01:00:00.000000000 +0100
127+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_connlimit.h 2004-04-29 09:47:49.000000000 +0200
128@@ -0,0 +1,12 @@
129+#ifndef _IPT_CONNLIMIT_H
130+#define _IPT_CONNLIMIT_H
131+
132+struct ipt_connlimit_data;
133+
134+struct ipt_connlimit_info {
135+ int limit;
136+ int inverse;
137+ u_int32_t mask;
138+ struct ipt_connlimit_data *data;
139+};
140+#endif /* _IPT_CONNLIMIT_H */
141diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_dstlimit.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_dstlimit.h
142--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_dstlimit.h 1970-01-01 01:00:00.000000000 +0100
143+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_dstlimit.h 2004-04-29 09:48:04.000000000 +0200
144@@ -0,0 +1,39 @@
145+#ifndef _IPT_DSTLIMIT_H
146+#define _IPT_DSTLIMIT_H
147+
148+/* timings are in milliseconds. */
149+#define IPT_DSTLIMIT_SCALE 10000
150+/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
151+ seconds, or one every 59 hours. */
152+
153+/* details of this structure hidden by the implementation */
154+struct ipt_dstlimit_htable;
155+
156+#define IPT_DSTLIMIT_HASH_DIP 0x0001
157+#define IPT_DSTLIMIT_HASH_DPT 0x0002
158+#define IPT_DSTLIMIT_HASH_SIP 0x0004
159+
160+struct dstlimit_cfg {
161+ u_int32_t mode; /* bitmask of IPT_DSTLIMIT_HASH_* */
162+ u_int32_t avg; /* Average secs between packets * scale */
163+ u_int32_t burst; /* Period multiplier for upper limit. */
164+
165+ /* user specified */
166+ u_int32_t size; /* how many buckets */
167+ u_int32_t max; /* max number of entries */
168+ u_int32_t gc_interval; /* gc interval */
169+ u_int32_t expire; /* when do entries expire? */
170+};
171+
172+struct ipt_dstlimit_info {
173+ char name [IFNAMSIZ]; /* name */
174+ struct dstlimit_cfg cfg;
175+ struct ipt_dstlimit_htable *hinfo;
176+
177+ /* Used internally by the kernel */
178+ union {
179+ void *ptr;
180+ struct ipt_dstlimit_info *master;
181+ } u;
182+};
183+#endif /*_IPT_DSTLIMIT_H*/
184diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_fuzzy.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_fuzzy.h
185--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_fuzzy.h 1970-01-01 01:00:00.000000000 +0100
186+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_fuzzy.h 2004-04-29 09:48:15.000000000 +0200
187@@ -0,0 +1,21 @@
188+#ifndef _IPT_FUZZY_H
189+#define _IPT_FUZZY_H
190+
191+#include <linux/param.h>
192+#include <linux/types.h>
193+
194+#define MAXFUZZYRATE 10000000
195+#define MINFUZZYRATE 3
196+
197+struct ipt_fuzzy_info {
198+ u_int32_t minimum_rate;
199+ u_int32_t maximum_rate;
200+ u_int32_t packets_total;
201+ u_int32_t bytes_total;
202+ u_int32_t previous_time;
203+ u_int32_t present_time;
204+ u_int32_t mean_rate;
205+ u_int8_t acceptance_rate;
206+};
207+
208+#endif /*_IPT_FUZZY_H*/
209diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_ipv4options.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_ipv4options.h
210--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_ipv4options.h 1970-01-01 01:00:00.000000000 +0100
211+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_ipv4options.h 2004-04-29 09:48:49.000000000 +0200
212@@ -0,0 +1,21 @@
213+#ifndef __ipt_ipv4options_h_included__
214+#define __ipt_ipv4options_h_included__
215+
216+#define IPT_IPV4OPTION_MATCH_SSRR 0x01 /* For strict source routing */
217+#define IPT_IPV4OPTION_MATCH_LSRR 0x02 /* For loose source routing */
218+#define IPT_IPV4OPTION_DONT_MATCH_SRR 0x04 /* any source routing */
219+#define IPT_IPV4OPTION_MATCH_RR 0x08 /* For Record route */
220+#define IPT_IPV4OPTION_DONT_MATCH_RR 0x10
221+#define IPT_IPV4OPTION_MATCH_TIMESTAMP 0x20 /* For timestamp request */
222+#define IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP 0x40
223+#define IPT_IPV4OPTION_MATCH_ROUTER_ALERT 0x80 /* For router-alert */
224+#define IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT 0x100
225+#define IPT_IPV4OPTION_MATCH_ANY_OPT 0x200 /* match packet with any option */
226+#define IPT_IPV4OPTION_DONT_MATCH_ANY_OPT 0x400 /* match packet with no option */
227+
228+struct ipt_ipv4options_info {
229+ u_int16_t options;
230+};
231+
232+
233+#endif /* __ipt_ipv4options_h_included__ */
234diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_mport.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_mport.h
235--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_mport.h 1970-01-01 01:00:00.000000000 +0100
236+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_mport.h 2004-04-29 09:49:01.000000000 +0200
237@@ -0,0 +1,24 @@
238+#ifndef _IPT_MPORT_H
239+#define _IPT_MPORT_H
240+#include <linux/netfilter_ipv4/ip_tables.h>
241+
242+#define IPT_MPORT_SOURCE (1<<0)
243+#define IPT_MPORT_DESTINATION (1<<1)
244+#define IPT_MPORT_EITHER (IPT_MPORT_SOURCE|IPT_MPORT_DESTINATION)
245+
246+#define IPT_MULTI_PORTS 15
247+
248+/* Must fit inside union ipt_matchinfo: 32 bytes */
249+/* every entry in ports[] except for the last one has one bit in pflags
250+ * associated with it. If this bit is set, the port is the first port of
251+ * a portrange, with the next entry being the last.
252+ * End of list is marked with pflags bit set and port=65535.
253+ * If 14 ports are used (last one does not have a pflag), the last port
254+ * is repeated to fill the last entry in ports[] */
255+struct ipt_mport
256+{
257+ u_int8_t flags:2; /* Type of comparison */
258+ u_int16_t pflags:14; /* Port flags */
259+ u_int16_t ports[IPT_MULTI_PORTS]; /* Ports */
260+};
261+#endif /*_IPT_MPORT_H*/
262diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_nth.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_nth.h
263--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_nth.h 1970-01-01 01:00:00.000000000 +0100
264+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_nth.h 2004-04-29 09:49:13.000000000 +0200
265@@ -0,0 +1,19 @@
266+#ifndef _IPT_NTH_H
267+#define _IPT_NTH_H
268+
269+#include <linux/param.h>
270+#include <linux/types.h>
271+
272+#ifndef IPT_NTH_NUM_COUNTERS
273+#define IPT_NTH_NUM_COUNTERS 16
274+#endif
275+
276+struct ipt_nth_info {
277+ u_int8_t every;
278+ u_int8_t not;
279+ u_int8_t startat;
280+ u_int8_t counter;
281+ u_int8_t packet;
282+};
283+
284+#endif /*_IPT_NTH_H*/
285diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_osf.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_osf.h
286--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_osf.h 1970-01-01 01:00:00.000000000 +0100
287+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_osf.h 2004-04-29 09:49:24.000000000 +0200
288@@ -0,0 +1,148 @@
289+/*
290+ * ipt_osf.h
291+ *
292+ * Copyright (c) 2003 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
293+ *
294+ *
295+ * This program is free software; you can redistribute it and/or modify
296+ * it under the terms of the GNU General Public License as published by
297+ * the Free Software Foundation; either version 2 of the License, or
298+ * (at your option) any later version.
299+ *
300+ * This program is distributed in the hope that it will be useful,
301+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
302+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
303+ * GNU General Public License for more details.
304+ *
305+ * You should have received a copy of the GNU General Public License
306+ * along with this program; if not, write to the Free Software
307+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
308+ */
309+
310+#ifndef _IPT_OSF_H
311+#define _IPT_OSF_H
312+
313+#define MAXGENRELEN 32
314+#define MAXDETLEN 64
315+
316+#define IPT_OSF_GENRE 1
317+#define IPT_OSF_SMART 2
318+#define IPT_OSF_LOG 4
319+#define IPT_OSF_NETLINK 8
320+
321+#define IPT_OSF_LOGLEVEL_ALL 0
322+#define IPT_OSF_LOGLEVEL_FIRST 1
323+
324+#include <linux/list.h>
325+
326+#ifndef __KERNEL__
327+#include <netinet/ip.h>
328+#include <netinet/tcp.h>
329+
330+struct list_head
331+{
332+ struct list_head *prev, *next;
333+};
334+#endif
335+
336+struct ipt_osf_info
337+{
338+ char genre[MAXGENRELEN];
339+ int len;
340+ unsigned long flags;
341+ int loglevel;
342+ int invert; /* UNSUPPORTED */
343+};
344+
345+struct osf_wc
346+{
347+ char wc;
348+ unsigned long val;
349+};
350+
351+/* This struct represents IANA options
352+ * http://www.iana.org/assignments/tcp-parameters
353+ */
354+struct osf_opt
355+{
356+ unsigned char kind;
357+ unsigned char length;
358+ struct osf_wc wc;
359+};
360+
361+struct osf_finger
362+{
363+ struct list_head flist;
364+ struct osf_wc wss;
365+ unsigned char ttl;
366+ unsigned char df;
367+ unsigned long ss;
368+ unsigned char genre[MAXGENRELEN];
369+ unsigned char version[MAXGENRELEN], subtype[MAXGENRELEN];
370+
371+ /* Not needed, but for consistency with original table from Michal Zalewski */
372+ unsigned char details[MAXDETLEN];
373+
374+ int opt_num;
375+ struct osf_opt opt[MAX_IPOPTLEN]; /* In case it is all NOP or EOL */
376+
377+};
378+
379+struct ipt_osf_nlmsg
380+{
381+ struct osf_finger f;
382+ struct iphdr ip;
383+ struct tcphdr tcp;
384+};
385+
386+#ifdef __KERNEL__
387+
388+/* Defines for IANA option kinds */
389+
390+#define OSFOPT_EOL 0 /* End of options */
391+#define OSFOPT_NOP 1 /* NOP */
392+#define OSFOPT_MSS 2 /* Maximum segment size */
393+#define OSFOPT_WSO 3 /* Window scale option */
394+#define OSFOPT_SACKP 4 /* SACK permitted */
395+#define OSFOPT_SACK 5 /* SACK */
396+#define OSFOPT_ECHO 6
397+#define OSFOPT_ECHOREPLY 7
398+#define OSFOPT_TS 8 /* Timestamp option */
399+#define OSFOPT_POCP 9 /* Partial Order Connection Permitted */
400+#define OSFOPT_POSP 10 /* Partial Order Service Profile */
401+/* Others are not used in current OSF */
402+
403+static struct osf_opt IANA_opts[] =
404+{
405+ {0, 1,},
406+ {1, 1,},
407+ {2, 4,},
408+ {3, 3,},
409+ {4, 2,},
410+ {5, 1 ,}, /* SACK length is not defined */
411+ {6, 6,},
412+ {7, 6,},
413+ {8, 10,},
414+ {9, 2,},
415+ {10, 3,},
416+ {11, 1,}, /* CC: Suppose 1 */
417+ {12, 1,}, /* the same */
418+ {13, 1,}, /* and here too */
419+ {14, 3,},
420+ {15, 1,}, /* TCP Alternate Checksum Data. Length is not defined */
421+ {16, 1,},
422+ {17, 1,},
423+ {18, 3,},
424+ {19, 18,},
425+ {20, 1,},
426+ {21, 1,},
427+ {22, 1,},
428+ {23, 1,},
429+ {24, 1,},
430+ {25, 1,},
431+ {26, 1,},
432+};
433+
434+#endif /* __KERNEL__ */
435+
436+#endif /* _IPT_OSF_H */
437diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_pool.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_pool.h
438--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_pool.h 1970-01-01 01:00:00.000000000 +0100
439+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_pool.h 2004-04-29 09:49:29.000000000 +0200
440@@ -0,0 +1,25 @@
441+#ifndef _IPT_POOL_H
442+#define _IPT_POOL_H
443+
444+#include <linux/netfilter_ipv4/ip_pool.h>
445+
446+#define IPT_POOL_INV_SRC 0x00000001
447+#define IPT_POOL_INV_DST 0x00000002
448+#define IPT_POOL_DEL_SRC 0x00000004
449+#define IPT_POOL_DEL_DST 0x00000008
450+#define IPT_POOL_INV_MOD_SRC 0x00000010
451+#define IPT_POOL_INV_MOD_DST 0x00000020
452+#define IPT_POOL_MOD_SRC_ACCEPT 0x00000040
453+#define IPT_POOL_MOD_DST_ACCEPT 0x00000080
454+#define IPT_POOL_MOD_SRC_DROP 0x00000100
455+#define IPT_POOL_MOD_DST_DROP 0x00000200
456+
457+/* match info */
458+struct ipt_pool_info
459+{
460+ ip_pool_t src;
461+ ip_pool_t dst;
462+ unsigned flags;
463+};
464+
465+#endif /*_IPT_POOL_H*/
466diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_psd.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_psd.h
467--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_psd.h 1970-01-01 01:00:00.000000000 +0100
468+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_psd.h 2004-04-29 09:49:40.000000000 +0200
469@@ -0,0 +1,40 @@
470+#ifndef _IPT_PSD_H
471+#define _IPT_PSD_H
472+
473+#include <linux/param.h>
474+#include <linux/types.h>
475+
476+/*
477+ * High port numbers have a lower weight to reduce the frequency of false
478+ * positives, such as from passive mode FTP transfers.
479+ */
480+#define PORT_WEIGHT_PRIV 3
481+#define PORT_WEIGHT_HIGH 1
482+
483+/*
484+ * Port scan detection thresholds: at least COUNT ports need to be scanned
485+ * from the same source, with no longer than DELAY ticks between ports.
486+ */
487+#define SCAN_MIN_COUNT 7
488+#define SCAN_MAX_COUNT (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
489+#define SCAN_WEIGHT_THRESHOLD SCAN_MAX_COUNT
490+#define SCAN_DELAY_THRESHOLD (HZ * 3)
491+
492+/*
493+ * Keep track of up to LIST_SIZE source addresses, using a hash table of
494+ * HASH_SIZE entries for faster lookups, but limiting hash collisions to
495+ * HASH_MAX source addresses per the same hash value.
496+ */
497+#define LIST_SIZE 0x100
498+#define HASH_LOG 9
499+#define HASH_SIZE (1 << HASH_LOG)
500+#define HASH_MAX 0x10
501+
502+struct ipt_psd_info {
503+ unsigned int weight_threshold;
504+ unsigned int delay_threshold;
505+ unsigned short lo_ports_weight;
506+ unsigned short hi_ports_weight;
507+};
508+
509+#endif /*_IPT_PSD_H*/
510diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_quota.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_quota.h
511--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_quota.h 1970-01-01 01:00:00.000000000 +0100
512+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_quota.h 2004-04-29 09:49:47.000000000 +0200
513@@ -0,0 +1,11 @@
514+#ifndef _IPT_QUOTA_H
515+#define _IPT_QUOTA_H
516+
517+/* print debug info in both kernel/netfilter module & iptable library */
518+//#define DEBUG_IPT_QUOTA
519+
520+struct ipt_quota_info {
521+ u_int64_t quota;
522+};
523+
524+#endif /*_IPT_QUOTA_H*/
525diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_random.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_random.h
526--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_random.h 1970-01-01 01:00:00.000000000 +0100
527+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_random.h 2004-04-29 09:49:54.000000000 +0200
528@@ -0,0 +1,11 @@
529+#ifndef _IPT_RAND_H
530+#define _IPT_RAND_H
531+
532+#include <linux/param.h>
533+#include <linux/types.h>
534+
535+struct ipt_rand_info {
536+ u_int8_t average;
537+};
538+
539+#endif /*_IPT_RAND_H*/
540diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_realm.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_realm.h
541--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_realm.h 1970-01-01 01:00:00.000000000 +0100
542+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_realm.h 2004-04-29 09:50:16.000000000 +0200
543@@ -0,0 +1,9 @@
544+#ifndef _IPT_REALM_H
545+#define _IPT_REALM_H
546+
547+struct ipt_realm_info {
548+ u_int32_t id;
549+ u_int32_t mask;
550+ u_int8_t invert;
551+};
552+#endif /*_IPT_REALM_H*/
553diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_sctp.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_sctp.h
554--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_sctp.h 1970-01-01 01:00:00.000000000 +0100
555+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_sctp.h 2004-04-29 09:50:22.000000000 +0200
556@@ -0,0 +1,107 @@
557+#ifndef _IPT_SCTP_H_
558+#define _IPT_SCTP_H_
559+
560+#define IPT_SCTP_SRC_PORTS 0x01
561+#define IPT_SCTP_DEST_PORTS 0x02
562+#define IPT_SCTP_CHUNK_TYPES 0x04
563+
564+#define IPT_SCTP_VALID_FLAGS 0x07
565+
566+#define ELEMCOUNT(x) (sizeof(x)/sizeof(x[0]))
567+
568+
569+struct ipt_sctp_flag_info {
570+ u_int8_t chunktype;
571+ u_int8_t flag;
572+ u_int8_t flag_mask;
573+};
574+
575+#define IPT_NUM_SCTP_FLAGS 4
576+
577+struct ipt_sctp_info {
578+ u_int16_t dpts[2]; /* Min, Max */
579+ u_int16_t spts[2]; /* Min, Max */
580+
581+ u_int32_t chunkmap[256 / sizeof (u_int32_t)]; /* Bit mask of chunks to be matched according to RFC 2960 */
582+
583+#define SCTP_CHUNK_MATCH_ANY 0x01 /* Match if any of the chunk types are present */
584+#define SCTP_CHUNK_MATCH_ALL 0x02 /* Match if all of the chunk types are present */
585+#define SCTP_CHUNK_MATCH_ONLY 0x04 /* Match if these are the only chunk types present */
586+
587+ u_int32_t chunk_match_type;
588+ struct ipt_sctp_flag_info flag_info[IPT_NUM_SCTP_FLAGS];
589+ int flag_count;
590+
591+ u_int32_t flags;
592+ u_int32_t invflags;
593+};
594+
595+#define bytes(type) (sizeof(type) * 8)
596+
597+#define SCTP_CHUNKMAP_SET(chunkmap, type) \
598+ do { \
599+ chunkmap[type / bytes(u_int32_t)] |= \
600+ 1 << (type % bytes(u_int32_t)); \
601+ } while (0)
602+
603+#define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \
604+ do { \
605+ chunkmap[type / bytes(u_int32_t)] &= \
606+ ~(1 << (type % bytes(u_int32_t))); \
607+ } while (0)
608+
609+#define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \
610+({ \
611+ (chunkmap[type / bytes (u_int32_t)] & \
612+ (1 << (type % bytes (u_int32_t)))) ? 1: 0; \
613+})
614+
615+#define SCTP_CHUNKMAP_RESET(chunkmap) \
616+ do { \
617+ int i; \
618+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
619+ chunkmap[i] = 0; \
620+ } while (0)
621+
622+#define SCTP_CHUNKMAP_SET_ALL(chunkmap) \
623+ do { \
624+ int i; \
625+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
626+ chunkmap[i] = ~0; \
627+ } while (0)
628+
629+#define SCTP_CHUNKMAP_COPY(destmap, srcmap) \
630+ do { \
631+ int i; \
632+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
633+ destmap[i] = srcmap[i]; \
634+ } while (0)
635+
636+#define SCTP_CHUNKMAP_IS_CLEAR(chunkmap) \
637+({ \
638+ int i; \
639+ int flag = 1; \
640+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) { \
641+ if (chunkmap[i]) { \
642+ flag = 0; \
643+ break; \
644+ } \
645+ } \
646+ flag; \
647+})
648+
649+#define SCTP_CHUNKMAP_IS_ALL_SET(chunkmap) \
650+({ \
651+ int i; \
652+ int flag = 1; \
653+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) { \
654+ if (chunkmap[i] != ~0) { \
655+ flag = 0; \
656+ break; \
657+ } \
658+ } \
659+ flag; \
660+})
661+
662+#endif /* _IPT_SCTP_H_ */
663+
664diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_time.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_time.h
665--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_time.h 1970-01-01 01:00:00.000000000 +0100
666+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_time.h 2004-04-29 09:50:30.000000000 +0200
667@@ -0,0 +1,13 @@
668+#ifndef __ipt_time_h_included__
669+#define __ipt_time_h_included__
670+
671+
672+struct ipt_time_info {
673+ u_int8_t days_match; /* 1 bit per day. -SMTWTFS */
674+ u_int16_t time_start; /* 0 < time_start < 23*60+59 = 1439 */
675+ u_int16_t time_stop; /* 0:0 < time_stat < 23:59 */
676+ u_int8_t kerneltime; /* ignore skb time (and use kerneltime) or not. */
677+};
678+
679+
680+#endif /* __ipt_time_h_included__ */
681diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_u32.h linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_u32.h
682--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv4/ipt_u32.h 1970-01-01 01:00:00.000000000 +0100
683+++ linux-2.6.6-rc3/include/linux/netfilter_ipv4/ipt_u32.h 2004-04-29 09:50:36.000000000 +0200
684@@ -0,0 +1,40 @@
685+#ifndef _IPT_U32_H
686+#define _IPT_U32_H
687+#include <linux/netfilter_ipv4/ip_tables.h>
688+
689+enum ipt_u32_ops
690+{
691+ IPT_U32_AND,
692+ IPT_U32_LEFTSH,
693+ IPT_U32_RIGHTSH,
694+ IPT_U32_AT
695+};
696+
697+struct ipt_u32_location_element
698+{
699+ u_int32_t number;
700+ u_int8_t nextop;
701+};
702+struct ipt_u32_value_element
703+{
704+ u_int32_t min;
705+ u_int32_t max;
706+};
707+/* *** any way to allow for an arbitrary number of elements?
708+ for now I settle for a limit of 10 of each */
709+#define U32MAXSIZE 10
710+struct ipt_u32_test
711+{
712+ u_int8_t nnums;
713+ struct ipt_u32_location_element location[U32MAXSIZE+1];
714+ u_int8_t nvalues;
715+ struct ipt_u32_value_element value[U32MAXSIZE+1];
716+};
717+
718+struct ipt_u32
719+{
720+ u_int8_t ntests;
721+ struct ipt_u32_test tests[U32MAXSIZE+1];
722+};
723+
724+#endif /*_IPT_U32_H*/
725diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv6/ip6t_HL.h linux-2.6.6-rc3/include/linux/netfilter_ipv6/ip6t_HL.h
726--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv6/ip6t_HL.h 1970-01-01 01:00:00.000000000 +0100
727+++ linux-2.6.6-rc3/include/linux/netfilter_ipv6/ip6t_HL.h 2004-04-29 09:46:34.000000000 +0200
728@@ -0,0 +1,22 @@
729+/* Hop Limit modification module for ip6tables
730+ * Maciej Soltysiak <solt@dns.toxicfilms.tv>
731+ * Based on HW's TTL module */
732+
733+#ifndef _IP6T_HL_H
734+#define _IP6T_HL_H
735+
736+enum {
737+ IP6T_HL_SET = 0,
738+ IP6T_HL_INC,
739+ IP6T_HL_DEC
740+};
741+
742+#define IP6T_HL_MAXMODE IP6T_HL_DEC
743+
744+struct ip6t_HL_info {
745+ u_int8_t mode;
746+ u_int8_t hop_limit;
747+};
748+
749+
750+#endif
751diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv6/ip6t_REJECT.h linux-2.6.6-rc3/include/linux/netfilter_ipv6/ip6t_REJECT.h
752--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv6/ip6t_REJECT.h 2004-04-28 03:34:59.000000000 +0200
753+++ linux-2.6.6-rc3/include/linux/netfilter_ipv6/ip6t_REJECT.h 2004-04-29 09:47:26.000000000 +0200
754@@ -2,15 +2,17 @@
755 #define _IP6T_REJECT_H
756
757 enum ip6t_reject_with {
758- IP6T_ICMP_NET_UNREACHABLE,
759- IP6T_ICMP_HOST_UNREACHABLE,
760- IP6T_ICMP_PROT_UNREACHABLE,
761- IP6T_ICMP_PORT_UNREACHABLE,
762- IP6T_ICMP_ECHOREPLY
763+ IP6T_ICMP6_NO_ROUTE,
764+ IP6T_ICMP6_ADM_PROHIBITED,
765+ IP6T_ICMP6_NOT_NEIGHBOUR,
766+ IP6T_ICMP6_ADDR_UNREACH,
767+ IP6T_ICMP6_PORT_UNREACH,
768+ IP6T_ICMP6_ECHOREPLY,
769+ IP6T_TCP_RESET
770 };
771
772 struct ip6t_reject_info {
773 enum ip6t_reject_with with; /* reject type */
774 };
775
776-#endif /*_IPT_REJECT_H*/
777+#endif /*_IP6T_REJECT_H*/
778diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv6/ip6t_fuzzy.h linux-2.6.6-rc3/include/linux/netfilter_ipv6/ip6t_fuzzy.h
779--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv6/ip6t_fuzzy.h 1970-01-01 01:00:00.000000000 +0100
780+++ linux-2.6.6-rc3/include/linux/netfilter_ipv6/ip6t_fuzzy.h 2004-04-29 09:48:15.000000000 +0200
781@@ -0,0 +1,21 @@
782+#ifndef _IP6T_FUZZY_H
783+#define _IP6T_FUZZY_H
784+
785+#include <linux/param.h>
786+#include <linux/types.h>
787+
788+#define MAXFUZZYRATE 10000000
789+#define MINFUZZYRATE 3
790+
791+struct ip6t_fuzzy_info {
792+ u_int32_t minimum_rate;
793+ u_int32_t maximum_rate;
794+ u_int32_t packets_total;
795+ u_int32_t bytes_total;
796+ u_int32_t previous_time;
797+ u_int32_t present_time;
798+ u_int32_t mean_rate;
799+ u_int8_t acceptance_rate;
800+};
801+
802+#endif /*_IP6T_FUZZY_H*/
803diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv6/ip6t_nth.h linux-2.6.6-rc3/include/linux/netfilter_ipv6/ip6t_nth.h
804--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv6/ip6t_nth.h 1970-01-01 01:00:00.000000000 +0100
805+++ linux-2.6.6-rc3/include/linux/netfilter_ipv6/ip6t_nth.h 2004-04-29 09:49:13.000000000 +0200
806@@ -0,0 +1,19 @@
807+#ifndef _IP6T_NTH_H
808+#define _IP6T_NTH_H
809+
810+#include <linux/param.h>
811+#include <linux/types.h>
812+
813+#ifndef IP6T_NTH_NUM_COUNTERS
814+#define IP6T_NTH_NUM_COUNTERS 16
815+#endif
816+
817+struct ip6t_nth_info {
818+ u_int8_t every;
819+ u_int8_t not;
820+ u_int8_t startat;
821+ u_int8_t counter;
822+ u_int8_t packet;
823+};
824+
825+#endif /*_IP6T_NTH_H*/
826diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/netfilter_ipv6/ip6t_random.h linux-2.6.6-rc3/include/linux/netfilter_ipv6/ip6t_random.h
827--- linux-2.6.6-rc3.org/include/linux/netfilter_ipv6/ip6t_random.h 1970-01-01 01:00:00.000000000 +0100
828+++ linux-2.6.6-rc3/include/linux/netfilter_ipv6/ip6t_random.h 2004-04-29 09:49:54.000000000 +0200
829@@ -0,0 +1,11 @@
830+#ifndef _IP6T_RAND_H
831+#define _IP6T_RAND_H
832+
833+#include <linux/param.h>
834+#include <linux/types.h>
835+
836+struct ip6t_rand_info {
837+ u_int8_t average;
838+};
839+
840+#endif /*_IP6T_RAND_H*/
841diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/include/linux/skbuff.h linux-2.6.6-rc3/include/linux/skbuff.h
842--- linux-2.6.6-rc3.org/include/linux/skbuff.h 2004-04-29 09:37:52.000000000 +0200
843+++ linux-2.6.6-rc3/include/linux/skbuff.h 2004-04-29 09:45:51.000000000 +0200
844@@ -1049,6 +1049,14 @@
845 if (nfct)
846 atomic_inc(&nfct->master->use);
847 }
848+static inline void nf_reset(struct sk_buff *skb)
849+{
850+ nf_conntrack_put(skb->nfct);
851+ skb->nfct = NULL;
852+#ifdef CONFIG_NETFILTER_DEBUG
853+ skb->nf_debug = 0;
854+#endif
855+}
856
857 #ifdef CONFIG_BRIDGE_NETFILTER
858 static inline void nf_bridge_put(struct nf_bridge_info *nf_bridge)
859@@ -1061,9 +1069,10 @@
860 if (nf_bridge)
861 atomic_inc(&nf_bridge->use);
862 }
863-#endif
864-
865-#endif
866+#endif /* CONFIG_BRIDGE_NETFILTER */
867+#else /* CONFIG_NETFILTER */
868+static inline void nf_reset(struct sk_buff *skb) {}
869+#endif /* CONFIG_NETFILTER */
870
871 #endif /* __KERNEL__ */
872 #endif /* _LINUX_SKBUFF_H */
873diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/ip_gre.c linux-2.6.6-rc3/net/ipv4/ip_gre.c
874--- linux-2.6.6-rc3.org/net/ipv4/ip_gre.c 2004-04-28 03:36:22.000000000 +0200
875+++ linux-2.6.6-rc3/net/ipv4/ip_gre.c 2004-04-29 09:45:51.000000000 +0200
876@@ -643,13 +643,7 @@
877 skb->dev = tunnel->dev;
878 dst_release(skb->dst);
879 skb->dst = NULL;
880-#ifdef CONFIG_NETFILTER
881- nf_conntrack_put(skb->nfct);
882- skb->nfct = NULL;
883-#ifdef CONFIG_NETFILTER_DEBUG
884- skb->nf_debug = 0;
885-#endif
886-#endif
887+ nf_reset(skb);
888 ipgre_ecn_decapsulate(iph, skb);
889 netif_rx(skb);
890 read_unlock(&ipgre_lock);
891@@ -877,13 +871,7 @@
892 }
893 }
894
895-#ifdef CONFIG_NETFILTER
896- nf_conntrack_put(skb->nfct);
897- skb->nfct = NULL;
898-#ifdef CONFIG_NETFILTER_DEBUG
899- skb->nf_debug = 0;
900-#endif
901-#endif
902+ nf_reset(skb);
903
904 IPTUNNEL_XMIT();
905 tunnel->recursion--;
906diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/ip_input.c linux-2.6.6-rc3/net/ipv4/ip_input.c
907--- linux-2.6.6-rc3.org/net/ipv4/ip_input.c 2004-04-28 03:35:06.000000000 +0200
908+++ linux-2.6.6-rc3/net/ipv4/ip_input.c 2004-04-29 09:45:51.000000000 +0200
909@@ -202,17 +202,13 @@
910
911 #ifdef CONFIG_NETFILTER_DEBUG
912 nf_debug_ip_local_deliver(skb);
913- skb->nf_debug = 0;
914 #endif /*CONFIG_NETFILTER_DEBUG*/
915
916 __skb_pull(skb, ihl);
917
918-#ifdef CONFIG_NETFILTER
919 /* Free reference early: we don't need it any more, and it may
920 hold ip_conntrack module loaded indefinitely. */
921- nf_conntrack_put(skb->nfct);
922- skb->nfct = NULL;
923-#endif /*CONFIG_NETFILTER*/
924+ nf_reset(skb);
925
926 /* Point into the IP datagram, just past the header. */
927 skb->h.raw = skb->data;
928diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/ipip.c linux-2.6.6-rc3/net/ipv4/ipip.c
929--- linux-2.6.6-rc3.org/net/ipv4/ipip.c 2004-04-28 03:37:06.000000000 +0200
930+++ linux-2.6.6-rc3/net/ipv4/ipip.c 2004-04-29 09:45:51.000000000 +0200
931@@ -496,13 +496,7 @@
932 skb->dev = tunnel->dev;
933 dst_release(skb->dst);
934 skb->dst = NULL;
935-#ifdef CONFIG_NETFILTER
936- nf_conntrack_put(skb->nfct);
937- skb->nfct = NULL;
938-#ifdef CONFIG_NETFILTER_DEBUG
939- skb->nf_debug = 0;
940-#endif
941-#endif
942+ nf_reset(skb);
943 ipip_ecn_decapsulate(iph, skb);
944 netif_rx(skb);
945 read_unlock(&ipip_lock);
946@@ -647,13 +641,7 @@
947 if ((iph->ttl = tiph->ttl) == 0)
948 iph->ttl = old_iph->ttl;
949
950-#ifdef CONFIG_NETFILTER
951- nf_conntrack_put(skb->nfct);
952- skb->nfct = NULL;
953-#ifdef CONFIG_NETFILTER_DEBUG
954- skb->nf_debug = 0;
955-#endif
956-#endif
957+ nf_reset(skb);
958
959 IPTUNNEL_XMIT();
960 tunnel->recursion--;
961diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/netfilter/Kconfig linux-2.6.6-rc3/net/ipv4/netfilter/Kconfig
962--- linux-2.6.6-rc3.org/net/ipv4/netfilter/Kconfig 2004-04-28 03:36:31.000000000 +0200
963+++ linux-2.6.6-rc3/net/ipv4/netfilter/Kconfig 2004-04-29 09:50:36.000000000 +0200
964@@ -603,5 +603,99 @@
965 <file:Documentation/modules.txt>. If unsure, say `N'.
966 help
967
968+config IP_NF_TARGET_IPV4OPTSSTRIP
969+ tristate 'IPV4OPTSSTRIP target support'
970+ depends on IP_NF_MANGLE
971+ help
972+
973+config IP_NF_TARGET_NETLINK
974+ tristate 'NETLINK target support'
975+ depends on IP_NF_FILTER
976+ help
977+
978+config IP_NF_TARGET_TTL
979+ tristate 'TTL target support'
980+ depends on IP_NF_MANGLE
981+ help
982+
983+config IP_NF_MATCH_CONNLIMIT
984+ tristate 'Connections/IP limit match support'
985+ depends on IP_NF_IPTABLES
986+ help
987+
988+config IP_NF_MATCH_DSTLIMIT
989+ tristate 'dstlimit match support'
990+ depends on IP_NF_IPTABLES
991+ help
992+
993+config IP_NF_MATCH_FUZZY
994+ tristate 'fuzzy match support'
995+ depends on IP_NF_IPTABLES
996+ help
997+
998+config IP_NF_MATCH_IPV4OPTIONS
999+ tristate 'IPV4OPTIONS match support'
1000+ depends on IP_NF_IPTABLES
1001+ help
1002+
1003+config IP_NF_MATCH_MPORT
1004+ tristate 'Multiple port with ranges match support'
1005+ depends on IP_NF_IPTABLES
1006+ help
1007+
1008+config IP_NF_MATCH_NTH
1009+ tristate 'Nth match support'
1010+ depends on IP_NF_IPTABLES
1011+ help
1012+
1013+config IP_NF_MATCH_OSF
1014+ tristate 'OSF match support'
1015+ depends on IP_NF_IPTABLES
1016+ help
1017+
1018+config IP_POOL_STATISTICS
1019+ bool 'enable statistics on pool usage'
1020+ depends on IP_NF_POOL!=n
1021+
1022+config IP_NF_POOL
1023+ tristate 'IP address pool support'
1024+ depends on IP_NF_IPTABLES
1025+ help
1026+
1027+config IP_NF_MATCH_PSD
1028+ tristate 'psd match support'
1029+ depends on IP_NF_IPTABLES
1030+ help
1031+
1032+config IP_NF_MATCH_QUOTA
1033+ tristate 'quota match support'
1034+ depends on IP_NF_IPTABLES
1035+ help
1036+
1037+config IP_NF_MATCH_RANDOM
1038+ tristate 'random match support'
1039+ depends on IP_NF_IPTABLES
1040+ help
1041+
1042+config IP_NF_MATCH_REALM
1043+ tristate 'realm match support'
1044+ depends on IP_NF_IPTABLES && NET_CLS_ROUTE
1045+ help
1046+
1047+config IP_NF_MATCH_SCTP
1048+ tristate 'SCTP protocol match support'
1049+ depends on IP_NF_IPTABLES
1050+ help
1051+
1052+config IP_NF_MATCH_TIME
1053+ tristate 'TIME match support'
1054+ depends on IP_NF_IPTABLES
1055+ help
1056+
1057+config IP_NF_MATCH_U32
1058+ tristate 'U32 match support'
1059+ depends on IP_NF_IPTABLES
1060+ help
1061+
1062 endmenu
1063
1064diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/netfilter/Makefile linux-2.6.6-rc3/net/ipv4/netfilter/Makefile
1065--- linux-2.6.6-rc3.org/net/ipv4/netfilter/Makefile 2004-04-28 03:35:21.000000000 +0200
1066+++ linux-2.6.6-rc3/net/ipv4/netfilter/Makefile 2004-04-29 09:50:36.000000000 +0200
1067@@ -43,15 +43,39 @@
1068 # matches
1069 obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
1070 obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
1071+obj-$(CONFIG_IP_NF_MATCH_SCTP) += ipt_sctp.o
1072+obj-$(CONFIG_IP_NF_MATCH_QUOTA) += ipt_quota.o
1073+obj-$(CONFIG_IP_NF_MATCH_DSTLIMIT) += ipt_dstlimit.o
1074 obj-$(CONFIG_IP_NF_MATCH_MARK) += ipt_mark.o
1075+obj-$(CONFIG_IP_NF_POOL) += ipt_pool.o ipt_POOL.o ip_pool.o
1076 obj-$(CONFIG_IP_NF_MATCH_MAC) += ipt_mac.o
1077 obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
1078
1079 obj-$(CONFIG_IP_NF_MATCH_PKTTYPE) += ipt_pkttype.o
1080 obj-$(CONFIG_IP_NF_MATCH_MULTIPORT) += ipt_multiport.o
1081+
1082+obj-$(CONFIG_IP_NF_MATCH_MPORT) += ipt_mport.o
1083+
1084 obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
1085 obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
1086
1087+obj-$(CONFIG_IP_NF_MATCH_TIME) += ipt_time.o
1088+
1089+
1090+obj-$(CONFIG_IP_NF_MATCH_RANDOM) += ipt_random.o
1091+
1092+obj-$(CONFIG_IP_NF_MATCH_PSD) += ipt_psd.o
1093+
1094+obj-$(CONFIG_IP_NF_MATCH_OSF) += ipt_osf.o
1095+
1096+
1097+obj-$(CONFIG_IP_NF_MATCH_NTH) += ipt_nth.o
1098+
1099+obj-$(CONFIG_IP_NF_MATCH_IPV4OPTIONS) += ipt_ipv4options.o
1100+
1101+
1102+obj-$(CONFIG_IP_NF_MATCH_FUZZY) += ipt_fuzzy.o
1103+
1104 obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
1105
1106 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
1107@@ -60,10 +84,15 @@
1108
1109 obj-$(CONFIG_IP_NF_MATCH_LENGTH) += ipt_length.o
1110
1111+obj-$(CONFIG_IP_NF_MATCH_U32) += ipt_u32.o
1112+
1113+
1114 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
1115 obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
1116+obj-$(CONFIG_IP_NF_MATCH_CONNLIMIT) += ipt_connlimit.o
1117 obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
1118 obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
1119+obj-$(CONFIG_IP_NF_MATCH_REALM) += ipt_realm.o
1120
1121 obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o
1122
1123@@ -80,6 +109,9 @@
1124 obj-$(CONFIG_IP_NF_TARGET_CLASSIFY) += ipt_CLASSIFY.o
1125 obj-$(CONFIG_IP_NF_NAT_SNMP_BASIC) += ip_nat_snmp_basic.o
1126 obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
1127+obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
1128+obj-$(CONFIG_IP_NF_TARGET_NETLINK) += ipt_NETLINK.o
1129+obj-$(CONFIG_IP_NF_TARGET_IPV4OPTSSTRIP) += ipt_IPV4OPTSSTRIP.o
1130 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
1131 obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
1132 obj-$(CONFIG_IP_NF_TARGET_NOTRACK) += ipt_NOTRACK.o
1133diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/netfilter/ip_conntrack_core.c linux-2.6.6-rc3/net/ipv4/netfilter/ip_conntrack_core.c
1134--- linux-2.6.6-rc3.org/net/ipv4/netfilter/ip_conntrack_core.c 2004-04-28 03:34:58.000000000 +0200
1135+++ linux-2.6.6-rc3/net/ipv4/netfilter/ip_conntrack_core.c 2004-04-29 09:46:00.000000000 +0200
1136@@ -324,8 +324,9 @@
1137 ip_conntrack_destroyed(ct);
1138
1139 WRITE_LOCK(&ip_conntrack_lock);
1140- /* Delete us from our own list to prevent corruption later */
1141- list_del(&ct->sibling_list);
1142+ /* Make sure don't leave any orphaned expectations lying around */
1143+ if (ct->expecting)
1144+ remove_expectations(ct, 1);
1145
1146 /* Delete our master expectation */
1147 if (ct->master) {
1148@@ -692,42 +693,50 @@
1149 struct ip_conntrack_expect *, tuple);
1150 READ_UNLOCK(&ip_conntrack_expect_tuple_lock);
1151
1152- /* If master is not in hash table yet (ie. packet hasn't left
1153- this machine yet), how can other end know about expected?
1154- Hence these are not the droids you are looking for (if
1155- master ct never got confirmed, we'd hold a reference to it
1156- and weird things would happen to future packets). */
1157- if (expected && !is_confirmed(expected->expectant))
1158- expected = NULL;
1159-
1160- /* Look up the conntrack helper for master connections only */
1161- if (!expected)
1162- conntrack->helper = ip_ct_find_helper(&repl_tuple);
1163-
1164- /* If the expectation is dying, then this is a loser. */
1165- if (expected
1166- && expected->expectant->helper->timeout
1167- && ! del_timer(&expected->timeout))
1168- expected = NULL;
1169-
1170 if (expected) {
1171- DEBUGP("conntrack: expectation arrives ct=%p exp=%p\n",
1172- conntrack, expected);
1173- /* Welcome, Mr. Bond. We've been expecting you... */
1174- IP_NF_ASSERT(master_ct(conntrack));
1175- __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
1176- conntrack->master = expected;
1177- expected->sibling = conntrack;
1178- LIST_DELETE(&ip_conntrack_expect_list, expected);
1179- expected->expectant->expecting--;
1180- nf_conntrack_get(&master_ct(conntrack)->infos[0]);
1181- }
1182- atomic_inc(&ip_conntrack_count);
1183+ /* If master is not in hash table yet (ie. packet hasn't left
1184+ this machine yet), how can other end know about expected?
1185+ Hence these are not the droids you are looking for (if
1186+ master ct never got confirmed, we'd hold a reference to it
1187+ and weird things would happen to future packets). */
1188+ if (!is_confirmed(expected->expectant)) {
1189+
1190+ conntrack->helper = ip_ct_find_helper(&repl_tuple);
1191+ goto end;
1192+ }
1193+
1194+ /* Expectation is dying... */
1195+ if (expected->expectant->helper->timeout
1196+ && ! del_timer(&expected->timeout)) {
1197+ goto end;
1198+ }
1199+
1200+ DEBUGP("conntrack: expectation arrives ct=%p exp=%p\n",
1201+ conntrack, expected);
1202+ /* Welcome, Mr. Bond. We've been expecting you... */
1203+ IP_NF_ASSERT(master_ct(conntrack));
1204+ __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
1205+ conntrack->master = expected;
1206+ expected->sibling = conntrack;
1207+ LIST_DELETE(&ip_conntrack_expect_list, expected);
1208+ expected->expectant->expecting--;
1209+ nf_conntrack_get(&master_ct(conntrack)->infos[0]);
1210+
1211+ /* this is a braindead... --pablo */
1212+ atomic_inc(&ip_conntrack_count);
1213+ WRITE_UNLOCK(&ip_conntrack_lock);
1214+
1215+ if (expected->expectfn)
1216+ expected->expectfn(conntrack);
1217+
1218+ goto ret;
1219+ } else
1220+ conntrack->helper = ip_ct_find_helper(&repl_tuple);
1221+
1222+end: atomic_inc(&ip_conntrack_count);
1223 WRITE_UNLOCK(&ip_conntrack_lock);
1224
1225- if (expected && expected->expectfn)
1226- expected->expectfn(conntrack);
1227- return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
1228+ret: return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
1229 }
1230
1231 /* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
1232@@ -947,9 +956,8 @@
1233 atomic_set(&new->use, 1);
1234
1235 /* add to expected list for this connection */
1236- list_add(&new->expected_list, &related_to->sibling_list);
1237+ list_add_tail(&new->expected_list, &related_to->sibling_list);
1238 /* add to global list of expectations */
1239-
1240 list_prepend(&ip_conntrack_expect_list, &new->list);
1241 /* add and start timer if required */
1242 if (related_to->helper->timeout) {
1243@@ -1003,7 +1011,6 @@
1244
1245 } else if (related_to->helper->max_expected &&
1246 related_to->expecting >= related_to->helper->max_expected) {
1247- struct list_head *cur_item;
1248 /* old == NULL */
1249 if (!(related_to->helper->flags &
1250 IP_CT_HELPER_F_REUSE_EXPECT)) {
1251@@ -1029,21 +1036,14 @@
1252 NIPQUAD(related_to->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip));
1253
1254 /* choose the the oldest expectation to evict */
1255- list_for_each(cur_item, &related_to->sibling_list) {
1256- struct ip_conntrack_expect *cur;
1257-
1258- cur = list_entry(cur_item,
1259- struct ip_conntrack_expect,
1260- expected_list);
1261- if (cur->sibling == NULL) {
1262- old = cur;
1263+ list_for_each_entry(old, &related_to->sibling_list,
1264+ expected_list)
1265+ if (old->sibling == NULL)
1266 break;
1267- }
1268- }
1269
1270- /* (!old) cannot happen, since related_to->expecting is the
1271- * number of unconfirmed expects */
1272- IP_NF_ASSERT(old);
1273+ /* We cannot fail since related_to->expecting is the number
1274+ * of unconfirmed expectations */
1275+ IP_NF_ASSERT(old && old->sibling == NULL);
1276
1277 /* newnat14 does not reuse the real allocated memory
1278 * structures but rather unexpects the old and
1279diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/netfilter/ip_nat_core.c linux-2.6.6-rc3/net/ipv4/netfilter/ip_nat_core.c
1280--- linux-2.6.6-rc3.org/net/ipv4/netfilter/ip_nat_core.c 2004-04-28 03:35:10.000000000 +0200
1281+++ linux-2.6.6-rc3/net/ipv4/netfilter/ip_nat_core.c 2004-04-29 09:43:53.000000000 +0200
1282@@ -816,7 +816,7 @@
1283
1284 /* Have to grab read lock before sibling_list traversal */
1285 READ_LOCK(&ip_conntrack_lock);
1286- list_for_each(cur_item, &ct->sibling_list) {
1287+ list_for_each_prev(cur_item, &ct->sibling_list) {
1288 exp = list_entry(cur_item, struct ip_conntrack_expect,
1289 expected_list);
1290
1291diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/netfilter/ip_pool.c linux-2.6.6-rc3/net/ipv4/netfilter/ip_pool.c
1292--- linux-2.6.6-rc3.org/net/ipv4/netfilter/ip_pool.c 1970-01-01 01:00:00.000000000 +0100
1293+++ linux-2.6.6-rc3/net/ipv4/netfilter/ip_pool.c 2004-04-29 09:49:29.000000000 +0200
1294@@ -0,0 +1,334 @@
1295+/* Kernel module for IP pool management */
1296+
1297+#include <linux/module.h>
1298+#include <linux/ip.h>
1299+#include <linux/skbuff.h>
1300+#include <linux/netfilter_ipv4/ip_tables.h>
1301+#include <linux/netfilter_ipv4/ip_pool.h>
1302+#include <linux/errno.h>
1303+#include <asm/uaccess.h>
1304+#include <asm/bitops.h>
1305+#include <linux/interrupt.h>
1306+#include <linux/spinlock.h>
1307+
1308+#if 0
1309+#define DP printk
1310+#else
1311+#define DP(format, args...)
1312+#endif
1313+
1314+MODULE_LICENSE("GPL");
1315+
1316+#define NR_POOL 16
1317+static int nr_pool = NR_POOL;/* overwrite this when loading module */
1318+
1319+struct ip_pool {
1320+ u_int32_t first_ip; /* host byte order, included in range */
1321+ u_int32_t last_ip; /* host byte order, included in range */
1322+ void *members; /* the bitmap proper */
1323+ int nr_use; /* total nr. of tests through this */
1324+ int nr_match; /* total nr. of matches through this */
1325+ rwlock_t lock;
1326+};
1327+
1328+static struct ip_pool *POOL;
1329+
1330+static inline struct ip_pool *lookup(ip_pool_t index)
1331+{
1332+ if (index < 0 || index >= nr_pool) {
1333+ DP("ip_pool:lookup: bad index %d\n", index);
1334+ return 0;
1335+ }
1336+ return POOL+index;
1337+}
1338+
1339+int ip_pool_match(ip_pool_t index, u_int32_t addr)
1340+{
1341+ struct ip_pool *pool = lookup(index);
1342+ int res = 0;
1343+
1344+ if (!pool || !pool->members)
1345+ return 0;
1346+ read_lock_bh(&pool->lock);
1347+ if (pool->members) {
1348+ if (addr >= pool->first_ip && addr <= pool->last_ip) {
1349+ addr -= pool->first_ip;
1350+ if (test_bit(addr, pool->members)) {
1351+ res = 1;
1352+#ifdef CONFIG_IP_POOL_STATISTICS
1353+ pool->nr_match++;
1354+#endif
1355+ }
1356+ }
1357+#ifdef CONFIG_IP_POOL_STATISTICS
1358+ pool->nr_use++;
1359+#endif
1360+ }
1361+ read_unlock_bh(&pool->lock);
1362+ return res;
1363+}
1364+EXPORT_SYMBOL(ip_pool_match);
1365+
1366+static int pool_change(ip_pool_t index, u_int32_t addr, int isdel)
1367+{
1368+ struct ip_pool *pool;
1369+ int res = -1;
1370+
1371+ pool = lookup(index);
1372+ if ( !pool || !pool->members
1373+ || addr < pool->first_ip || addr > pool->last_ip)
1374+ return -1;
1375+ read_lock_bh(&pool->lock);
1376+ if (pool->members && addr >= pool->first_ip && addr <= pool->last_ip) {
1377+ addr -= pool->first_ip;
1378+ res = isdel
1379+ ? (0 != test_and_clear_bit(addr, pool->members))
1380+ : (0 != test_and_set_bit(addr, pool->members));
1381+ }
1382+ read_unlock_bh(&pool->lock);
1383+ return res;
1384+}
1385+
1386+int ip_pool_mod(ip_pool_t index, u_int32_t addr, int isdel)
1387+{
1388+ int res = pool_change(index,addr,isdel);
1389+
1390+ if (!isdel) res = !res;
1391+ return res;
1392+}
1393+EXPORT_SYMBOL(ip_pool_mod);
1394+
1395+static inline int bitmap_bytes(u_int32_t a, u_int32_t b)
1396+{
1397+ return 4*((((b-a+8)/8)+3)/4);
1398+}
1399+
1400+static inline int poolbytes(ip_pool_t index)
1401+{
1402+ struct ip_pool *pool = lookup(index);
1403+
1404+ return pool ? bitmap_bytes(pool->first_ip, pool->last_ip) : 0;
1405+}
1406+
1407+static int setpool(
1408+ struct sock *sk,
1409+ int optval,
1410+ void *user,
1411+ unsigned int len
1412+) {
1413+ struct ip_pool_request req;
1414+
1415+ DP("ip_pool:setpool: optval=%d, user=%p, len=%d\n", optval, user, len);
1416+ if (!capable(CAP_NET_ADMIN))
1417+ return -EPERM;
1418+ if (optval != SO_IP_POOL)
1419+ return -EBADF;
1420+ if (len != sizeof(req))
1421+ return -EINVAL;
1422+ if (copy_from_user(&req, user, sizeof(req)) != 0)
1423+ return -EFAULT;
1424+ printk("obsolete op - upgrade your ippool(8) utility.\n");
1425+ return -EINVAL;
1426+}
1427+
1428+static int getpool(
1429+ struct sock *sk,
1430+ int optval,
1431+ void *user,
1432+ int *len
1433+) {
1434+ struct ip_pool_request req;
1435+ struct ip_pool *pool;
1436+ ip_pool_t i;
1437+ int newbytes;
1438+ void *newmembers;
1439+ int res;
1440+
1441+ DP("ip_pool:getpool: optval=%d, user=%p\n", optval, user);
1442+ if (!capable(CAP_NET_ADMIN))
1443+ return -EINVAL;
1444+ if (optval != SO_IP_POOL)
1445+ return -EINVAL;
1446+ if (*len != sizeof(req)) {
1447+ return -EFAULT;
1448+ }
1449+ if (copy_from_user(&req, user, sizeof(req)) != 0)
1450+ return -EFAULT;
1451+ DP("ip_pool:getpool op=%d, index=%d\n", req.op, req.index);
1452+ if (req.op < IP_POOL_BAD001) {
1453+ printk("obsolete op - upgrade your ippool(8) utility.\n");
1454+ return -EFAULT;
1455+ }
1456+ switch(req.op) {
1457+ case IP_POOL_HIGH_NR:
1458+ DP("ip_pool HIGH_NR\n");
1459+ req.index = IP_POOL_NONE;
1460+ for (i=0; i<nr_pool; i++)
1461+ if (POOL[i].members)
1462+ req.index = i;
1463+ return copy_to_user(user, &req, sizeof(req));
1464+ case IP_POOL_LOOKUP:
1465+ DP("ip_pool LOOKUP\n");
1466+ pool = lookup(req.index);
1467+ if (!pool)
1468+ return -EINVAL;
1469+ if (!pool->members)
1470+ return -EBADF;
1471+ req.addr = htonl(pool->first_ip);
1472+ req.addr2 = htonl(pool->last_ip);
1473+ return copy_to_user(user, &req, sizeof(req));
1474+ case IP_POOL_USAGE:
1475+ DP("ip_pool USE\n");
1476+ pool = lookup(req.index);
1477+ if (!pool)
1478+ return -EINVAL;
1479+ if (!pool->members)
1480+ return -EBADF;
1481+ req.addr = pool->nr_use;
1482+ req.addr2 = pool->nr_match;
1483+ return copy_to_user(user, &req, sizeof(req));
1484+ case IP_POOL_TEST_ADDR:
1485+ DP("ip_pool TEST 0x%08x\n", req.addr);
1486+ pool = lookup(req.index);
1487+ if (!pool)
1488+ return -EINVAL;
1489+ res = 0;
1490+ read_lock_bh(&pool->lock);
1491+ if (!pool->members) {
1492+ DP("ip_pool TEST_ADDR no members in pool\n");
1493+ res = -EBADF;
1494+ goto unlock_and_return_res;
1495+ }
1496+ req.addr = ntohl(req.addr);
1497+ if (req.addr < pool->first_ip) {
1498+ DP("ip_pool TEST_ADDR address < pool bounds\n");
1499+ res = -ERANGE;
1500+ goto unlock_and_return_res;
1501+ }
1502+ if (req.addr > pool->last_ip) {
1503+ DP("ip_pool TEST_ADDR address > pool bounds\n");
1504+ res = -ERANGE;
1505+ goto unlock_and_return_res;
1506+ }
1507+ req.addr = (0 != test_bit((req.addr - pool->first_ip),
1508+ pool->members));
1509+ read_unlock_bh(&pool->lock);
1510+ return copy_to_user(user, &req, sizeof(req));
1511+ case IP_POOL_FLUSH:
1512+ DP("ip_pool FLUSH not yet implemented.\n");
1513+ return -EBUSY;
1514+ case IP_POOL_DESTROY:
1515+ DP("ip_pool DESTROY not yet implemented.\n");
1516+ return -EBUSY;
1517+ case IP_POOL_INIT:
1518+ DP("ip_pool INIT 0x%08x-0x%08x\n", req.addr, req.addr2);
1519+ pool = lookup(req.index);
1520+ if (!pool)
1521+ return -EINVAL;
1522+ req.addr = ntohl(req.addr);
1523+ req.addr2 = ntohl(req.addr2);
1524+ if (req.addr > req.addr2) {
1525+ DP("ip_pool INIT bad ip range\n");
1526+ return -EINVAL;
1527+ }
1528+ newbytes = bitmap_bytes(req.addr, req.addr2);
1529+ newmembers = kmalloc(newbytes, GFP_KERNEL);
1530+ if (!newmembers) {
1531+ DP("ip_pool INIT out of mem for %d bytes\n", newbytes);
1532+ return -ENOMEM;
1533+ }
1534+ memset(newmembers, 0, newbytes);
1535+ write_lock_bh(&pool->lock);
1536+ if (pool->members) {
1537+ DP("ip_pool INIT pool %d exists\n", req.index);
1538+ kfree(newmembers);
1539+ res = -EBUSY;
1540+ goto unlock_and_return_res;
1541+ }
1542+ pool->first_ip = req.addr;
1543+ pool->last_ip = req.addr2;
1544+ pool->nr_use = 0;
1545+ pool->nr_match = 0;
1546+ pool->members = newmembers;
1547+ write_unlock_bh(&pool->lock);
1548+ return 0;
1549+ case IP_POOL_ADD_ADDR:
1550+ DP("ip_pool ADD_ADDR 0x%08x\n", req.addr);
1551+ req.addr = pool_change(req.index, ntohl(req.addr), 0);
1552+ return copy_to_user(user, &req, sizeof(req));
1553+ case IP_POOL_DEL_ADDR:
1554+ DP("ip_pool DEL_ADDR 0x%08x\n", req.addr);
1555+ req.addr = pool_change(req.index, ntohl(req.addr), 1);
1556+ return copy_to_user(user, &req, sizeof(req));
1557+ default:
1558+ DP("ip_pool:getpool bad op %d\n", req.op);
1559+ return -EINVAL;
1560+ }
1561+ return -EINVAL;
1562+
1563+unlock_and_return_res:
1564+ if (pool)
1565+ read_unlock_bh(&pool->lock);
1566+ return res;
1567+}
1568+
1569+static struct nf_sockopt_ops so_pool
1570+= { { NULL, NULL }, PF_INET,
1571+ SO_IP_POOL, SO_IP_POOL+1, &setpool,
1572+ SO_IP_POOL, SO_IP_POOL+1, &getpool,
1573+ 0, NULL };
1574+
1575+MODULE_PARM(nr_pool, "i");
1576+
1577+static int __init init(void)
1578+{
1579+ ip_pool_t i;
1580+ int res;
1581+
1582+ if (nr_pool < 1) {
1583+ printk("ip_pool module init: bad nr_pool %d\n", nr_pool);
1584+ return -EINVAL;
1585+ }
1586+ POOL = kmalloc(nr_pool * sizeof(*POOL), GFP_KERNEL);
1587+ if (!POOL) {
1588+ printk("ip_pool module init: out of memory for nr_pool %d\n",
1589+ nr_pool);
1590+ return -ENOMEM;
1591+ }
1592+ for (i=0; i<nr_pool; i++) {
1593+ POOL[i].first_ip = 0;
1594+ POOL[i].last_ip = 0;
1595+ POOL[i].members = 0;
1596+ POOL[i].nr_use = 0;
1597+ POOL[i].nr_match = 0;
1598+ POOL[i].lock = RW_LOCK_UNLOCKED;
1599+ }
1600+ res = nf_register_sockopt(&so_pool);
1601+ DP("ip_pool:init %d pools, result %d\n", nr_pool, res);
1602+ if (res != 0) {
1603+ kfree(POOL);
1604+ POOL = 0;
1605+ }
1606+ return res;
1607+}
1608+
1609+static void __exit fini(void)
1610+{
1611+ ip_pool_t i;
1612+
1613+ DP("ip_pool:fini BYEBYE\n");
1614+ nf_unregister_sockopt(&so_pool);
1615+ for (i=0; i<nr_pool; i++) {
1616+ if (POOL[i].members) {
1617+ kfree(POOL[i].members);
1618+ POOL[i].members = 0;
1619+ }
1620+ }
1621+ kfree(POOL);
1622+ POOL = 0;
1623+ DP("ip_pool:fini these are the famous last words\n");
1624+ return;
1625+}
1626+
1627+module_init(init);
1628+module_exit(fini);
1629diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/netfilter/ip_tables.c linux-2.6.6-rc3/net/ipv4/netfilter/ip_tables.c
1630--- linux-2.6.6-rc3.org/net/ipv4/netfilter/ip_tables.c 2004-04-28 03:35:21.000000000 +0200
1631+++ linux-2.6.6-rc3/net/ipv4/netfilter/ip_tables.c 2004-04-29 09:46:20.000000000 +0200
1632@@ -1716,9 +1716,9 @@
1633 };
1634
1635 #ifdef CONFIG_PROC_FS
1636-static inline int print_name(const char *i,
1637- off_t start_offset, char *buffer, int length,
1638- off_t *pos, unsigned int *count)
1639+static int print_name(const char *i,
1640+ off_t start_offset, char *buffer, int length,
1641+ off_t *pos, unsigned int *count)
1642 {
1643 if ((*count)++ >= start_offset) {
1644 unsigned int namelen;
1645@@ -1752,6 +1752,15 @@
1646 return pos;
1647 }
1648
1649+static inline int print_target(const struct ipt_target *t,
1650+ off_t start_offset, char *buffer, int length,
1651+ off_t *pos, unsigned int *count)
1652+{
1653+ if (t != &ipt_standard_target && t != &ipt_error_target)
1654+ return 0;
1655+ return print_name((char *)t, start_offset, buffer, length, pos, count);
1656+}
1657+
1658 static int ipt_get_targets(char *buffer, char **start, off_t offset, int length)
1659 {
1660 off_t pos = 0;
1661@@ -1760,7 +1769,7 @@
1662 if (down_interruptible(&ipt_mutex) != 0)
1663 return 0;
1664
1665- LIST_FIND(&ipt_target, print_name, void *,
1666+ LIST_FIND(&ipt_target, print_target, struct ipt_target *,
1667 offset, buffer, length, &pos, &count);
1668
1669 up(&ipt_mutex);
1670diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c linux-2.6.6-rc3/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c
1671--- linux-2.6.6-rc3.org/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c 1970-01-01 01:00:00.000000000 +0100
1672+++ linux-2.6.6-rc3/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c 2004-04-29 09:46:43.000000000 +0200
1673@@ -0,0 +1,89 @@
1674+/**
1675+ * Strip all IP options in the IP packet header.
1676+ *
1677+ * (C) 2001 by Fabrice MARIE <fabrice@netfilter.org>
1678+ * This software is distributed under GNU GPL v2, 1991
1679+ */
1680+
1681+#include <linux/module.h>
1682+#include <linux/skbuff.h>
1683+#include <linux/ip.h>
1684+#include <net/checksum.h>
1685+
1686+#include <linux/netfilter_ipv4/ip_tables.h>
1687+
1688+MODULE_AUTHOR("Fabrice MARIE <fabrice@netfilter.org>");
1689+MODULE_DESCRIPTION("Strip all options in IPv4 packets");
1690+MODULE_LICENSE("GPL");
1691+
1692+static unsigned int
1693+target(struct sk_buff **pskb,
1694+ const struct net_device *in,
1695+ const struct net_device *out,
1696+ unsigned int hooknum,
1697+ const void *targinfo,
1698+ void *userinfo)
1699+{
1700+ struct iphdr *iph;
1701+ struct sk_buff *skb;
1702+ struct ip_options *opt;
1703+ unsigned char *optiph;
1704+ int l;
1705+
1706+ if (!skb_ip_make_writable(pskb, (*pskb)->len))
1707+ return NF_DROP;
1708+
1709+ skb = (*pskb);
1710+ iph = (*pskb)->nh.iph;
1711+ optiph = skb->nh.raw;
1712+ l = ((struct ip_options *)(&(IPCB(skb)->opt)))->optlen;
1713+
1714+ /* if no options in packet then nothing to clear. */
1715+ if (iph->ihl * 4 == sizeof(struct iphdr))
1716+ return IPT_CONTINUE;
1717+
1718+ /* else clear all options */
1719+ memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
1720+ memset(optiph+sizeof(struct iphdr), IPOPT_NOOP, l);
1721+ opt = &(IPCB(skb)->opt);
1722+ opt->is_data = 0;
1723+ opt->optlen = l;
1724+
1725+ skb->nfcache |= NFC_ALTERED;
1726+
1727+ return IPT_CONTINUE;
1728+}
1729+
1730+static int
1731+checkentry(const char *tablename,
1732+ const struct ipt_entry *e,
1733+ void *targinfo,
1734+ unsigned int targinfosize,
1735+ unsigned int hook_mask)
1736+{
1737+ if (strcmp(tablename, "mangle")) {
1738+ printk(KERN_WARNING "IPV4OPTSSTRIP: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
1739+ return 0;
1740+ }
1741+ /* nothing else to check because no parameters */
1742+ return 1;
1743+}
1744+
1745+static struct ipt_target ipt_ipv4optsstrip_reg = {
1746+ .name = "IPV4OPTSSTRIP",
1747+ .target = target,
1748+ .checkentry = checkentry,
1749+ .me = THIS_MODULE };
1750+
1751+static int __init init(void)
1752+{
1753+ return ipt_register_target(&ipt_ipv4optsstrip_reg);
1754+}
1755+
1756+static void __exit fini(void)
1757+{
1758+ ipt_unregister_target(&ipt_ipv4optsstrip_reg);
1759+}
1760+
1761+module_init(init);
1762+module_exit(fini);
1763diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/netfilter/ipt_NETLINK.c linux-2.6.6-rc3/net/ipv4/netfilter/ipt_NETLINK.c
1764--- linux-2.6.6-rc3.org/net/ipv4/netfilter/ipt_NETLINK.c 1970-01-01 01:00:00.000000000 +0100
1765+++ linux-2.6.6-rc3/net/ipv4/netfilter/ipt_NETLINK.c 2004-04-29 09:47:00.000000000 +0200
1766@@ -0,0 +1,119 @@
1767+#include <linux/module.h>
1768+#include <linux/version.h>
1769+#include <linux/config.h>
1770+#include <linux/socket.h>
1771+#include <linux/skbuff.h>
1772+#include <linux/kernel.h>
1773+#include <linux/netlink.h>
1774+#include <linux/netdevice.h>
1775+#include <linux/mm.h>
1776+#include <linux/socket.h>
1777+#include <linux/netfilter_ipv4/ip_tables.h>
1778+#include <linux/netfilter_ipv4/ipt_NETLINK.h>
1779+#include <net/sock.h>
1780+
1781+MODULE_AUTHOR("Gianni Tedesco <gianni@ecsc.co.uk>");
1782+MODULE_DESCRIPTION("Provides iptables NETLINK target similar to ipchains -o");
1783+MODULE_LICENSE("GPL");
1784+
1785+#if 0
1786+#define DEBUGP printk
1787+#else
1788+#define DEBUGP(format, args...)
1789+#endif
1790+
1791+static struct sock *ipfwsk;
1792+
1793+static unsigned int ipt_netlink_target(struct sk_buff **pskb,
1794+ unsigned int hooknum,
1795+ const struct net_device *in,
1796+ const struct net_device *out,
1797+ const void *targinfo, void *userinfo)
1798+{
1799+ struct ipt_nldata *nld = (struct ipt_nldata *)targinfo;
1800+ struct iphdr *ip = (*pskb)->nh.iph;
1801+ struct sk_buff *outskb;
1802+ struct netlink_t nlhdr;
1803+ size_t len=0;
1804+
1805+ /* Allocate a socket buffer */
1806+ if ( MASK(nld->flags, USE_SIZE) )
1807+ len = nld->size+sizeof(nlhdr);
1808+ else
1809+ len = ntohs(ip->tot_len)+sizeof(nlhdr);
1810+
1811+ outskb=alloc_skb(len, GFP_ATOMIC);
1812+
1813+ if (outskb) {
1814+ nlhdr.len=len;
1815+
1816+ if ( MASK(nld->flags, USE_MARK) )
1817+ nlhdr.mark=(*pskb)->nfmark=nld->mark;
1818+ else
1819+ nlhdr.mark=(*pskb)->nfmark;
1820+
1821+ if ( in && in->name ) {
1822+ strncpy((char *)&nlhdr.iface, in->name, IFNAMSIZ);
1823+ }else if ( out && out->name ){
1824+ strncpy((char *)&nlhdr.iface, out->name, IFNAMSIZ);
1825+ }
1826+
1827+ skb_put(outskb, len);
1828+ memcpy(outskb->data, &nlhdr, sizeof(nlhdr));
1829+ memcpy((outskb->data)+sizeof(nlhdr), ip, len-sizeof(nlhdr));
1830+ netlink_broadcast(ipfwsk, outskb, 0, ~0, GFP_ATOMIC);
1831+ }else{
1832+ if (net_ratelimit())
1833+ printk(KERN_WARNING "ipt_NETLINK: packet drop due to netlink failure\n");
1834+ }
1835+
1836+ if ( MASK(nld->flags, USE_DROP) )
1837+ return NF_DROP;
1838+
1839+ return IPT_CONTINUE;
1840+}
1841+
1842+static int ipt_netlink_checkentry(const char *tablename,
1843+ const struct ipt_entry *e,
1844+ void *targinfo,
1845+ unsigned int targinfosize,
1846+ unsigned int hookmask)
1847+{
1848+ //struct ipt_nldata *nld = (struct ipt_nldata *)targinfo;
1849+
1850+ return 1;
1851+}
1852+
1853+static struct ipt_target ipt_netlink_reg = {
1854+ {NULL, NULL},
1855+ "NETLINK",
1856+ ipt_netlink_target,
1857+ ipt_netlink_checkentry,
1858+ NULL,
1859+ THIS_MODULE
1860+};
1861+
1862+static int __init init(void)
1863+{
1864+ DEBUGP("ipt_NETLINK: init module\n");
1865+
1866+ if (ipt_register_target(&ipt_netlink_reg) != 0) {
1867+ return -EINVAL;
1868+ }
1869+
1870+ if ( !(ipfwsk=netlink_kernel_create(NETLINK_FIREWALL, NULL)) ){
1871+ return -EINVAL;
1872+ }
1873+
1874+ return 0;
1875+}
1876+
1877+static void __exit fini(void)
1878+{
1879+ DEBUGP("ipt_NETLINK: cleanup_module\n");
1880+ ipt_unregister_target(&ipt_netlink_reg);
1881+ if(ipfwsk->socket) sock_release(ipfwsk->socket);
1882+}
1883+
1884+module_init(init);
1885+module_exit(fini);
1886diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/netfilter/ipt_POOL.c linux-2.6.6-rc3/net/ipv4/netfilter/ipt_POOL.c
1887--- linux-2.6.6-rc3.org/net/ipv4/netfilter/ipt_POOL.c 1970-01-01 01:00:00.000000000 +0100
1888+++ linux-2.6.6-rc3/net/ipv4/netfilter/ipt_POOL.c 2004-04-29 09:49:29.000000000 +0200
1889@@ -0,0 +1,116 @@
1890+/* ipt_POOL.c - netfilter target to manipulate IP pools
1891+ *
1892+ * This target can be used almost everywhere. It acts on some specified
1893+ * IP pool, adding or deleting some IP address in the pool. The address
1894+ * can be either the source (--addsrc, --delsrc), or destination (--add/deldst)
1895+ * of the packet under inspection.
1896+ *
1897+ * The target normally returns IPT_CONTINUE.
1898+ */
1899+
1900+#include <linux/types.h>
1901+#include <linux/ip.h>
1902+#include <linux/timer.h>
1903+#include <linux/module.h>
1904+#include <linux/netfilter.h>
1905+#include <linux/netdevice.h>
1906+#include <linux/if.h>
1907+#include <linux/inetdevice.h>
1908+#include <net/protocol.h>
1909+#include <net/checksum.h>
1910+#include <linux/netfilter_ipv4.h>
1911+#include <linux/netfilter_ipv4/ip_nat_rule.h>
1912+#include <linux/netfilter_ipv4/ipt_pool.h>
1913+
1914+#if 0
1915+#define DEBUGP printk
1916+#else
1917+#define DEBUGP(format, args...)
1918+#endif
1919+
1920+/*** NOTE NOTE NOTE NOTE ***
1921+**
1922+** By sheer luck, I get away with using the "struct ipt_pool_info", as defined
1923+** in <linux/netfilter_ipv4/ipt_pool.h>, both as the match and target info.
1924+** Here, in the target implementation, ipt_pool_info.src, if not IP_POOL_NONE,
1925+** is modified for the source IP address of the packet under inspection.
1926+** The same way, the ipt_pool_info.dst pool is modified for the destination.
1927+**
1928+** The address is added to the pool normally. However, if IPT_POOL_DEL_dir
1929+** flag is set in ipt_pool_info.flags, the address is deleted from the pool.
1930+**
1931+** If a modification was done to the pool, we possibly return ACCEPT or DROP,
1932+** if the right IPT_POOL_MOD_dir_ACCEPT or _MOD_dir_DROP flags are set.
1933+** The IPT_POOL_INV_MOD_dir flag inverts the sense of the check (i.e. the
1934+** ACCEPT and DROP flags are evaluated when the pool was not modified.)
1935+*/
1936+
1937+static int
1938+do_check(const char *tablename,
1939+ const struct ipt_entry *e,
1940+ void *targinfo,
1941+ unsigned int targinfosize,
1942+ unsigned int hook_mask)
1943+{
1944+ const struct ipt_pool_info *ipi = targinfo;
1945+
1946+ if (targinfosize != IPT_ALIGN(sizeof(*ipi))) {
1947+ DEBUGP("POOL_check: size %u.\n", targinfosize);
1948+ return 0;
1949+ }
1950+ DEBUGP("ipt_POOL:do_check(%d,%d,%d)\n",ipi->src,ipi->dst,ipi->flags);
1951+ return 1;
1952+}
1953+
1954+static unsigned int
1955+do_target(struct sk_buff **pskb,
1956+ unsigned int hooknum,
1957+ const struct net_device *in,
1958+ const struct net_device *out,
1959+ const void *targinfo,
1960+ void *userinfo)
1961+{
1962+ const struct ipt_pool_info *ipi = targinfo;
1963+ int modified;
1964+ unsigned int verdict = IPT_CONTINUE;
1965+
1966+ if (ipi->src != IP_POOL_NONE) {
1967+ modified = ip_pool_mod(ipi->src, ntohl((*pskb)->nh.iph->saddr),
1968+ ipi->flags & IPT_POOL_DEL_SRC);
1969+ if (!!modified ^ !!(ipi->flags & IPT_POOL_INV_MOD_SRC)) {
1970+ if (ipi->flags & IPT_POOL_MOD_SRC_ACCEPT)
1971+ verdict = NF_ACCEPT;
1972+ else if (ipi->flags & IPT_POOL_MOD_SRC_DROP)
1973+ verdict = NF_DROP;
1974+ }
1975+ }
1976+ if (verdict == IPT_CONTINUE && ipi->dst != IP_POOL_NONE) {
1977+ modified = ip_pool_mod(ipi->dst, ntohl((*pskb)->nh.iph->daddr),
1978+ ipi->flags & IPT_POOL_DEL_DST);
1979+ if (!!modified ^ !!(ipi->flags & IPT_POOL_INV_MOD_DST)) {
1980+ if (ipi->flags & IPT_POOL_MOD_DST_ACCEPT)
1981+ verdict = NF_ACCEPT;
1982+ else if (ipi->flags & IPT_POOL_MOD_DST_DROP)
1983+ verdict = NF_DROP;
1984+ }
1985+ }
1986+ return verdict;
1987+}
1988+
1989+static struct ipt_target pool_reg
1990+= { { NULL, NULL }, "POOL", do_target, do_check, NULL, THIS_MODULE };
1991+
1992+static int __init init(void)
1993+{
1994+ DEBUGP("init ipt_POOL\n");
1995+ return ipt_register_target(&pool_reg);
1996+}
1997+
1998+static void __exit fini(void)
1999+{
2000+ DEBUGP("fini ipt_POOL\n");
2001+ ipt_unregister_target(&pool_reg);
2002+}
2003+
2004+module_init(init);
2005+module_exit(fini);
2006diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/netfilter/ipt_TTL.c linux-2.6.6-rc3/net/ipv4/netfilter/ipt_TTL.c
2007--- linux-2.6.6-rc3.org/net/ipv4/netfilter/ipt_TTL.c 1970-01-01 01:00:00.000000000 +0100
2008+++ linux-2.6.6-rc3/net/ipv4/netfilter/ipt_TTL.c 2004-04-29 09:47:42.000000000 +0200
2009@@ -0,0 +1,120 @@
2010+/* TTL modification target for IP tables
2011+ * (C) 2000 by Harald Welte <laforge@gnumonks.org>
2012+ *
2013+ * Version: $Revision$
2014+ *
2015+ * This software is distributed under the terms of GNU GPL
2016+ */
2017+
2018+#include <linux/module.h>
2019+#include <linux/skbuff.h>
2020+#include <linux/ip.h>
2021+#include <net/checksum.h>
2022+
2023+#include <linux/netfilter_ipv4/ip_tables.h>
2024+#include <linux/netfilter_ipv4/ipt_TTL.h>
2025+
2026+MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
2027+MODULE_DESCRIPTION("IP tables TTL modification module");
2028+MODULE_LICENSE("GPL");
2029+
2030+static unsigned int
2031+ipt_ttl_target(struct sk_buff **pskb, const struct net_device *in,
2032+ const struct net_device *out, unsigned int hooknum,
2033+ const void *targinfo, void *userinfo)
2034+{
2035+ struct iphdr *iph;
2036+ const struct ipt_TTL_info *info = targinfo;
2037+ u_int16_t diffs[2];
2038+ int new_ttl;
2039+
2040+ if (!skb_ip_make_writable(pskb, (*pskb)->len))
2041+ return NF_DROP;
2042+
2043+ iph = (*pskb)->nh.iph;
2044+
2045+ switch (info->mode) {
2046+ case IPT_TTL_SET:
2047+ new_ttl = info->ttl;
2048+ break;
2049+ case IPT_TTL_INC:
2050+ new_ttl = iph->ttl + info->ttl;
2051+ if (new_ttl > 255)
2052+ new_ttl = 255;
2053+ break;
2054+ case IPT_TTL_DEC:
2055+ new_ttl = iph->ttl + info->ttl;
2056+ if (new_ttl < 0)
2057+ new_ttl = 0;
2058+ break;
2059+ default:
2060+ new_ttl = iph->ttl;
2061+ break;
2062+ }
2063+
2064+ if (new_ttl != iph->ttl) {
2065+ diffs[0] = htons(((unsigned)iph->ttl) << 8) ^ 0xFFFF;
2066+ iph->ttl = new_ttl;
2067+ diffs[1] = htons(((unsigned)iph->ttl) << 8);
2068+ iph->check = csum_fold(csum_partial((char *)diffs,
2069+ sizeof(diffs),
2070+ iph->check^0xFFFF));
2071+ (*pskb)->nfcache |= NFC_ALTERED;
2072+ }
2073+
2074+ return IPT_CONTINUE;
2075+}
2076+
2077+static int ipt_ttl_checkentry(const char *tablename,
2078+ const struct ipt_entry *e,
2079+ void *targinfo,
2080+ unsigned int targinfosize,
2081+ unsigned int hook_mask)
2082+{
2083+ struct ipt_TTL_info *info = targinfo;
2084+
2085+ if (targinfosize != IPT_ALIGN(sizeof(struct ipt_TTL_info))) {
2086+ printk(KERN_WARNING "TTL: targinfosize %u != %Zu\n",
2087+ targinfosize,
2088+ IPT_ALIGN(sizeof(struct ipt_TTL_info)));
2089+ return 0;
2090+ }
2091+
2092+ if (strcmp(tablename, "mangle")) {
2093+ printk(KERN_WARNING "TTL: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
2094+ return 0;
2095+ }
2096+
2097+ if (info->mode > IPT_TTL_MAXMODE) {
2098+ printk(KERN_WARNING "TTL: invalid or unknown Mode %u\n",
2099+ info->mode);
2100+ return 0;
2101+ }
2102+
2103+ if ((info->mode != IPT_TTL_SET) && (info->ttl == 0)) {
2104+ printk(KERN_WARNING "TTL: increment/decrement doesn't make sense with value 0\n");
2105+ return 0;
2106+ }
2107+
2108+ return 1;
2109+}
2110+
2111+static struct ipt_target ipt_TTL = {
2112+ .name = "TTL",
2113+ .target = ipt_ttl_target,
2114+ .checkentry = ipt_ttl_checkentry,
2115+ .me = THIS_MODULE
2116+};
2117+
2118+static int __init init(void)
2119+{
2120+ return ipt_register_target(&ipt_TTL);
2121+}
2122+
2123+static void __exit fini(void)
2124+{
2125+ ipt_unregister_target(&ipt_TTL);
2126+}
2127+
2128+module_init(init);
2129+module_exit(fini);
2130diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/netfilter/ipt_connlimit.c linux-2.6.6-rc3/net/ipv4/netfilter/ipt_connlimit.c
2131--- linux-2.6.6-rc3.org/net/ipv4/netfilter/ipt_connlimit.c 1970-01-01 01:00:00.000000000 +0100
2132+++ linux-2.6.6-rc3/net/ipv4/netfilter/ipt_connlimit.c 2004-04-29 09:47:49.000000000 +0200
2133@@ -0,0 +1,230 @@
2134+/*
2135+ * netfilter module to limit the number of parallel tcp
2136+ * connections per IP address.
2137+ * (c) 2000 Gerd Knorr <kraxel@bytesex.org>
2138+ * Nov 2002: Martin Bene <martin.bene@icomedias.com>:
2139+ * only ignore TIME_WAIT or gone connections
2140+ *
2141+ * based on ...
2142+ *
2143+ * Kernel module to match connection tracking information.
2144+ * GPL (C) 1999 Rusty Russell (rusty@rustcorp.com.au).
2145+ */
2146+#include <linux/module.h>
2147+#include <linux/skbuff.h>
2148+#include <linux/list.h>
2149+#include <linux/netfilter_ipv4/ip_conntrack.h>
2150+#include <linux/netfilter_ipv4/ip_conntrack_core.h>
2151+#include <linux/netfilter_ipv4/ip_conntrack_tcp.h>
2152+#include <linux/netfilter_ipv4/ip_tables.h>
2153+#include <linux/netfilter_ipv4/ipt_connlimit.h>
2154+
2155+#define DEBUG 0
2156+
2157+MODULE_LICENSE("GPL");
2158+
2159+/* we'll save the tuples of all connections we care about */
2160+struct ipt_connlimit_conn
2161+{
2162+ struct list_head list;
2163+ struct ip_conntrack_tuple tuple;
2164+};
2165+
2166+struct ipt_connlimit_data {
2167+ spinlock_t lock;
2168+ struct list_head iphash[256];
2169+};
2170+
2171+static int ipt_iphash(u_int32_t addr)
2172+{
2173+ int hash;
2174+
2175+ hash = addr & 0xff;
2176+ hash ^= (addr >> 8) & 0xff;
2177+ hash ^= (addr >> 16) & 0xff;
2178+ hash ^= (addr >> 24) & 0xff;
2179+ return hash;
2180+}
2181+
2182+static int count_them(struct ipt_connlimit_data *data,
2183+ u_int32_t addr, u_int32_t mask,
2184+ struct ip_conntrack *ct)
2185+{
2186+#if DEBUG
2187+ const static char *tcp[] = { "none", "established", "syn_sent", "syn_recv",
2188+ "fin_wait", "time_wait", "close", "close_wait",
2189+ "last_ack", "listen" };
2190+#endif
2191+ int addit = 1, matches = 0;
2192+ struct ip_conntrack_tuple tuple;
2193+ struct ip_conntrack_tuple_hash *found;
2194+ struct ipt_connlimit_conn *conn;
2195+ struct list_head *hash,*lh;
2196+
2197+ spin_lock(&data->lock);
2198+ tuple = ct->tuplehash[0].tuple;
2199+ hash = &data->iphash[ipt_iphash(addr & mask)];
2200+
2201+ /* check the saved connections */
2202+ for (lh = hash->next; lh != hash; lh = lh->next) {
2203+ conn = list_entry(lh,struct ipt_connlimit_conn,list);
2204+ found = ip_conntrack_find_get(&conn->tuple,ct);
2205+ if (0 == memcmp(&conn->tuple,&tuple,sizeof(tuple)) &&
2206+ found != NULL &&
2207+ found->ctrack->proto.tcp.state != TCP_CONNTRACK_TIME_WAIT) {
2208+ /* Just to be sure we have it only once in the list.
2209+ We should'nt see tuples twice unless someone hooks this
2210+ into a table without "-p tcp --syn" */
2211+ addit = 0;
2212+ }
2213+#if DEBUG
2214+ printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d %s\n",
2215+ ipt_iphash(addr & mask),
2216+ NIPQUAD(conn->tuple.src.ip), ntohs(conn->tuple.src.u.tcp.port),
2217+ NIPQUAD(conn->tuple.dst.ip), ntohs(conn->tuple.dst.u.tcp.port),
2218+ (NULL != found) ? tcp[found->ctrack->proto.tcp.state] : "gone");
2219+#endif
2220+ if (NULL == found) {
2221+ /* this one is gone */
2222+ lh = lh->prev;
2223+ list_del(lh->next);
2224+ kfree(conn);
2225+ continue;
2226+ }
2227+ if (found->ctrack->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT) {
2228+ /* we don't care about connections which are
2229+ closed already -> ditch it */
2230+ lh = lh->prev;
2231+ list_del(lh->next);
2232+ kfree(conn);
2233+ nf_conntrack_put(&found->ctrack->infos[0]);
2234+ continue;
2235+ }
2236+ if ((addr & mask) == (conn->tuple.src.ip & mask)) {
2237+ /* same source IP address -> be counted! */
2238+ matches++;
2239+ }
2240+ nf_conntrack_put(&found->ctrack->infos[0]);
2241+ }
2242+ if (addit) {
2243+ /* save the new connection in our list */
2244+#if DEBUG
2245+ printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d new\n",
2246+ ipt_iphash(addr & mask),
2247+ NIPQUAD(tuple.src.ip), ntohs(tuple.src.u.tcp.port),
2248+ NIPQUAD(tuple.dst.ip), ntohs(tuple.dst.u.tcp.port));
2249+#endif
2250+ conn = kmalloc(sizeof(*conn),GFP_ATOMIC);
2251+ if (NULL == conn)
2252+ return -1;
2253+ memset(conn,0,sizeof(*conn));
2254+ INIT_LIST_HEAD(&conn->list);
2255+ conn->tuple = tuple;
2256+ list_add(&conn->list,hash);
2257+ matches++;
2258+ }
2259+ spin_unlock(&data->lock);
2260+ return matches;
2261+}
2262+
2263+static int
2264+match(const struct sk_buff *skb,
2265+ const struct net_device *in,
2266+ const struct net_device *out,
2267+ const void *matchinfo,
2268+ int offset,
2269+ int *hotdrop)
2270+{
2271+ const struct ipt_connlimit_info *info = matchinfo;
2272+ int connections, match;
2273+ struct ip_conntrack *ct;
2274+ enum ip_conntrack_info ctinfo;
2275+
2276+ ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
2277+ if (NULL == ct) {
2278+ printk("ipt_connlimit: Oops: invalid ct state ?\n");
2279+ *hotdrop = 1;
2280+ return 0;
2281+ }
2282+ connections = count_them(info->data,skb->nh.iph->saddr,info->mask,ct);
2283+ if (-1 == connections) {
2284+ printk("ipt_connlimit: Hmm, kmalloc failed :-(\n");
2285+ *hotdrop = 1; /* let's free some memory :-) */
2286+ return 0;
2287+ }
2288+ match = (info->inverse) ? (connections <= info->limit) : (connections > info->limit);
2289+#if DEBUG
2290+ printk("ipt_connlimit: src=%u.%u.%u.%u mask=%u.%u.%u.%u "
2291+ "connections=%d limit=%d match=%s\n",
2292+ NIPQUAD(skb->nh.iph->saddr), NIPQUAD(info->mask),
2293+ connections, info->limit, match ? "yes" : "no");
2294+#endif
2295+
2296+ return match;
2297+}
2298+
2299+static int check(const char *tablename,
2300+ const struct ipt_ip *ip,
2301+ void *matchinfo,
2302+ unsigned int matchsize,
2303+ unsigned int hook_mask)
2304+{
2305+ struct ipt_connlimit_info *info = matchinfo;
2306+ int i;
2307+
2308+ /* verify size */
2309+ if (matchsize != IPT_ALIGN(sizeof(struct ipt_connlimit_info)))
2310+ return 0;
2311+
2312+ /* refuse anything but tcp */
2313+ if (ip->proto != IPPROTO_TCP)
2314+ return 0;
2315+
2316+ /* init private data */
2317+ info->data = kmalloc(sizeof(struct ipt_connlimit_data),GFP_KERNEL);
2318+ spin_lock_init(&(info->data->lock));
2319+ for (i = 0; i < 256; i++)
2320+ INIT_LIST_HEAD(&(info->data->iphash[i]));
2321+
2322+ return 1;
2323+}
2324+
2325+static void destroy(void *matchinfo, unsigned int matchinfosize)
2326+{
2327+ struct ipt_connlimit_info *info = matchinfo;
2328+ struct ipt_connlimit_conn *conn;
2329+ struct list_head *hash;
2330+ int i;
2331+
2332+ /* cleanup */
2333+ for (i = 0; i < 256; i++) {
2334+ hash = &(info->data->iphash[i]);
2335+ while (hash != hash->next) {
2336+ conn = list_entry(hash->next,struct ipt_connlimit_conn,list);
2337+ list_del(hash->next);
2338+ kfree(conn);
2339+ }
2340+ }
2341+ kfree(info->data);
2342+}
2343+
2344+static struct ipt_match connlimit_match = {
2345+ .name = "connlimit",
2346+ .match = &match,
2347+ .checkentry = &check,
2348+ .destroy = &destroy,
2349+ .me = THIS_MODULE
2350+};
2351+
2352+static int __init init(void)
2353+{
2354+ return ipt_register_match(&connlimit_match);
2355+}
2356+
2357+static void __exit fini(void)
2358+{
2359+ ipt_unregister_match(&connlimit_match);
2360+}
2361+
2362+module_init(init);
2363+module_exit(fini);
2364diff -Nur --exclude '*.orig' linux-2.6.6-rc3.org/net/ipv4/netfilter/ipt_dstlimit.c linux-2.6.6-rc3/net/ipv4/netfilter/ipt_dstlimit.c
2365--- linux-2.6.6-rc3.org/net/ipv4/netfilter/ipt_dstlimit.c 1970-01-01 01:00:00.000000000 +0100
2366+++ linux-2.6.6-rc3/net/ipv4/netfilter/ipt_dstlimit.c 2004-04-29 09:48:04.000000000 +0200
2367@@ -0,0 +1,690 @@
2368+/* iptables match extension to limit the number of packets per second
2369+ * seperately for each destination.
2370+ *
2371+ * (C) 2003 by Harald Welte <laforge@netfilter.org>
2372+ *
2373+ * $Id$
2374+ *
2375+ * Development of this code was funded by Astaro AG, http://www.astaro.com/
2376+ *
2377+ * based on ipt_limit.c by:
2378