]> git.pld-linux.org Git - packages/kernel.git/blame - 2.6.x-patch-o-matic-ng-base-20040307.patch
projects / packages / kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- minor fix. it builds but linking needs fix.
[packages/kernel.git] / 2.6.x-patch-o-matic-ng-base-20040307.patch
CommitLineData
d4a8a662 1diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter.h linux-2.6.4-rc2/include/linux/netfilter.h
2--- linux-2.6.4-rc2.org/include/linux/netfilter.h 2004-03-04 06:16:47.000000000 +0000
3+++ linux-2.6.4-rc2/include/linux/netfilter.h 2004-03-07 08:43:12.000000000 +0000
4@@ -99,6 +99,24 @@
5
6 extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
7
8+typedef void nf_logfn(unsigned int hooknum,
9+ const struct sk_buff *skb,
10+ const struct net_device *in,
11+ const struct net_device *out,
12+ const char *prefix);
13+
14+/* Function to register/unregister log function. */
15+int nf_log_register(int pf, nf_logfn *logfn);
16+void nf_log_unregister(int pf, nf_logfn *logfn);
17+
18+/* Calls the registered backend logging function */
19+void nf_log_packet(int pf,
20+ unsigned int hooknum,
21+ const struct sk_buff *skb,
22+ const struct net_device *in,
23+ const struct net_device *out,
24+ const char *fmt, ...);
25+
26 /* Activate hook; either okfn or kfree_skb called, unless a hook
27 returns NF_STOLEN (in which case, it's up to the hook to deal with
28 the consequences).
29diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ip_conntrack.h
30--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ip_conntrack.h 2004-03-04 06:17:04.000000000 +0000
31+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ip_conntrack.h 2004-03-07 08:43:29.000000000 +0000
32@@ -251,6 +251,9 @@
33 /* Call me when a conntrack is destroyed. */
34 extern void (*ip_conntrack_destroyed)(struct ip_conntrack *conntrack);
35
36+/* Fake conntrack entry for untracked connections */
37+extern struct ip_conntrack ip_conntrack_untracked;
38+
39 /* Returns new sk_buff, or NULL */
40 struct sk_buff *
41 ip_ct_gather_frags(struct sk_buff *skb);
42diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_TTL.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_TTL.h
43--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_TTL.h 1970-01-01 00:00:00.000000000 +0000
44+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_TTL.h 2004-03-07 08:43:16.000000000 +0000
45@@ -0,0 +1,21 @@
46+/* TTL modification module for IP tables
47+ * (C) 2000 by Harald Welte <laforge@gnumonks.org> */
48+
49+#ifndef _IPT_TTL_H
50+#define _IPT_TTL_H
51+
52+enum {
53+ IPT_TTL_SET = 0,
54+ IPT_TTL_INC,
55+ IPT_TTL_DEC
56+};
57+
58+#define IPT_TTL_MAXMODE IPT_TTL_DEC
59+
60+struct ipt_TTL_info {
61+ u_int8_t mode;
62+ u_int8_t ttl;
63+};
64+
65+
66+#endif
67diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_ULOG.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_ULOG.h
68--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_ULOG.h 2004-03-04 06:16:43.000000000 +0000
69+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_ULOG.h 2004-03-07 08:43:12.000000000 +0000
70@@ -11,6 +11,9 @@
71 #define NETLINK_NFLOG 5
72 #endif
73
74+#define ULOG_DEFAULT_NLGROUP 1
75+#define ULOG_DEFAULT_QTHRESHOLD 1
76+
77 #define ULOG_MAC_LEN 80
78 #define ULOG_PREFIX_LEN 32
79
80diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_connlimit.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_connlimit.h
81--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_connlimit.h 1970-01-01 00:00:00.000000000 +0000
82+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_connlimit.h 2004-03-07 08:43:18.000000000 +0000
83@@ -0,0 +1,12 @@
84+#ifndef _IPT_CONNLIMIT_H
85+#define _IPT_CONNLIMIT_H
86+
87+struct ipt_connlimit_data;
88+
89+struct ipt_connlimit_info {
90+ int limit;
91+ int inverse;
92+ u_int32_t mask;
93+ struct ipt_connlimit_data *data;
94+};
95+#endif /* _IPT_CONNLIMIT_H */
96diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_conntrack.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_conntrack.h
97--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_conntrack.h 2004-03-04 06:16:55.000000000 +0000
98+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_conntrack.h 2004-03-07 08:43:29.000000000 +0000
99@@ -10,6 +10,7 @@
100
101 #define IPT_CONNTRACK_STATE_SNAT (1 << (IP_CT_NUMBER + 1))
102 #define IPT_CONNTRACK_STATE_DNAT (1 << (IP_CT_NUMBER + 2))
103+#define IPT_CONNTRACK_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 3))
104
105 /* flags, invflags: */
106 #define IPT_CONNTRACK_STATE 0x01
107diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_dstlimit.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_dstlimit.h
108--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_dstlimit.h 1970-01-01 00:00:00.000000000 +0000
109+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_dstlimit.h 2004-03-07 08:43:19.000000000 +0000
110@@ -0,0 +1,39 @@
111+#ifndef _IPT_DSTLIMIT_H
112+#define _IPT_DSTLIMIT_H
113+
114+/* timings are in milliseconds. */
115+#define IPT_DSTLIMIT_SCALE 10000
116+/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
117+ seconds, or one every 59 hours. */
118+
119+/* details of this structure hidden by the implementation */
120+struct ipt_dstlimit_htable;
121+
122+#define IPT_DSTLIMIT_HASH_DIP 0x0001
123+#define IPT_DSTLIMIT_HASH_DPT 0x0002
124+#define IPT_DSTLIMIT_HASH_SIP 0x0004
125+
126+struct dstlimit_cfg {
127+ u_int32_t mode; /* bitmask of IPT_DSTLIMIT_HASH_* */
128+ u_int32_t avg; /* Average secs between packets * scale */
129+ u_int32_t burst; /* Period multiplier for upper limit. */
130+
131+ /* user specified */
132+ u_int32_t size; /* how many buckets */
133+ u_int32_t max; /* max number of entries */
134+ u_int32_t gc_interval; /* gc interval */
135+ u_int32_t expire; /* when do entries expire? */
136+};
137+
138+struct ipt_dstlimit_info {
139+ char name [IFNAMSIZ]; /* name */
140+ struct dstlimit_cfg cfg;
141+ struct ipt_dstlimit_htable *hinfo;
142+
143+ /* Used internally by the kernel */
144+ union {
145+ void *ptr;
146+ struct ipt_dstlimit_info *master;
147+ } u;
148+};
149+#endif /*_IPT_DSTLIMIT_H*/
150diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_fuzzy.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_fuzzy.h
151--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_fuzzy.h 1970-01-01 00:00:00.000000000 +0000
152+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_fuzzy.h 2004-03-07 08:43:19.000000000 +0000
153@@ -0,0 +1,21 @@
154+#ifndef _IPT_FUZZY_H
155+#define _IPT_FUZZY_H
156+
157+#include <linux/param.h>
158+#include <linux/types.h>
159+
160+#define MAXFUZZYRATE 10000000
161+#define MINFUZZYRATE 3
162+
163+struct ipt_fuzzy_info {
164+ u_int32_t minimum_rate;
165+ u_int32_t maximum_rate;
166+ u_int32_t packets_total;
167+ u_int32_t bytes_total;
168+ u_int32_t previous_time;
169+ u_int32_t present_time;
170+ u_int32_t mean_rate;
171+ u_int8_t acceptance_rate;
172+};
173+
174+#endif /*_IPT_FUZZY_H*/
175diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_ipv4options.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_ipv4options.h
176--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_ipv4options.h 1970-01-01 00:00:00.000000000 +0000
177+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_ipv4options.h 2004-03-07 08:43:20.000000000 +0000
178@@ -0,0 +1,21 @@
179+#ifndef __ipt_ipv4options_h_included__
180+#define __ipt_ipv4options_h_included__
181+
182+#define IPT_IPV4OPTION_MATCH_SSRR 0x01 /* For strict source routing */
183+#define IPT_IPV4OPTION_MATCH_LSRR 0x02 /* For loose source routing */
184+#define IPT_IPV4OPTION_DONT_MATCH_SRR 0x04 /* any source routing */
185+#define IPT_IPV4OPTION_MATCH_RR 0x08 /* For Record route */
186+#define IPT_IPV4OPTION_DONT_MATCH_RR 0x10
187+#define IPT_IPV4OPTION_MATCH_TIMESTAMP 0x20 /* For timestamp request */
188+#define IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP 0x40
189+#define IPT_IPV4OPTION_MATCH_ROUTER_ALERT 0x80 /* For router-alert */
190+#define IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT 0x100
191+#define IPT_IPV4OPTION_MATCH_ANY_OPT 0x200 /* match packet with any option */
192+#define IPT_IPV4OPTION_DONT_MATCH_ANY_OPT 0x400 /* match packet with no option */
193+
194+struct ipt_ipv4options_info {
195+ u_int16_t options;
196+};
197+
198+
199+#endif /* __ipt_ipv4options_h_included__ */
200diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_mport.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_mport.h
201--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_mport.h 1970-01-01 00:00:00.000000000 +0000
202+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_mport.h 2004-03-07 08:43:23.000000000 +0000
203@@ -0,0 +1,24 @@
204+#ifndef _IPT_MPORT_H
205+#define _IPT_MPORT_H
206+#include <linux/netfilter_ipv4/ip_tables.h>
207+
208+#define IPT_MPORT_SOURCE (1<<0)
209+#define IPT_MPORT_DESTINATION (1<<1)
210+#define IPT_MPORT_EITHER (IPT_MPORT_SOURCE|IPT_MPORT_DESTINATION)
211+
212+#define IPT_MULTI_PORTS 15
213+
214+/* Must fit inside union ipt_matchinfo: 32 bytes */
215+/* every entry in ports[] except for the last one has one bit in pflags
216+ * associated with it. If this bit is set, the port is the first port of
217+ * a portrange, with the next entry being the last.
218+ * End of list is marked with pflags bit set and port=65535.
219+ * If 14 ports are used (last one does not have a pflag), the last port
220+ * is repeated to fill the last entry in ports[] */
221+struct ipt_mport
222+{
223+ u_int8_t flags:2; /* Type of comparison */
224+ u_int16_t pflags:14; /* Port flags */
225+ u_int16_t ports[IPT_MULTI_PORTS]; /* Ports */
226+};
227+#endif /*_IPT_MPORT_H*/
228diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_nth.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_nth.h
229--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_nth.h 1970-01-01 00:00:00.000000000 +0000
230+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_nth.h 2004-03-07 08:43:24.000000000 +0000
231@@ -0,0 +1,19 @@
232+#ifndef _IPT_NTH_H
233+#define _IPT_NTH_H
234+
235+#include <linux/param.h>
236+#include <linux/types.h>
237+
238+#ifndef IPT_NTH_NUM_COUNTERS
239+#define IPT_NTH_NUM_COUNTERS 16
240+#endif
241+
242+struct ipt_nth_info {
243+ u_int8_t every;
244+ u_int8_t not;
245+ u_int8_t startat;
246+ u_int8_t counter;
247+ u_int8_t packet;
248+};
249+
250+#endif /*_IPT_NTH_H*/
251diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_quota.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_quota.h
252--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_quota.h 1970-01-01 00:00:00.000000000 +0000
253+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_quota.h 2004-03-07 08:43:28.000000000 +0000
254@@ -0,0 +1,11 @@
255+#ifndef _IPT_QUOTA_H
256+#define _IPT_QUOTA_H
257+
258+/* print debug info in both kernel/netfilter module & iptable library */
259+//#define DEBUG_IPT_QUOTA
260+
261+struct ipt_quota_info {
262+ u_int64_t quota;
263+};
264+
265+#endif /*_IPT_QUOTA_H*/
266diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_realm.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_realm.h
267--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_realm.h 1970-01-01 00:00:00.000000000 +0000
268+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_realm.h 2004-03-07 08:43:30.000000000 +0000
269@@ -0,0 +1,9 @@
270+#ifndef _IPT_REALM_H
271+#define _IPT_REALM_H
272+
273+struct ipt_realm_info {
274+ u_int32_t id;
275+ u_int32_t mask;
276+ u_int8_t invert;
277+};
278+#endif /*_IPT_REALM_H*/
279diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_sctp.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_sctp.h
280--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_sctp.h 1970-01-01 00:00:00.000000000 +0000
281+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_sctp.h 2004-03-07 08:43:31.000000000 +0000
282@@ -0,0 +1,107 @@
283+#ifndef _IPT_SCTP_H_
284+#define _IPT_SCTP_H_
285+
286+#define IPT_SCTP_SRC_PORTS 0x01
287+#define IPT_SCTP_DEST_PORTS 0x02
288+#define IPT_SCTP_CHUNK_TYPES 0x04
289+
290+#define IPT_SCTP_VALID_FLAGS 0x07
291+
292+#define ELEMCOUNT(x) (sizeof(x)/sizeof(x[0]))
293+
294+
295+struct ipt_sctp_flag_info {
296+ u_int8_t chunktype;
297+ u_int8_t flag;
298+ u_int8_t flag_mask;
299+};
300+
301+#define IPT_NUM_SCTP_FLAGS 4
302+
303+struct ipt_sctp_info {
304+ u_int16_t dpts[2]; /* Min, Max */
305+ u_int16_t spts[2]; /* Min, Max */
306+
307+ u_int32_t chunkmap[256 / sizeof (u_int32_t)]; /* Bit mask of chunks to be matched according to RFC 2960 */
308+
309+#define SCTP_CHUNK_MATCH_ANY 0x01 /* Match if any of the chunk types are present */
310+#define SCTP_CHUNK_MATCH_ALL 0x02 /* Match if all of the chunk types are present */
311+#define SCTP_CHUNK_MATCH_ONLY 0x04 /* Match if these are the only chunk types present */
312+
313+ u_int32_t chunk_match_type;
314+ struct ipt_sctp_flag_info flag_info[IPT_NUM_SCTP_FLAGS];
315+ int flag_count;
316+
317+ u_int32_t flags;
318+ u_int32_t invflags;
319+};
320+
321+#define bytes(type) (sizeof(type) * 8)
322+
323+#define SCTP_CHUNKMAP_SET(chunkmap, type) \
324+ do { \
325+ chunkmap[type / bytes(u_int32_t)] |= \
326+ 1 << (type % bytes(u_int32_t)); \
327+ } while (0)
328+
329+#define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \
330+ do { \
331+ chunkmap[type / bytes(u_int32_t)] &= \
332+ ~(1 << (type % bytes(u_int32_t))); \
333+ } while (0)
334+
335+#define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \
336+({ \
337+ (chunkmap[type / bytes (u_int32_t)] & \
338+ (1 << (type % bytes (u_int32_t)))) ? 1: 0; \
339+})
340+
341+#define SCTP_CHUNKMAP_RESET(chunkmap) \
342+ do { \
343+ int i; \
344+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
345+ chunkmap[i] = 0; \
346+ } while (0)
347+
348+#define SCTP_CHUNKMAP_SET_ALL(chunkmap) \
349+ do { \
350+ int i; \
351+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
352+ chunkmap[i] = ~0; \
353+ } while (0)
354+
355+#define SCTP_CHUNKMAP_COPY(destmap, srcmap) \
356+ do { \
357+ int i; \
358+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
359+ destmap[i] = srcmap[i]; \
360+ } while (0)
361+
362+#define SCTP_CHUNKMAP_IS_CLEAR(chunkmap) \
363+({ \
364+ int i; \
365+ int flag = 1; \
366+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) { \
367+ if (chunkmap[i]) { \
368+ flag = 0; \
369+ break; \
370+ } \
371+ } \
372+ flag; \
373+})
374+
375+#define SCTP_CHUNKMAP_IS_ALL_SET(chunkmap) \
376+({ \
377+ int i; \
378+ int flag = 1; \
379+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) { \
380+ if (chunkmap[i] != ~0) { \
381+ flag = 0; \
382+ break; \
383+ } \
384+ } \
385+ flag; \
386+})
387+
388+#endif /* _IPT_SCTP_H_ */
389+
390diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_state.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_state.h
391--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_state.h 2004-03-04 06:17:00.000000000 +0000
392+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_state.h 2004-03-07 08:43:29.000000000 +0000
393@@ -4,6 +4,8 @@
394 #define IPT_STATE_BIT(ctinfo) (1 << ((ctinfo)%IP_CT_IS_REPLY+1))
395 #define IPT_STATE_INVALID (1 << 0)
396
397+#define IPT_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 1))
398+
399 struct ipt_state_info
400 {
401 unsigned int statemask;
402diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_u32.h linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_u32.h
403--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4/ipt_u32.h 1970-01-01 00:00:00.000000000 +0000
404+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4/ipt_u32.h 2004-03-07 08:44:17.000000000 +0000
405@@ -0,0 +1,40 @@
406+#ifndef _IPT_U32_H
407+#define _IPT_U32_H
408+#include <linux/netfilter_ipv4/ip_tables.h>
409+
410+enum ipt_u32_ops
411+{
412+ IPT_U32_AND,
413+ IPT_U32_LEFTSH,
414+ IPT_U32_RIGHTSH,
415+ IPT_U32_AT
416+};
417+
418+struct ipt_u32_location_element
419+{
420+ u_int32_t number;
421+ u_int8_t nextop;
422+};
423+struct ipt_u32_value_element
424+{
425+ u_int32_t min;
426+ u_int32_t max;
427+};
428+/* *** any way to allow for an arbitrary number of elements?
429+ for now I settle for a limit of 10 of each */
430+#define U32MAXSIZE 10
431+struct ipt_u32_test
432+{
433+ u_int8_t nnums;
434+ struct ipt_u32_location_element location[U32MAXSIZE+1];
435+ u_int8_t nvalues;
436+ struct ipt_u32_value_element value[U32MAXSIZE+1];
437+};
438+
439+struct ipt_u32
440+{
441+ u_int8_t ntests;
442+ struct ipt_u32_test tests[U32MAXSIZE+1];
443+};
444+
445+#endif /*_IPT_U32_H*/
446diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv4.h linux-2.6.4-rc2/include/linux/netfilter_ipv4.h
447--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv4.h 2004-03-04 06:16:58.000000000 +0000
448+++ linux-2.6.4-rc2/include/linux/netfilter_ipv4.h 2004-03-07 08:43:29.000000000 +0000
449@@ -51,6 +51,8 @@
450
451 enum nf_ip_hook_priorities {
452 NF_IP_PRI_FIRST = INT_MIN,
453+ NF_IP_PRI_CONNTRACK_DEFRAG = -400,
454+ NF_IP_PRI_RAW = -300,
455 NF_IP_PRI_SELINUX_FIRST = -225,
456 NF_IP_PRI_CONNTRACK = -200,
457 NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
458diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv6/ip6t_HL.h linux-2.6.4-rc2/include/linux/netfilter_ipv6/ip6t_HL.h
459--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv6/ip6t_HL.h 1970-01-01 00:00:00.000000000 +0000
460+++ linux-2.6.4-rc2/include/linux/netfilter_ipv6/ip6t_HL.h 2004-03-07 08:43:13.000000000 +0000
461@@ -0,0 +1,22 @@
462+/* Hop Limit modification module for ip6tables
463+ * Maciej Soltysiak <solt@dns.toxicfilms.tv>
464+ * Based on HW's TTL module */
465+
466+#ifndef _IP6T_HL_H
467+#define _IP6T_HL_H
468+
469+enum {
470+ IP6T_HL_SET = 0,
471+ IP6T_HL_INC,
472+ IP6T_HL_DEC
473+};
474+
475+#define IP6T_HL_MAXMODE IP6T_HL_DEC
476+
477+struct ip6t_HL_info {
478+ u_int8_t mode;
479+ u_int8_t hop_limit;
480+};
481+
482+
483+#endif
484diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv6/ip6t_REJECT.h linux-2.6.4-rc2/include/linux/netfilter_ipv6/ip6t_REJECT.h
485--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv6/ip6t_REJECT.h 2004-03-04 06:16:34.000000000 +0000
486+++ linux-2.6.4-rc2/include/linux/netfilter_ipv6/ip6t_REJECT.h 2004-03-07 08:43:15.000000000 +0000
487@@ -2,15 +2,17 @@
488 #define _IP6T_REJECT_H
489
490 enum ip6t_reject_with {
491- IP6T_ICMP_NET_UNREACHABLE,
492- IP6T_ICMP_HOST_UNREACHABLE,
493- IP6T_ICMP_PROT_UNREACHABLE,
494- IP6T_ICMP_PORT_UNREACHABLE,
495- IP6T_ICMP_ECHOREPLY
496+ IP6T_ICMP6_NO_ROUTE,
497+ IP6T_ICMP6_ADM_PROHIBITED,
498+ IP6T_ICMP6_NOT_NEIGHBOUR,
499+ IP6T_ICMP6_ADDR_UNREACH,
500+ IP6T_ICMP6_PORT_UNREACH,
501+ IP6T_ICMP6_ECHOREPLY,
502+ IP6T_TCP_RESET
503 };
504
505 struct ip6t_reject_info {
506 enum ip6t_reject_with with; /* reject type */
507 };
508
509-#endif /*_IPT_REJECT_H*/
510+#endif /*_IP6T_REJECT_H*/
511diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv6/ip6t_fuzzy.h linux-2.6.4-rc2/include/linux/netfilter_ipv6/ip6t_fuzzy.h
512--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv6/ip6t_fuzzy.h 1970-01-01 00:00:00.000000000 +0000
513+++ linux-2.6.4-rc2/include/linux/netfilter_ipv6/ip6t_fuzzy.h 2004-03-07 08:43:19.000000000 +0000
514@@ -0,0 +1,21 @@
515+#ifndef _IP6T_FUZZY_H
516+#define _IP6T_FUZZY_H
517+
518+#include <linux/param.h>
519+#include <linux/types.h>
520+
521+#define MAXFUZZYRATE 10000000
522+#define MINFUZZYRATE 3
523+
524+struct ip6t_fuzzy_info {
525+ u_int32_t minimum_rate;
526+ u_int32_t maximum_rate;
527+ u_int32_t packets_total;
528+ u_int32_t bytes_total;
529+ u_int32_t previous_time;
530+ u_int32_t present_time;
531+ u_int32_t mean_rate;
532+ u_int8_t acceptance_rate;
533+};
534+
535+#endif /*_IP6T_FUZZY_H*/
536diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/include/linux/netfilter_ipv6/ip6t_nth.h linux-2.6.4-rc2/include/linux/netfilter_ipv6/ip6t_nth.h
537--- linux-2.6.4-rc2.org/include/linux/netfilter_ipv6/ip6t_nth.h 1970-01-01 00:00:00.000000000 +0000
538+++ linux-2.6.4-rc2/include/linux/netfilter_ipv6/ip6t_nth.h 2004-03-07 08:43:24.000000000 +0000
539@@ -0,0 +1,19 @@
540+#ifndef _IP6T_NTH_H
541+#define _IP6T_NTH_H
542+
543+#include <linux/param.h>
544+#include <linux/types.h>
545+
546+#ifndef IP6T_NTH_NUM_COUNTERS
547+#define IP6T_NTH_NUM_COUNTERS 16
548+#endif
549+
550+struct ip6t_nth_info {
551+ u_int8_t every;
552+ u_int8_t not;
553+ u_int8_t startat;
554+ u_int8_t counter;
555+ u_int8_t packet;
556+};
557+
558+#endif /*_IP6T_NTH_H*/
559diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/core/netfilter.c linux-2.6.4-rc2/net/core/netfilter.c
560--- linux-2.6.4-rc2.org/net/core/netfilter.c 2004-03-04 06:16:45.000000000 +0000
561+++ linux-2.6.4-rc2/net/core/netfilter.c 2004-03-07 08:43:12.000000000 +0000
562@@ -8,8 +8,10 @@
563 *
564 * February 2000: Modified by James Morris to have 1 queue per protocol.
565 * 15-Mar-2000: Added NF_REPEAT --RR.
566+ * 08-May-2003: Internal logging interface added by Jozsef Kadlecsik.
567 */
568 #include <linux/config.h>
569+#include <linux/kernel.h>
570 #include <linux/netfilter.h>
571 #include <net/protocol.h>
572 #include <linux/init.h>
573@@ -58,6 +60,10 @@
574 } queue_handler[NPROTO];
575 static rwlock_t queue_handler_lock = RW_LOCK_UNLOCKED;
576
577+/**
578+ * nf_register_hook - Register with a netfilter hook
579+ * @reg: Hook operations to be registered
580+ */
581 int nf_register_hook(struct nf_hook_ops *reg)
582 {
583 struct list_head *i;
584@@ -74,6 +80,10 @@
585 return 0;
586 }
587
588+/**
589+ * nf_unregister_hook - Unregister from a netfilter hook
590+ * @reg: hook operations to be unregistered
591+ */
592 void nf_unregister_hook(struct nf_hook_ops *reg)
593 {
594 spin_lock_bh(&nf_hook_lock);
595@@ -386,6 +396,18 @@
596 return NF_ACCEPT;
597 }
598
599+/**
600+ * nf_register_queue_handler - Registere a queue handler with netfilter
601+ * @pf: protocol family
602+ * @outfn: function called by core to enqueue a packet
603+ * @data: opaque parameter, passed through
604+ *
605+ * This function registers a queue handler with netfilter. There can only
606+ * be one queue handler for every protocol family.
607+ *
608+ * A queue handler _must_ reinject every packet via nf_reinject, no
609+ * matter what.
610+ */
611 int nf_register_queue_handler(int pf, nf_queue_outfn_t outfn, void *data)
612 {
613 int ret;
614@@ -403,7 +425,12 @@
615 return ret;
616 }
617
618-/* The caller must flush their queue before this */
619+/**
620+ * nf_unregister_queue_handler - Unregister queue handler from netfilter
621+ * @pf: protocol family
622+ *
623+ * The caller must flush their queue before unregistering
624+ */
625 int nf_unregister_queue_handler(int pf)
626 {
627 write_lock_bh(&queue_handler_lock);
628@@ -546,6 +573,15 @@
629 return ret;
630 }
631
632+/**
633+ * nf_reinject - Reinject a packet from a queue handler
634+ * @skb: the packet to be reinjected
635+ * @info: info which was passed to the outfn() of the queue handler
636+ * @verdict: verdict (NF_ACCEPT, ...) for this packet
637+ *
638+ * This is the function called by a queue handler to reinject a
639+ * packet.
640+ */
641 void nf_reinject(struct sk_buff *skb, struct nf_info *info,
642 unsigned int verdict)
643 {
644@@ -740,6 +776,72 @@
645 EXPORT_SYMBOL(skb_ip_make_writable);
646 #endif /*CONFIG_INET*/
647
648+/* Internal logging interface, which relies on the real
649+ LOG target modules */
650+
651+#define NF_LOG_PREFIXLEN 128
652+
653+static nf_logfn *nf_logging[NPROTO]; /* = NULL */
654+static int reported = 0;
655+static spinlock_t nf_log_lock = SPIN_LOCK_UNLOCKED;
656+
657+int nf_log_register(int pf, nf_logfn *logfn)
658+{
659+ int ret = -EBUSY;
660+
661+ /* Any setup of logging members must be done before
662+ * substituting pointer. */
663+ smp_wmb();
664+ spin_lock(&nf_log_lock);
665+ if (!nf_logging[pf]) {
666+ nf_logging[pf] = logfn;
667+ ret = 0;
668+ }
669+ spin_unlock(&nf_log_lock);
670+ return ret;
671+}
672+
673+void nf_log_unregister(int pf, nf_logfn *logfn)
674+{
675+ spin_lock(&nf_log_lock);
676+ if (nf_logging[pf] == logfn)
677+ nf_logging[pf] = NULL;
678+ spin_unlock(&nf_log_lock);
679+
680+ /* Give time to concurrent readers. */
681+ synchronize_net();
682+}
683+
684+void nf_log_packet(int pf,
685+ unsigned int hooknum,
686+ const struct sk_buff *skb,
687+ const struct net_device *in,
688+ const struct net_device *out,
689+ const char *fmt, ...)
690+{
691+ va_list args;
692+ char prefix[NF_LOG_PREFIXLEN];
693+ nf_logfn *logfn;
694+
695+ rcu_read_lock();
696+ logfn = nf_logging[pf];
697+ if (logfn) {
698+ va_start(args, fmt);
699+ vsnprintf(prefix, sizeof(prefix), fmt, args);
700+ va_end(args);
701+ /* We must read logging before nf_logfn[pf] */
702+ smp_read_barrier_depends();
703+ logfn(hooknum, skb, in, out, prefix);
704+ } else if (!reported) {
705+ printk(KERN_WARNING "nf_log_packet: can\'t log yet, "
706+ "no backend logging module loaded in!\n");
707+ reported++;
708+ }
709+ rcu_read_unlock();
710+}
711+EXPORT_SYMBOL(nf_log_register);
712+EXPORT_SYMBOL(nf_log_unregister);
713+EXPORT_SYMBOL(nf_log_packet);
714
715 /* This does not belong here, but ipt_REJECT needs it if connection
716 tracking in use: without this, connection may not be in hash table,
717diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/Kconfig linux-2.6.4-rc2/net/ipv4/netfilter/Kconfig
718--- linux-2.6.4-rc2.org/net/ipv4/netfilter/Kconfig 2004-03-04 06:16:58.000000000 +0000
719+++ linux-2.6.4-rc2/net/ipv4/netfilter/Kconfig 2004-03-07 08:44:17.000000000 +0000
720@@ -579,5 +579,89 @@
721
722 To compile it as a module, choose M here. If unsure, say N.
723
724+config IP_NF_TARGET_IPV4OPTSSTRIP
725+ tristate 'IPV4OPTSSTRIP target support'
726+ depends on IP_NF_MANGLE
727+ help
728+
729+config IP_NF_TARGET_TTL
730+ tristate 'TTL target support'
731+ depends on IP_NF_MANGLE
732+ help
733+
734+config IP_NF_MATCH_CONNLIMIT
735+ tristate 'Connections/IP limit match support'
736+ depends on IP_NF_IPTABLES
737+ help
738+
739+config IP_NF_MATCH_DSTLIMIT
740+ tristate 'dstlimit match support'
741+ depends on IP_NF_IPTABLES
742+ help
743+
744+config IP_NF_MATCH_FUZZY
745+ tristate 'fuzzy match support'
746+ depends on IP_NF_IPTABLES
747+ help
748+
749+config IP_NF_MATCH_IPV4OPTIONS
750+ tristate 'IPV4OPTIONS match support'
751+ depends on IP_NF_IPTABLES
752+ help
753+
754+config IP_NF_MATCH_MPORT
755+ tristate 'Multiple port with ranges match support'
756+ depends on IP_NF_IPTABLES
757+ help
758+
759+config IP_NF_MATCH_NTH
760+ tristate 'Nth match support'
761+ depends on IP_NF_IPTABLES
762+ help
763+
764+config IP_NF_MATCH_QUOTA
765+ tristate 'quota match support'
766+ depends on IP_NF_IPTABLES
767+ help
768+
769+config IP_NF_TARGET_NOTRACK
770+ tristate 'NOTRACK target support'
771+ depends on IP_NF_RAW
772+ help
773+ The NOTRACK target allows a select rule to specify
774+ which packets *not* to enter the conntrack/NAT
775+ subsystem with all the consequences (no ICMP error tracking,
776+ no protocol helpers for the selected packets).
777+
778+ If you want to compile it as a module, say M here and read
779+ <file:Documentation/modules.txt>. If unsure, say `N'.
780+
781+config IP_NF_RAW
782+ tristate 'raw table support (required for NOTRACK/TRACE)'
783+ depends on IP_NF_IPTABLES
784+ help
785+ This option adds a `raw' table to iptables. This table is the very
786+ first in the netfilter framework and hooks in at the PREROUTING
787+ and OUTPUT chains.
788+
789+ If you want to compile it as a module, say M here and read
790+ <file:Documentation/modules.txt>. If unsure, say `N'.
791+ help
792+
793+config IP_NF_MATCH_REALM
794+ tristate 'realm match support'
795+ depends on IP_NF_IPTABLES && NET_CLS_ROUTE
796+ help
797+
798+config IP_NF_MATCH_SCTP
799+ tristate 'SCTP protocol match support'
800+ depends on IP_NF_IPTABLES
801+ help
802+
803+config IP_NF_MATCH_U32
804+ tristate 'U32 match support'
805+ depends on IP_NF_IPTABLES
806+ help
807+
808 endmenu
809
810diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/Makefile linux-2.6.4-rc2/net/ipv4/netfilter/Makefile
811--- linux-2.6.4-rc2.org/net/ipv4/netfilter/Makefile 2004-03-04 06:16:38.000000000 +0000
812+++ linux-2.6.4-rc2/net/ipv4/netfilter/Makefile 2004-03-07 08:44:17.000000000 +0000
813@@ -38,19 +38,33 @@
814 obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
815 obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
816 obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
817+obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
818
819 # matches
820 obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
821 obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
822+obj-$(CONFIG_IP_NF_MATCH_SCTP) += ipt_sctp.o
823+obj-$(CONFIG_IP_NF_MATCH_QUOTA) += ipt_quota.o
824+obj-$(CONFIG_IP_NF_MATCH_DSTLIMIT) += ipt_dstlimit.o
825 obj-$(CONFIG_IP_NF_MATCH_MARK) += ipt_mark.o
826 obj-$(CONFIG_IP_NF_MATCH_MAC) += ipt_mac.o
827 obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
828
829 obj-$(CONFIG_IP_NF_MATCH_PKTTYPE) += ipt_pkttype.o
830 obj-$(CONFIG_IP_NF_MATCH_MULTIPORT) += ipt_multiport.o
831+
832+obj-$(CONFIG_IP_NF_MATCH_MPORT) += ipt_mport.o
833+
834 obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
835 obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
836
837+obj-$(CONFIG_IP_NF_MATCH_NTH) += ipt_nth.o
838+
839+obj-$(CONFIG_IP_NF_MATCH_IPV4OPTIONS) += ipt_ipv4options.o
840+
841+
842+obj-$(CONFIG_IP_NF_MATCH_FUZZY) += ipt_fuzzy.o
843+
844 obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
845
846 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
847@@ -59,10 +73,15 @@
848
849 obj-$(CONFIG_IP_NF_MATCH_LENGTH) += ipt_length.o
850
851+obj-$(CONFIG_IP_NF_MATCH_U32) += ipt_u32.o
852+
853+
854 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
855 obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
856+obj-$(CONFIG_IP_NF_MATCH_CONNLIMIT) += ipt_connlimit.o
857 obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
858 obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
859+obj-$(CONFIG_IP_NF_MATCH_REALM) += ipt_realm.o
860
861 obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o
862
863@@ -79,8 +98,11 @@
864 obj-$(CONFIG_IP_NF_TARGET_CLASSIFY) += ipt_CLASSIFY.o
865 obj-$(CONFIG_IP_NF_NAT_SNMP_BASIC) += ip_nat_snmp_basic.o
866 obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
867+obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
868+obj-$(CONFIG_IP_NF_TARGET_IPV4OPTSSTRIP) += ipt_IPV4OPTSSTRIP.o
869 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
870 obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
871+obj-$(CONFIG_IP_NF_TARGET_NOTRACK) += ipt_NOTRACK.o
872
873 # generic ARP tables
874 obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
875diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/ip_conntrack_core.c linux-2.6.4-rc2/net/ipv4/netfilter/ip_conntrack_core.c
876--- linux-2.6.4-rc2.org/net/ipv4/netfilter/ip_conntrack_core.c 2004-03-04 06:16:34.000000000 +0000
877+++ linux-2.6.4-rc2/net/ipv4/netfilter/ip_conntrack_core.c 2004-03-07 08:43:29.000000000 +0000
878@@ -15,6 +15,8 @@
879 * 16 Jul 2002: Harald Welte <laforge@gnumonks.org>
880 * - add usage/reference counts to ip_conntrack_expect
881 * - export ip_conntrack[_expect]_{find_get,put} functions
882+ * 05 Aug 2002: Harald Welte <laforge@gnumonks.org>
883+ * - added DocBook-style comments for public API
884 * */
885
886 #include <linux/config.h>
887@@ -67,6 +69,7 @@
888 static atomic_t ip_conntrack_count = ATOMIC_INIT(0);
889 struct list_head *ip_conntrack_hash;
890 static kmem_cache_t *ip_conntrack_cachep;
891+struct ip_conntrack ip_conntrack_untracked;
892
893 extern struct ip_conntrack_protocol ip_conntrack_generic_protocol;
894
895@@ -89,6 +92,10 @@
896 return p;
897 }
898
899+/**
900+ * ip_ct_find_proto - Find layer 4 protocol helper for given protocol number
901+ * @protocol: protocol number
902+ */
903 struct ip_conntrack_protocol *ip_ct_find_proto(u_int8_t protocol)
904 {
905 struct ip_conntrack_protocol *p;
906@@ -112,6 +119,11 @@
907 static int ip_conntrack_hash_rnd_initted;
908 static unsigned int ip_conntrack_hash_rnd;
909
910+/**
911+ * hash_conntrack - Calculate the position of an entry in the connection
912+ * tracking table.
913+ * @tuple: conntrack tuple which we want to calculate the hash position
914+ */
915 static u_int32_t
916 hash_conntrack(const struct ip_conntrack_tuple *tuple)
917 {
918@@ -124,6 +136,19 @@
919 ip_conntrack_hash_rnd) % ip_conntrack_htable_size);
920 }
921
922+/**
923+ * get_tuple - set all the fields of a tuple which is passed as parameter
924+ * given a network buffer.
925+ * @iph:pointer an IP header.
926+ * @skb:network buffer for which we want to generate the tuple
927+ * @dataoff: FIXME: Deprecated?
928+ * @tuple: tuple which will be generate. Used as return parameter.
929+ * @protocol: structure which contains pointer to protocol specific functions.
930+ *
931+ * Note: This function doesn't allocate space for the tuple passed as
932+ * parameter. The function pkt_to_packet which set all the protocol specific
933+ * fields of a given tuple.
934+ */
935 int
936 get_tuple(const struct iphdr *iph,
937 const struct sk_buff *skb,
938@@ -145,6 +170,15 @@
939 return protocol->pkt_to_tuple(skb, dataoff, tuple);
940 }
941
942+/**
943+ * invert_tuple - Returns the inverse of a given tuple. It is used to
944+ * calculate the tuple which represents the other sense of the flow
945+ * of a connection.
946+ * @inverse: the inverted tuple. Use as return value.
947+ * @orig: the original tuple which will be inverted.
948+ * @protocol: a pointer to the protocol structure which contains all the
949+ * specifical functions available for this tuple.
950+ */
951 static int
952 invert_tuple(struct ip_conntrack_tuple *inverse,
953 const struct ip_conntrack_tuple *orig,
954@@ -160,7 +194,15 @@
955
956 /* ip_conntrack_expect helper functions */
957
958-/* Compare tuple parts depending on mask. */
959+/**
960+ * expect_cmp - compare a tuple with a expectation depending on a mask
961+ * @i: pointer to an expectation.
962+ * @tuple: tuple which will be compared with the expectation tuple.
963+ *
964+ * Actually the tuple field of an expectation is compared with a tuple
965+ * This function is used by LIST_FIND to find a expectation which match a te
966+ * given tuple.
967+ */
968 static inline int expect_cmp(const struct ip_conntrack_expect *i,
969 const struct ip_conntrack_tuple *tuple)
970 {
971@@ -168,6 +210,10 @@
972 return ip_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask);
973 }
974
975+/**
976+ * destroy_expect - Release all the resources allocated by an expectation.
977+ * @exp: pointer to the expectation which we want to release.
978+ */
979 static void
980 destroy_expect(struct ip_conntrack_expect *exp)
981 {
982@@ -178,7 +224,11 @@
983 kfree(exp);
984 }
985
986-
987+/**
988+ * ip_conntrack_expect_put - it decrements the counter of use related
989+ * associated to an expectation and it calls destroy_expect.
990+ * @exp: pointer to the expectation which we want to release.
991+ */
992 inline void ip_conntrack_expect_put(struct ip_conntrack_expect *exp)
993 {
994 IP_NF_ASSERT(exp);
995@@ -198,7 +248,14 @@
996 struct ip_conntrack_expect *, tuple);
997 }
998
999-/* Find a expectation corresponding to a tuple. */
1000+/**
1001+ * ip_conntrack_find_get - find conntrack according to tuple
1002+ * @tuple: conntrack tuple for which we search conntrack
1003+ * @ignored_conntrack: ignore this conntrack during search
1004+ *
1005+ * This function increments the reference count of the found
1006+ * conntrack (if any).
1007+ */
1008 struct ip_conntrack_expect *
1009 ip_conntrack_expect_find_get(const struct ip_conntrack_tuple *tuple)
1010 {
1011@@ -381,7 +438,14 @@
1012 return h;
1013 }
1014
1015-/* Find a connection corresponding to a tuple. */
1016+/**
1017+ * ip_conntrack_find_get - find conntrack according to tuple
1018+ * @tuple: conntrack tuple for which we search conntrack
1019+ * @ignored_conntrack: ignore this conntrack during search
1020+ *
1021+ * This function increments the reference count of the found
1022+ * conntrack (if any).
1023+ */
1024 struct ip_conntrack_tuple_hash *
1025 ip_conntrack_find_get(const struct ip_conntrack_tuple *tuple,
1026 const struct ip_conntrack *ignored_conntrack)
1027@@ -409,7 +473,14 @@
1028 return ct;
1029 }
1030
1031-/* Return conntrack and conntrack_info given skb->nfct->master */
1032+/**
1033+ * ip_conntrack_get - Return conntrack and conntrack_info for given skb
1034+ * @skb: skb for which we want to find conntrack and conntrack_info
1035+ * @ctinfo: pointer to ctinfo, used as return value
1036+ *
1037+ * This function resolves the respective conntrack and conntrack_info
1038+ * structures for the connection this packet (skb) is part of.
1039+ */
1040 struct ip_conntrack *
1041 ip_conntrack_get(struct sk_buff *skb, enum ip_conntrack_info *ctinfo)
1042 {
1043@@ -479,8 +550,14 @@
1044 return NF_DROP;
1045 }
1046
1047-/* Returns true if a connection correspondings to the tuple (required
1048- for NAT). */
1049+/**
1050+ * ip_conntrack_tuple_taken - Find out if tuple is already in use
1051+ * @tuple: tuple to be used for this test
1052+ * @ignored_conntrack: conntrack which is excluded from result
1053+ *
1054+ * This function is called by the NAT code in order to find out if
1055+ * a particular tuple is already in use by some connection.
1056+ */
1057 int
1058 ip_conntrack_tuple_taken(const struct ip_conntrack_tuple *tuple,
1059 const struct ip_conntrack *ignored_conntrack)
1060@@ -606,7 +683,13 @@
1061 {
1062 return ip_ct_tuple_mask_cmp(rtuple, &i->tuple, &i->mask);
1063 }
1064-
1065+/**
1066+ * ip_ct_find_helper - Find application helper according to tuple
1067+ * @tuple: tuple for which helper needs to be found
1068+ *
1069+ * This function is used to determine if any registered conntrack helper
1070+ * is to be used for the given tuple.
1071+ */
1072 struct ip_conntrack_helper *ip_ct_find_helper(const struct ip_conntrack_tuple *tuple)
1073 {
1074 return LIST_FIND(&helpers, helper_cmp,
1075@@ -691,42 +774,50 @@
1076 struct ip_conntrack_expect *, tuple);
1077 READ_UNLOCK(&ip_conntrack_expect_tuple_lock);
1078
1079- /* If master is not in hash table yet (ie. packet hasn't left
1080- this machine yet), how can other end know about expected?
1081- Hence these are not the droids you are looking for (if
1082- master ct never got confirmed, we'd hold a reference to it
1083- and weird things would happen to future packets). */
1084- if (expected && !is_confirmed(expected->expectant))
1085- expected = NULL;
1086-
1087- /* Look up the conntrack helper for master connections only */
1088- if (!expected)
1089- conntrack->helper = ip_ct_find_helper(&repl_tuple);
1090-
1091- /* If the expectation is dying, then this is a loser. */
1092- if (expected
1093- && expected->expectant->helper->timeout
1094- && ! del_timer(&expected->timeout))
1095- expected = NULL;
1096-
1097 if (expected) {
1098- DEBUGP("conntrack: expectation arrives ct=%p exp=%p\n",
1099- conntrack, expected);
1100- /* Welcome, Mr. Bond. We've been expecting you... */
1101- IP_NF_ASSERT(master_ct(conntrack));
1102- __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
1103- conntrack->master = expected;
1104- expected->sibling = conntrack;
1105- LIST_DELETE(&ip_conntrack_expect_list, expected);
1106- expected->expectant->expecting--;
1107- nf_conntrack_get(&master_ct(conntrack)->infos[0]);
1108- }
1109- atomic_inc(&ip_conntrack_count);
1110+ /* If master is not in hash table yet (ie. packet hasn't left
1111+ this machine yet), how can other end know about expected?
1112+ Hence these are not the droids you are looking for (if
1113+ master ct never got confirmed, we'd hold a reference to it
1114+ and weird things would happen to future packets). */
1115+ if (!is_confirmed(expected->expectant)) {
1116+
1117+ conntrack->helper = ip_ct_find_helper(&repl_tuple);
1118+ goto end;
1119+ }
1120+
1121+ /* Expectation is dying... */
1122+ if (expected->expectant->helper->timeout
1123+ && ! del_timer(&expected->timeout)) {
1124+ goto end;
1125+ }
1126+
1127+ DEBUGP("conntrack: expectation arrives ct=%p exp=%p\n",
1128+ conntrack, expected);
1129+ /* Welcome, Mr. Bond. We've been expecting you... */
1130+ IP_NF_ASSERT(master_ct(conntrack));
1131+ __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
1132+ conntrack->master = expected;
1133+ expected->sibling = conntrack;
1134+ LIST_DELETE(&ip_conntrack_expect_list, expected);
1135+ expected->expectant->expecting--;
1136+ nf_conntrack_get(&master_ct(conntrack)->infos[0]);
1137+
1138+ /* this is a braindead... --pablo */
1139+ atomic_inc(&ip_conntrack_count);
1140+ WRITE_UNLOCK(&ip_conntrack_lock);
1141+
1142+ if (expected->expectfn)
1143+ expected->expectfn(conntrack);
1144+
1145+ goto ret;
1146+ } else
1147+ conntrack->helper = ip_ct_find_helper(&repl_tuple);
1148+
1149+end: atomic_inc(&ip_conntrack_count);
1150 WRITE_UNLOCK(&ip_conntrack_lock);
1151
1152- if (expected && expected->expectfn)
1153- expected->expectfn(conntrack);
1154- return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
1155+ret: return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
1156 }
1157
1158 /* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
1159@@ -794,6 +885,15 @@
1160 int set_reply;
1161 int ret;
1162
1163+ /* Never happen */
1164+ if ((*pskb)->nh.iph->frag_off & htons(IP_OFFSET)) {
1165+ if (net_ratelimit()) {
1166+ printk(KERN_ERR "ip_conntrack_in: Frag of proto %u (hook=%u)\n",
1167+ (*pskb)->nh.iph->protocol, hooknum);
1168+ }
1169+ return NF_DROP;
1170+ }
1171+
1172 /* FIXME: Do this right please. --RR */
1173 (*pskb)->nfcache |= NFC_UNKNOWN;
1174
1175@@ -812,18 +912,10 @@
1176 }
1177 #endif
1178
1179- /* Previously seen (loopback)? Ignore. Do this before
1180- fragment check. */
1181+ /* Previously seen (loopback or untracked)? Ignore. */
1182 if ((*pskb)->nfct)
1183 return NF_ACCEPT;
1184
1185- /* Gather fragments. */
1186- if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
1187- *pskb = ip_ct_gather_frags(*pskb);
1188- if (!*pskb)
1189- return NF_STOLEN;
1190- }
1191-
1192 proto = ip_ct_find_proto((*pskb)->nh.iph->protocol);
1193
1194 /* It may be an icmp error... */
1195@@ -900,6 +992,14 @@
1196 return ip_ct_tuple_mask_cmp(&i->tuple, tuple, &intersect_mask);
1197 }
1198
1199+/**
1200+ * ip_conntrack_unexpect_related - Unexpect a related connection
1201+ * @expect: expecattin to be removed
1202+ *
1203+ * This function removes an existing expectation, that has not yet been
1204+ * confirmed (i.e. expectation was issued, but expected connection didn't
1205+ * arrive yet)
1206+ */
1207 inline void ip_conntrack_unexpect_related(struct ip_conntrack_expect *expect)
1208 {
1209 WRITE_LOCK(&ip_conntrack_lock);
1210@@ -917,7 +1017,20 @@
1211 WRITE_UNLOCK(&ip_conntrack_lock);
1212 }
1213
1214-/* Add a related connection. */
1215+/**
1216+ * ip_conntrack_expect_related - Expect a related connection
1217+ * @related_to: master conntrack
1218+ * @expect: expectation with all values filled in
1219+ *
1220+ * This function is called by conntrack application helpers who
1221+ * have detected that the control (master) connection is just about
1222+ * to negotiate a related slave connection.
1223+ *
1224+ * Note: This function allocates it's own struct ip_conntrack_expect,
1225+ * copying the values from the 'expect' parameter. Thus, 'expect' can
1226+ * be allocated on the stack and does not need to be valid after this
1227+ * function returns.
1228+ */
1229 int ip_conntrack_expect_related(struct ip_conntrack *related_to,
1230 struct ip_conntrack_expect *expect)
1231 {
1232@@ -1047,7 +1160,15 @@
1233 return ret;
1234 }
1235
1236-/* Change tuple in an existing expectation */
1237+/**
1238+ * ip_conntrack_change_expect - Change tuple in existing expectation
1239+ * @expect: expectation which is to be changed
1240+ * @newtuple: new tuple for expect
1241+ *
1242+ * This function is mostly called by NAT application helpers, who want to
1243+ * change an expectation issued by their respective conntrack application
1244+ * helper counterpart.
1245+ */
1246 int ip_conntrack_change_expect(struct ip_conntrack_expect *expect,
1247 struct ip_conntrack_tuple *newtuple)
1248 {
1249@@ -1088,8 +1209,15 @@
1250 return ret;
1251 }
1252
1253-/* Alter reply tuple (maybe alter helper). If it's already taken,
1254- return 0 and don't do alteration. */
1255+/**
1256+ * ip_conntrack_alter_reply - Alter reply tuple of conntrack
1257+ * @conntrack: conntrack whose reply tuple we want to alter
1258+ * @newreply: designated reply tuple for this conntrack
1259+ *
1260+ * This function alters the reply tuple of a conntrack to the given
1261+ * newreply tuple. If this newreply tuple is already taken, return 0
1262+ * and don't do alteration
1263+ */
1264 int ip_conntrack_alter_reply(struct ip_conntrack *conntrack,
1265 const struct ip_conntrack_tuple *newreply)
1266 {
1267@@ -1114,6 +1242,13 @@
1268 return 1;
1269 }
1270
1271+/**
1272+ * ip_conntrack_helper_register - Register a conntrack application helper
1273+ * @me: structure describing the helper
1274+ *
1275+ * This function is called by conntrack application helpers to register
1276+ * themselves with the conntrack core.
1277+ */
1278 int ip_conntrack_helper_register(struct ip_conntrack_helper *me)
1279 {
1280 WRITE_LOCK(&ip_conntrack_lock);
1281@@ -1135,6 +1270,13 @@
1282 return 0;
1283 }
1284
1285+/**
1286+ * ip_conntrack_helper_unregister - Unregister a conntrack application helper
1287+ * @me: structure describing the helper
1288+ *
1289+ * This function is called by conntrack application helpers to unregister
1290+ * themselvers from the conntrack core.
1291+ */
1292 void ip_conntrack_helper_unregister(struct ip_conntrack_helper *me)
1293 {
1294 unsigned int i;
1295@@ -1153,7 +1295,14 @@
1296 synchronize_net();
1297 }
1298
1299-/* Refresh conntrack for this many jiffies. */
1300+/**
1301+ * ip_ct_refresh - Refresh conntrack timer for given conntrack
1302+ * @ct: conntrack which we want to refresh
1303+ * @extra_jiffies: number of jiffies to add
1304+ *
1305+ * This function is called by protocol helpers and application helpers in
1306+ * order to change the expiration timer of a conntrack entry.
1307+ */
1308 void ip_ct_refresh(struct ip_conntrack *ct, unsigned long extra_jiffies)
1309 {
1310 IP_NF_ASSERT(ct->timeout.data == (unsigned long)ct);
1311@@ -1172,7 +1321,16 @@
1312 WRITE_UNLOCK(&ip_conntrack_lock);
1313 }
1314
1315-/* Returns new sk_buff, or NULL */
1316+
1317+/**
1318+ * ip_ct_gather_frags - Gather fragments of a particular skb
1319+ * @skb: pointer to sk_buff of fragmented IP packet
1320+ *
1321+ * This code is just a wrapper around the defragmentation code in the core IPv4
1322+ * stack. It also takes care of nonlinear skb's.
1323+ *
1324+ * Returns new sk_buff, or NULL
1325+ */
1326 struct sk_buff *
1327 ip_ct_gather_frags(struct sk_buff *skb)
1328 {
1329@@ -1256,6 +1414,16 @@
1330 return h;
1331 }
1332
1333+/**
1334+ * ip_ct_selective_cleanup - Selectively delete a set of conntrack entries
1335+ * @kill: callback function selecting which entries to delete
1336+ * @data: opaque data pointer, becomes 2nd argument for kill function
1337+ *
1338+ * This function can be used to selectively delete elements of the conntrack
1339+ * hashtable. The function iterates over the list of conntrack entries and
1340+ * calls the 'kill' function for every entry. If the return value is true,
1341+ * the connection is deleted (death_by_timeout).
1342+ */
1343 void
1344 ip_ct_selective_cleanup(int (*kill)(const struct ip_conntrack *i, void *data),
1345 void *data)
1346@@ -1422,6 +1590,18 @@
1347
1348 /* For use by ipt_REJECT */
1349 ip_ct_attach = ip_conntrack_attach;
1350+
1351+ /* Set up fake conntrack:
1352+ - to never be deleted, not in any hashes */
1353+ atomic_set(&ip_conntrack_untracked.ct_general.use, 1);
1354+ /* - and look it like as a confirmed connection */
1355+ set_bit(IPS_CONFIRMED_BIT, &ip_conntrack_untracked.status);
1356+ /* - and prepare the ctinfo field for REJECT & NAT. */
1357+ ip_conntrack_untracked.infos[IP_CT_NEW].master =
1358+ ip_conntrack_untracked.infos[IP_CT_RELATED].master =
1359+ ip_conntrack_untracked.infos[IP_CT_RELATED + IP_CT_IS_REPLY].master =
1360+ &ip_conntrack_untracked.ct_general;
1361+
1362 return ret;
1363
1364 err_free_hash:
1365diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.6.4-rc2/net/ipv4/netfilter/ip_conntrack_standalone.c
1366--- linux-2.6.4-rc2.org/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-03-04 06:16:44.000000000 +0000
1367+++ linux-2.6.4-rc2/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-03-07 08:43:29.000000000 +0000
1368@@ -194,6 +194,26 @@
1369 return ip_conntrack_confirm(*pskb);
1370 }
1371
1372+static unsigned int ip_conntrack_defrag(unsigned int hooknum,
1373+ struct sk_buff **pskb,
1374+ const struct net_device *in,
1375+ const struct net_device *out,
1376+ int (*okfn)(struct sk_buff *))
1377+{
1378+ /* Previously seen (loopback)? Ignore. Do this before
1379+ fragment check. */
1380+ if ((*pskb)->nfct)
1381+ return NF_ACCEPT;
1382+
1383+ /* Gather fragments. */
1384+ if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
1385+ *pskb = ip_ct_gather_frags(*pskb);
1386+ if (!*pskb)
1387+ return NF_STOLEN;
1388+ }
1389+ return NF_ACCEPT;
1390+}
1391+
1392 static unsigned int ip_refrag(unsigned int hooknum,
1393 struct sk_buff **pskb,
1394 const struct net_device *in,
1395@@ -236,6 +256,14 @@
1396
1397 /* Connection tracking may drop packets, but never alters them, so
1398 make it the first hook. */
1399+static struct nf_hook_ops ip_conntrack_defrag_ops = {
1400+ .hook = ip_conntrack_defrag,
1401+ .owner = THIS_MODULE,
1402+ .pf = PF_INET,
1403+ .hooknum = NF_IP_PRE_ROUTING,
1404+ .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
1405+};
1406+
1407 static struct nf_hook_ops ip_conntrack_in_ops = {
1408 .hook = ip_conntrack_in,
1409 .owner = THIS_MODULE,
1410@@ -244,6 +272,14 @@
1411 .priority = NF_IP_PRI_CONNTRACK,
1412 };
1413
1414+static struct nf_hook_ops ip_conntrack_defrag_local_out_ops = {
1415+ .hook = ip_conntrack_defrag,
1416+ .owner = THIS_MODULE,
1417+ .pf = PF_INET,
1418+ .hooknum = NF_IP_LOCAL_OUT,
1419+ .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
1420+};
1421+
1422 static struct nf_hook_ops ip_conntrack_local_out_ops = {
1423 .hook = ip_conntrack_local,
1424 .owner = THIS_MODULE,
1425@@ -470,10 +506,20 @@
1426 if (!proc) goto cleanup_init;
1427 proc->owner = THIS_MODULE;
1428
1429+ ret = nf_register_hook(&ip_conntrack_defrag_ops);
1430+ if (ret < 0) {
1431+ printk("ip_conntrack: can't register pre-routing defrag hook.\n");
1432+ goto cleanup_proc;
1433+ }
1434+ ret = nf_register_hook(&ip_conntrack_defrag_local_out_ops);
1435+ if (ret < 0) {
1436+ printk("ip_conntrack: can't register local_out defrag hook.\n");
1437+ goto cleanup_defragops;
1438+ }
1439 ret = nf_register_hook(&ip_conntrack_in_ops);
1440 if (ret < 0) {
1441 printk("ip_conntrack: can't register pre-routing hook.\n");
1442- goto cleanup_proc;
1443+ goto cleanup_defraglocalops;
1444 }
1445 ret = nf_register_hook(&ip_conntrack_local_out_ops);
1446 if (ret < 0) {
1447@@ -511,6 +557,10 @@
1448 nf_unregister_hook(&ip_conntrack_local_out_ops);
1449 cleanup_inops:
1450 nf_unregister_hook(&ip_conntrack_in_ops);
1451+ cleanup_defraglocalops:
1452+ nf_unregister_hook(&ip_conntrack_defrag_local_out_ops);
1453+ cleanup_defragops:
1454+ nf_unregister_hook(&ip_conntrack_defrag_ops);
1455 cleanup_proc:
1456 proc_net_remove("ip_conntrack");
1457 cleanup_init:
1458@@ -519,13 +569,20 @@
1459 return ret;
1460 }
1461
1462-/* FIXME: Allow NULL functions and sub in pointers to generic for
1463- them. --RR */
1464+/**
1465+ * ip_conntrack_protocol_register - Register layer 4 protocol helper
1466+ * @proto: structure describing this layer 4 protocol helper
1467+ *
1468+ * This function is called by layer 4 protocol helpers to register
1469+ * themselves with the conntrack core.
1470+ */
1471 int ip_conntrack_protocol_register(struct ip_conntrack_protocol *proto)
1472 {
1473 int ret = 0;
1474 struct list_head *i;
1475
1476+ /* FIXME: Allow NULL functions and sub in pointers to generic for
1477+ them. --RR */
1478 WRITE_LOCK(&ip_conntrack_lock);
1479 list_for_each(i, &protocol_list) {
1480 if (((struct ip_conntrack_protocol *)i)->proto
1481@@ -542,12 +599,20 @@
1482 return ret;
1483 }
1484
1485+/**
1486+ * ip_conntrack_protocol_unregister - Unregister layer 4 protocol helper
1487+ * @proto: structure describing this layer 4 protocol helper
1488+ *
1489+ * This function is called byh layer 4 protocol helpers to unregister
1490+ * themselvers from the conntrack core. Please note that all conntrack
1491+ * entries for this protocol are deleted from the conntrack hash table.
1492+ */
1493 void ip_conntrack_protocol_unregister(struct ip_conntrack_protocol *proto)
1494 {
1495 WRITE_LOCK(&ip_conntrack_lock);
1496
1497- /* ip_ct_find_proto() returns proto_generic in case there is no protocol
1498- * helper. So this should be enough - HW */
1499+ /* ip_ct_find_proto() returns proto_generic in case there is no
1500+ * protocol helper. So this should be enough - HW */
1501 LIST_DELETE(&protocol_list, proto);
1502 WRITE_UNLOCK(&ip_conntrack_lock);
1503
1504@@ -602,5 +667,6 @@
1505 EXPORT_SYMBOL(ip_conntrack_expect_list);
1506 EXPORT_SYMBOL(ip_conntrack_lock);
1507 EXPORT_SYMBOL(ip_conntrack_hash);
1508+EXPORT_SYMBOL(ip_conntrack_untracked);
1509 EXPORT_SYMBOL_GPL(ip_conntrack_find_get);
1510 EXPORT_SYMBOL_GPL(ip_conntrack_put);
1511diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/ip_nat_core.c linux-2.6.4-rc2/net/ipv4/netfilter/ip_nat_core.c
1512--- linux-2.6.4-rc2.org/net/ipv4/netfilter/ip_nat_core.c 2004-03-04 06:16:37.000000000 +0000
1513+++ linux-2.6.4-rc2/net/ipv4/netfilter/ip_nat_core.c 2004-03-07 08:43:29.000000000 +0000
1514@@ -96,9 +96,16 @@
1515 WRITE_UNLOCK(&ip_nat_lock);
1516 }
1517
1518-/* We do checksum mangling, so if they were wrong before they're still
1519- * wrong. Also works for incomplete packets (eg. ICMP dest
1520- * unreachables.) */
1521+/**
1522+ * ip_nat_cheat_check - Incremental checksum change for IP/TCP checksum
1523+ * @oldvalinv: bit-inverted old value of 32bit word
1524+ * @newval: new value of 32bit word
1525+ * @oldcheck: old checksum value
1526+ *
1527+ * This function implements incremental checksum mangling, so if a checksum
1528+ * was wrong it will still be wrong after mangling. Also works for incomplete
1529+ * packets (eg. ICMP dest unreachables). Return value is the new checksum.
1530+ */
1531 u_int16_t
1532 ip_nat_cheat_check(u_int32_t oldvalinv, u_int32_t newval, u_int16_t oldcheck)
1533 {
1534@@ -124,7 +131,14 @@
1535 return i;
1536 }
1537
1538-/* Is this tuple already taken? (not by us) */
1539+/**
1540+ * ip_nat_used_tuple - Is this tuple already in use?
1541+ * @tuple: tuple to be used for this check
1542+ * @ignored_conntrack: conntrack excluded from this check
1543+ *
1544+ * This function checks for the reply (inverted) tuple in the conntrack
1545+ * hash. This is necessarry with NAT, since there is no fixed mapping.
1546+ */
1547 int
1548 ip_nat_used_tuple(const struct ip_conntrack_tuple *tuple,
1549 const struct ip_conntrack *ignored_conntrack)
1550@@ -515,6 +529,19 @@
1551 #endif
1552 };
1553
1554+/**
1555+ * ip_nat_setup_info - Set up NAT mappings for NEW packet
1556+ * @conntrack: conntrack on which we operate
1557+ * @mr: address/port range which is valid for this NAT mapping
1558+ * @hooknum: hook at which this NAT mapping applies
1559+ *
1560+ * This function is called by NAT targets (SNAT,DNAT,...) and by
1561+ * the NAT application helper modules. It is called for the NEW packet
1562+ * of a connection in order to specify which NAT mappings shall apply to
1563+ * this connection at a given hook.
1564+ *
1565+ * Note: The reply mappings are created automagically by this function.
1566+ */
1567 unsigned int
1568 ip_nat_setup_info(struct ip_conntrack *conntrack,
1569 const struct ip_nat_multi_range *mr,
1570@@ -1016,6 +1043,10 @@
1571 /* FIXME: Man, this is a hack. <SIGH> */
1572 IP_NF_ASSERT(ip_conntrack_destroyed == NULL);
1573 ip_conntrack_destroyed = &ip_nat_cleanup_conntrack;
1574+
1575+ /* Initialize fake conntrack so that NAT will skip it */
1576+ ip_conntrack_untracked.nat.info.initialized |=
1577+ (1 << IP_NAT_MANIP_SRC) | (1 << IP_NAT_MANIP_DST);
1578
1579 return 0;
1580 }
1581diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/ip_nat_helper.c linux-2.6.4-rc2/net/ipv4/netfilter/ip_nat_helper.c
1582--- linux-2.6.4-rc2.org/net/ipv4/netfilter/ip_nat_helper.c 2004-03-04 06:16:38.000000000 +0000
1583+++ linux-2.6.4-rc2/net/ipv4/netfilter/ip_nat_helper.c 2004-03-07 08:43:10.000000000 +0000
1584@@ -150,9 +150,19 @@
1585 return 1;
1586 }
1587
1588-/* Generic function for mangling variable-length address changes inside
1589- * NATed TCP connections (like the PORT XXX,XXX,XXX,XXX,XXX,XXX
1590- * command in FTP).
1591+/**
1592+ * ip_nat_mangle_tcp_packet - Mangle and potentially resize payload packet
1593+ * @skb: pointer to skb of packet on which we operate
1594+ * @ct: conntrack of the connection to which this packet belongs
1595+ * @ctinfo: conntrack_info of the connection to which this packet belongs
1596+ * @match_offset: offset in bytes where to-be-manipulated part starts
1597+ * @match_len: lenght of the to-be-manipulated part
1598+ * @rep_buffer: pointer to buffer containing replacement
1599+ * @rep_len: length of replacement
1600+ *
1601+ * Generic function for mangling fixed and variable-length changes inside
1602+ * NATed TCP connections (like the PORT XXX,XXX,XXX,XXX,XXX,XXX command
1603+ * in FTP).
1604 *
1605 * Takes care about all the nasty sequence number changes, checksumming,
1606 * skb enlargement, ...
1607@@ -198,16 +208,27 @@
1608 return 1;
1609 }
1610
1611-/* Generic function for mangling variable-length address changes inside
1612- * NATed UDP connections (like the CONNECT DATA XXXXX MESG XXXXX INDEX XXXXX
1613- * command in the Amanda protocol)
1614+/**
1615+ * ip_nat_mangle_udp_packet - Mangle and potentially resize payload packet
1616+ * @skb: pointer to skb of packet on which we operate
1617+ * @ct: conntrack of the connection to which this packet belongs
1618+ * @ctinfo: conntrack_info of the connection to which this packet belongs
1619+ * @match_offset: offset in bytes where to-be-manipulated part starts
1620+ * @match_len: lenght of the to-be-manipulated part
1621+ * @rep_buffer: pointer to buffer containing replacement
1622+ * @rep_len: length of replacement
1623+ *
1624+ * Generic function for mangling fixed and variable-length changes inside
1625+ * NATed TCP connections (like the CONNECT DATA XXXXX MESG XXXXX INDEX XXXXX
1626+ * commad in the Amanda protocol)
1627 *
1628 * Takes care about all the nasty sequence number changes, checksumming,
1629 * skb enlargement, ...
1630 *
1631- * XXX - This function could be merged with ip_nat_mangle_tcp_packet which
1632- * should be fairly easy to do.
1633- */
1634+ * FIXME: should be unified with ip_nat_mangle_tcp_packet!!
1635+ *
1636+ * */
1637+
1638 int
1639 ip_nat_mangle_udp_packet(struct sk_buff **pskb,
1640 struct ip_conntrack *ct,
1641@@ -405,6 +426,13 @@
1642 return ip_ct_tuple_mask_cmp(tuple, &helper->tuple, &helper->mask);
1643 }
1644
1645+/**
1646+ * ip_nat_helper_register - Register NAT application helper
1647+ * @me: structure describing the helper
1648+ *
1649+ * This function is called by NAT application helpers to register
1650+ * themselves with the NAT core.
1651+ */
1652 int ip_nat_helper_register(struct ip_nat_helper *me)
1653 {
1654 int ret = 0;
1655@@ -431,6 +459,13 @@
1656 return ret;
1657 }
1658
1659+/**
1660+ * ip_nat_helper_unregister - Unregister NAT application helper
1661+ * @me: structure describing the helper
1662+ *
1663+ * This function is called by NAT application helpers to unregister
1664+ * themselves from the NAT core.
1665+ */
1666 void ip_nat_helper_unregister(struct ip_nat_helper *me)
1667 {
1668 WRITE_LOCK(&ip_nat_lock);
1669diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/ip_nat_standalone.c linux-2.6.4-rc2/net/ipv4/netfilter/ip_nat_standalone.c
1670--- linux-2.6.4-rc2.org/net/ipv4/netfilter/ip_nat_standalone.c 2004-03-04 06:16:55.000000000 +0000
1671+++ linux-2.6.4-rc2/net/ipv4/netfilter/ip_nat_standalone.c 2004-03-07 08:43:10.000000000 +0000
1672@@ -266,7 +266,13 @@
1673 };
1674 #endif
1675
1676-/* Protocol registration. */
1677+/**
1678+ * ip_nat_protocol_register - Register a layer 4 protocol helper
1679+ * @proto: structure describing this helper
1680+ *
1681+ * This function is called by NAT layer 4 protocol helpers to register
1682+ * themselvers with the NAT core.
1683+ */
1684 int ip_nat_protocol_register(struct ip_nat_protocol *proto)
1685 {
1686 int ret = 0;
1687@@ -287,9 +293,16 @@
1688 return ret;
1689 }
1690
1691-/* Noone stores the protocol anywhere; simply delete it. */
1692+/**
1693+ * ip_nat_protocol_unregister - Unregister a layer 4 protocol helper
1694+ * @proto: structure describing the helper
1695+ *
1696+ * This function is called by NAT layer 4 protocol helpers to
1697+ * unregister themselves from the NAT core.
1698+ */
1699 void ip_nat_protocol_unregister(struct ip_nat_protocol *proto)
1700 {
1701+ /* Noone stores the protocol anywhere; simply delete it. */
1702 WRITE_LOCK(&ip_nat_lock);
1703 LIST_DELETE(&protos, proto);
1704 WRITE_UNLOCK(&ip_nat_lock);
1705diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c linux-2.6.4-rc2/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c
1706--- linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c 1970-01-01 00:00:00.000000000 +0000
1707+++ linux-2.6.4-rc2/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c 2004-03-07 08:43:14.000000000 +0000
1708@@ -0,0 +1,89 @@
1709+/**
1710+ * Strip all IP options in the IP packet header.
1711+ *
1712+ * (C) 2001 by Fabrice MARIE <fabrice@netfilter.org>
1713+ * This software is distributed under GNU GPL v2, 1991
1714+ */
1715+
1716+#include <linux/module.h>
1717+#include <linux/skbuff.h>
1718+#include <linux/ip.h>
1719+#include <net/checksum.h>
1720+
1721+#include <linux/netfilter_ipv4/ip_tables.h>
1722+
1723+MODULE_AUTHOR("Fabrice MARIE <fabrice@netfilter.org>");
1724+MODULE_DESCRIPTION("Strip all options in IPv4 packets");
1725+MODULE_LICENSE("GPL");
1726+
1727+static unsigned int
1728+target(struct sk_buff **pskb,
1729+ const struct net_device *in,
1730+ const struct net_device *out,
1731+ unsigned int hooknum,
1732+ const void *targinfo,
1733+ void *userinfo)
1734+{
1735+ struct iphdr *iph;
1736+ struct sk_buff *skb;
1737+ struct ip_options *opt;
1738+ unsigned char *optiph;
1739+ int l;
1740+
1741+ if (!skb_ip_make_writable(pskb, (*pskb)->len))
1742+ return NF_DROP;
1743+
1744+ skb = (*pskb);
1745+ iph = (*pskb)->nh.iph;
1746+ optiph = skb->nh.raw;
1747+ l = ((struct ip_options *)(&(IPCB(skb)->opt)))->optlen;
1748+
1749+ /* if no options in packet then nothing to clear. */
1750+ if (iph->ihl * 4 == sizeof(struct iphdr))
1751+ return IPT_CONTINUE;
1752+
1753+ /* else clear all options */
1754+ memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
1755+ memset(optiph+sizeof(struct iphdr), IPOPT_NOOP, l);
1756+ opt = &(IPCB(skb)->opt);
1757+ opt->is_data = 0;
1758+ opt->optlen = l;
1759+
1760+ skb->nfcache |= NFC_ALTERED;
1761+
1762+ return IPT_CONTINUE;
1763+}
1764+
1765+static int
1766+checkentry(const char *tablename,
1767+ const struct ipt_entry *e,
1768+ void *targinfo,
1769+ unsigned int targinfosize,
1770+ unsigned int hook_mask)
1771+{
1772+ if (strcmp(tablename, "mangle")) {
1773+ printk(KERN_WARNING "IPV4OPTSSTRIP: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
1774+ return 0;
1775+ }
1776+ /* nothing else to check because no parameters */
1777+ return 1;
1778+}
1779+
1780+static struct ipt_target ipt_ipv4optsstrip_reg = {
1781+ .name = "IPV4OPTSSTRIP",
1782+ .target = target,
1783+ .checkentry = checkentry,
1784+ .me = THIS_MODULE };
1785+
1786+static int __init init(void)
1787+{
1788+ return ipt_register_target(&ipt_ipv4optsstrip_reg);
1789+}
1790+
1791+static void __exit fini(void)
1792+{
1793+ ipt_unregister_target(&ipt_ipv4optsstrip_reg);
1794+}
1795+
1796+module_init(init);
1797+module_exit(fini);
1798diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_LOG.c linux-2.6.4-rc2/net/ipv4/netfilter/ipt_LOG.c
1799--- linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_LOG.c 2004-03-04 06:17:03.000000000 +0000
1800+++ linux-2.6.4-rc2/net/ipv4/netfilter/ipt_LOG.c 2004-03-07 08:43:12.000000000 +0000
1801@@ -19,6 +19,7 @@
1802 #include <net/tcp.h>
1803 #include <net/route.h>
1804
1805+#include <linux/netfilter.h>
1806 #include <linux/netfilter_ipv4/ip_tables.h>
1807 #include <linux/netfilter_ipv4/ipt_LOG.h>
1808
1809@@ -26,6 +27,10 @@
1810 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1811 MODULE_DESCRIPTION("iptables syslog logging module");
1812
1813+static unsigned int nflog = 1;
1814+MODULE_PARM(nflog, "i");
1815+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
1816+
1817 #if 0
1818 #define DEBUGP printk
1819 #else
1820@@ -324,28 +329,25 @@
1821 /* maxlen = 230+ 91 + 230 + 252 = 803 */
1822 }
1823
1824-static unsigned int
1825-ipt_log_target(struct sk_buff **pskb,
1826+static void
1827+ipt_log_packet(unsigned int hooknum,
1828+ const struct sk_buff *skb,
1829 const struct net_device *in,
1830 const struct net_device *out,
1831- unsigned int hooknum,
1832- const void *targinfo,
1833- void *userinfo)
1834+ const struct ipt_log_info *loginfo,
1835+ const char *level_string,
1836+ const char *prefix)
1837 {
1838- const struct ipt_log_info *loginfo = targinfo;
1839- char level_string[4] = "< >";
1840-
1841- level_string[1] = '0' + (loginfo->level % 8);
1842 spin_lock_bh(&log_lock);
1843 printk(level_string);
1844 printk("%sIN=%s OUT=%s ",
1845- loginfo->prefix,
1846+ prefix == NULL ? loginfo->prefix : prefix,
1847 in ? in->name : "",
1848 out ? out->name : "");
1849 #ifdef CONFIG_BRIDGE_NETFILTER
1850- if ((*pskb)->nf_bridge) {
1851- struct net_device *physindev = (*pskb)->nf_bridge->physindev;
1852- struct net_device *physoutdev = (*pskb)->nf_bridge->physoutdev;
1853+ if (skb->nf_bridge) {
1854+ struct net_device *physindev = skb->nf_bridge->physindev;
1855+ struct net_device *physoutdev = skb->nf_bridge->physoutdev;
1856
1857 if (physindev && in != physindev)
1858 printk("PHYSIN=%s ", physindev->name);
1859@@ -357,25 +359,56 @@
1860 if (in && !out) {
1861 /* MAC logging for input chain only. */
1862 printk("MAC=");
1863- if ((*pskb)->dev && (*pskb)->dev->hard_header_len
1864- && (*pskb)->mac.raw != (void*)(*pskb)->nh.iph) {
1865+ if (skb->dev && skb->dev->hard_header_len
1866+ && skb->mac.raw != (void*)skb->nh.iph) {
1867 int i;
1868- unsigned char *p = (*pskb)->mac.raw;
1869- for (i = 0; i < (*pskb)->dev->hard_header_len; i++,p++)
1870+ unsigned char *p = skb->mac.raw;
1871+ for (i = 0; i < skb->dev->hard_header_len; i++,p++)
1872 printk("%02x%c", *p,
1873- i==(*pskb)->dev->hard_header_len - 1
1874+ i==skb->dev->hard_header_len - 1
1875 ? ' ':':');
1876 } else
1877 printk(" ");
1878 }
1879
1880- dump_packet(loginfo, *pskb, 0);
1881+ dump_packet(loginfo, skb, 0);
1882 printk("\n");
1883 spin_unlock_bh(&log_lock);
1884+}
1885+
1886+static unsigned int
1887+ipt_log_target(struct sk_buff **pskb,
1888+ const struct net_device *in,
1889+ const struct net_device *out,
1890+ unsigned int hooknum,
1891+ const void *targinfo,
1892+ void *userinfo)
1893+{
1894+ const struct ipt_log_info *loginfo = targinfo;
1895+ char level_string[4] = "< >";
1896+
1897+ level_string[1] = '0' + (loginfo->level % 8);
1898+ ipt_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
1899
1900 return IPT_CONTINUE;
1901 }
1902
1903+static void
1904+ipt_logfn(unsigned int hooknum,
1905+ const struct sk_buff *skb,
1906+ const struct net_device *in,
1907+ const struct net_device *out,
1908+ const char *prefix)
1909+{
1910+ struct ipt_log_info loginfo = {
1911+ .level = 0,
1912+ .logflags = IPT_LOG_MASK,
1913+ .prefix = ""
1914+ };
1915+
1916+ ipt_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
1917+}
1918+
1919 static int ipt_log_checkentry(const char *tablename,
1920 const struct ipt_entry *e,
1921 void *targinfo,
1922@@ -413,11 +446,18 @@
1923
1924 static int __init init(void)
1925 {
1926- return ipt_register_target(&ipt_log_reg);
1927+ if (ipt_register_target(&ipt_log_reg))
1928+ return -EINVAL;
1929+ if (nflog)
1930+ nf_log_register(PF_INET, &ipt_logfn);
1931+
1932+ return 0;
1933 }
1934
1935 static void __exit fini(void)
1936 {
1937+ if (nflog)
1938+ nf_log_unregister(PF_INET, &ipt_logfn);
1939 ipt_unregister_target(&ipt_log_reg);
1940 }
1941
1942diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_NOTRACK.c linux-2.6.4-rc2/net/ipv4/netfilter/ipt_NOTRACK.c
1943--- linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_NOTRACK.c 1970-01-01 00:00:00.000000000 +0000
1944+++ linux-2.6.4-rc2/net/ipv4/netfilter/ipt_NOTRACK.c 2004-03-07 08:43:29.000000000 +0000
1945@@ -0,0 +1,75 @@
1946+/* This is a module which is used for setting up fake conntracks
1947+ * on packets so that they are not seen by the conntrack/NAT code.
1948+ */
1949+#include <linux/module.h>
1950+#include <linux/skbuff.h>
1951+
1952+#include <linux/netfilter_ipv4/ip_tables.h>
1953+#include <linux/netfilter_ipv4/ip_conntrack.h>
1954+
1955+static unsigned int
1956+target(struct sk_buff **pskb,
1957+ const struct net_device *in,
1958+ const struct net_device *out,
1959+ unsigned int hooknum,
1960+ const void *targinfo,
1961+ void *userinfo)
1962+{
1963+ /* Previously seen (loopback)? Ignore. */
1964+ if ((*pskb)->nfct != NULL)
1965+ return IPT_CONTINUE;
1966+
1967+ /* Attach fake conntrack entry.
1968+ If there is a real ct entry correspondig to this packet,
1969+ it'll hang aroun till timing out. We don't deal with it
1970+ for performance reasons. JK */
1971+ (*pskb)->nfct = &ip_conntrack_untracked.infos[IP_CT_NEW];
1972+ nf_conntrack_get((*pskb)->nfct);
1973+
1974+ return IPT_CONTINUE;
1975+}
1976+
1977+static int
1978+checkentry(const char *tablename,
1979+ const struct ipt_entry *e,
1980+ void *targinfo,
1981+ unsigned int targinfosize,
1982+ unsigned int hook_mask)
1983+{
1984+ if (targinfosize != 0) {
1985+ printk(KERN_WARNING "NOTRACK: targinfosize %u != 0\n",
1986+ targinfosize);
1987+ return 0;
1988+ }
1989+
1990+ if (strcmp(tablename, "raw") != 0) {
1991+ printk(KERN_WARNING "NOTRACK: can only be called from \"raw\" table, not \"%s\"\n", tablename);
1992+ return 0;
1993+ }
1994+
1995+ return 1;
1996+}
1997+
1998+static struct ipt_target ipt_notrack_reg = {
1999+ .name = "NOTRACK",
2000+ .target = target,
2001+ .checkentry = checkentry,
2002+ .me = THIS_MODULE
2003+};
2004+
2005+static int __init init(void)
2006+{
2007+ if (ipt_register_target(&ipt_notrack_reg))
2008+ return -EINVAL;
2009+
2010+ return 0;
2011+}
2012+
2013+static void __exit fini(void)
2014+{
2015+ ipt_unregister_target(&ipt_notrack_reg);
2016+}
2017+
2018+module_init(init);
2019+module_exit(fini);
2020+MODULE_LICENSE("GPL");
2021diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_TTL.c linux-2.6.4-rc2/net/ipv4/netfilter/ipt_TTL.c
2022--- linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_TTL.c 1970-01-01 00:00:00.000000000 +0000
2023+++ linux-2.6.4-rc2/net/ipv4/netfilter/ipt_TTL.c 2004-03-07 08:43:16.000000000 +0000
2024@@ -0,0 +1,120 @@
2025+/* TTL modification target for IP tables
2026+ * (C) 2000 by Harald Welte <laforge@gnumonks.org>
2027+ *
2028+ * Version: $Revision$
2029+ *
2030+ * This software is distributed under the terms of GNU GPL
2031+ */
2032+
2033+#include <linux/module.h>
2034+#include <linux/skbuff.h>
2035+#include <linux/ip.h>
2036+#include <net/checksum.h>
2037+
2038+#include <linux/netfilter_ipv4/ip_tables.h>
2039+#include <linux/netfilter_ipv4/ipt_TTL.h>
2040+
2041+MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
2042+MODULE_DESCRIPTION("IP tables TTL modification module");
2043+MODULE_LICENSE("GPL");
2044+
2045+static unsigned int
2046+ipt_ttl_target(struct sk_buff **pskb, const struct net_device *in,
2047+ const struct net_device *out, unsigned int hooknum,
2048+ const void *targinfo, void *userinfo)
2049+{
2050+ struct iphdr *iph;
2051+ const struct ipt_TTL_info *info = targinfo;
2052+ u_int16_t diffs[2];
2053+ int new_ttl;
2054+
2055+ if (!skb_ip_make_writable(pskb, (*pskb)->len))
2056+ return NF_DROP;
2057+
2058+ iph = (*pskb)->nh.iph;
2059+
2060+ switch (info->mode) {
2061+ case IPT_TTL_SET:
2062+ new_ttl = info->ttl;
2063+ break;
2064+ case IPT_TTL_INC:
2065+ new_ttl = iph->ttl + info->ttl;
2066+ if (new_ttl > 255)
2067+ new_ttl = 255;
2068+ break;
2069+ case IPT_TTL_DEC:
2070+ new_ttl = iph->ttl + info->ttl;
2071+ if (new_ttl < 0)
2072+ new_ttl = 0;
2073+ break;
2074+ default:
2075+ new_ttl = iph->ttl;
2076+ break;
2077+ }
2078+
2079+ if (new_ttl != iph->ttl) {
2080+ diffs[0] = htons(((unsigned)iph->ttl) << 8) ^ 0xFFFF;
2081+ iph->ttl = new_ttl;
2082+ diffs[1] = htons(((unsigned)iph->ttl) << 8);
2083+ iph->check = csum_fold(csum_partial((char *)diffs,
2084+ sizeof(diffs),
2085+ iph->check^0xFFFF));
2086+ (*pskb)->nfcache |= NFC_ALTERED;
2087+ }
2088+
2089+ return IPT_CONTINUE;
2090+}
2091+
2092+static int ipt_ttl_checkentry(const char *tablename,
2093+ const struct ipt_entry *e,
2094+ void *targinfo,
2095+ unsigned int targinfosize,
2096+ unsigned int hook_mask)
2097+{
2098+ struct ipt_TTL_info *info = targinfo;
2099+
2100+ if (targinfosize != IPT_ALIGN(sizeof(struct ipt_TTL_info))) {
2101+ printk(KERN_WARNING "TTL: targinfosize %u != %Zu\n",
2102+ targinfosize,
2103+ IPT_ALIGN(sizeof(struct ipt_TTL_info)));
2104+ return 0;
2105+ }
2106+
2107+ if (strcmp(tablename, "mangle")) {
2108+ printk(KERN_WARNING "TTL: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
2109+ return 0;
2110+ }
2111+
2112+ if (info->mode > IPT_TTL_MAXMODE) {
2113+ printk(KERN_WARNING "TTL: invalid or unknown Mode %u\n",
2114+ info->mode);
2115+ return 0;
2116+ }
2117+
2118+ if ((info->mode != IPT_TTL_SET) && (info->ttl == 0)) {
2119+ printk(KERN_WARNING "TTL: increment/decrement doesn't make sense with value 0\n");
2120+ return 0;
2121+ }
2122+
2123+ return 1;
2124+}
2125+
2126+static struct ipt_target ipt_TTL = {
2127+ .name = "TTL",
2128+ .target = ipt_ttl_target,
2129+ .checkentry = ipt_ttl_checkentry,
2130+ .me = THIS_MODULE
2131+};
2132+
2133+static int __init init(void)
2134+{
2135+ return ipt_register_target(&ipt_TTL);
2136+}
2137+
2138+static void __exit fini(void)
2139+{
2140+ ipt_unregister_target(&ipt_TTL);
2141+}
2142+
2143+module_init(init);
2144+module_exit(fini);
2145diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_ULOG.c linux-2.6.4-rc2/net/ipv4/netfilter/ipt_ULOG.c
2146--- linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_ULOG.c 2004-03-04 06:16:42.000000000 +0000
2147+++ linux-2.6.4-rc2/net/ipv4/netfilter/ipt_ULOG.c 2004-03-07 08:43:12.000000000 +0000
2148@@ -50,6 +50,7 @@
2149 #include <linux/netlink.h>
2150 #include <linux/netdevice.h>
2151 #include <linux/mm.h>
2152+#include <linux/netfilter.h>
2153 #include <linux/netfilter_ipv4/ip_tables.h>
2154 #include <linux/netfilter_ipv4/ipt_ULOG.h>
2155 #include <linux/netfilter_ipv4/lockhelp.h>
2156@@ -80,6 +81,10 @@
2157 MODULE_PARM(flushtimeout, "i");
2158 MODULE_PARM_DESC(flushtimeout, "buffer flush timeout");
2159
2160+static unsigned int nflog = 1;
2161+MODULE_PARM(nflog, "i");
2162+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
2163+
2164 /* global data structures */
2165
2166 typedef struct {
2167@@ -157,17 +162,17 @@
2168 return skb;
2169 }
2170
2171-static unsigned int ipt_ulog_target(struct sk_buff **pskb,
2172- const struct net_device *in,
2173- const struct net_device *out,
2174- unsigned int hooknum,
2175- const void *targinfo, void *userinfo)
2176+static void ipt_ulog_packet(unsigned int hooknum,
2177+ const struct sk_buff *skb,
2178+ const struct net_device *in,
2179+ const struct net_device *out,
2180+ const struct ipt_ulog_info *loginfo,
2181+ const char *prefix)
2182 {
2183 ulog_buff_t *ub;
2184 ulog_packet_msg_t *pm;
2185 size_t size, copy_len;
2186 struct nlmsghdr *nlh;
2187- struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
2188
2189 /* ffs == find first bit set, necessary because userspace
2190 * is already shifting groupnumber, but we need unshifted.
2191@@ -176,8 +181,8 @@
2192
2193 /* calculate the size of the skb needed */
2194 if ((loginfo->copy_range == 0) ||
2195- (loginfo->copy_range > (*pskb)->len)) {
2196- copy_len = (*pskb)->len;
2197+ (loginfo->copy_range > skb->len)) {
2198+ copy_len = skb->len;
2199 } else {
2200 copy_len = loginfo->copy_range;
2201 }
2202@@ -214,19 +219,21 @@
2203
2204 /* copy hook, prefix, timestamp, payload, etc. */
2205 pm->data_len = copy_len;
2206- pm->timestamp_sec = (*pskb)->stamp.tv_sec;
2207- pm->timestamp_usec = (*pskb)->stamp.tv_usec;
2208- pm->mark = (*pskb)->nfmark;
2209+ pm->timestamp_sec = skb->stamp.tv_sec;
2210+ pm->timestamp_usec = skb->stamp.tv_usec;
2211+ pm->mark = skb->nfmark;
2212 pm->hook = hooknum;
2213- if (loginfo->prefix[0] != '\0')
2214+ if (prefix != NULL)
2215+ strncpy(pm->prefix, prefix, sizeof(pm->prefix));
2216+ else if (loginfo->prefix[0] != '\0')
2217 strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
2218 else
2219 *(pm->prefix) = '\0';
2220
2221 if (in && in->hard_header_len > 0
2222- && (*pskb)->mac.raw != (void *) (*pskb)->nh.iph
2223+ && skb->mac.raw != (void *) skb->nh.iph
2224 && in->hard_header_len <= ULOG_MAC_LEN) {
2225- memcpy(pm->mac, (*pskb)->mac.raw, in->hard_header_len);
2226+ memcpy(pm->mac, skb->mac.raw, in->hard_header_len);
2227 pm->mac_len = in->hard_header_len;
2228 } else
2229 pm->mac_len = 0;
2230@@ -241,8 +248,8 @@
2231 else
2232 pm->outdev_name[0] = '\0';
2233
2234- /* copy_len <= (*pskb)->len, so can't fail. */
2235- if (skb_copy_bits(*pskb, 0, pm->payload, copy_len) < 0)
2236+ /* copy_len <= skb->len, so can't fail. */
2237+ if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0)
2238 BUG();
2239
2240 /* check if we are building multi-part messages */
2241@@ -266,8 +273,7 @@
2242
2243 UNLOCK_BH(&ulog_lock);
2244
2245- return IPT_CONTINUE;
2246-
2247+ return;
2248
2249 nlmsg_failure:
2250 PRINTR("ipt_ULOG: error during NLMSG_PUT\n");
2251@@ -276,8 +282,35 @@
2252 PRINTR("ipt_ULOG: Error building netlink message\n");
2253
2254 UNLOCK_BH(&ulog_lock);
2255+}
2256+
2257+static unsigned int ipt_ulog_target(struct sk_buff **pskb,
2258+ const struct net_device *in,
2259+ const struct net_device *out,
2260+ unsigned int hooknum,
2261+ const void *targinfo, void *userinfo)
2262+{
2263+ struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
2264
2265- return IPT_CONTINUE;
2266+ ipt_ulog_packet(hooknum, *pskb, in, out, loginfo, NULL);
2267+
2268+ return IPT_CONTINUE;
2269+}
2270+
2271+static void ipt_logfn(unsigned int hooknum,
2272+ const struct sk_buff *skb,
2273+ const struct net_device *in,
2274+ const struct net_device *out,
2275+ const char *prefix)
2276+{
2277+ struct ipt_ulog_info loginfo = {
2278+ .nl_group = ULOG_DEFAULT_NLGROUP,
2279+ .copy_range = 0,
2280+ .qthreshold = ULOG_DEFAULT_QTHRESHOLD,
2281+ .prefix = ""
2282+ };
2283+
2284+ ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
2285 }
2286
2287 static int ipt_ulog_checkentry(const char *tablename,
2288@@ -341,7 +374,9 @@
2289 sock_release(nflognl->sk_socket);
2290 return -EINVAL;
2291 }
2292-
2293+ if (nflog)
2294+ nf_log_register(PF_INET, &ipt_logfn);
2295+
2296 return 0;
2297 }
2298
2299@@ -352,6 +387,8 @@
2300
2301 DEBUGP("ipt_ULOG: cleanup_module\n");
2302
2303+ if (nflog)
2304+ nf_log_unregister(PF_INET, &ipt_logfn);
2305 ipt_unregister_target(&ipt_ulog_reg);
2306 sock_release(nflognl->sk_socket);
2307
2308diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_connlimit.c linux-2.6.4-rc2/net/ipv4/netfilter/ipt_connlimit.c
2309--- linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_connlimit.c 1970-01-01 00:00:00.000000000 +0000
2310+++ linux-2.6.4-rc2/net/ipv4/netfilter/ipt_connlimit.c 2004-03-07 08:43:18.000000000 +0000
2311@@ -0,0 +1,230 @@
2312+/*
2313+ * netfilter module to limit the number of parallel tcp
2314+ * connections per IP address.
2315+ * (c) 2000 Gerd Knorr <kraxel@bytesex.org>
2316+ * Nov 2002: Martin Bene <martin.bene@icomedias.com>:
2317+ * only ignore TIME_WAIT or gone connections
2318+ *
2319+ * based on ...
2320+ *
2321+ * Kernel module to match connection tracking information.
2322+ * GPL (C) 1999 Rusty Russell (rusty@rustcorp.com.au).
2323+ */
2324+#include <linux/module.h>
2325+#include <linux/skbuff.h>
2326+#include <linux/list.h>
2327+#include <linux/netfilter_ipv4/ip_conntrack.h>
2328+#include <linux/netfilter_ipv4/ip_conntrack_core.h>
2329+#include <linux/netfilter_ipv4/ip_conntrack_tcp.h>
2330+#include <linux/netfilter_ipv4/ip_tables.h>
2331+#include <linux/netfilter_ipv4/ipt_connlimit.h>
2332+
2333+#define DEBUG 0
2334+
2335+MODULE_LICENSE("GPL");
2336+
2337+/* we'll save the tuples of all connections we care about */
2338+struct ipt_connlimit_conn
2339+{
2340+ struct list_head list;
2341+ struct ip_conntrack_tuple tuple;
2342+};
2343+
2344+struct ipt_connlimit_data {
2345+ spinlock_t lock;
2346+ struct list_head iphash[256];
2347+};
2348+
2349+static int ipt_iphash(u_int32_t addr)
2350+{
2351+ int hash;
2352+
2353+ hash = addr & 0xff;
2354+ hash ^= (addr >> 8) & 0xff;
2355+ hash ^= (addr >> 16) & 0xff;
2356+ hash ^= (addr >> 24) & 0xff;
2357+ return hash;
2358+}
2359+
2360+static int count_them(struct ipt_connlimit_data *data,
2361+ u_int32_t addr, u_int32_t mask,
2362+ struct ip_conntrack *ct)
2363+{
2364+#if DEBUG
2365+ const static char *tcp[] = { "none", "established", "syn_sent", "syn_recv",
2366+ "fin_wait", "time_wait", "close", "close_wait",
2367+ "last_ack", "listen" };
2368+#endif
2369+ int addit = 1, matches = 0;
2370+ struct ip_conntrack_tuple tuple;
2371+ struct ip_conntrack_tuple_hash *found;
2372+ struct ipt_connlimit_conn *conn;
2373+ struct list_head *hash,*lh;
2374+
2375+ spin_lock(&data->lock);
2376+ tuple = ct->tuplehash[0].tuple;
2377+ hash = &data->iphash[ipt_iphash(addr & mask)];
2378+
2379+ /* check the saved connections */
2380+ for (lh = hash->next; lh != hash; lh = lh->next) {
2381+ conn = list_entry(lh,struct ipt_connlimit_conn,list);
2382+ found = ip_conntrack_find_get(&conn->tuple,ct);
2383+ if (0 == memcmp(&conn->tuple,&tuple,sizeof(tuple)) &&
2384+ found != NULL &&
2385+ found->ctrack->proto.tcp.state != TCP_CONNTRACK_TIME_WAIT) {
2386+ /* Just to be sure we have it only once in the list.
2387+ We should'nt see tuples twice unless someone hooks this
2388+ into a table without "-p tcp --syn" */
2389+ addit = 0;
2390+ }
2391+#if DEBUG
2392+ printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d %s\n",
2393+ ipt_iphash(addr & mask),
2394+ NIPQUAD(conn->tuple.src.ip), ntohs(conn->tuple.src.u.tcp.port),
2395+ NIPQUAD(conn->tuple.dst.ip), ntohs(conn->tuple.dst.u.tcp.port),
2396+ (NULL != found) ? tcp[found->ctrack->proto.tcp.state] : "gone");
2397+#endif
2398+ if (NULL == found) {
2399+ /* this one is gone */
2400+ lh = lh->prev;
2401+ list_del(lh->next);
2402+ kfree(conn);
2403+ continue;
2404+ }
2405+ if (found->ctrack->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT) {
2406+ /* we don't care about connections which are
2407+ closed already -> ditch it */
2408+ lh = lh->prev;
2409+ list_del(lh->next);
2410+ kfree(conn);
2411+ nf_conntrack_put(&found->ctrack->infos[0]);
2412+ continue;
2413+ }
2414+ if ((addr & mask) == (conn->tuple.src.ip & mask)) {
2415+ /* same source IP address -> be counted! */
2416+ matches++;
2417+ }
2418+ nf_conntrack_put(&found->ctrack->infos[0]);
2419+ }
2420+ if (addit) {
2421+ /* save the new connection in our list */
2422+#if DEBUG
2423+ printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d new\n",
2424+ ipt_iphash(addr & mask),
2425+ NIPQUAD(tuple.src.ip), ntohs(tuple.src.u.tcp.port),
2426+ NIPQUAD(tuple.dst.ip), ntohs(tuple.dst.u.tcp.port));
2427+#endif
2428+ conn = kmalloc(sizeof(*conn),GFP_ATOMIC);
2429+ if (NULL == conn)
2430+ return -1;
2431+ memset(conn,0,sizeof(*conn));
2432+ INIT_LIST_HEAD(&conn->list);
2433+ conn->tuple = tuple;
2434+ list_add(&conn->list,hash);
2435+ matches++;
2436+ }
2437+ spin_unlock(&data->lock);
2438+ return matches;
2439+}
2440+
2441+static int
2442+match(const struct sk_buff *skb,
2443+ const struct net_device *in,
2444+ const struct net_device *out,
2445+ const void *matchinfo,
2446+ int offset,
2447+ int *hotdrop)
2448+{
2449+ const struct ipt_connlimit_info *info = matchinfo;
2450+ int connections, match;
2451+ struct ip_conntrack *ct;
2452+ enum ip_conntrack_info ctinfo;
2453+
2454+ ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
2455+ if (NULL == ct) {
2456+ printk("ipt_connlimit: Oops: invalid ct state ?\n");
2457+ *hotdrop = 1;
2458+ return 0;
2459+ }
2460+ connections = count_them(info->data,skb->nh.iph->saddr,info->mask,ct);
2461+ if (-1 == connections) {
2462+ printk("ipt_connlimit: Hmm, kmalloc failed :-(\n");
2463+ *hotdrop = 1; /* let's free some memory :-) */
2464+ return 0;
2465+ }
2466+ match = (info->inverse) ? (connections <= info->limit) : (connections > info->limit);
2467+#if DEBUG
2468+ printk("ipt_connlimit: src=%u.%u.%u.%u mask=%u.%u.%u.%u "
2469+ "connections=%d limit=%d match=%s\n",
2470+ NIPQUAD(skb->nh.iph->saddr), NIPQUAD(info->mask),
2471+ connections, info->limit, match ? "yes" : "no");
2472+#endif
2473+
2474+ return match;
2475+}
2476+
2477+static int check(const char *tablename,
2478+ const struct ipt_ip *ip,
2479+ void *matchinfo,
2480+ unsigned int matchsize,
2481+ unsigned int hook_mask)
2482+{
2483+ struct ipt_connlimit_info *info = matchinfo;
2484+ int i;
2485+
2486+ /* verify size */
2487+ if (matchsize != IPT_ALIGN(sizeof(struct ipt_connlimit_info)))
2488+ return 0;
2489+
2490+ /* refuse anything but tcp */
2491+ if (ip->proto != IPPROTO_TCP)
2492+ return 0;
2493+
2494+ /* init private data */
2495+ info->data = kmalloc(sizeof(struct ipt_connlimit_data),GFP_KERNEL);
2496+ spin_lock_init(&(info->data->lock));
2497+ for (i = 0; i < 256; i++)
2498+ INIT_LIST_HEAD(&(info->data->iphash[i]));
2499+
2500+ return 1;
2501+}
2502+
2503+static void destroy(void *matchinfo, unsigned int matchinfosize)
2504+{
2505+ struct ipt_connlimit_info *info = matchinfo;
2506+ struct ipt_connlimit_conn *conn;
2507+ struct list_head *hash;
2508+ int i;
2509+
2510+ /* cleanup */
2511+ for (i = 0; i < 256; i++) {
2512+ hash = &(info->data->iphash[i]);
2513+ while (hash != hash->next) {
2514+ conn = list_entry(hash->next,struct ipt_connlimit_conn,list);
2515+ list_del(hash->next);
2516+ kfree(conn);
2517+ }
2518+ }
2519+ kfree(info->data);
2520+}
2521+
2522+static struct ipt_match connlimit_match = {
2523+ .name = "connlimit",
2524+ .match = &match,
2525+ .checkentry = &check,
2526+ .destroy = &destroy,
2527+ .me = THIS_MODULE
2528+};
2529+
2530+static int __init init(void)
2531+{
2532+ return ipt_register_match(&connlimit_match);
2533+}
2534+
2535+static void __exit fini(void)
2536+{
2537+ ipt_unregister_match(&connlimit_match);
2538+}
2539+
2540+module_init(init);
2541+module_exit(fini);
2542diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_conntrack.c linux-2.6.4-rc2/net/ipv4/netfilter/ipt_conntrack.c
2543--- linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_conntrack.c 2004-03-04 06:17:04.000000000 +0000
2544+++ linux-2.6.4-rc2/net/ipv4/netfilter/ipt_conntrack.c 2004-03-07 08:43:29.000000000 +0000
2545@@ -35,11 +35,13 @@
2546
2547 #define FWINV(bool,invflg) ((bool) ^ !!(sinfo->invflags & invflg))
2548
2549- if (ct)
2550- statebit = IPT_CONNTRACK_STATE_BIT(ctinfo);
2551- else
2552- statebit = IPT_CONNTRACK_STATE_INVALID;
2553-
2554+ if (skb->nfct == &ip_conntrack_untracked.infos[IP_CT_NEW])
2555+ statebit = IPT_CONNTRACK_STATE_UNTRACKED;
2556+ else if (ct)
2557+ statebit = IPT_CONNTRACK_STATE_BIT(ctinfo);
2558+ else
2559+ statebit = IPT_CONNTRACK_STATE_INVALID;
2560+
2561 if(sinfo->flags & IPT_CONNTRACK_STATE) {
2562 if (ct) {
2563 if(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip !=
2564diff -Nur --exclude '*.orig' linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_dstlimit.c linux-2.6.4-rc2/net/ipv4/netfilter/ipt_dstlimit.c
2565--- linux-2.6.4-rc2.org/net/ipv4/netfilter/ipt_dstlimit.c 1970-01-01 00:00:00.000000000 +0000
2566+++ linux-2.6.4-rc2/net/ipv4/netfilter/ipt_dstlimit.c 2004-03-07 08:43:19.000000000 +0000
2567@@ -0,0 +1,690 @@
2568+/* iptables match extension to limit the number of packets per second
2569+ * seperately for each destination.
2570+ *
2571+ * (C) 2003 by Harald Welte <laforge@netfilter.org>
2572+ *
2573+ * $Id$
2574+ *
2575+ * Development of this code was funded by Astaro AG, http://www.astaro.com/
2576+ *
2577+ * based on ipt_limit.c by:
2578