2.6.0-t9-netfilter-20031026.patch

   1 diff -Nur linux-2.6.0-test9.org/include/linux/netfilter.h linux-2.6.0-test9/include/linux/netfilter.h
   2 --- linux-2.6.0-test9.org/include/linux/netfilter.h     2003-10-25 20:43:40.000000000 +0200
   3 +++ linux-2.6.0-test9/include/linux/netfilter.h 2003-10-26 12:44:33.000000000 +0100
   4 @@ -23,6 +23,7 @@
   5     <= 0x2000 is used for protocol-flags. */
   6  #define NFC_UNKNOWN 0x4000
   7  #define NFC_ALTERED 0x8000
   8 +#define NFC_TRACE   0x10000
   9
  10  #ifdef __KERNEL__
  11  #include <linux/config.h>
  12 @@ -99,6 +100,24 @@
  13
  14  extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
  15
  16 +typedef void nf_logfn(unsigned int hooknum,
  17 +                     const struct sk_buff *skb,
  18 +                     const struct net_device *in,
  19 +                     const struct net_device *out,
  20 +                     const char *prefix);
  21 +
  22 +/* Function to register/unregister log function. */
  23 +int nf_log_register(int pf, nf_logfn *logfn);
  24 +void nf_log_unregister(int pf, nf_logfn *logfn);
  25 +
  26 +/* Calls the registered backend logging function */
  27 +void nf_log_packet(int pf,
  28 +                  unsigned int hooknum,
  29 +                  const struct sk_buff *skb,
  30 +                  const struct net_device *in,
  31 +                  const struct net_device *out,
  32 +                  const char *fmt, ...);
  33 +
  34  /* Activate hook; either okfn or kfree_skb called, unless a hook
  35     returns NF_STOLEN (in which case, it's up to the hook to deal with
  36     the consequences).
  37 diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.6.0-test9/include/linux/netfilter_ipv4/ip_conntrack.h
  38 --- linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ip_conntrack.h   2003-10-25 20:44:44.000000000 +0200
  39 +++ linux-2.6.0-test9/include/linux/netfilter_ipv4/ip_conntrack.h       2003-10-26 12:44:33.000000000 +0100
  40 @@ -268,6 +268,9 @@
  41
  42  extern unsigned int ip_conntrack_htable_size;
  43
  44 +/* A fake conntrack entry which never vanishes. */
  45 +extern struct ip_conntrack ip_conntrack_untracked;
  46 +
  47  /* eg. PROVIDES_CONNTRACK(ftp); */
  48  #define PROVIDES_CONNTRACK(name)                        \
  49          int needs_ip_conntrack_##name;                  \
  50 diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ip_tables.h linux-2.6.0-test9/include/linux/netfilter_ipv4/ip_tables.h
  51 --- linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ip_tables.h      2003-10-25 20:43:46.000000000 +0200
  52 +++ linux-2.6.0-test9/include/linux/netfilter_ipv4/ip_tables.h  2003-10-26 12:44:33.000000000 +0100
  53 @@ -134,6 +134,12 @@
  54         /* Back pointer */
  55         unsigned int comefrom;
  56
  57 +       /* Name of the chain */
  58 +       char *chainname;
  59 +
  60 +       /* Rule number in the chain. */
  61 +       u_int32_t rulenum;
  62 +
  63         /* Packet and byte counters. */
  64         struct ipt_counters counters;
  65
  66 diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_ULOG.h linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_ULOG.h
  67 --- linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_ULOG.h       2003-10-25 20:43:28.000000000 +0200
  68 +++ linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_ULOG.h   2003-10-26 12:44:13.000000000 +0100
  69 @@ -11,6 +11,9 @@
  70  #define NETLINK_NFLOG  5
  71  #endif
  72
  73 +#define NFLOG_DEFAULT_NLGROUP          1
  74 +#define NFLOG_DEFAULT_QTHRESHOLD       1
  75 +
  76  #define ULOG_MAC_LEN   80
  77  #define ULOG_PREFIX_LEN        32
  78
  79 diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_conntrack.h linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_conntrack.h
  80 --- linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_conntrack.h  2003-10-25 20:44:16.000000000 +0200
  81 +++ linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_conntrack.h      2003-10-26 12:44:33.000000000 +0100
  82 @@ -10,6 +10,7 @@
  83
  84  #define IPT_CONNTRACK_STATE_SNAT (1 << (IP_CT_NUMBER + 1))
  85  #define IPT_CONNTRACK_STATE_DNAT (1 << (IP_CT_NUMBER + 2))
  86 +#define IPT_CONNTRACK_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 3))
  87
  88  /* flags, invflags: */
  89  #define IPT_CONNTRACK_STATE    0x01
  90 diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_sctp.h linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_sctp.h
  91 --- linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_sctp.h       1970-01-01 01:00:00.000000000 +0100
  92 +++ linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_sctp.h   2003-10-26 12:44:43.000000000 +0100
  93 @@ -0,0 +1,25 @@
  94 +/* iptables module for matching the SCTP header
  95 + *
  96 + * (C) 2003 Harald Welte <laforge@gnumonks.org>
  97 + *
  98 + * This software is distributed under GNU GPL v2, 1991
  99 + *
 100 + * $Id$
 101 + */
 102 +#ifndef _IPT_SCTP_H
 103 +#define _IPT_SCTP_H
 104 +
 105 +struct ipt_sctp_info {
 106 +       u_int16_t spts[2];                      /* Souce port range */
 107 +       u_int16_t dpts[2];                      /* Destination port range */
 108 +       u_int32_t chunks;                       /* chunks to be matched */
 109 +       u_int32_t chunk_mask;                   /* chunk mask to be matched */
 110 +       u_int8_t invflags;                      /* Inverse flags */
 111 +};
 112 +
 113 +#define IPT_SCTP_INV_SRCPT     0x01    /* Invert the sense of source ports */
 114 +#define IPT_SCTP_INV_DSTPT     0x02    /* Invert the sense of dest ports */
 115 +#define IPT_SCTP_INV_CHUNKS    0x03    /* Invert the sense of chunks */
 116 +#define IPT_SCTP_INV_MASK      0x03    /* All possible flags */
 117 +
 118 +#endif /* _IPT_SCTP_H */
 119 diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_state.h linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_state.h
 120 --- linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_state.h      2003-10-25 20:44:36.000000000 +0200
 121 +++ linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_state.h  2003-10-26 12:44:33.000000000 +0100
 122 @@ -4,6 +4,8 @@
 123  #define IPT_STATE_BIT(ctinfo) (1 << ((ctinfo)%IP_CT_IS_REPLY+1))
 124  #define IPT_STATE_INVALID (1 << 0)
 125
 126 +#define IPT_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 1))
 127 +
 128  struct ipt_state_info
 129  {
 130         unsigned int statemask;
 131 diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv4.h linux-2.6.0-test9/include/linux/netfilter_ipv4.h
 132 --- linux-2.6.0-test9.org/include/linux/netfilter_ipv4.h        2003-10-25 20:44:34.000000000 +0200
 133 +++ linux-2.6.0-test9/include/linux/netfilter_ipv4.h    2003-10-26 12:44:33.000000000 +0100
 134 @@ -51,6 +51,8 @@
 135
 136  enum nf_ip_hook_priorities {
 137         NF_IP_PRI_FIRST = INT_MIN,
 138 +       NF_IP_PRI_CONNTRACK_DEFRAG = -400,
 139 +       NF_IP_PRI_RAW = -300,
 140         NF_IP_PRI_CONNTRACK = -200,
 141         NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
 142         NF_IP_PRI_MANGLE = -150,
 143 diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv6/ip6_tables.h linux-2.6.0-test9/include/linux/netfilter_ipv6/ip6_tables.h
 144 --- linux-2.6.0-test9.org/include/linux/netfilter_ipv6/ip6_tables.h     2003-10-25 20:44:48.000000000 +0200
 145 +++ linux-2.6.0-test9/include/linux/netfilter_ipv6/ip6_tables.h 2003-10-26 12:44:33.000000000 +0100
 146 @@ -140,6 +140,12 @@
 147         /* Back pointer */
 148         unsigned int comefrom;
 149
 150 +       /* Name of the chain */
 151 +       char *chainname;
 152 +
 153 +       /* Rule number in the chain. */
 154 +       u_int32_t rulenum;
 155 +
 156         /* Packet and byte counters. */
 157         struct ip6t_counters counters;
 158
 159 diff -Nur linux-2.6.0-test9.org/net/bridge/br_netfilter.c linux-2.6.0-test9/net/bridge/br_netfilter.c
 160 --- linux-2.6.0-test9.org/net/bridge/br_netfilter.c     2003-10-25 20:44:49.000000000 +0200
 161 +++ linux-2.6.0-test9/net/bridge/br_netfilter.c 2003-10-26 12:43:43.000000000 +0100
 162 @@ -297,6 +297,8 @@
 163         if (skb->pkt_type == PACKET_OTHERHOST) {
 164                 skb->pkt_type = PACKET_HOST;
 165                 nf_bridge->mask |= BRNF_PKT_TYPE;
 166 +               /* The physdev module checks on this */
 167 +               nf_bridge->mask |= BRNF_BRIDGED;
 168         }
 169
 170         nf_bridge->mask |= BRNF_NF_BRIDGE_PREROUTING;
 171 diff -Nur linux-2.6.0-test9.org/net/core/netfilter.c linux-2.6.0-test9/net/core/netfilter.c
 172 --- linux-2.6.0-test9.org/net/core/netfilter.c  2003-10-25 20:43:34.000000000 +0200
 173 +++ linux-2.6.0-test9/net/core/netfilter.c      2003-10-26 12:44:13.000000000 +0100
 174 @@ -8,8 +8,10 @@
 175   *
 176   * February 2000: Modified by James Morris to have 1 queue per protocol.
 177   * 15-Mar-2000:   Added NF_REPEAT --RR.
 178 + * 08-May-2003:          Internal logging interface added by Jozsef Kadlecsik.
 179   */
 180  #include <linux/config.h>
 181 +#include <linux/kernel.h>
 182  #include <linux/netfilter.h>
 183  #include <net/protocol.h>
 184  #include <linux/init.h>
 185 @@ -743,7 +745,70 @@
 186  EXPORT_SYMBOL(skb_ip_make_writable);
 187  #endif /*CONFIG_INET*/
 188
 189 +/* Internal logging interface, which relies on the real
 190 +   LOG target modules */
 191
 192 +#define NF_LOG_PREFIXLEN               128
 193 +
 194 +static nf_logfn *nf_logging[NPROTO]; /* = NULL */
 195 +static int reported = 0;
 196 +static spinlock_t nf_log_lock = SPIN_LOCK_UNLOCKED;
 197 +
 198 +int nf_log_register(int pf, nf_logfn *logfn)
 199 +{
 200 +       int ret = -EBUSY;
 201 +
 202 +       /* Any setup of logging members must be done before
 203 +        * substituting pointer. */
 204 +       smp_wmb();
 205 +       spin_lock(&nf_log_lock);
 206 +       if (!nf_logging[pf]) {
 207 +               nf_logging[pf] = logfn;
 208 +               ret = 0;
 209 +       }
 210 +       spin_unlock(&nf_log_lock);
 211 +       return ret;
 212 +}
 213 +
 214 +void nf_log_unregister(int pf, nf_logfn *logfn)
 215 +{
 216 +       spin_lock(&nf_log_lock);
 217 +       if (nf_logging[pf] == logfn)
 218 +               nf_logging[pf] = NULL;
 219 +       spin_unlock(&nf_log_lock);
 220 +
 221 +       /* Give time to concurrent readers. */
 222 +       synchronize_net();
 223 +}
 224 +
 225 +void nf_log_packet(int pf,
 226 +                  unsigned int hooknum,
 227 +                  const struct sk_buff *skb,
 228 +                  const struct net_device *in,
 229 +                  const struct net_device *out,
 230 +                  const char *fmt, ...)
 231 +{
 232 +       va_list args;
 233 +       char prefix[NF_LOG_PREFIXLEN];
 234 +       nf_logfn *logfn;
 235 +
 236 +       rcu_read_lock();
 237 +       logfn = nf_logging[pf];
 238 +       if (logfn) {
 239 +               va_start(args, fmt);
 240 +               vsnprintf(prefix, sizeof(prefix), fmt, args);
 241 +               va_end(args);
 242 +               /* We must read logging before nf_logfn[pf] */
 243 +               smp_read_barrier_depends();
 244 +               logfn(hooknum, skb, in, out, prefix);
 245 +       } else if (!reported) {
 246 +               printk(KERN_WARNING "nf_log_packet: can\'t log yet, "
 247 +                      "no backend logging module loaded in!\n");
 248 +               reported++;
 249 +       }
 250 +       rcu_read_unlock();
 251 +}
 252 +
 253  /* This does not belong here, but ipt_REJECT needs it if connection
 254     tracking in use: without this, connection may not be in hash table,
 255     and hence manufactured ICMP or RST packets will not be associated
 256 @@ -773,3 +838,6 @@
 257  EXPORT_SYMBOL(nf_unregister_hook);
 258  EXPORT_SYMBOL(nf_unregister_queue_handler);
 259  EXPORT_SYMBOL(nf_unregister_sockopt);
 260 +EXPORT_SYMBOL(nf_log_register);
 261 +EXPORT_SYMBOL(nf_log_unregister);
 262 +EXPORT_SYMBOL(nf_log_packet);
 263 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/Kconfig linux-2.6.0-test9/net/ipv4/netfilter/Kconfig
 264 --- linux-2.6.0-test9.org/net/ipv4/netfilter/Kconfig    2003-10-25 20:44:33.000000000 +0200
 265 +++ linux-2.6.0-test9/net/ipv4/netfilter/Kconfig        2003-10-26 12:44:43.000000000 +0100
 266 @@ -197,6 +197,15 @@
 267
 268           To compile it as a module, choose M here.  If unsure, say N.
 269
 270 +config IP_NF_MATCH_SCTP
 271 +       tristate "SCTP match support"
 272 +       depends on IP_NF_IPTABLES
 273 +       help
 274 +         This match allows iptables to match on the SCTP header.
 275 +
 276 +         If you want to compile it as a module, say M here and read
 277 +         <file:Documentation/modules.txt>. If unsure, say `N'.
 278 +
 279  config IP_NF_MATCH_LENGTH
 280         tristate "LENGTH match support"
 281         depends on IP_NF_IPTABLES
 282 @@ -527,6 +536,42 @@
 283
 284           To compile it as a module, choose M here.  If unsure, say N.
 285
 286 +config IP_NF_RAW
 287 +       tristate "Raw table"
 288 +       depends on IP_NF_IPTABLES
 289 +       help
 290 +         This option adds a `raw' table to iptables: see the man page for
 291 +         iptables(8).  This table is the very first in the netfilter
 292 +         framework and hooks in at the PREROUTING and OUTPUT chains.
 293 +         The TRACE and NOTRACK targets can be used in this table only.
 294 +
 295 +         To compile it as a module, choose M here.  If unsure, say N.
 296 +
 297 +config IP_NF_TARGET_TRACE
 298 +       tristate "TRACE target support"
 299 +       depends on IP_NF_RAW
 300 +       help
 301 +         The TRACE target allows packets to be traced as those matches
 302 +         any subsequent rule in any table/rule. The matched rule and
 303 +         the packet is logged with the prefix
 304 +
 305 +         TRACE: tablename/chainname/rulenum
 306 +
 307 +         if the ipt_LOG or ipt_ULOG targets are loaded in.
 308 +
 309 +         To compile it as a module, choose M here.  If unsure, say N.
 310 +
 311 +config IP_NF_TARGET_NOTRACK
 312 +       tristate "NOTRACK target support"
 313 +       depends on IP_NF_RAW
 314 +       help
 315 +         The NOTRACK target allows a select rule to specify which
 316 +         packets *not* to enter the conntrack/NAT subsystems
 317 +         with all the consequences (no ICMP error tracking,
 318 +         no protocol helpers for the selected packets).
 319 +
 320 +         To compile it as a module, choose M here.  If unsure, say N.
 321 +
 322  config IP_NF_ARPTABLES
 323         tristate "ARP tables support"
 324
 325 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/Makefile linux-2.6.0-test9/net/ipv4/netfilter/Makefile
 326 --- linux-2.6.0-test9.org/net/ipv4/netfilter/Makefile   2003-10-25 20:43:07.000000000 +0200
 327 +++ linux-2.6.0-test9/net/ipv4/netfilter/Makefile       2003-10-26 12:44:44.000000000 +0100
 328 @@ -34,12 +34,14 @@
 329  # generic IP tables
 330  obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
 331
 332 -# the three instances of ip_tables
 333 +# the four instances of ip_tables
 334  obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
 335  obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
 336  obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
 337 +obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
 338
 339  # matches
 340 +obj-$(CONFIG_IP_NF_MATCH_SCTP) += ipt_sctp.o
 341  obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
 342  obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
 343  obj-$(CONFIG_IP_NF_MATCH_MARK) += ipt_mark.o
 344 @@ -81,6 +83,8 @@
 345  obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
 346  obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
 347  obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
 348 +obj-$(CONFIG_IP_NF_TARGET_NOTRACK) += ipt_NOTRACK.o
 349 +obj-$(CONFIG_IP_NF_TARGET_TRACE) += ipt_TRACE.o
 350
 351  # generic ARP tables
 352  obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
 353 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_conntrack_core.c linux-2.6.0-test9/net/ipv4/netfilter/ip_conntrack_core.c
 354 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_conntrack_core.c        2003-10-25 20:42:41.000000000 +0200
 355 +++ linux-2.6.0-test9/net/ipv4/netfilter/ip_conntrack_core.c    2003-10-26 12:44:33.000000000 +0100
 356 @@ -29,8 +29,7 @@
 357  #include <linux/slab.h>
 358  #include <linux/random.h>
 359  #include <linux/jhash.h>
 360 -/* For ERR_PTR().  Yeah, I know... --RR */
 361 -#include <linux/fs.h>
 362 +#include <linux/err.h>
 363
 364  /* This rwlock protects the main hash table, protocol/helper/expected
 365     registrations, conntrack timers*/
 366 @@ -63,6 +62,7 @@
 367  static atomic_t ip_conntrack_count = ATOMIC_INIT(0);
 368  struct list_head *ip_conntrack_hash;
 369  static kmem_cache_t *ip_conntrack_cachep;
 370 +struct ip_conntrack ip_conntrack_untracked;
 371
 372  extern struct ip_conntrack_protocol ip_conntrack_generic_protocol;
 373
 374 @@ -808,18 +808,10 @@
 375         }
 376  #endif
 377
 378 -       /* Previously seen (loopback)?  Ignore.  Do this before
 379 -           fragment check. */
 380 +       /* Previously seen (loopback or untracked)?  Ignore. */
 381         if ((*pskb)->nfct)
 382                 return NF_ACCEPT;
 383
 384 -       /* Gather fragments. */
 385 -       if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
 386 -               *pskb = ip_ct_gather_frags(*pskb);
 387 -               if (!*pskb)
 388 -                       return NF_STOLEN;
 389 -       }
 390 -
 391         proto = ip_ct_find_proto((*pskb)->nh.iph->protocol);
 392
 393         /* It may be an icmp error... */
 394 @@ -953,7 +945,6 @@
 395                 }
 396         } else if (related_to->helper->max_expected &&
 397                    related_to->expecting >= related_to->helper->max_expected) {
 398 -               struct list_head *cur_item;
 399                 /* old == NULL */
 400                 if (!(related_to->helper->flags &
 401                       IP_CT_HELPER_F_REUSE_EXPECT)) {
 402 @@ -978,21 +969,14 @@
 403                        NIPQUAD(related_to->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip));
 404
 405                 /* choose the the oldest expectation to evict */
 406 -               list_for_each(cur_item, &related_to->sibling_list) {
 407 -                       struct ip_conntrack_expect *cur;
 408 -
 409 -                       cur = list_entry(cur_item,
 410 -                                        struct ip_conntrack_expect,
 411 -                                        expected_list);
 412 -                       if (cur->sibling == NULL) {
 413 -                               old = cur;
 414 +               list_for_each_entry(old, &related_to->sibling_list,
 415 +                                                     expected_list)
 416 +                       if (old->sibling == NULL)
 417                                 break;
 418 -                       }
 419 -               }
 420
 421 -               /* (!old) cannot happen, since related_to->expecting is the
 422 -                * number of unconfirmed expects */
 423 -               IP_NF_ASSERT(old);
 424 +               /* We cannot fail since related_to->expecting is the number
 425 +                * of unconfirmed expectations */
 426 +               IP_NF_ASSERT(old && old->sibling == NULL);
 427
 428                 /* newnat14 does not reuse the real allocated memory
 429                  * structures but rather unexpects the old and
 430 @@ -1024,7 +1008,7 @@
 431         atomic_set(&new->use, 1);
 432
 433         /* add to expected list for this connection */
 434 -       list_add(&new->expected_list, &related_to->sibling_list);
 435 +       list_add_tail(&new->expected_list, &related_to->sibling_list);
 436         /* add to global list of expectations */
 437         list_prepend(&ip_conntrack_expect_list, &new->list);
 438         /* add and start timer if required */
 439 @@ -1419,6 +1403,15 @@
 440
 441         /* For use by ipt_REJECT */
 442         ip_ct_attach = ip_conntrack_attach;
 443 +
 444 +       /* Set up fake conntrack:
 445 +           - to never be deleted, not in any hashes */
 446 +       atomic_set(&ip_conntrack_untracked.ct_general.use, 1);
 447 +       /*  - and look it like as a confirmed connection */
 448 +       set_bit(IPS_CONFIRMED_BIT, &ip_conntrack_untracked.status);
 449 +       /*  - and prepare the ctinfo field for NAT. */
 450 +       ip_conntrack_untracked.infos[IP_CT_NEW].master = &ip_conntrack_untracked.ct_general;
 451 +
 452         return ret;
 453
 454  err_free_hash:
 455 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.6.0-test9/net/ipv4/netfilter/ip_conntrack_standalone.c
 456 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_conntrack_standalone.c  2003-10-25 20:43:32.000000000 +0200
 457 +++ linux-2.6.0-test9/net/ipv4/netfilter/ip_conntrack_standalone.c      2003-10-26 12:44:33.000000000 +0100
 458 @@ -186,6 +186,26 @@
 459         return ip_conntrack_confirm(*pskb);
 460  }
 461
 462 +static unsigned int ip_conntrack_defrag(unsigned int hooknum,
 463 +                                       struct sk_buff **pskb,
 464 +                                       const struct net_device *in,
 465 +                                       const struct net_device *out,
 466 +                                       int (*okfn)(struct sk_buff *))
 467 +{
 468 +       /* Previously seen (loopback)?  Ignore.  Do this before
 469 +           fragment check. */
 470 +       if ((*pskb)->nfct)
 471 +               return NF_ACCEPT;
 472 +
 473 +       /* Gather fragments. */
 474 +       if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
 475 +               *pskb = ip_ct_gather_frags(*pskb);
 476 +               if (!*pskb)
 477 +                       return NF_STOLEN;
 478 +       }
 479 +       return NF_ACCEPT;
 480 +}
 481 +
 482  static unsigned int ip_refrag(unsigned int hooknum,
 483                               struct sk_buff **pskb,
 484                               const struct net_device *in,
 485 @@ -225,6 +245,15 @@
 486         return ip_conntrack_in(hooknum, pskb, in, out, okfn);
 487  }
 488
 489 +/* At the very first: defragment */
 490 +static struct nf_hook_ops ip_conntrack_defrag_ops = {
 491 +       .hook           = ip_conntrack_defrag,
 492 +       .owner          = THIS_MODULE,
 493 +       .pf             = PF_INET,
 494 +       .hooknum        = NF_IP_PRE_ROUTING,
 495 +       .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
 496 +};
 497 +
 498  /* Connection tracking may drop packets, but never alters them, so
 499     make it the first hook. */
 500  static struct nf_hook_ops ip_conntrack_in_ops = {
 501 @@ -367,10 +396,15 @@
 502         if (!proc) goto cleanup_init;
 503         proc->owner = THIS_MODULE;
 504
 505 +       ret = nf_register_hook(&ip_conntrack_defrag_ops);
 506 +       if (ret < 0) {
 507 +               printk("ip_conntrack: can't register pre-routing hook to defrag.\n");
 508 +               goto cleanup_proc;
 509 +       }
 510         ret = nf_register_hook(&ip_conntrack_in_ops);
 511         if (ret < 0) {
 512                 printk("ip_conntrack: can't register pre-routing hook.\n");
 513 -               goto cleanup_proc;
 514 +               goto cleanup_defragops;
 515         }
 516         ret = nf_register_hook(&ip_conntrack_local_out_ops);
 517         if (ret < 0) {
 518 @@ -408,6 +442,8 @@
 519         nf_unregister_hook(&ip_conntrack_local_out_ops);
 520   cleanup_inops:
 521         nf_unregister_hook(&ip_conntrack_in_ops);
 522 + cleanup_defragops:
 523 +       nf_unregister_hook(&ip_conntrack_defrag_ops);
 524   cleanup_proc:
 525         proc_net_remove("ip_conntrack");
 526   cleanup_init:
 527 @@ -499,5 +535,6 @@
 528  EXPORT_SYMBOL(ip_conntrack_expect_list);
 529  EXPORT_SYMBOL(ip_conntrack_lock);
 530  EXPORT_SYMBOL(ip_conntrack_hash);
 531 +EXPORT_SYMBOL(ip_conntrack_untracked);
 532  EXPORT_SYMBOL_GPL(ip_conntrack_find_get);
 533  EXPORT_SYMBOL_GPL(ip_conntrack_put);
 534 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_conntrack_tftp.c linux-2.6.0-test9/net/ipv4/netfilter/ip_conntrack_tftp.c
 535 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_conntrack_tftp.c        2003-10-25 20:43:19.000000000 +0200
 536 +++ linux-2.6.0-test9/net/ipv4/netfilter/ip_conntrack_tftp.c    2003-10-26 12:44:03.000000000 +0100
 537 @@ -97,8 +97,6 @@
 538
 539         for (i = 0 ; (i < MAX_PORTS) && ports[i] ; i++) {
 540                 /* Create helper structure */
 541 -               memset(&tftp[i], 0, sizeof(struct ip_conntrack_helper));
 542 -
 543                 tftp[i].tuple.dst.protonum = IPPROTO_UDP;
 544                 tftp[i].tuple.src.u.udp.port = htons(ports[i]);
 545                 tftp[i].mask.dst.protonum = 0xFFFF;
 546 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_amanda.c linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_amanda.c
 547 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_amanda.c    2003-10-25 20:43:06.000000000 +0200
 548 +++ linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_amanda.c        2003-10-26 12:44:03.000000000 +0100
 549 @@ -195,8 +195,6 @@
 550         struct ip_nat_helper *hlpr;
 551
 552         hlpr = &ip_nat_amanda_helper;
 553 -       memset(hlpr, 0, sizeof(struct ip_nat_helper));
 554 -
 555         hlpr->tuple.dst.protonum = IPPROTO_UDP;
 556         hlpr->tuple.src.u.udp.port = htons(10080);
 557         hlpr->mask.src.u.udp.port = 0xFFFF;
 558 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_core.c linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_core.c
 559 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_core.c      2003-10-25 20:43:01.000000000 +0200
 560 +++ linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_core.c  2003-10-26 12:44:33.000000000 +0100
 561 @@ -809,7 +809,7 @@
 562
 563                 /* Have to grab read lock before sibling_list traversal */
 564                 READ_LOCK(&ip_conntrack_lock);
 565 -               list_for_each(cur_item, &ct->sibling_list) {
 566 +               list_for_each_prev(cur_item, &ct->sibling_list) {
 567                         exp = list_entry(cur_item, struct ip_conntrack_expect,
 568                                          expected_list);
 569
 570 @@ -1009,7 +1009,11 @@
 571         /* FIXME: Man, this is a hack.  <SIGH> */
 572         IP_NF_ASSERT(ip_conntrack_destroyed == NULL);
 573         ip_conntrack_destroyed = &ip_nat_cleanup_conntrack;
 574 -
 575 +
 576 +       /* Initialize fake conntrack so that NAT will skip it */
 577 +       ip_conntrack_untracked.nat.info.initialized |=
 578 +               (1 << IP_NAT_MANIP_SRC) | (1 << IP_NAT_MANIP_DST);
 579 +
 580         return 0;
 581  }
 582
 583 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_rule.c linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_rule.c
 584 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_rule.c      2003-10-25 20:43:27.000000000 +0200
 585 +++ linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_rule.c  2003-10-26 12:44:33.000000000 +0100
 586 @@ -67,7 +67,7 @@
 587                 0,
 588                 sizeof(struct ipt_entry),
 589                 sizeof(struct ipt_standard),
 590 -               0, { 0, 0 }, { } },
 591 +               0, NULL, 0, { 0, 0 }, { } },
 592               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
 593                 -NF_ACCEPT - 1 } },
 594             /* POST_ROUTING */
 595 @@ -75,7 +75,7 @@
 596                 0,
 597                 sizeof(struct ipt_entry),
 598                 sizeof(struct ipt_standard),
 599 -               0, { 0, 0 }, { } },
 600 +               0, NULL, 0, { 0, 0 }, { } },
 601               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
 602                 -NF_ACCEPT - 1 } },
 603             /* LOCAL_OUT */
 604 @@ -83,7 +83,7 @@
 605                 0,
 606                 sizeof(struct ipt_entry),
 607                 sizeof(struct ipt_standard),
 608 -               0, { 0, 0 }, { } },
 609 +               0, NULL, 0, { 0, 0 }, { } },
 610               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
 611                 -NF_ACCEPT - 1 } }
 612      },
 613 @@ -92,7 +92,7 @@
 614         0,
 615         sizeof(struct ipt_entry),
 616         sizeof(struct ipt_error),
 617 -       0, { 0, 0 }, { } },
 618 +       0, NULL, 0, { 0, 0 }, { } },
 619        { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
 620           { } },
 621         "ERROR"
 622 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_tftp.c linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_tftp.c
 623 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_tftp.c      2003-10-25 20:43:18.000000000 +0200
 624 +++ linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_tftp.c  2003-10-26 12:44:03.000000000 +0100
 625 @@ -164,8 +164,6 @@
 626                 ports[0] = TFTP_PORT;
 627
 628         for (i = 0 ; (i < MAX_PORTS) && ports[i] ; i++) {
 629 -               memset(&tftp[i], 0, sizeof(struct ip_nat_helper));
 630 -
 631                 tftp[i].tuple.dst.protonum = IPPROTO_UDP;
 632                 tftp[i].tuple.src.u.udp.port = htons(ports[i]);
 633                 tftp[i].mask.dst.protonum = 0xFFFF;
 634 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_tables.c linux-2.6.0-test9/net/ipv4/netfilter/ip_tables.c
 635 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_tables.c        2003-10-25 20:43:11.000000000 +0200
 636 +++ linux-2.6.0-test9/net/ipv4/netfilter/ip_tables.c    2003-10-26 12:44:33.000000000 +0100
 637 @@ -11,6 +11,7 @@
 638  #include <linux/config.h>
 639  #include <linux/cache.h>
 640  #include <linux/skbuff.h>
 641 +#include <linux/socket.h>
 642  #include <linux/kmod.h>
 643  #include <linux/vmalloc.h>
 644  #include <linux/netdevice.h>
 645 @@ -23,8 +24,17 @@
 646  #include <asm/semaphore.h>
 647  #include <linux/proc_fs.h>
 648
 649 +#include <linux/netfilter.h>
 650  #include <linux/netfilter_ipv4/ip_tables.h>
 651
 652 +static const char *hooknames[] = {
 653 +       [NF_IP_PRE_ROUTING] "PREROUTING",
 654 +       [NF_IP_LOCAL_IN] "INPUT",
 655 +       [NF_IP_FORWARD] "FORWARD",
 656 +       [NF_IP_LOCAL_OUT] "OUTPUT",
 657 +       [NF_IP_POST_ROUTING] "POSTROUTING",
 658 +};
 659 +
 660  MODULE_LICENSE("GPL");
 661  MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 662  MODULE_DESCRIPTION("IPv4 packet filter");
 663 @@ -322,6 +332,12 @@
 664
 665                         t = ipt_get_target(e);
 666                         IP_NF_ASSERT(t->u.kernel.target);
 667 +
 668 +                       /* The packet traced and the rule isn't an unconditional return/END. */
 669 +                       if (((*pskb)->nfcache & NFC_TRACE) && e->rulenum) {
 670 +                               nf_log_packet(AF_INET, hook, *pskb, in, out, "TRACE: %s/%s/%u ",
 671 +                                                table->name, e->chainname, e->rulenum);
 672 +                       }
 673                         /* Standard target? */
 674                         if (!t->u.kernel.target->target) {
 675                                 int v;
 676 @@ -474,6 +490,29 @@
 677         return find_inlist_lock(&ipt_target, name, "ipt_", error, mutex);
 678  }
 679
 680 +static inline int
 681 +find_error_target(struct ipt_entry *s,
 682 +                 struct ipt_entry *e,
 683 +                 char **chainname)
 684 +{
 685 +       struct ipt_entry_target *t;
 686 +       static struct ipt_entry *found = NULL;
 687 +
 688 +       if (s == e) {
 689 +               if (!found)
 690 +                       return 0;
 691 +               t = ipt_get_target(found);
 692 +               if (strcmp(t->u.user.name,
 693 +                          IPT_ERROR_TARGET) == 0) {
 694 +                       *chainname = t->data;
 695 +                       return 1;
 696 +               }
 697 +       } else
 698 +               found = s;
 699 +
 700 +       return 0;
 701 +}
 702 +
 703  /* All zeroes == unconditional rule. */
 704  static inline int
 705  unconditional(const struct ipt_ip *ip)
 706 @@ -493,6 +532,8 @@
 707  mark_source_chains(struct ipt_table_info *newinfo, unsigned int valid_hooks)
 708  {
 709         unsigned int hook;
 710 +       char *chainname = NULL;
 711 +       u_int32_t rulenum;
 712
 713         /* No recursion; use packet counter to save back ptrs (reset
 714            to 0 as we leave), and comefrom to save source hook bitmask */
 715 @@ -506,6 +547,8 @@
 716
 717                 /* Set initial back pointer. */
 718                 e->counters.pcnt = pos;
 719 +               rulenum = 1;
 720 +               chainname = (char *) hooknames[hook];
 721
 722                 for (;;) {
 723                         struct ipt_standard_target *t
 724 @@ -518,6 +561,8 @@
 725                         }
 726                         e->comefrom
 727                                 |= ((1 << hook) | (1 << NF_IP_NUMHOOKS));
 728 +                       e->rulenum = rulenum++;
 729 +                       e->chainname = chainname;
 730
 731                         /* Unconditional return/END. */
 732                         if (e->target_offset == sizeof(struct ipt_entry)
 733 @@ -527,6 +572,10 @@
 734                             && unconditional(&e->ip)) {
 735                                 unsigned int oldpos, size;
 736
 737 +                               /* Set unconditional rulenum to zero. */
 738 +                               e->rulenum = 0;
 739 +                               e->counters.bcnt = 0;
 740 +
 741                                 /* Return: backtrack through the last
 742                                    big jump. */
 743                                 do {
 744 @@ -552,6 +601,11 @@
 745                                                 (newinfo->entries + pos);
 746                                 } while (oldpos == pos + e->next_offset);
 747
 748 +                               /* Restore chainname, rulenum. */
 749 +                               chainname = e->chainname;
 750 +                               rulenum = e->counters.bcnt;
 751 +                               e->counters.bcnt = 0;
 752 +
 753                                 /* Move along one */
 754                                 size = e->next_offset;
 755                                 e = (struct ipt_entry *)
 756 @@ -567,6 +621,17 @@
 757                                         /* This a jump; chase it. */
 758                                         duprintf("Jump rule %u -> %u\n",
 759                                                  pos, newpos);
 760 +                                       e->counters.bcnt = rulenum++;
 761 +                                       rulenum = 1;
 762 +                                       e = (struct ipt_entry *)
 763 +                                               (newinfo->entries + newpos);
 764 +                                       if (IPT_ENTRY_ITERATE(newinfo->entries,
 765 +                                                             newinfo->size,
 766 +                                                             find_error_target,
 767 +                                                             e, &chainname) == 0) {
 768 +                                               printk("ip_tables: table screwed up!\n");
 769 +                                               return 0;
 770 +                                       }
 771                                 } else {
 772                                         /* ... this is a fallthru */
 773                                         newpos = pos + e->next_offset;
 774 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_LOG.c linux-2.6.0-test9/net/ipv4/netfilter/ipt_LOG.c
 775 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_LOG.c  2003-10-25 20:44:37.000000000 +0200
 776 +++ linux-2.6.0-test9/net/ipv4/netfilter/ipt_LOG.c      2003-10-26 12:44:13.000000000 +0100
 777 @@ -4,12 +4,14 @@
 778  #include <linux/module.h>
 779  #include <linux/spinlock.h>
 780  #include <linux/skbuff.h>
 781 +#include <linux/socket.h>
 782  #include <linux/ip.h>
 783  #include <net/icmp.h>
 784  #include <net/udp.h>
 785  #include <net/tcp.h>
 786  #include <net/route.h>
 787
 788 +#include <linux/netfilter.h>
 789  #include <linux/netfilter_ipv4/ip_tables.h>
 790  #include <linux/netfilter_ipv4/ipt_LOG.h>
 791
 792 @@ -17,6 +19,10 @@
 793  MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 794  MODULE_DESCRIPTION("iptables syslog logging module");
 795
 796 +static unsigned int nflog = 1;
 797 +MODULE_PARM(nflog, "i");
 798 +MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
 799 +
 800  #if 0
 801  #define DEBUGP printk
 802  #else
 803 @@ -315,28 +321,25 @@
 804         /* maxlen = 230+   91  + 230 + 252 = 803 */
 805  }
 806
 807 -static unsigned int
 808 -ipt_log_target(struct sk_buff **pskb,
 809 +static void
 810 +ipt_log_packet(unsigned int hooknum,
 811 +              const struct sk_buff *skb,
 812                const struct net_device *in,
 813                const struct net_device *out,
 814 -              unsigned int hooknum,
 815 -              const void *targinfo,
 816 -              void *userinfo)
 817 +              const struct ipt_log_info *loginfo,
 818 +              const char *level_string,
 819 +              const char *prefix)
 820  {
 821 -       const struct ipt_log_info *loginfo = targinfo;
 822 -       char level_string[4] = "< >";
 823 -
 824 -       level_string[1] = '0' + (loginfo->level % 8);
 825         spin_lock_bh(&log_lock);
 826         printk(level_string);
 827         printk("%sIN=%s OUT=%s ",
 828 -              loginfo->prefix,
 829 +              prefix == NULL ? loginfo->prefix : prefix,
 830                in ? in->name : "",
 831                out ? out->name : "");
 832  #ifdef CONFIG_BRIDGE_NETFILTER
 833 -       if ((*pskb)->nf_bridge) {
 834 -               struct net_device *physindev = (*pskb)->nf_bridge->physindev;
 835 -               struct net_device *physoutdev = (*pskb)->nf_bridge->physoutdev;
 836 +       if (skb->nf_bridge) {
 837 +               struct net_device *physindev = skb->nf_bridge->physindev;
 838 +               struct net_device *physoutdev = skb->nf_bridge->physoutdev;
 839
 840                 if (physindev && in != physindev)
 841                         printk("PHYSIN=%s ", physindev->name);
 842 @@ -348,25 +351,56 @@
 843         if (in && !out) {
 844                 /* MAC logging for input chain only. */
 845                 printk("MAC=");
 846 -               if ((*pskb)->dev && (*pskb)->dev->hard_header_len
 847 -                   && (*pskb)->mac.raw != (void*)(*pskb)->nh.iph) {
 848 +               if (skb->dev && skb->dev->hard_header_len
 849 +                   && skb->mac.raw != (void*)skb->nh.iph) {
 850                         int i;
 851 -                       unsigned char *p = (*pskb)->mac.raw;
 852 -                       for (i = 0; i < (*pskb)->dev->hard_header_len; i++,p++)
 853 +                       unsigned char *p = skb->mac.raw;
 854 +                       for (i = 0; i < skb->dev->hard_header_len; i++,p++)
 855                                 printk("%02x%c", *p,
 856 -                                      i==(*pskb)->dev->hard_header_len - 1
 857 +                                      i==skb->dev->hard_header_len - 1
 858                                        ? ' ':':');
 859                 } else
 860                         printk(" ");
 861         }
 862
 863 -       dump_packet(loginfo, *pskb, 0);
 864 +       dump_packet(loginfo, skb, 0);
 865         printk("\n");
 866         spin_unlock_bh(&log_lock);
 867 +}
 868 +
 869 +static unsigned int
 870 +ipt_log_target(struct sk_buff **pskb,
 871 +              const struct net_device *in,
 872 +              const struct net_device *out,
 873 +              unsigned int hooknum,
 874 +              const void *targinfo,
 875 +              void *userinfo)
 876 +{
 877 +       const struct ipt_log_info *loginfo = targinfo;
 878 +       char level_string[4] = "< >";
 879 +
 880 +       level_string[1] = '0' + (loginfo->level % 8);
 881 +       ipt_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
 882
 883         return IPT_CONTINUE;
 884  }
 885
 886 +static void
 887 +ipt_logfn(unsigned int hooknum,
 888 +         const struct sk_buff *skb,
 889 +         const struct net_device *in,
 890 +         const struct net_device *out,
 891 +         const char *prefix)
 892 +{
 893 +       struct ipt_log_info loginfo = {
 894 +               .level = 0,
 895 +               .logflags = IPT_LOG_MASK,
 896 +               .prefix = ""
 897 +       };
 898 +
 899 +       ipt_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
 900 +}
 901 +
 902  static int ipt_log_checkentry(const char *tablename,
 903                               const struct ipt_entry *e,
 904                               void *targinfo,
 905 @@ -406,12 +440,17 @@
 906  {
 907         if (ipt_register_target(&ipt_log_reg))
 908                 return -EINVAL;
 909 +       if (nflog)
 910 +               nf_log_register(PF_INET, &ipt_logfn);
 911
 912         return 0;
 913  }
 914
 915  static void __exit fini(void)
 916  {
 917 +       if (nflog)
 918 +               nf_log_unregister(PF_INET, &ipt_logfn);
 919 +
 920         ipt_unregister_target(&ipt_log_reg);
 921  }
 922
 923 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_NOTRACK.c linux-2.6.0-test9/net/ipv4/netfilter/ipt_NOTRACK.c
 924 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_NOTRACK.c      1970-01-01 01:00:00.000000000 +0100
 925 +++ linux-2.6.0-test9/net/ipv4/netfilter/ipt_NOTRACK.c  2003-10-26 12:44:33.000000000 +0100
 926 @@ -0,0 +1,79 @@
 927 +/* This is a module which is used for setting up fake conntracks
 928 + * on packets so that they are not seen by the conntrack/NAT code.
 929 + */
 930 +#include <linux/module.h>
 931 +#include <linux/skbuff.h>
 932 +
 933 +#include <linux/netfilter_ipv4/ip_tables.h>
 934 +#include <linux/netfilter_ipv4/ip_conntrack.h>
 935 +
 936 +static unsigned int
 937 +target(struct sk_buff **pskb,
 938 +       const struct net_device *in,
 939 +       const struct net_device *out,
 940 +       unsigned int hooknum,
 941 +       const void *targinfo,
 942 +       void *userinfo)
 943 +{
 944 +       /* Previously seen (loopback)? Ignore. */
 945 +       if ((*pskb)->nfct != NULL)
 946 +               return IPT_CONTINUE;
 947 +
 948 +       /* Attach fake conntrack entry.
 949 +          If there is a real ct entry correspondig to this packet,
 950 +          it'll hang aroun till timing out. We don't deal with it
 951 +          for performance reasons. JK */
 952 +       (*pskb)->nfct = &ip_conntrack_untracked.infos[IP_CT_NEW];
 953 +       nf_conntrack_get((*pskb)->nfct);
 954 +
 955 +       return IPT_CONTINUE;
 956 +}
 957 +
 958 +static int
 959 +checkentry(const char *tablename,
 960 +          const struct ipt_entry *e,
 961 +           void *targinfo,
 962 +           unsigned int targinfosize,
 963 +           unsigned int hook_mask)
 964 +{
 965 +       if (targinfosize != 0) {
 966 +               printk(KERN_WARNING "NOTRACK: targinfosize %u != 0\n",
 967 +                      targinfosize);
 968 +               return 0;
 969 +       }
 970 +
 971 +       if (strcmp(tablename, "raw") != 0) {
 972 +               printk(KERN_WARNING "NOTRACK: can only be called from \"raw\" table, not \"%s\"\n", tablename);
 973 +               return 0;
 974 +       }
 975 +
 976 +       return 1;
 977 +}
 978 +
 979 +static struct ipt_target ipt_notrack_reg = {
 980 +       .name           = "NOTRACK",
 981 +       .target         = target,
 982 +       .checkentry     = checkentry,
 983 +       .destroy        = NULL,
 984 +       .me             = THIS_MODULE,
 985 +};
 986 +
 987 +static int __init init(void)
 988 +{
 989 +       if (ipt_register_target(&ipt_notrack_reg))
 990 +               return -EINVAL;
 991 +
 992 +       return 0;
 993 +}
 994 +
 995 +static void __exit fini(void)
 996 +{
 997 +       ipt_unregister_target(&ipt_notrack_reg);
 998 +}
 999 +
1000 +module_init(init);
1001 +module_exit(fini);
1002 +
1003 +MODULE_LICENSE("GPL");
1004 +MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1005 +MODULE_DESCRIPTION("IPv4 NOTRACK target");
1006 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_TRACE.c linux-2.6.0-test9/net/ipv4/netfilter/ipt_TRACE.c
1007 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_TRACE.c        1970-01-01 01:00:00.000000000 +0100
1008 +++ linux-2.6.0-test9/net/ipv4/netfilter/ipt_TRACE.c    2003-10-26 12:44:33.000000000 +0100
1009 @@ -0,0 +1,67 @@
1010 +/* This is a module which is used for setting
1011 + * the NFC_TRACE flag in the nfcache field of an skb.
1012 + */
1013 +#include <linux/module.h>
1014 +#include <linux/skbuff.h>
1015 +
1016 +#include <linux/netfilter_ipv4/ip_tables.h>
1017 +
1018 +static unsigned int
1019 +target(struct sk_buff **pskb,
1020 +       const struct net_device *in,
1021 +       const struct net_device *out,
1022 +       unsigned int hooknum,
1023 +       const void *targinfo,
1024 +       void *userinfo)
1025 +{
1026 +       (*pskb)->nfcache |= NFC_TRACE;
1027 +       return IPT_CONTINUE;
1028 +}
1029 +
1030 +static int
1031 +checkentry(const char *tablename,
1032 +          const struct ipt_entry *e,
1033 +           void *targinfo,
1034 +           unsigned int targinfosize,
1035 +           unsigned int hook_mask)
1036 +{
1037 +       if (targinfosize != 0) {
1038 +               printk(KERN_WARNING "TRACE: targinfosize %u != 0\n",
1039 +                      targinfosize);
1040 +               return 0;
1041 +       }
1042 +
1043 +       if (strcmp(tablename, "raw") != 0) {
1044 +               printk(KERN_WARNING "TRACE: can only be called from \"raw\" table, not \"%s\"\n", tablename);
1045 +               return 0;
1046 +       }
1047 +
1048 +       return 1;
1049 +}
1050 +
1051 +static struct ipt_target ipt_trace_reg = {
1052 +       .name           = "TRACE",
1053 +       .target         = target,
1054 +       .checkentry     = checkentry,
1055 +       .destroy        = NULL,
1056 +       .me             = THIS_MODULE,
1057 +};
1058 +
1059 +static int __init init(void)
1060 +{
1061 +       if (ipt_register_target(&ipt_trace_reg))
1062 +               return -EINVAL;
1063 +
1064 +       return 0;
1065 +}
1066 +
1067 +static void __exit fini(void)
1068 +{
1069 +       ipt_unregister_target(&ipt_trace_reg);
1070 +}
1071 +
1072 +module_init(init);
1073 +module_exit(fini);
1074 +MODULE_LICENSE("GPL");
1075 +MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1076 +MODULE_DESCRIPTION("IPv4 TRACE target");
1077 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_ULOG.c linux-2.6.0-test9/net/ipv4/netfilter/ipt_ULOG.c
1078 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_ULOG.c 2003-10-25 20:43:22.000000000 +0200
1079 +++ linux-2.6.0-test9/net/ipv4/netfilter/ipt_ULOG.c     2003-10-26 12:44:13.000000000 +0100
1080 @@ -45,6 +45,7 @@
1081  #include <linux/netlink.h>
1082  #include <linux/netdevice.h>
1083  #include <linux/mm.h>
1084 +#include <linux/netfilter.h>
1085  #include <linux/netfilter_ipv4/ip_tables.h>
1086  #include <linux/netfilter_ipv4/ipt_ULOG.h>
1087  #include <linux/netfilter_ipv4/lockhelp.h>
1088 @@ -75,6 +76,10 @@
1089  MODULE_PARM(flushtimeout, "i");
1090  MODULE_PARM_DESC(flushtimeout, "buffer flush timeout");
1091
1092 +static unsigned int nflog = 1;
1093 +MODULE_PARM(nflog, "i");
1094 +MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
1095 +
1096  /* global data structures */
1097
1098  typedef struct {
1099 @@ -152,17 +157,17 @@
1100         return skb;
1101  }
1102
1103 -static unsigned int ipt_ulog_target(struct sk_buff **pskb,
1104 -                                   const struct net_device *in,
1105 -                                   const struct net_device *out,
1106 -                                   unsigned int hooknum,
1107 -                                   const void *targinfo, void *userinfo)
1108 +static void ipt_ulog_packet(unsigned int hooknum,
1109 +                           const struct sk_buff *skb,
1110 +                           const struct net_device *in,
1111 +                           const struct net_device *out,
1112 +                           const struct ipt_ulog_info *loginfo,
1113 +                           const char *prefix)
1114  {
1115         ulog_buff_t *ub;
1116         ulog_packet_msg_t *pm;
1117         size_t size, copy_len;
1118         struct nlmsghdr *nlh;
1119 -       struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
1120
1121         /* ffs == find first bit set, necessary because userspace
1122          * is already shifting groupnumber, but we need unshifted.
1123 @@ -171,8 +176,8 @@
1124
1125         /* calculate the size of the skb needed */
1126         if ((loginfo->copy_range == 0) ||
1127 -           (loginfo->copy_range > (*pskb)->len)) {
1128 -               copy_len = (*pskb)->len;
1129 +           (loginfo->copy_range > skb->len)) {
1130 +               copy_len = skb->len;
1131         } else {
1132                 copy_len = loginfo->copy_range;
1133         }
1134 @@ -209,19 +214,21 @@
1135
1136         /* copy hook, prefix, timestamp, payload, etc. */
1137         pm->data_len = copy_len;
1138 -       pm->timestamp_sec = (*pskb)->stamp.tv_sec;
1139 -       pm->timestamp_usec = (*pskb)->stamp.tv_usec;
1140 -       pm->mark = (*pskb)->nfmark;
1141 +       pm->timestamp_sec = skb->stamp.tv_sec;
1142 +       pm->timestamp_usec = skb->stamp.tv_usec;
1143 +       pm->mark = skb->nfmark;
1144         pm->hook = hooknum;
1145 -       if (loginfo->prefix[0] != '\0')
1146 +       if (prefix != NULL)
1147 +               strncpy(pm->prefix, prefix, sizeof(pm->prefix));
1148 +       else if (loginfo->prefix[0] != '\0')
1149                 strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
1150         else
1151                 *(pm->prefix) = '\0';
1152
1153         if (in && in->hard_header_len > 0
1154 -           && (*pskb)->mac.raw != (void *) (*pskb)->nh.iph
1155 +           && skb->mac.raw != (void *) skb->nh.iph
1156             && in->hard_header_len <= ULOG_MAC_LEN) {
1157 -               memcpy(pm->mac, (*pskb)->mac.raw, in->hard_header_len);
1158 +               memcpy(pm->mac, skb->mac.raw, in->hard_header_len);
1159                 pm->mac_len = in->hard_header_len;
1160         } else
1161                 pm->mac_len = 0;
1162 @@ -236,8 +243,8 @@
1163         else
1164                 pm->outdev_name[0] = '\0';
1165
1166 -       /* copy_len <= (*pskb)->len, so can't fail. */
1167 -       if (skb_copy_bits(*pskb, 0, pm->payload, copy_len) < 0)
1168 +       /* copy_len <= skb->len, so can't fail. */
1169 +       if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0)
1170                 BUG();
1171
1172         /* check if we are building multi-part messages */
1173 @@ -261,8 +268,7 @@
1174
1175         UNLOCK_BH(&ulog_lock);
1176
1177 -       return IPT_CONTINUE;
1178 -
1179 +       return;
1180
1181  nlmsg_failure:
1182         PRINTR("ipt_ULOG: error during NLMSG_PUT\n");
1183 @@ -271,8 +277,35 @@
1184         PRINTR("ipt_ULOG: Error building netlink message\n");
1185
1186         UNLOCK_BH(&ulog_lock);
1187 +}
1188 +
1189 +static unsigned int ipt_ulog_target(struct sk_buff **pskb,
1190 +                                   const struct net_device *in,
1191 +                                   const struct net_device *out,
1192 +                                   unsigned int hooknum,
1193 +                                   const void *targinfo, void *userinfo)
1194 +{
1195 +       struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
1196
1197 -       return IPT_CONTINUE;
1198 +       ipt_ulog_packet(hooknum, *pskb, in, out, loginfo, NULL);
1199 +
1200 +       return IPT_CONTINUE;
1201 +}
1202 +
1203 +static void ipt_logfn(unsigned int hooknum,
1204 +                     const struct sk_buff *skb,
1205 +                     const struct net_device *in,
1206 +                     const struct net_device *out,
1207 +                     const char *prefix)
1208 +{
1209 +       struct ipt_ulog_info loginfo = {
1210 +               .nl_group = NFLOG_DEFAULT_NLGROUP,
1211 +               .copy_range = 0,
1212 +               .qthreshold = NFLOG_DEFAULT_QTHRESHOLD,
1213 +               .prefix = ""
1214 +       };
1215 +
1216 +       ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
1217  }
1218
1219  static int ipt_ulog_checkentry(const char *tablename,
1220 @@ -337,6 +370,9 @@
1221                 return -EINVAL;
1222         }
1223
1224 +       if (nflog)
1225 +               nf_log_register(PF_INET, &ipt_logfn);
1226 +
1227         return 0;
1228  }
1229
1230 @@ -347,6 +383,9 @@
1231
1232         DEBUGP("ipt_ULOG: cleanup_module\n");
1233
1234 +       if (nflog)
1235 +               nf_log_unregister(PF_INET, &ipt_logfn);
1236 +
1237         ipt_unregister_target(&ipt_ulog_reg);
1238         sock_release(nflognl->sk_socket);
1239
1240 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_conntrack.c linux-2.6.0-test9/net/ipv4/netfilter/ipt_conntrack.c
1241 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_conntrack.c    2003-10-25 20:44:42.000000000 +0200
1242 +++ linux-2.6.0-test9/net/ipv4/netfilter/ipt_conntrack.c        2003-10-26 12:44:33.000000000 +0100
1243 @@ -29,7 +29,9 @@
1244
1245  #define FWINV(bool,invflg) ((bool) ^ !!(sinfo->invflags & invflg))
1246
1247 -       if (ct)
1248 +       if (skb->nfct == &ip_conntrack_untracked.infos[IP_CT_NEW])
1249 +               statebit = IPT_CONNTRACK_STATE_UNTRACKED;
1250 +       else if (ct)
1251                 statebit = IPT_CONNTRACK_STATE_BIT(ctinfo);
1252         else
1253                 statebit = IPT_CONNTRACK_STATE_INVALID;
1254 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_sctp.c linux-2.6.0-test9/net/ipv4/netfilter/ipt_sctp.c
1255 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_sctp.c 1970-01-01 01:00:00.000000000 +0100
1256 +++ linux-2.6.0-test9/net/ipv4/netfilter/ipt_sctp.c     2003-10-26 12:44:43.000000000 +0100
1257 @@ -0,0 +1,125 @@
1258 +/* IP tables module for matching the SCTP header
1259 + *
1260 + * $ipt_sctp.c,v 1.3 2002/05/29 15:09:00 laforge Exp$
1261 + *
1262 + * (C) 2003 by Harald Welte <laforge@gnumonks.org>
1263 + *
1264 + * This software is distributed under the terms GNU GPL v2
1265 + */
1266 +
1267 +#include <linux/module.h>
1268 +#include <linux/skbuff.h>
1269 +#include <linux/sctp.h>
1270 +
1271 +#include <linux/netfilter_ipv4/ip_tables.h>
1272 +#include <linux/netfilter_ipv4/ipt_sctp.h>
1273 +
1274 +MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
1275 +MODULE_DESCRIPTION("IP tables SCTP matching module");
1276 +MODULE_LICENSE("GPL");
1277 +
1278 +/* Returns 1 if the port is matched by the range, 0 otherwise */
1279 +static inline int
1280 +port_match(u_int16_t min, u_int16_t max, u_int16_t port, int invert)
1281 +{
1282 +       int ret;
1283 +
1284 +       ret = (port >= min && port <= max) ^ invert;
1285 +       return ret;
1286 +}
1287 +
1288 +static int chunk_match(const struct sk_buff *skb, u_int32_t chunks, u_int32_t chunk_mask)
1289 +{
1290 +       sctp_chunkhdr_t *ch = (sctp_chunkhdr_t *) skb->data;
1291 +
1292 +       u_int32_t chunks_present = 0;
1293 +
1294 +       do {
1295 +               u_int8_t *ch_end;
1296 +               ch_end = ((u_int8_t *) ch) + WORD_ROUND(ntohs(ch->length));
1297 +
1298 +               if (ch->type < 32)
1299 +                       chunks_present |= (1 << ch_type);
1300 +               else if (ch->type == SCTP_CID_ASCONF)
1301 +                       chunks_present |= (1 << 31);
1302 +               else if (ch->type == SCTP_CID_ASCONF_ACK)
1303 +                       chunks_present |= (1 << 30);
1304 +
1305 +               ch = (sctp_chunkhdr_t *) ch_end;
1306 +       } while (ch_end < skb->tail);
1307 +
1308 +       return ((chunks_present& chunk_mask) == chunks);
1309 +}
1310 +
1311 +static int match(const struct sk_buff *skb, const struct net_device *in,
1312 +                const struct net_device *out, const void *matchinfo,
1313 +                int offset, const void *hdr, u_int16_t datalen,
1314 +                int *hotdrop)
1315 +{
1316 +       const struct ipt_sctp_info *info = matchinfo;
1317 +       const struct iphdr *iph = skb->nh.iph;
1318 +       const struct sctphdr *sh = (struct sctphdr *) skb->h.raw;
1319 +
1320 +       if (iph->protocol != IPPROTO_SCTP)
1321 +               return 0;
1322 +
1323 +       if (offset == 1) {
1324 +               duprintf("Dropping evil SCTP offset=1 frag.\n");
1325 +               *hotdrop = 1;
1326 +               return 0;
1327 +       } else if (offset == 0 && datalen < sizeof(struct sctphdr)) {
1328 +               /* We've been askd o examine this packet, and we can't.
1329 +                * Hence, no choice but to drop. */
1330 +               duprintf("Dropping evil SCTP offset=0 tinygram.\n");
1331 +               *hotdrop = 1;
1332 +               return 0;
1333 +       }
1334 +
1335 +       return (!offset
1336 +               && port_match(info->spts[0], info->spts[1],
1337 +                             ntohs(sh->source),
1338 +                             !!(info->invflags & IPT_SCTP_INV_SRCPT))
1339 +               && port_match(info->dpts[0], info->dpts[1],
1340 +                             ntohs(sh->dest),
1341 +                             !!(info->invflags & IPT_SCTP_INV_DSTPT))
1342 +               && chunk_match(skb, info->chunks, info->chunk_mask)
1343 +              );
1344 +}
1345 +
1346 +static int checkentry(const char *tablename, const struct ipt_ip *ip,
1347 +                     void *matchinfo, unsigned int matchsize,
1348 +                     unsigned int hook_mask)
1349 +{
1350 +       const struct ipt_sctp_info *info = matchinfo;
1351 +
1352 +       if (matchsize != IPT_ALIGN(sizeof(struct ipt_sctp_info)))
1353 +               return 0;
1354 +
1355 +       if (ip->proto != IPPROTO_SCTP && !(ip->invflags & IPT_INV_PROTO))
1356 +               return 0;
1357 +
1358 +       if !(info->invflags & ~IPT_SCTP_INV_MASK)
1359 +               return 0;
1360 +
1361 +       return 1;
1362 +}
1363 +
1364 +static struct ipt_match sctp_match = {
1365 +       .name           = "sctp",
1366 +       .match          = &match,
1367 +       .checkentry     = &checkentry,
1368 +       .me             = THIS_MODULE,
1369 +};
1370 +
1371 +static int __init init(void)
1372 +{
1373 +       return ipt_register_match(&sctp_match);
1374 +}
1375 +
1376 +static void __exit fini(void)
1377 +{
1378 +       ipt_unregister_match(&sctp_match);
1379 +}
1380 +
1381 +module_init(init);
1382 +module_exit(fini);
1383 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_state.c linux-2.6.0-test9/net/ipv4/netfilter/ipt_state.c
1384 --- linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_state.c        2003-10-25 20:44:59.000000000 +0200
1385 +++ linux-2.6.0-test9/net/ipv4/netfilter/ipt_state.c    2003-10-26 12:44:33.000000000 +0100
1386 @@ -23,10 +23,12 @@
1387         enum ip_conntrack_info ctinfo;
1388         unsigned int statebit;
1389
1390 -       if (!ip_conntrack_get((struct sk_buff *)skb, &ctinfo))
1391 -               statebit = IPT_STATE_INVALID;
1392 -       else
1393 +       if (skb->nfct == &ip_conntrack_untracked.infos[IP_CT_NEW])
1394 +               statebit = IPT_STATE_UNTRACKED;
1395 +       else if (ip_conntrack_get((struct sk_buff *)skb, &ctinfo))
1396                 statebit = IPT_STATE_BIT(ctinfo);
1397 +       else
1398 +               statebit = IPT_STATE_INVALID;
1399
1400         return (sinfo->statemask & statebit);
1401  }
1402 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/iptable_filter.c linux-2.6.0-test9/net/ipv4/netfilter/iptable_filter.c
1403 --- linux-2.6.0-test9.org/net/ipv4/netfilter/iptable_filter.c   2003-10-25 20:43:23.000000000 +0200
1404 +++ linux-2.6.0-test9/net/ipv4/netfilter/iptable_filter.c       2003-10-26 12:44:33.000000000 +0100
1405 @@ -52,7 +52,7 @@
1406                 0,
1407                 sizeof(struct ipt_entry),
1408                 sizeof(struct ipt_standard),
1409 -               0, { 0, 0 }, { } },
1410 +               0, NULL, 0, { 0, 0 }, { } },
1411               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1412                 -NF_ACCEPT - 1 } },
1413             /* FORWARD */
1414 @@ -60,7 +60,7 @@
1415                 0,
1416                 sizeof(struct ipt_entry),
1417                 sizeof(struct ipt_standard),
1418 -               0, { 0, 0 }, { } },
1419 +               0, NULL, 0, { 0, 0 }, { } },
1420               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1421                 -NF_ACCEPT - 1 } },
1422             /* LOCAL_OUT */
1423 @@ -68,7 +68,7 @@
1424                 0,
1425                 sizeof(struct ipt_entry),
1426                 sizeof(struct ipt_standard),
1427 -               0, { 0, 0 }, { } },
1428 +               0, NULL, 0, { 0, 0 }, { } },
1429               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1430                 -NF_ACCEPT - 1 } }
1431      },
1432 @@ -77,7 +77,7 @@
1433         0,
1434         sizeof(struct ipt_entry),
1435         sizeof(struct ipt_error),
1436 -       0, { 0, 0 }, { } },
1437 +       0, NULL, 0, { 0, 0 }, { } },
1438        { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
1439           { } },
1440         "ERROR"
1441 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/iptable_mangle.c linux-2.6.0-test9/net/ipv4/netfilter/iptable_mangle.c
1442 --- linux-2.6.0-test9.org/net/ipv4/netfilter/iptable_mangle.c   2003-10-25 20:44:37.000000000 +0200
1443 +++ linux-2.6.0-test9/net/ipv4/netfilter/iptable_mangle.c       2003-10-26 12:44:33.000000000 +0100
1444 @@ -69,7 +69,7 @@
1445                 0,
1446                 sizeof(struct ipt_entry),
1447                 sizeof(struct ipt_standard),
1448 -               0, { 0, 0 }, { } },
1449 +               0, NULL, 0, { 0, 0 }, { } },
1450               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1451                 -NF_ACCEPT - 1 } },
1452             /* LOCAL_IN */
1453 @@ -77,7 +77,7 @@
1454                 0,
1455                 sizeof(struct ipt_entry),
1456                 sizeof(struct ipt_standard),
1457 -               0, { 0, 0 }, { } },
1458 +               0, NULL, 0, { 0, 0 }, { } },
1459               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1460                 -NF_ACCEPT - 1 } },
1461             /* FORWARD */
1462 @@ -85,7 +85,7 @@
1463                 0,
1464                 sizeof(struct ipt_entry),
1465                 sizeof(struct ipt_standard),
1466 -               0, { 0, 0 }, { } },
1467 +               0, NULL, 0, { 0, 0 }, { } },
1468               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1469                 -NF_ACCEPT - 1 } },
1470             /* LOCAL_OUT */
1471 @@ -93,7 +93,7 @@
1472                 0,
1473                 sizeof(struct ipt_entry),
1474                 sizeof(struct ipt_standard),
1475 -               0, { 0, 0 }, { } },
1476 +               0, NULL, 0, { 0, 0 }, { } },
1477               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1478                 -NF_ACCEPT - 1 } },
1479             /* POST_ROUTING */
1480 @@ -101,7 +101,7 @@
1481                 0,
1482                 sizeof(struct ipt_entry),
1483                 sizeof(struct ipt_standard),
1484 -               0, { 0, 0 }, { } },
1485 +               0, NULL, 0, { 0, 0 }, { } },
1486               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1487                 -NF_ACCEPT - 1 } },
1488      },
1489 @@ -110,7 +110,7 @@
1490         0,
1491         sizeof(struct ipt_entry),
1492         sizeof(struct ipt_error),
1493 -       0, { 0, 0 }, { } },
1494 +       0, NULL, 0, { 0, 0 }, { } },
1495        { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
1496           { } },
1497         "ERROR"
1498 diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/iptable_raw.c linux-2.6.0-test9/net/ipv4/netfilter/iptable_raw.c
1499 --- linux-2.6.0-test9.org/net/ipv4/netfilter/iptable_raw.c      1970-01-01 01:00:00.000000000 +0100
1500 +++ linux-2.6.0-test9/net/ipv4/netfilter/iptable_raw.c  2003-10-26 12:44:33.000000000 +0100
1501 @@ -0,0 +1,153 @@
1502 +/*
1503 + * 'raw' table, which is the very first hooked in at PRE_ROUTING and LOCAL_OUT .
1504 + *
1505 + * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
1506 + */
1507 +#include <linux/module.h>
1508 +#include <linux/netfilter_ipv4/ip_tables.h>
1509 +
1510 +#define RAW_VALID_HOOKS ((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT))
1511 +
1512 +/* Standard entry. */
1513 +struct ipt_standard
1514 +{
1515 +       struct ipt_entry entry;
1516 +       struct ipt_standard_target target;
1517 +};
1518 +
1519 +struct ipt_error_target
1520 +{
1521 +       struct ipt_entry_target target;
1522 +       char errorname[IPT_FUNCTION_MAXNAMELEN];
1523 +};
1524 +
1525 +struct ipt_error
1526 +{
1527 +       struct ipt_entry entry;
1528 +       struct ipt_error_target target;
1529 +};
1530 +
1531 +static struct
1532 +{
1533 +       struct ipt_replace repl;
1534 +       struct ipt_standard entries[2];
1535 +       struct ipt_error term;
1536 +} initial_table __initdata
1537 += { { "raw", RAW_VALID_HOOKS, 3,
1538 +      sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error),
1539 +      { [NF_IP_PRE_ROUTING] 0,
1540 +       [NF_IP_LOCAL_OUT] sizeof(struct ipt_standard) },
1541 +      { [NF_IP_PRE_ROUTING] 0,
1542 +       [NF_IP_LOCAL_OUT] sizeof(struct ipt_standard) },
1543 +      0, NULL, { } },
1544 +    {
1545 +           /* PRE_ROUTING */
1546 +           { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
1547 +               0,
1548 +               sizeof(struct ipt_entry),
1549 +               sizeof(struct ipt_standard),
1550 +               0, NULL, 0, { 0, 0 }, { } },
1551 +             { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1552 +               -NF_ACCEPT - 1 } },
1553 +           /* LOCAL_OUT */
1554 +           { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
1555 +               0,
1556 +               sizeof(struct ipt_entry),
1557 +               sizeof(struct ipt_standard),
1558 +               0, NULL, 0, { 0, 0 }, { } },
1559 +             { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1560 +               -NF_ACCEPT - 1 } }
1561 +    },
1562 +    /* ERROR */
1563 +    { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
1564 +       0,
1565 +       sizeof(struct ipt_entry),
1566 +       sizeof(struct ipt_error),
1567 +       0, NULL, 0, { 0, 0 }, { } },
1568 +      { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
1569 +         { } },
1570 +       "ERROR"
1571 +      }
1572 +    }
1573 +};
1574 +
1575 +static struct ipt_table packet_raw = {
1576 +       .name = "raw",
1577 +       .table = &initial_table.repl,
1578 +       .valid_hooks =  RAW_VALID_HOOKS,
1579 +       .lock = RW_LOCK_UNLOCKED,
1580 +       .me = THIS_MODULE,
1581 +};
1582 +
1583 +/* The work comes in here from netfilter.c. */
1584 +static unsigned int
1585 +ipt_hook(unsigned int hook,
1586 +        struct sk_buff **pskb,
1587 +        const struct net_device *in,
1588 +        const struct net_device *out,
1589 +        int (*okfn)(struct sk_buff *))
1590 +{
1591 +       return ipt_do_table(pskb, hook, in, out, &packet_raw, NULL);
1592 +}
1593 +
1594 +/* 'raw' is the very first table. */
1595 +static struct nf_hook_ops ipt_ops[] = {
1596 +       {       /* PRE_ROUTING hook */
1597 +               .hook           = ipt_hook,
1598 +               .owner          = THIS_MODULE,
1599 +               .pf             = PF_INET,
1600 +               .hooknum        = NF_IP_PRE_ROUTING,
1601 +               .priority       = NF_IP_PRI_RAW,
1602 +       },
1603 +       {       /* LOCAL_OUT hook */
1604 +               .hook           = ipt_hook,
1605 +               .owner          = THIS_MODULE,
1606 +               .pf             = PF_INET,
1607 +               .hooknum        = NF_IP_LOCAL_OUT,
1608 +               .priority       = NF_IP_PRI_RAW,
1609 +       },
1610 +};
1611 +
1612 +static int __init init(void)
1613 +{
1614 +       int ret;
1615 +
1616 +       /* Register table */
1617 +       ret = ipt_register_table(&packet_raw);
1618 +       if (ret < 0)
1619 +               return ret;
1620 +
1621 +       /* Register hooks */
1622 +       ret = nf_register_hook(&ipt_ops[0]);
1623 +       if (ret < 0)
1624 +               goto cleanup_table;
1625 +
1626 +       ret = nf_register_hook(&ipt_ops[1]);
1627 +       if (ret < 0)
1628 +               goto cleanup_hook0;
1629 +
1630 +       return ret;
1631 +
1632 + cleanup_hook0:
1633 +       nf_unregister_hook(&ipt_ops[0]);
1634 + cleanup_table:
1635 +       ipt_unregister_table(&packet_raw);
1636 +
1637 +       return ret;
1638 +}
1639 +
1640 +static void __exit fini(void)
1641 +{
1642 +       unsigned int i;
1643 +
1644 +       for (i = 0; i < sizeof(ipt_ops)/sizeof(struct nf_hook_ops); i++)
1645 +               nf_unregister_hook(&ipt_ops[i]);
1646 +
1647 +       ipt_unregister_table(&packet_raw);
1648 +}
1649 +
1650 +module_init(init);
1651 +module_exit(fini);
1652 +MODULE_LICENSE("GPL");
1653 +MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1654 +MODULE_DESCRIPTION("IPv4 raw table");
1655 diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/Kconfig linux-2.6.0-test9/net/ipv6/netfilter/Kconfig
1656 --- linux-2.6.0-test9.org/net/ipv6/netfilter/Kconfig    2003-10-25 20:44:37.000000000 +0200
1657 +++ linux-2.6.0-test9/net/ipv6/netfilter/Kconfig        2003-10-26 12:44:33.000000000 +0100
1658 @@ -217,6 +217,31 @@
1659
1660           To compile it as a module, choose M here.  If unsure, say N.
1661
1662 +config IP6_NF_RAW
1663 +       tristate "Raw table"
1664 +       depends on IP6_NF_IPTABLES
1665 +       help
1666 +         This option adds a `raw' table to iptables: see the man page for
1667 +         iptables(8).  This table is the very first in the netfilter
1668 +         framework and hooks in at the PREROUTING and OUTPUT chains.
1669 +         The TRACE target can be used in this table only.
1670 +
1671 +         To compile it as a module, choose M here.  If unsure, say N.
1672 +
1673 +config IP6_NF_TARGET_TRACE
1674 +       tristate "TRACE target support"
1675 +       depends on IP6_NF_RAW
1676 +       help
1677 +         The TRACE target allows packets to be traced as those matches
1678 +         any subsequent rule in any IPv6 netfilter table/rule. The matched
1679 +         rule and the packet is logged with the prefix
1680 +
1681 +         TRACE: tablename/chainname/rulenum
1682 +
1683 +         if the ip6t_LOG target is loaded in.
1684 +
1685 +         To compile it as a module, choose M here.  If unsure, say N.
1686 +
1687  #dep_tristate '  LOG target support' CONFIG_IP6_NF_TARGET_LOG $CONFIG_IP6_NF_IPTABLES
1688  endmenu
1689
1690 diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/Makefile linux-2.6.0-test9/net/ipv6/netfilter/Makefile
1691 --- linux-2.6.0-test9.org/net/ipv6/netfilter/Makefile   2003-10-25 20:43:53.000000000 +0200
1692 +++ linux-2.6.0-test9/net/ipv6/netfilter/Makefile       2003-10-26 12:44:33.000000000 +0100
1693 @@ -18,7 +18,9 @@
1694  obj-$(CONFIG_IP6_NF_MATCH_OWNER) += ip6t_owner.o
1695  obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
1696  obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
1697 +obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
1698  obj-$(CONFIG_IP6_NF_TARGET_MARK) += ip6t_MARK.o
1699  obj-$(CONFIG_IP6_NF_QUEUE) += ip6_queue.o
1700  obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_LOG.o
1701 +obj-$(CONFIG_IP6_NF_TARGET_TRACE) += ip6t_TRACE.o
1702  obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
1703 diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/ip6_tables.c linux-2.6.0-test9/net/ipv6/netfilter/ip6_tables.c
1704 --- linux-2.6.0-test9.org/net/ipv6/netfilter/ip6_tables.c       2003-10-25 20:44:39.000000000 +0200
1705 +++ linux-2.6.0-test9/net/ipv6/netfilter/ip6_tables.c   2003-10-26 12:44:33.000000000 +0100
1706 @@ -12,6 +12,7 @@
1707   */
1708  #include <linux/config.h>
1709  #include <linux/skbuff.h>
1710 +#include <linux/socket.h>
1711  #include <linux/kmod.h>
1712  #include <linux/vmalloc.h>
1713  #include <linux/netdevice.h>
1714 @@ -24,8 +25,17 @@
1715  #include <asm/semaphore.h>
1716  #include <linux/proc_fs.h>
1717
1718 +#include <linux/netfilter.h>
1719  #include <linux/netfilter_ipv6/ip6_tables.h>
1720
1721 +static const char *hook6names[] = {
1722 +       [NF_IP6_PRE_ROUTING] "PREROUTING",
1723 +       [NF_IP6_LOCAL_IN] "INPUT",
1724 +       [NF_IP6_FORWARD] "FORWARD",
1725 +       [NF_IP6_LOCAL_OUT] "OUTPUT",
1726 +       [NF_IP6_POST_ROUTING] "POSTROUTING",
1727 +};
1728 +
1729  MODULE_LICENSE("GPL");
1730  MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1731  MODULE_DESCRIPTION("IPv6 packet filter");
1732 @@ -403,6 +413,12 @@
1733
1734                         t = ip6t_get_target(e);
1735                         IP_NF_ASSERT(t->u.kernel.target);
1736 +
1737 +                       /* The packet traced and the rule isn't an unconditional return/END. */
1738 +                       if (((*pskb)->nfcache & NFC_TRACE) && e->rulenum) {
1739 +                               nf_log_packet(AF_INET6, hook, *pskb, in, out, "TRACE: %s/%s/%u ",
1740 +                                                 table->name, e->chainname, e->rulenum);
1741 +                       }
1742                         /* Standard target? */
1743                         if (!t->u.kernel.target->target) {
1744                                 int v;
1745 @@ -556,6 +572,29 @@
1746         return find_inlist_lock(&ip6t_target, name, "ip6t_", error, mutex);
1747  }
1748
1749 +static inline int
1750 +find_error_target(struct ip6t_entry *s,
1751 +                 struct ip6t_entry *e,
1752 +                 char **chainname)
1753 +{
1754 +       struct ip6t_entry_target *t;
1755 +       static struct ip6t_entry *found = NULL;
1756 +
1757 +       if (s == e) {
1758 +               if (!found)
1759 +                       return 0;
1760 +               t = ip6t_get_target(found);
1761 +               if (strcmp(t->u.user.name,
1762 +                          IP6T_ERROR_TARGET) == 0) {
1763 +                       *chainname = t->data;
1764 +                       return 1;
1765 +               }
1766 +       } else
1767 +               found = s;
1768 +
1769 +       return 0;
1770 +}
1771 +
1772  /* All zeroes == unconditional rule. */
1773  static inline int
1774  unconditional(const struct ip6t_ip6 *ipv6)
1775 @@ -575,6 +614,8 @@
1776  mark_source_chains(struct ip6t_table_info *newinfo, unsigned int valid_hooks)
1777  {
1778         unsigned int hook;
1779 +       char *chainname = NULL;
1780 +       u_int32_t rulenum;
1781
1782         /* No recursion; use packet counter to save back ptrs (reset
1783            to 0 as we leave), and comefrom to save source hook bitmask */
1784 @@ -588,6 +629,8 @@
1785
1786                 /* Set initial back pointer. */
1787                 e->counters.pcnt = pos;
1788 +               rulenum = 1;
1789 +               chainname = (char *) hook6names[hook];
1790
1791                 for (;;) {
1792                         struct ip6t_standard_target *t
1793 @@ -600,6 +643,8 @@
1794                         }
1795                         e->comefrom
1796                                 |= ((1 << hook) | (1 << NF_IP6_NUMHOOKS));
1797 +                       e->rulenum = rulenum++;
1798 +                       e->chainname = chainname;
1799
1800                         /* Unconditional return/END. */
1801                         if (e->target_offset == sizeof(struct ip6t_entry)
1802 @@ -609,6 +654,10 @@
1803                             && unconditional(&e->ipv6)) {
1804                                 unsigned int oldpos, size;
1805
1806 +                               /* Set unconditional rulenum to zero. */
1807 +                               e->rulenum = 0;
1808 +                               e->counters.bcnt = 0;
1809 +
1810                                 /* Return: backtrack through the last
1811                                    big jump. */
1812                                 do {
1813 @@ -634,6 +683,11 @@
1814                                                 (newinfo->entries + pos);
1815                                 } while (oldpos == pos + e->next_offset);
1816
1817 +                               /* Restore chainname, rulenum. */
1818 +                               chainname = e->chainname;
1819 +                               rulenum = e->counters.bcnt;
1820 +                               e->counters.bcnt = 0;
1821 +
1822                                 /* Move along one */
1823                                 size = e->next_offset;
1824                                 e = (struct ip6t_entry *)
1825 @@ -649,6 +703,17 @@
1826                                         /* This a jump; chase it. */
1827                                         duprintf("Jump rule %u -> %u\n",
1828                                                  pos, newpos);
1829 +                                       e->counters.bcnt = rulenum++;
1830 +                                       rulenum = 1;
1831 +                                       e = (struct ip6t_entry *)
1832 +                                               (newinfo->entries + newpos);
1833 +                                       if (IP6T_ENTRY_ITERATE(newinfo->entries,
1834 +                                                              newinfo->size,
1835 +                                                              find_error_target,
1836 +                                                              e, &chainname) == 0) {
1837 +                                               printk("ip6_tables: table screwed up!\n");
1838 +                                               return 0;
1839 +                                       }
1840                                 } else {
1841                                         /* ... this is a fallthru */
1842                                         newpos = pos + e->next_offset;
1843 diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/ip6t_LOG.c linux-2.6.0-test9/net/ipv6/netfilter/ip6t_LOG.c
1844 --- linux-2.6.0-test9.org/net/ipv6/netfilter/ip6t_LOG.c 2003-10-25 20:43:18.000000000 +0200
1845 +++ linux-2.6.0-test9/net/ipv6/netfilter/ip6t_LOG.c     2003-10-26 12:44:13.000000000 +0100
1846 @@ -3,18 +3,24 @@
1847   */
1848  #include <linux/module.h>
1849  #include <linux/skbuff.h>
1850 +#include <linux/socket.h>
1851  #include <linux/ip.h>
1852  #include <linux/spinlock.h>
1853  #include <linux/icmpv6.h>
1854  #include <net/udp.h>
1855  #include <net/tcp.h>
1856  #include <net/ipv6.h>
1857 +#include <linux/netfilter.h>
1858  #include <linux/netfilter_ipv6/ip6_tables.h>
1859
1860  MODULE_AUTHOR("Jan Rekorajski <baggins@pld.org.pl>");
1861  MODULE_DESCRIPTION("IP6 tables LOG target module");
1862  MODULE_LICENSE("GPL");
1863
1864 +static unsigned int nflog = 1;
1865 +MODULE_PARM(nflog, "i");
1866 +MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
1867 +
1868  struct in_device;
1869  #include <net/route.h>
1870  #include <linux/netfilter_ipv6/ip6t_LOG.h>
1871 @@ -256,40 +262,38 @@
1872         }
1873  }
1874
1875 -static unsigned int
1876 -ip6t_log_target(struct sk_buff **pskb,
1877 -               unsigned int hooknum,
1878 -               const struct net_device *in,
1879 -               const struct net_device *out,
1880 -               const void *targinfo,
1881 -               void *userinfo)
1882 +static void
1883 +ip6t_log_packet(unsigned int hooknum,
1884 +               const struct sk_buff *skb,
1885 +               const struct net_device *in,
1886 +               const struct net_device *out,
1887 +               const struct ip6t_log_info *loginfo,
1888 +               const char *level_string,
1889 +               const char *prefix)
1890  {
1891 -       struct ipv6hdr *ipv6h = (*pskb)->nh.ipv6h;
1892 -       const struct ip6t_log_info *loginfo = targinfo;
1893 -       char level_string[4] = "< >";
1894 +       struct ipv6hdr *ipv6h = skb->nh.ipv6h;
1895
1896 -       level_string[1] = '0' + (loginfo->level % 8);
1897         spin_lock_bh(&log_lock);
1898         printk(level_string);
1899         printk("%sIN=%s OUT=%s ",
1900 -               loginfo->prefix,
1901 +               prefix == NULL ? loginfo->prefix : prefix,
1902                 in ? in->name : "",
1903                 out ? out->name : "");
1904         if (in && !out) {
1905                 /* MAC logging for input chain only. */
1906                 printk("MAC=");
1907 -               if ((*pskb)->dev && (*pskb)->dev->hard_header_len && (*pskb)->mac.raw != (void*)ipv6h) {
1908 -                       if ((*pskb)->dev->type != ARPHRD_SIT){
1909 +               if (skb->dev && skb->dev->hard_header_len && skb->mac.raw != (void*)ipv6h) {
1910 +                       if (skb->dev->type != ARPHRD_SIT){
1911                           int i;
1912 -                         unsigned char *p = (*pskb)->mac.raw;
1913 -                         for (i = 0; i < (*pskb)->dev->hard_header_len; i++,p++)
1914 +                         unsigned char *p = skb->mac.raw;
1915 +                         for (i = 0; i < skb->dev->hard_header_len; i++,p++)
1916                                 printk("%02x%c", *p,
1917 -                                       i==(*pskb)->dev->hard_header_len - 1
1918 +                                       i==skb->dev->hard_header_len - 1
1919                                         ? ' ':':');
1920                         } else {
1921                           int i;
1922 -                         unsigned char *p = (*pskb)->mac.raw;
1923 -                         if ( p - (ETH_ALEN*2+2) > (*pskb)->head ){
1924 +                         unsigned char *p = skb->mac.raw;
1925 +                         if ( p - (ETH_ALEN*2+2) > skb->head ){
1926                             p -= (ETH_ALEN+2);
1927                             for (i = 0; i < (ETH_ALEN); i++,p++)
1928                                 printk("%02x%s", *p,
1929 @@ -300,10 +304,10 @@
1930                                         i == ETH_ALEN-1 ? ' ' : ':');
1931                           }
1932
1933 -                         if (((*pskb)->dev->addr_len == 4) &&
1934 -                             (*pskb)->dev->hard_header_len > 20){
1935 +                         if ((skb->dev->addr_len == 4) &&
1936 +                             skb->dev->hard_header_len > 20){
1937                             printk("TUNNEL=");
1938 -                           p = (*pskb)->mac.raw + 12;
1939 +                           p = skb->mac.raw + 12;
1940                             for (i = 0; i < 4; i++,p++)
1941                                 printk("%3d%s", *p,
1942                                         i == 3 ? "->" : ".");
1943 @@ -319,10 +323,41 @@
1944         dump_packet(loginfo, ipv6h, 1);
1945         printk("\n");
1946         spin_unlock_bh(&log_lock);
1947 +}
1948 +
1949 +static unsigned int
1950 +ip6t_log_target(struct sk_buff **pskb,
1951 +               unsigned int hooknum,
1952 +               const struct net_device *in,
1953 +               const struct net_device *out,
1954 +               const void *targinfo,
1955 +               void *userinfo)
1956 +{
1957 +       const struct ip6t_log_info *loginfo = targinfo;
1958 +       char level_string[4] = "< >";
1959 +
1960 +       level_string[1] = '0' + (loginfo->level % 8);
1961 +       ip6t_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
1962
1963         return IP6T_CONTINUE;
1964  }
1965
1966 +static void
1967 +ip6t_logfn(unsigned int hooknum,
1968 +          const struct sk_buff *skb,
1969 +          const struct net_device *in,
1970 +          const struct net_device *out,
1971 +          const char *prefix)
1972 +{
1973 +       struct ip6t_log_info loginfo = {
1974 +               .level = 0,
1975 +               .logflags = IP6T_LOG_MASK,
1976 +               .prefix = ""
1977 +       };
1978 +
1979 +       ip6t_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
1980 +}
1981 +
1982  static int ip6t_log_checkentry(const char *tablename,
1983                                const struct ip6t_entry *e,
1984                                void *targinfo,
1985 @@ -359,12 +394,17 @@
1986  {
1987         if (ip6t_register_target(&ip6t_log_reg))
1988                 return -EINVAL;
1989 +       if (nflog)
1990 +               nf_log_register(PF_INET6, &ip6t_logfn);
1991
1992         return 0;
1993  }
1994
1995  static void __exit fini(void)
1996  {
1997 +       if (nflog)
1998 +               nf_log_register(PF_INET6, &ip6t_logfn);
1999 +
2000         ip6t_unregister_target(&ip6t_log_reg);
2001  }
2002
2003 diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/ip6t_TRACE.c linux-2.6.0-test9/net/ipv6/netfilter/ip6t_TRACE.c
2004 --- linux-2.6.0-test9.org/net/ipv6/netfilter/ip6t_TRACE.c       1970-01-01 01:00:00.000000000 +0100
2005 +++ linux-2.6.0-test9/net/ipv6/netfilter/ip6t_TRACE.c   2003-10-26 12:44:33.000000000 +0100
2006 @@ -0,0 +1,69 @@
2007 +/* This is a module which is used for setting
2008 + * the NFC_TRACE flag in the nfcache field of an skb.
2009 + */
2010 +#include <linux/module.h>
2011 +#include <linux/skbuff.h>
2012 +
2013 +#include <linux/netfilter_ipv6/ip6_tables.h>
2014 +
2015 +static unsigned int
2016 +target(struct sk_buff **pskb,
2017 +       unsigned int hooknum,
2018 +       const struct net_device *in,
2019 +       const struct net_device *out,
2020 +       const void *targinfo,
2021 +       void *userinfo)
2022 +{
2023 +       (*pskb)->nfcache |= NFC_TRACE;
2024 +       return IP6T_CONTINUE;
2025 +}
2026 +
2027 +static int
2028 +checkentry(const char *tablename,
2029 +                  const struct ip6t_entry *e,
2030 +           void *targinfo,
2031 +           unsigned int targinfosize,
2032 +           unsigned int hook_mask)
2033 +{
2034 +       if (targinfosize != 0) {
2035 +               printk(KERN_WARNING "TRACE: targinfosize %u != 0\n",
2036 +                      targinfosize);
2037 +               return 0;
2038 +       }
2039 +
2040 +       if (strcmp(tablename, "raw") != 0) {
2041 +               printk(KERN_WARNING "TRACE: can only be called from \"raw\" table, not \"%s\"\n", tablename);
2042 +               return 0;
2043 +       }
2044 +
2045 +       return 1;
2046 +}
2047 +
2048 +static struct ip6t_target ip6t_trace_reg = {
2049 +       .name = "TRACE",
2050 +       .target = target,
2051 +       .checkentry = checkentry,
2052 +       .destroy = NULL,
2053 +       .me = THIS_MODULE,
2054 +};
2055 +
2056 +static int __init init(void)
2057 +{
2058 +       if (ip6t_register_target(&ip6t_trace_reg))
2059 +               return -EINVAL;
2060 +
2061 +       return 0;
2062 +}
2063 +
2064 +static void __exit fini(void)
2065 +{
2066 +       ip6t_unregister_target(&ip6t_trace_reg);
2067 +}
2068 +
2069 +module_init(init);
2070 +module_exit(fini);
2071 +
2072 +MODULE_LICENSE("GPL");
2073 +MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
2074 +MODULE_DESCRIPTION("IPv6 TRACE target");
2075 +
2076 \ No newline at end of file
2077 diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/ip6table_filter.c linux-2.6.0-test9/net/ipv6/netfilter/ip6table_filter.c
2078 --- linux-2.6.0-test9.org/net/ipv6/netfilter/ip6table_filter.c  2003-10-25 20:42:53.000000000 +0200
2079 +++ linux-2.6.0-test9/net/ipv6/netfilter/ip6table_filter.c      2003-10-26 12:44:33.000000000 +0100
2080 @@ -52,7 +52,7 @@
2081                 0,
2082                 sizeof(struct ip6t_entry),
2083                 sizeof(struct ip6t_standard),
2084 -               0, { 0, 0 }, { } },
2085 +               0, NULL, 0, { 0, 0 }, { } },
2086               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2087                 -NF_ACCEPT - 1 } },
2088             /* FORWARD */
2089 @@ -60,7 +60,7 @@
2090                 0,
2091                 sizeof(struct ip6t_entry),
2092                 sizeof(struct ip6t_standard),
2093 -               0, { 0, 0 }, { } },
2094 +               0, NULL, 0, { 0, 0 }, { } },
2095               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2096                 -NF_ACCEPT - 1 } },
2097             /* LOCAL_OUT */
2098 @@ -68,7 +68,7 @@
2099                 0,
2100                 sizeof(struct ip6t_entry),
2101                 sizeof(struct ip6t_standard),
2102 -               0, { 0, 0 }, { } },
2103 +               0, NULL, 0, { 0, 0 }, { } },
2104               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2105                 -NF_ACCEPT - 1 } }
2106      },
2107 @@ -77,7 +77,7 @@
2108         0,
2109         sizeof(struct ip6t_entry),
2110         sizeof(struct ip6t_error),
2111 -       0, { 0, 0 }, { } },
2112 +       0, NULL, 0, { 0, 0 }, { } },
2113        { { { { IP6T_ALIGN(sizeof(struct ip6t_error_target)), IP6T_ERROR_TARGET } },
2114           { } },
2115         "ERROR"
2116 diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/ip6table_mangle.c linux-2.6.0-test9/net/ipv6/netfilter/ip6table_mangle.c
2117 --- linux-2.6.0-test9.org/net/ipv6/netfilter/ip6table_mangle.c  2003-10-25 20:43:26.000000000 +0200
2118 +++ linux-2.6.0-test9/net/ipv6/netfilter/ip6table_mangle.c      2003-10-26 12:44:33.000000000 +0100
2119 @@ -66,7 +66,7 @@
2120                 0,
2121                 sizeof(struct ip6t_entry),
2122                 sizeof(struct ip6t_standard),
2123 -               0, { 0, 0 }, { } },
2124 +               0, NULL, 0, { 0, 0 }, { } },
2125               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2126                 -NF_ACCEPT - 1 } },
2127             /* LOCAL_IN */
2128 @@ -74,7 +74,7 @@
2129                 0,
2130                 sizeof(struct ip6t_entry),
2131                 sizeof(struct ip6t_standard),
2132 -               0, { 0, 0 }, { } },
2133 +               0, NULL, 0, { 0, 0 }, { } },
2134               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2135                 -NF_ACCEPT - 1 } },
2136             /* FORWARD */
2137 @@ -82,7 +82,7 @@
2138                 0,
2139                 sizeof(struct ip6t_entry),
2140                 sizeof(struct ip6t_standard),
2141 -               0, { 0, 0 }, { } },
2142 +               0, NULL, 0, { 0, 0 }, { } },
2143               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2144                 -NF_ACCEPT - 1 } },
2145             /* LOCAL_OUT */
2146 @@ -90,7 +90,7 @@
2147                 0,
2148                 sizeof(struct ip6t_entry),
2149                 sizeof(struct ip6t_standard),
2150 -               0, { 0, 0 }, { } },
2151 +               0, NULL, 0, { 0, 0 }, { } },
2152               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2153                 -NF_ACCEPT - 1 } },
2154             /* POST_ROUTING */
2155 @@ -98,7 +98,7 @@
2156                 0,
2157                 sizeof(struct ip6t_entry),
2158                 sizeof(struct ip6t_standard),
2159 -               0, { 0, 0 }, { } },
2160 +               0, NULL, 0, { 0, 0 }, { } },
2161               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2162                 -NF_ACCEPT - 1 } }
2163      },
2164 @@ -107,7 +107,7 @@
2165         0,
2166         sizeof(struct ip6t_entry),
2167         sizeof(struct ip6t_error),
2168 -       0, { 0, 0 }, { } },
2169 +       0, NULL, 0, { 0, 0 }, { } },
2170        { { { { IP6T_ALIGN(sizeof(struct ip6t_error_target)), IP6T_ERROR_TARGET } },
2171           { } },
2172         "ERROR"
2173 diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/ip6table_raw.c linux-2.6.0-test9/net/ipv6/netfilter/ip6table_raw.c
2174 --- linux-2.6.0-test9.org/net/ipv6/netfilter/ip6table_raw.c     1970-01-01 01:00:00.000000000 +0100
2175 +++ linux-2.6.0-test9/net/ipv6/netfilter/ip6table_raw.c 2003-10-26 12:44:33.000000000 +0100
2176 @@ -0,0 +1,158 @@
2177 +/*
2178 + * IPv6 raw table, a port of the IPv4 raw table to IPv6
2179 + *
2180 + * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
2181 + */
2182 +#include <linux/module.h>
2183 +#include <linux/netfilter_ipv6/ip6_tables.h>
2184 +
2185 +#define RAW_VALID_HOOKS ((1 << NF_IP6_PRE_ROUTING) | (1 << NF_IP6_LOCAL_OUT))
2186 +
2187 +#if 0
2188 +#define DEBUGP(x, args...)     printk(KERN_DEBUG x, ## args)
2189 +#else
2190 +#define DEBUGP(x, args...)
2191 +#endif
2192 +
2193 +/* Standard entry. */
2194 +struct ip6t_standard
2195 +{
2196 +       struct ip6t_entry entry;
2197 +       struct ip6t_standard_target target;
2198 +};
2199 +
2200 +struct ip6t_error_target
2201 +{
2202 +       struct ip6t_entry_target target;
2203 +       char errorname[IP6T_FUNCTION_MAXNAMELEN];
2204 +};
2205 +
2206 +struct ip6t_error
2207 +{
2208 +       struct ip6t_entry entry;
2209 +       struct ip6t_error_target target;
2210 +};
2211 +
2212 +static struct
2213 +{
2214 +       struct ip6t_replace repl;
2215 +       struct ip6t_standard entries[2];
2216 +       struct ip6t_error term;
2217 +} initial_table __initdata
2218 += { { "raw", RAW_VALID_HOOKS, 3,
2219 +      sizeof(struct ip6t_standard) * 2 + sizeof(struct ip6t_error),
2220 +      { [NF_IP6_PRE_ROUTING]   0,
2221 +       [NF_IP6_LOCAL_OUT]      sizeof(struct ip6t_standard) },
2222 +      { [NF_IP6_PRE_ROUTING]   0,
2223 +       [NF_IP6_LOCAL_OUT]      sizeof(struct ip6t_standard) },
2224 +      0, NULL, { } },
2225 +    {
2226 +           /* PRE_ROUTING */
2227 +            { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
2228 +               0,
2229 +               sizeof(struct ip6t_entry),
2230 +               sizeof(struct ip6t_standard),
2231 +               0, NULL, 0, { 0, 0 }, { } },
2232 +             { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2233 +               -NF_ACCEPT - 1 } },
2234 +           /* LOCAL_OUT */
2235 +            { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
2236 +               0,
2237 +               sizeof(struct ip6t_entry),
2238 +               sizeof(struct ip6t_standard),
2239 +               0, NULL, 0, { 0, 0 }, { } },
2240 +             { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2241 +               -NF_ACCEPT - 1 } },
2242 +    },
2243 +    /* ERROR */
2244 +    { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
2245 +       0,
2246 +       sizeof(struct ip6t_entry),
2247 +       sizeof(struct ip6t_error),
2248 +       0, NULL, 0, { 0, 0 }, { } },
2249 +      { { { { IP6T_ALIGN(sizeof(struct ip6t_error_target)), IP6T_ERROR_TARGET } },
2250 +         { } },
2251 +       "ERROR"
2252 +      }
2253 +    }
2254 +};
2255 +
2256 +static struct ip6t_table packet_raw = {
2257 +       .name = "raw",
2258 +       .table = &initial_table.repl,
2259 +       .valid_hooks = RAW_VALID_HOOKS,
2260 +       .lock = RW_LOCK_UNLOCKED,
2261 +       .me = THIS_MODULE
2262 +};
2263 +
2264 +/* The work comes in here from netfilter.c. */
2265 +static unsigned int
2266 +ip6t_hook(unsigned int hook,
2267 +        struct sk_buff **pskb,
2268 +        const struct net_device *in,
2269 +        const struct net_device *out,
2270 +        int (*okfn)(struct sk_buff *))
2271 +{
2272 +       return ip6t_do_table(pskb, hook, in, out, &packet_raw, NULL);
2273 +}
2274 +
2275 +static struct nf_hook_ops ip6t_ops[] = {
2276 +       { /* PRE_ROUTING */
2277 +               .hook = ip6t_hook,
2278 +               .owner = THIS_MODULE,
2279 +               .pf = PF_INET6,
2280 +               .hooknum = NF_IP6_PRE_ROUTING,
2281 +               .priority = NF_IP6_PRI_FIRST,
2282 +       },
2283 +       { /* LOCAL_OUT */
2284 +               .hook = ip6t_hook,
2285 +               .owner = THIS_MODULE,
2286 +               .pf = PF_INET6,
2287 +               .hooknum = NF_IP6_LOCAL_OUT,
2288 +               .priority = NF_IP6_PRI_FIRST,
2289 +       },
2290 +};
2291 +
2292 +static int __init init(void)
2293 +{
2294 +       int ret;
2295 +
2296 +       /* Register table */
2297 +       ret = ip6t_register_table(&packet_raw);
2298 +       if (ret < 0)
2299 +               return ret;
2300 +
2301 +       /* Register hooks */
2302 +       ret = nf_register_hook(&ip6t_ops[0]);
2303 +       if (ret < 0)
2304 +               goto cleanup_table;
2305 +
2306 +       ret = nf_register_hook(&ip6t_ops[1]);
2307 +       if (ret < 0)
2308 +               goto cleanup_hook0;
2309 +
2310 +       return ret;
2311 +
2312 + cleanup_hook0:
2313 +       nf_unregister_hook(&ip6t_ops[0]);
2314 + cleanup_table:
2315 +       ip6t_unregister_table(&packet_raw);
2316 +
2317 +       return ret;
2318 +}
2319 +
2320 +static void __exit fini(void)
2321 +{
2322 +       unsigned int i;
2323 +
2324 +       for (i = 0; i < sizeof(ip6t_ops)/sizeof(struct nf_hook_ops); i++)
2325 +               nf_unregister_hook(&ip6t_ops[i]);
2326 +
2327 +       ip6t_unregister_table(&packet_raw);
2328 +}
2329 +
2330 +module_init(init);
2331 +module_exit(fini);
2332 +MODULE_LICENSE("GPL");
2333 +MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
2334 +MODULE_DESCRIPTION("IPv6 raw table");
2335 diff -Nur linux-2.6.0-test9.org/netfilter-patch-o-matic/patches linux-2.6.0-test9/netfilter-patch-o-matic/patches
2336 --- linux-2.6.0-test9.org/netfilter-patch-o-matic/patches       1970-01-01 01:00:00.000000000 +0100
2337 +++ linux-2.6.0-test9/netfilter-patch-o-matic/patches   2003-10-26 12:45:17.000000000 +0100
2338 @@ -0,0 +1,10 @@
2339 +./base/01_sctp_match.patch
2340 +./pending/40_nf-log.patch
2341 +./pending/25-err-ptr.patch
2342 +./pending/26-memsets.patch
2343 +./pending/70_expect-evict-order.patch
2344 +./pending/71_raw.patch
2345 +./submitted/02_REJECT-headroom-tcprst.patch
2346 +./submitted/03_260t4-mirror-remove.patch
2347 +./submitted/03_physdev_bridged.patch
2348 +./submitted/04_260t4-unclean-remove.patch