2.6.4-rc1-03-CONNMARK.patch

   1 diff -uNr linux-2.6.4-rc1/include/linux.orig/netfilter_ipv4/ip_conntrack.h linux-2.6.4-rc1/include/linux/netfilter_ipv4/ip_conntrack.h
   2 --- linux-2.6.4-rc1/include/linux.orig/netfilter_ipv4/ip_conntrack.h    2004-03-03 03:30:33.000000000 +0100
   3 +++ linux-2.6.4-rc1/include/linux/netfilter_ipv4/ip_conntrack.h 2004-03-03 03:58:03.401720416 +0100
   4 @@ -206,6 +206,9 @@
   5         } nat;
   6  #endif /* CONFIG_IP_NF_NAT_NEEDED */
   7
   8 +#if defined(CONFIG_IP_NF_CONNTRACK_MARK)
   9 +       unsigned long mark;
  10 +#endif
  11  };
  12
  13  /* get master conntrack via master expectation */
  14 diff -uNr linux-2.6.4-rc1/include/linux.orig/netfilter_ipv4/ipt_connmark.h linux-2.6.4-rc1/include/linux/netfilter_ipv4/ipt_connmark.h
  15 --- linux-2.6.4-rc1/include/linux.orig/netfilter_ipv4/ipt_connmark.h    1970-01-01 01:00:00.000000000 +0100
  16 +++ linux-2.6.4-rc1/include/linux/netfilter_ipv4/ipt_connmark.h 2004-03-03 03:58:03.402720264 +0100
  17 @@ -0,0 +1,9 @@
  18 +#ifndef _IPT_CONNMARK_H
  19 +#define _IPT_CONNMARK_H
  20 +
  21 +struct ipt_connmark_info {
  22 +       unsigned long mark, mask;
  23 +       u_int8_t invert;
  24 +};
  25 +
  26 +#endif /*_IPT_CONNMARK_H*/
  27 diff -uNr linux-2.6.4-rc1/include/linux.orig/netfilter_ipv4/ipt_CONNMARK.h linux-2.6.4-rc1/include/linux/netfilter_ipv4/ipt_CONNMARK.h
  28 --- linux-2.6.4-rc1/include/linux.orig/netfilter_ipv4/ipt_CONNMARK.h    1970-01-01 01:00:00.000000000 +0100
  29 +++ linux-2.6.4-rc1/include/linux/netfilter_ipv4/ipt_CONNMARK.h 2004-03-03 03:58:03.402720264 +0100
  30 @@ -0,0 +1,15 @@
  31 +#ifndef _IPT_CONNMARK_H_target
  32 +#define _IPT_CONNMARK_H_target
  33 +
  34 +enum {
  35 +    IPT_CONNMARK_SET = 0,
  36 +    IPT_CONNMARK_SAVE,
  37 +    IPT_CONNMARK_RESTORE
  38 +};
  39 +
  40 +struct ipt_connmark_target_info {
  41 +       unsigned long mark, mask;
  42 +       u_int8_t mode;
  43 +};
  44 +
  45 +#endif /*_IPT_CONNMARK_H_target*/
  46 diff -uNr linux-2.6.4-rc1/net/ipv4.orig/netfilter/ip_conntrack_core.c linux-2.6.4-rc1/net/ipv4/netfilter/ip_conntrack_core.c
  47 --- linux-2.6.4-rc1/net/ipv4.orig/netfilter/ip_conntrack_core.c 2004-03-03 03:30:33.000000000 +0100
  48 +++ linux-2.6.4-rc1/net/ipv4/netfilter/ip_conntrack_core.c      2004-03-03 03:58:03.418717832 +0100
  49 @@ -718,6 +718,9 @@
  50                 __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
  51                 conntrack->master = expected;
  52                 expected->sibling = conntrack;
  53 +#if CONFIG_IP_NF_CONNTRACK_MARK
  54 +               conntrack->mark = expected->expectant->mark;
  55 +#endif
  56                 LIST_DELETE(&ip_conntrack_expect_list, expected);
  57                 expected->expectant->expecting--;
  58                 nf_conntrack_get(&master_ct(conntrack)->infos[0]);
  59 diff -uNr linux-2.6.4-rc1/net/ipv4.orig/netfilter/ip_conntrack_standalone.c linux-2.6.4-rc1/net/ipv4/netfilter/ip_conntrack_standalone.c
  60 --- linux-2.6.4-rc1/net/ipv4.orig/netfilter/ip_conntrack_standalone.c   2004-03-03 03:30:33.000000000 +0100
  61 +++ linux-2.6.4-rc1/net/ipv4/netfilter/ip_conntrack_standalone.c        2004-03-03 03:58:03.420717528 +0100
  62 @@ -110,6 +110,9 @@
  63                 len += sprintf(buffer + len, "[ASSURED] ");
  64         len += sprintf(buffer + len, "use=%u ",
  65                        atomic_read(&conntrack->ct_general.use));
  66 +#if defined(CONFIG_IP_NF_CONNTRACK_MARK)
  67 +       len += sprintf(buffer + len, "mark=%ld ", conntrack->mark);
  68 +#endif
  69         len += sprintf(buffer + len, "\n");
  70
  71         return len;
  72 diff -uNr linux-2.6.4-rc1/net/ipv4.orig/netfilter/ipt_connmark.c linux-2.6.4-rc1/net/ipv4/netfilter/ipt_connmark.c
  73 --- linux-2.6.4-rc1/net/ipv4.orig/netfilter/ipt_connmark.c      1970-01-01 01:00:00.000000000 +0100
  74 +++ linux-2.6.4-rc1/net/ipv4/netfilter/ipt_connmark.c   2004-03-03 03:58:03.429716160 +0100
  75 @@ -0,0 +1,57 @@
  76 +/* Kernel module to match connection mark values. */
  77 +#include <linux/module.h>
  78 +#include <linux/skbuff.h>
  79 +
  80 +#include <linux/netfilter_ipv4/ip_tables.h>
  81 +#include <linux/netfilter_ipv4/ipt_connmark.h>
  82 +#include <linux/netfilter_ipv4/ip_conntrack.h>
  83 +
  84 +static int
  85 +match(const struct sk_buff *skb,
  86 +      const struct net_device *in,
  87 +      const struct net_device *out,
  88 +      const void *matchinfo,
  89 +      int offset,
  90 +      int *hotdrop)
  91 +{
  92 +       const struct ipt_connmark_info *info = matchinfo;
  93 +       enum ip_conntrack_info ctinfo;
  94 +       struct ip_conntrack *ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
  95 +       if (!ct)
  96 +           return 0;
  97 +
  98 +       return ((ct->mark & info->mask) == info->mark) ^ info->invert;
  99 +}
 100 +
 101 +static int
 102 +checkentry(const char *tablename,
 103 +           const struct ipt_ip *ip,
 104 +           void *matchinfo,
 105 +           unsigned int matchsize,
 106 +           unsigned int hook_mask)
 107 +{
 108 +       if (matchsize != IPT_ALIGN(sizeof(struct ipt_connmark_info)))
 109 +               return 0;
 110 +
 111 +       return 1;
 112 +}
 113 +
 114 +static struct ipt_match connmark_match = {
 115 +       .name           = "connmark",
 116 +       .match          = &match,
 117 +       .checkentry     = &checkentry,
 118 +       .me             = THIS_MODULE
 119 +};
 120 +
 121 +static int __init init(void)
 122 +{
 123 +       return ipt_register_match(&connmark_match);
 124 +}
 125 +
 126 +static void __exit fini(void)
 127 +{
 128 +       ipt_unregister_match(&connmark_match);
 129 +}
 130 +
 131 +module_init(init);
 132 +module_exit(fini);
 133 diff -uNr linux-2.6.4-rc1/net/ipv4.orig/netfilter/ipt_CONNMARK.c linux-2.6.4-rc1/net/ipv4/netfilter/ipt_CONNMARK.c
 134 --- linux-2.6.4-rc1/net/ipv4.orig/netfilter/ipt_CONNMARK.c      1970-01-01 01:00:00.000000000 +0100
 135 +++ linux-2.6.4-rc1/net/ipv4/netfilter/ipt_CONNMARK.c   2004-03-03 03:58:03.427716464 +0100
 136 @@ -0,0 +1,91 @@
 137 +/* This is a module which is used for setting/remembering the mark field of
 138 + * an connection, or optionally restore it to the skb
 139 + */
 140 +#include <linux/module.h>
 141 +#include <linux/skbuff.h>
 142 +#include <linux/ip.h>
 143 +#include <net/checksum.h>
 144 +
 145 +#include <linux/netfilter_ipv4/ip_tables.h>
 146 +#include <linux/netfilter_ipv4/ipt_CONNMARK.h>
 147 +#include <linux/netfilter_ipv4/ip_conntrack.h>
 148 +
 149 +static unsigned int
 150 +target(struct sk_buff **pskb,
 151 +       const struct net_device *in,
 152 +       const struct net_device *out,
 153 +       unsigned int hooknum,
 154 +       const void *targinfo,
 155 +       void *userinfo)
 156 +{
 157 +       const struct ipt_connmark_target_info *markinfo = targinfo;
 158 +
 159 +       enum ip_conntrack_info ctinfo;
 160 +       struct ip_conntrack *ct = ip_conntrack_get((*pskb), &ctinfo);
 161 +       if (ct) {
 162 +           switch(markinfo->mode) {
 163 +           case IPT_CONNMARK_SET:
 164 +               ct->mark = markinfo->mark;
 165 +               break;
 166 +           case IPT_CONNMARK_SAVE:
 167 +               ct->mark = (*pskb)->nfmark;
 168 +               break;
 169 +           case IPT_CONNMARK_RESTORE:
 170 +               if (ct->mark != (*pskb)->nfmark) {
 171 +                   (*pskb)->nfmark = ct->mark;
 172 +                   (*pskb)->nfcache |= NFC_ALTERED;
 173 +               }
 174 +               break;
 175 +           }
 176 +       }
 177 +
 178 +       return IPT_CONTINUE;
 179 +}
 180 +
 181 +static int
 182 +checkentry(const char *tablename,
 183 +          const struct ipt_entry *e,
 184 +           void *targinfo,
 185 +           unsigned int targinfosize,
 186 +           unsigned int hook_mask)
 187 +{
 188 +       struct ipt_connmark_target_info *matchinfo = targinfo;
 189 +       if (targinfosize != IPT_ALIGN(sizeof(struct ipt_connmark_target_info))) {
 190 +               printk(KERN_WARNING "CONNMARK: targinfosize %u != %Zu\n",
 191 +                      targinfosize,
 192 +                      IPT_ALIGN(sizeof(struct ipt_connmark_target_info)));
 193 +               return 0;
 194 +       }
 195 +
 196 +       if (matchinfo->mode == IPT_CONNMARK_RESTORE) {
 197 +           if (strcmp(tablename, "mangle") != 0) {
 198 +                   printk(KERN_WARNING "CONNMARK: restore can only be called from \"mangle\" table, not \"%s\"\n", tablename);
 199 +                   return 0;
 200 +           }
 201 +       }
 202 +
 203 +       return 1;
 204 +}
 205 +
 206 +static struct ipt_target ipt_connmark_reg = {
 207 +       .name           = "CONNMARK",
 208 +       .target         = target,
 209 +       .checkentry     = checkentry,
 210 +       .me             = THIS_MODULE
 211 +};
 212 +
 213 +static int __init init(void)
 214 +{
 215 +       if (ipt_register_target(&ipt_connmark_reg))
 216 +               return -EINVAL;
 217 +
 218 +       return 0;
 219 +}
 220 +
 221 +static void __exit fini(void)
 222 +{
 223 +       ipt_unregister_target(&ipt_connmark_reg);
 224 +}
 225 +
 226 +module_init(init);
 227 +module_exit(fini);
 228 diff -uNr linux-2.6.4-rc1/net/ipv4.orig/netfilter/Kconfig linux-2.6.4-rc1/net/ipv4/netfilter/Kconfig
 229 --- linux-2.6.4-rc1/net/ipv4.orig/netfilter/Kconfig     2004-03-03 03:43:30.000000000 +0100
 230 +++ linux-2.6.4-rc1/net/ipv4/netfilter/Kconfig  2004-03-03 03:58:03.414718440 +0100
 231 @@ -29,6 +29,15 @@
 232
 233           To compile it as a module, choose M here.  If unsure, say Y.
 234
 235 +config IP_NF_CONNTRACK_MARK
 236 +       bool "Connection mark tracking support"
 237 +       depends on IP_NF_CONNTRACK
 238 +       help
 239 +         This option enables support for connection marks, used by the
 240 +         `CONNMARK' target and `connmark' match. Similar to the mark value
 241 +         of packets, but this mark value is kept in the conntrack session
 242 +         instead of the individual packets.
 243 +
 244  config IP_NF_IRC
 245         tristate "IRC protocol support"
 246         depends on IP_NF_CONNTRACK
 247 @@ -244,6 +253,15 @@
 248
 249           To compile it as a module, choose M here.  If unsure, say N.
 250
 251 +config IP_NF_MATCH_CONNMARK
 252 +       tristate "Connection mark match support"
 253 +       depends on IP_NF_CONNTRACK_MARK && IP_NF_CONNTRACK && IP_NF_IPTABLES
 254 +       help
 255 +         This option adds a `connmark' match, which allows you to match the
 256 +         connection mark value previously set for the session by `CONNMARK'.
 257 +
 258 +         To compile it as a module, choose M here.  If unsure, say N.
 259 +
 260  config IP_NF_MATCH_CONNTRACK
 261         tristate "Connection tracking match support"
 262         depends on IP_NF_CONNTRACK && IP_NF_IPTABLES
 263 @@ -487,6 +505,17 @@
 264
 265           To compile it as a module, choose M here.  If unsure, say N.
 266
 267 +config IP_NF_TARGET_CONNMARK
 268 +       tristate "CONNMARK target support"
 269 +       depends on IP_NF_CONNTRACK_MARK && IP_NF_CONNTRACK && IP_NF_IPTABLES
 270 +       help
 271 +         This option adds a `CONNMARK' target, which allows one to manipulate
 272 +         the connection mark value.  Similar to the MARK target, but
 273 +         affects the connection mark value rather than the packet mark value.
 274 +
 275 +         To compile it as a module, choose M here, the module will be called
 276 +         ipt_CONNMARK.o.  If unsure, say N.
 277 +
 278  config IP_NF_TARGET_ULOG
 279         tristate "ULOG target support"
 280         depends on IP_NF_IPTABLES
 281 diff -uNr linux-2.6.4-rc1/net/ipv4.orig/netfilter/Makefile linux-2.6.4-rc1/net/ipv4/netfilter/Makefile
 282 --- linux-2.6.4-rc1/net/ipv4.orig/netfilter/Makefile    2004-03-03 03:43:30.000000000 +0100
 283 +++ linux-2.6.4-rc1/net/ipv4/netfilter/Makefile 2004-03-03 04:01:17.565203080 +0100
 284 @@ -76,6 +76,7 @@
 285  obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
 286  obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
 287  obj-$(CONFIG_IP_NF_MATCH_CONNLIMIT) += ipt_connlimit.o
 288 +obj-$(CONFIG_IP_NF_MATCH_CONNMARK) += ipt_connmark.o
 289  obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
 290  obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
 291  obj-$(CONFIG_IP_NF_MATCH_REALM) += ipt_realm.o
 292 @@ -97,6 +98,7 @@
 293  obj-$(CONFIG_IP_NF_NAT_SNMP_BASIC) += ip_nat_snmp_basic.o
 294  obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
 295  obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
 296 +obj-$(CONFIG_IP_NF_TARGET_CONNMARK) += ipt_CONNMARK.o
 297  obj-$(CONFIG_IP_NF_TARGET_IPV4OPTSSTRIP) += ipt_IPV4OPTSSTRIP.o
 298  obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
 299  obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o