2.6.5-patch-o-matic-ng-extra-20040330.patch

   1 diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ip_conntrack.h
   2 --- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ip_conntrack.h     2004-03-30 20:32:42.000000000 +0200
   3 +++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ip_conntrack.h 2004-03-30 20:37:46.505753064 +0200
   4 @@ -206,6 +206,10 @@
   5         } nat;
   6  #endif /* CONFIG_IP_NF_NAT_NEEDED */
   7
   8 +#if defined(CONFIG_IP_NF_CONNTRACK_MARK)
   9 +       unsigned long mark;
  10 +#endif
  11 +
  12  };
  13
  14  /* get master conntrack via master expectation */
  15 diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_connmark.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_connmark.h
  16 --- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_connmark.h     1970-01-01 01:00:00.000000000 +0100
  17 +++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_connmark.h 2004-03-30 20:37:46.488755648 +0200
  18 @@ -0,0 +1,18 @@
  19 +#ifndef _IPT_CONNMARK_H
  20 +#define _IPT_CONNMARK_H
  21 +
  22 +/* Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
  23 + * by Henrik Nordstrom <hno@marasystems.com>
  24 + *
  25 + * This program is free software; you can redistribute it and/or modify
  26 + * it under the terms of the GNU General Public License as published by
  27 + * the Free Software Foundation; either version 2 of the License, or
  28 + * (at your option) any later version.
  29 + */
  30 +
  31 +struct ipt_connmark_info {
  32 +       unsigned long mark, mask;
  33 +       u_int8_t invert;
  34 +};
  35 +
  36 +#endif /*_IPT_CONNMARK_H*/
  37 diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_CONNMARK.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_CONNMARK.h
  38 --- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_CONNMARK.h     1970-01-01 01:00:00.000000000 +0100
  39 +++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_CONNMARK.h 2004-03-30 20:37:46.474757776 +0200
  40 @@ -0,0 +1,25 @@
  41 +#ifndef _IPT_CONNMARK_H_target
  42 +#define _IPT_CONNMARK_H_target
  43 +
  44 +/* Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
  45 + * by Henrik Nordstrom <hno@marasystems.com>
  46 + *
  47 + * This program is free software; you can redistribute it and/or modify
  48 + * it under the terms of the GNU General Public License as published by
  49 + * the Free Software Foundation; either version 2 of the License, or
  50 + * (at your option) any later version.
  51 + */
  52 +
  53 +enum {
  54 +       IPT_CONNMARK_SET = 0,
  55 +       IPT_CONNMARK_SAVE,
  56 +       IPT_CONNMARK_RESTORE
  57 +};
  58 +
  59 +struct ipt_connmark_target_info {
  60 +       unsigned long mark;
  61 +       unsigned long mask;
  62 +       u_int8_t mode;
  63 +};
  64 +
  65 +#endif /*_IPT_CONNMARK_H_target*/
  66 diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_conntrack_core.c linux-2.6.5-rc3/net/ipv4/netfilter/ip_conntrack_core.c
  67 --- linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_conntrack_core.c  2004-03-30 20:32:42.000000000 +0200
  68 +++ linux-2.6.5-rc3/net/ipv4/netfilter/ip_conntrack_core.c      2004-03-30 20:37:46.513751848 +0200
  69 @@ -717,6 +717,9 @@
  70                  __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
  71                  conntrack->master = expected;
  72                  expected->sibling = conntrack;
  73 +#if CONFIG_IP_NF_CONNTRACK_MARK
  74 +               conntrack->mark = expected->expectant->mark;
  75 +#endif
  76                  LIST_DELETE(&ip_conntrack_expect_list, expected);
  77                  expected->expectant->expecting--;
  78                  nf_conntrack_get(&master_ct(conntrack)->infos[0]);
  79 diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.6.5-rc3/net/ipv4/netfilter/ip_conntrack_standalone.c
  80 --- linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_conntrack_standalone.c    2004-03-30 20:32:42.000000000 +0200
  81 +++ linux-2.6.5-rc3/net/ipv4/netfilter/ip_conntrack_standalone.c        2004-03-30 20:37:46.512752000 +0200
  82 @@ -110,6 +110,9 @@
  83                 len += sprintf(buffer + len, "[ASSURED] ");
  84         len += sprintf(buffer + len, "use=%u ",
  85                        atomic_read(&conntrack->ct_general.use));
  86 +#if defined(CONFIG_IP_NF_CONNTRACK_MARK)
  87 +       len += sprintf(buffer + len, "mark=%ld ", conntrack->mark);
  88 +#endif
  89         len += sprintf(buffer + len, "\n");
  90
  91         return len;
  92 diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_connmark.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_connmark.c
  93 --- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_connmark.c       1970-01-01 01:00:00.000000000 +0100
  94 +++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_connmark.c   2004-03-30 20:37:46.501753672 +0200
  95 @@ -0,0 +1,81 @@
  96 +/* This kernel module matches connection mark values set by the
  97 + * CONNMARK target
  98 + *
  99 + * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
 100 + * by Henrik Nordstrom <hno@marasystems.com>
 101 + *
 102 + * This program is free software; you can redistribute it and/or modify
 103 + * it under the terms of the GNU General Public License as published by
 104 + * the Free Software Foundation; either version 2 of the License, or
 105 + * (at your option) any later version.
 106 + *
 107 + * This program is distributed in the hope that it will be useful,
 108 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 109 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 110 + * GNU General Public License for more details.
 111 + *
 112 + * You should have received a copy of the GNU General Public License
 113 + * along with this program; if not, write to the Free Software
 114 + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 115 + */
 116 +
 117 +#include <linux/module.h>
 118 +#include <linux/skbuff.h>
 119 +
 120 +MODULE_AUTHOR("Henrik Nordstrom <hno@marasytems.com>");
 121 +MODULE_DESCRIPTION("IP tables connmark match module");
 122 +MODULE_LICENSE("GPL");
 123 +
 124 +#include <linux/netfilter_ipv4/ip_tables.h>
 125 +#include <linux/netfilter_ipv4/ipt_connmark.h>
 126 +#include <linux/netfilter_ipv4/ip_conntrack.h>
 127 +
 128 +static int
 129 +match(const struct sk_buff *skb,
 130 +      const struct net_device *in,
 131 +      const struct net_device *out,
 132 +      const void *matchinfo,
 133 +      int offset,
 134 +      int *hotdrop)
 135 +{
 136 +       const struct ipt_connmark_info *info = matchinfo;
 137 +       enum ip_conntrack_info ctinfo;
 138 +       struct ip_conntrack *ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
 139 +       if (!ct)
 140 +               return 0;
 141 +
 142 +       return ((ct->mark & info->mask) == info->mark) ^ info->invert;
 143 +}
 144 +
 145 +static int
 146 +checkentry(const char *tablename,
 147 +          const struct ipt_ip *ip,
 148 +          void *matchinfo,
 149 +          unsigned int matchsize,
 150 +          unsigned int hook_mask)
 151 +{
 152 +       if (matchsize != IPT_ALIGN(sizeof(struct ipt_connmark_info)))
 153 +               return 0;
 154 +
 155 +       return 1;
 156 +}
 157 +
 158 +static struct ipt_match connmark_match = {
 159 +       .name = "connmark",
 160 +       .match = &match,
 161 +       .checkentry = &checkentry,
 162 +       .me = THIS_MODULE
 163 +};
 164 +
 165 +static int __init init(void)
 166 +{
 167 +       return ipt_register_match(&connmark_match);
 168 +}
 169 +
 170 +static void __exit fini(void)
 171 +{
 172 +       ipt_unregister_match(&connmark_match);
 173 +}
 174 +
 175 +module_init(init);
 176 +module_exit(fini);
 177 diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_CONNMARK.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_CONNMARK.c
 178 --- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_CONNMARK.c       1970-01-01 01:00:00.000000000 +0100
 179 +++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_CONNMARK.c   2004-03-30 20:37:46.500753824 +0200
 180 @@ -0,0 +1,118 @@
 181 +/* This kernel module is used to modify the connection mark values, or
 182 + * to optionally restore the skb nfmark from the connection mark
 183 + *
 184 + * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
 185 + * by Henrik Nordstrom <hno@marasystems.com>
 186 + *
 187 + * This program is free software; you can redistribute it and/or modify
 188 + * it under the terms of the GNU General Public License as published by
 189 + * the Free Software Foundation; either version 2 of the License, or
 190 + * (at your option) any later version.
 191 + *
 192 + * This program is distributed in the hope that it will be useful,
 193 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 194 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 195 + * GNU General Public License for more details.
 196 + *
 197 + * You should have received a copy of the GNU General Public License
 198 + * along with this program; if not, write to the Free Software
 199 + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 200 + */
 201 +#include <linux/module.h>
 202 +#include <linux/skbuff.h>
 203 +#include <linux/ip.h>
 204 +#include <net/checksum.h>
 205 +
 206 +MODULE_AUTHOR("Henrik Nordstrom <hno@marasytems.com>");
 207 +MODULE_DESCRIPTION("IP tables CONNMARK matching module");
 208 +MODULE_LICENSE("GPL");
 209 +
 210 +#include <linux/netfilter_ipv4/ip_tables.h>
 211 +#include <linux/netfilter_ipv4/ipt_CONNMARK.h>
 212 +#include <linux/netfilter_ipv4/ip_conntrack.h>
 213 +
 214 +static unsigned int
 215 +target(struct sk_buff **pskb,
 216 +       const struct net_device *in,
 217 +       const struct net_device *out,
 218 +       unsigned int hooknum,
 219 +       const void *targinfo,
 220 +       void *userinfo)
 221 +{
 222 +       const struct ipt_connmark_target_info *markinfo = targinfo;
 223 +       unsigned long diff;
 224 +       unsigned long nfmark;
 225 +       unsigned long newmark;
 226 +
 227 +       enum ip_conntrack_info ctinfo;
 228 +       struct ip_conntrack *ct = ip_conntrack_get((*pskb), &ctinfo);
 229 +       if (ct) {
 230 +           switch(markinfo->mode) {
 231 +           case IPT_CONNMARK_SET:
 232 +               newmark = (ct->mark & ~markinfo->mask) | markinfo->mark;
 233 +               if (newmark != ct->mark)
 234 +                   ct->mark = newmark;
 235 +               break;
 236 +           case IPT_CONNMARK_SAVE:
 237 +               newmark = (ct->mark & ~markinfo->mask) | ((*pskb)->nfmark & markinfo->mask);
 238 +               if (ct->mark != newmark)
 239 +                   ct->mark = newmark;
 240 +               break;
 241 +           case IPT_CONNMARK_RESTORE:
 242 +               nfmark = (*pskb)->nfmark;
 243 +               diff = (ct->mark ^ nfmark & markinfo->mask);
 244 +               if (diff != 0) {
 245 +                   (*pskb)->nfmark = nfmark ^ diff;
 246 +                   (*pskb)->nfcache |= NFC_ALTERED;
 247 +               }
 248 +               break;
 249 +           }
 250 +       }
 251 +
 252 +       return IPT_CONTINUE;
 253 +}
 254 +
 255 +static int
 256 +checkentry(const char *tablename,
 257 +          const struct ipt_entry *e,
 258 +          void *targinfo,
 259 +          unsigned int targinfosize,
 260 +          unsigned int hook_mask)
 261 +{
 262 +       struct ipt_connmark_target_info *matchinfo = targinfo;
 263 +       if (targinfosize != IPT_ALIGN(sizeof(struct ipt_connmark_target_info))) {
 264 +               printk(KERN_WARNING "CONNMARK: targinfosize %u != %Zu\n",
 265 +                      targinfosize,
 266 +                      IPT_ALIGN(sizeof(struct ipt_connmark_target_info)));
 267 +               return 0;
 268 +       }
 269 +
 270 +       if (matchinfo->mode == IPT_CONNMARK_RESTORE) {
 271 +           if (strcmp(tablename, "mangle") != 0) {
 272 +                   printk(KERN_WARNING "CONNMARK: restore can only be called from \"mangle\" table, not \"%s\"\n", tablename);
 273 +                   return 0;
 274 +           }
 275 +       }
 276 +
 277 +       return 1;
 278 +}
 279 +
 280 +static struct ipt_target ipt_connmark_reg = {
 281 +       .name = "CONNMARK",
 282 +       .target = &target,
 283 +       .checkentry = &checkentry,
 284 +       .me = THIS_MODULE
 285 +};
 286 +
 287 +static int __init init(void)
 288 +{
 289 +       return ipt_register_target(&ipt_connmark_reg);
 290 +}
 291 +
 292 +static void __exit fini(void)
 293 +{
 294 +       ipt_unregister_target(&ipt_connmark_reg);
 295 +}
 296 +
 297 +module_init(init);
 298 +module_exit(fini);
 299 diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_helper.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_helper.c
 300 --- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_helper.c 2004-03-30 20:32:42.000000000 +0200
 301 +++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_helper.c     2004-03-30 20:38:09.307286704 +0200
 302 @@ -71,8 +71,11 @@
 303         DEBUGP("master's name = %s , info->name = %s\n",
 304                 exp->expectant->helper->name, info->name);
 305
 306 -       ret ^= !strncmp(exp->expectant->helper->name, info->name,
 307 -                       strlen(exp->expectant->helper->name));
 308 +       if (info->name[0] == '\0')
 309 +               ret ^= 1;
 310 +       else
 311 +               ret ^= !strncmp(exp->expectant->helper->name, info->name,
 312 +                               strlen(exp->expectant->helper->name));
 313  out_unlock:
 314         READ_UNLOCK(&ip_conntrack_lock);
 315         return ret;
 316 @@ -92,10 +95,6 @@
 317         if (matchsize != IPT_ALIGN(sizeof(struct ipt_helper_info)))
 318                 return 0;
 319
 320 -       /* verify that we actually should match anything */
 321 -       if ( strlen(info->name) == 0 )
 322 -               return 0;
 323 -
 324         return 1;
 325  }
 326
 327 diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/Kconfig linux-2.6.5-rc3/net/ipv4/netfilter/Kconfig
 328 --- linux-2.6.5-rc3.org/net/ipv4/netfilter/Kconfig      2004-03-30 20:32:42.000000000 +0200
 329 +++ linux-2.6.5-rc3/net/ipv4/netfilter/Kconfig  2004-03-30 20:37:46.503753368 +0200
 330 @@ -706,5 +706,15 @@
 331         depends on IP_NF_IPTABLES
 332           help
 333
 334 +config IP_NF_CONNTRACK_MARK
 335 +       bool  'Connection mark tracking support'
 336 +config IP_NF_TARGET_CONNMARK
 337 +       tristate  'CONNMARK target support'
 338 +       depends on IP_NF_MANGLE
 339 +config IP_NF_MATCH_CONNMARK
 340 +       tristate  ' Connection mark match support'
 341 +       depends on IP_NF_IPTABLES
 342 +         help
 343 +
 344  endmenu
 345
 346 diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/Makefile linux-2.6.5-rc3/net/ipv4/netfilter/Makefile
 347 --- linux-2.6.5-rc3.org/net/ipv4/netfilter/Makefile     2004-03-30 20:32:42.000000000 +0200
 348 +++ linux-2.6.5-rc3/net/ipv4/netfilter/Makefile 2004-03-30 20:37:46.507752760 +0200
 349 @@ -89,6 +89,7 @@
 350
 351  obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
 352  obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
 353 +obj-$(CONFIG_IP_NF_MATCH_CONNMARK) += ipt_connmark.o
 354  obj-$(CONFIG_IP_NF_MATCH_CONNLIMIT) += ipt_connlimit.o
 355  obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
 356  obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
 357 @@ -110,6 +111,7 @@
 358  obj-$(CONFIG_IP_NF_TARGET_CLASSIFY) += ipt_CLASSIFY.o
 359  obj-$(CONFIG_IP_NF_NAT_SNMP_BASIC) += ip_nat_snmp_basic.o
 360  obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
 361 +obj-$(CONFIG_IP_NF_TARGET_CONNMARK) += ipt_CONNMARK.o
 362  obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
 363  obj-$(CONFIG_IP_NF_TARGET_NETLINK) += ipt_NETLINK.o
 364  obj-$(CONFIG_IP_NF_TARGET_IPV4OPTSSTRIP) += ipt_IPV4OPTSSTRIP.o