]> git.pld-linux.org Git - packages/kernel.git/blame - 2.6.0-t9-netfilter-20031026.patch
projects / packages / kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- added description of djurban's branch
[packages/kernel.git] / 2.6.0-t9-netfilter-20031026.patch
CommitLineData
82758924 1diff -Nur linux-2.6.0-test9.org/include/linux/netfilter.h linux-2.6.0-test9/include/linux/netfilter.h
2--- linux-2.6.0-test9.org/include/linux/netfilter.h 2003-10-25 20:43:40.000000000 +0200
3+++ linux-2.6.0-test9/include/linux/netfilter.h 2003-10-26 12:44:33.000000000 +0100
4@@ -23,6 +23,7 @@
5 <= 0x2000 is used for protocol-flags. */
6 #define NFC_UNKNOWN 0x4000
7 #define NFC_ALTERED 0x8000
8+#define NFC_TRACE 0x10000
9
10 #ifdef __KERNEL__
11 #include <linux/config.h>
12@@ -99,6 +100,24 @@
13
14 extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
15
16+typedef void nf_logfn(unsigned int hooknum,
17+ const struct sk_buff *skb,
18+ const struct net_device *in,
19+ const struct net_device *out,
20+ const char *prefix);
21+
22+/* Function to register/unregister log function. */
23+int nf_log_register(int pf, nf_logfn *logfn);
24+void nf_log_unregister(int pf, nf_logfn *logfn);
25+
26+/* Calls the registered backend logging function */
27+void nf_log_packet(int pf,
28+ unsigned int hooknum,
29+ const struct sk_buff *skb,
30+ const struct net_device *in,
31+ const struct net_device *out,
32+ const char *fmt, ...);
33+
34 /* Activate hook; either okfn or kfree_skb called, unless a hook
35 returns NF_STOLEN (in which case, it's up to the hook to deal with
36 the consequences).
37diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.6.0-test9/include/linux/netfilter_ipv4/ip_conntrack.h
38--- linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ip_conntrack.h 2003-10-25 20:44:44.000000000 +0200
39+++ linux-2.6.0-test9/include/linux/netfilter_ipv4/ip_conntrack.h 2003-10-26 12:44:33.000000000 +0100
40@@ -268,6 +268,9 @@
41
42 extern unsigned int ip_conntrack_htable_size;
43
44+/* A fake conntrack entry which never vanishes. */
45+extern struct ip_conntrack ip_conntrack_untracked;
46+
47 /* eg. PROVIDES_CONNTRACK(ftp); */
48 #define PROVIDES_CONNTRACK(name) \
49 int needs_ip_conntrack_##name; \
50diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ip_tables.h linux-2.6.0-test9/include/linux/netfilter_ipv4/ip_tables.h
51--- linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ip_tables.h 2003-10-25 20:43:46.000000000 +0200
52+++ linux-2.6.0-test9/include/linux/netfilter_ipv4/ip_tables.h 2003-10-26 12:44:33.000000000 +0100
53@@ -134,6 +134,12 @@
54 /* Back pointer */
55 unsigned int comefrom;
56
57+ /* Name of the chain */
58+ char *chainname;
59+
60+ /* Rule number in the chain. */
61+ u_int32_t rulenum;
62+
63 /* Packet and byte counters. */
64 struct ipt_counters counters;
65
66diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_ULOG.h linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_ULOG.h
67--- linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_ULOG.h 2003-10-25 20:43:28.000000000 +0200
68+++ linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_ULOG.h 2003-10-26 12:44:13.000000000 +0100
69@@ -11,6 +11,9 @@
70 #define NETLINK_NFLOG 5
71 #endif
72
73+#define NFLOG_DEFAULT_NLGROUP 1
74+#define NFLOG_DEFAULT_QTHRESHOLD 1
75+
76 #define ULOG_MAC_LEN 80
77 #define ULOG_PREFIX_LEN 32
78
79diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_conntrack.h linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_conntrack.h
80--- linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_conntrack.h 2003-10-25 20:44:16.000000000 +0200
81+++ linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_conntrack.h 2003-10-26 12:44:33.000000000 +0100
82@@ -10,6 +10,7 @@
83
84 #define IPT_CONNTRACK_STATE_SNAT (1 << (IP_CT_NUMBER + 1))
85 #define IPT_CONNTRACK_STATE_DNAT (1 << (IP_CT_NUMBER + 2))
86+#define IPT_CONNTRACK_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 3))
87
88 /* flags, invflags: */
89 #define IPT_CONNTRACK_STATE 0x01
90diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_sctp.h linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_sctp.h
91--- linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_sctp.h 1970-01-01 01:00:00.000000000 +0100
92+++ linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_sctp.h 2003-10-26 12:44:43.000000000 +0100
93@@ -0,0 +1,25 @@
94+/* iptables module for matching the SCTP header
95+ *
96+ * (C) 2003 Harald Welte <laforge@gnumonks.org>
97+ *
98+ * This software is distributed under GNU GPL v2, 1991
99+ *
100+ * $Id$
101+ */
102+#ifndef _IPT_SCTP_H
103+#define _IPT_SCTP_H
104+
105+struct ipt_sctp_info {
106+ u_int16_t spts[2]; /* Souce port range */
107+ u_int16_t dpts[2]; /* Destination port range */
108+ u_int32_t chunks; /* chunks to be matched */
109+ u_int32_t chunk_mask; /* chunk mask to be matched */
110+ u_int8_t invflags; /* Inverse flags */
111+};
112+
113+#define IPT_SCTP_INV_SRCPT 0x01 /* Invert the sense of source ports */
114+#define IPT_SCTP_INV_DSTPT 0x02 /* Invert the sense of dest ports */
115+#define IPT_SCTP_INV_CHUNKS 0x03 /* Invert the sense of chunks */
116+#define IPT_SCTP_INV_MASK 0x03 /* All possible flags */
117+
118+#endif /* _IPT_SCTP_H */
119diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_state.h linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_state.h
120--- linux-2.6.0-test9.org/include/linux/netfilter_ipv4/ipt_state.h 2003-10-25 20:44:36.000000000 +0200
121+++ linux-2.6.0-test9/include/linux/netfilter_ipv4/ipt_state.h 2003-10-26 12:44:33.000000000 +0100
122@@ -4,6 +4,8 @@
123 #define IPT_STATE_BIT(ctinfo) (1 << ((ctinfo)%IP_CT_IS_REPLY+1))
124 #define IPT_STATE_INVALID (1 << 0)
125
126+#define IPT_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 1))
127+
128 struct ipt_state_info
129 {
130 unsigned int statemask;
131diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv4.h linux-2.6.0-test9/include/linux/netfilter_ipv4.h
132--- linux-2.6.0-test9.org/include/linux/netfilter_ipv4.h 2003-10-25 20:44:34.000000000 +0200
133+++ linux-2.6.0-test9/include/linux/netfilter_ipv4.h 2003-10-26 12:44:33.000000000 +0100
134@@ -51,6 +51,8 @@
135
136 enum nf_ip_hook_priorities {
137 NF_IP_PRI_FIRST = INT_MIN,
138+ NF_IP_PRI_CONNTRACK_DEFRAG = -400,
139+ NF_IP_PRI_RAW = -300,
140 NF_IP_PRI_CONNTRACK = -200,
141 NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
142 NF_IP_PRI_MANGLE = -150,
143diff -Nur linux-2.6.0-test9.org/include/linux/netfilter_ipv6/ip6_tables.h linux-2.6.0-test9/include/linux/netfilter_ipv6/ip6_tables.h
144--- linux-2.6.0-test9.org/include/linux/netfilter_ipv6/ip6_tables.h 2003-10-25 20:44:48.000000000 +0200
145+++ linux-2.6.0-test9/include/linux/netfilter_ipv6/ip6_tables.h 2003-10-26 12:44:33.000000000 +0100
146@@ -140,6 +140,12 @@
147 /* Back pointer */
148 unsigned int comefrom;
149
150+ /* Name of the chain */
151+ char *chainname;
152+
153+ /* Rule number in the chain. */
154+ u_int32_t rulenum;
155+
156 /* Packet and byte counters. */
157 struct ip6t_counters counters;
158
159diff -Nur linux-2.6.0-test9.org/net/bridge/br_netfilter.c linux-2.6.0-test9/net/bridge/br_netfilter.c
160--- linux-2.6.0-test9.org/net/bridge/br_netfilter.c 2003-10-25 20:44:49.000000000 +0200
161+++ linux-2.6.0-test9/net/bridge/br_netfilter.c 2003-10-26 12:43:43.000000000 +0100
162@@ -297,6 +297,8 @@
163 if (skb->pkt_type == PACKET_OTHERHOST) {
164 skb->pkt_type = PACKET_HOST;
165 nf_bridge->mask |= BRNF_PKT_TYPE;
166+ /* The physdev module checks on this */
167+ nf_bridge->mask |= BRNF_BRIDGED;
168 }
169
170 nf_bridge->mask |= BRNF_NF_BRIDGE_PREROUTING;
171diff -Nur linux-2.6.0-test9.org/net/core/netfilter.c linux-2.6.0-test9/net/core/netfilter.c
172--- linux-2.6.0-test9.org/net/core/netfilter.c 2003-10-25 20:43:34.000000000 +0200
173+++ linux-2.6.0-test9/net/core/netfilter.c 2003-10-26 12:44:13.000000000 +0100
174@@ -8,8 +8,10 @@
175 *
176 * February 2000: Modified by James Morris to have 1 queue per protocol.
177 * 15-Mar-2000: Added NF_REPEAT --RR.
178+ * 08-May-2003: Internal logging interface added by Jozsef Kadlecsik.
179 */
180 #include <linux/config.h>
181+#include <linux/kernel.h>
182 #include <linux/netfilter.h>
183 #include <net/protocol.h>
184 #include <linux/init.h>
185@@ -743,7 +745,70 @@
186 EXPORT_SYMBOL(skb_ip_make_writable);
187 #endif /*CONFIG_INET*/
188
189+/* Internal logging interface, which relies on the real
190+ LOG target modules */
191
192+#define NF_LOG_PREFIXLEN 128
193+
194+static nf_logfn *nf_logging[NPROTO]; /* = NULL */
195+static int reported = 0;
196+static spinlock_t nf_log_lock = SPIN_LOCK_UNLOCKED;
197+
198+int nf_log_register(int pf, nf_logfn *logfn)
199+{
200+ int ret = -EBUSY;
201+
202+ /* Any setup of logging members must be done before
203+ * substituting pointer. */
204+ smp_wmb();
205+ spin_lock(&nf_log_lock);
206+ if (!nf_logging[pf]) {
207+ nf_logging[pf] = logfn;
208+ ret = 0;
209+ }
210+ spin_unlock(&nf_log_lock);
211+ return ret;
212+}
213+
214+void nf_log_unregister(int pf, nf_logfn *logfn)
215+{
216+ spin_lock(&nf_log_lock);
217+ if (nf_logging[pf] == logfn)
218+ nf_logging[pf] = NULL;
219+ spin_unlock(&nf_log_lock);
220+
221+ /* Give time to concurrent readers. */
222+ synchronize_net();
223+}
224+
225+void nf_log_packet(int pf,
226+ unsigned int hooknum,
227+ const struct sk_buff *skb,
228+ const struct net_device *in,
229+ const struct net_device *out,
230+ const char *fmt, ...)
231+{
232+ va_list args;
233+ char prefix[NF_LOG_PREFIXLEN];
234+ nf_logfn *logfn;
235+
236+ rcu_read_lock();
237+ logfn = nf_logging[pf];
238+ if (logfn) {
239+ va_start(args, fmt);
240+ vsnprintf(prefix, sizeof(prefix), fmt, args);
241+ va_end(args);
242+ /* We must read logging before nf_logfn[pf] */
243+ smp_read_barrier_depends();
244+ logfn(hooknum, skb, in, out, prefix);
245+ } else if (!reported) {
246+ printk(KERN_WARNING "nf_log_packet: can\'t log yet, "
247+ "no backend logging module loaded in!\n");
248+ reported++;
249+ }
250+ rcu_read_unlock();
251+}
252+
253 /* This does not belong here, but ipt_REJECT needs it if connection
254 tracking in use: without this, connection may not be in hash table,
255 and hence manufactured ICMP or RST packets will not be associated
256@@ -773,3 +838,6 @@
257 EXPORT_SYMBOL(nf_unregister_hook);
258 EXPORT_SYMBOL(nf_unregister_queue_handler);
259 EXPORT_SYMBOL(nf_unregister_sockopt);
260+EXPORT_SYMBOL(nf_log_register);
261+EXPORT_SYMBOL(nf_log_unregister);
262+EXPORT_SYMBOL(nf_log_packet);
263diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/Kconfig linux-2.6.0-test9/net/ipv4/netfilter/Kconfig
264--- linux-2.6.0-test9.org/net/ipv4/netfilter/Kconfig 2003-10-25 20:44:33.000000000 +0200
265+++ linux-2.6.0-test9/net/ipv4/netfilter/Kconfig 2003-10-26 12:44:43.000000000 +0100
266@@ -197,6 +197,15 @@
267
268 To compile it as a module, choose M here. If unsure, say N.
269
270+config IP_NF_MATCH_SCTP
271+ tristate "SCTP match support"
272+ depends on IP_NF_IPTABLES
273+ help
274+ This match allows iptables to match on the SCTP header.
275+
276+ If you want to compile it as a module, say M here and read
277+ <file:Documentation/modules.txt>. If unsure, say `N'.
278+
279 config IP_NF_MATCH_LENGTH
280 tristate "LENGTH match support"
281 depends on IP_NF_IPTABLES
282@@ -527,6 +536,42 @@
283
284 To compile it as a module, choose M here. If unsure, say N.
285
286+config IP_NF_RAW
287+ tristate "Raw table"
288+ depends on IP_NF_IPTABLES
289+ help
290+ This option adds a `raw' table to iptables: see the man page for
291+ iptables(8). This table is the very first in the netfilter
292+ framework and hooks in at the PREROUTING and OUTPUT chains.
293+ The TRACE and NOTRACK targets can be used in this table only.
294+
295+ To compile it as a module, choose M here. If unsure, say N.
296+
297+config IP_NF_TARGET_TRACE
298+ tristate "TRACE target support"
299+ depends on IP_NF_RAW
300+ help
301+ The TRACE target allows packets to be traced as those matches
302+ any subsequent rule in any table/rule. The matched rule and
303+ the packet is logged with the prefix
304+
305+ TRACE: tablename/chainname/rulenum
306+
307+ if the ipt_LOG or ipt_ULOG targets are loaded in.
308+
309+ To compile it as a module, choose M here. If unsure, say N.
310+
311+config IP_NF_TARGET_NOTRACK
312+ tristate "NOTRACK target support"
313+ depends on IP_NF_RAW
314+ help
315+ The NOTRACK target allows a select rule to specify which
316+ packets *not* to enter the conntrack/NAT subsystems
317+ with all the consequences (no ICMP error tracking,
318+ no protocol helpers for the selected packets).
319+
320+ To compile it as a module, choose M here. If unsure, say N.
321+
322 config IP_NF_ARPTABLES
323 tristate "ARP tables support"
324
325diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/Makefile linux-2.6.0-test9/net/ipv4/netfilter/Makefile
326--- linux-2.6.0-test9.org/net/ipv4/netfilter/Makefile 2003-10-25 20:43:07.000000000 +0200
327+++ linux-2.6.0-test9/net/ipv4/netfilter/Makefile 2003-10-26 12:44:44.000000000 +0100
328@@ -34,12 +34,14 @@
329 # generic IP tables
330 obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
331
332-# the three instances of ip_tables
333+# the four instances of ip_tables
334 obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
335 obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
336 obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
337+obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
338
339 # matches
340+obj-$(CONFIG_IP_NF_MATCH_SCTP) += ipt_sctp.o
341 obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
342 obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
343 obj-$(CONFIG_IP_NF_MATCH_MARK) += ipt_mark.o
344@@ -81,6 +83,8 @@
345 obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
346 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
347 obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
348+obj-$(CONFIG_IP_NF_TARGET_NOTRACK) += ipt_NOTRACK.o
349+obj-$(CONFIG_IP_NF_TARGET_TRACE) += ipt_TRACE.o
350
351 # generic ARP tables
352 obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
353diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_conntrack_core.c linux-2.6.0-test9/net/ipv4/netfilter/ip_conntrack_core.c
354--- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_conntrack_core.c 2003-10-25 20:42:41.000000000 +0200
355+++ linux-2.6.0-test9/net/ipv4/netfilter/ip_conntrack_core.c 2003-10-26 12:44:33.000000000 +0100
356@@ -29,8 +29,7 @@
357 #include <linux/slab.h>
358 #include <linux/random.h>
359 #include <linux/jhash.h>
360-/* For ERR_PTR(). Yeah, I know... --RR */
361-#include <linux/fs.h>
362+#include <linux/err.h>
363
364 /* This rwlock protects the main hash table, protocol/helper/expected
365 registrations, conntrack timers*/
366@@ -63,6 +62,7 @@
367 static atomic_t ip_conntrack_count = ATOMIC_INIT(0);
368 struct list_head *ip_conntrack_hash;
369 static kmem_cache_t *ip_conntrack_cachep;
370+struct ip_conntrack ip_conntrack_untracked;
371
372 extern struct ip_conntrack_protocol ip_conntrack_generic_protocol;
373
374@@ -808,18 +808,10 @@
375 }
376 #endif
377
378- /* Previously seen (loopback)? Ignore. Do this before
379- fragment check. */
380+ /* Previously seen (loopback or untracked)? Ignore. */
381 if ((*pskb)->nfct)
382 return NF_ACCEPT;
383
384- /* Gather fragments. */
385- if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
386- *pskb = ip_ct_gather_frags(*pskb);
387- if (!*pskb)
388- return NF_STOLEN;
389- }
390-
391 proto = ip_ct_find_proto((*pskb)->nh.iph->protocol);
392
393 /* It may be an icmp error... */
394@@ -953,7 +945,6 @@
395 }
396 } else if (related_to->helper->max_expected &&
397 related_to->expecting >= related_to->helper->max_expected) {
398- struct list_head *cur_item;
399 /* old == NULL */
400 if (!(related_to->helper->flags &
401 IP_CT_HELPER_F_REUSE_EXPECT)) {
402@@ -978,21 +969,14 @@
403 NIPQUAD(related_to->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip));
404
405 /* choose the the oldest expectation to evict */
406- list_for_each(cur_item, &related_to->sibling_list) {
407- struct ip_conntrack_expect *cur;
408-
409- cur = list_entry(cur_item,
410- struct ip_conntrack_expect,
411- expected_list);
412- if (cur->sibling == NULL) {
413- old = cur;
414+ list_for_each_entry(old, &related_to->sibling_list,
415+ expected_list)
416+ if (old->sibling == NULL)
417 break;
418- }
419- }
420
421- /* (!old) cannot happen, since related_to->expecting is the
422- * number of unconfirmed expects */
423- IP_NF_ASSERT(old);
424+ /* We cannot fail since related_to->expecting is the number
425+ * of unconfirmed expectations */
426+ IP_NF_ASSERT(old && old->sibling == NULL);
427
428 /* newnat14 does not reuse the real allocated memory
429 * structures but rather unexpects the old and
430@@ -1024,7 +1008,7 @@
431 atomic_set(&new->use, 1);
432
433 /* add to expected list for this connection */
434- list_add(&new->expected_list, &related_to->sibling_list);
435+ list_add_tail(&new->expected_list, &related_to->sibling_list);
436 /* add to global list of expectations */
437 list_prepend(&ip_conntrack_expect_list, &new->list);
438 /* add and start timer if required */
439@@ -1419,6 +1403,15 @@
440
441 /* For use by ipt_REJECT */
442 ip_ct_attach = ip_conntrack_attach;
443+
444+ /* Set up fake conntrack:
445+ - to never be deleted, not in any hashes */
446+ atomic_set(&ip_conntrack_untracked.ct_general.use, 1);
447+ /* - and look it like as a confirmed connection */
448+ set_bit(IPS_CONFIRMED_BIT, &ip_conntrack_untracked.status);
449+ /* - and prepare the ctinfo field for NAT. */
450+ ip_conntrack_untracked.infos[IP_CT_NEW].master = &ip_conntrack_untracked.ct_general;
451+
452 return ret;
453
454 err_free_hash:
455diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.6.0-test9/net/ipv4/netfilter/ip_conntrack_standalone.c
456--- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_conntrack_standalone.c 2003-10-25 20:43:32.000000000 +0200
457+++ linux-2.6.0-test9/net/ipv4/netfilter/ip_conntrack_standalone.c 2003-10-26 12:44:33.000000000 +0100
458@@ -186,6 +186,26 @@
459 return ip_conntrack_confirm(*pskb);
460 }
461
462+static unsigned int ip_conntrack_defrag(unsigned int hooknum,
463+ struct sk_buff **pskb,
464+ const struct net_device *in,
465+ const struct net_device *out,
466+ int (*okfn)(struct sk_buff *))
467+{
468+ /* Previously seen (loopback)? Ignore. Do this before
469+ fragment check. */
470+ if ((*pskb)->nfct)
471+ return NF_ACCEPT;
472+
473+ /* Gather fragments. */
474+ if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
475+ *pskb = ip_ct_gather_frags(*pskb);
476+ if (!*pskb)
477+ return NF_STOLEN;
478+ }
479+ return NF_ACCEPT;
480+}
481+
482 static unsigned int ip_refrag(unsigned int hooknum,
483 struct sk_buff **pskb,
484 const struct net_device *in,
485@@ -225,6 +245,15 @@
486 return ip_conntrack_in(hooknum, pskb, in, out, okfn);
487 }
488
489+/* At the very first: defragment */
490+static struct nf_hook_ops ip_conntrack_defrag_ops = {
491+ .hook = ip_conntrack_defrag,
492+ .owner = THIS_MODULE,
493+ .pf = PF_INET,
494+ .hooknum = NF_IP_PRE_ROUTING,
495+ .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
496+};
497+
498 /* Connection tracking may drop packets, but never alters them, so
499 make it the first hook. */
500 static struct nf_hook_ops ip_conntrack_in_ops = {
501@@ -367,10 +396,15 @@
502 if (!proc) goto cleanup_init;
503 proc->owner = THIS_MODULE;
504
505+ ret = nf_register_hook(&ip_conntrack_defrag_ops);
506+ if (ret < 0) {
507+ printk("ip_conntrack: can't register pre-routing hook to defrag.\n");
508+ goto cleanup_proc;
509+ }
510 ret = nf_register_hook(&ip_conntrack_in_ops);
511 if (ret < 0) {
512 printk("ip_conntrack: can't register pre-routing hook.\n");
513- goto cleanup_proc;
514+ goto cleanup_defragops;
515 }
516 ret = nf_register_hook(&ip_conntrack_local_out_ops);
517 if (ret < 0) {
518@@ -408,6 +442,8 @@
519 nf_unregister_hook(&ip_conntrack_local_out_ops);
520 cleanup_inops:
521 nf_unregister_hook(&ip_conntrack_in_ops);
522+ cleanup_defragops:
523+ nf_unregister_hook(&ip_conntrack_defrag_ops);
524 cleanup_proc:
525 proc_net_remove("ip_conntrack");
526 cleanup_init:
527@@ -499,5 +535,6 @@
528 EXPORT_SYMBOL(ip_conntrack_expect_list);
529 EXPORT_SYMBOL(ip_conntrack_lock);
530 EXPORT_SYMBOL(ip_conntrack_hash);
531+EXPORT_SYMBOL(ip_conntrack_untracked);
532 EXPORT_SYMBOL_GPL(ip_conntrack_find_get);
533 EXPORT_SYMBOL_GPL(ip_conntrack_put);
534diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_conntrack_tftp.c linux-2.6.0-test9/net/ipv4/netfilter/ip_conntrack_tftp.c
535--- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_conntrack_tftp.c 2003-10-25 20:43:19.000000000 +0200
536+++ linux-2.6.0-test9/net/ipv4/netfilter/ip_conntrack_tftp.c 2003-10-26 12:44:03.000000000 +0100
537@@ -97,8 +97,6 @@
538
539 for (i = 0 ; (i < MAX_PORTS) && ports[i] ; i++) {
540 /* Create helper structure */
541- memset(&tftp[i], 0, sizeof(struct ip_conntrack_helper));
542-
543 tftp[i].tuple.dst.protonum = IPPROTO_UDP;
544 tftp[i].tuple.src.u.udp.port = htons(ports[i]);
545 tftp[i].mask.dst.protonum = 0xFFFF;
546diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_amanda.c linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_amanda.c
547--- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_amanda.c 2003-10-25 20:43:06.000000000 +0200
548+++ linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_amanda.c 2003-10-26 12:44:03.000000000 +0100
549@@ -195,8 +195,6 @@
550 struct ip_nat_helper *hlpr;
551
552 hlpr = &ip_nat_amanda_helper;
553- memset(hlpr, 0, sizeof(struct ip_nat_helper));
554-
555 hlpr->tuple.dst.protonum = IPPROTO_UDP;
556 hlpr->tuple.src.u.udp.port = htons(10080);
557 hlpr->mask.src.u.udp.port = 0xFFFF;
558diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_core.c linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_core.c
559--- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_core.c 2003-10-25 20:43:01.000000000 +0200
560+++ linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_core.c 2003-10-26 12:44:33.000000000 +0100
561@@ -809,7 +809,7 @@
562
563 /* Have to grab read lock before sibling_list traversal */
564 READ_LOCK(&ip_conntrack_lock);
565- list_for_each(cur_item, &ct->sibling_list) {
566+ list_for_each_prev(cur_item, &ct->sibling_list) {
567 exp = list_entry(cur_item, struct ip_conntrack_expect,
568 expected_list);
569
570@@ -1009,7 +1009,11 @@
571 /* FIXME: Man, this is a hack. <SIGH> */
572 IP_NF_ASSERT(ip_conntrack_destroyed == NULL);
573 ip_conntrack_destroyed = &ip_nat_cleanup_conntrack;
574-
575+
576+ /* Initialize fake conntrack so that NAT will skip it */
577+ ip_conntrack_untracked.nat.info.initialized |=
578+ (1 << IP_NAT_MANIP_SRC) | (1 << IP_NAT_MANIP_DST);
579+
580 return 0;
581 }
582
583diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_rule.c linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_rule.c
584--- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_rule.c 2003-10-25 20:43:27.000000000 +0200
585+++ linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_rule.c 2003-10-26 12:44:33.000000000 +0100
586@@ -67,7 +67,7 @@
587 0,
588 sizeof(struct ipt_entry),
589 sizeof(struct ipt_standard),
590- 0, { 0, 0 }, { } },
591+ 0, NULL, 0, { 0, 0 }, { } },
592 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
593 -NF_ACCEPT - 1 } },
594 /* POST_ROUTING */
595@@ -75,7 +75,7 @@
596 0,
597 sizeof(struct ipt_entry),
598 sizeof(struct ipt_standard),
599- 0, { 0, 0 }, { } },
600+ 0, NULL, 0, { 0, 0 }, { } },
601 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
602 -NF_ACCEPT - 1 } },
603 /* LOCAL_OUT */
604@@ -83,7 +83,7 @@
605 0,
606 sizeof(struct ipt_entry),
607 sizeof(struct ipt_standard),
608- 0, { 0, 0 }, { } },
609+ 0, NULL, 0, { 0, 0 }, { } },
610 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
611 -NF_ACCEPT - 1 } }
612 },
613@@ -92,7 +92,7 @@
614 0,
615 sizeof(struct ipt_entry),
616 sizeof(struct ipt_error),
617- 0, { 0, 0 }, { } },
618+ 0, NULL, 0, { 0, 0 }, { } },
619 { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
620 { } },
621 "ERROR"
622diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_tftp.c linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_tftp.c
623--- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_nat_tftp.c 2003-10-25 20:43:18.000000000 +0200
624+++ linux-2.6.0-test9/net/ipv4/netfilter/ip_nat_tftp.c 2003-10-26 12:44:03.000000000 +0100
625@@ -164,8 +164,6 @@
626 ports[0] = TFTP_PORT;
627
628 for (i = 0 ; (i < MAX_PORTS) && ports[i] ; i++) {
629- memset(&tftp[i], 0, sizeof(struct ip_nat_helper));
630-
631 tftp[i].tuple.dst.protonum = IPPROTO_UDP;
632 tftp[i].tuple.src.u.udp.port = htons(ports[i]);
633 tftp[i].mask.dst.protonum = 0xFFFF;
634diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ip_tables.c linux-2.6.0-test9/net/ipv4/netfilter/ip_tables.c
635--- linux-2.6.0-test9.org/net/ipv4/netfilter/ip_tables.c 2003-10-25 20:43:11.000000000 +0200
636+++ linux-2.6.0-test9/net/ipv4/netfilter/ip_tables.c 2003-10-26 12:44:33.000000000 +0100
637@@ -11,6 +11,7 @@
638 #include <linux/config.h>
639 #include <linux/cache.h>
640 #include <linux/skbuff.h>
641+#include <linux/socket.h>
642 #include <linux/kmod.h>
643 #include <linux/vmalloc.h>
644 #include <linux/netdevice.h>
645@@ -23,8 +24,17 @@
646 #include <asm/semaphore.h>
647 #include <linux/proc_fs.h>
648
649+#include <linux/netfilter.h>
650 #include <linux/netfilter_ipv4/ip_tables.h>
651
652+static const char *hooknames[] = {
653+ [NF_IP_PRE_ROUTING] "PREROUTING",
654+ [NF_IP_LOCAL_IN] "INPUT",
655+ [NF_IP_FORWARD] "FORWARD",
656+ [NF_IP_LOCAL_OUT] "OUTPUT",
657+ [NF_IP_POST_ROUTING] "POSTROUTING",
658+};
659+
660 MODULE_LICENSE("GPL");
661 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
662 MODULE_DESCRIPTION("IPv4 packet filter");
663@@ -322,6 +332,12 @@
664
665 t = ipt_get_target(e);
666 IP_NF_ASSERT(t->u.kernel.target);
667+
668+ /* The packet traced and the rule isn't an unconditional return/END. */
669+ if (((*pskb)->nfcache & NFC_TRACE) && e->rulenum) {
670+ nf_log_packet(AF_INET, hook, *pskb, in, out, "TRACE: %s/%s/%u ",
671+ table->name, e->chainname, e->rulenum);
672+ }
673 /* Standard target? */
674 if (!t->u.kernel.target->target) {
675 int v;
676@@ -474,6 +490,29 @@
677 return find_inlist_lock(&ipt_target, name, "ipt_", error, mutex);
678 }
679
680+static inline int
681+find_error_target(struct ipt_entry *s,
682+ struct ipt_entry *e,
683+ char **chainname)
684+{
685+ struct ipt_entry_target *t;
686+ static struct ipt_entry *found = NULL;
687+
688+ if (s == e) {
689+ if (!found)
690+ return 0;
691+ t = ipt_get_target(found);
692+ if (strcmp(t->u.user.name,
693+ IPT_ERROR_TARGET) == 0) {
694+ *chainname = t->data;
695+ return 1;
696+ }
697+ } else
698+ found = s;
699+
700+ return 0;
701+}
702+
703 /* All zeroes == unconditional rule. */
704 static inline int
705 unconditional(const struct ipt_ip *ip)
706@@ -493,6 +532,8 @@
707 mark_source_chains(struct ipt_table_info *newinfo, unsigned int valid_hooks)
708 {
709 unsigned int hook;
710+ char *chainname = NULL;
711+ u_int32_t rulenum;
712
713 /* No recursion; use packet counter to save back ptrs (reset
714 to 0 as we leave), and comefrom to save source hook bitmask */
715@@ -506,6 +547,8 @@
716
717 /* Set initial back pointer. */
718 e->counters.pcnt = pos;
719+ rulenum = 1;
720+ chainname = (char *) hooknames[hook];
721
722 for (;;) {
723 struct ipt_standard_target *t
724@@ -518,6 +561,8 @@
725 }
726 e->comefrom
727 |= ((1 << hook) | (1 << NF_IP_NUMHOOKS));
728+ e->rulenum = rulenum++;
729+ e->chainname = chainname;
730
731 /* Unconditional return/END. */
732 if (e->target_offset == sizeof(struct ipt_entry)
733@@ -527,6 +572,10 @@
734 && unconditional(&e->ip)) {
735 unsigned int oldpos, size;
736
737+ /* Set unconditional rulenum to zero. */
738+ e->rulenum = 0;
739+ e->counters.bcnt = 0;
740+
741 /* Return: backtrack through the last
742 big jump. */
743 do {
744@@ -552,6 +601,11 @@
745 (newinfo->entries + pos);
746 } while (oldpos == pos + e->next_offset);
747
748+ /* Restore chainname, rulenum. */
749+ chainname = e->chainname;
750+ rulenum = e->counters.bcnt;
751+ e->counters.bcnt = 0;
752+
753 /* Move along one */
754 size = e->next_offset;
755 e = (struct ipt_entry *)
756@@ -567,6 +621,17 @@
757 /* This a jump; chase it. */
758 duprintf("Jump rule %u -> %u\n",
759 pos, newpos);
760+ e->counters.bcnt = rulenum++;
761+ rulenum = 1;
762+ e = (struct ipt_entry *)
763+ (newinfo->entries + newpos);
764+ if (IPT_ENTRY_ITERATE(newinfo->entries,
765+ newinfo->size,
766+ find_error_target,
767+ e, &chainname) == 0) {
768+ printk("ip_tables: table screwed up!\n");
769+ return 0;
770+ }
771 } else {
772 /* ... this is a fallthru */
773 newpos = pos + e->next_offset;
774diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_LOG.c linux-2.6.0-test9/net/ipv4/netfilter/ipt_LOG.c
775--- linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_LOG.c 2003-10-25 20:44:37.000000000 +0200
776+++ linux-2.6.0-test9/net/ipv4/netfilter/ipt_LOG.c 2003-10-26 12:44:13.000000000 +0100
777@@ -4,12 +4,14 @@
778 #include <linux/module.h>
779 #include <linux/spinlock.h>
780 #include <linux/skbuff.h>
781+#include <linux/socket.h>
782 #include <linux/ip.h>
783 #include <net/icmp.h>
784 #include <net/udp.h>
785 #include <net/tcp.h>
786 #include <net/route.h>
787
788+#include <linux/netfilter.h>
789 #include <linux/netfilter_ipv4/ip_tables.h>
790 #include <linux/netfilter_ipv4/ipt_LOG.h>
791
792@@ -17,6 +19,10 @@
793 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
794 MODULE_DESCRIPTION("iptables syslog logging module");
795
796+static unsigned int nflog = 1;
797+MODULE_PARM(nflog, "i");
798+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
799+
800 #if 0
801 #define DEBUGP printk
802 #else
803@@ -315,28 +321,25 @@
804 /* maxlen = 230+ 91 + 230 + 252 = 803 */
805 }
806
807-static unsigned int
808-ipt_log_target(struct sk_buff **pskb,
809+static void
810+ipt_log_packet(unsigned int hooknum,
811+ const struct sk_buff *skb,
812 const struct net_device *in,
813 const struct net_device *out,
814- unsigned int hooknum,
815- const void *targinfo,
816- void *userinfo)
817+ const struct ipt_log_info *loginfo,
818+ const char *level_string,
819+ const char *prefix)
820 {
821- const struct ipt_log_info *loginfo = targinfo;
822- char level_string[4] = "< >";
823-
824- level_string[1] = '0' + (loginfo->level % 8);
825 spin_lock_bh(&log_lock);
826 printk(level_string);
827 printk("%sIN=%s OUT=%s ",
828- loginfo->prefix,
829+ prefix == NULL ? loginfo->prefix : prefix,
830 in ? in->name : "",
831 out ? out->name : "");
832 #ifdef CONFIG_BRIDGE_NETFILTER
833- if ((*pskb)->nf_bridge) {
834- struct net_device *physindev = (*pskb)->nf_bridge->physindev;
835- struct net_device *physoutdev = (*pskb)->nf_bridge->physoutdev;
836+ if (skb->nf_bridge) {
837+ struct net_device *physindev = skb->nf_bridge->physindev;
838+ struct net_device *physoutdev = skb->nf_bridge->physoutdev;
839
840 if (physindev && in != physindev)
841 printk("PHYSIN=%s ", physindev->name);
842@@ -348,25 +351,56 @@
843 if (in && !out) {
844 /* MAC logging for input chain only. */
845 printk("MAC=");
846- if ((*pskb)->dev && (*pskb)->dev->hard_header_len
847- && (*pskb)->mac.raw != (void*)(*pskb)->nh.iph) {
848+ if (skb->dev && skb->dev->hard_header_len
849+ && skb->mac.raw != (void*)skb->nh.iph) {
850 int i;
851- unsigned char *p = (*pskb)->mac.raw;
852- for (i = 0; i < (*pskb)->dev->hard_header_len; i++,p++)
853+ unsigned char *p = skb->mac.raw;
854+ for (i = 0; i < skb->dev->hard_header_len; i++,p++)
855 printk("%02x%c", *p,
856- i==(*pskb)->dev->hard_header_len - 1
857+ i==skb->dev->hard_header_len - 1
858 ? ' ':':');
859 } else
860 printk(" ");
861 }
862
863- dump_packet(loginfo, *pskb, 0);
864+ dump_packet(loginfo, skb, 0);
865 printk("\n");
866 spin_unlock_bh(&log_lock);
867+}
868+
869+static unsigned int
870+ipt_log_target(struct sk_buff **pskb,
871+ const struct net_device *in,
872+ const struct net_device *out,
873+ unsigned int hooknum,
874+ const void *targinfo,
875+ void *userinfo)
876+{
877+ const struct ipt_log_info *loginfo = targinfo;
878+ char level_string[4] = "< >";
879+
880+ level_string[1] = '0' + (loginfo->level % 8);
881+ ipt_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
882
883 return IPT_CONTINUE;
884 }
885
886+static void
887+ipt_logfn(unsigned int hooknum,
888+ const struct sk_buff *skb,
889+ const struct net_device *in,
890+ const struct net_device *out,
891+ const char *prefix)
892+{
893+ struct ipt_log_info loginfo = {
894+ .level = 0,
895+ .logflags = IPT_LOG_MASK,
896+ .prefix = ""
897+ };
898+
899+ ipt_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
900+}
901+
902 static int ipt_log_checkentry(const char *tablename,
903 const struct ipt_entry *e,
904 void *targinfo,
905@@ -406,12 +440,17 @@
906 {
907 if (ipt_register_target(&ipt_log_reg))
908 return -EINVAL;
909+ if (nflog)
910+ nf_log_register(PF_INET, &ipt_logfn);
911
912 return 0;
913 }
914
915 static void __exit fini(void)
916 {
917+ if (nflog)
918+ nf_log_unregister(PF_INET, &ipt_logfn);
919+
920 ipt_unregister_target(&ipt_log_reg);
921 }
922
923diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_NOTRACK.c linux-2.6.0-test9/net/ipv4/netfilter/ipt_NOTRACK.c
924--- linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_NOTRACK.c 1970-01-01 01:00:00.000000000 +0100
925+++ linux-2.6.0-test9/net/ipv4/netfilter/ipt_NOTRACK.c 2003-10-26 12:44:33.000000000 +0100
926@@ -0,0 +1,79 @@
927+/* This is a module which is used for setting up fake conntracks
928+ * on packets so that they are not seen by the conntrack/NAT code.
929+ */
930+#include <linux/module.h>
931+#include <linux/skbuff.h>
932+
933+#include <linux/netfilter_ipv4/ip_tables.h>
934+#include <linux/netfilter_ipv4/ip_conntrack.h>
935+
936+static unsigned int
937+target(struct sk_buff **pskb,
938+ const struct net_device *in,
939+ const struct net_device *out,
940+ unsigned int hooknum,
941+ const void *targinfo,
942+ void *userinfo)
943+{
944+ /* Previously seen (loopback)? Ignore. */
945+ if ((*pskb)->nfct != NULL)
946+ return IPT_CONTINUE;
947+
948+ /* Attach fake conntrack entry.
949+ If there is a real ct entry correspondig to this packet,
950+ it'll hang aroun till timing out. We don't deal with it
951+ for performance reasons. JK */
952+ (*pskb)->nfct = &ip_conntrack_untracked.infos[IP_CT_NEW];
953+ nf_conntrack_get((*pskb)->nfct);
954+
955+ return IPT_CONTINUE;
956+}
957+
958+static int
959+checkentry(const char *tablename,
960+ const struct ipt_entry *e,
961+ void *targinfo,
962+ unsigned int targinfosize,
963+ unsigned int hook_mask)
964+{
965+ if (targinfosize != 0) {
966+ printk(KERN_WARNING "NOTRACK: targinfosize %u != 0\n",
967+ targinfosize);
968+ return 0;
969+ }
970+
971+ if (strcmp(tablename, "raw") != 0) {
972+ printk(KERN_WARNING "NOTRACK: can only be called from \"raw\" table, not \"%s\"\n", tablename);
973+ return 0;
974+ }
975+
976+ return 1;
977+}
978+
979+static struct ipt_target ipt_notrack_reg = {
980+ .name = "NOTRACK",
981+ .target = target,
982+ .checkentry = checkentry,
983+ .destroy = NULL,
984+ .me = THIS_MODULE,
985+};
986+
987+static int __init init(void)
988+{
989+ if (ipt_register_target(&ipt_notrack_reg))
990+ return -EINVAL;
991+
992+ return 0;
993+}
994+
995+static void __exit fini(void)
996+{
997+ ipt_unregister_target(&ipt_notrack_reg);
998+}
999+
1000+module_init(init);
1001+module_exit(fini);
1002+
1003+MODULE_LICENSE("GPL");
1004+MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1005+MODULE_DESCRIPTION("IPv4 NOTRACK target");
1006diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_TRACE.c linux-2.6.0-test9/net/ipv4/netfilter/ipt_TRACE.c
1007--- linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_TRACE.c 1970-01-01 01:00:00.000000000 +0100
1008+++ linux-2.6.0-test9/net/ipv4/netfilter/ipt_TRACE.c 2003-10-26 12:44:33.000000000 +0100
1009@@ -0,0 +1,67 @@
1010+/* This is a module which is used for setting
1011+ * the NFC_TRACE flag in the nfcache field of an skb.
1012+ */
1013+#include <linux/module.h>
1014+#include <linux/skbuff.h>
1015+
1016+#include <linux/netfilter_ipv4/ip_tables.h>
1017+
1018+static unsigned int
1019+target(struct sk_buff **pskb,
1020+ const struct net_device *in,
1021+ const struct net_device *out,
1022+ unsigned int hooknum,
1023+ const void *targinfo,
1024+ void *userinfo)
1025+{
1026+ (*pskb)->nfcache |= NFC_TRACE;
1027+ return IPT_CONTINUE;
1028+}
1029+
1030+static int
1031+checkentry(const char *tablename,
1032+ const struct ipt_entry *e,
1033+ void *targinfo,
1034+ unsigned int targinfosize,
1035+ unsigned int hook_mask)
1036+{
1037+ if (targinfosize != 0) {
1038+ printk(KERN_WARNING "TRACE: targinfosize %u != 0\n",
1039+ targinfosize);
1040+ return 0;
1041+ }
1042+
1043+ if (strcmp(tablename, "raw") != 0) {
1044+ printk(KERN_WARNING "TRACE: can only be called from \"raw\" table, not \"%s\"\n", tablename);
1045+ return 0;
1046+ }
1047+
1048+ return 1;
1049+}
1050+
1051+static struct ipt_target ipt_trace_reg = {
1052+ .name = "TRACE",
1053+ .target = target,
1054+ .checkentry = checkentry,
1055+ .destroy = NULL,
1056+ .me = THIS_MODULE,
1057+};
1058+
1059+static int __init init(void)
1060+{
1061+ if (ipt_register_target(&ipt_trace_reg))
1062+ return -EINVAL;
1063+
1064+ return 0;
1065+}
1066+
1067+static void __exit fini(void)
1068+{
1069+ ipt_unregister_target(&ipt_trace_reg);
1070+}
1071+
1072+module_init(init);
1073+module_exit(fini);
1074+MODULE_LICENSE("GPL");
1075+MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1076+MODULE_DESCRIPTION("IPv4 TRACE target");
1077diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_ULOG.c linux-2.6.0-test9/net/ipv4/netfilter/ipt_ULOG.c
1078--- linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_ULOG.c 2003-10-25 20:43:22.000000000 +0200
1079+++ linux-2.6.0-test9/net/ipv4/netfilter/ipt_ULOG.c 2003-10-26 12:44:13.000000000 +0100
1080@@ -45,6 +45,7 @@
1081 #include <linux/netlink.h>
1082 #include <linux/netdevice.h>
1083 #include <linux/mm.h>
1084+#include <linux/netfilter.h>
1085 #include <linux/netfilter_ipv4/ip_tables.h>
1086 #include <linux/netfilter_ipv4/ipt_ULOG.h>
1087 #include <linux/netfilter_ipv4/lockhelp.h>
1088@@ -75,6 +76,10 @@
1089 MODULE_PARM(flushtimeout, "i");
1090 MODULE_PARM_DESC(flushtimeout, "buffer flush timeout");
1091
1092+static unsigned int nflog = 1;
1093+MODULE_PARM(nflog, "i");
1094+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
1095+
1096 /* global data structures */
1097
1098 typedef struct {
1099@@ -152,17 +157,17 @@
1100 return skb;
1101 }
1102
1103-static unsigned int ipt_ulog_target(struct sk_buff **pskb,
1104- const struct net_device *in,
1105- const struct net_device *out,
1106- unsigned int hooknum,
1107- const void *targinfo, void *userinfo)
1108+static void ipt_ulog_packet(unsigned int hooknum,
1109+ const struct sk_buff *skb,
1110+ const struct net_device *in,
1111+ const struct net_device *out,
1112+ const struct ipt_ulog_info *loginfo,
1113+ const char *prefix)
1114 {
1115 ulog_buff_t *ub;
1116 ulog_packet_msg_t *pm;
1117 size_t size, copy_len;
1118 struct nlmsghdr *nlh;
1119- struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
1120
1121 /* ffs == find first bit set, necessary because userspace
1122 * is already shifting groupnumber, but we need unshifted.
1123@@ -171,8 +176,8 @@
1124
1125 /* calculate the size of the skb needed */
1126 if ((loginfo->copy_range == 0) ||
1127- (loginfo->copy_range > (*pskb)->len)) {
1128- copy_len = (*pskb)->len;
1129+ (loginfo->copy_range > skb->len)) {
1130+ copy_len = skb->len;
1131 } else {
1132 copy_len = loginfo->copy_range;
1133 }
1134@@ -209,19 +214,21 @@
1135
1136 /* copy hook, prefix, timestamp, payload, etc. */
1137 pm->data_len = copy_len;
1138- pm->timestamp_sec = (*pskb)->stamp.tv_sec;
1139- pm->timestamp_usec = (*pskb)->stamp.tv_usec;
1140- pm->mark = (*pskb)->nfmark;
1141+ pm->timestamp_sec = skb->stamp.tv_sec;
1142+ pm->timestamp_usec = skb->stamp.tv_usec;
1143+ pm->mark = skb->nfmark;
1144 pm->hook = hooknum;
1145- if (loginfo->prefix[0] != '\0')
1146+ if (prefix != NULL)
1147+ strncpy(pm->prefix, prefix, sizeof(pm->prefix));
1148+ else if (loginfo->prefix[0] != '\0')
1149 strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
1150 else
1151 *(pm->prefix) = '\0';
1152
1153 if (in && in->hard_header_len > 0
1154- && (*pskb)->mac.raw != (void *) (*pskb)->nh.iph
1155+ && skb->mac.raw != (void *) skb->nh.iph
1156 && in->hard_header_len <= ULOG_MAC_LEN) {
1157- memcpy(pm->mac, (*pskb)->mac.raw, in->hard_header_len);
1158+ memcpy(pm->mac, skb->mac.raw, in->hard_header_len);
1159 pm->mac_len = in->hard_header_len;
1160 } else
1161 pm->mac_len = 0;
1162@@ -236,8 +243,8 @@
1163 else
1164 pm->outdev_name[0] = '\0';
1165
1166- /* copy_len <= (*pskb)->len, so can't fail. */
1167- if (skb_copy_bits(*pskb, 0, pm->payload, copy_len) < 0)
1168+ /* copy_len <= skb->len, so can't fail. */
1169+ if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0)
1170 BUG();
1171
1172 /* check if we are building multi-part messages */
1173@@ -261,8 +268,7 @@
1174
1175 UNLOCK_BH(&ulog_lock);
1176
1177- return IPT_CONTINUE;
1178-
1179+ return;
1180
1181 nlmsg_failure:
1182 PRINTR("ipt_ULOG: error during NLMSG_PUT\n");
1183@@ -271,8 +277,35 @@
1184 PRINTR("ipt_ULOG: Error building netlink message\n");
1185
1186 UNLOCK_BH(&ulog_lock);
1187+}
1188+
1189+static unsigned int ipt_ulog_target(struct sk_buff **pskb,
1190+ const struct net_device *in,
1191+ const struct net_device *out,
1192+ unsigned int hooknum,
1193+ const void *targinfo, void *userinfo)
1194+{
1195+ struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
1196
1197- return IPT_CONTINUE;
1198+ ipt_ulog_packet(hooknum, *pskb, in, out, loginfo, NULL);
1199+
1200+ return IPT_CONTINUE;
1201+}
1202+
1203+static void ipt_logfn(unsigned int hooknum,
1204+ const struct sk_buff *skb,
1205+ const struct net_device *in,
1206+ const struct net_device *out,
1207+ const char *prefix)
1208+{
1209+ struct ipt_ulog_info loginfo = {
1210+ .nl_group = NFLOG_DEFAULT_NLGROUP,
1211+ .copy_range = 0,
1212+ .qthreshold = NFLOG_DEFAULT_QTHRESHOLD,
1213+ .prefix = ""
1214+ };
1215+
1216+ ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
1217 }
1218
1219 static int ipt_ulog_checkentry(const char *tablename,
1220@@ -337,6 +370,9 @@
1221 return -EINVAL;
1222 }
1223
1224+ if (nflog)
1225+ nf_log_register(PF_INET, &ipt_logfn);
1226+
1227 return 0;
1228 }
1229
1230@@ -347,6 +383,9 @@
1231
1232 DEBUGP("ipt_ULOG: cleanup_module\n");
1233
1234+ if (nflog)
1235+ nf_log_unregister(PF_INET, &ipt_logfn);
1236+
1237 ipt_unregister_target(&ipt_ulog_reg);
1238 sock_release(nflognl->sk_socket);
1239
1240diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_conntrack.c linux-2.6.0-test9/net/ipv4/netfilter/ipt_conntrack.c
1241--- linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_conntrack.c 2003-10-25 20:44:42.000000000 +0200
1242+++ linux-2.6.0-test9/net/ipv4/netfilter/ipt_conntrack.c 2003-10-26 12:44:33.000000000 +0100
1243@@ -29,7 +29,9 @@
1244
1245 #define FWINV(bool,invflg) ((bool) ^ !!(sinfo->invflags & invflg))
1246
1247- if (ct)
1248+ if (skb->nfct == &ip_conntrack_untracked.infos[IP_CT_NEW])
1249+ statebit = IPT_CONNTRACK_STATE_UNTRACKED;
1250+ else if (ct)
1251 statebit = IPT_CONNTRACK_STATE_BIT(ctinfo);
1252 else
1253 statebit = IPT_CONNTRACK_STATE_INVALID;
1254diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_sctp.c linux-2.6.0-test9/net/ipv4/netfilter/ipt_sctp.c
1255--- linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_sctp.c 1970-01-01 01:00:00.000000000 +0100
1256+++ linux-2.6.0-test9/net/ipv4/netfilter/ipt_sctp.c 2003-10-26 12:44:43.000000000 +0100
1257@@ -0,0 +1,125 @@
1258+/* IP tables module for matching the SCTP header
1259+ *
1260+ * $ipt_sctp.c,v 1.3 2002/05/29 15:09:00 laforge Exp$
1261+ *
1262+ * (C) 2003 by Harald Welte <laforge@gnumonks.org>
1263+ *
1264+ * This software is distributed under the terms GNU GPL v2
1265+ */
1266+
1267+#include <linux/module.h>
1268+#include <linux/skbuff.h>
1269+#include <linux/sctp.h>
1270+
1271+#include <linux/netfilter_ipv4/ip_tables.h>
1272+#include <linux/netfilter_ipv4/ipt_sctp.h>
1273+
1274+MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
1275+MODULE_DESCRIPTION("IP tables SCTP matching module");
1276+MODULE_LICENSE("GPL");
1277+
1278+/* Returns 1 if the port is matched by the range, 0 otherwise */
1279+static inline int
1280+port_match(u_int16_t min, u_int16_t max, u_int16_t port, int invert)
1281+{
1282+ int ret;
1283+
1284+ ret = (port >= min && port <= max) ^ invert;
1285+ return ret;
1286+}
1287+
1288+static int chunk_match(const struct sk_buff *skb, u_int32_t chunks, u_int32_t chunk_mask)
1289+{
1290+ sctp_chunkhdr_t *ch = (sctp_chunkhdr_t *) skb->data;
1291+
1292+ u_int32_t chunks_present = 0;
1293+
1294+ do {
1295+ u_int8_t *ch_end;
1296+ ch_end = ((u_int8_t *) ch) + WORD_ROUND(ntohs(ch->length));
1297+
1298+ if (ch->type < 32)
1299+ chunks_present |= (1 << ch_type);
1300+ else if (ch->type == SCTP_CID_ASCONF)
1301+ chunks_present |= (1 << 31);
1302+ else if (ch->type == SCTP_CID_ASCONF_ACK)
1303+ chunks_present |= (1 << 30);
1304+
1305+ ch = (sctp_chunkhdr_t *) ch_end;
1306+ } while (ch_end < skb->tail);
1307+
1308+ return ((chunks_present& chunk_mask) == chunks);
1309+}
1310+
1311+static int match(const struct sk_buff *skb, const struct net_device *in,
1312+ const struct net_device *out, const void *matchinfo,
1313+ int offset, const void *hdr, u_int16_t datalen,
1314+ int *hotdrop)
1315+{
1316+ const struct ipt_sctp_info *info = matchinfo;
1317+ const struct iphdr *iph = skb->nh.iph;
1318+ const struct sctphdr *sh = (struct sctphdr *) skb->h.raw;
1319+
1320+ if (iph->protocol != IPPROTO_SCTP)
1321+ return 0;
1322+
1323+ if (offset == 1) {
1324+ duprintf("Dropping evil SCTP offset=1 frag.\n");
1325+ *hotdrop = 1;
1326+ return 0;
1327+ } else if (offset == 0 && datalen < sizeof(struct sctphdr)) {
1328+ /* We've been askd o examine this packet, and we can't.
1329+ * Hence, no choice but to drop. */
1330+ duprintf("Dropping evil SCTP offset=0 tinygram.\n");
1331+ *hotdrop = 1;
1332+ return 0;
1333+ }
1334+
1335+ return (!offset
1336+ && port_match(info->spts[0], info->spts[1],
1337+ ntohs(sh->source),
1338+ !!(info->invflags & IPT_SCTP_INV_SRCPT))
1339+ && port_match(info->dpts[0], info->dpts[1],
1340+ ntohs(sh->dest),
1341+ !!(info->invflags & IPT_SCTP_INV_DSTPT))
1342+ && chunk_match(skb, info->chunks, info->chunk_mask)
1343+ );
1344+}
1345+
1346+static int checkentry(const char *tablename, const struct ipt_ip *ip,
1347+ void *matchinfo, unsigned int matchsize,
1348+ unsigned int hook_mask)
1349+{
1350+ const struct ipt_sctp_info *info = matchinfo;
1351+
1352+ if (matchsize != IPT_ALIGN(sizeof(struct ipt_sctp_info)))
1353+ return 0;
1354+
1355+ if (ip->proto != IPPROTO_SCTP && !(ip->invflags & IPT_INV_PROTO))
1356+ return 0;
1357+
1358+ if !(info->invflags & ~IPT_SCTP_INV_MASK)
1359+ return 0;
1360+
1361+ return 1;
1362+}
1363+
1364+static struct ipt_match sctp_match = {
1365+ .name = "sctp",
1366+ .match = &match,
1367+ .checkentry = &checkentry,
1368+ .me = THIS_MODULE,
1369+};
1370+
1371+static int __init init(void)
1372+{
1373+ return ipt_register_match(&sctp_match);
1374+}
1375+
1376+static void __exit fini(void)
1377+{
1378+ ipt_unregister_match(&sctp_match);
1379+}
1380+
1381+module_init(init);
1382+module_exit(fini);
1383diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_state.c linux-2.6.0-test9/net/ipv4/netfilter/ipt_state.c
1384--- linux-2.6.0-test9.org/net/ipv4/netfilter/ipt_state.c 2003-10-25 20:44:59.000000000 +0200
1385+++ linux-2.6.0-test9/net/ipv4/netfilter/ipt_state.c 2003-10-26 12:44:33.000000000 +0100
1386@@ -23,10 +23,12 @@
1387 enum ip_conntrack_info ctinfo;
1388 unsigned int statebit;
1389
1390- if (!ip_conntrack_get((struct sk_buff *)skb, &ctinfo))
1391- statebit = IPT_STATE_INVALID;
1392- else
1393+ if (skb->nfct == &ip_conntrack_untracked.infos[IP_CT_NEW])
1394+ statebit = IPT_STATE_UNTRACKED;
1395+ else if (ip_conntrack_get((struct sk_buff *)skb, &ctinfo))
1396 statebit = IPT_STATE_BIT(ctinfo);
1397+ else
1398+ statebit = IPT_STATE_INVALID;
1399
1400 return (sinfo->statemask & statebit);
1401 }
1402diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/iptable_filter.c linux-2.6.0-test9/net/ipv4/netfilter/iptable_filter.c
1403--- linux-2.6.0-test9.org/net/ipv4/netfilter/iptable_filter.c 2003-10-25 20:43:23.000000000 +0200
1404+++ linux-2.6.0-test9/net/ipv4/netfilter/iptable_filter.c 2003-10-26 12:44:33.000000000 +0100
1405@@ -52,7 +52,7 @@
1406 0,
1407 sizeof(struct ipt_entry),
1408 sizeof(struct ipt_standard),
1409- 0, { 0, 0 }, { } },
1410+ 0, NULL, 0, { 0, 0 }, { } },
1411 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1412 -NF_ACCEPT - 1 } },
1413 /* FORWARD */
1414@@ -60,7 +60,7 @@
1415 0,
1416 sizeof(struct ipt_entry),
1417 sizeof(struct ipt_standard),
1418- 0, { 0, 0 }, { } },
1419+ 0, NULL, 0, { 0, 0 }, { } },
1420 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1421 -NF_ACCEPT - 1 } },
1422 /* LOCAL_OUT */
1423@@ -68,7 +68,7 @@
1424 0,
1425 sizeof(struct ipt_entry),
1426 sizeof(struct ipt_standard),
1427- 0, { 0, 0 }, { } },
1428+ 0, NULL, 0, { 0, 0 }, { } },
1429 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1430 -NF_ACCEPT - 1 } }
1431 },
1432@@ -77,7 +77,7 @@
1433 0,
1434 sizeof(struct ipt_entry),
1435 sizeof(struct ipt_error),
1436- 0, { 0, 0 }, { } },
1437+ 0, NULL, 0, { 0, 0 }, { } },
1438 { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
1439 { } },
1440 "ERROR"
1441diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/iptable_mangle.c linux-2.6.0-test9/net/ipv4/netfilter/iptable_mangle.c
1442--- linux-2.6.0-test9.org/net/ipv4/netfilter/iptable_mangle.c 2003-10-25 20:44:37.000000000 +0200
1443+++ linux-2.6.0-test9/net/ipv4/netfilter/iptable_mangle.c 2003-10-26 12:44:33.000000000 +0100
1444@@ -69,7 +69,7 @@
1445 0,
1446 sizeof(struct ipt_entry),
1447 sizeof(struct ipt_standard),
1448- 0, { 0, 0 }, { } },
1449+ 0, NULL, 0, { 0, 0 }, { } },
1450 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1451 -NF_ACCEPT - 1 } },
1452 /* LOCAL_IN */
1453@@ -77,7 +77,7 @@
1454 0,
1455 sizeof(struct ipt_entry),
1456 sizeof(struct ipt_standard),
1457- 0, { 0, 0 }, { } },
1458+ 0, NULL, 0, { 0, 0 }, { } },
1459 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1460 -NF_ACCEPT - 1 } },
1461 /* FORWARD */
1462@@ -85,7 +85,7 @@
1463 0,
1464 sizeof(struct ipt_entry),
1465 sizeof(struct ipt_standard),
1466- 0, { 0, 0 }, { } },
1467+ 0, NULL, 0, { 0, 0 }, { } },
1468 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1469 -NF_ACCEPT - 1 } },
1470 /* LOCAL_OUT */
1471@@ -93,7 +93,7 @@
1472 0,
1473 sizeof(struct ipt_entry),
1474 sizeof(struct ipt_standard),
1475- 0, { 0, 0 }, { } },
1476+ 0, NULL, 0, { 0, 0 }, { } },
1477 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1478 -NF_ACCEPT - 1 } },
1479 /* POST_ROUTING */
1480@@ -101,7 +101,7 @@
1481 0,
1482 sizeof(struct ipt_entry),
1483 sizeof(struct ipt_standard),
1484- 0, { 0, 0 }, { } },
1485+ 0, NULL, 0, { 0, 0 }, { } },
1486 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1487 -NF_ACCEPT - 1 } },
1488 },
1489@@ -110,7 +110,7 @@
1490 0,
1491 sizeof(struct ipt_entry),
1492 sizeof(struct ipt_error),
1493- 0, { 0, 0 }, { } },
1494+ 0, NULL, 0, { 0, 0 }, { } },
1495 { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
1496 { } },
1497 "ERROR"
1498diff -Nur linux-2.6.0-test9.org/net/ipv4/netfilter/iptable_raw.c linux-2.6.0-test9/net/ipv4/netfilter/iptable_raw.c
1499--- linux-2.6.0-test9.org/net/ipv4/netfilter/iptable_raw.c 1970-01-01 01:00:00.000000000 +0100
1500+++ linux-2.6.0-test9/net/ipv4/netfilter/iptable_raw.c 2003-10-26 12:44:33.000000000 +0100
1501@@ -0,0 +1,153 @@
1502+/*
1503+ * 'raw' table, which is the very first hooked in at PRE_ROUTING and LOCAL_OUT .
1504+ *
1505+ * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
1506+ */
1507+#include <linux/module.h>
1508+#include <linux/netfilter_ipv4/ip_tables.h>
1509+
1510+#define RAW_VALID_HOOKS ((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT))
1511+
1512+/* Standard entry. */
1513+struct ipt_standard
1514+{
1515+ struct ipt_entry entry;
1516+ struct ipt_standard_target target;
1517+};
1518+
1519+struct ipt_error_target
1520+{
1521+ struct ipt_entry_target target;
1522+ char errorname[IPT_FUNCTION_MAXNAMELEN];
1523+};
1524+
1525+struct ipt_error
1526+{
1527+ struct ipt_entry entry;
1528+ struct ipt_error_target target;
1529+};
1530+
1531+static struct
1532+{
1533+ struct ipt_replace repl;
1534+ struct ipt_standard entries[2];
1535+ struct ipt_error term;
1536+} initial_table __initdata
1537+= { { "raw", RAW_VALID_HOOKS, 3,
1538+ sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error),
1539+ { [NF_IP_PRE_ROUTING] 0,
1540+ [NF_IP_LOCAL_OUT] sizeof(struct ipt_standard) },
1541+ { [NF_IP_PRE_ROUTING] 0,
1542+ [NF_IP_LOCAL_OUT] sizeof(struct ipt_standard) },
1543+ 0, NULL, { } },
1544+ {
1545+ /* PRE_ROUTING */
1546+ { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
1547+ 0,
1548+ sizeof(struct ipt_entry),
1549+ sizeof(struct ipt_standard),
1550+ 0, NULL, 0, { 0, 0 }, { } },
1551+ { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1552+ -NF_ACCEPT - 1 } },
1553+ /* LOCAL_OUT */
1554+ { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
1555+ 0,
1556+ sizeof(struct ipt_entry),
1557+ sizeof(struct ipt_standard),
1558+ 0, NULL, 0, { 0, 0 }, { } },
1559+ { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1560+ -NF_ACCEPT - 1 } }
1561+ },
1562+ /* ERROR */
1563+ { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
1564+ 0,
1565+ sizeof(struct ipt_entry),
1566+ sizeof(struct ipt_error),
1567+ 0, NULL, 0, { 0, 0 }, { } },
1568+ { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
1569+ { } },
1570+ "ERROR"
1571+ }
1572+ }
1573+};
1574+
1575+static struct ipt_table packet_raw = {
1576+ .name = "raw",
1577+ .table = &initial_table.repl,
1578+ .valid_hooks = RAW_VALID_HOOKS,
1579+ .lock = RW_LOCK_UNLOCKED,
1580+ .me = THIS_MODULE,
1581+};
1582+
1583+/* The work comes in here from netfilter.c. */
1584+static unsigned int
1585+ipt_hook(unsigned int hook,
1586+ struct sk_buff **pskb,
1587+ const struct net_device *in,
1588+ const struct net_device *out,
1589+ int (*okfn)(struct sk_buff *))
1590+{
1591+ return ipt_do_table(pskb, hook, in, out, &packet_raw, NULL);
1592+}
1593+
1594+/* 'raw' is the very first table. */
1595+static struct nf_hook_ops ipt_ops[] = {
1596+ { /* PRE_ROUTING hook */
1597+ .hook = ipt_hook,
1598+ .owner = THIS_MODULE,
1599+ .pf = PF_INET,
1600+ .hooknum = NF_IP_PRE_ROUTING,
1601+ .priority = NF_IP_PRI_RAW,
1602+ },
1603+ { /* LOCAL_OUT hook */
1604+ .hook = ipt_hook,
1605+ .owner = THIS_MODULE,
1606+ .pf = PF_INET,
1607+ .hooknum = NF_IP_LOCAL_OUT,
1608+ .priority = NF_IP_PRI_RAW,
1609+ },
1610+};
1611+
1612+static int __init init(void)
1613+{
1614+ int ret;
1615+
1616+ /* Register table */
1617+ ret = ipt_register_table(&packet_raw);
1618+ if (ret < 0)
1619+ return ret;
1620+
1621+ /* Register hooks */
1622+ ret = nf_register_hook(&ipt_ops[0]);
1623+ if (ret < 0)
1624+ goto cleanup_table;
1625+
1626+ ret = nf_register_hook(&ipt_ops[1]);
1627+ if (ret < 0)
1628+ goto cleanup_hook0;
1629+
1630+ return ret;
1631+
1632+ cleanup_hook0:
1633+ nf_unregister_hook(&ipt_ops[0]);
1634+ cleanup_table:
1635+ ipt_unregister_table(&packet_raw);
1636+
1637+ return ret;
1638+}
1639+
1640+static void __exit fini(void)
1641+{
1642+ unsigned int i;
1643+
1644+ for (i = 0; i < sizeof(ipt_ops)/sizeof(struct nf_hook_ops); i++)
1645+ nf_unregister_hook(&ipt_ops[i]);
1646+
1647+ ipt_unregister_table(&packet_raw);
1648+}
1649+
1650+module_init(init);
1651+module_exit(fini);
1652+MODULE_LICENSE("GPL");
1653+MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1654+MODULE_DESCRIPTION("IPv4 raw table");
1655diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/Kconfig linux-2.6.0-test9/net/ipv6/netfilter/Kconfig
1656--- linux-2.6.0-test9.org/net/ipv6/netfilter/Kconfig 2003-10-25 20:44:37.000000000 +0200
1657+++ linux-2.6.0-test9/net/ipv6/netfilter/Kconfig 2003-10-26 12:44:33.000000000 +0100
1658@@ -217,6 +217,31 @@
1659
1660 To compile it as a module, choose M here. If unsure, say N.
1661
1662+config IP6_NF_RAW
1663+ tristate "Raw table"
1664+ depends on IP6_NF_IPTABLES
1665+ help
1666+ This option adds a `raw' table to iptables: see the man page for
1667+ iptables(8). This table is the very first in the netfilter
1668+ framework and hooks in at the PREROUTING and OUTPUT chains.
1669+ The TRACE target can be used in this table only.
1670+
1671+ To compile it as a module, choose M here. If unsure, say N.
1672+
1673+config IP6_NF_TARGET_TRACE
1674+ tristate "TRACE target support"
1675+ depends on IP6_NF_RAW
1676+ help
1677+ The TRACE target allows packets to be traced as those matches
1678+ any subsequent rule in any IPv6 netfilter table/rule. The matched
1679+ rule and the packet is logged with the prefix
1680+
1681+ TRACE: tablename/chainname/rulenum
1682+
1683+ if the ip6t_LOG target is loaded in.
1684+
1685+ To compile it as a module, choose M here. If unsure, say N.
1686+
1687 #dep_tristate ' LOG target support' CONFIG_IP6_NF_TARGET_LOG $CONFIG_IP6_NF_IPTABLES
1688 endmenu
1689
1690diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/Makefile linux-2.6.0-test9/net/ipv6/netfilter/Makefile
1691--- linux-2.6.0-test9.org/net/ipv6/netfilter/Makefile 2003-10-25 20:43:53.000000000 +0200
1692+++ linux-2.6.0-test9/net/ipv6/netfilter/Makefile 2003-10-26 12:44:33.000000000 +0100
1693@@ -18,7 +18,9 @@
1694 obj-$(CONFIG_IP6_NF_MATCH_OWNER) += ip6t_owner.o
1695 obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
1696 obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
1697+obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
1698 obj-$(CONFIG_IP6_NF_TARGET_MARK) += ip6t_MARK.o
1699 obj-$(CONFIG_IP6_NF_QUEUE) += ip6_queue.o
1700 obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_LOG.o
1701+obj-$(CONFIG_IP6_NF_TARGET_TRACE) += ip6t_TRACE.o
1702 obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
1703diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/ip6_tables.c linux-2.6.0-test9/net/ipv6/netfilter/ip6_tables.c
1704--- linux-2.6.0-test9.org/net/ipv6/netfilter/ip6_tables.c 2003-10-25 20:44:39.000000000 +0200
1705+++ linux-2.6.0-test9/net/ipv6/netfilter/ip6_tables.c 2003-10-26 12:44:33.000000000 +0100
1706@@ -12,6 +12,7 @@
1707 */
1708 #include <linux/config.h>
1709 #include <linux/skbuff.h>
1710+#include <linux/socket.h>
1711 #include <linux/kmod.h>
1712 #include <linux/vmalloc.h>
1713 #include <linux/netdevice.h>
1714@@ -24,8 +25,17 @@
1715 #include <asm/semaphore.h>
1716 #include <linux/proc_fs.h>
1717
1718+#include <linux/netfilter.h>
1719 #include <linux/netfilter_ipv6/ip6_tables.h>
1720
1721+static const char *hook6names[] = {
1722+ [NF_IP6_PRE_ROUTING] "PREROUTING",
1723+ [NF_IP6_LOCAL_IN] "INPUT",
1724+ [NF_IP6_FORWARD] "FORWARD",
1725+ [NF_IP6_LOCAL_OUT] "OUTPUT",
1726+ [NF_IP6_POST_ROUTING] "POSTROUTING",
1727+};
1728+
1729 MODULE_LICENSE("GPL");
1730 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1731 MODULE_DESCRIPTION("IPv6 packet filter");
1732@@ -403,6 +413,12 @@
1733
1734 t = ip6t_get_target(e);
1735 IP_NF_ASSERT(t->u.kernel.target);
1736+
1737+ /* The packet traced and the rule isn't an unconditional return/END. */
1738+ if (((*pskb)->nfcache & NFC_TRACE) && e->rulenum) {
1739+ nf_log_packet(AF_INET6, hook, *pskb, in, out, "TRACE: %s/%s/%u ",
1740+ table->name, e->chainname, e->rulenum);
1741+ }
1742 /* Standard target? */
1743 if (!t->u.kernel.target->target) {
1744 int v;
1745@@ -556,6 +572,29 @@
1746 return find_inlist_lock(&ip6t_target, name, "ip6t_", error, mutex);
1747 }
1748
1749+static inline int
1750+find_error_target(struct ip6t_entry *s,
1751+ struct ip6t_entry *e,
1752+ char **chainname)
1753+{
1754+ struct ip6t_entry_target *t;
1755+ static struct ip6t_entry *found = NULL;
1756+
1757+ if (s == e) {
1758+ if (!found)
1759+ return 0;
1760+ t = ip6t_get_target(found);
1761+ if (strcmp(t->u.user.name,
1762+ IP6T_ERROR_TARGET) == 0) {
1763+ *chainname = t->data;
1764+ return 1;
1765+ }
1766+ } else
1767+ found = s;
1768+
1769+ return 0;
1770+}
1771+
1772 /* All zeroes == unconditional rule. */
1773 static inline int
1774 unconditional(const struct ip6t_ip6 *ipv6)
1775@@ -575,6 +614,8 @@
1776 mark_source_chains(struct ip6t_table_info *newinfo, unsigned int valid_hooks)
1777 {
1778 unsigned int hook;
1779+ char *chainname = NULL;
1780+ u_int32_t rulenum;
1781
1782 /* No recursion; use packet counter to save back ptrs (reset
1783 to 0 as we leave), and comefrom to save source hook bitmask */
1784@@ -588,6 +629,8 @@
1785
1786 /* Set initial back pointer. */
1787 e->counters.pcnt = pos;
1788+ rulenum = 1;
1789+ chainname = (char *) hook6names[hook];
1790
1791 for (;;) {
1792 struct ip6t_standard_target *t
1793@@ -600,6 +643,8 @@
1794 }
1795 e->comefrom
1796 |= ((1 << hook) | (1 << NF_IP6_NUMHOOKS));
1797+ e->rulenum = rulenum++;
1798+ e->chainname = chainname;
1799
1800 /* Unconditional return/END. */
1801 if (e->target_offset == sizeof(struct ip6t_entry)
1802@@ -609,6 +654,10 @@
1803 && unconditional(&e->ipv6)) {
1804 unsigned int oldpos, size;
1805
1806+ /* Set unconditional rulenum to zero. */
1807+ e->rulenum = 0;
1808+ e->counters.bcnt = 0;
1809+
1810 /* Return: backtrack through the last
1811 big jump. */
1812 do {
1813@@ -634,6 +683,11 @@
1814 (newinfo->entries + pos);
1815 } while (oldpos == pos + e->next_offset);
1816
1817+ /* Restore chainname, rulenum. */
1818+ chainname = e->chainname;
1819+ rulenum = e->counters.bcnt;
1820+ e->counters.bcnt = 0;
1821+
1822 /* Move along one */
1823 size = e->next_offset;
1824 e = (struct ip6t_entry *)
1825@@ -649,6 +703,17 @@
1826 /* This a jump; chase it. */
1827 duprintf("Jump rule %u -> %u\n",
1828 pos, newpos);
1829+ e->counters.bcnt = rulenum++;
1830+ rulenum = 1;
1831+ e = (struct ip6t_entry *)
1832+ (newinfo->entries + newpos);
1833+ if (IP6T_ENTRY_ITERATE(newinfo->entries,
1834+ newinfo->size,
1835+ find_error_target,
1836+ e, &chainname) == 0) {
1837+ printk("ip6_tables: table screwed up!\n");
1838+ return 0;
1839+ }
1840 } else {
1841 /* ... this is a fallthru */
1842 newpos = pos + e->next_offset;
1843diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/ip6t_LOG.c linux-2.6.0-test9/net/ipv6/netfilter/ip6t_LOG.c
1844--- linux-2.6.0-test9.org/net/ipv6/netfilter/ip6t_LOG.c 2003-10-25 20:43:18.000000000 +0200
1845+++ linux-2.6.0-test9/net/ipv6/netfilter/ip6t_LOG.c 2003-10-26 12:44:13.000000000 +0100
1846@@ -3,18 +3,24 @@
1847 */
1848 #include <linux/module.h>
1849 #include <linux/skbuff.h>
1850+#include <linux/socket.h>
1851 #include <linux/ip.h>
1852 #include <linux/spinlock.h>
1853 #include <linux/icmpv6.h>
1854 #include <net/udp.h>
1855 #include <net/tcp.h>
1856 #include <net/ipv6.h>
1857+#include <linux/netfilter.h>
1858 #include <linux/netfilter_ipv6/ip6_tables.h>
1859
1860 MODULE_AUTHOR("Jan Rekorajski <baggins@pld.org.pl>");
1861 MODULE_DESCRIPTION("IP6 tables LOG target module");
1862 MODULE_LICENSE("GPL");
1863
1864+static unsigned int nflog = 1;
1865+MODULE_PARM(nflog, "i");
1866+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
1867+
1868 struct in_device;
1869 #include <net/route.h>
1870 #include <linux/netfilter_ipv6/ip6t_LOG.h>
1871@@ -256,40 +262,38 @@
1872 }
1873 }
1874
1875-static unsigned int
1876-ip6t_log_target(struct sk_buff **pskb,
1877- unsigned int hooknum,
1878- const struct net_device *in,
1879- const struct net_device *out,
1880- const void *targinfo,
1881- void *userinfo)
1882+static void
1883+ip6t_log_packet(unsigned int hooknum,
1884+ const struct sk_buff *skb,
1885+ const struct net_device *in,
1886+ const struct net_device *out,
1887+ const struct ip6t_log_info *loginfo,
1888+ const char *level_string,
1889+ const char *prefix)
1890 {
1891- struct ipv6hdr *ipv6h = (*pskb)->nh.ipv6h;
1892- const struct ip6t_log_info *loginfo = targinfo;
1893- char level_string[4] = "< >";
1894+ struct ipv6hdr *ipv6h = skb->nh.ipv6h;
1895
1896- level_string[1] = '0' + (loginfo->level % 8);
1897 spin_lock_bh(&log_lock);
1898 printk(level_string);
1899 printk("%sIN=%s OUT=%s ",
1900- loginfo->prefix,
1901+ prefix == NULL ? loginfo->prefix : prefix,
1902 in ? in->name : "",
1903 out ? out->name : "");
1904 if (in && !out) {
1905 /* MAC logging for input chain only. */
1906 printk("MAC=");
1907- if ((*pskb)->dev && (*pskb)->dev->hard_header_len && (*pskb)->mac.raw != (void*)ipv6h) {
1908- if ((*pskb)->dev->type != ARPHRD_SIT){
1909+ if (skb->dev && skb->dev->hard_header_len && skb->mac.raw != (void*)ipv6h) {
1910+ if (skb->dev->type != ARPHRD_SIT){
1911 int i;
1912- unsigned char *p = (*pskb)->mac.raw;
1913- for (i = 0; i < (*pskb)->dev->hard_header_len; i++,p++)
1914+ unsigned char *p = skb->mac.raw;
1915+ for (i = 0; i < skb->dev->hard_header_len; i++,p++)
1916 printk("%02x%c", *p,
1917- i==(*pskb)->dev->hard_header_len - 1
1918+ i==skb->dev->hard_header_len - 1
1919 ? ' ':':');
1920 } else {
1921 int i;
1922- unsigned char *p = (*pskb)->mac.raw;
1923- if ( p - (ETH_ALEN*2+2) > (*pskb)->head ){
1924+ unsigned char *p = skb->mac.raw;
1925+ if ( p - (ETH_ALEN*2+2) > skb->head ){
1926 p -= (ETH_ALEN+2);
1927 for (i = 0; i < (ETH_ALEN); i++,p++)
1928 printk("%02x%s", *p,
1929@@ -300,10 +304,10 @@
1930 i == ETH_ALEN-1 ? ' ' : ':');
1931 }
1932
1933- if (((*pskb)->dev->addr_len == 4) &&
1934- (*pskb)->dev->hard_header_len > 20){
1935+ if ((skb->dev->addr_len == 4) &&
1936+ skb->dev->hard_header_len > 20){
1937 printk("TUNNEL=");
1938- p = (*pskb)->mac.raw + 12;
1939+ p = skb->mac.raw + 12;
1940 for (i = 0; i < 4; i++,p++)
1941 printk("%3d%s", *p,
1942 i == 3 ? "->" : ".");
1943@@ -319,10 +323,41 @@
1944 dump_packet(loginfo, ipv6h, 1);
1945 printk("\n");
1946 spin_unlock_bh(&log_lock);
1947+}
1948+
1949+static unsigned int
1950+ip6t_log_target(struct sk_buff **pskb,
1951+ unsigned int hooknum,
1952+ const struct net_device *in,
1953+ const struct net_device *out,
1954+ const void *targinfo,
1955+ void *userinfo)
1956+{
1957+ const struct ip6t_log_info *loginfo = targinfo;
1958+ char level_string[4] = "< >";
1959+
1960+ level_string[1] = '0' + (loginfo->level % 8);
1961+ ip6t_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
1962
1963 return IP6T_CONTINUE;
1964 }
1965
1966+static void
1967+ip6t_logfn(unsigned int hooknum,
1968+ const struct sk_buff *skb,
1969+ const struct net_device *in,
1970+ const struct net_device *out,
1971+ const char *prefix)
1972+{
1973+ struct ip6t_log_info loginfo = {
1974+ .level = 0,
1975+ .logflags = IP6T_LOG_MASK,
1976+ .prefix = ""
1977+ };
1978+
1979+ ip6t_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
1980+}
1981+
1982 static int ip6t_log_checkentry(const char *tablename,
1983 const struct ip6t_entry *e,
1984 void *targinfo,
1985@@ -359,12 +394,17 @@
1986 {
1987 if (ip6t_register_target(&ip6t_log_reg))
1988 return -EINVAL;
1989+ if (nflog)
1990+ nf_log_register(PF_INET6, &ip6t_logfn);
1991
1992 return 0;
1993 }
1994
1995 static void __exit fini(void)
1996 {
1997+ if (nflog)
1998+ nf_log_register(PF_INET6, &ip6t_logfn);
1999+
2000 ip6t_unregister_target(&ip6t_log_reg);
2001 }
2002
2003diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/ip6t_TRACE.c linux-2.6.0-test9/net/ipv6/netfilter/ip6t_TRACE.c
2004--- linux-2.6.0-test9.org/net/ipv6/netfilter/ip6t_TRACE.c 1970-01-01 01:00:00.000000000 +0100
2005+++ linux-2.6.0-test9/net/ipv6/netfilter/ip6t_TRACE.c 2003-10-26 12:44:33.000000000 +0100
2006@@ -0,0 +1,69 @@
2007+/* This is a module which is used for setting
2008+ * the NFC_TRACE flag in the nfcache field of an skb.
2009+ */
2010+#include <linux/module.h>
2011+#include <linux/skbuff.h>
2012+
2013+#include <linux/netfilter_ipv6/ip6_tables.h>
2014+
2015+static unsigned int
2016+target(struct sk_buff **pskb,
2017+ unsigned int hooknum,
2018+ const struct net_device *in,
2019+ const struct net_device *out,
2020+ const void *targinfo,
2021+ void *userinfo)
2022+{
2023+ (*pskb)->nfcache |= NFC_TRACE;
2024+ return IP6T_CONTINUE;
2025+}
2026+
2027+static int
2028+checkentry(const char *tablename,
2029+ const struct ip6t_entry *e,
2030+ void *targinfo,
2031+ unsigned int targinfosize,
2032+ unsigned int hook_mask)
2033+{
2034+ if (targinfosize != 0) {
2035+ printk(KERN_WARNING "TRACE: targinfosize %u != 0\n",
2036+ targinfosize);
2037+ return 0;
2038+ }
2039+
2040+ if (strcmp(tablename, "raw") != 0) {
2041+ printk(KERN_WARNING "TRACE: can only be called from \"raw\" table, not \"%s\"\n", tablename);
2042+ return 0;
2043+ }
2044+
2045+ return 1;
2046+}
2047+
2048+static struct ip6t_target ip6t_trace_reg = {
2049+ .name = "TRACE",
2050+ .target = target,
2051+ .checkentry = checkentry,
2052+ .destroy = NULL,
2053+ .me = THIS_MODULE,
2054+};
2055+
2056+static int __init init(void)
2057+{
2058+ if (ip6t_register_target(&ip6t_trace_reg))
2059+ return -EINVAL;
2060+
2061+ return 0;
2062+}
2063+
2064+static void __exit fini(void)
2065+{
2066+ ip6t_unregister_target(&ip6t_trace_reg);
2067+}
2068+
2069+module_init(init);
2070+module_exit(fini);
2071+
2072+MODULE_LICENSE("GPL");
2073+MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
2074+MODULE_DESCRIPTION("IPv6 TRACE target");
2075+
2076\ No newline at end of file
2077diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/ip6table_filter.c linux-2.6.0-test9/net/ipv6/netfilter/ip6table_filter.c
2078--- linux-2.6.0-test9.org/net/ipv6/netfilter/ip6table_filter.c 2003-10-25 20:42:53.000000000 +0200
2079+++ linux-2.6.0-test9/net/ipv6/netfilter/ip6table_filter.c 2003-10-26 12:44:33.000000000 +0100
2080@@ -52,7 +52,7 @@
2081 0,
2082 sizeof(struct ip6t_entry),
2083 sizeof(struct ip6t_standard),
2084- 0, { 0, 0 }, { } },
2085+ 0, NULL, 0, { 0, 0 }, { } },
2086 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2087 -NF_ACCEPT - 1 } },
2088 /* FORWARD */
2089@@ -60,7 +60,7 @@
2090 0,
2091 sizeof(struct ip6t_entry),
2092 sizeof(struct ip6t_standard),
2093- 0, { 0, 0 }, { } },
2094+ 0, NULL, 0, { 0, 0 }, { } },
2095 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2096 -NF_ACCEPT - 1 } },
2097 /* LOCAL_OUT */
2098@@ -68,7 +68,7 @@
2099 0,
2100 sizeof(struct ip6t_entry),
2101 sizeof(struct ip6t_standard),
2102- 0, { 0, 0 }, { } },
2103+ 0, NULL, 0, { 0, 0 }, { } },
2104 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2105 -NF_ACCEPT - 1 } }
2106 },
2107@@ -77,7 +77,7 @@
2108 0,
2109 sizeof(struct ip6t_entry),
2110 sizeof(struct ip6t_error),
2111- 0, { 0, 0 }, { } },
2112+ 0, NULL, 0, { 0, 0 }, { } },
2113 { { { { IP6T_ALIGN(sizeof(struct ip6t_error_target)), IP6T_ERROR_TARGET } },
2114 { } },
2115 "ERROR"
2116diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/ip6table_mangle.c linux-2.6.0-test9/net/ipv6/netfilter/ip6table_mangle.c
2117--- linux-2.6.0-test9.org/net/ipv6/netfilter/ip6table_mangle.c 2003-10-25 20:43:26.000000000 +0200
2118+++ linux-2.6.0-test9/net/ipv6/netfilter/ip6table_mangle.c 2003-10-26 12:44:33.000000000 +0100
2119@@ -66,7 +66,7 @@
2120 0,
2121 sizeof(struct ip6t_entry),
2122 sizeof(struct ip6t_standard),
2123- 0, { 0, 0 }, { } },
2124+ 0, NULL, 0, { 0, 0 }, { } },
2125 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2126 -NF_ACCEPT - 1 } },
2127 /* LOCAL_IN */
2128@@ -74,7 +74,7 @@
2129 0,
2130 sizeof(struct ip6t_entry),
2131 sizeof(struct ip6t_standard),
2132- 0, { 0, 0 }, { } },
2133+ 0, NULL, 0, { 0, 0 }, { } },
2134 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2135 -NF_ACCEPT - 1 } },
2136 /* FORWARD */
2137@@ -82,7 +82,7 @@
2138 0,
2139 sizeof(struct ip6t_entry),
2140 sizeof(struct ip6t_standard),
2141- 0, { 0, 0 }, { } },
2142+ 0, NULL, 0, { 0, 0 }, { } },
2143 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2144 -NF_ACCEPT - 1 } },
2145 /* LOCAL_OUT */
2146@@ -90,7 +90,7 @@
2147 0,
2148 sizeof(struct ip6t_entry),
2149 sizeof(struct ip6t_standard),
2150- 0, { 0, 0 }, { } },
2151+ 0, NULL, 0, { 0, 0 }, { } },
2152 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2153 -NF_ACCEPT - 1 } },
2154 /* POST_ROUTING */
2155@@ -98,7 +98,7 @@
2156 0,
2157 sizeof(struct ip6t_entry),
2158 sizeof(struct ip6t_standard),
2159- 0, { 0, 0 }, { } },
2160+ 0, NULL, 0, { 0, 0 }, { } },
2161 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2162 -NF_ACCEPT - 1 } }
2163 },
2164@@ -107,7 +107,7 @@
2165 0,
2166 sizeof(struct ip6t_entry),
2167 sizeof(struct ip6t_error),
2168- 0, { 0, 0 }, { } },
2169+ 0, NULL, 0, { 0, 0 }, { } },
2170 { { { { IP6T_ALIGN(sizeof(struct ip6t_error_target)), IP6T_ERROR_TARGET } },
2171 { } },
2172 "ERROR"
2173diff -Nur linux-2.6.0-test9.org/net/ipv6/netfilter/ip6table_raw.c linux-2.6.0-test9/net/ipv6/netfilter/ip6table_raw.c
2174--- linux-2.6.0-test9.org/net/ipv6/netfilter/ip6table_raw.c 1970-01-01 01:00:00.000000000 +0100
2175+++ linux-2.6.0-test9/net/ipv6/netfilter/ip6table_raw.c 2003-10-26 12:44:33.000000000 +0100
2176@@ -0,0 +1,158 @@
2177+/*
2178+ * IPv6 raw table, a port of the IPv4 raw table to IPv6
2179+ *
2180+ * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
2181+ */
2182+#include <linux/module.h>
2183+#include <linux/netfilter_ipv6/ip6_tables.h>
2184+
2185+#define RAW_VALID_HOOKS ((1 << NF_IP6_PRE_ROUTING) | (1 << NF_IP6_LOCAL_OUT))
2186+
2187+#if 0
2188+#define DEBUGP(x, args...) printk(KERN_DEBUG x, ## args)
2189+#else
2190+#define DEBUGP(x, args...)
2191+#endif
2192+
2193+/* Standard entry. */
2194+struct ip6t_standard
2195+{
2196+ struct ip6t_entry entry;
2197+ struct ip6t_standard_target target;
2198+};
2199+
2200+struct ip6t_error_target
2201+{
2202+ struct ip6t_entry_target target;
2203+ char errorname[IP6T_FUNCTION_MAXNAMELEN];
2204+};
2205+
2206+struct ip6t_error
2207+{
2208+ struct ip6t_entry entry;
2209+ struct ip6t_error_target target;
2210+};
2211+
2212+static struct
2213+{
2214+ struct ip6t_replace repl;
2215+ struct ip6t_standard entries[2];
2216+ struct ip6t_error term;
2217+} initial_table __initdata
2218+= { { "raw", RAW_VALID_HOOKS, 3,
2219+ sizeof(struct ip6t_standard) * 2 + sizeof(struct ip6t_error),
2220+ { [NF_IP6_PRE_ROUTING] 0,
2221+ [NF_IP6_LOCAL_OUT] sizeof(struct ip6t_standard) },
2222+ { [NF_IP6_PRE_ROUTING] 0,
2223+ [NF_IP6_LOCAL_OUT] sizeof(struct ip6t_standard) },
2224+ 0, NULL, { } },
2225+ {
2226+ /* PRE_ROUTING */
2227+ { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
2228+ 0,
2229+ sizeof(struct ip6t_entry),
2230+ sizeof(struct ip6t_standard),
2231+ 0, NULL, 0, { 0, 0 }, { } },
2232+ { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2233+ -NF_ACCEPT - 1 } },
2234+ /* LOCAL_OUT */
2235+ { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
2236+ 0,
2237+ sizeof(struct ip6t_entry),
2238+ sizeof(struct ip6t_standard),
2239+ 0, NULL, 0, { 0, 0 }, { } },
2240+ { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2241+ -NF_ACCEPT - 1 } },
2242+ },
2243+ /* ERROR */
2244+ { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
2245+ 0,
2246+ sizeof(struct ip6t_entry),
2247+ sizeof(struct ip6t_error),
2248+ 0, NULL, 0, { 0, 0 }, { } },
2249+ { { { { IP6T_ALIGN(sizeof(struct ip6t_error_target)), IP6T_ERROR_TARGET } },
2250+ { } },
2251+ "ERROR"
2252+ }
2253+ }
2254+};
2255+
2256+static struct ip6t_table packet_raw = {
2257+ .name = "raw",
2258+ .table = &initial_table.repl,
2259+ .valid_hooks = RAW_VALID_HOOKS,
2260+ .lock = RW_LOCK_UNLOCKED,
2261+ .me = THIS_MODULE
2262+};
2263+
2264+/* The work comes in here from netfilter.c. */
2265+static unsigned int
2266+ip6t_hook(unsigned int hook,
2267+ struct sk_buff **pskb,
2268+ const struct net_device *in,
2269+ const struct net_device *out,
2270+ int (*okfn)(struct sk_buff *))
2271+{
2272+ return ip6t_do_table(pskb, hook, in, out, &packet_raw, NULL);
2273+}
2274+
2275+static struct nf_hook_ops ip6t_ops[] = {
2276+ { /* PRE_ROUTING */
2277+ .hook = ip6t_hook,
2278+ .owner = THIS_MODULE,
2279+ .pf = PF_INET6,
2280+ .hooknum = NF_IP6_PRE_ROUTING,
2281+ .priority = NF_IP6_PRI_FIRST,
2282+ },
2283+ { /* LOCAL_OUT */
2284+ .hook = ip6t_hook,
2285+ .owner = THIS_MODULE,
2286+ .pf = PF_INET6,
2287+ .hooknum = NF_IP6_LOCAL_OUT,
2288+ .priority = NF_IP6_PRI_FIRST,
2289+ },
2290+};
2291+
2292+static int __init init(void)
2293+{
2294+ int ret;
2295+
2296+ /* Register table */
2297+ ret = ip6t_register_table(&packet_raw);
2298+ if (ret < 0)
2299+ return ret;
2300+
2301+ /* Register hooks */
2302+ ret = nf_register_hook(&ip6t_ops[0]);
2303+ if (ret < 0)
2304+ goto cleanup_table;
2305+
2306+ ret = nf_register_hook(&ip6t_ops[1]);
2307+ if (ret < 0)
2308+ goto cleanup_hook0;
2309+
2310+ return ret;
2311+
2312+ cleanup_hook0:
2313+ nf_unregister_hook(&ip6t_ops[0]);
2314+ cleanup_table:
2315+ ip6t_unregister_table(&packet_raw);
2316+
2317+ return ret;
2318+}
2319+
2320+static void __exit fini(void)
2321+{
2322+ unsigned int i;
2323+
2324+ for (i = 0; i < sizeof(ip6t_ops)/sizeof(struct nf_hook_ops); i++)
2325+ nf_unregister_hook(&ip6t_ops[i]);
2326+
2327+ ip6t_unregister_table(&packet_raw);
2328+}
2329+
2330+module_init(init);
2331+module_exit(fini);
2332+MODULE_LICENSE("GPL");
2333+MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
2334+MODULE_DESCRIPTION("IPv6 raw table");
2335diff -Nur linux-2.6.0-test9.org/netfilter-patch-o-matic/patches linux-2.6.0-test9/netfilter-patch-o-matic/patches
2336--- linux-2.6.0-test9.org/netfilter-patch-o-matic/patches 1970-01-01 01:00:00.000000000 +0100
2337+++ linux-2.6.0-test9/netfilter-patch-o-matic/patches 2003-10-26 12:45:17.000000000 +0100
2338@@ -0,0 +1,10 @@
2339+./base/01_sctp_match.patch
2340+./pending/40_nf-log.patch
2341+./pending/25-err-ptr.patch
2342+./pending/26-memsets.patch
2343+./pending/70_expect-evict-order.patch
2344+./pending/71_raw.patch
2345+./submitted/02_REJECT-headroom-tcprst.patch
2346+./submitted/03_260t4-mirror-remove.patch
2347+./submitted/03_physdev_bridged.patch
2348+./submitted/04_260t4-unclean-remove.patch
The Linux kernel (the core of the Linux operating system)
This page took 0.401436 seconds and 4 git commands to generate.