]> git.pld-linux.org Git - packages/kernel.git/blame - 2.6.5-patch-o-matic-ng-base-20040322.patch
projects / packages / kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- obsolete
[packages/kernel.git] / 2.6.5-patch-o-matic-ng-base-20040322.patch
CommitLineData
5bf18a53 1diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter.h linux-2.6.5-rc2/include/linux/netfilter.h
2--- linux-2.6.5-rc2.org/include/linux/netfilter.h 2004-03-20 00:11:18.000000000 +0000
3+++ linux-2.6.5-rc2/include/linux/netfilter.h 2004-03-22 08:27:15.000000000 +0000
4@@ -99,6 +99,24 @@
5
6 extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
7
8+typedef void nf_logfn(unsigned int hooknum,
9+ const struct sk_buff *skb,
10+ const struct net_device *in,
11+ const struct net_device *out,
12+ const char *prefix);
13+
14+/* Function to register/unregister log function. */
15+int nf_log_register(int pf, nf_logfn *logfn);
16+void nf_log_unregister(int pf, nf_logfn *logfn);
17+
18+/* Calls the registered backend logging function */
19+void nf_log_packet(int pf,
20+ unsigned int hooknum,
21+ const struct sk_buff *skb,
22+ const struct net_device *in,
23+ const struct net_device *out,
24+ const char *fmt, ...);
25+
26 /* Activate hook; either okfn or kfree_skb called, unless a hook
27 returns NF_STOLEN (in which case, it's up to the hook to deal with
28 the consequences).
29diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ip_conntrack.h
30--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ip_conntrack.h 2004-03-20 00:11:50.000000000 +0000
31+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ip_conntrack.h 2004-03-22 08:29:50.000000000 +0000
32@@ -251,6 +251,9 @@
33 /* Call me when a conntrack is destroyed. */
34 extern void (*ip_conntrack_destroyed)(struct ip_conntrack *conntrack);
35
36+/* Fake conntrack entry for untracked connections */
37+extern struct ip_conntrack ip_conntrack_untracked;
38+
39 /* Returns new sk_buff, or NULL */
40 struct sk_buff *
41 ip_ct_gather_frags(struct sk_buff *skb);
42diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ip_pool.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ip_pool.h
43--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ip_pool.h 1970-01-01 00:00:00.000000000 +0000
44+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ip_pool.h 2004-03-22 08:29:18.000000000 +0000
45@@ -0,0 +1,64 @@
46+#ifndef _IP_POOL_H
47+#define _IP_POOL_H
48+
49+/***************************************************************************/
50+/* This program is free software; you can redistribute it and/or modify */
51+/* it under the terms of the GNU General Public License as published by */
52+/* the Free Software Foundation; either version 2 of the License, or */
53+/* (at your option) any later version. */
54+/* */
55+/* This program is distributed in the hope that it will be useful, */
56+/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
57+/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
58+/* GNU General Public License for more details. */
59+/* */
60+/* You should have received a copy of the GNU General Public License */
61+/* along with this program; if not, write to the Free Software */
62+/* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA*/
63+/***************************************************************************/
64+
65+/* A sockopt of such quality has hardly ever been seen before on the open
66+ * market! This little beauty, hardly ever used: above 64, so it's
67+ * traditionally used for firewalling, not touched (even once!) by the
68+ * 2.0, 2.2 and 2.4 kernels!
69+ *
70+ * Comes with its own certificate of authenticity, valid anywhere in the
71+ * Free world!
72+ *
73+ * Rusty, 19.4.2000
74+ */
75+#define SO_IP_POOL 81
76+
77+typedef int ip_pool_t; /* pool index */
78+#define IP_POOL_NONE ((ip_pool_t)-1)
79+
80+struct ip_pool_request {
81+ int op;
82+ ip_pool_t index;
83+ u_int32_t addr;
84+ u_int32_t addr2;
85+};
86+
87+/* NOTE: I deliberately break the first cut ippool utility. Nobody uses it. */
88+
89+#define IP_POOL_BAD001 0x00000010
90+
91+#define IP_POOL_FLUSH 0x00000011 /* req.index, no arguments */
92+#define IP_POOL_INIT 0x00000012 /* from addr to addr2 incl. */
93+#define IP_POOL_DESTROY 0x00000013 /* req.index, no arguments */
94+#define IP_POOL_ADD_ADDR 0x00000014 /* add addr to pool */
95+#define IP_POOL_DEL_ADDR 0x00000015 /* del addr from pool */
96+#define IP_POOL_HIGH_NR 0x00000016 /* result in req.index */
97+#define IP_POOL_LOOKUP 0x00000017 /* result in addr and addr2 */
98+#define IP_POOL_USAGE 0x00000018 /* result in addr */
99+#define IP_POOL_TEST_ADDR 0x00000019 /* result (0/1) returned */
100+
101+#ifdef __KERNEL__
102+
103+/* NOTE: ip_pool_match() and ip_pool_mod() expect ADDR to be host byte order */
104+extern int ip_pool_match(ip_pool_t pool, u_int32_t addr);
105+extern int ip_pool_mod(ip_pool_t pool, u_int32_t addr, int isdel);
106+
107+#endif
108+
109+#endif /*_IP_POOL_H*/
110diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_TTL.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_TTL.h
111--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_TTL.h 1970-01-01 00:00:00.000000000 +0000
112+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_TTL.h 2004-03-22 08:28:11.000000000 +0000
113@@ -0,0 +1,21 @@
114+/* TTL modification module for IP tables
115+ * (C) 2000 by Harald Welte <laforge@gnumonks.org> */
116+
117+#ifndef _IPT_TTL_H
118+#define _IPT_TTL_H
119+
120+enum {
121+ IPT_TTL_SET = 0,
122+ IPT_TTL_INC,
123+ IPT_TTL_DEC
124+};
125+
126+#define IPT_TTL_MAXMODE IPT_TTL_DEC
127+
128+struct ipt_TTL_info {
129+ u_int8_t mode;
130+ u_int8_t ttl;
131+};
132+
133+
134+#endif
135diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_ULOG.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_ULOG.h
136--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_ULOG.h 2004-03-20 00:11:05.000000000 +0000
137+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_ULOG.h 2004-03-22 08:27:15.000000000 +0000
138@@ -11,6 +11,9 @@
139 #define NETLINK_NFLOG 5
140 #endif
141
142+#define ULOG_DEFAULT_NLGROUP 1
143+#define ULOG_DEFAULT_QTHRESHOLD 1
144+
145 #define ULOG_MAC_LEN 80
146 #define ULOG_PREFIX_LEN 32
147
148diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_connlimit.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_connlimit.h
149--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_connlimit.h 1970-01-01 00:00:00.000000000 +0000
150+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_connlimit.h 2004-03-22 08:28:18.000000000 +0000
151@@ -0,0 +1,12 @@
152+#ifndef _IPT_CONNLIMIT_H
153+#define _IPT_CONNLIMIT_H
154+
155+struct ipt_connlimit_data;
156+
157+struct ipt_connlimit_info {
158+ int limit;
159+ int inverse;
160+ u_int32_t mask;
161+ struct ipt_connlimit_data *data;
162+};
163+#endif /* _IPT_CONNLIMIT_H */
164diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_conntrack.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_conntrack.h
165--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_conntrack.h 2004-03-20 00:11:34.000000000 +0000
166+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_conntrack.h 2004-03-22 08:29:50.000000000 +0000
167@@ -10,6 +10,7 @@
168
169 #define IPT_CONNTRACK_STATE_SNAT (1 << (IP_CT_NUMBER + 1))
170 #define IPT_CONNTRACK_STATE_DNAT (1 << (IP_CT_NUMBER + 2))
171+#define IPT_CONNTRACK_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 3))
172
173 /* flags, invflags: */
174 #define IPT_CONNTRACK_STATE 0x01
175diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_dstlimit.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_dstlimit.h
176--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_dstlimit.h 1970-01-01 00:00:00.000000000 +0000
177+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_dstlimit.h 2004-03-22 08:28:26.000000000 +0000
178@@ -0,0 +1,39 @@
179+#ifndef _IPT_DSTLIMIT_H
180+#define _IPT_DSTLIMIT_H
181+
182+/* timings are in milliseconds. */
183+#define IPT_DSTLIMIT_SCALE 10000
184+/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
185+ seconds, or one every 59 hours. */
186+
187+/* details of this structure hidden by the implementation */
188+struct ipt_dstlimit_htable;
189+
190+#define IPT_DSTLIMIT_HASH_DIP 0x0001
191+#define IPT_DSTLIMIT_HASH_DPT 0x0002
192+#define IPT_DSTLIMIT_HASH_SIP 0x0004
193+
194+struct dstlimit_cfg {
195+ u_int32_t mode; /* bitmask of IPT_DSTLIMIT_HASH_* */
196+ u_int32_t avg; /* Average secs between packets * scale */
197+ u_int32_t burst; /* Period multiplier for upper limit. */
198+
199+ /* user specified */
200+ u_int32_t size; /* how many buckets */
201+ u_int32_t max; /* max number of entries */
202+ u_int32_t gc_interval; /* gc interval */
203+ u_int32_t expire; /* when do entries expire? */
204+};
205+
206+struct ipt_dstlimit_info {
207+ char name [IFNAMSIZ]; /* name */
208+ struct dstlimit_cfg cfg;
209+ struct ipt_dstlimit_htable *hinfo;
210+
211+ /* Used internally by the kernel */
212+ union {
213+ void *ptr;
214+ struct ipt_dstlimit_info *master;
215+ } u;
216+};
217+#endif /*_IPT_DSTLIMIT_H*/
218diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_fuzzy.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_fuzzy.h
219--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_fuzzy.h 1970-01-01 00:00:00.000000000 +0000
220+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_fuzzy.h 2004-03-22 08:28:32.000000000 +0000
221@@ -0,0 +1,21 @@
222+#ifndef _IPT_FUZZY_H
223+#define _IPT_FUZZY_H
224+
225+#include <linux/param.h>
226+#include <linux/types.h>
227+
228+#define MAXFUZZYRATE 10000000
229+#define MINFUZZYRATE 3
230+
231+struct ipt_fuzzy_info {
232+ u_int32_t minimum_rate;
233+ u_int32_t maximum_rate;
234+ u_int32_t packets_total;
235+ u_int32_t bytes_total;
236+ u_int32_t previous_time;
237+ u_int32_t present_time;
238+ u_int32_t mean_rate;
239+ u_int8_t acceptance_rate;
240+};
241+
242+#endif /*_IPT_FUZZY_H*/
243diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_ipv4options.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_ipv4options.h
244--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_ipv4options.h 1970-01-01 00:00:00.000000000 +0000
245+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_ipv4options.h 2004-03-22 08:28:47.000000000 +0000
246@@ -0,0 +1,21 @@
247+#ifndef __ipt_ipv4options_h_included__
248+#define __ipt_ipv4options_h_included__
249+
250+#define IPT_IPV4OPTION_MATCH_SSRR 0x01 /* For strict source routing */
251+#define IPT_IPV4OPTION_MATCH_LSRR 0x02 /* For loose source routing */
252+#define IPT_IPV4OPTION_DONT_MATCH_SRR 0x04 /* any source routing */
253+#define IPT_IPV4OPTION_MATCH_RR 0x08 /* For Record route */
254+#define IPT_IPV4OPTION_DONT_MATCH_RR 0x10
255+#define IPT_IPV4OPTION_MATCH_TIMESTAMP 0x20 /* For timestamp request */
256+#define IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP 0x40
257+#define IPT_IPV4OPTION_MATCH_ROUTER_ALERT 0x80 /* For router-alert */
258+#define IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT 0x100
259+#define IPT_IPV4OPTION_MATCH_ANY_OPT 0x200 /* match packet with any option */
260+#define IPT_IPV4OPTION_DONT_MATCH_ANY_OPT 0x400 /* match packet with no option */
261+
262+struct ipt_ipv4options_info {
263+ u_int16_t options;
264+};
265+
266+
267+#endif /* __ipt_ipv4options_h_included__ */
268diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_mport.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_mport.h
269--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_mport.h 1970-01-01 00:00:00.000000000 +0000
270+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_mport.h 2004-03-22 08:28:51.000000000 +0000
271@@ -0,0 +1,24 @@
272+#ifndef _IPT_MPORT_H
273+#define _IPT_MPORT_H
274+#include <linux/netfilter_ipv4/ip_tables.h>
275+
276+#define IPT_MPORT_SOURCE (1<<0)
277+#define IPT_MPORT_DESTINATION (1<<1)
278+#define IPT_MPORT_EITHER (IPT_MPORT_SOURCE|IPT_MPORT_DESTINATION)
279+
280+#define IPT_MULTI_PORTS 15
281+
282+/* Must fit inside union ipt_matchinfo: 32 bytes */
283+/* every entry in ports[] except for the last one has one bit in pflags
284+ * associated with it. If this bit is set, the port is the first port of
285+ * a portrange, with the next entry being the last.
286+ * End of list is marked with pflags bit set and port=65535.
287+ * If 14 ports are used (last one does not have a pflag), the last port
288+ * is repeated to fill the last entry in ports[] */
289+struct ipt_mport
290+{
291+ u_int8_t flags:2; /* Type of comparison */
292+ u_int16_t pflags:14; /* Port flags */
293+ u_int16_t ports[IPT_MULTI_PORTS]; /* Ports */
294+};
295+#endif /*_IPT_MPORT_H*/
296diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_nth.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_nth.h
297--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_nth.h 1970-01-01 00:00:00.000000000 +0000
298+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_nth.h 2004-03-22 08:29:02.000000000 +0000
299@@ -0,0 +1,19 @@
300+#ifndef _IPT_NTH_H
301+#define _IPT_NTH_H
302+
303+#include <linux/param.h>
304+#include <linux/types.h>
305+
306+#ifndef IPT_NTH_NUM_COUNTERS
307+#define IPT_NTH_NUM_COUNTERS 16
308+#endif
309+
310+struct ipt_nth_info {
311+ u_int8_t every;
312+ u_int8_t not;
313+ u_int8_t startat;
314+ u_int8_t counter;
315+ u_int8_t packet;
316+};
317+
318+#endif /*_IPT_NTH_H*/
319diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_osf.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_osf.h
320--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_osf.h 1970-01-01 00:00:00.000000000 +0000
321+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_osf.h 2004-03-22 08:29:11.000000000 +0000
322@@ -0,0 +1,148 @@
323+/*
324+ * ipt_osf.h
325+ *
326+ * Copyright (c) 2003 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
327+ *
328+ *
329+ * This program is free software; you can redistribute it and/or modify
330+ * it under the terms of the GNU General Public License as published by
331+ * the Free Software Foundation; either version 2 of the License, or
332+ * (at your option) any later version.
333+ *
334+ * This program is distributed in the hope that it will be useful,
335+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
336+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
337+ * GNU General Public License for more details.
338+ *
339+ * You should have received a copy of the GNU General Public License
340+ * along with this program; if not, write to the Free Software
341+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
342+ */
343+
344+#ifndef _IPT_OSF_H
345+#define _IPT_OSF_H
346+
347+#define MAXGENRELEN 32
348+#define MAXDETLEN 64
349+
350+#define IPT_OSF_GENRE 1
351+#define IPT_OSF_SMART 2
352+#define IPT_OSF_LOG 4
353+#define IPT_OSF_NETLINK 8
354+
355+#define IPT_OSF_LOGLEVEL_ALL 0
356+#define IPT_OSF_LOGLEVEL_FIRST 1
357+
358+#include <linux/list.h>
359+
360+#ifndef __KERNEL__
361+#include <netinet/ip.h>
362+#include <netinet/tcp.h>
363+
364+struct list_head
365+{
366+ struct list_head *prev, *next;
367+};
368+#endif
369+
370+struct ipt_osf_info
371+{
372+ char genre[MAXGENRELEN];
373+ int len;
374+ unsigned long flags;
375+ int loglevel;
376+ int invert; /* UNSUPPORTED */
377+};
378+
379+struct osf_wc
380+{
381+ char wc;
382+ unsigned long val;
383+};
384+
385+/* This struct represents IANA options
386+ * http://www.iana.org/assignments/tcp-parameters
387+ */
388+struct osf_opt
389+{
390+ unsigned char kind;
391+ unsigned char length;
392+ struct osf_wc wc;
393+};
394+
395+struct osf_finger
396+{
397+ struct list_head flist;
398+ struct osf_wc wss;
399+ unsigned char ttl;
400+ unsigned char df;
401+ unsigned long ss;
402+ unsigned char genre[MAXGENRELEN];
403+ unsigned char version[MAXGENRELEN], subtype[MAXGENRELEN];
404+
405+ /* Not needed, but for consistency with original table from Michal Zalewski */
406+ unsigned char details[MAXDETLEN];
407+
408+ int opt_num;
409+ struct osf_opt opt[MAX_IPOPTLEN]; /* In case it is all NOP or EOL */
410+
411+};
412+
413+struct ipt_osf_nlmsg
414+{
415+ struct osf_finger f;
416+ struct iphdr ip;
417+ struct tcphdr tcp;
418+};
419+
420+#ifdef __KERNEL__
421+
422+/* Defines for IANA option kinds */
423+
424+#define OSFOPT_EOL 0 /* End of options */
425+#define OSFOPT_NOP 1 /* NOP */
426+#define OSFOPT_MSS 2 /* Maximum segment size */
427+#define OSFOPT_WSO 3 /* Window scale option */
428+#define OSFOPT_SACKP 4 /* SACK permitted */
429+#define OSFOPT_SACK 5 /* SACK */
430+#define OSFOPT_ECHO 6
431+#define OSFOPT_ECHOREPLY 7
432+#define OSFOPT_TS 8 /* Timestamp option */
433+#define OSFOPT_POCP 9 /* Partial Order Connection Permitted */
434+#define OSFOPT_POSP 10 /* Partial Order Service Profile */
435+/* Others are not used in current OSF */
436+
437+static struct osf_opt IANA_opts[] =
438+{
439+ {0, 1,},
440+ {1, 1,},
441+ {2, 4,},
442+ {3, 3,},
443+ {4, 2,},
444+ {5, 1 ,}, /* SACK length is not defined */
445+ {6, 6,},
446+ {7, 6,},
447+ {8, 10,},
448+ {9, 2,},
449+ {10, 3,},
450+ {11, 1,}, /* CC: Suppose 1 */
451+ {12, 1,}, /* the same */
452+ {13, 1,}, /* and here too */
453+ {14, 3,},
454+ {15, 1,}, /* TCP Alternate Checksum Data. Length is not defined */
455+ {16, 1,},
456+ {17, 1,},
457+ {18, 3,},
458+ {19, 18,},
459+ {20, 1,},
460+ {21, 1,},
461+ {22, 1,},
462+ {23, 1,},
463+ {24, 1,},
464+ {25, 1,},
465+ {26, 1,},
466+};
467+
468+#endif /* __KERNEL__ */
469+
470+#endif /* _IPT_OSF_H */
471diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_pool.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_pool.h
472--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_pool.h 1970-01-01 00:00:00.000000000 +0000
473+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_pool.h 2004-03-22 08:29:18.000000000 +0000
474@@ -0,0 +1,25 @@
475+#ifndef _IPT_POOL_H
476+#define _IPT_POOL_H
477+
478+#include <linux/netfilter_ipv4/ip_pool.h>
479+
480+#define IPT_POOL_INV_SRC 0x00000001
481+#define IPT_POOL_INV_DST 0x00000002
482+#define IPT_POOL_DEL_SRC 0x00000004
483+#define IPT_POOL_DEL_DST 0x00000008
484+#define IPT_POOL_INV_MOD_SRC 0x00000010
485+#define IPT_POOL_INV_MOD_DST 0x00000020
486+#define IPT_POOL_MOD_SRC_ACCEPT 0x00000040
487+#define IPT_POOL_MOD_DST_ACCEPT 0x00000080
488+#define IPT_POOL_MOD_SRC_DROP 0x00000100
489+#define IPT_POOL_MOD_DST_DROP 0x00000200
490+
491+/* match info */
492+struct ipt_pool_info
493+{
494+ ip_pool_t src;
495+ ip_pool_t dst;
496+ unsigned flags;
497+};
498+
499+#endif /*_IPT_POOL_H*/
500diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_psd.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_psd.h
501--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_psd.h 1970-01-01 00:00:00.000000000 +0000
502+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_psd.h 2004-03-22 08:29:30.000000000 +0000
503@@ -0,0 +1,40 @@
504+#ifndef _IPT_PSD_H
505+#define _IPT_PSD_H
506+
507+#include <linux/param.h>
508+#include <linux/types.h>
509+
510+/*
511+ * High port numbers have a lower weight to reduce the frequency of false
512+ * positives, such as from passive mode FTP transfers.
513+ */
514+#define PORT_WEIGHT_PRIV 3
515+#define PORT_WEIGHT_HIGH 1
516+
517+/*
518+ * Port scan detection thresholds: at least COUNT ports need to be scanned
519+ * from the same source, with no longer than DELAY ticks between ports.
520+ */
521+#define SCAN_MIN_COUNT 7
522+#define SCAN_MAX_COUNT (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
523+#define SCAN_WEIGHT_THRESHOLD SCAN_MAX_COUNT
524+#define SCAN_DELAY_THRESHOLD (HZ * 3)
525+
526+/*
527+ * Keep track of up to LIST_SIZE source addresses, using a hash table of
528+ * HASH_SIZE entries for faster lookups, but limiting hash collisions to
529+ * HASH_MAX source addresses per the same hash value.
530+ */
531+#define LIST_SIZE 0x100
532+#define HASH_LOG 9
533+#define HASH_SIZE (1 << HASH_LOG)
534+#define HASH_MAX 0x10
535+
536+struct ipt_psd_info {
537+ unsigned int weight_threshold;
538+ unsigned int delay_threshold;
539+ unsigned short lo_ports_weight;
540+ unsigned short hi_ports_weight;
541+};
542+
543+#endif /*_IPT_PSD_H*/
544diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_quota.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_quota.h
545--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_quota.h 1970-01-01 00:00:00.000000000 +0000
546+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_quota.h 2004-03-22 08:29:35.000000000 +0000
547@@ -0,0 +1,11 @@
548+#ifndef _IPT_QUOTA_H
549+#define _IPT_QUOTA_H
550+
551+/* print debug info in both kernel/netfilter module & iptable library */
552+//#define DEBUG_IPT_QUOTA
553+
554+struct ipt_quota_info {
555+ u_int64_t quota;
556+};
557+
558+#endif /*_IPT_QUOTA_H*/
559diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_random.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_random.h
560--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_random.h 1970-01-01 00:00:00.000000000 +0000
561+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_random.h 2004-03-22 08:29:43.000000000 +0000
562@@ -0,0 +1,11 @@
563+#ifndef _IPT_RAND_H
564+#define _IPT_RAND_H
565+
566+#include <linux/param.h>
567+#include <linux/types.h>
568+
569+struct ipt_rand_info {
570+ u_int8_t average;
571+};
572+
573+#endif /*_IPT_RAND_H*/
574diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_realm.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_realm.h
575--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_realm.h 1970-01-01 00:00:00.000000000 +0000
576+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_realm.h 2004-03-22 08:29:57.000000000 +0000
577@@ -0,0 +1,9 @@
578+#ifndef _IPT_REALM_H
579+#define _IPT_REALM_H
580+
581+struct ipt_realm_info {
582+ u_int32_t id;
583+ u_int32_t mask;
584+ u_int8_t invert;
585+};
586+#endif /*_IPT_REALM_H*/
587diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_sctp.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_sctp.h
588--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_sctp.h 1970-01-01 00:00:00.000000000 +0000
589+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_sctp.h 2004-03-22 08:30:03.000000000 +0000
590@@ -0,0 +1,107 @@
591+#ifndef _IPT_SCTP_H_
592+#define _IPT_SCTP_H_
593+
594+#define IPT_SCTP_SRC_PORTS 0x01
595+#define IPT_SCTP_DEST_PORTS 0x02
596+#define IPT_SCTP_CHUNK_TYPES 0x04
597+
598+#define IPT_SCTP_VALID_FLAGS 0x07
599+
600+#define ELEMCOUNT(x) (sizeof(x)/sizeof(x[0]))
601+
602+
603+struct ipt_sctp_flag_info {
604+ u_int8_t chunktype;
605+ u_int8_t flag;
606+ u_int8_t flag_mask;
607+};
608+
609+#define IPT_NUM_SCTP_FLAGS 4
610+
611+struct ipt_sctp_info {
612+ u_int16_t dpts[2]; /* Min, Max */
613+ u_int16_t spts[2]; /* Min, Max */
614+
615+ u_int32_t chunkmap[256 / sizeof (u_int32_t)]; /* Bit mask of chunks to be matched according to RFC 2960 */
616+
617+#define SCTP_CHUNK_MATCH_ANY 0x01 /* Match if any of the chunk types are present */
618+#define SCTP_CHUNK_MATCH_ALL 0x02 /* Match if all of the chunk types are present */
619+#define SCTP_CHUNK_MATCH_ONLY 0x04 /* Match if these are the only chunk types present */
620+
621+ u_int32_t chunk_match_type;
622+ struct ipt_sctp_flag_info flag_info[IPT_NUM_SCTP_FLAGS];
623+ int flag_count;
624+
625+ u_int32_t flags;
626+ u_int32_t invflags;
627+};
628+
629+#define bytes(type) (sizeof(type) * 8)
630+
631+#define SCTP_CHUNKMAP_SET(chunkmap, type) \
632+ do { \
633+ chunkmap[type / bytes(u_int32_t)] |= \
634+ 1 << (type % bytes(u_int32_t)); \
635+ } while (0)
636+
637+#define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \
638+ do { \
639+ chunkmap[type / bytes(u_int32_t)] &= \
640+ ~(1 << (type % bytes(u_int32_t))); \
641+ } while (0)
642+
643+#define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \
644+({ \
645+ (chunkmap[type / bytes (u_int32_t)] & \
646+ (1 << (type % bytes (u_int32_t)))) ? 1: 0; \
647+})
648+
649+#define SCTP_CHUNKMAP_RESET(chunkmap) \
650+ do { \
651+ int i; \
652+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
653+ chunkmap[i] = 0; \
654+ } while (0)
655+
656+#define SCTP_CHUNKMAP_SET_ALL(chunkmap) \
657+ do { \
658+ int i; \
659+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
660+ chunkmap[i] = ~0; \
661+ } while (0)
662+
663+#define SCTP_CHUNKMAP_COPY(destmap, srcmap) \
664+ do { \
665+ int i; \
666+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
667+ destmap[i] = srcmap[i]; \
668+ } while (0)
669+
670+#define SCTP_CHUNKMAP_IS_CLEAR(chunkmap) \
671+({ \
672+ int i; \
673+ int flag = 1; \
674+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) { \
675+ if (chunkmap[i]) { \
676+ flag = 0; \
677+ break; \
678+ } \
679+ } \
680+ flag; \
681+})
682+
683+#define SCTP_CHUNKMAP_IS_ALL_SET(chunkmap) \
684+({ \
685+ int i; \
686+ int flag = 1; \
687+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) { \
688+ if (chunkmap[i] != ~0) { \
689+ flag = 0; \
690+ break; \
691+ } \
692+ } \
693+ flag; \
694+})
695+
696+#endif /* _IPT_SCTP_H_ */
697+
698diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_state.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_state.h
699--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_state.h 2004-03-20 00:11:41.000000000 +0000
700+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_state.h 2004-03-22 08:29:50.000000000 +0000
701@@ -4,6 +4,8 @@
702 #define IPT_STATE_BIT(ctinfo) (1 << ((ctinfo)%IP_CT_IS_REPLY+1))
703 #define IPT_STATE_INVALID (1 << 0)
704
705+#define IPT_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 1))
706+
707 struct ipt_state_info
708 {
709 unsigned int statemask;
710diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_time.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_time.h
711--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_time.h 1970-01-01 00:00:00.000000000 +0000
712+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_time.h 2004-03-22 08:30:10.000000000 +0000
713@@ -0,0 +1,13 @@
714+#ifndef __ipt_time_h_included__
715+#define __ipt_time_h_included__
716+
717+
718+struct ipt_time_info {
719+ u_int8_t days_match; /* 1 bit per day. -SMTWTFS */
720+ u_int16_t time_start; /* 0 < time_start < 23*60+59 = 1439 */
721+ u_int16_t time_stop; /* 0:0 < time_stat < 23:59 */
722+ u_int8_t kerneltime; /* ignore skb time (and use kerneltime) or not. */
723+};
724+
725+
726+#endif /* __ipt_time_h_included__ */
727diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_u32.h linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_u32.h
728--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4/ipt_u32.h 1970-01-01 00:00:00.000000000 +0000
729+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4/ipt_u32.h 2004-03-22 08:30:19.000000000 +0000
730@@ -0,0 +1,40 @@
731+#ifndef _IPT_U32_H
732+#define _IPT_U32_H
733+#include <linux/netfilter_ipv4/ip_tables.h>
734+
735+enum ipt_u32_ops
736+{
737+ IPT_U32_AND,
738+ IPT_U32_LEFTSH,
739+ IPT_U32_RIGHTSH,
740+ IPT_U32_AT
741+};
742+
743+struct ipt_u32_location_element
744+{
745+ u_int32_t number;
746+ u_int8_t nextop;
747+};
748+struct ipt_u32_value_element
749+{
750+ u_int32_t min;
751+ u_int32_t max;
752+};
753+/* *** any way to allow for an arbitrary number of elements?
754+ for now I settle for a limit of 10 of each */
755+#define U32MAXSIZE 10
756+struct ipt_u32_test
757+{
758+ u_int8_t nnums;
759+ struct ipt_u32_location_element location[U32MAXSIZE+1];
760+ u_int8_t nvalues;
761+ struct ipt_u32_value_element value[U32MAXSIZE+1];
762+};
763+
764+struct ipt_u32
765+{
766+ u_int8_t ntests;
767+ struct ipt_u32_test tests[U32MAXSIZE+1];
768+};
769+
770+#endif /*_IPT_U32_H*/
771diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv4.h linux-2.6.5-rc2/include/linux/netfilter_ipv4.h
772--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv4.h 2004-03-20 00:11:41.000000000 +0000
773+++ linux-2.6.5-rc2/include/linux/netfilter_ipv4.h 2004-03-22 08:29:50.000000000 +0000
774@@ -51,6 +51,8 @@
775
776 enum nf_ip_hook_priorities {
777 NF_IP_PRI_FIRST = INT_MIN,
778+ NF_IP_PRI_CONNTRACK_DEFRAG = -400,
779+ NF_IP_PRI_RAW = -300,
780 NF_IP_PRI_SELINUX_FIRST = -225,
781 NF_IP_PRI_CONNTRACK = -200,
782 NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
783diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv6/ip6t_HL.h linux-2.6.5-rc2/include/linux/netfilter_ipv6/ip6t_HL.h
784--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv6/ip6t_HL.h 1970-01-01 00:00:00.000000000 +0000
785+++ linux-2.6.5-rc2/include/linux/netfilter_ipv6/ip6t_HL.h 2004-03-22 08:27:23.000000000 +0000
786@@ -0,0 +1,22 @@
787+/* Hop Limit modification module for ip6tables
788+ * Maciej Soltysiak <solt@dns.toxicfilms.tv>
789+ * Based on HW's TTL module */
790+
791+#ifndef _IP6T_HL_H
792+#define _IP6T_HL_H
793+
794+enum {
795+ IP6T_HL_SET = 0,
796+ IP6T_HL_INC,
797+ IP6T_HL_DEC
798+};
799+
800+#define IP6T_HL_MAXMODE IP6T_HL_DEC
801+
802+struct ip6t_HL_info {
803+ u_int8_t mode;
804+ u_int8_t hop_limit;
805+};
806+
807+
808+#endif
809diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv6/ip6t_REJECT.h linux-2.6.5-rc2/include/linux/netfilter_ipv6/ip6t_REJECT.h
810--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv6/ip6t_REJECT.h 2004-03-20 00:11:00.000000000 +0000
811+++ linux-2.6.5-rc2/include/linux/netfilter_ipv6/ip6t_REJECT.h 2004-03-22 08:28:02.000000000 +0000
812@@ -2,15 +2,17 @@
813 #define _IP6T_REJECT_H
814
815 enum ip6t_reject_with {
816- IP6T_ICMP_NET_UNREACHABLE,
817- IP6T_ICMP_HOST_UNREACHABLE,
818- IP6T_ICMP_PROT_UNREACHABLE,
819- IP6T_ICMP_PORT_UNREACHABLE,
820- IP6T_ICMP_ECHOREPLY
821+ IP6T_ICMP6_NO_ROUTE,
822+ IP6T_ICMP6_ADM_PROHIBITED,
823+ IP6T_ICMP6_NOT_NEIGHBOUR,
824+ IP6T_ICMP6_ADDR_UNREACH,
825+ IP6T_ICMP6_PORT_UNREACH,
826+ IP6T_ICMP6_ECHOREPLY,
827+ IP6T_TCP_RESET
828 };
829
830 struct ip6t_reject_info {
831 enum ip6t_reject_with with; /* reject type */
832 };
833
834-#endif /*_IPT_REJECT_H*/
835+#endif /*_IP6T_REJECT_H*/
836diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv6/ip6t_fuzzy.h linux-2.6.5-rc2/include/linux/netfilter_ipv6/ip6t_fuzzy.h
837--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv6/ip6t_fuzzy.h 1970-01-01 00:00:00.000000000 +0000
838+++ linux-2.6.5-rc2/include/linux/netfilter_ipv6/ip6t_fuzzy.h 2004-03-22 08:28:32.000000000 +0000
839@@ -0,0 +1,21 @@
840+#ifndef _IP6T_FUZZY_H
841+#define _IP6T_FUZZY_H
842+
843+#include <linux/param.h>
844+#include <linux/types.h>
845+
846+#define MAXFUZZYRATE 10000000
847+#define MINFUZZYRATE 3
848+
849+struct ip6t_fuzzy_info {
850+ u_int32_t minimum_rate;
851+ u_int32_t maximum_rate;
852+ u_int32_t packets_total;
853+ u_int32_t bytes_total;
854+ u_int32_t previous_time;
855+ u_int32_t present_time;
856+ u_int32_t mean_rate;
857+ u_int8_t acceptance_rate;
858+};
859+
860+#endif /*_IP6T_FUZZY_H*/
861diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv6/ip6t_nth.h linux-2.6.5-rc2/include/linux/netfilter_ipv6/ip6t_nth.h
862--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv6/ip6t_nth.h 1970-01-01 00:00:00.000000000 +0000
863+++ linux-2.6.5-rc2/include/linux/netfilter_ipv6/ip6t_nth.h 2004-03-22 08:29:02.000000000 +0000
864@@ -0,0 +1,19 @@
865+#ifndef _IP6T_NTH_H
866+#define _IP6T_NTH_H
867+
868+#include <linux/param.h>
869+#include <linux/types.h>
870+
871+#ifndef IP6T_NTH_NUM_COUNTERS
872+#define IP6T_NTH_NUM_COUNTERS 16
873+#endif
874+
875+struct ip6t_nth_info {
876+ u_int8_t every;
877+ u_int8_t not;
878+ u_int8_t startat;
879+ u_int8_t counter;
880+ u_int8_t packet;
881+};
882+
883+#endif /*_IP6T_NTH_H*/
884diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/include/linux/netfilter_ipv6/ip6t_random.h linux-2.6.5-rc2/include/linux/netfilter_ipv6/ip6t_random.h
885--- linux-2.6.5-rc2.org/include/linux/netfilter_ipv6/ip6t_random.h 1970-01-01 00:00:00.000000000 +0000
886+++ linux-2.6.5-rc2/include/linux/netfilter_ipv6/ip6t_random.h 2004-03-22 08:29:43.000000000 +0000
887@@ -0,0 +1,11 @@
888+#ifndef _IP6T_RAND_H
889+#define _IP6T_RAND_H
890+
891+#include <linux/param.h>
892+#include <linux/types.h>
893+
894+struct ip6t_rand_info {
895+ u_int8_t average;
896+};
897+
898+#endif /*_IP6T_RAND_H*/
899diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/core/netfilter.c linux-2.6.5-rc2/net/core/netfilter.c
900--- linux-2.6.5-rc2.org/net/core/netfilter.c 2004-03-20 00:11:08.000000000 +0000
901+++ linux-2.6.5-rc2/net/core/netfilter.c 2004-03-22 08:27:15.000000000 +0000
902@@ -8,8 +8,10 @@
903 *
904 * February 2000: Modified by James Morris to have 1 queue per protocol.
905 * 15-Mar-2000: Added NF_REPEAT --RR.
906+ * 08-May-2003: Internal logging interface added by Jozsef Kadlecsik.
907 */
908 #include <linux/config.h>
909+#include <linux/kernel.h>
910 #include <linux/netfilter.h>
911 #include <net/protocol.h>
912 #include <linux/init.h>
913@@ -741,6 +743,72 @@
914 EXPORT_SYMBOL(skb_ip_make_writable);
915 #endif /*CONFIG_INET*/
916
917+/* Internal logging interface, which relies on the real
918+ LOG target modules */
919+
920+#define NF_LOG_PREFIXLEN 128
921+
922+static nf_logfn *nf_logging[NPROTO]; /* = NULL */
923+static int reported = 0;
924+static spinlock_t nf_log_lock = SPIN_LOCK_UNLOCKED;
925+
926+int nf_log_register(int pf, nf_logfn *logfn)
927+{
928+ int ret = -EBUSY;
929+
930+ /* Any setup of logging members must be done before
931+ * substituting pointer. */
932+ smp_wmb();
933+ spin_lock(&nf_log_lock);
934+ if (!nf_logging[pf]) {
935+ nf_logging[pf] = logfn;
936+ ret = 0;
937+ }
938+ spin_unlock(&nf_log_lock);
939+ return ret;
940+}
941+
942+void nf_log_unregister(int pf, nf_logfn *logfn)
943+{
944+ spin_lock(&nf_log_lock);
945+ if (nf_logging[pf] == logfn)
946+ nf_logging[pf] = NULL;
947+ spin_unlock(&nf_log_lock);
948+
949+ /* Give time to concurrent readers. */
950+ synchronize_net();
951+}
952+
953+void nf_log_packet(int pf,
954+ unsigned int hooknum,
955+ const struct sk_buff *skb,
956+ const struct net_device *in,
957+ const struct net_device *out,
958+ const char *fmt, ...)
959+{
960+ va_list args;
961+ char prefix[NF_LOG_PREFIXLEN];
962+ nf_logfn *logfn;
963+
964+ rcu_read_lock();
965+ logfn = nf_logging[pf];
966+ if (logfn) {
967+ va_start(args, fmt);
968+ vsnprintf(prefix, sizeof(prefix), fmt, args);
969+ va_end(args);
970+ /* We must read logging before nf_logfn[pf] */
971+ smp_read_barrier_depends();
972+ logfn(hooknum, skb, in, out, prefix);
973+ } else if (!reported) {
974+ printk(KERN_WARNING "nf_log_packet: can\'t log yet, "
975+ "no backend logging module loaded in!\n");
976+ reported++;
977+ }
978+ rcu_read_unlock();
979+}
980+EXPORT_SYMBOL(nf_log_register);
981+EXPORT_SYMBOL(nf_log_unregister);
982+EXPORT_SYMBOL(nf_log_packet);
983
984 /* This does not belong here, but ipt_REJECT needs it if connection
985 tracking in use: without this, connection may not be in hash table,
986diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/Kconfig linux-2.6.5-rc2/net/ipv4/netfilter/Kconfig
987--- linux-2.6.5-rc2.org/net/ipv4/netfilter/Kconfig 2004-03-20 00:11:41.000000000 +0000
988+++ linux-2.6.5-rc2/net/ipv4/netfilter/Kconfig 2004-03-22 08:30:19.000000000 +0000
989@@ -579,5 +579,118 @@
990
991 To compile it as a module, choose M here. If unsure, say N.
992
993+config IP_NF_TARGET_IPV4OPTSSTRIP
994+ tristate 'IPV4OPTSSTRIP target support'
995+ depends on IP_NF_MANGLE
996+ help
997+
998+config IP_NF_TARGET_TTL
999+ tristate 'TTL target support'
1000+ depends on IP_NF_MANGLE
1001+ help
1002+
1003+config IP_NF_MATCH_CONNLIMIT
1004+ tristate 'Connections/IP limit match support'
1005+ depends on IP_NF_IPTABLES
1006+ help
1007+
1008+config IP_NF_MATCH_DSTLIMIT
1009+ tristate 'dstlimit match support'
1010+ depends on IP_NF_IPTABLES
1011+ help
1012+
1013+config IP_NF_MATCH_FUZZY
1014+ tristate 'fuzzy match support'
1015+ depends on IP_NF_IPTABLES
1016+ help
1017+
1018+config IP_NF_MATCH_IPV4OPTIONS
1019+ tristate 'IPV4OPTIONS match support'
1020+ depends on IP_NF_IPTABLES
1021+ help
1022+
1023+config IP_NF_MATCH_MPORT
1024+ tristate 'Multiple port with ranges match support'
1025+ depends on IP_NF_IPTABLES
1026+ help
1027+
1028+config IP_NF_MATCH_NTH
1029+ tristate 'Nth match support'
1030+ depends on IP_NF_IPTABLES
1031+ help
1032+
1033+config IP_NF_MATCH_OSF
1034+ tristate 'OSF match support'
1035+ depends on IP_NF_IPTABLES
1036+ help
1037+
1038+config IP_POOL_STATISTICS
1039+ bool 'enable statistics on pool usage'
1040+ depends on IP_NF_POOL!=n
1041+
1042+config IP_NF_POOL
1043+ tristate 'IP address pool support'
1044+ depends on IP_NF_IPTABLES
1045+ help
1046+
1047+config IP_NF_MATCH_PSD
1048+ tristate 'psd match support'
1049+ depends on IP_NF_IPTABLES
1050+ help
1051+
1052+config IP_NF_MATCH_QUOTA
1053+ tristate 'quota match support'
1054+ depends on IP_NF_IPTABLES
1055+ help
1056+
1057+config IP_NF_MATCH_RANDOM
1058+ tristate 'random match support'
1059+ depends on IP_NF_IPTABLES
1060+ help
1061+
1062+config IP_NF_TARGET_NOTRACK
1063+ tristate 'NOTRACK target support'
1064+ depends on IP_NF_RAW
1065+ help
1066+ The NOTRACK target allows a select rule to specify
1067+ which packets *not* to enter the conntrack/NAT
1068+ subsystem with all the consequences (no ICMP error tracking,
1069+ no protocol helpers for the selected packets).
1070+
1071+ If you want to compile it as a module, say M here and read
1072+ <file:Documentation/modules.txt>. If unsure, say `N'.
1073+
1074+config IP_NF_RAW
1075+ tristate 'raw table support (required for NOTRACK/TRACE)'
1076+ depends on IP_NF_IPTABLES
1077+ help
1078+ This option adds a `raw' table to iptables. This table is the very
1079+ first in the netfilter framework and hooks in at the PREROUTING
1080+ and OUTPUT chains.
1081+
1082+ If you want to compile it as a module, say M here and read
1083+ <file:Documentation/modules.txt>. If unsure, say `N'.
1084+ help
1085+
1086+config IP_NF_MATCH_REALM
1087+ tristate 'realm match support'
1088+ depends on IP_NF_IPTABLES && NET_CLS_ROUTE
1089+ help
1090+
1091+config IP_NF_MATCH_SCTP
1092+ tristate 'SCTP protocol match support'
1093+ depends on IP_NF_IPTABLES
1094+ help
1095+
1096+config IP_NF_MATCH_TIME
1097+ tristate 'TIME match support'
1098+ depends on IP_NF_IPTABLES
1099+ help
1100+
1101+config IP_NF_MATCH_U32
1102+ tristate 'U32 match support'
1103+ depends on IP_NF_IPTABLES
1104+ help
1105+
1106 endmenu
1107
1108diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/Makefile linux-2.6.5-rc2/net/ipv4/netfilter/Makefile
1109--- linux-2.6.5-rc2.org/net/ipv4/netfilter/Makefile 2004-03-20 00:11:03.000000000 +0000
1110+++ linux-2.6.5-rc2/net/ipv4/netfilter/Makefile 2004-03-22 08:30:19.000000000 +0000
1111@@ -38,19 +38,44 @@
1112 obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
1113 obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
1114 obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
1115+obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
1116
1117 # matches
1118 obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
1119 obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
1120+obj-$(CONFIG_IP_NF_MATCH_SCTP) += ipt_sctp.o
1121+obj-$(CONFIG_IP_NF_MATCH_QUOTA) += ipt_quota.o
1122+obj-$(CONFIG_IP_NF_MATCH_DSTLIMIT) += ipt_dstlimit.o
1123 obj-$(CONFIG_IP_NF_MATCH_MARK) += ipt_mark.o
1124+obj-$(CONFIG_IP_NF_POOL) += ipt_pool.o ipt_POOL.o ip_pool.o
1125 obj-$(CONFIG_IP_NF_MATCH_MAC) += ipt_mac.o
1126 obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
1127
1128 obj-$(CONFIG_IP_NF_MATCH_PKTTYPE) += ipt_pkttype.o
1129 obj-$(CONFIG_IP_NF_MATCH_MULTIPORT) += ipt_multiport.o
1130+
1131+obj-$(CONFIG_IP_NF_MATCH_MPORT) += ipt_mport.o
1132+
1133 obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
1134 obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
1135
1136+obj-$(CONFIG_IP_NF_MATCH_TIME) += ipt_time.o
1137+
1138+
1139+obj-$(CONFIG_IP_NF_MATCH_RANDOM) += ipt_random.o
1140+
1141+obj-$(CONFIG_IP_NF_MATCH_PSD) += ipt_psd.o
1142+
1143+obj-$(CONFIG_IP_NF_MATCH_OSF) += ipt_osf.o
1144+
1145+
1146+obj-$(CONFIG_IP_NF_MATCH_NTH) += ipt_nth.o
1147+
1148+obj-$(CONFIG_IP_NF_MATCH_IPV4OPTIONS) += ipt_ipv4options.o
1149+
1150+
1151+obj-$(CONFIG_IP_NF_MATCH_FUZZY) += ipt_fuzzy.o
1152+
1153 obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
1154
1155 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
1156@@ -59,10 +84,15 @@
1157
1158 obj-$(CONFIG_IP_NF_MATCH_LENGTH) += ipt_length.o
1159
1160+obj-$(CONFIG_IP_NF_MATCH_U32) += ipt_u32.o
1161+
1162+
1163 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
1164 obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
1165+obj-$(CONFIG_IP_NF_MATCH_CONNLIMIT) += ipt_connlimit.o
1166 obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
1167 obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
1168+obj-$(CONFIG_IP_NF_MATCH_REALM) += ipt_realm.o
1169
1170 obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o
1171
1172@@ -79,8 +109,11 @@
1173 obj-$(CONFIG_IP_NF_TARGET_CLASSIFY) += ipt_CLASSIFY.o
1174 obj-$(CONFIG_IP_NF_NAT_SNMP_BASIC) += ip_nat_snmp_basic.o
1175 obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
1176+obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
1177+obj-$(CONFIG_IP_NF_TARGET_IPV4OPTSSTRIP) += ipt_IPV4OPTSSTRIP.o
1178 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
1179 obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
1180+obj-$(CONFIG_IP_NF_TARGET_NOTRACK) += ipt_NOTRACK.o
1181
1182 # generic ARP tables
1183 obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
1184diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/ip_conntrack_core.c linux-2.6.5-rc2/net/ipv4/netfilter/ip_conntrack_core.c
1185--- linux-2.6.5-rc2.org/net/ipv4/netfilter/ip_conntrack_core.c 2004-03-20 00:11:00.000000000 +0000
1186+++ linux-2.6.5-rc2/net/ipv4/netfilter/ip_conntrack_core.c 2004-03-22 08:29:50.000000000 +0000
1187@@ -67,6 +67,7 @@
1188 static atomic_t ip_conntrack_count = ATOMIC_INIT(0);
1189 struct list_head *ip_conntrack_hash;
1190 static kmem_cache_t *ip_conntrack_cachep;
1191+struct ip_conntrack ip_conntrack_untracked;
1192
1193 extern struct ip_conntrack_protocol ip_conntrack_generic_protocol;
1194
1195@@ -691,42 +692,50 @@
1196 struct ip_conntrack_expect *, tuple);
1197 READ_UNLOCK(&ip_conntrack_expect_tuple_lock);
1198
1199- /* If master is not in hash table yet (ie. packet hasn't left
1200- this machine yet), how can other end know about expected?
1201- Hence these are not the droids you are looking for (if
1202- master ct never got confirmed, we'd hold a reference to it
1203- and weird things would happen to future packets). */
1204- if (expected && !is_confirmed(expected->expectant))
1205- expected = NULL;
1206-
1207- /* Look up the conntrack helper for master connections only */
1208- if (!expected)
1209- conntrack->helper = ip_ct_find_helper(&repl_tuple);
1210-
1211- /* If the expectation is dying, then this is a loser. */
1212- if (expected
1213- && expected->expectant->helper->timeout
1214- && ! del_timer(&expected->timeout))
1215- expected = NULL;
1216-
1217 if (expected) {
1218- DEBUGP("conntrack: expectation arrives ct=%p exp=%p\n",
1219- conntrack, expected);
1220- /* Welcome, Mr. Bond. We've been expecting you... */
1221- IP_NF_ASSERT(master_ct(conntrack));
1222- __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
1223- conntrack->master = expected;
1224- expected->sibling = conntrack;
1225- LIST_DELETE(&ip_conntrack_expect_list, expected);
1226- expected->expectant->expecting--;
1227- nf_conntrack_get(&master_ct(conntrack)->infos[0]);
1228- }
1229- atomic_inc(&ip_conntrack_count);
1230+ /* If master is not in hash table yet (ie. packet hasn't left
1231+ this machine yet), how can other end know about expected?
1232+ Hence these are not the droids you are looking for (if
1233+ master ct never got confirmed, we'd hold a reference to it
1234+ and weird things would happen to future packets). */
1235+ if (!is_confirmed(expected->expectant)) {
1236+
1237+ conntrack->helper = ip_ct_find_helper(&repl_tuple);
1238+ goto end;
1239+ }
1240+
1241+ /* Expectation is dying... */
1242+ if (expected->expectant->helper->timeout
1243+ && ! del_timer(&expected->timeout)) {
1244+ goto end;
1245+ }
1246+
1247+ DEBUGP("conntrack: expectation arrives ct=%p exp=%p\n",
1248+ conntrack, expected);
1249+ /* Welcome, Mr. Bond. We've been expecting you... */
1250+ IP_NF_ASSERT(master_ct(conntrack));
1251+ __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
1252+ conntrack->master = expected;
1253+ expected->sibling = conntrack;
1254+ LIST_DELETE(&ip_conntrack_expect_list, expected);
1255+ expected->expectant->expecting--;
1256+ nf_conntrack_get(&master_ct(conntrack)->infos[0]);
1257+
1258+ /* this is a braindead... --pablo */
1259+ atomic_inc(&ip_conntrack_count);
1260+ WRITE_UNLOCK(&ip_conntrack_lock);
1261+
1262+ if (expected->expectfn)
1263+ expected->expectfn(conntrack);
1264+
1265+ goto ret;
1266+ } else
1267+ conntrack->helper = ip_ct_find_helper(&repl_tuple);
1268+
1269+end: atomic_inc(&ip_conntrack_count);
1270 WRITE_UNLOCK(&ip_conntrack_lock);
1271
1272- if (expected && expected->expectfn)
1273- expected->expectfn(conntrack);
1274- return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
1275+ret: return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
1276 }
1277
1278 /* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
1279@@ -794,6 +803,15 @@
1280 int set_reply;
1281 int ret;
1282
1283+ /* Never happen */
1284+ if ((*pskb)->nh.iph->frag_off & htons(IP_OFFSET)) {
1285+ if (net_ratelimit()) {
1286+ printk(KERN_ERR "ip_conntrack_in: Frag of proto %u (hook=%u)\n",
1287+ (*pskb)->nh.iph->protocol, hooknum);
1288+ }
1289+ return NF_DROP;
1290+ }
1291+
1292 /* FIXME: Do this right please. --RR */
1293 (*pskb)->nfcache |= NFC_UNKNOWN;
1294
1295@@ -812,18 +830,10 @@
1296 }
1297 #endif
1298
1299- /* Previously seen (loopback)? Ignore. Do this before
1300- fragment check. */
1301+ /* Previously seen (loopback or untracked)? Ignore. */
1302 if ((*pskb)->nfct)
1303 return NF_ACCEPT;
1304
1305- /* Gather fragments. */
1306- if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
1307- *pskb = ip_ct_gather_frags(*pskb);
1308- if (!*pskb)
1309- return NF_STOLEN;
1310- }
1311-
1312 proto = ip_ct_find_proto((*pskb)->nh.iph->protocol);
1313
1314 /* It may be an icmp error... */
1315@@ -1422,6 +1432,18 @@
1316
1317 /* For use by ipt_REJECT */
1318 ip_ct_attach = ip_conntrack_attach;
1319+
1320+ /* Set up fake conntrack:
1321+ - to never be deleted, not in any hashes */
1322+ atomic_set(&ip_conntrack_untracked.ct_general.use, 1);
1323+ /* - and look it like as a confirmed connection */
1324+ set_bit(IPS_CONFIRMED_BIT, &ip_conntrack_untracked.status);
1325+ /* - and prepare the ctinfo field for REJECT & NAT. */
1326+ ip_conntrack_untracked.infos[IP_CT_NEW].master =
1327+ ip_conntrack_untracked.infos[IP_CT_RELATED].master =
1328+ ip_conntrack_untracked.infos[IP_CT_RELATED + IP_CT_IS_REPLY].master =
1329+ &ip_conntrack_untracked.ct_general;
1330+
1331 return ret;
1332
1333 err_free_hash:
1334diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.6.5-rc2/net/ipv4/netfilter/ip_conntrack_standalone.c
1335--- linux-2.6.5-rc2.org/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-03-20 00:11:06.000000000 +0000
1336+++ linux-2.6.5-rc2/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-03-22 08:29:50.000000000 +0000
1337@@ -194,6 +194,26 @@
1338 return ip_conntrack_confirm(*pskb);
1339 }
1340
1341+static unsigned int ip_conntrack_defrag(unsigned int hooknum,
1342+ struct sk_buff **pskb,
1343+ const struct net_device *in,
1344+ const struct net_device *out,
1345+ int (*okfn)(struct sk_buff *))
1346+{
1347+ /* Previously seen (loopback)? Ignore. Do this before
1348+ fragment check. */
1349+ if ((*pskb)->nfct)
1350+ return NF_ACCEPT;
1351+
1352+ /* Gather fragments. */
1353+ if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
1354+ *pskb = ip_ct_gather_frags(*pskb);
1355+ if (!*pskb)
1356+ return NF_STOLEN;
1357+ }
1358+ return NF_ACCEPT;
1359+}
1360+
1361 static unsigned int ip_refrag(unsigned int hooknum,
1362 struct sk_buff **pskb,
1363 const struct net_device *in,
1364@@ -236,6 +256,14 @@
1365
1366 /* Connection tracking may drop packets, but never alters them, so
1367 make it the first hook. */
1368+static struct nf_hook_ops ip_conntrack_defrag_ops = {
1369+ .hook = ip_conntrack_defrag,
1370+ .owner = THIS_MODULE,
1371+ .pf = PF_INET,
1372+ .hooknum = NF_IP_PRE_ROUTING,
1373+ .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
1374+};
1375+
1376 static struct nf_hook_ops ip_conntrack_in_ops = {
1377 .hook = ip_conntrack_in,
1378 .owner = THIS_MODULE,
1379@@ -244,6 +272,14 @@
1380 .priority = NF_IP_PRI_CONNTRACK,
1381 };
1382
1383+static struct nf_hook_ops ip_conntrack_defrag_local_out_ops = {
1384+ .hook = ip_conntrack_defrag,
1385+ .owner = THIS_MODULE,
1386+ .pf = PF_INET,
1387+ .hooknum = NF_IP_LOCAL_OUT,
1388+ .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
1389+};
1390+
1391 static struct nf_hook_ops ip_conntrack_local_out_ops = {
1392 .hook = ip_conntrack_local,
1393 .owner = THIS_MODULE,
1394@@ -470,10 +506,20 @@
1395 if (!proc) goto cleanup_init;
1396 proc->owner = THIS_MODULE;
1397
1398+ ret = nf_register_hook(&ip_conntrack_defrag_ops);
1399+ if (ret < 0) {
1400+ printk("ip_conntrack: can't register pre-routing defrag hook.\n");
1401+ goto cleanup_proc;
1402+ }
1403+ ret = nf_register_hook(&ip_conntrack_defrag_local_out_ops);
1404+ if (ret < 0) {
1405+ printk("ip_conntrack: can't register local_out defrag hook.\n");
1406+ goto cleanup_defragops;
1407+ }
1408 ret = nf_register_hook(&ip_conntrack_in_ops);
1409 if (ret < 0) {
1410 printk("ip_conntrack: can't register pre-routing hook.\n");
1411- goto cleanup_proc;
1412+ goto cleanup_defraglocalops;
1413 }
1414 ret = nf_register_hook(&ip_conntrack_local_out_ops);
1415 if (ret < 0) {
1416@@ -511,6 +557,10 @@
1417 nf_unregister_hook(&ip_conntrack_local_out_ops);
1418 cleanup_inops:
1419 nf_unregister_hook(&ip_conntrack_in_ops);
1420+ cleanup_defraglocalops:
1421+ nf_unregister_hook(&ip_conntrack_defrag_local_out_ops);
1422+ cleanup_defragops:
1423+ nf_unregister_hook(&ip_conntrack_defrag_ops);
1424 cleanup_proc:
1425 proc_net_remove("ip_conntrack");
1426 cleanup_init:
1427@@ -602,5 +652,6 @@
1428 EXPORT_SYMBOL(ip_conntrack_expect_list);
1429 EXPORT_SYMBOL(ip_conntrack_lock);
1430 EXPORT_SYMBOL(ip_conntrack_hash);
1431+EXPORT_SYMBOL(ip_conntrack_untracked);
1432 EXPORT_SYMBOL_GPL(ip_conntrack_find_get);
1433 EXPORT_SYMBOL_GPL(ip_conntrack_put);
1434diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/ip_nat_core.c linux-2.6.5-rc2/net/ipv4/netfilter/ip_nat_core.c
1435--- linux-2.6.5-rc2.org/net/ipv4/netfilter/ip_nat_core.c 2004-03-20 00:11:02.000000000 +0000
1436+++ linux-2.6.5-rc2/net/ipv4/netfilter/ip_nat_core.c 2004-03-22 08:29:50.000000000 +0000
1437@@ -1016,6 +1016,10 @@
1438 /* FIXME: Man, this is a hack. <SIGH> */
1439 IP_NF_ASSERT(ip_conntrack_destroyed == NULL);
1440 ip_conntrack_destroyed = &ip_nat_cleanup_conntrack;
1441+
1442+ /* Initialize fake conntrack so that NAT will skip it */
1443+ ip_conntrack_untracked.nat.info.initialized |=
1444+ (1 << IP_NAT_MANIP_SRC) | (1 << IP_NAT_MANIP_DST);
1445
1446 return 0;
1447 }
1448diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/ip_pool.c linux-2.6.5-rc2/net/ipv4/netfilter/ip_pool.c
1449--- linux-2.6.5-rc2.org/net/ipv4/netfilter/ip_pool.c 1970-01-01 00:00:00.000000000 +0000
1450+++ linux-2.6.5-rc2/net/ipv4/netfilter/ip_pool.c 2004-03-22 08:29:18.000000000 +0000
1451@@ -0,0 +1,334 @@
1452+/* Kernel module for IP pool management */
1453+
1454+#include <linux/module.h>
1455+#include <linux/ip.h>
1456+#include <linux/skbuff.h>
1457+#include <linux/netfilter_ipv4/ip_tables.h>
1458+#include <linux/netfilter_ipv4/ip_pool.h>
1459+#include <linux/errno.h>
1460+#include <asm/uaccess.h>
1461+#include <asm/bitops.h>
1462+#include <linux/interrupt.h>
1463+#include <linux/spinlock.h>
1464+
1465+#if 0
1466+#define DP printk
1467+#else
1468+#define DP(format, args...)
1469+#endif
1470+
1471+MODULE_LICENSE("GPL");
1472+
1473+#define NR_POOL 16
1474+static int nr_pool = NR_POOL;/* overwrite this when loading module */
1475+
1476+struct ip_pool {
1477+ u_int32_t first_ip; /* host byte order, included in range */
1478+ u_int32_t last_ip; /* host byte order, included in range */
1479+ void *members; /* the bitmap proper */
1480+ int nr_use; /* total nr. of tests through this */
1481+ int nr_match; /* total nr. of matches through this */
1482+ rwlock_t lock;
1483+};
1484+
1485+static struct ip_pool *POOL;
1486+
1487+static inline struct ip_pool *lookup(ip_pool_t index)
1488+{
1489+ if (index < 0 || index >= nr_pool) {
1490+ DP("ip_pool:lookup: bad index %d\n", index);
1491+ return 0;
1492+ }
1493+ return POOL+index;
1494+}
1495+
1496+int ip_pool_match(ip_pool_t index, u_int32_t addr)
1497+{
1498+ struct ip_pool *pool = lookup(index);
1499+ int res = 0;
1500+
1501+ if (!pool || !pool->members)
1502+ return 0;
1503+ read_lock_bh(&pool->lock);
1504+ if (pool->members) {
1505+ if (addr >= pool->first_ip && addr <= pool->last_ip) {
1506+ addr -= pool->first_ip;
1507+ if (test_bit(addr, pool->members)) {
1508+ res = 1;
1509+#ifdef CONFIG_IP_POOL_STATISTICS
1510+ pool->nr_match++;
1511+#endif
1512+ }
1513+ }
1514+#ifdef CONFIG_IP_POOL_STATISTICS
1515+ pool->nr_use++;
1516+#endif
1517+ }
1518+ read_unlock_bh(&pool->lock);
1519+ return res;
1520+}
1521+EXPORT_SYMBOL(ip_pool_match);
1522+
1523+static int pool_change(ip_pool_t index, u_int32_t addr, int isdel)
1524+{
1525+ struct ip_pool *pool;
1526+ int res = -1;
1527+
1528+ pool = lookup(index);
1529+ if ( !pool || !pool->members
1530+ || addr < pool->first_ip || addr > pool->last_ip)
1531+ return -1;
1532+ read_lock_bh(&pool->lock);
1533+ if (pool->members && addr >= pool->first_ip && addr <= pool->last_ip) {
1534+ addr -= pool->first_ip;
1535+ res = isdel
1536+ ? (0 != test_and_clear_bit(addr, pool->members))
1537+ : (0 != test_and_set_bit(addr, pool->members));
1538+ }
1539+ read_unlock_bh(&pool->lock);
1540+ return res;
1541+}
1542+
1543+int ip_pool_mod(ip_pool_t index, u_int32_t addr, int isdel)
1544+{
1545+ int res = pool_change(index,addr,isdel);
1546+
1547+ if (!isdel) res = !res;
1548+ return res;
1549+}
1550+EXPORT_SYMBOL(ip_pool_mod);
1551+
1552+static inline int bitmap_bytes(u_int32_t a, u_int32_t b)
1553+{
1554+ return 4*((((b-a+8)/8)+3)/4);
1555+}
1556+
1557+static inline int poolbytes(ip_pool_t index)
1558+{
1559+ struct ip_pool *pool = lookup(index);
1560+
1561+ return pool ? bitmap_bytes(pool->first_ip, pool->last_ip) : 0;
1562+}
1563+
1564+static int setpool(
1565+ struct sock *sk,
1566+ int optval,
1567+ void *user,
1568+ unsigned int len
1569+) {
1570+ struct ip_pool_request req;
1571+
1572+ DP("ip_pool:setpool: optval=%d, user=%p, len=%d\n", optval, user, len);
1573+ if (!capable(CAP_NET_ADMIN))
1574+ return -EPERM;
1575+ if (optval != SO_IP_POOL)
1576+ return -EBADF;
1577+ if (len != sizeof(req))
1578+ return -EINVAL;
1579+ if (copy_from_user(&req, user, sizeof(req)) != 0)
1580+ return -EFAULT;
1581+ printk("obsolete op - upgrade your ippool(8) utility.\n");
1582+ return -EINVAL;
1583+}
1584+
1585+static int getpool(
1586+ struct sock *sk,
1587+ int optval,
1588+ void *user,
1589+ int *len
1590+) {
1591+ struct ip_pool_request req;
1592+ struct ip_pool *pool;
1593+ ip_pool_t i;
1594+ int newbytes;
1595+ void *newmembers;
1596+ int res;
1597+
1598+ DP("ip_pool:getpool: optval=%d, user=%p\n", optval, user);
1599+ if (!capable(CAP_NET_ADMIN))
1600+ return -EINVAL;
1601+ if (optval != SO_IP_POOL)
1602+ return -EINVAL;
1603+ if (*len != sizeof(req)) {
1604+ return -EFAULT;
1605+ }
1606+ if (copy_from_user(&req, user, sizeof(req)) != 0)
1607+ return -EFAULT;
1608+ DP("ip_pool:getpool op=%d, index=%d\n", req.op, req.index);
1609+ if (req.op < IP_POOL_BAD001) {
1610+ printk("obsolete op - upgrade your ippool(8) utility.\n");
1611+ return -EFAULT;
1612+ }
1613+ switch(req.op) {
1614+ case IP_POOL_HIGH_NR:
1615+ DP("ip_pool HIGH_NR\n");
1616+ req.index = IP_POOL_NONE;
1617+ for (i=0; i<nr_pool; i++)
1618+ if (POOL[i].members)
1619+ req.index = i;
1620+ return copy_to_user(user, &req, sizeof(req));
1621+ case IP_POOL_LOOKUP:
1622+ DP("ip_pool LOOKUP\n");
1623+ pool = lookup(req.index);
1624+ if (!pool)
1625+ return -EINVAL;
1626+ if (!pool->members)
1627+ return -EBADF;
1628+ req.addr = htonl(pool->first_ip);
1629+ req.addr2 = htonl(pool->last_ip);
1630+ return copy_to_user(user, &req, sizeof(req));
1631+ case IP_POOL_USAGE:
1632+ DP("ip_pool USE\n");
1633+ pool = lookup(req.index);
1634+ if (!pool)
1635+ return -EINVAL;
1636+ if (!pool->members)
1637+ return -EBADF;
1638+ req.addr = pool->nr_use;
1639+ req.addr2 = pool->nr_match;
1640+ return copy_to_user(user, &req, sizeof(req));
1641+ case IP_POOL_TEST_ADDR:
1642+ DP("ip_pool TEST 0x%08x\n", req.addr);
1643+ pool = lookup(req.index);
1644+ if (!pool)
1645+ return -EINVAL;
1646+ res = 0;
1647+ read_lock_bh(&pool->lock);
1648+ if (!pool->members) {
1649+ DP("ip_pool TEST_ADDR no members in pool\n");
1650+ res = -EBADF;
1651+ goto unlock_and_return_res;
1652+ }
1653+ req.addr = ntohl(req.addr);
1654+ if (req.addr < pool->first_ip) {
1655+ DP("ip_pool TEST_ADDR address < pool bounds\n");
1656+ res = -ERANGE;
1657+ goto unlock_and_return_res;
1658+ }
1659+ if (req.addr > pool->last_ip) {
1660+ DP("ip_pool TEST_ADDR address > pool bounds\n");
1661+ res = -ERANGE;
1662+ goto unlock_and_return_res;
1663+ }
1664+ req.addr = (0 != test_bit((req.addr - pool->first_ip),
1665+ pool->members));
1666+ read_unlock_bh(&pool->lock);
1667+ return copy_to_user(user, &req, sizeof(req));
1668+ case IP_POOL_FLUSH:
1669+ DP("ip_pool FLUSH not yet implemented.\n");
1670+ return -EBUSY;
1671+ case IP_POOL_DESTROY:
1672+ DP("ip_pool DESTROY not yet implemented.\n");
1673+ return -EBUSY;
1674+ case IP_POOL_INIT:
1675+ DP("ip_pool INIT 0x%08x-0x%08x\n", req.addr, req.addr2);
1676+ pool = lookup(req.index);
1677+ if (!pool)
1678+ return -EINVAL;
1679+ req.addr = ntohl(req.addr);
1680+ req.addr2 = ntohl(req.addr2);
1681+ if (req.addr > req.addr2) {
1682+ DP("ip_pool INIT bad ip range\n");
1683+ return -EINVAL;
1684+ }
1685+ newbytes = bitmap_bytes(req.addr, req.addr2);
1686+ newmembers = kmalloc(newbytes, GFP_KERNEL);
1687+ if (!newmembers) {
1688+ DP("ip_pool INIT out of mem for %d bytes\n", newbytes);
1689+ return -ENOMEM;
1690+ }
1691+ memset(newmembers, 0, newbytes);
1692+ write_lock_bh(&pool->lock);
1693+ if (pool->members) {
1694+ DP("ip_pool INIT pool %d exists\n", req.index);
1695+ kfree(newmembers);
1696+ res = -EBUSY;
1697+ goto unlock_and_return_res;
1698+ }
1699+ pool->first_ip = req.addr;
1700+ pool->last_ip = req.addr2;
1701+ pool->nr_use = 0;
1702+ pool->nr_match = 0;
1703+ pool->members = newmembers;
1704+ write_unlock_bh(&pool->lock);
1705+ return 0;
1706+ case IP_POOL_ADD_ADDR:
1707+ DP("ip_pool ADD_ADDR 0x%08x\n", req.addr);
1708+ req.addr = pool_change(req.index, ntohl(req.addr), 0);
1709+ return copy_to_user(user, &req, sizeof(req));
1710+ case IP_POOL_DEL_ADDR:
1711+ DP("ip_pool DEL_ADDR 0x%08x\n", req.addr);
1712+ req.addr = pool_change(req.index, ntohl(req.addr), 1);
1713+ return copy_to_user(user, &req, sizeof(req));
1714+ default:
1715+ DP("ip_pool:getpool bad op %d\n", req.op);
1716+ return -EINVAL;
1717+ }
1718+ return -EINVAL;
1719+
1720+unlock_and_return_res:
1721+ if (pool)
1722+ read_unlock_bh(&pool->lock);
1723+ return res;
1724+}
1725+
1726+static struct nf_sockopt_ops so_pool
1727+= { { NULL, NULL }, PF_INET,
1728+ SO_IP_POOL, SO_IP_POOL+1, &setpool,
1729+ SO_IP_POOL, SO_IP_POOL+1, &getpool,
1730+ 0, NULL };
1731+
1732+MODULE_PARM(nr_pool, "i");
1733+
1734+static int __init init(void)
1735+{
1736+ ip_pool_t i;
1737+ int res;
1738+
1739+ if (nr_pool < 1) {
1740+ printk("ip_pool module init: bad nr_pool %d\n", nr_pool);
1741+ return -EINVAL;
1742+ }
1743+ POOL = kmalloc(nr_pool * sizeof(*POOL), GFP_KERNEL);
1744+ if (!POOL) {
1745+ printk("ip_pool module init: out of memory for nr_pool %d\n",
1746+ nr_pool);
1747+ return -ENOMEM;
1748+ }
1749+ for (i=0; i<nr_pool; i++) {
1750+ POOL[i].first_ip = 0;
1751+ POOL[i].last_ip = 0;
1752+ POOL[i].members = 0;
1753+ POOL[i].nr_use = 0;
1754+ POOL[i].nr_match = 0;
1755+ POOL[i].lock = RW_LOCK_UNLOCKED;
1756+ }
1757+ res = nf_register_sockopt(&so_pool);
1758+ DP("ip_pool:init %d pools, result %d\n", nr_pool, res);
1759+ if (res != 0) {
1760+ kfree(POOL);
1761+ POOL = 0;
1762+ }
1763+ return res;
1764+}
1765+
1766+static void __exit fini(void)
1767+{
1768+ ip_pool_t i;
1769+
1770+ DP("ip_pool:fini BYEBYE\n");
1771+ nf_unregister_sockopt(&so_pool);
1772+ for (i=0; i<nr_pool; i++) {
1773+ if (POOL[i].members) {
1774+ kfree(POOL[i].members);
1775+ POOL[i].members = 0;
1776+ }
1777+ }
1778+ kfree(POOL);
1779+ POOL = 0;
1780+ DP("ip_pool:fini these are the famous last words\n");
1781+ return;
1782+}
1783+
1784+module_init(init);
1785+module_exit(fini);
1786diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c linux-2.6.5-rc2/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c
1787--- linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c 1970-01-01 00:00:00.000000000 +0000
1788+++ linux-2.6.5-rc2/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c 2004-03-22 08:27:30.000000000 +0000
1789@@ -0,0 +1,89 @@
1790+/**
1791+ * Strip all IP options in the IP packet header.
1792+ *
1793+ * (C) 2001 by Fabrice MARIE <fabrice@netfilter.org>
1794+ * This software is distributed under GNU GPL v2, 1991
1795+ */
1796+
1797+#include <linux/module.h>
1798+#include <linux/skbuff.h>
1799+#include <linux/ip.h>
1800+#include <net/checksum.h>
1801+
1802+#include <linux/netfilter_ipv4/ip_tables.h>
1803+
1804+MODULE_AUTHOR("Fabrice MARIE <fabrice@netfilter.org>");
1805+MODULE_DESCRIPTION("Strip all options in IPv4 packets");
1806+MODULE_LICENSE("GPL");
1807+
1808+static unsigned int
1809+target(struct sk_buff **pskb,
1810+ const struct net_device *in,
1811+ const struct net_device *out,
1812+ unsigned int hooknum,
1813+ const void *targinfo,
1814+ void *userinfo)
1815+{
1816+ struct iphdr *iph;
1817+ struct sk_buff *skb;
1818+ struct ip_options *opt;
1819+ unsigned char *optiph;
1820+ int l;
1821+
1822+ if (!skb_ip_make_writable(pskb, (*pskb)->len))
1823+ return NF_DROP;
1824+
1825+ skb = (*pskb);
1826+ iph = (*pskb)->nh.iph;
1827+ optiph = skb->nh.raw;
1828+ l = ((struct ip_options *)(&(IPCB(skb)->opt)))->optlen;
1829+
1830+ /* if no options in packet then nothing to clear. */
1831+ if (iph->ihl * 4 == sizeof(struct iphdr))
1832+ return IPT_CONTINUE;
1833+
1834+ /* else clear all options */
1835+ memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
1836+ memset(optiph+sizeof(struct iphdr), IPOPT_NOOP, l);
1837+ opt = &(IPCB(skb)->opt);
1838+ opt->is_data = 0;
1839+ opt->optlen = l;
1840+
1841+ skb->nfcache |= NFC_ALTERED;
1842+
1843+ return IPT_CONTINUE;
1844+}
1845+
1846+static int
1847+checkentry(const char *tablename,
1848+ const struct ipt_entry *e,
1849+ void *targinfo,
1850+ unsigned int targinfosize,
1851+ unsigned int hook_mask)
1852+{
1853+ if (strcmp(tablename, "mangle")) {
1854+ printk(KERN_WARNING "IPV4OPTSSTRIP: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
1855+ return 0;
1856+ }
1857+ /* nothing else to check because no parameters */
1858+ return 1;
1859+}
1860+
1861+static struct ipt_target ipt_ipv4optsstrip_reg = {
1862+ .name = "IPV4OPTSSTRIP",
1863+ .target = target,
1864+ .checkentry = checkentry,
1865+ .me = THIS_MODULE };
1866+
1867+static int __init init(void)
1868+{
1869+ return ipt_register_target(&ipt_ipv4optsstrip_reg);
1870+}
1871+
1872+static void __exit fini(void)
1873+{
1874+ ipt_unregister_target(&ipt_ipv4optsstrip_reg);
1875+}
1876+
1877+module_init(init);
1878+module_exit(fini);
1879diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_LOG.c linux-2.6.5-rc2/net/ipv4/netfilter/ipt_LOG.c
1880--- linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_LOG.c 2004-03-20 00:11:42.000000000 +0000
1881+++ linux-2.6.5-rc2/net/ipv4/netfilter/ipt_LOG.c 2004-03-22 08:27:15.000000000 +0000
1882@@ -19,6 +19,7 @@
1883 #include <net/tcp.h>
1884 #include <net/route.h>
1885
1886+#include <linux/netfilter.h>
1887 #include <linux/netfilter_ipv4/ip_tables.h>
1888 #include <linux/netfilter_ipv4/ipt_LOG.h>
1889
1890@@ -26,6 +27,10 @@
1891 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1892 MODULE_DESCRIPTION("iptables syslog logging module");
1893
1894+static unsigned int nflog = 1;
1895+MODULE_PARM(nflog, "i");
1896+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
1897+
1898 #if 0
1899 #define DEBUGP printk
1900 #else
1901@@ -324,28 +329,25 @@
1902 /* maxlen = 230+ 91 + 230 + 252 = 803 */
1903 }
1904
1905-static unsigned int
1906-ipt_log_target(struct sk_buff **pskb,
1907+static void
1908+ipt_log_packet(unsigned int hooknum,
1909+ const struct sk_buff *skb,
1910 const struct net_device *in,
1911 const struct net_device *out,
1912- unsigned int hooknum,
1913- const void *targinfo,
1914- void *userinfo)
1915+ const struct ipt_log_info *loginfo,
1916+ const char *level_string,
1917+ const char *prefix)
1918 {
1919- const struct ipt_log_info *loginfo = targinfo;
1920- char level_string[4] = "< >";
1921-
1922- level_string[1] = '0' + (loginfo->level % 8);
1923 spin_lock_bh(&log_lock);
1924 printk(level_string);
1925 printk("%sIN=%s OUT=%s ",
1926- loginfo->prefix,
1927+ prefix == NULL ? loginfo->prefix : prefix,
1928 in ? in->name : "",
1929 out ? out->name : "");
1930 #ifdef CONFIG_BRIDGE_NETFILTER
1931- if ((*pskb)->nf_bridge) {
1932- struct net_device *physindev = (*pskb)->nf_bridge->physindev;
1933- struct net_device *physoutdev = (*pskb)->nf_bridge->physoutdev;
1934+ if (skb->nf_bridge) {
1935+ struct net_device *physindev = skb->nf_bridge->physindev;
1936+ struct net_device *physoutdev = skb->nf_bridge->physoutdev;
1937
1938 if (physindev && in != physindev)
1939 printk("PHYSIN=%s ", physindev->name);
1940@@ -357,25 +359,56 @@
1941 if (in && !out) {
1942 /* MAC logging for input chain only. */
1943 printk("MAC=");
1944- if ((*pskb)->dev && (*pskb)->dev->hard_header_len
1945- && (*pskb)->mac.raw != (void*)(*pskb)->nh.iph) {
1946+ if (skb->dev && skb->dev->hard_header_len
1947+ && skb->mac.raw != (void*)skb->nh.iph) {
1948 int i;
1949- unsigned char *p = (*pskb)->mac.raw;
1950- for (i = 0; i < (*pskb)->dev->hard_header_len; i++,p++)
1951+ unsigned char *p = skb->mac.raw;
1952+ for (i = 0; i < skb->dev->hard_header_len; i++,p++)
1953 printk("%02x%c", *p,
1954- i==(*pskb)->dev->hard_header_len - 1
1955+ i==skb->dev->hard_header_len - 1
1956 ? ' ':':');
1957 } else
1958 printk(" ");
1959 }
1960
1961- dump_packet(loginfo, *pskb, 0);
1962+ dump_packet(loginfo, skb, 0);
1963 printk("\n");
1964 spin_unlock_bh(&log_lock);
1965+}
1966+
1967+static unsigned int
1968+ipt_log_target(struct sk_buff **pskb,
1969+ const struct net_device *in,
1970+ const struct net_device *out,
1971+ unsigned int hooknum,
1972+ const void *targinfo,
1973+ void *userinfo)
1974+{
1975+ const struct ipt_log_info *loginfo = targinfo;
1976+ char level_string[4] = "< >";
1977+
1978+ level_string[1] = '0' + (loginfo->level % 8);
1979+ ipt_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
1980
1981 return IPT_CONTINUE;
1982 }
1983
1984+static void
1985+ipt_logfn(unsigned int hooknum,
1986+ const struct sk_buff *skb,
1987+ const struct net_device *in,
1988+ const struct net_device *out,
1989+ const char *prefix)
1990+{
1991+ struct ipt_log_info loginfo = {
1992+ .level = 0,
1993+ .logflags = IPT_LOG_MASK,
1994+ .prefix = ""
1995+ };
1996+
1997+ ipt_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
1998+}
1999+
2000 static int ipt_log_checkentry(const char *tablename,
2001 const struct ipt_entry *e,
2002 void *targinfo,
2003@@ -413,11 +446,18 @@
2004
2005 static int __init init(void)
2006 {
2007- return ipt_register_target(&ipt_log_reg);
2008+ if (ipt_register_target(&ipt_log_reg))
2009+ return -EINVAL;
2010+ if (nflog)
2011+ nf_log_register(PF_INET, &ipt_logfn);
2012+
2013+ return 0;
2014 }
2015
2016 static void __exit fini(void)
2017 {
2018+ if (nflog)
2019+ nf_log_unregister(PF_INET, &ipt_logfn);
2020 ipt_unregister_target(&ipt_log_reg);
2021 }
2022
2023diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_NOTRACK.c linux-2.6.5-rc2/net/ipv4/netfilter/ipt_NOTRACK.c
2024--- linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_NOTRACK.c 1970-01-01 00:00:00.000000000 +0000
2025+++ linux-2.6.5-rc2/net/ipv4/netfilter/ipt_NOTRACK.c 2004-03-22 08:29:50.000000000 +0000
2026@@ -0,0 +1,75 @@
2027+/* This is a module which is used for setting up fake conntracks
2028+ * on packets so that they are not seen by the conntrack/NAT code.
2029+ */
2030+#include <linux/module.h>
2031+#include <linux/skbuff.h>
2032+
2033+#include <linux/netfilter_ipv4/ip_tables.h>
2034+#include <linux/netfilter_ipv4/ip_conntrack.h>
2035+
2036+static unsigned int
2037+target(struct sk_buff **pskb,
2038+ const struct net_device *in,
2039+ const struct net_device *out,
2040+ unsigned int hooknum,
2041+ const void *targinfo,
2042+ void *userinfo)
2043+{
2044+ /* Previously seen (loopback)? Ignore. */
2045+ if ((*pskb)->nfct != NULL)
2046+ return IPT_CONTINUE;
2047+
2048+ /* Attach fake conntrack entry.
2049+ If there is a real ct entry correspondig to this packet,
2050+ it'll hang aroun till timing out. We don't deal with it
2051+ for performance reasons. JK */
2052+ (*pskb)->nfct = &ip_conntrack_untracked.infos[IP_CT_NEW];
2053+ nf_conntrack_get((*pskb)->nfct);
2054+
2055+ return IPT_CONTINUE;
2056+}
2057+
2058+static int
2059+checkentry(const char *tablename,
2060+ const struct ipt_entry *e,
2061+ void *targinfo,
2062+ unsigned int targinfosize,
2063+ unsigned int hook_mask)
2064+{
2065+ if (targinfosize != 0) {
2066+ printk(KERN_WARNING "NOTRACK: targinfosize %u != 0\n",
2067+ targinfosize);
2068+ return 0;
2069+ }
2070+
2071+ if (strcmp(tablename, "raw") != 0) {
2072+ printk(KERN_WARNING "NOTRACK: can only be called from \"raw\" table, not \"%s\"\n", tablename);
2073+ return 0;
2074+ }
2075+
2076+ return 1;
2077+}
2078+
2079+static struct ipt_target ipt_notrack_reg = {
2080+ .name = "NOTRACK",
2081+ .target = target,
2082+ .checkentry = checkentry,
2083+ .me = THIS_MODULE
2084+};
2085+
2086+static int __init init(void)
2087+{
2088+ if (ipt_register_target(&ipt_notrack_reg))
2089+ return -EINVAL;
2090+
2091+ return 0;
2092+}
2093+
2094+static void __exit fini(void)
2095+{
2096+ ipt_unregister_target(&ipt_notrack_reg);
2097+}
2098+
2099+module_init(init);
2100+module_exit(fini);
2101+MODULE_LICENSE("GPL");
2102diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_POOL.c linux-2.6.5-rc2/net/ipv4/netfilter/ipt_POOL.c
2103--- linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_POOL.c 1970-01-01 00:00:00.000000000 +0000
2104+++ linux-2.6.5-rc2/net/ipv4/netfilter/ipt_POOL.c 2004-03-22 08:29:18.000000000 +0000
2105@@ -0,0 +1,116 @@
2106+/* ipt_POOL.c - netfilter target to manipulate IP pools
2107+ *
2108+ * This target can be used almost everywhere. It acts on some specified
2109+ * IP pool, adding or deleting some IP address in the pool. The address
2110+ * can be either the source (--addsrc, --delsrc), or destination (--add/deldst)
2111+ * of the packet under inspection.
2112+ *
2113+ * The target normally returns IPT_CONTINUE.
2114+ */
2115+
2116+#include <linux/types.h>
2117+#include <linux/ip.h>
2118+#include <linux/timer.h>
2119+#include <linux/module.h>
2120+#include <linux/netfilter.h>
2121+#include <linux/netdevice.h>
2122+#include <linux/if.h>
2123+#include <linux/inetdevice.h>
2124+#include <net/protocol.h>
2125+#include <net/checksum.h>
2126+#include <linux/netfilter_ipv4.h>
2127+#include <linux/netfilter_ipv4/ip_nat_rule.h>
2128+#include <linux/netfilter_ipv4/ipt_pool.h>
2129+
2130+#if 0
2131+#define DEBUGP printk
2132+#else
2133+#define DEBUGP(format, args...)
2134+#endif
2135+
2136+/*** NOTE NOTE NOTE NOTE ***
2137+**
2138+** By sheer luck, I get away with using the "struct ipt_pool_info", as defined
2139+** in <linux/netfilter_ipv4/ipt_pool.h>, both as the match and target info.
2140+** Here, in the target implementation, ipt_pool_info.src, if not IP_POOL_NONE,
2141+** is modified for the source IP address of the packet under inspection.
2142+** The same way, the ipt_pool_info.dst pool is modified for the destination.
2143+**
2144+** The address is added to the pool normally. However, if IPT_POOL_DEL_dir
2145+** flag is set in ipt_pool_info.flags, the address is deleted from the pool.
2146+**
2147+** If a modification was done to the pool, we possibly return ACCEPT or DROP,
2148+** if the right IPT_POOL_MOD_dir_ACCEPT or _MOD_dir_DROP flags are set.
2149+** The IPT_POOL_INV_MOD_dir flag inverts the sense of the check (i.e. the
2150+** ACCEPT and DROP flags are evaluated when the pool was not modified.)
2151+*/
2152+
2153+static int
2154+do_check(const char *tablename,
2155+ const struct ipt_entry *e,
2156+ void *targinfo,
2157+ unsigned int targinfosize,
2158+ unsigned int hook_mask)
2159+{
2160+ const struct ipt_pool_info *ipi = targinfo;
2161+
2162+ if (targinfosize != IPT_ALIGN(sizeof(*ipi))) {
2163+ DEBUGP("POOL_check: size %u.\n", targinfosize);
2164+ return 0;
2165+ }
2166+ DEBUGP("ipt_POOL:do_check(%d,%d,%d)\n",ipi->src,ipi->dst,ipi->flags);
2167+ return 1;
2168+}
2169+
2170+static unsigned int
2171+do_target(struct sk_buff **pskb,
2172+ unsigned int hooknum,
2173+ const struct net_device *in,
2174+ const struct net_device *out,
2175+ const void *targinfo,
2176+ void *userinfo)
2177+{
2178+ const struct ipt_pool_info *ipi = targinfo;
2179+ int modified;
2180+ unsigned int verdict = IPT_CONTINUE;
2181+
2182+ if (ipi->src != IP_POOL_NONE) {
2183+ modified = ip_pool_mod(ipi->src, ntohl((*pskb)->nh.iph->saddr),
2184+ ipi->flags & IPT_POOL_DEL_SRC);
2185+ if (!!modified ^ !!(ipi->flags & IPT_POOL_INV_MOD_SRC)) {
2186+ if (ipi->flags & IPT_POOL_MOD_SRC_ACCEPT)
2187+ verdict = NF_ACCEPT;
2188+ else if (ipi->flags & IPT_POOL_MOD_SRC_DROP)
2189+ verdict = NF_DROP;
2190+ }
2191+ }
2192+ if (verdict == IPT_CONTINUE && ipi->dst != IP_POOL_NONE) {
2193+ modified = ip_pool_mod(ipi->dst, ntohl((*pskb)->nh.iph->daddr),
2194+ ipi->flags & IPT_POOL_DEL_DST);
2195+ if (!!modified ^ !!(ipi->flags & IPT_POOL_INV_MOD_DST)) {
2196+ if (ipi->flags & IPT_POOL_MOD_DST_ACCEPT)
2197+ verdict = NF_ACCEPT;
2198+ else if (ipi->flags & IPT_POOL_MOD_DST_DROP)
2199+ verdict = NF_DROP;
2200+ }
2201+ }
2202+ return verdict;
2203+}
2204+
2205+static struct ipt_target pool_reg
2206+= { { NULL, NULL }, "POOL", do_target, do_check, NULL, THIS_MODULE };
2207+
2208+static int __init init(void)
2209+{
2210+ DEBUGP("init ipt_POOL\n");
2211+ return ipt_register_target(&pool_reg);
2212+}
2213+
2214+static void __exit fini(void)
2215+{
2216+ DEBUGP("fini ipt_POOL\n");
2217+ ipt_unregister_target(&pool_reg);
2218+}
2219+
2220+module_init(init);
2221+module_exit(fini);
2222diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_TTL.c linux-2.6.5-rc2/net/ipv4/netfilter/ipt_TTL.c
2223--- linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_TTL.c 1970-01-01 00:00:00.000000000 +0000
2224+++ linux-2.6.5-rc2/net/ipv4/netfilter/ipt_TTL.c 2004-03-22 08:28:11.000000000 +0000
2225@@ -0,0 +1,120 @@
2226+/* TTL modification target for IP tables
2227+ * (C) 2000 by Harald Welte <laforge@gnumonks.org>
2228+ *
2229+ * Version: $Revision$
2230+ *
2231+ * This software is distributed under the terms of GNU GPL
2232+ */
2233+
2234+#include <linux/module.h>
2235+#include <linux/skbuff.h>
2236+#include <linux/ip.h>
2237+#include <net/checksum.h>
2238+
2239+#include <linux/netfilter_ipv4/ip_tables.h>
2240+#include <linux/netfilter_ipv4/ipt_TTL.h>
2241+
2242+MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
2243+MODULE_DESCRIPTION("IP tables TTL modification module");
2244+MODULE_LICENSE("GPL");
2245+
2246+static unsigned int
2247+ipt_ttl_target(struct sk_buff **pskb, const struct net_device *in,
2248+ const struct net_device *out, unsigned int hooknum,
2249+ const void *targinfo, void *userinfo)
2250+{
2251+ struct iphdr *iph;
2252+ const struct ipt_TTL_info *info = targinfo;
2253+ u_int16_t diffs[2];
2254+ int new_ttl;
2255+
2256+ if (!skb_ip_make_writable(pskb, (*pskb)->len))
2257+ return NF_DROP;
2258+
2259+ iph = (*pskb)->nh.iph;
2260+
2261+ switch (info->mode) {
2262+ case IPT_TTL_SET:
2263+ new_ttl = info->ttl;
2264+ break;
2265+ case IPT_TTL_INC:
2266+ new_ttl = iph->ttl + info->ttl;
2267+ if (new_ttl > 255)
2268+ new_ttl = 255;
2269+ break;
2270+ case IPT_TTL_DEC:
2271+ new_ttl = iph->ttl + info->ttl;
2272+ if (new_ttl < 0)
2273+ new_ttl = 0;
2274+ break;
2275+ default:
2276+ new_ttl = iph->ttl;
2277+ break;
2278+ }
2279+
2280+ if (new_ttl != iph->ttl) {
2281+ diffs[0] = htons(((unsigned)iph->ttl) << 8) ^ 0xFFFF;
2282+ iph->ttl = new_ttl;
2283+ diffs[1] = htons(((unsigned)iph->ttl) << 8);
2284+ iph->check = csum_fold(csum_partial((char *)diffs,
2285+ sizeof(diffs),
2286+ iph->check^0xFFFF));
2287+ (*pskb)->nfcache |= NFC_ALTERED;
2288+ }
2289+
2290+ return IPT_CONTINUE;
2291+}
2292+
2293+static int ipt_ttl_checkentry(const char *tablename,
2294+ const struct ipt_entry *e,
2295+ void *targinfo,
2296+ unsigned int targinfosize,
2297+ unsigned int hook_mask)
2298+{
2299+ struct ipt_TTL_info *info = targinfo;
2300+
2301+ if (targinfosize != IPT_ALIGN(sizeof(struct ipt_TTL_info))) {
2302+ printk(KERN_WARNING "TTL: targinfosize %u != %Zu\n",
2303+ targinfosize,
2304+ IPT_ALIGN(sizeof(struct ipt_TTL_info)));
2305+ return 0;
2306+ }
2307+
2308+ if (strcmp(tablename, "mangle")) {
2309+ printk(KERN_WARNING "TTL: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
2310+ return 0;
2311+ }
2312+
2313+ if (info->mode > IPT_TTL_MAXMODE) {
2314+ printk(KERN_WARNING "TTL: invalid or unknown Mode %u\n",
2315+ info->mode);
2316+ return 0;
2317+ }
2318+
2319+ if ((info->mode != IPT_TTL_SET) && (info->ttl == 0)) {
2320+ printk(KERN_WARNING "TTL: increment/decrement doesn't make sense with value 0\n");
2321+ return 0;
2322+ }
2323+
2324+ return 1;
2325+}
2326+
2327+static struct ipt_target ipt_TTL = {
2328+ .name = "TTL",
2329+ .target = ipt_ttl_target,
2330+ .checkentry = ipt_ttl_checkentry,
2331+ .me = THIS_MODULE
2332+};
2333+
2334+static int __init init(void)
2335+{
2336+ return ipt_register_target(&ipt_TTL);
2337+}
2338+
2339+static void __exit fini(void)
2340+{
2341+ ipt_unregister_target(&ipt_TTL);
2342+}
2343+
2344+module_init(init);
2345+module_exit(fini);
2346diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_ULOG.c linux-2.6.5-rc2/net/ipv4/netfilter/ipt_ULOG.c
2347--- linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_ULOG.c 2004-03-20 00:11:05.000000000 +0000
2348+++ linux-2.6.5-rc2/net/ipv4/netfilter/ipt_ULOG.c 2004-03-22 08:27:15.000000000 +0000
2349@@ -50,6 +50,7 @@
2350 #include <linux/netlink.h>
2351 #include <linux/netdevice.h>
2352 #include <linux/mm.h>
2353+#include <linux/netfilter.h>
2354 #include <linux/netfilter_ipv4/ip_tables.h>
2355 #include <linux/netfilter_ipv4/ipt_ULOG.h>
2356 #include <linux/netfilter_ipv4/lockhelp.h>
2357@@ -80,6 +81,10 @@
2358 MODULE_PARM(flushtimeout, "i");
2359 MODULE_PARM_DESC(flushtimeout, "buffer flush timeout");
2360
2361+static unsigned int nflog = 1;
2362+MODULE_PARM(nflog, "i");
2363+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
2364+
2365 /* global data structures */
2366
2367 typedef struct {
2368@@ -157,17 +162,17 @@
2369 return skb;
2370 }
2371
2372-static unsigned int ipt_ulog_target(struct sk_buff **pskb,
2373- const struct net_device *in,
2374- const struct net_device *out,
2375- unsigned int hooknum,
2376- const void *targinfo, void *userinfo)
2377+static void ipt_ulog_packet(unsigned int hooknum,
2378+ const struct sk_buff *skb,
2379+ const struct net_device *in,
2380+ const struct net_device *out,
2381+ const struct ipt_ulog_info *loginfo,
2382+ const char *prefix)
2383 {
2384 ulog_buff_t *ub;
2385 ulog_packet_msg_t *pm;
2386 size_t size, copy_len;
2387 struct nlmsghdr *nlh;
2388- struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
2389
2390 /* ffs == find first bit set, necessary because userspace
2391 * is already shifting groupnumber, but we need unshifted.
2392@@ -176,8 +181,8 @@
2393
2394 /* calculate the size of the skb needed */
2395 if ((loginfo->copy_range == 0) ||
2396- (loginfo->copy_range > (*pskb)->len)) {
2397- copy_len = (*pskb)->len;
2398+ (loginfo->copy_range > skb->len)) {
2399+ copy_len = skb->len;
2400 } else {
2401 copy_len = loginfo->copy_range;
2402 }
2403@@ -214,19 +219,21 @@
2404
2405 /* copy hook, prefix, timestamp, payload, etc. */
2406 pm->data_len = copy_len;
2407- pm->timestamp_sec = (*pskb)->stamp.tv_sec;
2408- pm->timestamp_usec = (*pskb)->stamp.tv_usec;
2409- pm->mark = (*pskb)->nfmark;
2410+ pm->timestamp_sec = skb->stamp.tv_sec;
2411+ pm->timestamp_usec = skb->stamp.tv_usec;
2412+ pm->mark = skb->nfmark;
2413 pm->hook = hooknum;
2414- if (loginfo->prefix[0] != '\0')
2415+ if (prefix != NULL)
2416+ strncpy(pm->prefix, prefix, sizeof(pm->prefix));
2417+ else if (loginfo->prefix[0] != '\0')
2418 strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
2419 else
2420 *(pm->prefix) = '\0';
2421
2422 if (in && in->hard_header_len > 0
2423- && (*pskb)->mac.raw != (void *) (*pskb)->nh.iph
2424+ && skb->mac.raw != (void *) skb->nh.iph
2425 && in->hard_header_len <= ULOG_MAC_LEN) {
2426- memcpy(pm->mac, (*pskb)->mac.raw, in->hard_header_len);
2427+ memcpy(pm->mac, skb->mac.raw, in->hard_header_len);
2428 pm->mac_len = in->hard_header_len;
2429 } else
2430 pm->mac_len = 0;
2431@@ -241,8 +248,8 @@
2432 else
2433 pm->outdev_name[0] = '\0';
2434
2435- /* copy_len <= (*pskb)->len, so can't fail. */
2436- if (skb_copy_bits(*pskb, 0, pm->payload, copy_len) < 0)
2437+ /* copy_len <= skb->len, so can't fail. */
2438+ if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0)
2439 BUG();
2440
2441 /* check if we are building multi-part messages */
2442@@ -266,8 +273,7 @@
2443
2444 UNLOCK_BH(&ulog_lock);
2445
2446- return IPT_CONTINUE;
2447-
2448+ return;
2449
2450 nlmsg_failure:
2451 PRINTR("ipt_ULOG: error during NLMSG_PUT\n");
2452@@ -276,8 +282,35 @@
2453 PRINTR("ipt_ULOG: Error building netlink message\n");
2454
2455 UNLOCK_BH(&ulog_lock);
2456+}
2457+
2458+static unsigned int ipt_ulog_target(struct sk_buff **pskb,
2459+ const struct net_device *in,
2460+ const struct net_device *out,
2461+ unsigned int hooknum,
2462+ const void *targinfo, void *userinfo)
2463+{
2464+ struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
2465
2466- return IPT_CONTINUE;
2467+ ipt_ulog_packet(hooknum, *pskb, in, out, loginfo, NULL);
2468+
2469+ return IPT_CONTINUE;
2470+}
2471+
2472+static void ipt_logfn(unsigned int hooknum,
2473+ const struct sk_buff *skb,
2474+ const struct net_device *in,
2475+ const struct net_device *out,
2476+ const char *prefix)
2477+{
2478+ struct ipt_ulog_info loginfo = {
2479+ .nl_group = ULOG_DEFAULT_NLGROUP,
2480+ .copy_range = 0,
2481+ .qthreshold = ULOG_DEFAULT_QTHRESHOLD,
2482+ .prefix = ""
2483+ };
2484+
2485+ ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
2486 }
2487
2488 static int ipt_ulog_checkentry(const char *tablename,
2489@@ -341,7 +374,9 @@
2490 sock_release(nflognl->sk_socket);
2491 return -EINVAL;
2492 }
2493-
2494+ if (nflog)
2495+ nf_log_register(PF_INET, &ipt_logfn);
2496+
2497 return 0;
2498 }
2499
2500@@ -352,6 +387,8 @@
2501
2502 DEBUGP("ipt_ULOG: cleanup_module\n");
2503
2504+ if (nflog)
2505+ nf_log_unregister(PF_INET, &ipt_logfn);
2506 ipt_unregister_target(&ipt_ulog_reg);
2507 sock_release(nflognl->sk_socket);
2508
2509diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_connlimit.c linux-2.6.5-rc2/net/ipv4/netfilter/ipt_connlimit.c
2510--- linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_connlimit.c 1970-01-01 00:00:00.000000000 +0000
2511+++ linux-2.6.5-rc2/net/ipv4/netfilter/ipt_connlimit.c 2004-03-22 08:28:18.000000000 +0000
2512@@ -0,0 +1,230 @@
2513+/*
2514+ * netfilter module to limit the number of parallel tcp
2515+ * connections per IP address.
2516+ * (c) 2000 Gerd Knorr <kraxel@bytesex.org>
2517+ * Nov 2002: Martin Bene <martin.bene@icomedias.com>:
2518+ * only ignore TIME_WAIT or gone connections
2519+ *
2520+ * based on ...
2521+ *
2522+ * Kernel module to match connection tracking information.
2523+ * GPL (C) 1999 Rusty Russell (rusty@rustcorp.com.au).
2524+ */
2525+#include <linux/module.h>
2526+#include <linux/skbuff.h>
2527+#include <linux/list.h>
2528+#include <linux/netfilter_ipv4/ip_conntrack.h>
2529+#include <linux/netfilter_ipv4/ip_conntrack_core.h>
2530+#include <linux/netfilter_ipv4/ip_conntrack_tcp.h>
2531+#include <linux/netfilter_ipv4/ip_tables.h>
2532+#include <linux/netfilter_ipv4/ipt_connlimit.h>
2533+
2534+#define DEBUG 0
2535+
2536+MODULE_LICENSE("GPL");
2537+
2538+/* we'll save the tuples of all connections we care about */
2539+struct ipt_connlimit_conn
2540+{
2541+ struct list_head list;
2542+ struct ip_conntrack_tuple tuple;
2543+};
2544+
2545+struct ipt_connlimit_data {
2546+ spinlock_t lock;
2547+ struct list_head iphash[256];
2548+};
2549+
2550+static int ipt_iphash(u_int32_t addr)
2551+{
2552+ int hash;
2553+
2554+ hash = addr & 0xff;
2555+ hash ^= (addr >> 8) & 0xff;
2556+ hash ^= (addr >> 16) & 0xff;
2557+ hash ^= (addr >> 24) & 0xff;
2558+ return hash;
2559+}
2560+
2561+static int count_them(struct ipt_connlimit_data *data,
2562+ u_int32_t addr, u_int32_t mask,
2563+ struct ip_conntrack *ct)
2564+{
2565+#if DEBUG
2566+ const static char *tcp[] = { "none", "established", "syn_sent", "syn_recv",
2567+ "fin_wait", "time_wait", "close", "close_wait",
2568+ "last_ack", "listen" };
2569+#endif
2570+ int addit = 1, matches = 0;
2571+ struct ip_conntrack_tuple tuple;
2572+ struct ip_conntrack_tuple_hash *found;
2573+ struct ipt_connlimit_conn *conn;
2574+ struct list_head *hash,*lh;
2575+
2576+ spin_lock(&data->lock);
2577+ tuple = ct->tuplehash[0].tuple;
2578+ hash = &data->iphash[ipt_iphash(addr & mask)];
2579+
2580+ /* check the saved connections */
2581+ for (lh = hash->next; lh != hash; lh = lh->next) {
2582+ conn = list_entry(lh,struct ipt_connlimit_conn,list);
2583+ found = ip_conntrack_find_get(&conn->tuple,ct);
2584+ if (0 == memcmp(&conn->tuple,&tuple,sizeof(tuple)) &&
2585+ found != NULL &&
2586+ found->ctrack->proto.tcp.state != TCP_CONNTRACK_TIME_WAIT) {
2587+ /* Just to be sure we have it only once in the list.
2588+ We should'nt see tuples twice unless someone hooks this
2589+ into a table without "-p tcp --syn" */
2590+ addit = 0;
2591+ }
2592+#if DEBUG
2593+ printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d %s\n",
2594+ ipt_iphash(addr & mask),
2595+ NIPQUAD(conn->tuple.src.ip), ntohs(conn->tuple.src.u.tcp.port),
2596+ NIPQUAD(conn->tuple.dst.ip), ntohs(conn->tuple.dst.u.tcp.port),
2597+ (NULL != found) ? tcp[found->ctrack->proto.tcp.state] : "gone");
2598+#endif
2599+ if (NULL == found) {
2600+ /* this one is gone */
2601+ lh = lh->prev;
2602+ list_del(lh->next);
2603+ kfree(conn);
2604+ continue;
2605+ }
2606+ if (found->ctrack->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT) {
2607+ /* we don't care about connections which are
2608+ closed already -> ditch it */
2609+ lh = lh->prev;
2610+ list_del(lh->next);
2611+ kfree(conn);
2612+ nf_conntrack_put(&found->ctrack->infos[0]);
2613+ continue;
2614+ }
2615+ if ((addr & mask) == (conn->tuple.src.ip & mask)) {
2616+ /* same source IP address -> be counted! */
2617+ matches++;
2618+ }
2619+ nf_conntrack_put(&found->ctrack->infos[0]);
2620+ }
2621+ if (addit) {
2622+ /* save the new connection in our list */
2623+#if DEBUG
2624+ printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d new\n",
2625+ ipt_iphash(addr & mask),
2626+ NIPQUAD(tuple.src.ip), ntohs(tuple.src.u.tcp.port),
2627+ NIPQUAD(tuple.dst.ip), ntohs(tuple.dst.u.tcp.port));
2628+#endif
2629+ conn = kmalloc(sizeof(*conn),GFP_ATOMIC);
2630+ if (NULL == conn)
2631+ return -1;
2632+ memset(conn,0,sizeof(*conn));
2633+ INIT_LIST_HEAD(&conn->list);
2634+ conn->tuple = tuple;
2635+ list_add(&conn->list,hash);
2636+ matches++;
2637+ }
2638+ spin_unlock(&data->lock);
2639+ return matches;
2640+}
2641+
2642+static int
2643+match(const struct sk_buff *skb,
2644+ const struct net_device *in,
2645+ const struct net_device *out,
2646+ const void *matchinfo,
2647+ int offset,
2648+ int *hotdrop)
2649+{
2650+ const struct ipt_connlimit_info *info = matchinfo;
2651+ int connections, match;
2652+ struct ip_conntrack *ct;
2653+ enum ip_conntrack_info ctinfo;
2654+
2655+ ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
2656+ if (NULL == ct) {
2657+ printk("ipt_connlimit: Oops: invalid ct state ?\n");
2658+ *hotdrop = 1;
2659+ return 0;
2660+ }
2661+ connections = count_them(info->data,skb->nh.iph->saddr,info->mask,ct);
2662+ if (-1 == connections) {
2663+ printk("ipt_connlimit: Hmm, kmalloc failed :-(\n");
2664+ *hotdrop = 1; /* let's free some memory :-) */
2665+ return 0;
2666+ }
2667+ match = (info->inverse) ? (connections <= info->limit) : (connections > info->limit);
2668+#if DEBUG
2669+ printk("ipt_connlimit: src=%u.%u.%u.%u mask=%u.%u.%u.%u "
2670+ "connections=%d limit=%d match=%s\n",
2671+ NIPQUAD(skb->nh.iph->saddr), NIPQUAD(info->mask),
2672+ connections, info->limit, match ? "yes" : "no");
2673+#endif
2674+
2675+ return match;
2676+}
2677+
2678+static int check(const char *tablename,
2679+ const struct ipt_ip *ip,
2680+ void *matchinfo,
2681+ unsigned int matchsize,
2682+ unsigned int hook_mask)
2683+{
2684+ struct ipt_connlimit_info *info = matchinfo;
2685+ int i;
2686+
2687+ /* verify size */
2688+ if (matchsize != IPT_ALIGN(sizeof(struct ipt_connlimit_info)))
2689+ return 0;
2690+
2691+ /* refuse anything but tcp */
2692+ if (ip->proto != IPPROTO_TCP)
2693+ return 0;
2694+
2695+ /* init private data */
2696+ info->data = kmalloc(sizeof(struct ipt_connlimit_data),GFP_KERNEL);
2697+ spin_lock_init(&(info->data->lock));
2698+ for (i = 0; i < 256; i++)
2699+ INIT_LIST_HEAD(&(info->data->iphash[i]));
2700+
2701+ return 1;
2702+}
2703+
2704+static void destroy(void *matchinfo, unsigned int matchinfosize)
2705+{
2706+ struct ipt_connlimit_info *info = matchinfo;
2707+ struct ipt_connlimit_conn *conn;
2708+ struct list_head *hash;
2709+ int i;
2710+
2711+ /* cleanup */
2712+ for (i = 0; i < 256; i++) {
2713+ hash = &(info->data->iphash[i]);
2714+ while (hash != hash->next) {
2715+ conn = list_entry(hash->next,struct ipt_connlimit_conn,list);
2716+ list_del(hash->next);
2717+ kfree(conn);
2718+ }
2719+ }
2720+ kfree(info->data);
2721+}
2722+
2723+static struct ipt_match connlimit_match = {
2724+ .name = "connlimit",
2725+ .match = &match,
2726+ .checkentry = &check,
2727+ .destroy = &destroy,
2728+ .me = THIS_MODULE
2729+};
2730+
2731+static int __init init(void)
2732+{
2733+ return ipt_register_match(&connlimit_match);
2734+}
2735+
2736+static void __exit fini(void)
2737+{
2738+ ipt_unregister_match(&connlimit_match);
2739+}
2740+
2741+module_init(init);
2742+module_exit(fini);
2743diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_conntrack.c linux-2.6.5-rc2/net/ipv4/netfilter/ipt_conntrack.c
2744--- linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_conntrack.c 2004-03-20 00:11:50.000000000 +0000
2745+++ linux-2.6.5-rc2/net/ipv4/netfilter/ipt_conntrack.c 2004-03-22 08:29:50.000000000 +0000
2746@@ -35,11 +35,13 @@
2747
2748 #define FWINV(bool,invflg) ((bool) ^ !!(sinfo->invflags & invflg))
2749
2750- if (ct)
2751- statebit = IPT_CONNTRACK_STATE_BIT(ctinfo);
2752- else
2753- statebit = IPT_CONNTRACK_STATE_INVALID;
2754-
2755+ if (skb->nfct == &ip_conntrack_untracked.infos[IP_CT_NEW])
2756+ statebit = IPT_CONNTRACK_STATE_UNTRACKED;
2757+ else if (ct)
2758+ statebit = IPT_CONNTRACK_STATE_BIT(ctinfo);
2759+ else
2760+ statebit = IPT_CONNTRACK_STATE_INVALID;
2761+
2762 if(sinfo->flags & IPT_CONNTRACK_STATE) {
2763 if (ct) {
2764 if(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip !=
2765diff -Nur --exclude '*.orig' linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_dstlimit.c linux-2.6.5-rc2/net/ipv4/netfilter/ipt_dstlimit.c
2766--- linux-2.6.5-rc2.org/net/ipv4/netfilter/ipt_dstlimit.c 1970-01-01 00:00:00.000000000 +0000
2767+++ linux-2.6.5-rc2/net/ipv4/netfilter/ipt_dstlimit.c 2004-03-22 08:28:26.000000000 +0000
2768@@ -0,0 +1,690 @@
2769+/* iptables match extension to limit the number of packets per second
2770+ * seperately for each destination.
2771+ *
2772+ * (C) 2003 by Harald Welte <laforge@netfilter.org>
2773+ *
2774+ * $Id$
2775+ *
2776+ * Development of this code was funded by Astaro AG, http://www.astaro.com/
2777+ *
2778+ * based on ipt_limit.c by:
2779