]> git.pld-linux.org Git - packages/kernel.git/blame - 2.6.5-patch-o-matic-ng-base-20040330.patch
projects / packages / kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- enable cluster config on ppc,sparc,amd64,ia64
[packages/kernel.git] / 2.6.5-patch-o-matic-ng-base-20040330.patch
CommitLineData
c88b0326 1diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter.h linux-2.6.5-rc3/include/linux/netfilter.h
2--- linux-2.6.5-rc3.org/include/linux/netfilter.h 2004-03-30 05:26:16.000000000 +0200
3+++ linux-2.6.5-rc3/include/linux/netfilter.h 2004-03-30 11:10:29.000000000 +0200
4@@ -99,6 +99,24 @@
5
6 extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
7
8+typedef void nf_logfn(unsigned int hooknum,
9+ const struct sk_buff *skb,
10+ const struct net_device *in,
11+ const struct net_device *out,
12+ const char *prefix);
13+
14+/* Function to register/unregister log function. */
15+int nf_log_register(int pf, nf_logfn *logfn);
16+void nf_log_unregister(int pf, nf_logfn *logfn);
17+
18+/* Calls the registered backend logging function */
19+void nf_log_packet(int pf,
20+ unsigned int hooknum,
21+ const struct sk_buff *skb,
22+ const struct net_device *in,
23+ const struct net_device *out,
24+ const char *fmt, ...);
25+
26 /* Activate hook; either okfn or kfree_skb called, unless a hook
27 returns NF_STOLEN (in which case, it's up to the hook to deal with
28 the consequences).
29diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ip_conntrack.h
30--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ip_conntrack.h 2004-03-30 05:27:17.000000000 +0200
31+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ip_conntrack.h 2004-03-30 11:11:27.000000000 +0200
32@@ -251,6 +251,9 @@
33 /* Call me when a conntrack is destroyed. */
34 extern void (*ip_conntrack_destroyed)(struct ip_conntrack *conntrack);
35
36+/* Fake conntrack entry for untracked connections */
37+extern struct ip_conntrack ip_conntrack_untracked;
38+
39 /* Returns new sk_buff, or NULL */
40 struct sk_buff *
41 ip_ct_gather_frags(struct sk_buff *skb);
42diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ip_pool.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ip_pool.h
43--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ip_pool.h 1970-01-01 01:00:00.000000000 +0100
44+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ip_pool.h 2004-03-30 11:11:17.000000000 +0200
45@@ -0,0 +1,64 @@
46+#ifndef _IP_POOL_H
47+#define _IP_POOL_H
48+
49+/***************************************************************************/
50+/* This program is free software; you can redistribute it and/or modify */
51+/* it under the terms of the GNU General Public License as published by */
52+/* the Free Software Foundation; either version 2 of the License, or */
53+/* (at your option) any later version. */
54+/* */
55+/* This program is distributed in the hope that it will be useful, */
56+/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
57+/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
58+/* GNU General Public License for more details. */
59+/* */
60+/* You should have received a copy of the GNU General Public License */
61+/* along with this program; if not, write to the Free Software */
62+/* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA*/
63+/***************************************************************************/
64+
65+/* A sockopt of such quality has hardly ever been seen before on the open
66+ * market! This little beauty, hardly ever used: above 64, so it's
67+ * traditionally used for firewalling, not touched (even once!) by the
68+ * 2.0, 2.2 and 2.4 kernels!
69+ *
70+ * Comes with its own certificate of authenticity, valid anywhere in the
71+ * Free world!
72+ *
73+ * Rusty, 19.4.2000
74+ */
75+#define SO_IP_POOL 81
76+
77+typedef int ip_pool_t; /* pool index */
78+#define IP_POOL_NONE ((ip_pool_t)-1)
79+
80+struct ip_pool_request {
81+ int op;
82+ ip_pool_t index;
83+ u_int32_t addr;
84+ u_int32_t addr2;
85+};
86+
87+/* NOTE: I deliberately break the first cut ippool utility. Nobody uses it. */
88+
89+#define IP_POOL_BAD001 0x00000010
90+
91+#define IP_POOL_FLUSH 0x00000011 /* req.index, no arguments */
92+#define IP_POOL_INIT 0x00000012 /* from addr to addr2 incl. */
93+#define IP_POOL_DESTROY 0x00000013 /* req.index, no arguments */
94+#define IP_POOL_ADD_ADDR 0x00000014 /* add addr to pool */
95+#define IP_POOL_DEL_ADDR 0x00000015 /* del addr from pool */
96+#define IP_POOL_HIGH_NR 0x00000016 /* result in req.index */
97+#define IP_POOL_LOOKUP 0x00000017 /* result in addr and addr2 */
98+#define IP_POOL_USAGE 0x00000018 /* result in addr */
99+#define IP_POOL_TEST_ADDR 0x00000019 /* result (0/1) returned */
100+
101+#ifdef __KERNEL__
102+
103+/* NOTE: ip_pool_match() and ip_pool_mod() expect ADDR to be host byte order */
104+extern int ip_pool_match(ip_pool_t pool, u_int32_t addr);
105+extern int ip_pool_mod(ip_pool_t pool, u_int32_t addr, int isdel);
106+
107+#endif
108+
109+#endif /*_IP_POOL_H*/
110diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_NETLINK.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_NETLINK.h
111--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_NETLINK.h 1970-01-01 01:00:00.000000000 +0100
112+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_NETLINK.h 2004-03-30 11:10:39.000000000 +0200
113@@ -0,0 +1,27 @@
114+#ifndef _IPT_FWMON_H
115+#define _IPT_FWMON_H
116+
117+/* Bitmask macros */
118+#define MASK(x,y) (x & y)
119+#define MASK_SET(x,y) x |= y
120+#define MASK_UNSET(x,y) x &= ~y
121+
122+#define USE_MARK 0x00000001
123+#define USE_DROP 0x00000002
124+#define USE_SIZE 0x00000004
125+
126+struct ipt_nldata
127+{
128+ unsigned int flags;
129+ unsigned int mark;
130+ unsigned int size;
131+};
132+
133+/* Old header */
134+struct netlink_t {
135+ unsigned int len;
136+ unsigned int mark;
137+ char iface[IFNAMSIZ];
138+};
139+
140+#endif /*_IPT_FWMON_H*/
141diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_TTL.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_TTL.h
142--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_TTL.h 1970-01-01 01:00:00.000000000 +0100
143+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_TTL.h 2004-03-30 11:10:42.000000000 +0200
144@@ -0,0 +1,21 @@
145+/* TTL modification module for IP tables
146+ * (C) 2000 by Harald Welte <laforge@gnumonks.org> */
147+
148+#ifndef _IPT_TTL_H
149+#define _IPT_TTL_H
150+
151+enum {
152+ IPT_TTL_SET = 0,
153+ IPT_TTL_INC,
154+ IPT_TTL_DEC
155+};
156+
157+#define IPT_TTL_MAXMODE IPT_TTL_DEC
158+
159+struct ipt_TTL_info {
160+ u_int8_t mode;
161+ u_int8_t ttl;
162+};
163+
164+
165+#endif
166diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_ULOG.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_ULOG.h
167--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_ULOG.h 2004-03-30 05:26:10.000000000 +0200
168+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_ULOG.h 2004-03-30 11:10:29.000000000 +0200
169@@ -11,6 +11,9 @@
170 #define NETLINK_NFLOG 5
171 #endif
172
173+#define ULOG_DEFAULT_NLGROUP 1
174+#define ULOG_DEFAULT_QTHRESHOLD 1
175+
176 #define ULOG_MAC_LEN 80
177 #define ULOG_PREFIX_LEN 32
178
179diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_connlimit.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_connlimit.h
180--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_connlimit.h 1970-01-01 01:00:00.000000000 +0100
181+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_connlimit.h 2004-03-30 11:10:45.000000000 +0200
182@@ -0,0 +1,12 @@
183+#ifndef _IPT_CONNLIMIT_H
184+#define _IPT_CONNLIMIT_H
185+
186+struct ipt_connlimit_data;
187+
188+struct ipt_connlimit_info {
189+ int limit;
190+ int inverse;
191+ u_int32_t mask;
192+ struct ipt_connlimit_data *data;
193+};
194+#endif /* _IPT_CONNLIMIT_H */
195diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_conntrack.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_conntrack.h
196--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_conntrack.h 2004-03-30 05:27:00.000000000 +0200
197+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_conntrack.h 2004-03-30 11:11:27.000000000 +0200
198@@ -10,6 +10,7 @@
199
200 #define IPT_CONNTRACK_STATE_SNAT (1 << (IP_CT_NUMBER + 1))
201 #define IPT_CONNTRACK_STATE_DNAT (1 << (IP_CT_NUMBER + 2))
202+#define IPT_CONNTRACK_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 3))
203
204 /* flags, invflags: */
205 #define IPT_CONNTRACK_STATE 0x01
206diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_dstlimit.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_dstlimit.h
207--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_dstlimit.h 1970-01-01 01:00:00.000000000 +0100
208+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_dstlimit.h 2004-03-30 11:10:47.000000000 +0200
209@@ -0,0 +1,39 @@
210+#ifndef _IPT_DSTLIMIT_H
211+#define _IPT_DSTLIMIT_H
212+
213+/* timings are in milliseconds. */
214+#define IPT_DSTLIMIT_SCALE 10000
215+/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
216+ seconds, or one every 59 hours. */
217+
218+/* details of this structure hidden by the implementation */
219+struct ipt_dstlimit_htable;
220+
221+#define IPT_DSTLIMIT_HASH_DIP 0x0001
222+#define IPT_DSTLIMIT_HASH_DPT 0x0002
223+#define IPT_DSTLIMIT_HASH_SIP 0x0004
224+
225+struct dstlimit_cfg {
226+ u_int32_t mode; /* bitmask of IPT_DSTLIMIT_HASH_* */
227+ u_int32_t avg; /* Average secs between packets * scale */
228+ u_int32_t burst; /* Period multiplier for upper limit. */
229+
230+ /* user specified */
231+ u_int32_t size; /* how many buckets */
232+ u_int32_t max; /* max number of entries */
233+ u_int32_t gc_interval; /* gc interval */
234+ u_int32_t expire; /* when do entries expire? */
235+};
236+
237+struct ipt_dstlimit_info {
238+ char name [IFNAMSIZ]; /* name */
239+ struct dstlimit_cfg cfg;
240+ struct ipt_dstlimit_htable *hinfo;
241+
242+ /* Used internally by the kernel */
243+ union {
244+ void *ptr;
245+ struct ipt_dstlimit_info *master;
246+ } u;
247+};
248+#endif /*_IPT_DSTLIMIT_H*/
249diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_fuzzy.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_fuzzy.h
250--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_fuzzy.h 1970-01-01 01:00:00.000000000 +0100
251+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_fuzzy.h 2004-03-30 11:11:06.000000000 +0200
252@@ -0,0 +1,21 @@
253+#ifndef _IPT_FUZZY_H
254+#define _IPT_FUZZY_H
255+
256+#include <linux/param.h>
257+#include <linux/types.h>
258+
259+#define MAXFUZZYRATE 10000000
260+#define MINFUZZYRATE 3
261+
262+struct ipt_fuzzy_info {
263+ u_int32_t minimum_rate;
264+ u_int32_t maximum_rate;
265+ u_int32_t packets_total;
266+ u_int32_t bytes_total;
267+ u_int32_t previous_time;
268+ u_int32_t present_time;
269+ u_int32_t mean_rate;
270+ u_int8_t acceptance_rate;
271+};
272+
273+#endif /*_IPT_FUZZY_H*/
274diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_ipv4options.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_ipv4options.h
275--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_ipv4options.h 1970-01-01 01:00:00.000000000 +0100
276+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_ipv4options.h 2004-03-30 11:11:08.000000000 +0200
277@@ -0,0 +1,21 @@
278+#ifndef __ipt_ipv4options_h_included__
279+#define __ipt_ipv4options_h_included__
280+
281+#define IPT_IPV4OPTION_MATCH_SSRR 0x01 /* For strict source routing */
282+#define IPT_IPV4OPTION_MATCH_LSRR 0x02 /* For loose source routing */
283+#define IPT_IPV4OPTION_DONT_MATCH_SRR 0x04 /* any source routing */
284+#define IPT_IPV4OPTION_MATCH_RR 0x08 /* For Record route */
285+#define IPT_IPV4OPTION_DONT_MATCH_RR 0x10
286+#define IPT_IPV4OPTION_MATCH_TIMESTAMP 0x20 /* For timestamp request */
287+#define IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP 0x40
288+#define IPT_IPV4OPTION_MATCH_ROUTER_ALERT 0x80 /* For router-alert */
289+#define IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT 0x100
290+#define IPT_IPV4OPTION_MATCH_ANY_OPT 0x200 /* match packet with any option */
291+#define IPT_IPV4OPTION_DONT_MATCH_ANY_OPT 0x400 /* match packet with no option */
292+
293+struct ipt_ipv4options_info {
294+ u_int16_t options;
295+};
296+
297+
298+#endif /* __ipt_ipv4options_h_included__ */
299diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_mport.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_mport.h
300--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_mport.h 1970-01-01 01:00:00.000000000 +0100
301+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_mport.h 2004-03-30 11:11:11.000000000 +0200
302@@ -0,0 +1,24 @@
303+#ifndef _IPT_MPORT_H
304+#define _IPT_MPORT_H
305+#include <linux/netfilter_ipv4/ip_tables.h>
306+
307+#define IPT_MPORT_SOURCE (1<<0)
308+#define IPT_MPORT_DESTINATION (1<<1)
309+#define IPT_MPORT_EITHER (IPT_MPORT_SOURCE|IPT_MPORT_DESTINATION)
310+
311+#define IPT_MULTI_PORTS 15
312+
313+/* Must fit inside union ipt_matchinfo: 32 bytes */
314+/* every entry in ports[] except for the last one has one bit in pflags
315+ * associated with it. If this bit is set, the port is the first port of
316+ * a portrange, with the next entry being the last.
317+ * End of list is marked with pflags bit set and port=65535.
318+ * If 14 ports are used (last one does not have a pflag), the last port
319+ * is repeated to fill the last entry in ports[] */
320+struct ipt_mport
321+{
322+ u_int8_t flags:2; /* Type of comparison */
323+ u_int16_t pflags:14; /* Port flags */
324+ u_int16_t ports[IPT_MULTI_PORTS]; /* Ports */
325+};
326+#endif /*_IPT_MPORT_H*/
327diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_nth.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_nth.h
328--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_nth.h 1970-01-01 01:00:00.000000000 +0100
329+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_nth.h 2004-03-30 11:11:13.000000000 +0200
330@@ -0,0 +1,19 @@
331+#ifndef _IPT_NTH_H
332+#define _IPT_NTH_H
333+
334+#include <linux/param.h>
335+#include <linux/types.h>
336+
337+#ifndef IPT_NTH_NUM_COUNTERS
338+#define IPT_NTH_NUM_COUNTERS 16
339+#endif
340+
341+struct ipt_nth_info {
342+ u_int8_t every;
343+ u_int8_t not;
344+ u_int8_t startat;
345+ u_int8_t counter;
346+ u_int8_t packet;
347+};
348+
349+#endif /*_IPT_NTH_H*/
350diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_osf.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_osf.h
351--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_osf.h 1970-01-01 01:00:00.000000000 +0100
352+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_osf.h 2004-03-30 11:11:15.000000000 +0200
353@@ -0,0 +1,148 @@
354+/*
355+ * ipt_osf.h
356+ *
357+ * Copyright (c) 2003 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
358+ *
359+ *
360+ * This program is free software; you can redistribute it and/or modify
361+ * it under the terms of the GNU General Public License as published by
362+ * the Free Software Foundation; either version 2 of the License, or
363+ * (at your option) any later version.
364+ *
365+ * This program is distributed in the hope that it will be useful,
366+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
367+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
368+ * GNU General Public License for more details.
369+ *
370+ * You should have received a copy of the GNU General Public License
371+ * along with this program; if not, write to the Free Software
372+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
373+ */
374+
375+#ifndef _IPT_OSF_H
376+#define _IPT_OSF_H
377+
378+#define MAXGENRELEN 32
379+#define MAXDETLEN 64
380+
381+#define IPT_OSF_GENRE 1
382+#define IPT_OSF_SMART 2
383+#define IPT_OSF_LOG 4
384+#define IPT_OSF_NETLINK 8
385+
386+#define IPT_OSF_LOGLEVEL_ALL 0
387+#define IPT_OSF_LOGLEVEL_FIRST 1
388+
389+#include <linux/list.h>
390+
391+#ifndef __KERNEL__
392+#include <netinet/ip.h>
393+#include <netinet/tcp.h>
394+
395+struct list_head
396+{
397+ struct list_head *prev, *next;
398+};
399+#endif
400+
401+struct ipt_osf_info
402+{
403+ char genre[MAXGENRELEN];
404+ int len;
405+ unsigned long flags;
406+ int loglevel;
407+ int invert; /* UNSUPPORTED */
408+};
409+
410+struct osf_wc
411+{
412+ char wc;
413+ unsigned long val;
414+};
415+
416+/* This struct represents IANA options
417+ * http://www.iana.org/assignments/tcp-parameters
418+ */
419+struct osf_opt
420+{
421+ unsigned char kind;
422+ unsigned char length;
423+ struct osf_wc wc;
424+};
425+
426+struct osf_finger
427+{
428+ struct list_head flist;
429+ struct osf_wc wss;
430+ unsigned char ttl;
431+ unsigned char df;
432+ unsigned long ss;
433+ unsigned char genre[MAXGENRELEN];
434+ unsigned char version[MAXGENRELEN], subtype[MAXGENRELEN];
435+
436+ /* Not needed, but for consistency with original table from Michal Zalewski */
437+ unsigned char details[MAXDETLEN];
438+
439+ int opt_num;
440+ struct osf_opt opt[MAX_IPOPTLEN]; /* In case it is all NOP or EOL */
441+
442+};
443+
444+struct ipt_osf_nlmsg
445+{
446+ struct osf_finger f;
447+ struct iphdr ip;
448+ struct tcphdr tcp;
449+};
450+
451+#ifdef __KERNEL__
452+
453+/* Defines for IANA option kinds */
454+
455+#define OSFOPT_EOL 0 /* End of options */
456+#define OSFOPT_NOP 1 /* NOP */
457+#define OSFOPT_MSS 2 /* Maximum segment size */
458+#define OSFOPT_WSO 3 /* Window scale option */
459+#define OSFOPT_SACKP 4 /* SACK permitted */
460+#define OSFOPT_SACK 5 /* SACK */
461+#define OSFOPT_ECHO 6
462+#define OSFOPT_ECHOREPLY 7
463+#define OSFOPT_TS 8 /* Timestamp option */
464+#define OSFOPT_POCP 9 /* Partial Order Connection Permitted */
465+#define OSFOPT_POSP 10 /* Partial Order Service Profile */
466+/* Others are not used in current OSF */
467+
468+static struct osf_opt IANA_opts[] =
469+{
470+ {0, 1,},
471+ {1, 1,},
472+ {2, 4,},
473+ {3, 3,},
474+ {4, 2,},
475+ {5, 1 ,}, /* SACK length is not defined */
476+ {6, 6,},
477+ {7, 6,},
478+ {8, 10,},
479+ {9, 2,},
480+ {10, 3,},
481+ {11, 1,}, /* CC: Suppose 1 */
482+ {12, 1,}, /* the same */
483+ {13, 1,}, /* and here too */
484+ {14, 3,},
485+ {15, 1,}, /* TCP Alternate Checksum Data. Length is not defined */
486+ {16, 1,},
487+ {17, 1,},
488+ {18, 3,},
489+ {19, 18,},
490+ {20, 1,},
491+ {21, 1,},
492+ {22, 1,},
493+ {23, 1,},
494+ {24, 1,},
495+ {25, 1,},
496+ {26, 1,},
497+};
498+
499+#endif /* __KERNEL__ */
500+
501+#endif /* _IPT_OSF_H */
502diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_pool.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_pool.h
503--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_pool.h 1970-01-01 01:00:00.000000000 +0100
504+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_pool.h 2004-03-30 11:11:17.000000000 +0200
505@@ -0,0 +1,25 @@
506+#ifndef _IPT_POOL_H
507+#define _IPT_POOL_H
508+
509+#include <linux/netfilter_ipv4/ip_pool.h>
510+
511+#define IPT_POOL_INV_SRC 0x00000001
512+#define IPT_POOL_INV_DST 0x00000002
513+#define IPT_POOL_DEL_SRC 0x00000004
514+#define IPT_POOL_DEL_DST 0x00000008
515+#define IPT_POOL_INV_MOD_SRC 0x00000010
516+#define IPT_POOL_INV_MOD_DST 0x00000020
517+#define IPT_POOL_MOD_SRC_ACCEPT 0x00000040
518+#define IPT_POOL_MOD_DST_ACCEPT 0x00000080
519+#define IPT_POOL_MOD_SRC_DROP 0x00000100
520+#define IPT_POOL_MOD_DST_DROP 0x00000200
521+
522+/* match info */
523+struct ipt_pool_info
524+{
525+ ip_pool_t src;
526+ ip_pool_t dst;
527+ unsigned flags;
528+};
529+
530+#endif /*_IPT_POOL_H*/
531diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_psd.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_psd.h
532--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_psd.h 1970-01-01 01:00:00.000000000 +0100
533+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_psd.h 2004-03-30 11:11:18.000000000 +0200
534@@ -0,0 +1,40 @@
535+#ifndef _IPT_PSD_H
536+#define _IPT_PSD_H
537+
538+#include <linux/param.h>
539+#include <linux/types.h>
540+
541+/*
542+ * High port numbers have a lower weight to reduce the frequency of false
543+ * positives, such as from passive mode FTP transfers.
544+ */
545+#define PORT_WEIGHT_PRIV 3
546+#define PORT_WEIGHT_HIGH 1
547+
548+/*
549+ * Port scan detection thresholds: at least COUNT ports need to be scanned
550+ * from the same source, with no longer than DELAY ticks between ports.
551+ */
552+#define SCAN_MIN_COUNT 7
553+#define SCAN_MAX_COUNT (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
554+#define SCAN_WEIGHT_THRESHOLD SCAN_MAX_COUNT
555+#define SCAN_DELAY_THRESHOLD (HZ * 3)
556+
557+/*
558+ * Keep track of up to LIST_SIZE source addresses, using a hash table of
559+ * HASH_SIZE entries for faster lookups, but limiting hash collisions to
560+ * HASH_MAX source addresses per the same hash value.
561+ */
562+#define LIST_SIZE 0x100
563+#define HASH_LOG 9
564+#define HASH_SIZE (1 << HASH_LOG)
565+#define HASH_MAX 0x10
566+
567+struct ipt_psd_info {
568+ unsigned int weight_threshold;
569+ unsigned int delay_threshold;
570+ unsigned short lo_ports_weight;
571+ unsigned short hi_ports_weight;
572+};
573+
574+#endif /*_IPT_PSD_H*/
575diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_quota.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_quota.h
576--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_quota.h 1970-01-01 01:00:00.000000000 +0100
577+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_quota.h 2004-03-30 11:11:23.000000000 +0200
578@@ -0,0 +1,11 @@
579+#ifndef _IPT_QUOTA_H
580+#define _IPT_QUOTA_H
581+
582+/* print debug info in both kernel/netfilter module & iptable library */
583+//#define DEBUG_IPT_QUOTA
584+
585+struct ipt_quota_info {
586+ u_int64_t quota;
587+};
588+
589+#endif /*_IPT_QUOTA_H*/
590diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_random.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_random.h
591--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_random.h 1970-01-01 01:00:00.000000000 +0100
592+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_random.h 2004-03-30 11:11:26.000000000 +0200
593@@ -0,0 +1,11 @@
594+#ifndef _IPT_RAND_H
595+#define _IPT_RAND_H
596+
597+#include <linux/param.h>
598+#include <linux/types.h>
599+
600+struct ipt_rand_info {
601+ u_int8_t average;
602+};
603+
604+#endif /*_IPT_RAND_H*/
605diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_realm.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_realm.h
606--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_realm.h 1970-01-01 01:00:00.000000000 +0100
607+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_realm.h 2004-03-30 11:11:29.000000000 +0200
608@@ -0,0 +1,9 @@
609+#ifndef _IPT_REALM_H
610+#define _IPT_REALM_H
611+
612+struct ipt_realm_info {
613+ u_int32_t id;
614+ u_int32_t mask;
615+ u_int8_t invert;
616+};
617+#endif /*_IPT_REALM_H*/
618diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_sctp.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_sctp.h
619--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_sctp.h 1970-01-01 01:00:00.000000000 +0100
620+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_sctp.h 2004-03-30 11:11:32.000000000 +0200
621@@ -0,0 +1,107 @@
622+#ifndef _IPT_SCTP_H_
623+#define _IPT_SCTP_H_
624+
625+#define IPT_SCTP_SRC_PORTS 0x01
626+#define IPT_SCTP_DEST_PORTS 0x02
627+#define IPT_SCTP_CHUNK_TYPES 0x04
628+
629+#define IPT_SCTP_VALID_FLAGS 0x07
630+
631+#define ELEMCOUNT(x) (sizeof(x)/sizeof(x[0]))
632+
633+
634+struct ipt_sctp_flag_info {
635+ u_int8_t chunktype;
636+ u_int8_t flag;
637+ u_int8_t flag_mask;
638+};
639+
640+#define IPT_NUM_SCTP_FLAGS 4
641+
642+struct ipt_sctp_info {
643+ u_int16_t dpts[2]; /* Min, Max */
644+ u_int16_t spts[2]; /* Min, Max */
645+
646+ u_int32_t chunkmap[256 / sizeof (u_int32_t)]; /* Bit mask of chunks to be matched according to RFC 2960 */
647+
648+#define SCTP_CHUNK_MATCH_ANY 0x01 /* Match if any of the chunk types are present */
649+#define SCTP_CHUNK_MATCH_ALL 0x02 /* Match if all of the chunk types are present */
650+#define SCTP_CHUNK_MATCH_ONLY 0x04 /* Match if these are the only chunk types present */
651+
652+ u_int32_t chunk_match_type;
653+ struct ipt_sctp_flag_info flag_info[IPT_NUM_SCTP_FLAGS];
654+ int flag_count;
655+
656+ u_int32_t flags;
657+ u_int32_t invflags;
658+};
659+
660+#define bytes(type) (sizeof(type) * 8)
661+
662+#define SCTP_CHUNKMAP_SET(chunkmap, type) \
663+ do { \
664+ chunkmap[type / bytes(u_int32_t)] |= \
665+ 1 << (type % bytes(u_int32_t)); \
666+ } while (0)
667+
668+#define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \
669+ do { \
670+ chunkmap[type / bytes(u_int32_t)] &= \
671+ ~(1 << (type % bytes(u_int32_t))); \
672+ } while (0)
673+
674+#define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \
675+({ \
676+ (chunkmap[type / bytes (u_int32_t)] & \
677+ (1 << (type % bytes (u_int32_t)))) ? 1: 0; \
678+})
679+
680+#define SCTP_CHUNKMAP_RESET(chunkmap) \
681+ do { \
682+ int i; \
683+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
684+ chunkmap[i] = 0; \
685+ } while (0)
686+
687+#define SCTP_CHUNKMAP_SET_ALL(chunkmap) \
688+ do { \
689+ int i; \
690+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
691+ chunkmap[i] = ~0; \
692+ } while (0)
693+
694+#define SCTP_CHUNKMAP_COPY(destmap, srcmap) \
695+ do { \
696+ int i; \
697+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
698+ destmap[i] = srcmap[i]; \
699+ } while (0)
700+
701+#define SCTP_CHUNKMAP_IS_CLEAR(chunkmap) \
702+({ \
703+ int i; \
704+ int flag = 1; \
705+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) { \
706+ if (chunkmap[i]) { \
707+ flag = 0; \
708+ break; \
709+ } \
710+ } \
711+ flag; \
712+})
713+
714+#define SCTP_CHUNKMAP_IS_ALL_SET(chunkmap) \
715+({ \
716+ int i; \
717+ int flag = 1; \
718+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) { \
719+ if (chunkmap[i] != ~0) { \
720+ flag = 0; \
721+ break; \
722+ } \
723+ } \
724+ flag; \
725+})
726+
727+#endif /* _IPT_SCTP_H_ */
728+
729diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_state.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_state.h
730--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_state.h 2004-03-30 05:27:06.000000000 +0200
731+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_state.h 2004-03-30 11:11:27.000000000 +0200
732@@ -4,6 +4,8 @@
733 #define IPT_STATE_BIT(ctinfo) (1 << ((ctinfo)%IP_CT_IS_REPLY+1))
734 #define IPT_STATE_INVALID (1 << 0)
735
736+#define IPT_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 1))
737+
738 struct ipt_state_info
739 {
740 unsigned int statemask;
741diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_time.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_time.h
742--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_time.h 1970-01-01 01:00:00.000000000 +0100
743+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_time.h 2004-03-30 11:11:33.000000000 +0200
744@@ -0,0 +1,13 @@
745+#ifndef __ipt_time_h_included__
746+#define __ipt_time_h_included__
747+
748+
749+struct ipt_time_info {
750+ u_int8_t days_match; /* 1 bit per day. -SMTWTFS */
751+ u_int16_t time_start; /* 0 < time_start < 23*60+59 = 1439 */
752+ u_int16_t time_stop; /* 0:0 < time_stat < 23:59 */
753+ u_int8_t kerneltime; /* ignore skb time (and use kerneltime) or not. */
754+};
755+
756+
757+#endif /* __ipt_time_h_included__ */
758diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_u32.h linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_u32.h
759--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4/ipt_u32.h 1970-01-01 01:00:00.000000000 +0100
760+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4/ipt_u32.h 2004-03-30 11:11:35.000000000 +0200
761@@ -0,0 +1,40 @@
762+#ifndef _IPT_U32_H
763+#define _IPT_U32_H
764+#include <linux/netfilter_ipv4/ip_tables.h>
765+
766+enum ipt_u32_ops
767+{
768+ IPT_U32_AND,
769+ IPT_U32_LEFTSH,
770+ IPT_U32_RIGHTSH,
771+ IPT_U32_AT
772+};
773+
774+struct ipt_u32_location_element
775+{
776+ u_int32_t number;
777+ u_int8_t nextop;
778+};
779+struct ipt_u32_value_element
780+{
781+ u_int32_t min;
782+ u_int32_t max;
783+};
784+/* *** any way to allow for an arbitrary number of elements?
785+ for now I settle for a limit of 10 of each */
786+#define U32MAXSIZE 10
787+struct ipt_u32_test
788+{
789+ u_int8_t nnums;
790+ struct ipt_u32_location_element location[U32MAXSIZE+1];
791+ u_int8_t nvalues;
792+ struct ipt_u32_value_element value[U32MAXSIZE+1];
793+};
794+
795+struct ipt_u32
796+{
797+ u_int8_t ntests;
798+ struct ipt_u32_test tests[U32MAXSIZE+1];
799+};
800+
801+#endif /*_IPT_U32_H*/
802diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv4.h linux-2.6.5-rc3/include/linux/netfilter_ipv4.h
803--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv4.h 2004-03-30 05:27:05.000000000 +0200
804+++ linux-2.6.5-rc3/include/linux/netfilter_ipv4.h 2004-03-30 11:11:27.000000000 +0200
805@@ -51,6 +51,8 @@
806
807 enum nf_ip_hook_priorities {
808 NF_IP_PRI_FIRST = INT_MIN,
809+ NF_IP_PRI_CONNTRACK_DEFRAG = -400,
810+ NF_IP_PRI_RAW = -300,
811 NF_IP_PRI_SELINUX_FIRST = -225,
812 NF_IP_PRI_CONNTRACK = -200,
813 NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
814diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_HL.h linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_HL.h
815--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_HL.h 1970-01-01 01:00:00.000000000 +0100
816+++ linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_HL.h 2004-03-30 11:10:35.000000000 +0200
817@@ -0,0 +1,22 @@
818+/* Hop Limit modification module for ip6tables
819+ * Maciej Soltysiak <solt@dns.toxicfilms.tv>
820+ * Based on HW's TTL module */
821+
822+#ifndef _IP6T_HL_H
823+#define _IP6T_HL_H
824+
825+enum {
826+ IP6T_HL_SET = 0,
827+ IP6T_HL_INC,
828+ IP6T_HL_DEC
829+};
830+
831+#define IP6T_HL_MAXMODE IP6T_HL_DEC
832+
833+struct ip6t_HL_info {
834+ u_int8_t mode;
835+ u_int8_t hop_limit;
836+};
837+
838+
839+#endif
840diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_REJECT.h linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_REJECT.h
841--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_REJECT.h 2004-03-30 05:25:30.000000000 +0200
842+++ linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_REJECT.h 2004-03-30 11:10:40.000000000 +0200
843@@ -2,15 +2,17 @@
844 #define _IP6T_REJECT_H
845
846 enum ip6t_reject_with {
847- IP6T_ICMP_NET_UNREACHABLE,
848- IP6T_ICMP_HOST_UNREACHABLE,
849- IP6T_ICMP_PROT_UNREACHABLE,
850- IP6T_ICMP_PORT_UNREACHABLE,
851- IP6T_ICMP_ECHOREPLY
852+ IP6T_ICMP6_NO_ROUTE,
853+ IP6T_ICMP6_ADM_PROHIBITED,
854+ IP6T_ICMP6_NOT_NEIGHBOUR,
855+ IP6T_ICMP6_ADDR_UNREACH,
856+ IP6T_ICMP6_PORT_UNREACH,
857+ IP6T_ICMP6_ECHOREPLY,
858+ IP6T_TCP_RESET
859 };
860
861 struct ip6t_reject_info {
862 enum ip6t_reject_with with; /* reject type */
863 };
864
865-#endif /*_IPT_REJECT_H*/
866+#endif /*_IP6T_REJECT_H*/
867diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_fuzzy.h linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_fuzzy.h
868--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_fuzzy.h 1970-01-01 01:00:00.000000000 +0100
869+++ linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_fuzzy.h 2004-03-30 11:11:06.000000000 +0200
870@@ -0,0 +1,21 @@
871+#ifndef _IP6T_FUZZY_H
872+#define _IP6T_FUZZY_H
873+
874+#include <linux/param.h>
875+#include <linux/types.h>
876+
877+#define MAXFUZZYRATE 10000000
878+#define MINFUZZYRATE 3
879+
880+struct ip6t_fuzzy_info {
881+ u_int32_t minimum_rate;
882+ u_int32_t maximum_rate;
883+ u_int32_t packets_total;
884+ u_int32_t bytes_total;
885+ u_int32_t previous_time;
886+ u_int32_t present_time;
887+ u_int32_t mean_rate;
888+ u_int8_t acceptance_rate;
889+};
890+
891+#endif /*_IP6T_FUZZY_H*/
892diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_nth.h linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_nth.h
893--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_nth.h 1970-01-01 01:00:00.000000000 +0100
894+++ linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_nth.h 2004-03-30 11:11:13.000000000 +0200
895@@ -0,0 +1,19 @@
896+#ifndef _IP6T_NTH_H
897+#define _IP6T_NTH_H
898+
899+#include <linux/param.h>
900+#include <linux/types.h>
901+
902+#ifndef IP6T_NTH_NUM_COUNTERS
903+#define IP6T_NTH_NUM_COUNTERS 16
904+#endif
905+
906+struct ip6t_nth_info {
907+ u_int8_t every;
908+ u_int8_t not;
909+ u_int8_t startat;
910+ u_int8_t counter;
911+ u_int8_t packet;
912+};
913+
914+#endif /*_IP6T_NTH_H*/
915diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_random.h linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_random.h
916--- linux-2.6.5-rc3.org/include/linux/netfilter_ipv6/ip6t_random.h 1970-01-01 01:00:00.000000000 +0100
917+++ linux-2.6.5-rc3/include/linux/netfilter_ipv6/ip6t_random.h 2004-03-30 11:11:26.000000000 +0200
918@@ -0,0 +1,11 @@
919+#ifndef _IP6T_RAND_H
920+#define _IP6T_RAND_H
921+
922+#include <linux/param.h>
923+#include <linux/types.h>
924+
925+struct ip6t_rand_info {
926+ u_int8_t average;
927+};
928+
929+#endif /*_IP6T_RAND_H*/
930diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/core/netfilter.c linux-2.6.5-rc3/net/core/netfilter.c
931--- linux-2.6.5-rc3.org/net/core/netfilter.c 2004-03-30 05:26:13.000000000 +0200
932+++ linux-2.6.5-rc3/net/core/netfilter.c 2004-03-30 11:10:29.000000000 +0200
933@@ -8,8 +8,10 @@
934 *
935 * February 2000: Modified by James Morris to have 1 queue per protocol.
936 * 15-Mar-2000: Added NF_REPEAT --RR.
937+ * 08-May-2003: Internal logging interface added by Jozsef Kadlecsik.
938 */
939 #include <linux/config.h>
940+#include <linux/kernel.h>
941 #include <linux/netfilter.h>
942 #include <net/protocol.h>
943 #include <linux/init.h>
944@@ -741,6 +743,72 @@
945 EXPORT_SYMBOL(skb_ip_make_writable);
946 #endif /*CONFIG_INET*/
947
948+/* Internal logging interface, which relies on the real
949+ LOG target modules */
950+
951+#define NF_LOG_PREFIXLEN 128
952+
953+static nf_logfn *nf_logging[NPROTO]; /* = NULL */
954+static int reported = 0;
955+static spinlock_t nf_log_lock = SPIN_LOCK_UNLOCKED;
956+
957+int nf_log_register(int pf, nf_logfn *logfn)
958+{
959+ int ret = -EBUSY;
960+
961+ /* Any setup of logging members must be done before
962+ * substituting pointer. */
963+ smp_wmb();
964+ spin_lock(&nf_log_lock);
965+ if (!nf_logging[pf]) {
966+ nf_logging[pf] = logfn;
967+ ret = 0;
968+ }
969+ spin_unlock(&nf_log_lock);
970+ return ret;
971+}
972+
973+void nf_log_unregister(int pf, nf_logfn *logfn)
974+{
975+ spin_lock(&nf_log_lock);
976+ if (nf_logging[pf] == logfn)
977+ nf_logging[pf] = NULL;
978+ spin_unlock(&nf_log_lock);
979+
980+ /* Give time to concurrent readers. */
981+ synchronize_net();
982+}
983+
984+void nf_log_packet(int pf,
985+ unsigned int hooknum,
986+ const struct sk_buff *skb,
987+ const struct net_device *in,
988+ const struct net_device *out,
989+ const char *fmt, ...)
990+{
991+ va_list args;
992+ char prefix[NF_LOG_PREFIXLEN];
993+ nf_logfn *logfn;
994+
995+ rcu_read_lock();
996+ logfn = nf_logging[pf];
997+ if (logfn) {
998+ va_start(args, fmt);
999+ vsnprintf(prefix, sizeof(prefix), fmt, args);
1000+ va_end(args);
1001+ /* We must read logging before nf_logfn[pf] */
1002+ smp_read_barrier_depends();
1003+ logfn(hooknum, skb, in, out, prefix);
1004+ } else if (!reported) {
1005+ printk(KERN_WARNING "nf_log_packet: can\'t log yet, "
1006+ "no backend logging module loaded in!\n");
1007+ reported++;
1008+ }
1009+ rcu_read_unlock();
1010+}
1011+EXPORT_SYMBOL(nf_log_register);
1012+EXPORT_SYMBOL(nf_log_unregister);
1013+EXPORT_SYMBOL(nf_log_packet);
1014
1015 /* This does not belong here, but ipt_REJECT needs it if connection
1016 tracking in use: without this, connection may not be in hash table,
1017diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/Kconfig linux-2.6.5-rc3/net/ipv4/netfilter/Kconfig
1018--- linux-2.6.5-rc3.org/net/ipv4/netfilter/Kconfig 2004-03-30 05:27:03.000000000 +0200
1019+++ linux-2.6.5-rc3/net/ipv4/netfilter/Kconfig 2004-03-30 11:11:35.000000000 +0200
1020@@ -579,5 +579,123 @@
1021
1022 To compile it as a module, choose M here. If unsure, say N.
1023
1024+config IP_NF_TARGET_IPV4OPTSSTRIP
1025+ tristate 'IPV4OPTSSTRIP target support'
1026+ depends on IP_NF_MANGLE
1027+ help
1028+
1029+config IP_NF_TARGET_NETLINK
1030+ tristate 'NETLINK target support'
1031+ depends on IP_NF_FILTER
1032+ help
1033+
1034+config IP_NF_TARGET_TTL
1035+ tristate 'TTL target support'
1036+ depends on IP_NF_MANGLE
1037+ help
1038+
1039+config IP_NF_MATCH_CONNLIMIT
1040+ tristate 'Connections/IP limit match support'
1041+ depends on IP_NF_IPTABLES
1042+ help
1043+
1044+config IP_NF_MATCH_DSTLIMIT
1045+ tristate 'dstlimit match support'
1046+ depends on IP_NF_IPTABLES
1047+ help
1048+
1049+config IP_NF_MATCH_FUZZY
1050+ tristate 'fuzzy match support'
1051+ depends on IP_NF_IPTABLES
1052+ help
1053+
1054+config IP_NF_MATCH_IPV4OPTIONS
1055+ tristate 'IPV4OPTIONS match support'
1056+ depends on IP_NF_IPTABLES
1057+ help
1058+
1059+config IP_NF_MATCH_MPORT
1060+ tristate 'Multiple port with ranges match support'
1061+ depends on IP_NF_IPTABLES
1062+ help
1063+
1064+config IP_NF_MATCH_NTH
1065+ tristate 'Nth match support'
1066+ depends on IP_NF_IPTABLES
1067+ help
1068+
1069+config IP_NF_MATCH_OSF
1070+ tristate 'OSF match support'
1071+ depends on IP_NF_IPTABLES
1072+ help
1073+
1074+config IP_POOL_STATISTICS
1075+ bool 'enable statistics on pool usage'
1076+ depends on IP_NF_POOL!=n
1077+
1078+config IP_NF_POOL
1079+ tristate 'IP address pool support'
1080+ depends on IP_NF_IPTABLES
1081+ help
1082+
1083+config IP_NF_MATCH_PSD
1084+ tristate 'psd match support'
1085+ depends on IP_NF_IPTABLES
1086+ help
1087+
1088+config IP_NF_MATCH_QUOTA
1089+ tristate 'quota match support'
1090+ depends on IP_NF_IPTABLES
1091+ help
1092+
1093+config IP_NF_MATCH_RANDOM
1094+ tristate 'random match support'
1095+ depends on IP_NF_IPTABLES
1096+ help
1097+
1098+config IP_NF_TARGET_NOTRACK
1099+ tristate 'NOTRACK target support'
1100+ depends on IP_NF_RAW
1101+ help
1102+ The NOTRACK target allows a select rule to specify
1103+ which packets *not* to enter the conntrack/NAT
1104+ subsystem with all the consequences (no ICMP error tracking,
1105+ no protocol helpers for the selected packets).
1106+
1107+ If you want to compile it as a module, say M here and read
1108+ <file:Documentation/modules.txt>. If unsure, say `N'.
1109+
1110+config IP_NF_RAW
1111+ tristate 'raw table support (required for NOTRACK/TRACE)'
1112+ depends on IP_NF_IPTABLES
1113+ help
1114+ This option adds a `raw' table to iptables. This table is the very
1115+ first in the netfilter framework and hooks in at the PREROUTING
1116+ and OUTPUT chains.
1117+
1118+ If you want to compile it as a module, say M here and read
1119+ <file:Documentation/modules.txt>. If unsure, say `N'.
1120+ help
1121+
1122+config IP_NF_MATCH_REALM
1123+ tristate 'realm match support'
1124+ depends on IP_NF_IPTABLES && NET_CLS_ROUTE
1125+ help
1126+
1127+config IP_NF_MATCH_SCTP
1128+ tristate 'SCTP protocol match support'
1129+ depends on IP_NF_IPTABLES
1130+ help
1131+
1132+config IP_NF_MATCH_TIME
1133+ tristate 'TIME match support'
1134+ depends on IP_NF_IPTABLES
1135+ help
1136+
1137+config IP_NF_MATCH_U32
1138+ tristate 'U32 match support'
1139+ depends on IP_NF_IPTABLES
1140+ help
1141+
1142 endmenu
1143
1144diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/Makefile linux-2.6.5-rc3/net/ipv4/netfilter/Makefile
1145--- linux-2.6.5-rc3.org/net/ipv4/netfilter/Makefile 2004-03-30 05:25:35.000000000 +0200
1146+++ linux-2.6.5-rc3/net/ipv4/netfilter/Makefile 2004-03-30 11:11:35.000000000 +0200
1147@@ -38,19 +38,44 @@
1148 obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
1149 obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
1150 obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
1151+obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
1152
1153 # matches
1154 obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
1155 obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
1156+obj-$(CONFIG_IP_NF_MATCH_SCTP) += ipt_sctp.o
1157+obj-$(CONFIG_IP_NF_MATCH_QUOTA) += ipt_quota.o
1158+obj-$(CONFIG_IP_NF_MATCH_DSTLIMIT) += ipt_dstlimit.o
1159 obj-$(CONFIG_IP_NF_MATCH_MARK) += ipt_mark.o
1160+obj-$(CONFIG_IP_NF_POOL) += ipt_pool.o ipt_POOL.o ip_pool.o
1161 obj-$(CONFIG_IP_NF_MATCH_MAC) += ipt_mac.o
1162 obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
1163
1164 obj-$(CONFIG_IP_NF_MATCH_PKTTYPE) += ipt_pkttype.o
1165 obj-$(CONFIG_IP_NF_MATCH_MULTIPORT) += ipt_multiport.o
1166+
1167+obj-$(CONFIG_IP_NF_MATCH_MPORT) += ipt_mport.o
1168+
1169 obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
1170 obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
1171
1172+obj-$(CONFIG_IP_NF_MATCH_TIME) += ipt_time.o
1173+
1174+
1175+obj-$(CONFIG_IP_NF_MATCH_RANDOM) += ipt_random.o
1176+
1177+obj-$(CONFIG_IP_NF_MATCH_PSD) += ipt_psd.o
1178+
1179+obj-$(CONFIG_IP_NF_MATCH_OSF) += ipt_osf.o
1180+
1181+
1182+obj-$(CONFIG_IP_NF_MATCH_NTH) += ipt_nth.o
1183+
1184+obj-$(CONFIG_IP_NF_MATCH_IPV4OPTIONS) += ipt_ipv4options.o
1185+
1186+
1187+obj-$(CONFIG_IP_NF_MATCH_FUZZY) += ipt_fuzzy.o
1188+
1189 obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
1190
1191 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
1192@@ -59,10 +84,15 @@
1193
1194 obj-$(CONFIG_IP_NF_MATCH_LENGTH) += ipt_length.o
1195
1196+obj-$(CONFIG_IP_NF_MATCH_U32) += ipt_u32.o
1197+
1198+
1199 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
1200 obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
1201+obj-$(CONFIG_IP_NF_MATCH_CONNLIMIT) += ipt_connlimit.o
1202 obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
1203 obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
1204+obj-$(CONFIG_IP_NF_MATCH_REALM) += ipt_realm.o
1205
1206 obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o
1207
1208@@ -79,8 +109,12 @@
1209 obj-$(CONFIG_IP_NF_TARGET_CLASSIFY) += ipt_CLASSIFY.o
1210 obj-$(CONFIG_IP_NF_NAT_SNMP_BASIC) += ip_nat_snmp_basic.o
1211 obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
1212+obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
1213+obj-$(CONFIG_IP_NF_TARGET_NETLINK) += ipt_NETLINK.o
1214+obj-$(CONFIG_IP_NF_TARGET_IPV4OPTSSTRIP) += ipt_IPV4OPTSSTRIP.o
1215 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
1216 obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
1217+obj-$(CONFIG_IP_NF_TARGET_NOTRACK) += ipt_NOTRACK.o
1218
1219 # generic ARP tables
1220 obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
1221diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_conntrack_core.c linux-2.6.5-rc3/net/ipv4/netfilter/ip_conntrack_core.c
1222--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_conntrack_core.c 2004-03-30 05:25:30.000000000 +0200
1223+++ linux-2.6.5-rc3/net/ipv4/netfilter/ip_conntrack_core.c 2004-03-30 11:11:27.000000000 +0200
1224@@ -67,6 +67,7 @@
1225 static atomic_t ip_conntrack_count = ATOMIC_INIT(0);
1226 struct list_head *ip_conntrack_hash;
1227 static kmem_cache_t *ip_conntrack_cachep;
1228+struct ip_conntrack ip_conntrack_untracked;
1229
1230 extern struct ip_conntrack_protocol ip_conntrack_generic_protocol;
1231
1232@@ -691,42 +692,50 @@
1233 struct ip_conntrack_expect *, tuple);
1234 READ_UNLOCK(&ip_conntrack_expect_tuple_lock);
1235
1236- /* If master is not in hash table yet (ie. packet hasn't left
1237- this machine yet), how can other end know about expected?
1238- Hence these are not the droids you are looking for (if
1239- master ct never got confirmed, we'd hold a reference to it
1240- and weird things would happen to future packets). */
1241- if (expected && !is_confirmed(expected->expectant))
1242- expected = NULL;
1243-
1244- /* Look up the conntrack helper for master connections only */
1245- if (!expected)
1246- conntrack->helper = ip_ct_find_helper(&repl_tuple);
1247-
1248- /* If the expectation is dying, then this is a loser. */
1249- if (expected
1250- && expected->expectant->helper->timeout
1251- && ! del_timer(&expected->timeout))
1252- expected = NULL;
1253-
1254 if (expected) {
1255- DEBUGP("conntrack: expectation arrives ct=%p exp=%p\n",
1256- conntrack, expected);
1257- /* Welcome, Mr. Bond. We've been expecting you... */
1258- IP_NF_ASSERT(master_ct(conntrack));
1259- __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
1260- conntrack->master = expected;
1261- expected->sibling = conntrack;
1262- LIST_DELETE(&ip_conntrack_expect_list, expected);
1263- expected->expectant->expecting--;
1264- nf_conntrack_get(&master_ct(conntrack)->infos[0]);
1265- }
1266- atomic_inc(&ip_conntrack_count);
1267+ /* If master is not in hash table yet (ie. packet hasn't left
1268+ this machine yet), how can other end know about expected?
1269+ Hence these are not the droids you are looking for (if
1270+ master ct never got confirmed, we'd hold a reference to it
1271+ and weird things would happen to future packets). */
1272+ if (!is_confirmed(expected->expectant)) {
1273+
1274+ conntrack->helper = ip_ct_find_helper(&repl_tuple);
1275+ goto end;
1276+ }
1277+
1278+ /* Expectation is dying... */
1279+ if (expected->expectant->helper->timeout
1280+ && ! del_timer(&expected->timeout)) {
1281+ goto end;
1282+ }
1283+
1284+ DEBUGP("conntrack: expectation arrives ct=%p exp=%p\n",
1285+ conntrack, expected);
1286+ /* Welcome, Mr. Bond. We've been expecting you... */
1287+ IP_NF_ASSERT(master_ct(conntrack));
1288+ __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
1289+ conntrack->master = expected;
1290+ expected->sibling = conntrack;
1291+ LIST_DELETE(&ip_conntrack_expect_list, expected);
1292+ expected->expectant->expecting--;
1293+ nf_conntrack_get(&master_ct(conntrack)->infos[0]);
1294+
1295+ /* this is a braindead... --pablo */
1296+ atomic_inc(&ip_conntrack_count);
1297+ WRITE_UNLOCK(&ip_conntrack_lock);
1298+
1299+ if (expected->expectfn)
1300+ expected->expectfn(conntrack);
1301+
1302+ goto ret;
1303+ } else
1304+ conntrack->helper = ip_ct_find_helper(&repl_tuple);
1305+
1306+end: atomic_inc(&ip_conntrack_count);
1307 WRITE_UNLOCK(&ip_conntrack_lock);
1308
1309- if (expected && expected->expectfn)
1310- expected->expectfn(conntrack);
1311- return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
1312+ret: return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
1313 }
1314
1315 /* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
1316@@ -794,6 +803,15 @@
1317 int set_reply;
1318 int ret;
1319
1320+ /* Never happen */
1321+ if ((*pskb)->nh.iph->frag_off & htons(IP_OFFSET)) {
1322+ if (net_ratelimit()) {
1323+ printk(KERN_ERR "ip_conntrack_in: Frag of proto %u (hook=%u)\n",
1324+ (*pskb)->nh.iph->protocol, hooknum);
1325+ }
1326+ return NF_DROP;
1327+ }
1328+
1329 /* FIXME: Do this right please. --RR */
1330 (*pskb)->nfcache |= NFC_UNKNOWN;
1331
1332@@ -812,18 +830,10 @@
1333 }
1334 #endif
1335
1336- /* Previously seen (loopback)? Ignore. Do this before
1337- fragment check. */
1338+ /* Previously seen (loopback or untracked)? Ignore. */
1339 if ((*pskb)->nfct)
1340 return NF_ACCEPT;
1341
1342- /* Gather fragments. */
1343- if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
1344- *pskb = ip_ct_gather_frags(*pskb);
1345- if (!*pskb)
1346- return NF_STOLEN;
1347- }
1348-
1349 proto = ip_ct_find_proto((*pskb)->nh.iph->protocol);
1350
1351 /* It may be an icmp error... */
1352@@ -1422,6 +1432,18 @@
1353
1354 /* For use by ipt_REJECT */
1355 ip_ct_attach = ip_conntrack_attach;
1356+
1357+ /* Set up fake conntrack:
1358+ - to never be deleted, not in any hashes */
1359+ atomic_set(&ip_conntrack_untracked.ct_general.use, 1);
1360+ /* - and look it like as a confirmed connection */
1361+ set_bit(IPS_CONFIRMED_BIT, &ip_conntrack_untracked.status);
1362+ /* - and prepare the ctinfo field for REJECT & NAT. */
1363+ ip_conntrack_untracked.infos[IP_CT_NEW].master =
1364+ ip_conntrack_untracked.infos[IP_CT_RELATED].master =
1365+ ip_conntrack_untracked.infos[IP_CT_RELATED + IP_CT_IS_REPLY].master =
1366+ &ip_conntrack_untracked.ct_general;
1367+
1368 return ret;
1369
1370 err_free_hash:
1371diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.6.5-rc3/net/ipv4/netfilter/ip_conntrack_standalone.c
1372--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-03-30 05:26:11.000000000 +0200
1373+++ linux-2.6.5-rc3/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-03-30 11:11:27.000000000 +0200
1374@@ -194,6 +194,26 @@
1375 return ip_conntrack_confirm(*pskb);
1376 }
1377
1378+static unsigned int ip_conntrack_defrag(unsigned int hooknum,
1379+ struct sk_buff **pskb,
1380+ const struct net_device *in,
1381+ const struct net_device *out,
1382+ int (*okfn)(struct sk_buff *))
1383+{
1384+ /* Previously seen (loopback)? Ignore. Do this before
1385+ fragment check. */
1386+ if ((*pskb)->nfct)
1387+ return NF_ACCEPT;
1388+
1389+ /* Gather fragments. */
1390+ if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
1391+ *pskb = ip_ct_gather_frags(*pskb);
1392+ if (!*pskb)
1393+ return NF_STOLEN;
1394+ }
1395+ return NF_ACCEPT;
1396+}
1397+
1398 static unsigned int ip_refrag(unsigned int hooknum,
1399 struct sk_buff **pskb,
1400 const struct net_device *in,
1401@@ -236,6 +256,14 @@
1402
1403 /* Connection tracking may drop packets, but never alters them, so
1404 make it the first hook. */
1405+static struct nf_hook_ops ip_conntrack_defrag_ops = {
1406+ .hook = ip_conntrack_defrag,
1407+ .owner = THIS_MODULE,
1408+ .pf = PF_INET,
1409+ .hooknum = NF_IP_PRE_ROUTING,
1410+ .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
1411+};
1412+
1413 static struct nf_hook_ops ip_conntrack_in_ops = {
1414 .hook = ip_conntrack_in,
1415 .owner = THIS_MODULE,
1416@@ -244,6 +272,14 @@
1417 .priority = NF_IP_PRI_CONNTRACK,
1418 };
1419
1420+static struct nf_hook_ops ip_conntrack_defrag_local_out_ops = {
1421+ .hook = ip_conntrack_defrag,
1422+ .owner = THIS_MODULE,
1423+ .pf = PF_INET,
1424+ .hooknum = NF_IP_LOCAL_OUT,
1425+ .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
1426+};
1427+
1428 static struct nf_hook_ops ip_conntrack_local_out_ops = {
1429 .hook = ip_conntrack_local,
1430 .owner = THIS_MODULE,
1431@@ -470,10 +506,20 @@
1432 if (!proc) goto cleanup_init;
1433 proc->owner = THIS_MODULE;
1434
1435+ ret = nf_register_hook(&ip_conntrack_defrag_ops);
1436+ if (ret < 0) {
1437+ printk("ip_conntrack: can't register pre-routing defrag hook.\n");
1438+ goto cleanup_proc;
1439+ }
1440+ ret = nf_register_hook(&ip_conntrack_defrag_local_out_ops);
1441+ if (ret < 0) {
1442+ printk("ip_conntrack: can't register local_out defrag hook.\n");
1443+ goto cleanup_defragops;
1444+ }
1445 ret = nf_register_hook(&ip_conntrack_in_ops);
1446 if (ret < 0) {
1447 printk("ip_conntrack: can't register pre-routing hook.\n");
1448- goto cleanup_proc;
1449+ goto cleanup_defraglocalops;
1450 }
1451 ret = nf_register_hook(&ip_conntrack_local_out_ops);
1452 if (ret < 0) {
1453@@ -511,6 +557,10 @@
1454 nf_unregister_hook(&ip_conntrack_local_out_ops);
1455 cleanup_inops:
1456 nf_unregister_hook(&ip_conntrack_in_ops);
1457+ cleanup_defraglocalops:
1458+ nf_unregister_hook(&ip_conntrack_defrag_local_out_ops);
1459+ cleanup_defragops:
1460+ nf_unregister_hook(&ip_conntrack_defrag_ops);
1461 cleanup_proc:
1462 proc_net_remove("ip_conntrack");
1463 cleanup_init:
1464@@ -602,5 +652,6 @@
1465 EXPORT_SYMBOL(ip_conntrack_expect_list);
1466 EXPORT_SYMBOL(ip_conntrack_lock);
1467 EXPORT_SYMBOL(ip_conntrack_hash);
1468+EXPORT_SYMBOL(ip_conntrack_untracked);
1469 EXPORT_SYMBOL_GPL(ip_conntrack_find_get);
1470 EXPORT_SYMBOL_GPL(ip_conntrack_put);
1471diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_nat_core.c linux-2.6.5-rc3/net/ipv4/netfilter/ip_nat_core.c
1472--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_nat_core.c 2004-03-30 05:25:33.000000000 +0200
1473+++ linux-2.6.5-rc3/net/ipv4/netfilter/ip_nat_core.c 2004-03-30 11:11:27.000000000 +0200
1474@@ -1016,6 +1016,10 @@
1475 /* FIXME: Man, this is a hack. <SIGH> */
1476 IP_NF_ASSERT(ip_conntrack_destroyed == NULL);
1477 ip_conntrack_destroyed = &ip_nat_cleanup_conntrack;
1478+
1479+ /* Initialize fake conntrack so that NAT will skip it */
1480+ ip_conntrack_untracked.nat.info.initialized |=
1481+ (1 << IP_NAT_MANIP_SRC) | (1 << IP_NAT_MANIP_DST);
1482
1483 return 0;
1484 }
1485diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_pool.c linux-2.6.5-rc3/net/ipv4/netfilter/ip_pool.c
1486--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_pool.c 1970-01-01 01:00:00.000000000 +0100
1487+++ linux-2.6.5-rc3/net/ipv4/netfilter/ip_pool.c 2004-03-30 11:11:17.000000000 +0200
1488@@ -0,0 +1,332 @@
1489+/* Kernel module for IP pool management */
1490+
1491+#include <linux/module.h>
1492+#include <linux/ip.h>
1493+#include <linux/skbuff.h>
1494+#include <linux/netfilter_ipv4/ip_tables.h>
1495+#include <linux/netfilter_ipv4/ip_pool.h>
1496+#include <linux/errno.h>
1497+#include <asm/uaccess.h>
1498+#include <asm/bitops.h>
1499+#include <linux/interrupt.h>
1500+#include <linux/spinlock.h>
1501+
1502+#if 0
1503+#define DP printk
1504+#else
1505+#define DP(format, args...)
1506+#endif
1507+
1508+MODULE_LICENSE("GPL");
1509+
1510+#define NR_POOL 16
1511+static int nr_pool = NR_POOL;/* overwrite this when loading module */
1512+
1513+struct ip_pool {
1514+ u_int32_t first_ip; /* host byte order, included in range */
1515+ u_int32_t last_ip; /* host byte order, included in range */
1516+ void *members; /* the bitmap proper */
1517+ int nr_use; /* total nr. of tests through this */
1518+ int nr_match; /* total nr. of matches through this */
1519+ rwlock_t lock;
1520+};
1521+
1522+static struct ip_pool *POOL;
1523+
1524+static inline struct ip_pool *lookup(ip_pool_t index)
1525+{
1526+ if (index < 0 || index >= nr_pool) {
1527+ DP("ip_pool:lookup: bad index %d\n", index);
1528+ return 0;
1529+ }
1530+ return POOL+index;
1531+}
1532+
1533+int ip_pool_match(ip_pool_t index, u_int32_t addr)
1534+{
1535+ struct ip_pool *pool = lookup(index);
1536+ int res = 0;
1537+
1538+ if (!pool || !pool->members)
1539+ return 0;
1540+ read_lock_bh(&pool->lock);
1541+ if (pool->members) {
1542+ if (addr >= pool->first_ip && addr <= pool->last_ip) {
1543+ addr -= pool->first_ip;
1544+ if (test_bit(addr, pool->members)) {
1545+ res = 1;
1546+#ifdef CONFIG_IP_POOL_STATISTICS
1547+ pool->nr_match++;
1548+#endif
1549+ }
1550+ }
1551+#ifdef CONFIG_IP_POOL_STATISTICS
1552+ pool->nr_use++;
1553+#endif
1554+ }
1555+ read_unlock_bh(&pool->lock);
1556+ return res;
1557+}
1558+
1559+static int pool_change(ip_pool_t index, u_int32_t addr, int isdel)
1560+{
1561+ struct ip_pool *pool;
1562+ int res = -1;
1563+
1564+ pool = lookup(index);
1565+ if ( !pool || !pool->members
1566+ || addr < pool->first_ip || addr > pool->last_ip)
1567+ return -1;
1568+ read_lock_bh(&pool->lock);
1569+ if (pool->members && addr >= pool->first_ip && addr <= pool->last_ip) {
1570+ addr -= pool->first_ip;
1571+ res = isdel
1572+ ? (0 != test_and_clear_bit(addr, pool->members))
1573+ : (0 != test_and_set_bit(addr, pool->members));
1574+ }
1575+ read_unlock_bh(&pool->lock);
1576+ return res;
1577+}
1578+
1579+int ip_pool_mod(ip_pool_t index, u_int32_t addr, int isdel)
1580+{
1581+ int res = pool_change(index,addr,isdel);
1582+
1583+ if (!isdel) res = !res;
1584+ return res;
1585+}
1586+
1587+static inline int bitmap_bytes(u_int32_t a, u_int32_t b)
1588+{
1589+ return 4*((((b-a+8)/8)+3)/4);
1590+}
1591+
1592+static inline int poolbytes(ip_pool_t index)
1593+{
1594+ struct ip_pool *pool = lookup(index);
1595+
1596+ return pool ? bitmap_bytes(pool->first_ip, pool->last_ip) : 0;
1597+}
1598+
1599+static int setpool(
1600+ struct sock *sk,
1601+ int optval,
1602+ void *user,
1603+ unsigned int len
1604+) {
1605+ struct ip_pool_request req;
1606+
1607+ DP("ip_pool:setpool: optval=%d, user=%p, len=%d\n", optval, user, len);
1608+ if (!capable(CAP_NET_ADMIN))
1609+ return -EPERM;
1610+ if (optval != SO_IP_POOL)
1611+ return -EBADF;
1612+ if (len != sizeof(req))
1613+ return -EINVAL;
1614+ if (copy_from_user(&req, user, sizeof(req)) != 0)
1615+ return -EFAULT;
1616+ printk("obsolete op - upgrade your ippool(8) utility.\n");
1617+ return -EINVAL;
1618+}
1619+
1620+static int getpool(
1621+ struct sock *sk,
1622+ int optval,
1623+ void *user,
1624+ int *len
1625+) {
1626+ struct ip_pool_request req;
1627+ struct ip_pool *pool;
1628+ ip_pool_t i;
1629+ int newbytes;
1630+ void *newmembers;
1631+ int res;
1632+
1633+ DP("ip_pool:getpool: optval=%d, user=%p\n", optval, user);
1634+ if (!capable(CAP_NET_ADMIN))
1635+ return -EINVAL;
1636+ if (optval != SO_IP_POOL)
1637+ return -EINVAL;
1638+ if (*len != sizeof(req)) {
1639+ return -EFAULT;
1640+ }
1641+ if (copy_from_user(&req, user, sizeof(req)) != 0)
1642+ return -EFAULT;
1643+ DP("ip_pool:getpool op=%d, index=%d\n", req.op, req.index);
1644+ if (req.op < IP_POOL_BAD001) {
1645+ printk("obsolete op - upgrade your ippool(8) utility.\n");
1646+ return -EFAULT;
1647+ }
1648+ switch(req.op) {
1649+ case IP_POOL_HIGH_NR:
1650+ DP("ip_pool HIGH_NR\n");
1651+ req.index = IP_POOL_NONE;
1652+ for (i=0; i<nr_pool; i++)
1653+ if (POOL[i].members)
1654+ req.index = i;
1655+ return copy_to_user(user, &req, sizeof(req));
1656+ case IP_POOL_LOOKUP:
1657+ DP("ip_pool LOOKUP\n");
1658+ pool = lookup(req.index);
1659+ if (!pool)
1660+ return -EINVAL;
1661+ if (!pool->members)
1662+ return -EBADF;
1663+ req.addr = htonl(pool->first_ip);
1664+ req.addr2 = htonl(pool->last_ip);
1665+ return copy_to_user(user, &req, sizeof(req));
1666+ case IP_POOL_USAGE:
1667+ DP("ip_pool USE\n");
1668+ pool = lookup(req.index);
1669+ if (!pool)
1670+ return -EINVAL;
1671+ if (!pool->members)
1672+ return -EBADF;
1673+ req.addr = pool->nr_use;
1674+ req.addr2 = pool->nr_match;
1675+ return copy_to_user(user, &req, sizeof(req));
1676+ case IP_POOL_TEST_ADDR:
1677+ DP("ip_pool TEST 0x%08x\n", req.addr);
1678+ pool = lookup(req.index);
1679+ if (!pool)
1680+ return -EINVAL;
1681+ res = 0;
1682+ read_lock_bh(&pool->lock);
1683+ if (!pool->members) {
1684+ DP("ip_pool TEST_ADDR no members in pool\n");
1685+ res = -EBADF;
1686+ goto unlock_and_return_res;
1687+ }
1688+ req.addr = ntohl(req.addr);
1689+ if (req.addr < pool->first_ip) {
1690+ DP("ip_pool TEST_ADDR address < pool bounds\n");
1691+ res = -ERANGE;
1692+ goto unlock_and_return_res;
1693+ }
1694+ if (req.addr > pool->last_ip) {
1695+ DP("ip_pool TEST_ADDR address > pool bounds\n");
1696+ res = -ERANGE;
1697+ goto unlock_and_return_res;
1698+ }
1699+ req.addr = (0 != test_bit((req.addr - pool->first_ip),
1700+ pool->members));
1701+ read_unlock_bh(&pool->lock);
1702+ return copy_to_user(user, &req, sizeof(req));
1703+ case IP_POOL_FLUSH:
1704+ DP("ip_pool FLUSH not yet implemented.\n");
1705+ return -EBUSY;
1706+ case IP_POOL_DESTROY:
1707+ DP("ip_pool DESTROY not yet implemented.\n");
1708+ return -EBUSY;
1709+ case IP_POOL_INIT:
1710+ DP("ip_pool INIT 0x%08x-0x%08x\n", req.addr, req.addr2);
1711+ pool = lookup(req.index);
1712+ if (!pool)
1713+ return -EINVAL;
1714+ req.addr = ntohl(req.addr);
1715+ req.addr2 = ntohl(req.addr2);
1716+ if (req.addr > req.addr2) {
1717+ DP("ip_pool INIT bad ip range\n");
1718+ return -EINVAL;
1719+ }
1720+ newbytes = bitmap_bytes(req.addr, req.addr2);
1721+ newmembers = kmalloc(newbytes, GFP_KERNEL);
1722+ if (!newmembers) {
1723+ DP("ip_pool INIT out of mem for %d bytes\n", newbytes);
1724+ return -ENOMEM;
1725+ }
1726+ memset(newmembers, 0, newbytes);
1727+ write_lock_bh(&pool->lock);
1728+ if (pool->members) {
1729+ DP("ip_pool INIT pool %d exists\n", req.index);
1730+ kfree(newmembers);
1731+ res = -EBUSY;
1732+ goto unlock_and_return_res;
1733+ }
1734+ pool->first_ip = req.addr;
1735+ pool->last_ip = req.addr2;
1736+ pool->nr_use = 0;
1737+ pool->nr_match = 0;
1738+ pool->members = newmembers;
1739+ write_unlock_bh(&pool->lock);
1740+ return 0;
1741+ case IP_POOL_ADD_ADDR:
1742+ DP("ip_pool ADD_ADDR 0x%08x\n", req.addr);
1743+ req.addr = pool_change(req.index, ntohl(req.addr), 0);
1744+ return copy_to_user(user, &req, sizeof(req));
1745+ case IP_POOL_DEL_ADDR:
1746+ DP("ip_pool DEL_ADDR 0x%08x\n", req.addr);
1747+ req.addr = pool_change(req.index, ntohl(req.addr), 1);
1748+ return copy_to_user(user, &req, sizeof(req));
1749+ default:
1750+ DP("ip_pool:getpool bad op %d\n", req.op);
1751+ return -EINVAL;
1752+ }
1753+ return -EINVAL;
1754+
1755+unlock_and_return_res:
1756+ if (pool)
1757+ read_unlock_bh(&pool->lock);
1758+ return res;
1759+}
1760+
1761+static struct nf_sockopt_ops so_pool
1762+= { { NULL, NULL }, PF_INET,
1763+ SO_IP_POOL, SO_IP_POOL+1, &setpool,
1764+ SO_IP_POOL, SO_IP_POOL+1, &getpool,
1765+ 0, NULL };
1766+
1767+MODULE_PARM(nr_pool, "i");
1768+
1769+static int __init init(void)
1770+{
1771+ ip_pool_t i;
1772+ int res;
1773+
1774+ if (nr_pool < 1) {
1775+ printk("ip_pool module init: bad nr_pool %d\n", nr_pool);
1776+ return -EINVAL;
1777+ }
1778+ POOL = kmalloc(nr_pool * sizeof(*POOL), GFP_KERNEL);
1779+ if (!POOL) {
1780+ printk("ip_pool module init: out of memory for nr_pool %d\n",
1781+ nr_pool);
1782+ return -ENOMEM;
1783+ }
1784+ for (i=0; i<nr_pool; i++) {
1785+ POOL[i].first_ip = 0;
1786+ POOL[i].last_ip = 0;
1787+ POOL[i].members = 0;
1788+ POOL[i].nr_use = 0;
1789+ POOL[i].nr_match = 0;
1790+ POOL[i].lock = RW_LOCK_UNLOCKED;
1791+ }
1792+ res = nf_register_sockopt(&so_pool);
1793+ DP("ip_pool:init %d pools, result %d\n", nr_pool, res);
1794+ if (res != 0) {
1795+ kfree(POOL);
1796+ POOL = 0;
1797+ }
1798+ return res;
1799+}
1800+
1801+static void __exit fini(void)
1802+{
1803+ ip_pool_t i;
1804+
1805+ DP("ip_pool:fini BYEBYE\n");
1806+ nf_unregister_sockopt(&so_pool);
1807+ for (i=0; i<nr_pool; i++) {
1808+ if (POOL[i].members) {
1809+ kfree(POOL[i].members);
1810+ POOL[i].members = 0;
1811+ }
1812+ }
1813+ kfree(POOL);
1814+ POOL = 0;
1815+ DP("ip_pool:fini these are the famous last words\n");
1816+ return;
1817+}
1818+
1819+module_init(init);
1820+module_exit(fini);
1821diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_tables.c linux-2.6.5-rc3/net/ipv4/netfilter/ip_tables.c
1822--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ip_tables.c 2004-03-30 05:25:36.000000000 +0200
1823+++ linux-2.6.5-rc3/net/ipv4/netfilter/ip_tables.c 2004-03-30 11:10:33.000000000 +0200
1824@@ -1716,9 +1716,9 @@
1825 };
1826
1827 #ifdef CONFIG_PROC_FS
1828-static inline int print_name(const char *i,
1829- off_t start_offset, char *buffer, int length,
1830- off_t *pos, unsigned int *count)
1831+static int print_name(const char *i,
1832+ off_t start_offset, char *buffer, int length,
1833+ off_t *pos, unsigned int *count)
1834 {
1835 if ((*count)++ >= start_offset) {
1836 unsigned int namelen;
1837@@ -1752,6 +1752,15 @@
1838 return pos;
1839 }
1840
1841+static inline int print_target(const struct ipt_target *t,
1842+ off_t start_offset, char *buffer, int length,
1843+ off_t *pos, unsigned int *count)
1844+{
1845+ if (t != &ipt_standard_target && t != &ipt_error_target)
1846+ return 0;
1847+ return print_name((char *)t, start_offset, buffer, length, pos, count);
1848+}
1849+
1850 static int ipt_get_targets(char *buffer, char **start, off_t offset, int length)
1851 {
1852 off_t pos = 0;
1853@@ -1760,7 +1769,7 @@
1854 if (down_interruptible(&ipt_mutex) != 0)
1855 return 0;
1856
1857- LIST_FIND(&ipt_target, print_name, void *,
1858+ LIST_FIND(&ipt_target, print_target, struct ipt_target *,
1859 offset, buffer, length, &pos, &count);
1860
1861 up(&ipt_mutex);
1862diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c
1863--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c 1970-01-01 01:00:00.000000000 +0100
1864+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c 2004-03-30 11:10:37.000000000 +0200
1865@@ -0,0 +1,89 @@
1866+/**
1867+ * Strip all IP options in the IP packet header.
1868+ *
1869+ * (C) 2001 by Fabrice MARIE <fabrice@netfilter.org>
1870+ * This software is distributed under GNU GPL v2, 1991
1871+ */
1872+
1873+#include <linux/module.h>
1874+#include <linux/skbuff.h>
1875+#include <linux/ip.h>
1876+#include <net/checksum.h>
1877+
1878+#include <linux/netfilter_ipv4/ip_tables.h>
1879+
1880+MODULE_AUTHOR("Fabrice MARIE <fabrice@netfilter.org>");
1881+MODULE_DESCRIPTION("Strip all options in IPv4 packets");
1882+MODULE_LICENSE("GPL");
1883+
1884+static unsigned int
1885+target(struct sk_buff **pskb,
1886+ const struct net_device *in,
1887+ const struct net_device *out,
1888+ unsigned int hooknum,
1889+ const void *targinfo,
1890+ void *userinfo)
1891+{
1892+ struct iphdr *iph;
1893+ struct sk_buff *skb;
1894+ struct ip_options *opt;
1895+ unsigned char *optiph;
1896+ int l;
1897+
1898+ if (!skb_ip_make_writable(pskb, (*pskb)->len))
1899+ return NF_DROP;
1900+
1901+ skb = (*pskb);
1902+ iph = (*pskb)->nh.iph;
1903+ optiph = skb->nh.raw;
1904+ l = ((struct ip_options *)(&(IPCB(skb)->opt)))->optlen;
1905+
1906+ /* if no options in packet then nothing to clear. */
1907+ if (iph->ihl * 4 == sizeof(struct iphdr))
1908+ return IPT_CONTINUE;
1909+
1910+ /* else clear all options */
1911+ memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
1912+ memset(optiph+sizeof(struct iphdr), IPOPT_NOOP, l);
1913+ opt = &(IPCB(skb)->opt);
1914+ opt->is_data = 0;
1915+ opt->optlen = l;
1916+
1917+ skb->nfcache |= NFC_ALTERED;
1918+
1919+ return IPT_CONTINUE;
1920+}
1921+
1922+static int
1923+checkentry(const char *tablename,
1924+ const struct ipt_entry *e,
1925+ void *targinfo,
1926+ unsigned int targinfosize,
1927+ unsigned int hook_mask)
1928+{
1929+ if (strcmp(tablename, "mangle")) {
1930+ printk(KERN_WARNING "IPV4OPTSSTRIP: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
1931+ return 0;
1932+ }
1933+ /* nothing else to check because no parameters */
1934+ return 1;
1935+}
1936+
1937+static struct ipt_target ipt_ipv4optsstrip_reg = {
1938+ .name = "IPV4OPTSSTRIP",
1939+ .target = target,
1940+ .checkentry = checkentry,
1941+ .me = THIS_MODULE };
1942+
1943+static int __init init(void)
1944+{
1945+ return ipt_register_target(&ipt_ipv4optsstrip_reg);
1946+}
1947+
1948+static void __exit fini(void)
1949+{
1950+ ipt_unregister_target(&ipt_ipv4optsstrip_reg);
1951+}
1952+
1953+module_init(init);
1954+module_exit(fini);
1955diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_LOG.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_LOG.c
1956--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_LOG.c 2004-03-30 05:27:07.000000000 +0200
1957+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_LOG.c 2004-03-30 11:10:29.000000000 +0200
1958@@ -19,6 +19,7 @@
1959 #include <net/tcp.h>
1960 #include <net/route.h>
1961
1962+#include <linux/netfilter.h>
1963 #include <linux/netfilter_ipv4/ip_tables.h>
1964 #include <linux/netfilter_ipv4/ipt_LOG.h>
1965
1966@@ -26,6 +27,10 @@
1967 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1968 MODULE_DESCRIPTION("iptables syslog logging module");
1969
1970+static unsigned int nflog = 1;
1971+MODULE_PARM(nflog, "i");
1972+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
1973+
1974 #if 0
1975 #define DEBUGP printk
1976 #else
1977@@ -324,28 +329,25 @@
1978 /* maxlen = 230+ 91 + 230 + 252 = 803 */
1979 }
1980
1981-static unsigned int
1982-ipt_log_target(struct sk_buff **pskb,
1983+static void
1984+ipt_log_packet(unsigned int hooknum,
1985+ const struct sk_buff *skb,
1986 const struct net_device *in,
1987 const struct net_device *out,
1988- unsigned int hooknum,
1989- const void *targinfo,
1990- void *userinfo)
1991+ const struct ipt_log_info *loginfo,
1992+ const char *level_string,
1993+ const char *prefix)
1994 {
1995- const struct ipt_log_info *loginfo = targinfo;
1996- char level_string[4] = "< >";
1997-
1998- level_string[1] = '0' + (loginfo->level % 8);
1999 spin_lock_bh(&log_lock);
2000 printk(level_string);
2001 printk("%sIN=%s OUT=%s ",
2002- loginfo->prefix,
2003+ prefix == NULL ? loginfo->prefix : prefix,
2004 in ? in->name : "",
2005 out ? out->name : "");
2006 #ifdef CONFIG_BRIDGE_NETFILTER
2007- if ((*pskb)->nf_bridge) {
2008- struct net_device *physindev = (*pskb)->nf_bridge->physindev;
2009- struct net_device *physoutdev = (*pskb)->nf_bridge->physoutdev;
2010+ if (skb->nf_bridge) {
2011+ struct net_device *physindev = skb->nf_bridge->physindev;
2012+ struct net_device *physoutdev = skb->nf_bridge->physoutdev;
2013
2014 if (physindev && in != physindev)
2015 printk("PHYSIN=%s ", physindev->name);
2016@@ -357,25 +359,56 @@
2017 if (in && !out) {
2018 /* MAC logging for input chain only. */
2019 printk("MAC=");
2020- if ((*pskb)->dev && (*pskb)->dev->hard_header_len
2021- && (*pskb)->mac.raw != (void*)(*pskb)->nh.iph) {
2022+ if (skb->dev && skb->dev->hard_header_len
2023+ && skb->mac.raw != (void*)skb->nh.iph) {
2024 int i;
2025- unsigned char *p = (*pskb)->mac.raw;
2026- for (i = 0; i < (*pskb)->dev->hard_header_len; i++,p++)
2027+ unsigned char *p = skb->mac.raw;
2028+ for (i = 0; i < skb->dev->hard_header_len; i++,p++)
2029 printk("%02x%c", *p,
2030- i==(*pskb)->dev->hard_header_len - 1
2031+ i==skb->dev->hard_header_len - 1
2032 ? ' ':':');
2033 } else
2034 printk(" ");
2035 }
2036
2037- dump_packet(loginfo, *pskb, 0);
2038+ dump_packet(loginfo, skb, 0);
2039 printk("\n");
2040 spin_unlock_bh(&log_lock);
2041+}
2042+
2043+static unsigned int
2044+ipt_log_target(struct sk_buff **pskb,
2045+ const struct net_device *in,
2046+ const struct net_device *out,
2047+ unsigned int hooknum,
2048+ const void *targinfo,
2049+ void *userinfo)
2050+{
2051+ const struct ipt_log_info *loginfo = targinfo;
2052+ char level_string[4] = "< >";
2053+
2054+ level_string[1] = '0' + (loginfo->level % 8);
2055+ ipt_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
2056
2057 return IPT_CONTINUE;
2058 }
2059
2060+static void
2061+ipt_logfn(unsigned int hooknum,
2062+ const struct sk_buff *skb,
2063+ const struct net_device *in,
2064+ const struct net_device *out,
2065+ const char *prefix)
2066+{
2067+ struct ipt_log_info loginfo = {
2068+ .level = 0,
2069+ .logflags = IPT_LOG_MASK,
2070+ .prefix = ""
2071+ };
2072+
2073+ ipt_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
2074+}
2075+
2076 static int ipt_log_checkentry(const char *tablename,
2077 const struct ipt_entry *e,
2078 void *targinfo,
2079@@ -413,11 +446,18 @@
2080
2081 static int __init init(void)
2082 {
2083- return ipt_register_target(&ipt_log_reg);
2084+ if (ipt_register_target(&ipt_log_reg))
2085+ return -EINVAL;
2086+ if (nflog)
2087+ nf_log_register(PF_INET, &ipt_logfn);
2088+
2089+ return 0;
2090 }
2091
2092 static void __exit fini(void)
2093 {
2094+ if (nflog)
2095+ nf_log_unregister(PF_INET, &ipt_logfn);
2096 ipt_unregister_target(&ipt_log_reg);
2097 }
2098
2099diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_NETLINK.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_NETLINK.c
2100--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_NETLINK.c 1970-01-01 01:00:00.000000000 +0100
2101+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_NETLINK.c 2004-03-30 11:10:39.000000000 +0200
2102@@ -0,0 +1,119 @@
2103+#include <linux/module.h>
2104+#include <linux/version.h>
2105+#include <linux/config.h>
2106+#include <linux/socket.h>
2107+#include <linux/skbuff.h>
2108+#include <linux/kernel.h>
2109+#include <linux/netlink.h>
2110+#include <linux/netdevice.h>
2111+#include <linux/mm.h>
2112+#include <linux/socket.h>
2113+#include <linux/netfilter_ipv4/ip_tables.h>
2114+#include <linux/netfilter_ipv4/ipt_NETLINK.h>
2115+#include <net/sock.h>
2116+
2117+MODULE_AUTHOR("Gianni Tedesco <gianni@ecsc.co.uk>");
2118+MODULE_DESCRIPTION("Provides iptables NETLINK target similar to ipchains -o");
2119+MODULE_LICENSE("GPL");
2120+
2121+#if 0
2122+#define DEBUGP printk
2123+#else
2124+#define DEBUGP(format, args...)
2125+#endif
2126+
2127+static struct sock *ipfwsk;
2128+
2129+static unsigned int ipt_netlink_target(struct sk_buff **pskb,
2130+ unsigned int hooknum,
2131+ const struct net_device *in,
2132+ const struct net_device *out,
2133+ const void *targinfo, void *userinfo)
2134+{
2135+ struct ipt_nldata *nld = (struct ipt_nldata *)targinfo;
2136+ struct iphdr *ip = (*pskb)->nh.iph;
2137+ struct sk_buff *outskb;
2138+ struct netlink_t nlhdr;
2139+ size_t len=0;
2140+
2141+ /* Allocate a socket buffer */
2142+ if ( MASK(nld->flags, USE_SIZE) )
2143+ len = nld->size+sizeof(nlhdr);
2144+ else
2145+ len = ntohs(ip->tot_len)+sizeof(nlhdr);
2146+
2147+ outskb=alloc_skb(len, GFP_ATOMIC);
2148+
2149+ if (outskb) {
2150+ nlhdr.len=len;
2151+
2152+ if ( MASK(nld->flags, USE_MARK) )
2153+ nlhdr.mark=(*pskb)->nfmark=nld->mark;
2154+ else
2155+ nlhdr.mark=(*pskb)->nfmark;
2156+
2157+ if ( in && in->name ) {
2158+ strncpy((char *)&nlhdr.iface, in->name, IFNAMSIZ);
2159+ }else if ( out && out->name ){
2160+ strncpy((char *)&nlhdr.iface, out->name, IFNAMSIZ);
2161+ }
2162+
2163+ skb_put(outskb, len);
2164+ memcpy(outskb->data, &nlhdr, sizeof(nlhdr));
2165+ memcpy((outskb->data)+sizeof(nlhdr), ip, len-sizeof(nlhdr));
2166+ netlink_broadcast(ipfwsk, outskb, 0, ~0, GFP_ATOMIC);
2167+ }else{
2168+ if (net_ratelimit())
2169+ printk(KERN_WARNING "ipt_NETLINK: packet drop due to netlink failure\n");
2170+ }
2171+
2172+ if ( MASK(nld->flags, USE_DROP) )
2173+ return NF_DROP;
2174+
2175+ return IPT_CONTINUE;
2176+}
2177+
2178+static int ipt_netlink_checkentry(const char *tablename,
2179+ const struct ipt_entry *e,
2180+ void *targinfo,
2181+ unsigned int targinfosize,
2182+ unsigned int hookmask)
2183+{
2184+ //struct ipt_nldata *nld = (struct ipt_nldata *)targinfo;
2185+
2186+ return 1;
2187+}
2188+
2189+static struct ipt_target ipt_netlink_reg = {
2190+ {NULL, NULL},
2191+ "NETLINK",
2192+ ipt_netlink_target,
2193+ ipt_netlink_checkentry,
2194+ NULL,
2195+ THIS_MODULE
2196+};
2197+
2198+static int __init init(void)
2199+{
2200+ DEBUGP("ipt_NETLINK: init module\n");
2201+
2202+ if (ipt_register_target(&ipt_netlink_reg) != 0) {
2203+ return -EINVAL;
2204+ }
2205+
2206+ if ( !(ipfwsk=netlink_kernel_create(NETLINK_FIREWALL, NULL)) ){
2207+ return -EINVAL;
2208+ }
2209+
2210+ return 0;
2211+}
2212+
2213+static void __exit fini(void)
2214+{
2215+ DEBUGP("ipt_NETLINK: cleanup_module\n");
2216+ ipt_unregister_target(&ipt_netlink_reg);
2217+ if(ipfwsk->socket) sock_release(ipfwsk->socket);
2218+}
2219+
2220+module_init(init);
2221+module_exit(fini);
2222diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_NOTRACK.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_NOTRACK.c
2223--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_NOTRACK.c 1970-01-01 01:00:00.000000000 +0100
2224+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_NOTRACK.c 2004-03-30 11:11:27.000000000 +0200
2225@@ -0,0 +1,75 @@
2226+/* This is a module which is used for setting up fake conntracks
2227+ * on packets so that they are not seen by the conntrack/NAT code.
2228+ */
2229+#include <linux/module.h>
2230+#include <linux/skbuff.h>
2231+
2232+#include <linux/netfilter_ipv4/ip_tables.h>
2233+#include <linux/netfilter_ipv4/ip_conntrack.h>
2234+
2235+static unsigned int
2236+target(struct sk_buff **pskb,
2237+ const struct net_device *in,
2238+ const struct net_device *out,
2239+ unsigned int hooknum,
2240+ const void *targinfo,
2241+ void *userinfo)
2242+{
2243+ /* Previously seen (loopback)? Ignore. */
2244+ if ((*pskb)->nfct != NULL)
2245+ return IPT_CONTINUE;
2246+
2247+ /* Attach fake conntrack entry.
2248+ If there is a real ct entry correspondig to this packet,
2249+ it'll hang aroun till timing out. We don't deal with it
2250+ for performance reasons. JK */
2251+ (*pskb)->nfct = &ip_conntrack_untracked.infos[IP_CT_NEW];
2252+ nf_conntrack_get((*pskb)->nfct);
2253+
2254+ return IPT_CONTINUE;
2255+}
2256+
2257+static int
2258+checkentry(const char *tablename,
2259+ const struct ipt_entry *e,
2260+ void *targinfo,
2261+ unsigned int targinfosize,
2262+ unsigned int hook_mask)
2263+{
2264+ if (targinfosize != 0) {
2265+ printk(KERN_WARNING "NOTRACK: targinfosize %u != 0\n",
2266+ targinfosize);
2267+ return 0;
2268+ }
2269+
2270+ if (strcmp(tablename, "raw") != 0) {
2271+ printk(KERN_WARNING "NOTRACK: can only be called from \"raw\" table, not \"%s\"\n", tablename);
2272+ return 0;
2273+ }
2274+
2275+ return 1;
2276+}
2277+
2278+static struct ipt_target ipt_notrack_reg = {
2279+ .name = "NOTRACK",
2280+ .target = target,
2281+ .checkentry = checkentry,
2282+ .me = THIS_MODULE
2283+};
2284+
2285+static int __init init(void)
2286+{
2287+ if (ipt_register_target(&ipt_notrack_reg))
2288+ return -EINVAL;
2289+
2290+ return 0;
2291+}
2292+
2293+static void __exit fini(void)
2294+{
2295+ ipt_unregister_target(&ipt_notrack_reg);
2296+}
2297+
2298+module_init(init);
2299+module_exit(fini);
2300+MODULE_LICENSE("GPL");
2301diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_POOL.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_POOL.c
2302--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_POOL.c 1970-01-01 01:00:00.000000000 +0100
2303+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_POOL.c 2004-03-30 11:11:17.000000000 +0200
2304@@ -0,0 +1,116 @@
2305+/* ipt_POOL.c - netfilter target to manipulate IP pools
2306+ *
2307+ * This target can be used almost everywhere. It acts on some specified
2308+ * IP pool, adding or deleting some IP address in the pool. The address
2309+ * can be either the source (--addsrc, --delsrc), or destination (--add/deldst)
2310+ * of the packet under inspection.
2311+ *
2312+ * The target normally returns IPT_CONTINUE.
2313+ */
2314+
2315+#include <linux/types.h>
2316+#include <linux/ip.h>
2317+#include <linux/timer.h>
2318+#include <linux/module.h>
2319+#include <linux/netfilter.h>
2320+#include <linux/netdevice.h>
2321+#include <linux/if.h>
2322+#include <linux/inetdevice.h>
2323+#include <net/protocol.h>
2324+#include <net/checksum.h>
2325+#include <linux/netfilter_ipv4.h>
2326+#include <linux/netfilter_ipv4/ip_nat_rule.h>
2327+#include <linux/netfilter_ipv4/ipt_pool.h>
2328+
2329+#if 0
2330+#define DEBUGP printk
2331+#else
2332+#define DEBUGP(format, args...)
2333+#endif
2334+
2335+/*** NOTE NOTE NOTE NOTE ***
2336+**
2337+** By sheer luck, I get away with using the "struct ipt_pool_info", as defined
2338+** in <linux/netfilter_ipv4/ipt_pool.h>, both as the match and target info.
2339+** Here, in the target implementation, ipt_pool_info.src, if not IP_POOL_NONE,
2340+** is modified for the source IP address of the packet under inspection.
2341+** The same way, the ipt_pool_info.dst pool is modified for the destination.
2342+**
2343+** The address is added to the pool normally. However, if IPT_POOL_DEL_dir
2344+** flag is set in ipt_pool_info.flags, the address is deleted from the pool.
2345+**
2346+** If a modification was done to the pool, we possibly return ACCEPT or DROP,
2347+** if the right IPT_POOL_MOD_dir_ACCEPT or _MOD_dir_DROP flags are set.
2348+** The IPT_POOL_INV_MOD_dir flag inverts the sense of the check (i.e. the
2349+** ACCEPT and DROP flags are evaluated when the pool was not modified.)
2350+*/
2351+
2352+static int
2353+do_check(const char *tablename,
2354+ const struct ipt_entry *e,
2355+ void *targinfo,
2356+ unsigned int targinfosize,
2357+ unsigned int hook_mask)
2358+{
2359+ const struct ipt_pool_info *ipi = targinfo;
2360+
2361+ if (targinfosize != IPT_ALIGN(sizeof(*ipi))) {
2362+ DEBUGP("POOL_check: size %u.\n", targinfosize);
2363+ return 0;
2364+ }
2365+ DEBUGP("ipt_POOL:do_check(%d,%d,%d)\n",ipi->src,ipi->dst,ipi->flags);
2366+ return 1;
2367+}
2368+
2369+static unsigned int
2370+do_target(struct sk_buff **pskb,
2371+ unsigned int hooknum,
2372+ const struct net_device *in,
2373+ const struct net_device *out,
2374+ const void *targinfo,
2375+ void *userinfo)
2376+{
2377+ const struct ipt_pool_info *ipi = targinfo;
2378+ int modified;
2379+ unsigned int verdict = IPT_CONTINUE;
2380+
2381+ if (ipi->src != IP_POOL_NONE) {
2382+ modified = ip_pool_mod(ipi->src, ntohl((*pskb)->nh.iph->saddr),
2383+ ipi->flags & IPT_POOL_DEL_SRC);
2384+ if (!!modified ^ !!(ipi->flags & IPT_POOL_INV_MOD_SRC)) {
2385+ if (ipi->flags & IPT_POOL_MOD_SRC_ACCEPT)
2386+ verdict = NF_ACCEPT;
2387+ else if (ipi->flags & IPT_POOL_MOD_SRC_DROP)
2388+ verdict = NF_DROP;
2389+ }
2390+ }
2391+ if (verdict == IPT_CONTINUE && ipi->dst != IP_POOL_NONE) {
2392+ modified = ip_pool_mod(ipi->dst, ntohl((*pskb)->nh.iph->daddr),
2393+ ipi->flags & IPT_POOL_DEL_DST);
2394+ if (!!modified ^ !!(ipi->flags & IPT_POOL_INV_MOD_DST)) {
2395+ if (ipi->flags & IPT_POOL_MOD_DST_ACCEPT)
2396+ verdict = NF_ACCEPT;
2397+ else if (ipi->flags & IPT_POOL_MOD_DST_DROP)
2398+ verdict = NF_DROP;
2399+ }
2400+ }
2401+ return verdict;
2402+}
2403+
2404+static struct ipt_target pool_reg
2405+= { { NULL, NULL }, "POOL", do_target, do_check, NULL, THIS_MODULE };
2406+
2407+static int __init init(void)
2408+{
2409+ DEBUGP("init ipt_POOL\n");
2410+ return ipt_register_target(&pool_reg);
2411+}
2412+
2413+static void __exit fini(void)
2414+{
2415+ DEBUGP("fini ipt_POOL\n");
2416+ ipt_unregister_target(&pool_reg);
2417+}
2418+
2419+module_init(init);
2420+module_exit(fini);
2421diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_TTL.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_TTL.c
2422--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_TTL.c 1970-01-01 01:00:00.000000000 +0100
2423+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_TTL.c 2004-03-30 11:10:42.000000000 +0200
2424@@ -0,0 +1,120 @@
2425+/* TTL modification target for IP tables
2426+ * (C) 2000 by Harald Welte <laforge@gnumonks.org>
2427+ *
2428+ * Version: $Revision$
2429+ *
2430+ * This software is distributed under the terms of GNU GPL
2431+ */
2432+
2433+#include <linux/module.h>
2434+#include <linux/skbuff.h>
2435+#include <linux/ip.h>
2436+#include <net/checksum.h>
2437+
2438+#include <linux/netfilter_ipv4/ip_tables.h>
2439+#include <linux/netfilter_ipv4/ipt_TTL.h>
2440+
2441+MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
2442+MODULE_DESCRIPTION("IP tables TTL modification module");
2443+MODULE_LICENSE("GPL");
2444+
2445+static unsigned int
2446+ipt_ttl_target(struct sk_buff **pskb, const struct net_device *in,
2447+ const struct net_device *out, unsigned int hooknum,
2448+ const void *targinfo, void *userinfo)
2449+{
2450+ struct iphdr *iph;
2451+ const struct ipt_TTL_info *info = targinfo;
2452+ u_int16_t diffs[2];
2453+ int new_ttl;
2454+
2455+ if (!skb_ip_make_writable(pskb, (*pskb)->len))
2456+ return NF_DROP;
2457+
2458+ iph = (*pskb)->nh.iph;
2459+
2460+ switch (info->mode) {
2461+ case IPT_TTL_SET:
2462+ new_ttl = info->ttl;
2463+ break;
2464+ case IPT_TTL_INC:
2465+ new_ttl = iph->ttl + info->ttl;
2466+ if (new_ttl > 255)
2467+ new_ttl = 255;
2468+ break;
2469+ case IPT_TTL_DEC:
2470+ new_ttl = iph->ttl + info->ttl;
2471+ if (new_ttl < 0)
2472+ new_ttl = 0;
2473+ break;
2474+ default:
2475+ new_ttl = iph->ttl;
2476+ break;
2477+ }
2478+
2479+ if (new_ttl != iph->ttl) {
2480+ diffs[0] = htons(((unsigned)iph->ttl) << 8) ^ 0xFFFF;
2481+ iph->ttl = new_ttl;
2482+ diffs[1] = htons(((unsigned)iph->ttl) << 8);
2483+ iph->check = csum_fold(csum_partial((char *)diffs,
2484+ sizeof(diffs),
2485+ iph->check^0xFFFF));
2486+ (*pskb)->nfcache |= NFC_ALTERED;
2487+ }
2488+
2489+ return IPT_CONTINUE;
2490+}
2491+
2492+static int ipt_ttl_checkentry(const char *tablename,
2493+ const struct ipt_entry *e,
2494+ void *targinfo,
2495+ unsigned int targinfosize,
2496+ unsigned int hook_mask)
2497+{
2498+ struct ipt_TTL_info *info = targinfo;
2499+
2500+ if (targinfosize != IPT_ALIGN(sizeof(struct ipt_TTL_info))) {
2501+ printk(KERN_WARNING "TTL: targinfosize %u != %Zu\n",
2502+ targinfosize,
2503+ IPT_ALIGN(sizeof(struct ipt_TTL_info)));
2504+ return 0;
2505+ }
2506+
2507+ if (strcmp(tablename, "mangle")) {
2508+ printk(KERN_WARNING "TTL: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
2509+ return 0;
2510+ }
2511+
2512+ if (info->mode > IPT_TTL_MAXMODE) {
2513+ printk(KERN_WARNING "TTL: invalid or unknown Mode %u\n",
2514+ info->mode);
2515+ return 0;
2516+ }
2517+
2518+ if ((info->mode != IPT_TTL_SET) && (info->ttl == 0)) {
2519+ printk(KERN_WARNING "TTL: increment/decrement doesn't make sense with value 0\n");
2520+ return 0;
2521+ }
2522+
2523+ return 1;
2524+}
2525+
2526+static struct ipt_target ipt_TTL = {
2527+ .name = "TTL",
2528+ .target = ipt_ttl_target,
2529+ .checkentry = ipt_ttl_checkentry,
2530+ .me = THIS_MODULE
2531+};
2532+
2533+static int __init init(void)
2534+{
2535+ return ipt_register_target(&ipt_TTL);
2536+}
2537+
2538+static void __exit fini(void)
2539+{
2540+ ipt_unregister_target(&ipt_TTL);
2541+}
2542+
2543+module_init(init);
2544+module_exit(fini);
2545diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_ULOG.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_ULOG.c
2546--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_ULOG.c 2004-03-30 05:26:06.000000000 +0200
2547+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_ULOG.c 2004-03-30 11:10:29.000000000 +0200
2548@@ -50,6 +50,7 @@
2549 #include <linux/netlink.h>
2550 #include <linux/netdevice.h>
2551 #include <linux/mm.h>
2552+#include <linux/netfilter.h>
2553 #include <linux/netfilter_ipv4/ip_tables.h>
2554 #include <linux/netfilter_ipv4/ipt_ULOG.h>
2555 #include <linux/netfilter_ipv4/lockhelp.h>
2556@@ -80,6 +81,10 @@
2557 MODULE_PARM(flushtimeout, "i");
2558 MODULE_PARM_DESC(flushtimeout, "buffer flush timeout");
2559
2560+static unsigned int nflog = 1;
2561+MODULE_PARM(nflog, "i");
2562+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
2563+
2564 /* global data structures */
2565
2566 typedef struct {
2567@@ -157,17 +162,17 @@
2568 return skb;
2569 }
2570
2571-static unsigned int ipt_ulog_target(struct sk_buff **pskb,
2572- const struct net_device *in,
2573- const struct net_device *out,
2574- unsigned int hooknum,
2575- const void *targinfo, void *userinfo)
2576+static void ipt_ulog_packet(unsigned int hooknum,
2577+ const struct sk_buff *skb,
2578+ const struct net_device *in,
2579+ const struct net_device *out,
2580+ const struct ipt_ulog_info *loginfo,
2581+ const char *prefix)
2582 {
2583 ulog_buff_t *ub;
2584 ulog_packet_msg_t *pm;
2585 size_t size, copy_len;
2586 struct nlmsghdr *nlh;
2587- struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
2588
2589 /* ffs == find first bit set, necessary because userspace
2590 * is already shifting groupnumber, but we need unshifted.
2591@@ -176,8 +181,8 @@
2592
2593 /* calculate the size of the skb needed */
2594 if ((loginfo->copy_range == 0) ||
2595- (loginfo->copy_range > (*pskb)->len)) {
2596- copy_len = (*pskb)->len;
2597+ (loginfo->copy_range > skb->len)) {
2598+ copy_len = skb->len;
2599 } else {
2600 copy_len = loginfo->copy_range;
2601 }
2602@@ -214,19 +219,21 @@
2603
2604 /* copy hook, prefix, timestamp, payload, etc. */
2605 pm->data_len = copy_len;
2606- pm->timestamp_sec = (*pskb)->stamp.tv_sec;
2607- pm->timestamp_usec = (*pskb)->stamp.tv_usec;
2608- pm->mark = (*pskb)->nfmark;
2609+ pm->timestamp_sec = skb->stamp.tv_sec;
2610+ pm->timestamp_usec = skb->stamp.tv_usec;
2611+ pm->mark = skb->nfmark;
2612 pm->hook = hooknum;
2613- if (loginfo->prefix[0] != '\0')
2614+ if (prefix != NULL)
2615+ strncpy(pm->prefix, prefix, sizeof(pm->prefix));
2616+ else if (loginfo->prefix[0] != '\0')
2617 strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
2618 else
2619 *(pm->prefix) = '\0';
2620
2621 if (in && in->hard_header_len > 0
2622- && (*pskb)->mac.raw != (void *) (*pskb)->nh.iph
2623+ && skb->mac.raw != (void *) skb->nh.iph
2624 && in->hard_header_len <= ULOG_MAC_LEN) {
2625- memcpy(pm->mac, (*pskb)->mac.raw, in->hard_header_len);
2626+ memcpy(pm->mac, skb->mac.raw, in->hard_header_len);
2627 pm->mac_len = in->hard_header_len;
2628 } else
2629 pm->mac_len = 0;
2630@@ -241,8 +248,8 @@
2631 else
2632 pm->outdev_name[0] = '\0';
2633
2634- /* copy_len <= (*pskb)->len, so can't fail. */
2635- if (skb_copy_bits(*pskb, 0, pm->payload, copy_len) < 0)
2636+ /* copy_len <= skb->len, so can't fail. */
2637+ if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0)
2638 BUG();
2639
2640 /* check if we are building multi-part messages */
2641@@ -266,8 +273,7 @@
2642
2643 UNLOCK_BH(&ulog_lock);
2644
2645- return IPT_CONTINUE;
2646-
2647+ return;
2648
2649 nlmsg_failure:
2650 PRINTR("ipt_ULOG: error during NLMSG_PUT\n");
2651@@ -276,8 +282,35 @@
2652 PRINTR("ipt_ULOG: Error building netlink message\n");
2653
2654 UNLOCK_BH(&ulog_lock);
2655+}
2656+
2657+static unsigned int ipt_ulog_target(struct sk_buff **pskb,
2658+ const struct net_device *in,
2659+ const struct net_device *out,
2660+ unsigned int hooknum,
2661+ const void *targinfo, void *userinfo)
2662+{
2663+ struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
2664
2665- return IPT_CONTINUE;
2666+ ipt_ulog_packet(hooknum, *pskb, in, out, loginfo, NULL);
2667+
2668+ return IPT_CONTINUE;
2669+}
2670+
2671+static void ipt_logfn(unsigned int hooknum,
2672+ const struct sk_buff *skb,
2673+ const struct net_device *in,
2674+ const struct net_device *out,
2675+ const char *prefix)
2676+{
2677+ struct ipt_ulog_info loginfo = {
2678+ .nl_group = ULOG_DEFAULT_NLGROUP,
2679+ .copy_range = 0,
2680+ .qthreshold = ULOG_DEFAULT_QTHRESHOLD,
2681+ .prefix = ""
2682+ };
2683+
2684+ ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
2685 }
2686
2687 static int ipt_ulog_checkentry(const char *tablename,
2688@@ -341,7 +374,9 @@
2689 sock_release(nflognl->sk_socket);
2690 return -EINVAL;
2691 }
2692-
2693+ if (nflog)
2694+ nf_log_register(PF_INET, &ipt_logfn);
2695+
2696 return 0;
2697 }
2698
2699@@ -352,6 +387,8 @@
2700
2701 DEBUGP("ipt_ULOG: cleanup_module\n");
2702
2703+ if (nflog)
2704+ nf_log_unregister(PF_INET, &ipt_logfn);
2705 ipt_unregister_target(&ipt_ulog_reg);
2706 sock_release(nflognl->sk_socket);
2707
2708diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_connlimit.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_connlimit.c
2709--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_connlimit.c 1970-01-01 01:00:00.000000000 +0100
2710+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_connlimit.c 2004-03-30 11:10:45.000000000 +0200
2711@@ -0,0 +1,230 @@
2712+/*
2713+ * netfilter module to limit the number of parallel tcp
2714+ * connections per IP address.
2715+ * (c) 2000 Gerd Knorr <kraxel@bytesex.org>
2716+ * Nov 2002: Martin Bene <martin.bene@icomedias.com>:
2717+ * only ignore TIME_WAIT or gone connections
2718+ *
2719+ * based on ...
2720+ *
2721+ * Kernel module to match connection tracking information.
2722+ * GPL (C) 1999 Rusty Russell (rusty@rustcorp.com.au).
2723+ */
2724+#include <linux/module.h>
2725+#include <linux/skbuff.h>
2726+#include <linux/list.h>
2727+#include <linux/netfilter_ipv4/ip_conntrack.h>
2728+#include <linux/netfilter_ipv4/ip_conntrack_core.h>
2729+#include <linux/netfilter_ipv4/ip_conntrack_tcp.h>
2730+#include <linux/netfilter_ipv4/ip_tables.h>
2731+#include <linux/netfilter_ipv4/ipt_connlimit.h>
2732+
2733+#define DEBUG 0
2734+
2735+MODULE_LICENSE("GPL");
2736+
2737+/* we'll save the tuples of all connections we care about */
2738+struct ipt_connlimit_conn
2739+{
2740+ struct list_head list;
2741+ struct ip_conntrack_tuple tuple;
2742+};
2743+
2744+struct ipt_connlimit_data {
2745+ spinlock_t lock;
2746+ struct list_head iphash[256];
2747+};
2748+
2749+static int ipt_iphash(u_int32_t addr)
2750+{
2751+ int hash;
2752+
2753+ hash = addr & 0xff;
2754+ hash ^= (addr >> 8) & 0xff;
2755+ hash ^= (addr >> 16) & 0xff;
2756+ hash ^= (addr >> 24) & 0xff;
2757+ return hash;
2758+}
2759+
2760+static int count_them(struct ipt_connlimit_data *data,
2761+ u_int32_t addr, u_int32_t mask,
2762+ struct ip_conntrack *ct)
2763+{
2764+#if DEBUG
2765+ const static char *tcp[] = { "none", "established", "syn_sent", "syn_recv",
2766+ "fin_wait", "time_wait", "close", "close_wait",
2767+ "last_ack", "listen" };
2768+#endif
2769+ int addit = 1, matches = 0;
2770+ struct ip_conntrack_tuple tuple;
2771+ struct ip_conntrack_tuple_hash *found;
2772+ struct ipt_connlimit_conn *conn;
2773+ struct list_head *hash,*lh;
2774+
2775+ spin_lock(&data->lock);
2776+ tuple = ct->tuplehash[0].tuple;
2777+ hash = &data->iphash[ipt_iphash(addr & mask)];
2778+
2779+ /* check the saved connections */
2780+ for (lh = hash->next; lh != hash; lh = lh->next) {
2781+ conn = list_entry(lh,struct ipt_connlimit_conn,list);
2782+ found = ip_conntrack_find_get(&conn->tuple,ct);
2783+ if (0 == memcmp(&conn->tuple,&tuple,sizeof(tuple)) &&
2784+ found != NULL &&
2785+ found->ctrack->proto.tcp.state != TCP_CONNTRACK_TIME_WAIT) {
2786+ /* Just to be sure we have it only once in the list.
2787+ We should'nt see tuples twice unless someone hooks this
2788+ into a table without "-p tcp --syn" */
2789+ addit = 0;
2790+ }
2791+#if DEBUG
2792+ printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d %s\n",
2793+ ipt_iphash(addr & mask),
2794+ NIPQUAD(conn->tuple.src.ip), ntohs(conn->tuple.src.u.tcp.port),
2795+ NIPQUAD(conn->tuple.dst.ip), ntohs(conn->tuple.dst.u.tcp.port),
2796+ (NULL != found) ? tcp[found->ctrack->proto.tcp.state] : "gone");
2797+#endif
2798+ if (NULL == found) {
2799+ /* this one is gone */
2800+ lh = lh->prev;
2801+ list_del(lh->next);
2802+ kfree(conn);
2803+ continue;
2804+ }
2805+ if (found->ctrack->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT) {
2806+ /* we don't care about connections which are
2807+ closed already -> ditch it */
2808+ lh = lh->prev;
2809+ list_del(lh->next);
2810+ kfree(conn);
2811+ nf_conntrack_put(&found->ctrack->infos[0]);
2812+ continue;
2813+ }
2814+ if ((addr & mask) == (conn->tuple.src.ip & mask)) {
2815+ /* same source IP address -> be counted! */
2816+ matches++;
2817+ }
2818+ nf_conntrack_put(&found->ctrack->infos[0]);
2819+ }
2820+ if (addit) {
2821+ /* save the new connection in our list */
2822+#if DEBUG
2823+ printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d new\n",
2824+ ipt_iphash(addr & mask),
2825+ NIPQUAD(tuple.src.ip), ntohs(tuple.src.u.tcp.port),
2826+ NIPQUAD(tuple.dst.ip), ntohs(tuple.dst.u.tcp.port));
2827+#endif
2828+ conn = kmalloc(sizeof(*conn),GFP_ATOMIC);
2829+ if (NULL == conn)
2830+ return -1;
2831+ memset(conn,0,sizeof(*conn));
2832+ INIT_LIST_HEAD(&conn->list);
2833+ conn->tuple = tuple;
2834+ list_add(&conn->list,hash);
2835+ matches++;
2836+ }
2837+ spin_unlock(&data->lock);
2838+ return matches;
2839+}
2840+
2841+static int
2842+match(const struct sk_buff *skb,
2843+ const struct net_device *in,
2844+ const struct net_device *out,
2845+ const void *matchinfo,
2846+ int offset,
2847+ int *hotdrop)
2848+{
2849+ const struct ipt_connlimit_info *info = matchinfo;
2850+ int connections, match;
2851+ struct ip_conntrack *ct;
2852+ enum ip_conntrack_info ctinfo;
2853+
2854+ ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
2855+ if (NULL == ct) {
2856+ printk("ipt_connlimit: Oops: invalid ct state ?\n");
2857+ *hotdrop = 1;
2858+ return 0;
2859+ }
2860+ connections = count_them(info->data,skb->nh.iph->saddr,info->mask,ct);
2861+ if (-1 == connections) {
2862+ printk("ipt_connlimit: Hmm, kmalloc failed :-(\n");
2863+ *hotdrop = 1; /* let's free some memory :-) */
2864+ return 0;
2865+ }
2866+ match = (info->inverse) ? (connections <= info->limit) : (connections > info->limit);
2867+#if DEBUG
2868+ printk("ipt_connlimit: src=%u.%u.%u.%u mask=%u.%u.%u.%u "
2869+ "connections=%d limit=%d match=%s\n",
2870+ NIPQUAD(skb->nh.iph->saddr), NIPQUAD(info->mask),
2871+ connections, info->limit, match ? "yes" : "no");
2872+#endif
2873+
2874+ return match;
2875+}
2876+
2877+static int check(const char *tablename,
2878+ const struct ipt_ip *ip,
2879+ void *matchinfo,
2880+ unsigned int matchsize,
2881+ unsigned int hook_mask)
2882+{
2883+ struct ipt_connlimit_info *info = matchinfo;
2884+ int i;
2885+
2886+ /* verify size */
2887+ if (matchsize != IPT_ALIGN(sizeof(struct ipt_connlimit_info)))
2888+ return 0;
2889+
2890+ /* refuse anything but tcp */
2891+ if (ip->proto != IPPROTO_TCP)
2892+ return 0;
2893+
2894+ /* init private data */
2895+ info->data = kmalloc(sizeof(struct ipt_connlimit_data),GFP_KERNEL);
2896+ spin_lock_init(&(info->data->lock));
2897+ for (i = 0; i < 256; i++)
2898+ INIT_LIST_HEAD(&(info->data->iphash[i]));
2899+
2900+ return 1;
2901+}
2902+
2903+static void destroy(void *matchinfo, unsigned int matchinfosize)
2904+{
2905+ struct ipt_connlimit_info *info = matchinfo;
2906+ struct ipt_connlimit_conn *conn;
2907+ struct list_head *hash;
2908+ int i;
2909+
2910+ /* cleanup */
2911+ for (i = 0; i < 256; i++) {
2912+ hash = &(info->data->iphash[i]);
2913+ while (hash != hash->next) {
2914+ conn = list_entry(hash->next,struct ipt_connlimit_conn,list);
2915+ list_del(hash->next);
2916+ kfree(conn);
2917+ }
2918+ }
2919+ kfree(info->data);
2920+}
2921+
2922+static struct ipt_match connlimit_match = {
2923+ .name = "connlimit",
2924+ .match = &match,
2925+ .checkentry = &check,
2926+ .destroy = &destroy,
2927+ .me = THIS_MODULE
2928+};
2929+
2930+static int __init init(void)
2931+{
2932+ return ipt_register_match(&connlimit_match);
2933+}
2934+
2935+static void __exit fini(void)
2936+{
2937+ ipt_unregister_match(&connlimit_match);
2938+}
2939+
2940+module_init(init);
2941+module_exit(fini);
2942diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_conntrack.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_conntrack.c
2943--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_conntrack.c 2004-03-30 05:27:15.000000000 +0200
2944+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_conntrack.c 2004-03-30 11:11:27.000000000 +0200
2945@@ -35,11 +35,13 @@
2946
2947 #define FWINV(bool,invflg) ((bool) ^ !!(sinfo->invflags & invflg))
2948
2949- if (ct)
2950- statebit = IPT_CONNTRACK_STATE_BIT(ctinfo);
2951- else
2952- statebit = IPT_CONNTRACK_STATE_INVALID;
2953-
2954+ if (skb->nfct == &ip_conntrack_untracked.infos[IP_CT_NEW])
2955+ statebit = IPT_CONNTRACK_STATE_UNTRACKED;
2956+ else if (ct)
2957+ statebit = IPT_CONNTRACK_STATE_BIT(ctinfo);
2958+ else
2959+ statebit = IPT_CONNTRACK_STATE_INVALID;
2960+
2961 if(sinfo->flags & IPT_CONNTRACK_STATE) {
2962 if (ct) {
2963 if(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip !=
2964diff -Nur --exclude '*.orig' linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_dstlimit.c linux-2.6.5-rc3/net/ipv4/netfilter/ipt_dstlimit.c
2965--- linux-2.6.5-rc3.org/net/ipv4/netfilter/ipt_dstlimit.c 1970-01-01 01:00:00.000000000 +0100
2966+++ linux-2.6.5-rc3/net/ipv4/netfilter/ipt_dstlimit.c 2004-03-30 11:10:47.000000000 +0200
2967@@ -0,0 +1,690 @@
2968+/* iptables match extension to limit the number of packets per second
2969+ * seperately for each destination.
2970+ *
2971+ * (C) 2003 by Harald Welte <laforge@netfilter.org>
2972+ *
2973+ * $Id$
2974+ *
2975+ * Development of this code was funded by Astaro AG, http://www.astaro.com/
2976+ *
2977+ * based on ipt_limit.c by:
2978