]> git.pld-linux.org Git - packages/kernel.git/blame - 2.6.6-rc1-patch-o-matic-ng-base-20040415.patch
projects / packages / kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- obsolete
[packages/kernel.git] / 2.6.6-rc1-patch-o-matic-ng-base-20040415.patch
CommitLineData
dd04ed5d 1diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter.h linux-2.6.6-rc1/include/linux/netfilter.h
2--- linux-2.6.6-rc1.org/include/linux/netfilter.h 2004-04-15 03:34:48.000000000 +0200
3+++ linux-2.6.6-rc1/include/linux/netfilter.h 2004-04-15 21:20:32.000000000 +0200
4@@ -99,6 +99,24 @@
5
6 extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
7
8+typedef void nf_logfn(unsigned int hooknum,
9+ const struct sk_buff *skb,
10+ const struct net_device *in,
11+ const struct net_device *out,
12+ const char *prefix);
13+
14+/* Function to register/unregister log function. */
15+int nf_log_register(int pf, nf_logfn *logfn);
16+void nf_log_unregister(int pf, nf_logfn *logfn);
17+
18+/* Calls the registered backend logging function */
19+void nf_log_packet(int pf,
20+ unsigned int hooknum,
21+ const struct sk_buff *skb,
22+ const struct net_device *in,
23+ const struct net_device *out,
24+ const char *fmt, ...);
25+
26 /* Activate hook; either okfn or kfree_skb called, unless a hook
27 returns NF_STOLEN (in which case, it's up to the hook to deal with
28 the consequences).
29diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ip_conntrack.h
30--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ip_conntrack.h 2004-04-15 03:35:50.000000000 +0200
31+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ip_conntrack.h 2004-04-15 21:21:20.000000000 +0200
32@@ -252,6 +252,9 @@
33 /* Call me when a conntrack is destroyed. */
34 extern void (*ip_conntrack_destroyed)(struct ip_conntrack *conntrack);
35
36+/* Fake conntrack entry for untracked connections */
37+extern struct ip_conntrack ip_conntrack_untracked;
38+
39 /* Returns new sk_buff, or NULL */
40 struct sk_buff *
41 ip_ct_gather_frags(struct sk_buff *skb);
42diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ip_pool.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ip_pool.h
43--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ip_pool.h 1970-01-01 01:00:00.000000000 +0100
44+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ip_pool.h 2004-04-15 21:21:08.000000000 +0200
45@@ -0,0 +1,64 @@
46+#ifndef _IP_POOL_H
47+#define _IP_POOL_H
48+
49+/***************************************************************************/
50+/* This program is free software; you can redistribute it and/or modify */
51+/* it under the terms of the GNU General Public License as published by */
52+/* the Free Software Foundation; either version 2 of the License, or */
53+/* (at your option) any later version. */
54+/* */
55+/* This program is distributed in the hope that it will be useful, */
56+/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
57+/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
58+/* GNU General Public License for more details. */
59+/* */
60+/* You should have received a copy of the GNU General Public License */
61+/* along with this program; if not, write to the Free Software */
62+/* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA*/
63+/***************************************************************************/
64+
65+/* A sockopt of such quality has hardly ever been seen before on the open
66+ * market! This little beauty, hardly ever used: above 64, so it's
67+ * traditionally used for firewalling, not touched (even once!) by the
68+ * 2.0, 2.2 and 2.4 kernels!
69+ *
70+ * Comes with its own certificate of authenticity, valid anywhere in the
71+ * Free world!
72+ *
73+ * Rusty, 19.4.2000
74+ */
75+#define SO_IP_POOL 81
76+
77+typedef int ip_pool_t; /* pool index */
78+#define IP_POOL_NONE ((ip_pool_t)-1)
79+
80+struct ip_pool_request {
81+ int op;
82+ ip_pool_t index;
83+ u_int32_t addr;
84+ u_int32_t addr2;
85+};
86+
87+/* NOTE: I deliberately break the first cut ippool utility. Nobody uses it. */
88+
89+#define IP_POOL_BAD001 0x00000010
90+
91+#define IP_POOL_FLUSH 0x00000011 /* req.index, no arguments */
92+#define IP_POOL_INIT 0x00000012 /* from addr to addr2 incl. */
93+#define IP_POOL_DESTROY 0x00000013 /* req.index, no arguments */
94+#define IP_POOL_ADD_ADDR 0x00000014 /* add addr to pool */
95+#define IP_POOL_DEL_ADDR 0x00000015 /* del addr from pool */
96+#define IP_POOL_HIGH_NR 0x00000016 /* result in req.index */
97+#define IP_POOL_LOOKUP 0x00000017 /* result in addr and addr2 */
98+#define IP_POOL_USAGE 0x00000018 /* result in addr */
99+#define IP_POOL_TEST_ADDR 0x00000019 /* result (0/1) returned */
100+
101+#ifdef __KERNEL__
102+
103+/* NOTE: ip_pool_match() and ip_pool_mod() expect ADDR to be host byte order */
104+extern int ip_pool_match(ip_pool_t pool, u_int32_t addr);
105+extern int ip_pool_mod(ip_pool_t pool, u_int32_t addr, int isdel);
106+
107+#endif
108+
109+#endif /*_IP_POOL_H*/
110diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_NETLINK.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_NETLINK.h
111--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_NETLINK.h 1970-01-01 01:00:00.000000000 +0100
112+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_NETLINK.h 2004-04-15 21:20:44.000000000 +0200
113@@ -0,0 +1,27 @@
114+#ifndef _IPT_FWMON_H
115+#define _IPT_FWMON_H
116+
117+/* Bitmask macros */
118+#define MASK(x,y) (x & y)
119+#define MASK_SET(x,y) x |= y
120+#define MASK_UNSET(x,y) x &= ~y
121+
122+#define USE_MARK 0x00000001
123+#define USE_DROP 0x00000002
124+#define USE_SIZE 0x00000004
125+
126+struct ipt_nldata
127+{
128+ unsigned int flags;
129+ unsigned int mark;
130+ unsigned int size;
131+};
132+
133+/* Old header */
134+struct netlink_t {
135+ unsigned int len;
136+ unsigned int mark;
137+ char iface[IFNAMSIZ];
138+};
139+
140+#endif /*_IPT_FWMON_H*/
141diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_TTL.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_TTL.h
142--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_TTL.h 1970-01-01 01:00:00.000000000 +0100
143+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_TTL.h 2004-04-15 21:20:49.000000000 +0200
144@@ -0,0 +1,21 @@
145+/* TTL modification module for IP tables
146+ * (C) 2000 by Harald Welte <laforge@gnumonks.org> */
147+
148+#ifndef _IPT_TTL_H
149+#define _IPT_TTL_H
150+
151+enum {
152+ IPT_TTL_SET = 0,
153+ IPT_TTL_INC,
154+ IPT_TTL_DEC
155+};
156+
157+#define IPT_TTL_MAXMODE IPT_TTL_DEC
158+
159+struct ipt_TTL_info {
160+ u_int8_t mode;
161+ u_int8_t ttl;
162+};
163+
164+
165+#endif
166diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_ULOG.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_ULOG.h
167--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_ULOG.h 2004-04-15 03:34:36.000000000 +0200
168+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_ULOG.h 2004-04-15 21:20:32.000000000 +0200
169@@ -11,6 +11,9 @@
170 #define NETLINK_NFLOG 5
171 #endif
172
173+#define ULOG_DEFAULT_NLGROUP 1
174+#define ULOG_DEFAULT_QTHRESHOLD 1
175+
176 #define ULOG_MAC_LEN 80
177 #define ULOG_PREFIX_LEN 32
178
179diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_connlimit.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_connlimit.h
180--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_connlimit.h 1970-01-01 01:00:00.000000000 +0100
181+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_connlimit.h 2004-04-15 21:20:53.000000000 +0200
182@@ -0,0 +1,12 @@
183+#ifndef _IPT_CONNLIMIT_H
184+#define _IPT_CONNLIMIT_H
185+
186+struct ipt_connlimit_data;
187+
188+struct ipt_connlimit_info {
189+ int limit;
190+ int inverse;
191+ u_int32_t mask;
192+ struct ipt_connlimit_data *data;
193+};
194+#endif /* _IPT_CONNLIMIT_H */
195diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_conntrack.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_conntrack.h
196--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_conntrack.h 2004-04-15 03:35:20.000000000 +0200
197+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_conntrack.h 2004-04-15 21:21:20.000000000 +0200
198@@ -10,6 +10,7 @@
199
200 #define IPT_CONNTRACK_STATE_SNAT (1 << (IP_CT_NUMBER + 1))
201 #define IPT_CONNTRACK_STATE_DNAT (1 << (IP_CT_NUMBER + 2))
202+#define IPT_CONNTRACK_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 3))
203
204 /* flags, invflags: */
205 #define IPT_CONNTRACK_STATE 0x01
206diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_dstlimit.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_dstlimit.h
207--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_dstlimit.h 1970-01-01 01:00:00.000000000 +0100
208+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_dstlimit.h 2004-04-15 21:20:56.000000000 +0200
209@@ -0,0 +1,39 @@
210+#ifndef _IPT_DSTLIMIT_H
211+#define _IPT_DSTLIMIT_H
212+
213+/* timings are in milliseconds. */
214+#define IPT_DSTLIMIT_SCALE 10000
215+/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
216+ seconds, or one every 59 hours. */
217+
218+/* details of this structure hidden by the implementation */
219+struct ipt_dstlimit_htable;
220+
221+#define IPT_DSTLIMIT_HASH_DIP 0x0001
222+#define IPT_DSTLIMIT_HASH_DPT 0x0002
223+#define IPT_DSTLIMIT_HASH_SIP 0x0004
224+
225+struct dstlimit_cfg {
226+ u_int32_t mode; /* bitmask of IPT_DSTLIMIT_HASH_* */
227+ u_int32_t avg; /* Average secs between packets * scale */
228+ u_int32_t burst; /* Period multiplier for upper limit. */
229+
230+ /* user specified */
231+ u_int32_t size; /* how many buckets */
232+ u_int32_t max; /* max number of entries */
233+ u_int32_t gc_interval; /* gc interval */
234+ u_int32_t expire; /* when do entries expire? */
235+};
236+
237+struct ipt_dstlimit_info {
238+ char name [IFNAMSIZ]; /* name */
239+ struct dstlimit_cfg cfg;
240+ struct ipt_dstlimit_htable *hinfo;
241+
242+ /* Used internally by the kernel */
243+ union {
244+ void *ptr;
245+ struct ipt_dstlimit_info *master;
246+ } u;
247+};
248+#endif /*_IPT_DSTLIMIT_H*/
249diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_fuzzy.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_fuzzy.h
250--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_fuzzy.h 1970-01-01 01:00:00.000000000 +0100
251+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_fuzzy.h 2004-04-15 21:20:59.000000000 +0200
252@@ -0,0 +1,21 @@
253+#ifndef _IPT_FUZZY_H
254+#define _IPT_FUZZY_H
255+
256+#include <linux/param.h>
257+#include <linux/types.h>
258+
259+#define MAXFUZZYRATE 10000000
260+#define MINFUZZYRATE 3
261+
262+struct ipt_fuzzy_info {
263+ u_int32_t minimum_rate;
264+ u_int32_t maximum_rate;
265+ u_int32_t packets_total;
266+ u_int32_t bytes_total;
267+ u_int32_t previous_time;
268+ u_int32_t present_time;
269+ u_int32_t mean_rate;
270+ u_int8_t acceptance_rate;
271+};
272+
273+#endif /*_IPT_FUZZY_H*/
274diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_ipv4options.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_ipv4options.h
275--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_ipv4options.h 1970-01-01 01:00:00.000000000 +0100
276+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_ipv4options.h 2004-04-15 21:21:01.000000000 +0200
277@@ -0,0 +1,21 @@
278+#ifndef __ipt_ipv4options_h_included__
279+#define __ipt_ipv4options_h_included__
280+
281+#define IPT_IPV4OPTION_MATCH_SSRR 0x01 /* For strict source routing */
282+#define IPT_IPV4OPTION_MATCH_LSRR 0x02 /* For loose source routing */
283+#define IPT_IPV4OPTION_DONT_MATCH_SRR 0x04 /* any source routing */
284+#define IPT_IPV4OPTION_MATCH_RR 0x08 /* For Record route */
285+#define IPT_IPV4OPTION_DONT_MATCH_RR 0x10
286+#define IPT_IPV4OPTION_MATCH_TIMESTAMP 0x20 /* For timestamp request */
287+#define IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP 0x40
288+#define IPT_IPV4OPTION_MATCH_ROUTER_ALERT 0x80 /* For router-alert */
289+#define IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT 0x100
290+#define IPT_IPV4OPTION_MATCH_ANY_OPT 0x200 /* match packet with any option */
291+#define IPT_IPV4OPTION_DONT_MATCH_ANY_OPT 0x400 /* match packet with no option */
292+
293+struct ipt_ipv4options_info {
294+ u_int16_t options;
295+};
296+
297+
298+#endif /* __ipt_ipv4options_h_included__ */
299diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_mport.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_mport.h
300--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_mport.h 1970-01-01 01:00:00.000000000 +0100
301+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_mport.h 2004-04-15 21:21:03.000000000 +0200
302@@ -0,0 +1,24 @@
303+#ifndef _IPT_MPORT_H
304+#define _IPT_MPORT_H
305+#include <linux/netfilter_ipv4/ip_tables.h>
306+
307+#define IPT_MPORT_SOURCE (1<<0)
308+#define IPT_MPORT_DESTINATION (1<<1)
309+#define IPT_MPORT_EITHER (IPT_MPORT_SOURCE|IPT_MPORT_DESTINATION)
310+
311+#define IPT_MULTI_PORTS 15
312+
313+/* Must fit inside union ipt_matchinfo: 32 bytes */
314+/* every entry in ports[] except for the last one has one bit in pflags
315+ * associated with it. If this bit is set, the port is the first port of
316+ * a portrange, with the next entry being the last.
317+ * End of list is marked with pflags bit set and port=65535.
318+ * If 14 ports are used (last one does not have a pflag), the last port
319+ * is repeated to fill the last entry in ports[] */
320+struct ipt_mport
321+{
322+ u_int8_t flags:2; /* Type of comparison */
323+ u_int16_t pflags:14; /* Port flags */
324+ u_int16_t ports[IPT_MULTI_PORTS]; /* Ports */
325+};
326+#endif /*_IPT_MPORT_H*/
327diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_nth.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_nth.h
328--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_nth.h 1970-01-01 01:00:00.000000000 +0100
329+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_nth.h 2004-04-15 21:21:05.000000000 +0200
330@@ -0,0 +1,19 @@
331+#ifndef _IPT_NTH_H
332+#define _IPT_NTH_H
333+
334+#include <linux/param.h>
335+#include <linux/types.h>
336+
337+#ifndef IPT_NTH_NUM_COUNTERS
338+#define IPT_NTH_NUM_COUNTERS 16
339+#endif
340+
341+struct ipt_nth_info {
342+ u_int8_t every;
343+ u_int8_t not;
344+ u_int8_t startat;
345+ u_int8_t counter;
346+ u_int8_t packet;
347+};
348+
349+#endif /*_IPT_NTH_H*/
350diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_osf.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_osf.h
351--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_osf.h 1970-01-01 01:00:00.000000000 +0100
352+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_osf.h 2004-04-15 21:21:06.000000000 +0200
353@@ -0,0 +1,148 @@
354+/*
355+ * ipt_osf.h
356+ *
357+ * Copyright (c) 2003 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
358+ *
359+ *
360+ * This program is free software; you can redistribute it and/or modify
361+ * it under the terms of the GNU General Public License as published by
362+ * the Free Software Foundation; either version 2 of the License, or
363+ * (at your option) any later version.
364+ *
365+ * This program is distributed in the hope that it will be useful,
366+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
367+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
368+ * GNU General Public License for more details.
369+ *
370+ * You should have received a copy of the GNU General Public License
371+ * along with this program; if not, write to the Free Software
372+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
373+ */
374+
375+#ifndef _IPT_OSF_H
376+#define _IPT_OSF_H
377+
378+#define MAXGENRELEN 32
379+#define MAXDETLEN 64
380+
381+#define IPT_OSF_GENRE 1
382+#define IPT_OSF_SMART 2
383+#define IPT_OSF_LOG 4
384+#define IPT_OSF_NETLINK 8
385+
386+#define IPT_OSF_LOGLEVEL_ALL 0
387+#define IPT_OSF_LOGLEVEL_FIRST 1
388+
389+#include <linux/list.h>
390+
391+#ifndef __KERNEL__
392+#include <netinet/ip.h>
393+#include <netinet/tcp.h>
394+
395+struct list_head
396+{
397+ struct list_head *prev, *next;
398+};
399+#endif
400+
401+struct ipt_osf_info
402+{
403+ char genre[MAXGENRELEN];
404+ int len;
405+ unsigned long flags;
406+ int loglevel;
407+ int invert; /* UNSUPPORTED */
408+};
409+
410+struct osf_wc
411+{
412+ char wc;
413+ unsigned long val;
414+};
415+
416+/* This struct represents IANA options
417+ * http://www.iana.org/assignments/tcp-parameters
418+ */
419+struct osf_opt
420+{
421+ unsigned char kind;
422+ unsigned char length;
423+ struct osf_wc wc;
424+};
425+
426+struct osf_finger
427+{
428+ struct list_head flist;
429+ struct osf_wc wss;
430+ unsigned char ttl;
431+ unsigned char df;
432+ unsigned long ss;
433+ unsigned char genre[MAXGENRELEN];
434+ unsigned char version[MAXGENRELEN], subtype[MAXGENRELEN];
435+
436+ /* Not needed, but for consistency with original table from Michal Zalewski */
437+ unsigned char details[MAXDETLEN];
438+
439+ int opt_num;
440+ struct osf_opt opt[MAX_IPOPTLEN]; /* In case it is all NOP or EOL */
441+
442+};
443+
444+struct ipt_osf_nlmsg
445+{
446+ struct osf_finger f;
447+ struct iphdr ip;
448+ struct tcphdr tcp;
449+};
450+
451+#ifdef __KERNEL__
452+
453+/* Defines for IANA option kinds */
454+
455+#define OSFOPT_EOL 0 /* End of options */
456+#define OSFOPT_NOP 1 /* NOP */
457+#define OSFOPT_MSS 2 /* Maximum segment size */
458+#define OSFOPT_WSO 3 /* Window scale option */
459+#define OSFOPT_SACKP 4 /* SACK permitted */
460+#define OSFOPT_SACK 5 /* SACK */
461+#define OSFOPT_ECHO 6
462+#define OSFOPT_ECHOREPLY 7
463+#define OSFOPT_TS 8 /* Timestamp option */
464+#define OSFOPT_POCP 9 /* Partial Order Connection Permitted */
465+#define OSFOPT_POSP 10 /* Partial Order Service Profile */
466+/* Others are not used in current OSF */
467+
468+static struct osf_opt IANA_opts[] =
469+{
470+ {0, 1,},
471+ {1, 1,},
472+ {2, 4,},
473+ {3, 3,},
474+ {4, 2,},
475+ {5, 1 ,}, /* SACK length is not defined */
476+ {6, 6,},
477+ {7, 6,},
478+ {8, 10,},
479+ {9, 2,},
480+ {10, 3,},
481+ {11, 1,}, /* CC: Suppose 1 */
482+ {12, 1,}, /* the same */
483+ {13, 1,}, /* and here too */
484+ {14, 3,},
485+ {15, 1,}, /* TCP Alternate Checksum Data. Length is not defined */
486+ {16, 1,},
487+ {17, 1,},
488+ {18, 3,},
489+ {19, 18,},
490+ {20, 1,},
491+ {21, 1,},
492+ {22, 1,},
493+ {23, 1,},
494+ {24, 1,},
495+ {25, 1,},
496+ {26, 1,},
497+};
498+
499+#endif /* __KERNEL__ */
500+
501+#endif /* _IPT_OSF_H */
502diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_pool.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_pool.h
503--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_pool.h 1970-01-01 01:00:00.000000000 +0100
504+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_pool.h 2004-04-15 21:21:08.000000000 +0200
505@@ -0,0 +1,25 @@
506+#ifndef _IPT_POOL_H
507+#define _IPT_POOL_H
508+
509+#include <linux/netfilter_ipv4/ip_pool.h>
510+
511+#define IPT_POOL_INV_SRC 0x00000001
512+#define IPT_POOL_INV_DST 0x00000002
513+#define IPT_POOL_DEL_SRC 0x00000004
514+#define IPT_POOL_DEL_DST 0x00000008
515+#define IPT_POOL_INV_MOD_SRC 0x00000010
516+#define IPT_POOL_INV_MOD_DST 0x00000020
517+#define IPT_POOL_MOD_SRC_ACCEPT 0x00000040
518+#define IPT_POOL_MOD_DST_ACCEPT 0x00000080
519+#define IPT_POOL_MOD_SRC_DROP 0x00000100
520+#define IPT_POOL_MOD_DST_DROP 0x00000200
521+
522+/* match info */
523+struct ipt_pool_info
524+{
525+ ip_pool_t src;
526+ ip_pool_t dst;
527+ unsigned flags;
528+};
529+
530+#endif /*_IPT_POOL_H*/
531diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_psd.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_psd.h
532--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_psd.h 1970-01-01 01:00:00.000000000 +0100
533+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_psd.h 2004-04-15 21:21:10.000000000 +0200
534@@ -0,0 +1,40 @@
535+#ifndef _IPT_PSD_H
536+#define _IPT_PSD_H
537+
538+#include <linux/param.h>
539+#include <linux/types.h>
540+
541+/*
542+ * High port numbers have a lower weight to reduce the frequency of false
543+ * positives, such as from passive mode FTP transfers.
544+ */
545+#define PORT_WEIGHT_PRIV 3
546+#define PORT_WEIGHT_HIGH 1
547+
548+/*
549+ * Port scan detection thresholds: at least COUNT ports need to be scanned
550+ * from the same source, with no longer than DELAY ticks between ports.
551+ */
552+#define SCAN_MIN_COUNT 7
553+#define SCAN_MAX_COUNT (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
554+#define SCAN_WEIGHT_THRESHOLD SCAN_MAX_COUNT
555+#define SCAN_DELAY_THRESHOLD (HZ * 3)
556+
557+/*
558+ * Keep track of up to LIST_SIZE source addresses, using a hash table of
559+ * HASH_SIZE entries for faster lookups, but limiting hash collisions to
560+ * HASH_MAX source addresses per the same hash value.
561+ */
562+#define LIST_SIZE 0x100
563+#define HASH_LOG 9
564+#define HASH_SIZE (1 << HASH_LOG)
565+#define HASH_MAX 0x10
566+
567+struct ipt_psd_info {
568+ unsigned int weight_threshold;
569+ unsigned int delay_threshold;
570+ unsigned short lo_ports_weight;
571+ unsigned short hi_ports_weight;
572+};
573+
574+#endif /*_IPT_PSD_H*/
575diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_quota.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_quota.h
576--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_quota.h 1970-01-01 01:00:00.000000000 +0100
577+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_quota.h 2004-04-15 21:21:16.000000000 +0200
578@@ -0,0 +1,11 @@
579+#ifndef _IPT_QUOTA_H
580+#define _IPT_QUOTA_H
581+
582+/* print debug info in both kernel/netfilter module & iptable library */
583+//#define DEBUG_IPT_QUOTA
584+
585+struct ipt_quota_info {
586+ u_int64_t quota;
587+};
588+
589+#endif /*_IPT_QUOTA_H*/
590diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_random.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_random.h
591--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_random.h 1970-01-01 01:00:00.000000000 +0100
592+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_random.h 2004-04-15 21:21:18.000000000 +0200
593@@ -0,0 +1,11 @@
594+#ifndef _IPT_RAND_H
595+#define _IPT_RAND_H
596+
597+#include <linux/param.h>
598+#include <linux/types.h>
599+
600+struct ipt_rand_info {
601+ u_int8_t average;
602+};
603+
604+#endif /*_IPT_RAND_H*/
605diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_realm.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_realm.h
606--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_realm.h 1970-01-01 01:00:00.000000000 +0100
607+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_realm.h 2004-04-15 21:21:22.000000000 +0200
608@@ -0,0 +1,9 @@
609+#ifndef _IPT_REALM_H
610+#define _IPT_REALM_H
611+
612+struct ipt_realm_info {
613+ u_int32_t id;
614+ u_int32_t mask;
615+ u_int8_t invert;
616+};
617+#endif /*_IPT_REALM_H*/
618diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_sctp.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_sctp.h
619--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_sctp.h 1970-01-01 01:00:00.000000000 +0100
620+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_sctp.h 2004-04-15 21:21:23.000000000 +0200
621@@ -0,0 +1,107 @@
622+#ifndef _IPT_SCTP_H_
623+#define _IPT_SCTP_H_
624+
625+#define IPT_SCTP_SRC_PORTS 0x01
626+#define IPT_SCTP_DEST_PORTS 0x02
627+#define IPT_SCTP_CHUNK_TYPES 0x04
628+
629+#define IPT_SCTP_VALID_FLAGS 0x07
630+
631+#define ELEMCOUNT(x) (sizeof(x)/sizeof(x[0]))
632+
633+
634+struct ipt_sctp_flag_info {
635+ u_int8_t chunktype;
636+ u_int8_t flag;
637+ u_int8_t flag_mask;
638+};
639+
640+#define IPT_NUM_SCTP_FLAGS 4
641+
642+struct ipt_sctp_info {
643+ u_int16_t dpts[2]; /* Min, Max */
644+ u_int16_t spts[2]; /* Min, Max */
645+
646+ u_int32_t chunkmap[256 / sizeof (u_int32_t)]; /* Bit mask of chunks to be matched according to RFC 2960 */
647+
648+#define SCTP_CHUNK_MATCH_ANY 0x01 /* Match if any of the chunk types are present */
649+#define SCTP_CHUNK_MATCH_ALL 0x02 /* Match if all of the chunk types are present */
650+#define SCTP_CHUNK_MATCH_ONLY 0x04 /* Match if these are the only chunk types present */
651+
652+ u_int32_t chunk_match_type;
653+ struct ipt_sctp_flag_info flag_info[IPT_NUM_SCTP_FLAGS];
654+ int flag_count;
655+
656+ u_int32_t flags;
657+ u_int32_t invflags;
658+};
659+
660+#define bytes(type) (sizeof(type) * 8)
661+
662+#define SCTP_CHUNKMAP_SET(chunkmap, type) \
663+ do { \
664+ chunkmap[type / bytes(u_int32_t)] |= \
665+ 1 << (type % bytes(u_int32_t)); \
666+ } while (0)
667+
668+#define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \
669+ do { \
670+ chunkmap[type / bytes(u_int32_t)] &= \
671+ ~(1 << (type % bytes(u_int32_t))); \
672+ } while (0)
673+
674+#define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \
675+({ \
676+ (chunkmap[type / bytes (u_int32_t)] & \
677+ (1 << (type % bytes (u_int32_t)))) ? 1: 0; \
678+})
679+
680+#define SCTP_CHUNKMAP_RESET(chunkmap) \
681+ do { \
682+ int i; \
683+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
684+ chunkmap[i] = 0; \
685+ } while (0)
686+
687+#define SCTP_CHUNKMAP_SET_ALL(chunkmap) \
688+ do { \
689+ int i; \
690+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
691+ chunkmap[i] = ~0; \
692+ } while (0)
693+
694+#define SCTP_CHUNKMAP_COPY(destmap, srcmap) \
695+ do { \
696+ int i; \
697+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) \
698+ destmap[i] = srcmap[i]; \
699+ } while (0)
700+
701+#define SCTP_CHUNKMAP_IS_CLEAR(chunkmap) \
702+({ \
703+ int i; \
704+ int flag = 1; \
705+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) { \
706+ if (chunkmap[i]) { \
707+ flag = 0; \
708+ break; \
709+ } \
710+ } \
711+ flag; \
712+})
713+
714+#define SCTP_CHUNKMAP_IS_ALL_SET(chunkmap) \
715+({ \
716+ int i; \
717+ int flag = 1; \
718+ for (i = 0; i < ELEMCOUNT(chunkmap); i++) { \
719+ if (chunkmap[i] != ~0) { \
720+ flag = 0; \
721+ break; \
722+ } \
723+ } \
724+ flag; \
725+})
726+
727+#endif /* _IPT_SCTP_H_ */
728+
729diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_state.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_state.h
730--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_state.h 2004-04-15 03:35:37.000000000 +0200
731+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_state.h 2004-04-15 21:21:20.000000000 +0200
732@@ -4,6 +4,8 @@
733 #define IPT_STATE_BIT(ctinfo) (1 << ((ctinfo)%IP_CT_IS_REPLY+1))
734 #define IPT_STATE_INVALID (1 << 0)
735
736+#define IPT_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 1))
737+
738 struct ipt_state_info
739 {
740 unsigned int statemask;
741diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_time.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_time.h
742--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_time.h 1970-01-01 01:00:00.000000000 +0100
743+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_time.h 2004-04-15 21:21:26.000000000 +0200
744@@ -0,0 +1,13 @@
745+#ifndef __ipt_time_h_included__
746+#define __ipt_time_h_included__
747+
748+
749+struct ipt_time_info {
750+ u_int8_t days_match; /* 1 bit per day. -SMTWTFS */
751+ u_int16_t time_start; /* 0 < time_start < 23*60+59 = 1439 */
752+ u_int16_t time_stop; /* 0:0 < time_stat < 23:59 */
753+ u_int8_t kerneltime; /* ignore skb time (and use kerneltime) or not. */
754+};
755+
756+
757+#endif /* __ipt_time_h_included__ */
758diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_u32.h linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_u32.h
759--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4/ipt_u32.h 1970-01-01 01:00:00.000000000 +0100
760+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4/ipt_u32.h 2004-04-15 21:21:29.000000000 +0200
761@@ -0,0 +1,40 @@
762+#ifndef _IPT_U32_H
763+#define _IPT_U32_H
764+#include <linux/netfilter_ipv4/ip_tables.h>
765+
766+enum ipt_u32_ops
767+{
768+ IPT_U32_AND,
769+ IPT_U32_LEFTSH,
770+ IPT_U32_RIGHTSH,
771+ IPT_U32_AT
772+};
773+
774+struct ipt_u32_location_element
775+{
776+ u_int32_t number;
777+ u_int8_t nextop;
778+};
779+struct ipt_u32_value_element
780+{
781+ u_int32_t min;
782+ u_int32_t max;
783+};
784+/* *** any way to allow for an arbitrary number of elements?
785+ for now I settle for a limit of 10 of each */
786+#define U32MAXSIZE 10
787+struct ipt_u32_test
788+{
789+ u_int8_t nnums;
790+ struct ipt_u32_location_element location[U32MAXSIZE+1];
791+ u_int8_t nvalues;
792+ struct ipt_u32_value_element value[U32MAXSIZE+1];
793+};
794+
795+struct ipt_u32
796+{
797+ u_int8_t ntests;
798+ struct ipt_u32_test tests[U32MAXSIZE+1];
799+};
800+
801+#endif /*_IPT_U32_H*/
802diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv4.h linux-2.6.6-rc1/include/linux/netfilter_ipv4.h
803--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv4.h 2004-04-15 03:35:36.000000000 +0200
804+++ linux-2.6.6-rc1/include/linux/netfilter_ipv4.h 2004-04-15 21:21:20.000000000 +0200
805@@ -51,6 +51,8 @@
806
807 enum nf_ip_hook_priorities {
808 NF_IP_PRI_FIRST = INT_MIN,
809+ NF_IP_PRI_CONNTRACK_DEFRAG = -400,
810+ NF_IP_PRI_RAW = -300,
811 NF_IP_PRI_SELINUX_FIRST = -225,
812 NF_IP_PRI_CONNTRACK = -200,
813 NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
814diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv6/ip6t_HL.h linux-2.6.6-rc1/include/linux/netfilter_ipv6/ip6t_HL.h
815--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv6/ip6t_HL.h 1970-01-01 01:00:00.000000000 +0100
816+++ linux-2.6.6-rc1/include/linux/netfilter_ipv6/ip6t_HL.h 2004-04-15 21:20:38.000000000 +0200
817@@ -0,0 +1,22 @@
818+/* Hop Limit modification module for ip6tables
819+ * Maciej Soltysiak <solt@dns.toxicfilms.tv>
820+ * Based on HW's TTL module */
821+
822+#ifndef _IP6T_HL_H
823+#define _IP6T_HL_H
824+
825+enum {
826+ IP6T_HL_SET = 0,
827+ IP6T_HL_INC,
828+ IP6T_HL_DEC
829+};
830+
831+#define IP6T_HL_MAXMODE IP6T_HL_DEC
832+
833+struct ip6t_HL_info {
834+ u_int8_t mode;
835+ u_int8_t hop_limit;
836+};
837+
838+
839+#endif
840diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv6/ip6t_REJECT.h linux-2.6.6-rc1/include/linux/netfilter_ipv6/ip6t_REJECT.h
841--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv6/ip6t_REJECT.h 2004-04-15 03:33:49.000000000 +0200
842+++ linux-2.6.6-rc1/include/linux/netfilter_ipv6/ip6t_REJECT.h 2004-04-15 21:20:47.000000000 +0200
843@@ -2,15 +2,17 @@
844 #define _IP6T_REJECT_H
845
846 enum ip6t_reject_with {
847- IP6T_ICMP_NET_UNREACHABLE,
848- IP6T_ICMP_HOST_UNREACHABLE,
849- IP6T_ICMP_PROT_UNREACHABLE,
850- IP6T_ICMP_PORT_UNREACHABLE,
851- IP6T_ICMP_ECHOREPLY
852+ IP6T_ICMP6_NO_ROUTE,
853+ IP6T_ICMP6_ADM_PROHIBITED,
854+ IP6T_ICMP6_NOT_NEIGHBOUR,
855+ IP6T_ICMP6_ADDR_UNREACH,
856+ IP6T_ICMP6_PORT_UNREACH,
857+ IP6T_ICMP6_ECHOREPLY,
858+ IP6T_TCP_RESET
859 };
860
861 struct ip6t_reject_info {
862 enum ip6t_reject_with with; /* reject type */
863 };
864
865-#endif /*_IPT_REJECT_H*/
866+#endif /*_IP6T_REJECT_H*/
867diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv6/ip6t_fuzzy.h linux-2.6.6-rc1/include/linux/netfilter_ipv6/ip6t_fuzzy.h
868--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv6/ip6t_fuzzy.h 1970-01-01 01:00:00.000000000 +0100
869+++ linux-2.6.6-rc1/include/linux/netfilter_ipv6/ip6t_fuzzy.h 2004-04-15 21:20:59.000000000 +0200
870@@ -0,0 +1,21 @@
871+#ifndef _IP6T_FUZZY_H
872+#define _IP6T_FUZZY_H
873+
874+#include <linux/param.h>
875+#include <linux/types.h>
876+
877+#define MAXFUZZYRATE 10000000
878+#define MINFUZZYRATE 3
879+
880+struct ip6t_fuzzy_info {
881+ u_int32_t minimum_rate;
882+ u_int32_t maximum_rate;
883+ u_int32_t packets_total;
884+ u_int32_t bytes_total;
885+ u_int32_t previous_time;
886+ u_int32_t present_time;
887+ u_int32_t mean_rate;
888+ u_int8_t acceptance_rate;
889+};
890+
891+#endif /*_IP6T_FUZZY_H*/
892diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv6/ip6t_nth.h linux-2.6.6-rc1/include/linux/netfilter_ipv6/ip6t_nth.h
893--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv6/ip6t_nth.h 1970-01-01 01:00:00.000000000 +0100
894+++ linux-2.6.6-rc1/include/linux/netfilter_ipv6/ip6t_nth.h 2004-04-15 21:21:05.000000000 +0200
895@@ -0,0 +1,19 @@
896+#ifndef _IP6T_NTH_H
897+#define _IP6T_NTH_H
898+
899+#include <linux/param.h>
900+#include <linux/types.h>
901+
902+#ifndef IP6T_NTH_NUM_COUNTERS
903+#define IP6T_NTH_NUM_COUNTERS 16
904+#endif
905+
906+struct ip6t_nth_info {
907+ u_int8_t every;
908+ u_int8_t not;
909+ u_int8_t startat;
910+ u_int8_t counter;
911+ u_int8_t packet;
912+};
913+
914+#endif /*_IP6T_NTH_H*/
915diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/netfilter_ipv6/ip6t_random.h linux-2.6.6-rc1/include/linux/netfilter_ipv6/ip6t_random.h
916--- linux-2.6.6-rc1.org/include/linux/netfilter_ipv6/ip6t_random.h 1970-01-01 01:00:00.000000000 +0100
917+++ linux-2.6.6-rc1/include/linux/netfilter_ipv6/ip6t_random.h 2004-04-15 21:21:18.000000000 +0200
918@@ -0,0 +1,11 @@
919+#ifndef _IP6T_RAND_H
920+#define _IP6T_RAND_H
921+
922+#include <linux/param.h>
923+#include <linux/types.h>
924+
925+struct ip6t_rand_info {
926+ u_int8_t average;
927+};
928+
929+#endif /*_IP6T_RAND_H*/
930diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/include/linux/skbuff.h linux-2.6.6-rc1/include/linux/skbuff.h
931--- linux-2.6.6-rc1.org/include/linux/skbuff.h 2004-04-15 03:35:04.000000000 +0200
932+++ linux-2.6.6-rc1/include/linux/skbuff.h 2004-04-15 21:20:34.000000000 +0200
933@@ -1201,6 +1201,14 @@
934 if (nfct)
935 atomic_inc(&nfct->master->use);
936 }
937+static inline void nf_reset(struct sk_buff *skb)
938+{
939+ nf_conntrack_put(skb->nfct);
940+ skb->nfct = NULL;
941+#ifdef CONFIG_NETFILTER_DEBUG
942+ skb->nf_debug = 0;
943+#endif
944+}
945
946 #ifdef CONFIG_BRIDGE_NETFILTER
947 static inline void nf_bridge_put(struct nf_bridge_info *nf_bridge)
948@@ -1213,9 +1221,10 @@
949 if (nf_bridge)
950 atomic_inc(&nf_bridge->use);
951 }
952-#endif
953-
954-#endif
955+#endif /* CONFIG_BRIDGE_NETFILTER */
956+#else /* CONFIG_NETFILTER */
957+static inline void nf_reset(struct sk_buff *skb) {}
958+#endif /* CONFIG_NETFILTER */
959
960 #endif /* __KERNEL__ */
961 #endif /* _LINUX_SKBUFF_H */
962diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/core/netfilter.c linux-2.6.6-rc1/net/core/netfilter.c
963--- linux-2.6.6-rc1.org/net/core/netfilter.c 2004-04-15 03:34:47.000000000 +0200
964+++ linux-2.6.6-rc1/net/core/netfilter.c 2004-04-15 21:20:33.000000000 +0200
965@@ -8,8 +8,10 @@
966 *
967 * February 2000: Modified by James Morris to have 1 queue per protocol.
968 * 15-Mar-2000: Added NF_REPEAT --RR.
969+ * 08-May-2003: Internal logging interface added by Jozsef Kadlecsik.
970 */
971 #include <linux/config.h>
972+#include <linux/kernel.h>
973 #include <linux/netfilter.h>
974 #include <net/protocol.h>
975 #include <linux/init.h>
976@@ -741,6 +743,72 @@
977 EXPORT_SYMBOL(skb_ip_make_writable);
978 #endif /*CONFIG_INET*/
979
980+/* Internal logging interface, which relies on the real
981+ LOG target modules */
982+
983+#define NF_LOG_PREFIXLEN 128
984+
985+static nf_logfn *nf_logging[NPROTO]; /* = NULL */
986+static int reported = 0;
987+static spinlock_t nf_log_lock = SPIN_LOCK_UNLOCKED;
988+
989+int nf_log_register(int pf, nf_logfn *logfn)
990+{
991+ int ret = -EBUSY;
992+
993+ /* Any setup of logging members must be done before
994+ * substituting pointer. */
995+ smp_wmb();
996+ spin_lock(&nf_log_lock);
997+ if (!nf_logging[pf]) {
998+ nf_logging[pf] = logfn;
999+ ret = 0;
1000+ }
1001+ spin_unlock(&nf_log_lock);
1002+ return ret;
1003+}
1004+
1005+void nf_log_unregister(int pf, nf_logfn *logfn)
1006+{
1007+ spin_lock(&nf_log_lock);
1008+ if (nf_logging[pf] == logfn)
1009+ nf_logging[pf] = NULL;
1010+ spin_unlock(&nf_log_lock);
1011+
1012+ /* Give time to concurrent readers. */
1013+ synchronize_net();
1014+}
1015+
1016+void nf_log_packet(int pf,
1017+ unsigned int hooknum,
1018+ const struct sk_buff *skb,
1019+ const struct net_device *in,
1020+ const struct net_device *out,
1021+ const char *fmt, ...)
1022+{
1023+ va_list args;
1024+ char prefix[NF_LOG_PREFIXLEN];
1025+ nf_logfn *logfn;
1026+
1027+ rcu_read_lock();
1028+ logfn = nf_logging[pf];
1029+ if (logfn) {
1030+ va_start(args, fmt);
1031+ vsnprintf(prefix, sizeof(prefix), fmt, args);
1032+ va_end(args);
1033+ /* We must read logging before nf_logfn[pf] */
1034+ smp_read_barrier_depends();
1035+ logfn(hooknum, skb, in, out, prefix);
1036+ } else if (!reported) {
1037+ printk(KERN_WARNING "nf_log_packet: can\'t log yet, "
1038+ "no backend logging module loaded in!\n");
1039+ reported++;
1040+ }
1041+ rcu_read_unlock();
1042+}
1043+EXPORT_SYMBOL(nf_log_register);
1044+EXPORT_SYMBOL(nf_log_unregister);
1045+EXPORT_SYMBOL(nf_log_packet);
1046
1047 /* This does not belong here, but ipt_REJECT needs it if connection
1048 tracking in use: without this, connection may not be in hash table,
1049diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/ip_gre.c linux-2.6.6-rc1/net/ipv4/ip_gre.c
1050--- linux-2.6.6-rc1.org/net/ipv4/ip_gre.c 2004-04-15 03:35:20.000000000 +0200
1051+++ linux-2.6.6-rc1/net/ipv4/ip_gre.c 2004-04-15 21:20:34.000000000 +0200
1052@@ -643,13 +643,7 @@
1053 skb->dev = tunnel->dev;
1054 dst_release(skb->dst);
1055 skb->dst = NULL;
1056-#ifdef CONFIG_NETFILTER
1057- nf_conntrack_put(skb->nfct);
1058- skb->nfct = NULL;
1059-#ifdef CONFIG_NETFILTER_DEBUG
1060- skb->nf_debug = 0;
1061-#endif
1062-#endif
1063+ nf_reset(skb);
1064 ipgre_ecn_decapsulate(iph, skb);
1065 netif_rx(skb);
1066 read_unlock(&ipgre_lock);
1067@@ -877,13 +871,7 @@
1068 }
1069 }
1070
1071-#ifdef CONFIG_NETFILTER
1072- nf_conntrack_put(skb->nfct);
1073- skb->nfct = NULL;
1074-#ifdef CONFIG_NETFILTER_DEBUG
1075- skb->nf_debug = 0;
1076-#endif
1077-#endif
1078+ nf_reset(skb);
1079
1080 IPTUNNEL_XMIT();
1081 tunnel->recursion--;
1082diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/ip_input.c linux-2.6.6-rc1/net/ipv4/ip_input.c
1083--- linux-2.6.6-rc1.org/net/ipv4/ip_input.c 2004-04-15 03:33:53.000000000 +0200
1084+++ linux-2.6.6-rc1/net/ipv4/ip_input.c 2004-04-15 21:20:34.000000000 +0200
1085@@ -202,17 +202,13 @@
1086
1087 #ifdef CONFIG_NETFILTER_DEBUG
1088 nf_debug_ip_local_deliver(skb);
1089- skb->nf_debug = 0;
1090 #endif /*CONFIG_NETFILTER_DEBUG*/
1091
1092 __skb_pull(skb, ihl);
1093
1094-#ifdef CONFIG_NETFILTER
1095 /* Free reference early: we don't need it any more, and it may
1096 hold ip_conntrack module loaded indefinitely. */
1097- nf_conntrack_put(skb->nfct);
1098- skb->nfct = NULL;
1099-#endif /*CONFIG_NETFILTER*/
1100+ nf_reset(skb);
1101
1102 /* Point into the IP datagram, just past the header. */
1103 skb->h.raw = skb->data;
1104diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/ipip.c linux-2.6.6-rc1/net/ipv4/ipip.c
1105--- linux-2.6.6-rc1.org/net/ipv4/ipip.c 2004-04-15 03:36:03.000000000 +0200
1106+++ linux-2.6.6-rc1/net/ipv4/ipip.c 2004-04-15 21:20:34.000000000 +0200
1107@@ -496,13 +496,7 @@
1108 skb->dev = tunnel->dev;
1109 dst_release(skb->dst);
1110 skb->dst = NULL;
1111-#ifdef CONFIG_NETFILTER
1112- nf_conntrack_put(skb->nfct);
1113- skb->nfct = NULL;
1114-#ifdef CONFIG_NETFILTER_DEBUG
1115- skb->nf_debug = 0;
1116-#endif
1117-#endif
1118+ nf_reset(skb);
1119 ipip_ecn_decapsulate(iph, skb);
1120 netif_rx(skb);
1121 read_unlock(&ipip_lock);
1122@@ -647,13 +641,7 @@
1123 if ((iph->ttl = tiph->ttl) == 0)
1124 iph->ttl = old_iph->ttl;
1125
1126-#ifdef CONFIG_NETFILTER
1127- nf_conntrack_put(skb->nfct);
1128- skb->nfct = NULL;
1129-#ifdef CONFIG_NETFILTER_DEBUG
1130- skb->nf_debug = 0;
1131-#endif
1132-#endif
1133+ nf_reset(skb);
1134
1135 IPTUNNEL_XMIT();
1136 tunnel->recursion--;
1137diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/Kconfig linux-2.6.6-rc1/net/ipv4/netfilter/Kconfig
1138--- linux-2.6.6-rc1.org/net/ipv4/netfilter/Kconfig 2004-04-15 03:35:36.000000000 +0200
1139+++ linux-2.6.6-rc1/net/ipv4/netfilter/Kconfig 2004-04-15 21:21:29.000000000 +0200
1140@@ -579,5 +579,123 @@
1141
1142 To compile it as a module, choose M here. If unsure, say N.
1143
1144+config IP_NF_TARGET_IPV4OPTSSTRIP
1145+ tristate 'IPV4OPTSSTRIP target support'
1146+ depends on IP_NF_MANGLE
1147+ help
1148+
1149+config IP_NF_TARGET_NETLINK
1150+ tristate 'NETLINK target support'
1151+ depends on IP_NF_FILTER
1152+ help
1153+
1154+config IP_NF_TARGET_TTL
1155+ tristate 'TTL target support'
1156+ depends on IP_NF_MANGLE
1157+ help
1158+
1159+config IP_NF_MATCH_CONNLIMIT
1160+ tristate 'Connections/IP limit match support'
1161+ depends on IP_NF_IPTABLES
1162+ help
1163+
1164+config IP_NF_MATCH_DSTLIMIT
1165+ tristate 'dstlimit match support'
1166+ depends on IP_NF_IPTABLES
1167+ help
1168+
1169+config IP_NF_MATCH_FUZZY
1170+ tristate 'fuzzy match support'
1171+ depends on IP_NF_IPTABLES
1172+ help
1173+
1174+config IP_NF_MATCH_IPV4OPTIONS
1175+ tristate 'IPV4OPTIONS match support'
1176+ depends on IP_NF_IPTABLES
1177+ help
1178+
1179+config IP_NF_MATCH_MPORT
1180+ tristate 'Multiple port with ranges match support'
1181+ depends on IP_NF_IPTABLES
1182+ help
1183+
1184+config IP_NF_MATCH_NTH
1185+ tristate 'Nth match support'
1186+ depends on IP_NF_IPTABLES
1187+ help
1188+
1189+config IP_NF_MATCH_OSF
1190+ tristate 'OSF match support'
1191+ depends on IP_NF_IPTABLES
1192+ help
1193+
1194+config IP_POOL_STATISTICS
1195+ bool 'enable statistics on pool usage'
1196+ depends on IP_NF_POOL!=n
1197+
1198+config IP_NF_POOL
1199+ tristate 'IP address pool support'
1200+ depends on IP_NF_IPTABLES
1201+ help
1202+
1203+config IP_NF_MATCH_PSD
1204+ tristate 'psd match support'
1205+ depends on IP_NF_IPTABLES
1206+ help
1207+
1208+config IP_NF_MATCH_QUOTA
1209+ tristate 'quota match support'
1210+ depends on IP_NF_IPTABLES
1211+ help
1212+
1213+config IP_NF_MATCH_RANDOM
1214+ tristate 'random match support'
1215+ depends on IP_NF_IPTABLES
1216+ help
1217+
1218+config IP_NF_TARGET_NOTRACK
1219+ tristate 'NOTRACK target support'
1220+ depends on IP_NF_RAW
1221+ help
1222+ The NOTRACK target allows a select rule to specify
1223+ which packets *not* to enter the conntrack/NAT
1224+ subsystem with all the consequences (no ICMP error tracking,
1225+ no protocol helpers for the selected packets).
1226+
1227+ If you want to compile it as a module, say M here and read
1228+ <file:Documentation/modules.txt>. If unsure, say `N'.
1229+
1230+config IP_NF_RAW
1231+ tristate 'raw table support (required for NOTRACK/TRACE)'
1232+ depends on IP_NF_IPTABLES
1233+ help
1234+ This option adds a `raw' table to iptables. This table is the very
1235+ first in the netfilter framework and hooks in at the PREROUTING
1236+ and OUTPUT chains.
1237+
1238+ If you want to compile it as a module, say M here and read
1239+ <file:Documentation/modules.txt>. If unsure, say `N'.
1240+ help
1241+
1242+config IP_NF_MATCH_REALM
1243+ tristate 'realm match support'
1244+ depends on IP_NF_IPTABLES && NET_CLS_ROUTE
1245+ help
1246+
1247+config IP_NF_MATCH_SCTP
1248+ tristate 'SCTP protocol match support'
1249+ depends on IP_NF_IPTABLES
1250+ help
1251+
1252+config IP_NF_MATCH_TIME
1253+ tristate 'TIME match support'
1254+ depends on IP_NF_IPTABLES
1255+ help
1256+
1257+config IP_NF_MATCH_U32
1258+ tristate 'U32 match support'
1259+ depends on IP_NF_IPTABLES
1260+ help
1261+
1262 endmenu
1263
1264diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/Makefile linux-2.6.6-rc1/net/ipv4/netfilter/Makefile
1265--- linux-2.6.6-rc1.org/net/ipv4/netfilter/Makefile 2004-04-15 03:34:03.000000000 +0200
1266+++ linux-2.6.6-rc1/net/ipv4/netfilter/Makefile 2004-04-15 21:21:29.000000000 +0200
1267@@ -38,19 +38,44 @@
1268 obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
1269 obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
1270 obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
1271+obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
1272
1273 # matches
1274 obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
1275 obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
1276+obj-$(CONFIG_IP_NF_MATCH_SCTP) += ipt_sctp.o
1277+obj-$(CONFIG_IP_NF_MATCH_QUOTA) += ipt_quota.o
1278+obj-$(CONFIG_IP_NF_MATCH_DSTLIMIT) += ipt_dstlimit.o
1279 obj-$(CONFIG_IP_NF_MATCH_MARK) += ipt_mark.o
1280+obj-$(CONFIG_IP_NF_POOL) += ipt_pool.o ipt_POOL.o ip_pool.o
1281 obj-$(CONFIG_IP_NF_MATCH_MAC) += ipt_mac.o
1282 obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
1283
1284 obj-$(CONFIG_IP_NF_MATCH_PKTTYPE) += ipt_pkttype.o
1285 obj-$(CONFIG_IP_NF_MATCH_MULTIPORT) += ipt_multiport.o
1286+
1287+obj-$(CONFIG_IP_NF_MATCH_MPORT) += ipt_mport.o
1288+
1289 obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
1290 obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
1291
1292+obj-$(CONFIG_IP_NF_MATCH_TIME) += ipt_time.o
1293+
1294+
1295+obj-$(CONFIG_IP_NF_MATCH_RANDOM) += ipt_random.o
1296+
1297+obj-$(CONFIG_IP_NF_MATCH_PSD) += ipt_psd.o
1298+
1299+obj-$(CONFIG_IP_NF_MATCH_OSF) += ipt_osf.o
1300+
1301+
1302+obj-$(CONFIG_IP_NF_MATCH_NTH) += ipt_nth.o
1303+
1304+obj-$(CONFIG_IP_NF_MATCH_IPV4OPTIONS) += ipt_ipv4options.o
1305+
1306+
1307+obj-$(CONFIG_IP_NF_MATCH_FUZZY) += ipt_fuzzy.o
1308+
1309 obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
1310
1311 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
1312@@ -59,10 +84,15 @@
1313
1314 obj-$(CONFIG_IP_NF_MATCH_LENGTH) += ipt_length.o
1315
1316+obj-$(CONFIG_IP_NF_MATCH_U32) += ipt_u32.o
1317+
1318+
1319 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
1320 obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
1321+obj-$(CONFIG_IP_NF_MATCH_CONNLIMIT) += ipt_connlimit.o
1322 obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
1323 obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
1324+obj-$(CONFIG_IP_NF_MATCH_REALM) += ipt_realm.o
1325
1326 obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o
1327
1328@@ -79,8 +109,12 @@
1329 obj-$(CONFIG_IP_NF_TARGET_CLASSIFY) += ipt_CLASSIFY.o
1330 obj-$(CONFIG_IP_NF_NAT_SNMP_BASIC) += ip_nat_snmp_basic.o
1331 obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
1332+obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
1333+obj-$(CONFIG_IP_NF_TARGET_NETLINK) += ipt_NETLINK.o
1334+obj-$(CONFIG_IP_NF_TARGET_IPV4OPTSSTRIP) += ipt_IPV4OPTSSTRIP.o
1335 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
1336 obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
1337+obj-$(CONFIG_IP_NF_TARGET_NOTRACK) += ipt_NOTRACK.o
1338
1339 # generic ARP tables
1340 obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
1341diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ip_conntrack_core.c linux-2.6.6-rc1/net/ipv4/netfilter/ip_conntrack_core.c
1342--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ip_conntrack_core.c 2004-04-15 03:33:47.000000000 +0200
1343+++ linux-2.6.6-rc1/net/ipv4/netfilter/ip_conntrack_core.c 2004-04-15 21:21:20.000000000 +0200
1344@@ -67,6 +67,7 @@
1345 static atomic_t ip_conntrack_count = ATOMIC_INIT(0);
1346 struct list_head *ip_conntrack_hash;
1347 static kmem_cache_t *ip_conntrack_cachep;
1348+struct ip_conntrack ip_conntrack_untracked;
1349
1350 extern struct ip_conntrack_protocol ip_conntrack_generic_protocol;
1351
1352@@ -691,42 +692,50 @@
1353 struct ip_conntrack_expect *, tuple);
1354 READ_UNLOCK(&ip_conntrack_expect_tuple_lock);
1355
1356- /* If master is not in hash table yet (ie. packet hasn't left
1357- this machine yet), how can other end know about expected?
1358- Hence these are not the droids you are looking for (if
1359- master ct never got confirmed, we'd hold a reference to it
1360- and weird things would happen to future packets). */
1361- if (expected && !is_confirmed(expected->expectant))
1362- expected = NULL;
1363-
1364- /* Look up the conntrack helper for master connections only */
1365- if (!expected)
1366- conntrack->helper = ip_ct_find_helper(&repl_tuple);
1367-
1368- /* If the expectation is dying, then this is a loser. */
1369- if (expected
1370- && expected->expectant->helper->timeout
1371- && ! del_timer(&expected->timeout))
1372- expected = NULL;
1373-
1374 if (expected) {
1375- DEBUGP("conntrack: expectation arrives ct=%p exp=%p\n",
1376- conntrack, expected);
1377- /* Welcome, Mr. Bond. We've been expecting you... */
1378- IP_NF_ASSERT(master_ct(conntrack));
1379- __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
1380- conntrack->master = expected;
1381- expected->sibling = conntrack;
1382- LIST_DELETE(&ip_conntrack_expect_list, expected);
1383- expected->expectant->expecting--;
1384- nf_conntrack_get(&master_ct(conntrack)->infos[0]);
1385- }
1386- atomic_inc(&ip_conntrack_count);
1387+ /* If master is not in hash table yet (ie. packet hasn't left
1388+ this machine yet), how can other end know about expected?
1389+ Hence these are not the droids you are looking for (if
1390+ master ct never got confirmed, we'd hold a reference to it
1391+ and weird things would happen to future packets). */
1392+ if (!is_confirmed(expected->expectant)) {
1393+
1394+ conntrack->helper = ip_ct_find_helper(&repl_tuple);
1395+ goto end;
1396+ }
1397+
1398+ /* Expectation is dying... */
1399+ if (expected->expectant->helper->timeout
1400+ && ! del_timer(&expected->timeout)) {
1401+ goto end;
1402+ }
1403+
1404+ DEBUGP("conntrack: expectation arrives ct=%p exp=%p\n",
1405+ conntrack, expected);
1406+ /* Welcome, Mr. Bond. We've been expecting you... */
1407+ IP_NF_ASSERT(master_ct(conntrack));
1408+ __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
1409+ conntrack->master = expected;
1410+ expected->sibling = conntrack;
1411+ LIST_DELETE(&ip_conntrack_expect_list, expected);
1412+ expected->expectant->expecting--;
1413+ nf_conntrack_get(&master_ct(conntrack)->infos[0]);
1414+
1415+ /* this is a braindead... --pablo */
1416+ atomic_inc(&ip_conntrack_count);
1417+ WRITE_UNLOCK(&ip_conntrack_lock);
1418+
1419+ if (expected->expectfn)
1420+ expected->expectfn(conntrack);
1421+
1422+ goto ret;
1423+ } else
1424+ conntrack->helper = ip_ct_find_helper(&repl_tuple);
1425+
1426+end: atomic_inc(&ip_conntrack_count);
1427 WRITE_UNLOCK(&ip_conntrack_lock);
1428
1429- if (expected && expected->expectfn)
1430- expected->expectfn(conntrack);
1431- return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
1432+ret: return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
1433 }
1434
1435 /* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
1436@@ -794,6 +803,15 @@
1437 int set_reply;
1438 int ret;
1439
1440+ /* Never happen */
1441+ if ((*pskb)->nh.iph->frag_off & htons(IP_OFFSET)) {
1442+ if (net_ratelimit()) {
1443+ printk(KERN_ERR "ip_conntrack_in: Frag of proto %u (hook=%u)\n",
1444+ (*pskb)->nh.iph->protocol, hooknum);
1445+ }
1446+ return NF_DROP;
1447+ }
1448+
1449 /* FIXME: Do this right please. --RR */
1450 (*pskb)->nfcache |= NFC_UNKNOWN;
1451
1452@@ -812,18 +830,10 @@
1453 }
1454 #endif
1455
1456- /* Previously seen (loopback)? Ignore. Do this before
1457- fragment check. */
1458+ /* Previously seen (loopback or untracked)? Ignore. */
1459 if ((*pskb)->nfct)
1460 return NF_ACCEPT;
1461
1462- /* Gather fragments. */
1463- if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
1464- *pskb = ip_ct_gather_frags(*pskb);
1465- if (!*pskb)
1466- return NF_STOLEN;
1467- }
1468-
1469 proto = ip_ct_find_proto((*pskb)->nh.iph->protocol);
1470
1471 /* It may be an icmp error... */
1472@@ -1422,6 +1432,18 @@
1473
1474 /* For use by ipt_REJECT */
1475 ip_ct_attach = ip_conntrack_attach;
1476+
1477+ /* Set up fake conntrack:
1478+ - to never be deleted, not in any hashes */
1479+ atomic_set(&ip_conntrack_untracked.ct_general.use, 1);
1480+ /* - and look it like as a confirmed connection */
1481+ set_bit(IPS_CONFIRMED_BIT, &ip_conntrack_untracked.status);
1482+ /* - and prepare the ctinfo field for REJECT & NAT. */
1483+ ip_conntrack_untracked.infos[IP_CT_NEW].master =
1484+ ip_conntrack_untracked.infos[IP_CT_RELATED].master =
1485+ ip_conntrack_untracked.infos[IP_CT_RELATED + IP_CT_IS_REPLY].master =
1486+ &ip_conntrack_untracked.ct_general;
1487+
1488 return ret;
1489
1490 err_free_hash:
1491diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.6.6-rc1/net/ipv4/netfilter/ip_conntrack_standalone.c
1492--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-04-15 03:34:37.000000000 +0200
1493+++ linux-2.6.6-rc1/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-04-15 21:21:20.000000000 +0200
1494@@ -194,6 +194,26 @@
1495 return ip_conntrack_confirm(*pskb);
1496 }
1497
1498+static unsigned int ip_conntrack_defrag(unsigned int hooknum,
1499+ struct sk_buff **pskb,
1500+ const struct net_device *in,
1501+ const struct net_device *out,
1502+ int (*okfn)(struct sk_buff *))
1503+{
1504+ /* Previously seen (loopback)? Ignore. Do this before
1505+ fragment check. */
1506+ if ((*pskb)->nfct)
1507+ return NF_ACCEPT;
1508+
1509+ /* Gather fragments. */
1510+ if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
1511+ *pskb = ip_ct_gather_frags(*pskb);
1512+ if (!*pskb)
1513+ return NF_STOLEN;
1514+ }
1515+ return NF_ACCEPT;
1516+}
1517+
1518 static unsigned int ip_refrag(unsigned int hooknum,
1519 struct sk_buff **pskb,
1520 const struct net_device *in,
1521@@ -236,6 +256,14 @@
1522
1523 /* Connection tracking may drop packets, but never alters them, so
1524 make it the first hook. */
1525+static struct nf_hook_ops ip_conntrack_defrag_ops = {
1526+ .hook = ip_conntrack_defrag,
1527+ .owner = THIS_MODULE,
1528+ .pf = PF_INET,
1529+ .hooknum = NF_IP_PRE_ROUTING,
1530+ .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
1531+};
1532+
1533 static struct nf_hook_ops ip_conntrack_in_ops = {
1534 .hook = ip_conntrack_in,
1535 .owner = THIS_MODULE,
1536@@ -244,6 +272,14 @@
1537 .priority = NF_IP_PRI_CONNTRACK,
1538 };
1539
1540+static struct nf_hook_ops ip_conntrack_defrag_local_out_ops = {
1541+ .hook = ip_conntrack_defrag,
1542+ .owner = THIS_MODULE,
1543+ .pf = PF_INET,
1544+ .hooknum = NF_IP_LOCAL_OUT,
1545+ .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
1546+};
1547+
1548 static struct nf_hook_ops ip_conntrack_local_out_ops = {
1549 .hook = ip_conntrack_local,
1550 .owner = THIS_MODULE,
1551@@ -470,10 +506,20 @@
1552 if (!proc) goto cleanup_init;
1553 proc->owner = THIS_MODULE;
1554
1555+ ret = nf_register_hook(&ip_conntrack_defrag_ops);
1556+ if (ret < 0) {
1557+ printk("ip_conntrack: can't register pre-routing defrag hook.\n");
1558+ goto cleanup_proc;
1559+ }
1560+ ret = nf_register_hook(&ip_conntrack_defrag_local_out_ops);
1561+ if (ret < 0) {
1562+ printk("ip_conntrack: can't register local_out defrag hook.\n");
1563+ goto cleanup_defragops;
1564+ }
1565 ret = nf_register_hook(&ip_conntrack_in_ops);
1566 if (ret < 0) {
1567 printk("ip_conntrack: can't register pre-routing hook.\n");
1568- goto cleanup_proc;
1569+ goto cleanup_defraglocalops;
1570 }
1571 ret = nf_register_hook(&ip_conntrack_local_out_ops);
1572 if (ret < 0) {
1573@@ -511,6 +557,10 @@
1574 nf_unregister_hook(&ip_conntrack_local_out_ops);
1575 cleanup_inops:
1576 nf_unregister_hook(&ip_conntrack_in_ops);
1577+ cleanup_defraglocalops:
1578+ nf_unregister_hook(&ip_conntrack_defrag_local_out_ops);
1579+ cleanup_defragops:
1580+ nf_unregister_hook(&ip_conntrack_defrag_ops);
1581 cleanup_proc:
1582 proc_net_remove("ip_conntrack");
1583 cleanup_init:
1584@@ -602,5 +652,6 @@
1585 EXPORT_SYMBOL(ip_conntrack_expect_list);
1586 EXPORT_SYMBOL(ip_conntrack_lock);
1587 EXPORT_SYMBOL(ip_conntrack_hash);
1588+EXPORT_SYMBOL(ip_conntrack_untracked);
1589 EXPORT_SYMBOL_GPL(ip_conntrack_find_get);
1590 EXPORT_SYMBOL_GPL(ip_conntrack_put);
1591diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ip_nat_core.c linux-2.6.6-rc1/net/ipv4/netfilter/ip_nat_core.c
1592--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ip_nat_core.c 2004-04-15 03:34:01.000000000 +0200
1593+++ linux-2.6.6-rc1/net/ipv4/netfilter/ip_nat_core.c 2004-04-15 21:21:20.000000000 +0200
1594@@ -1016,6 +1016,10 @@
1595 /* FIXME: Man, this is a hack. <SIGH> */
1596 IP_NF_ASSERT(ip_conntrack_destroyed == NULL);
1597 ip_conntrack_destroyed = &ip_nat_cleanup_conntrack;
1598+
1599+ /* Initialize fake conntrack so that NAT will skip it */
1600+ ip_conntrack_untracked.nat.info.initialized |=
1601+ (1 << IP_NAT_MANIP_SRC) | (1 << IP_NAT_MANIP_DST);
1602
1603 return 0;
1604 }
1605diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ip_pool.c linux-2.6.6-rc1/net/ipv4/netfilter/ip_pool.c
1606--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ip_pool.c 1970-01-01 01:00:00.000000000 +0100
1607+++ linux-2.6.6-rc1/net/ipv4/netfilter/ip_pool.c 2004-04-15 21:21:08.000000000 +0200
1608@@ -0,0 +1,332 @@
1609+/* Kernel module for IP pool management */
1610+
1611+#include <linux/module.h>
1612+#include <linux/ip.h>
1613+#include <linux/skbuff.h>
1614+#include <linux/netfilter_ipv4/ip_tables.h>
1615+#include <linux/netfilter_ipv4/ip_pool.h>
1616+#include <linux/errno.h>
1617+#include <asm/uaccess.h>
1618+#include <asm/bitops.h>
1619+#include <linux/interrupt.h>
1620+#include <linux/spinlock.h>
1621+
1622+#if 0
1623+#define DP printk
1624+#else
1625+#define DP(format, args...)
1626+#endif
1627+
1628+MODULE_LICENSE("GPL");
1629+
1630+#define NR_POOL 16
1631+static int nr_pool = NR_POOL;/* overwrite this when loading module */
1632+
1633+struct ip_pool {
1634+ u_int32_t first_ip; /* host byte order, included in range */
1635+ u_int32_t last_ip; /* host byte order, included in range */
1636+ void *members; /* the bitmap proper */
1637+ int nr_use; /* total nr. of tests through this */
1638+ int nr_match; /* total nr. of matches through this */
1639+ rwlock_t lock;
1640+};
1641+
1642+static struct ip_pool *POOL;
1643+
1644+static inline struct ip_pool *lookup(ip_pool_t index)
1645+{
1646+ if (index < 0 || index >= nr_pool) {
1647+ DP("ip_pool:lookup: bad index %d\n", index);
1648+ return 0;
1649+ }
1650+ return POOL+index;
1651+}
1652+
1653+int ip_pool_match(ip_pool_t index, u_int32_t addr)
1654+{
1655+ struct ip_pool *pool = lookup(index);
1656+ int res = 0;
1657+
1658+ if (!pool || !pool->members)
1659+ return 0;
1660+ read_lock_bh(&pool->lock);
1661+ if (pool->members) {
1662+ if (addr >= pool->first_ip && addr <= pool->last_ip) {
1663+ addr -= pool->first_ip;
1664+ if (test_bit(addr, pool->members)) {
1665+ res = 1;
1666+#ifdef CONFIG_IP_POOL_STATISTICS
1667+ pool->nr_match++;
1668+#endif
1669+ }
1670+ }
1671+#ifdef CONFIG_IP_POOL_STATISTICS
1672+ pool->nr_use++;
1673+#endif
1674+ }
1675+ read_unlock_bh(&pool->lock);
1676+ return res;
1677+}
1678+
1679+static int pool_change(ip_pool_t index, u_int32_t addr, int isdel)
1680+{
1681+ struct ip_pool *pool;
1682+ int res = -1;
1683+
1684+ pool = lookup(index);
1685+ if ( !pool || !pool->members
1686+ || addr < pool->first_ip || addr > pool->last_ip)
1687+ return -1;
1688+ read_lock_bh(&pool->lock);
1689+ if (pool->members && addr >= pool->first_ip && addr <= pool->last_ip) {
1690+ addr -= pool->first_ip;
1691+ res = isdel
1692+ ? (0 != test_and_clear_bit(addr, pool->members))
1693+ : (0 != test_and_set_bit(addr, pool->members));
1694+ }
1695+ read_unlock_bh(&pool->lock);
1696+ return res;
1697+}
1698+
1699+int ip_pool_mod(ip_pool_t index, u_int32_t addr, int isdel)
1700+{
1701+ int res = pool_change(index,addr,isdel);
1702+
1703+ if (!isdel) res = !res;
1704+ return res;
1705+}
1706+
1707+static inline int bitmap_bytes(u_int32_t a, u_int32_t b)
1708+{
1709+ return 4*((((b-a+8)/8)+3)/4);
1710+}
1711+
1712+static inline int poolbytes(ip_pool_t index)
1713+{
1714+ struct ip_pool *pool = lookup(index);
1715+
1716+ return pool ? bitmap_bytes(pool->first_ip, pool->last_ip) : 0;
1717+}
1718+
1719+static int setpool(
1720+ struct sock *sk,
1721+ int optval,
1722+ void *user,
1723+ unsigned int len
1724+) {
1725+ struct ip_pool_request req;
1726+
1727+ DP("ip_pool:setpool: optval=%d, user=%p, len=%d\n", optval, user, len);
1728+ if (!capable(CAP_NET_ADMIN))
1729+ return -EPERM;
1730+ if (optval != SO_IP_POOL)
1731+ return -EBADF;
1732+ if (len != sizeof(req))
1733+ return -EINVAL;
1734+ if (copy_from_user(&req, user, sizeof(req)) != 0)
1735+ return -EFAULT;
1736+ printk("obsolete op - upgrade your ippool(8) utility.\n");
1737+ return -EINVAL;
1738+}
1739+
1740+static int getpool(
1741+ struct sock *sk,
1742+ int optval,
1743+ void *user,
1744+ int *len
1745+) {
1746+ struct ip_pool_request req;
1747+ struct ip_pool *pool;
1748+ ip_pool_t i;
1749+ int newbytes;
1750+ void *newmembers;
1751+ int res;
1752+
1753+ DP("ip_pool:getpool: optval=%d, user=%p\n", optval, user);
1754+ if (!capable(CAP_NET_ADMIN))
1755+ return -EINVAL;
1756+ if (optval != SO_IP_POOL)
1757+ return -EINVAL;
1758+ if (*len != sizeof(req)) {
1759+ return -EFAULT;
1760+ }
1761+ if (copy_from_user(&req, user, sizeof(req)) != 0)
1762+ return -EFAULT;
1763+ DP("ip_pool:getpool op=%d, index=%d\n", req.op, req.index);
1764+ if (req.op < IP_POOL_BAD001) {
1765+ printk("obsolete op - upgrade your ippool(8) utility.\n");
1766+ return -EFAULT;
1767+ }
1768+ switch(req.op) {
1769+ case IP_POOL_HIGH_NR:
1770+ DP("ip_pool HIGH_NR\n");
1771+ req.index = IP_POOL_NONE;
1772+ for (i=0; i<nr_pool; i++)
1773+ if (POOL[i].members)
1774+ req.index = i;
1775+ return copy_to_user(user, &req, sizeof(req));
1776+ case IP_POOL_LOOKUP:
1777+ DP("ip_pool LOOKUP\n");
1778+ pool = lookup(req.index);
1779+ if (!pool)
1780+ return -EINVAL;
1781+ if (!pool->members)
1782+ return -EBADF;
1783+ req.addr = htonl(pool->first_ip);
1784+ req.addr2 = htonl(pool->last_ip);
1785+ return copy_to_user(user, &req, sizeof(req));
1786+ case IP_POOL_USAGE:
1787+ DP("ip_pool USE\n");
1788+ pool = lookup(req.index);
1789+ if (!pool)
1790+ return -EINVAL;
1791+ if (!pool->members)
1792+ return -EBADF;
1793+ req.addr = pool->nr_use;
1794+ req.addr2 = pool->nr_match;
1795+ return copy_to_user(user, &req, sizeof(req));
1796+ case IP_POOL_TEST_ADDR:
1797+ DP("ip_pool TEST 0x%08x\n", req.addr);
1798+ pool = lookup(req.index);
1799+ if (!pool)
1800+ return -EINVAL;
1801+ res = 0;
1802+ read_lock_bh(&pool->lock);
1803+ if (!pool->members) {
1804+ DP("ip_pool TEST_ADDR no members in pool\n");
1805+ res = -EBADF;
1806+ goto unlock_and_return_res;
1807+ }
1808+ req.addr = ntohl(req.addr);
1809+ if (req.addr < pool->first_ip) {
1810+ DP("ip_pool TEST_ADDR address < pool bounds\n");
1811+ res = -ERANGE;
1812+ goto unlock_and_return_res;
1813+ }
1814+ if (req.addr > pool->last_ip) {
1815+ DP("ip_pool TEST_ADDR address > pool bounds\n");
1816+ res = -ERANGE;
1817+ goto unlock_and_return_res;
1818+ }
1819+ req.addr = (0 != test_bit((req.addr - pool->first_ip),
1820+ pool->members));
1821+ read_unlock_bh(&pool->lock);
1822+ return copy_to_user(user, &req, sizeof(req));
1823+ case IP_POOL_FLUSH:
1824+ DP("ip_pool FLUSH not yet implemented.\n");
1825+ return -EBUSY;
1826+ case IP_POOL_DESTROY:
1827+ DP("ip_pool DESTROY not yet implemented.\n");
1828+ return -EBUSY;
1829+ case IP_POOL_INIT:
1830+ DP("ip_pool INIT 0x%08x-0x%08x\n", req.addr, req.addr2);
1831+ pool = lookup(req.index);
1832+ if (!pool)
1833+ return -EINVAL;
1834+ req.addr = ntohl(req.addr);
1835+ req.addr2 = ntohl(req.addr2);
1836+ if (req.addr > req.addr2) {
1837+ DP("ip_pool INIT bad ip range\n");
1838+ return -EINVAL;
1839+ }
1840+ newbytes = bitmap_bytes(req.addr, req.addr2);
1841+ newmembers = kmalloc(newbytes, GFP_KERNEL);
1842+ if (!newmembers) {
1843+ DP("ip_pool INIT out of mem for %d bytes\n", newbytes);
1844+ return -ENOMEM;
1845+ }
1846+ memset(newmembers, 0, newbytes);
1847+ write_lock_bh(&pool->lock);
1848+ if (pool->members) {
1849+ DP("ip_pool INIT pool %d exists\n", req.index);
1850+ kfree(newmembers);
1851+ res = -EBUSY;
1852+ goto unlock_and_return_res;
1853+ }
1854+ pool->first_ip = req.addr;
1855+ pool->last_ip = req.addr2;
1856+ pool->nr_use = 0;
1857+ pool->nr_match = 0;
1858+ pool->members = newmembers;
1859+ write_unlock_bh(&pool->lock);
1860+ return 0;
1861+ case IP_POOL_ADD_ADDR:
1862+ DP("ip_pool ADD_ADDR 0x%08x\n", req.addr);
1863+ req.addr = pool_change(req.index, ntohl(req.addr), 0);
1864+ return copy_to_user(user, &req, sizeof(req));
1865+ case IP_POOL_DEL_ADDR:
1866+ DP("ip_pool DEL_ADDR 0x%08x\n", req.addr);
1867+ req.addr = pool_change(req.index, ntohl(req.addr), 1);
1868+ return copy_to_user(user, &req, sizeof(req));
1869+ default:
1870+ DP("ip_pool:getpool bad op %d\n", req.op);
1871+ return -EINVAL;
1872+ }
1873+ return -EINVAL;
1874+
1875+unlock_and_return_res:
1876+ if (pool)
1877+ read_unlock_bh(&pool->lock);
1878+ return res;
1879+}
1880+
1881+static struct nf_sockopt_ops so_pool
1882+= { { NULL, NULL }, PF_INET,
1883+ SO_IP_POOL, SO_IP_POOL+1, &setpool,
1884+ SO_IP_POOL, SO_IP_POOL+1, &getpool,
1885+ 0, NULL };
1886+
1887+MODULE_PARM(nr_pool, "i");
1888+
1889+static int __init init(void)
1890+{
1891+ ip_pool_t i;
1892+ int res;
1893+
1894+ if (nr_pool < 1) {
1895+ printk("ip_pool module init: bad nr_pool %d\n", nr_pool);
1896+ return -EINVAL;
1897+ }
1898+ POOL = kmalloc(nr_pool * sizeof(*POOL), GFP_KERNEL);
1899+ if (!POOL) {
1900+ printk("ip_pool module init: out of memory for nr_pool %d\n",
1901+ nr_pool);
1902+ return -ENOMEM;
1903+ }
1904+ for (i=0; i<nr_pool; i++) {
1905+ POOL[i].first_ip = 0;
1906+ POOL[i].last_ip = 0;
1907+ POOL[i].members = 0;
1908+ POOL[i].nr_use = 0;
1909+ POOL[i].nr_match = 0;
1910+ POOL[i].lock = RW_LOCK_UNLOCKED;
1911+ }
1912+ res = nf_register_sockopt(&so_pool);
1913+ DP("ip_pool:init %d pools, result %d\n", nr_pool, res);
1914+ if (res != 0) {
1915+ kfree(POOL);
1916+ POOL = 0;
1917+ }
1918+ return res;
1919+}
1920+
1921+static void __exit fini(void)
1922+{
1923+ ip_pool_t i;
1924+
1925+ DP("ip_pool:fini BYEBYE\n");
1926+ nf_unregister_sockopt(&so_pool);
1927+ for (i=0; i<nr_pool; i++) {
1928+ if (POOL[i].members) {
1929+ kfree(POOL[i].members);
1930+ POOL[i].members = 0;
1931+ }
1932+ }
1933+ kfree(POOL);
1934+ POOL = 0;
1935+ DP("ip_pool:fini these are the famous last words\n");
1936+ return;
1937+}
1938+
1939+module_init(init);
1940+module_exit(fini);
1941diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ip_tables.c linux-2.6.6-rc1/net/ipv4/netfilter/ip_tables.c
1942--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ip_tables.c 2004-04-15 03:34:03.000000000 +0200
1943+++ linux-2.6.6-rc1/net/ipv4/netfilter/ip_tables.c 2004-04-15 21:20:36.000000000 +0200
1944@@ -1716,9 +1716,9 @@
1945 };
1946
1947 #ifdef CONFIG_PROC_FS
1948-static inline int print_name(const char *i,
1949- off_t start_offset, char *buffer, int length,
1950- off_t *pos, unsigned int *count)
1951+static int print_name(const char *i,
1952+ off_t start_offset, char *buffer, int length,
1953+ off_t *pos, unsigned int *count)
1954 {
1955 if ((*count)++ >= start_offset) {
1956 unsigned int namelen;
1957@@ -1752,6 +1752,15 @@
1958 return pos;
1959 }
1960
1961+static inline int print_target(const struct ipt_target *t,
1962+ off_t start_offset, char *buffer, int length,
1963+ off_t *pos, unsigned int *count)
1964+{
1965+ if (t != &ipt_standard_target && t != &ipt_error_target)
1966+ return 0;
1967+ return print_name((char *)t, start_offset, buffer, length, pos, count);
1968+}
1969+
1970 static int ipt_get_targets(char *buffer, char **start, off_t offset, int length)
1971 {
1972 off_t pos = 0;
1973@@ -1760,7 +1769,7 @@
1974 if (down_interruptible(&ipt_mutex) != 0)
1975 return 0;
1976
1977- LIST_FIND(&ipt_target, print_name, void *,
1978+ LIST_FIND(&ipt_target, print_target, struct ipt_target *,
1979 offset, buffer, length, &pos, &count);
1980
1981 up(&ipt_mutex);
1982diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c linux-2.6.6-rc1/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c
1983--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c 1970-01-01 01:00:00.000000000 +0100
1984+++ linux-2.6.6-rc1/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c 2004-04-15 21:20:41.000000000 +0200
1985@@ -0,0 +1,89 @@
1986+/**
1987+ * Strip all IP options in the IP packet header.
1988+ *
1989+ * (C) 2001 by Fabrice MARIE <fabrice@netfilter.org>
1990+ * This software is distributed under GNU GPL v2, 1991
1991+ */
1992+
1993+#include <linux/module.h>
1994+#include <linux/skbuff.h>
1995+#include <linux/ip.h>
1996+#include <net/checksum.h>
1997+
1998+#include <linux/netfilter_ipv4/ip_tables.h>
1999+
2000+MODULE_AUTHOR("Fabrice MARIE <fabrice@netfilter.org>");
2001+MODULE_DESCRIPTION("Strip all options in IPv4 packets");
2002+MODULE_LICENSE("GPL");
2003+
2004+static unsigned int
2005+target(struct sk_buff **pskb,
2006+ const struct net_device *in,
2007+ const struct net_device *out,
2008+ unsigned int hooknum,
2009+ const void *targinfo,
2010+ void *userinfo)
2011+{
2012+ struct iphdr *iph;
2013+ struct sk_buff *skb;
2014+ struct ip_options *opt;
2015+ unsigned char *optiph;
2016+ int l;
2017+
2018+ if (!skb_ip_make_writable(pskb, (*pskb)->len))
2019+ return NF_DROP;
2020+
2021+ skb = (*pskb);
2022+ iph = (*pskb)->nh.iph;
2023+ optiph = skb->nh.raw;
2024+ l = ((struct ip_options *)(&(IPCB(skb)->opt)))->optlen;
2025+
2026+ /* if no options in packet then nothing to clear. */
2027+ if (iph->ihl * 4 == sizeof(struct iphdr))
2028+ return IPT_CONTINUE;
2029+
2030+ /* else clear all options */
2031+ memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
2032+ memset(optiph+sizeof(struct iphdr), IPOPT_NOOP, l);
2033+ opt = &(IPCB(skb)->opt);
2034+ opt->is_data = 0;
2035+ opt->optlen = l;
2036+
2037+ skb->nfcache |= NFC_ALTERED;
2038+
2039+ return IPT_CONTINUE;
2040+}
2041+
2042+static int
2043+checkentry(const char *tablename,
2044+ const struct ipt_entry *e,
2045+ void *targinfo,
2046+ unsigned int targinfosize,
2047+ unsigned int hook_mask)
2048+{
2049+ if (strcmp(tablename, "mangle")) {
2050+ printk(KERN_WARNING "IPV4OPTSSTRIP: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
2051+ return 0;
2052+ }
2053+ /* nothing else to check because no parameters */
2054+ return 1;
2055+}
2056+
2057+static struct ipt_target ipt_ipv4optsstrip_reg = {
2058+ .name = "IPV4OPTSSTRIP",
2059+ .target = target,
2060+ .checkentry = checkentry,
2061+ .me = THIS_MODULE };
2062+
2063+static int __init init(void)
2064+{
2065+ return ipt_register_target(&ipt_ipv4optsstrip_reg);
2066+}
2067+
2068+static void __exit fini(void)
2069+{
2070+ ipt_unregister_target(&ipt_ipv4optsstrip_reg);
2071+}
2072+
2073+module_init(init);
2074+module_exit(fini);
2075diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_LOG.c linux-2.6.6-rc1/net/ipv4/netfilter/ipt_LOG.c
2076--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_LOG.c 2004-04-15 03:35:37.000000000 +0200
2077+++ linux-2.6.6-rc1/net/ipv4/netfilter/ipt_LOG.c 2004-04-15 21:20:33.000000000 +0200
2078@@ -19,6 +19,7 @@
2079 #include <net/tcp.h>
2080 #include <net/route.h>
2081
2082+#include <linux/netfilter.h>
2083 #include <linux/netfilter_ipv4/ip_tables.h>
2084 #include <linux/netfilter_ipv4/ipt_LOG.h>
2085
2086@@ -26,6 +27,10 @@
2087 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
2088 MODULE_DESCRIPTION("iptables syslog logging module");
2089
2090+static unsigned int nflog = 1;
2091+MODULE_PARM(nflog, "i");
2092+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
2093+
2094 #if 0
2095 #define DEBUGP printk
2096 #else
2097@@ -324,28 +329,25 @@
2098 /* maxlen = 230+ 91 + 230 + 252 = 803 */
2099 }
2100
2101-static unsigned int
2102-ipt_log_target(struct sk_buff **pskb,
2103+static void
2104+ipt_log_packet(unsigned int hooknum,
2105+ const struct sk_buff *skb,
2106 const struct net_device *in,
2107 const struct net_device *out,
2108- unsigned int hooknum,
2109- const void *targinfo,
2110- void *userinfo)
2111+ const struct ipt_log_info *loginfo,
2112+ const char *level_string,
2113+ const char *prefix)
2114 {
2115- const struct ipt_log_info *loginfo = targinfo;
2116- char level_string[4] = "< >";
2117-
2118- level_string[1] = '0' + (loginfo->level % 8);
2119 spin_lock_bh(&log_lock);
2120 printk(level_string);
2121 printk("%sIN=%s OUT=%s ",
2122- loginfo->prefix,
2123+ prefix == NULL ? loginfo->prefix : prefix,
2124 in ? in->name : "",
2125 out ? out->name : "");
2126 #ifdef CONFIG_BRIDGE_NETFILTER
2127- if ((*pskb)->nf_bridge) {
2128- struct net_device *physindev = (*pskb)->nf_bridge->physindev;
2129- struct net_device *physoutdev = (*pskb)->nf_bridge->physoutdev;
2130+ if (skb->nf_bridge) {
2131+ struct net_device *physindev = skb->nf_bridge->physindev;
2132+ struct net_device *physoutdev = skb->nf_bridge->physoutdev;
2133
2134 if (physindev && in != physindev)
2135 printk("PHYSIN=%s ", physindev->name);
2136@@ -357,25 +359,56 @@
2137 if (in && !out) {
2138 /* MAC logging for input chain only. */
2139 printk("MAC=");
2140- if ((*pskb)->dev && (*pskb)->dev->hard_header_len
2141- && (*pskb)->mac.raw != (void*)(*pskb)->nh.iph) {
2142+ if (skb->dev && skb->dev->hard_header_len
2143+ && skb->mac.raw != (void*)skb->nh.iph) {
2144 int i;
2145- unsigned char *p = (*pskb)->mac.raw;
2146- for (i = 0; i < (*pskb)->dev->hard_header_len; i++,p++)
2147+ unsigned char *p = skb->mac.raw;
2148+ for (i = 0; i < skb->dev->hard_header_len; i++,p++)
2149 printk("%02x%c", *p,
2150- i==(*pskb)->dev->hard_header_len - 1
2151+ i==skb->dev->hard_header_len - 1
2152 ? ' ':':');
2153 } else
2154 printk(" ");
2155 }
2156
2157- dump_packet(loginfo, *pskb, 0);
2158+ dump_packet(loginfo, skb, 0);
2159 printk("\n");
2160 spin_unlock_bh(&log_lock);
2161+}
2162+
2163+static unsigned int
2164+ipt_log_target(struct sk_buff **pskb,
2165+ const struct net_device *in,
2166+ const struct net_device *out,
2167+ unsigned int hooknum,
2168+ const void *targinfo,
2169+ void *userinfo)
2170+{
2171+ const struct ipt_log_info *loginfo = targinfo;
2172+ char level_string[4] = "< >";
2173+
2174+ level_string[1] = '0' + (loginfo->level % 8);
2175+ ipt_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
2176
2177 return IPT_CONTINUE;
2178 }
2179
2180+static void
2181+ipt_logfn(unsigned int hooknum,
2182+ const struct sk_buff *skb,
2183+ const struct net_device *in,
2184+ const struct net_device *out,
2185+ const char *prefix)
2186+{
2187+ struct ipt_log_info loginfo = {
2188+ .level = 0,
2189+ .logflags = IPT_LOG_MASK,
2190+ .prefix = ""
2191+ };
2192+
2193+ ipt_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
2194+}
2195+
2196 static int ipt_log_checkentry(const char *tablename,
2197 const struct ipt_entry *e,
2198 void *targinfo,
2199@@ -413,11 +446,18 @@
2200
2201 static int __init init(void)
2202 {
2203- return ipt_register_target(&ipt_log_reg);
2204+ if (ipt_register_target(&ipt_log_reg))
2205+ return -EINVAL;
2206+ if (nflog)
2207+ nf_log_register(PF_INET, &ipt_logfn);
2208+
2209+ return 0;
2210 }
2211
2212 static void __exit fini(void)
2213 {
2214+ if (nflog)
2215+ nf_log_unregister(PF_INET, &ipt_logfn);
2216 ipt_unregister_target(&ipt_log_reg);
2217 }
2218
2219diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_NETLINK.c linux-2.6.6-rc1/net/ipv4/netfilter/ipt_NETLINK.c
2220--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_NETLINK.c 1970-01-01 01:00:00.000000000 +0100
2221+++ linux-2.6.6-rc1/net/ipv4/netfilter/ipt_NETLINK.c 2004-04-15 21:20:44.000000000 +0200
2222@@ -0,0 +1,119 @@
2223+#include <linux/module.h>
2224+#include <linux/version.h>
2225+#include <linux/config.h>
2226+#include <linux/socket.h>
2227+#include <linux/skbuff.h>
2228+#include <linux/kernel.h>
2229+#include <linux/netlink.h>
2230+#include <linux/netdevice.h>
2231+#include <linux/mm.h>
2232+#include <linux/socket.h>
2233+#include <linux/netfilter_ipv4/ip_tables.h>
2234+#include <linux/netfilter_ipv4/ipt_NETLINK.h>
2235+#include <net/sock.h>
2236+
2237+MODULE_AUTHOR("Gianni Tedesco <gianni@ecsc.co.uk>");
2238+MODULE_DESCRIPTION("Provides iptables NETLINK target similar to ipchains -o");
2239+MODULE_LICENSE("GPL");
2240+
2241+#if 0
2242+#define DEBUGP printk
2243+#else
2244+#define DEBUGP(format, args...)
2245+#endif
2246+
2247+static struct sock *ipfwsk;
2248+
2249+static unsigned int ipt_netlink_target(struct sk_buff **pskb,
2250+ unsigned int hooknum,
2251+ const struct net_device *in,
2252+ const struct net_device *out,
2253+ const void *targinfo, void *userinfo)
2254+{
2255+ struct ipt_nldata *nld = (struct ipt_nldata *)targinfo;
2256+ struct iphdr *ip = (*pskb)->nh.iph;
2257+ struct sk_buff *outskb;
2258+ struct netlink_t nlhdr;
2259+ size_t len=0;
2260+
2261+ /* Allocate a socket buffer */
2262+ if ( MASK(nld->flags, USE_SIZE) )
2263+ len = nld->size+sizeof(nlhdr);
2264+ else
2265+ len = ntohs(ip->tot_len)+sizeof(nlhdr);
2266+
2267+ outskb=alloc_skb(len, GFP_ATOMIC);
2268+
2269+ if (outskb) {
2270+ nlhdr.len=len;
2271+
2272+ if ( MASK(nld->flags, USE_MARK) )
2273+ nlhdr.mark=(*pskb)->nfmark=nld->mark;
2274+ else
2275+ nlhdr.mark=(*pskb)->nfmark;
2276+
2277+ if ( in && in->name ) {
2278+ strncpy((char *)&nlhdr.iface, in->name, IFNAMSIZ);
2279+ }else if ( out && out->name ){
2280+ strncpy((char *)&nlhdr.iface, out->name, IFNAMSIZ);
2281+ }
2282+
2283+ skb_put(outskb, len);
2284+ memcpy(outskb->data, &nlhdr, sizeof(nlhdr));
2285+ memcpy((outskb->data)+sizeof(nlhdr), ip, len-sizeof(nlhdr));
2286+ netlink_broadcast(ipfwsk, outskb, 0, ~0, GFP_ATOMIC);
2287+ }else{
2288+ if (net_ratelimit())
2289+ printk(KERN_WARNING "ipt_NETLINK: packet drop due to netlink failure\n");
2290+ }
2291+
2292+ if ( MASK(nld->flags, USE_DROP) )
2293+ return NF_DROP;
2294+
2295+ return IPT_CONTINUE;
2296+}
2297+
2298+static int ipt_netlink_checkentry(const char *tablename,
2299+ const struct ipt_entry *e,
2300+ void *targinfo,
2301+ unsigned int targinfosize,
2302+ unsigned int hookmask)
2303+{
2304+ //struct ipt_nldata *nld = (struct ipt_nldata *)targinfo;
2305+
2306+ return 1;
2307+}
2308+
2309+static struct ipt_target ipt_netlink_reg = {
2310+ {NULL, NULL},
2311+ "NETLINK",
2312+ ipt_netlink_target,
2313+ ipt_netlink_checkentry,
2314+ NULL,
2315+ THIS_MODULE
2316+};
2317+
2318+static int __init init(void)
2319+{
2320+ DEBUGP("ipt_NETLINK: init module\n");
2321+
2322+ if (ipt_register_target(&ipt_netlink_reg) != 0) {
2323+ return -EINVAL;
2324+ }
2325+
2326+ if ( !(ipfwsk=netlink_kernel_create(NETLINK_FIREWALL, NULL)) ){
2327+ return -EINVAL;
2328+ }
2329+
2330+ return 0;
2331+}
2332+
2333+static void __exit fini(void)
2334+{
2335+ DEBUGP("ipt_NETLINK: cleanup_module\n");
2336+ ipt_unregister_target(&ipt_netlink_reg);
2337+ if(ipfwsk->socket) sock_release(ipfwsk->socket);
2338+}
2339+
2340+module_init(init);
2341+module_exit(fini);
2342diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_NOTRACK.c linux-2.6.6-rc1/net/ipv4/netfilter/ipt_NOTRACK.c
2343--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_NOTRACK.c 1970-01-01 01:00:00.000000000 +0100
2344+++ linux-2.6.6-rc1/net/ipv4/netfilter/ipt_NOTRACK.c 2004-04-15 21:21:20.000000000 +0200
2345@@ -0,0 +1,75 @@
2346+/* This is a module which is used for setting up fake conntracks
2347+ * on packets so that they are not seen by the conntrack/NAT code.
2348+ */
2349+#include <linux/module.h>
2350+#include <linux/skbuff.h>
2351+
2352+#include <linux/netfilter_ipv4/ip_tables.h>
2353+#include <linux/netfilter_ipv4/ip_conntrack.h>
2354+
2355+static unsigned int
2356+target(struct sk_buff **pskb,
2357+ const struct net_device *in,
2358+ const struct net_device *out,
2359+ unsigned int hooknum,
2360+ const void *targinfo,
2361+ void *userinfo)
2362+{
2363+ /* Previously seen (loopback)? Ignore. */
2364+ if ((*pskb)->nfct != NULL)
2365+ return IPT_CONTINUE;
2366+
2367+ /* Attach fake conntrack entry.
2368+ If there is a real ct entry correspondig to this packet,
2369+ it'll hang aroun till timing out. We don't deal with it
2370+ for performance reasons. JK */
2371+ (*pskb)->nfct = &ip_conntrack_untracked.infos[IP_CT_NEW];
2372+ nf_conntrack_get((*pskb)->nfct);
2373+
2374+ return IPT_CONTINUE;
2375+}
2376+
2377+static int
2378+checkentry(const char *tablename,
2379+ const struct ipt_entry *e,
2380+ void *targinfo,
2381+ unsigned int targinfosize,
2382+ unsigned int hook_mask)
2383+{
2384+ if (targinfosize != 0) {
2385+ printk(KERN_WARNING "NOTRACK: targinfosize %u != 0\n",
2386+ targinfosize);
2387+ return 0;
2388+ }
2389+
2390+ if (strcmp(tablename, "raw") != 0) {
2391+ printk(KERN_WARNING "NOTRACK: can only be called from \"raw\" table, not \"%s\"\n", tablename);
2392+ return 0;
2393+ }
2394+
2395+ return 1;
2396+}
2397+
2398+static struct ipt_target ipt_notrack_reg = {
2399+ .name = "NOTRACK",
2400+ .target = target,
2401+ .checkentry = checkentry,
2402+ .me = THIS_MODULE
2403+};
2404+
2405+static int __init init(void)
2406+{
2407+ if (ipt_register_target(&ipt_notrack_reg))
2408+ return -EINVAL;
2409+
2410+ return 0;
2411+}
2412+
2413+static void __exit fini(void)
2414+{
2415+ ipt_unregister_target(&ipt_notrack_reg);
2416+}
2417+
2418+module_init(init);
2419+module_exit(fini);
2420+MODULE_LICENSE("GPL");
2421diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_POOL.c linux-2.6.6-rc1/net/ipv4/netfilter/ipt_POOL.c
2422--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_POOL.c 1970-01-01 01:00:00.000000000 +0100
2423+++ linux-2.6.6-rc1/net/ipv4/netfilter/ipt_POOL.c 2004-04-15 21:21:08.000000000 +0200
2424@@ -0,0 +1,116 @@
2425+/* ipt_POOL.c - netfilter target to manipulate IP pools
2426+ *
2427+ * This target can be used almost everywhere. It acts on some specified
2428+ * IP pool, adding or deleting some IP address in the pool. The address
2429+ * can be either the source (--addsrc, --delsrc), or destination (--add/deldst)
2430+ * of the packet under inspection.
2431+ *
2432+ * The target normally returns IPT_CONTINUE.
2433+ */
2434+
2435+#include <linux/types.h>
2436+#include <linux/ip.h>
2437+#include <linux/timer.h>
2438+#include <linux/module.h>
2439+#include <linux/netfilter.h>
2440+#include <linux/netdevice.h>
2441+#include <linux/if.h>
2442+#include <linux/inetdevice.h>
2443+#include <net/protocol.h>
2444+#include <net/checksum.h>
2445+#include <linux/netfilter_ipv4.h>
2446+#include <linux/netfilter_ipv4/ip_nat_rule.h>
2447+#include <linux/netfilter_ipv4/ipt_pool.h>
2448+
2449+#if 0
2450+#define DEBUGP printk
2451+#else
2452+#define DEBUGP(format, args...)
2453+#endif
2454+
2455+/*** NOTE NOTE NOTE NOTE ***
2456+**
2457+** By sheer luck, I get away with using the "struct ipt_pool_info", as defined
2458+** in <linux/netfilter_ipv4/ipt_pool.h>, both as the match and target info.
2459+** Here, in the target implementation, ipt_pool_info.src, if not IP_POOL_NONE,
2460+** is modified for the source IP address of the packet under inspection.
2461+** The same way, the ipt_pool_info.dst pool is modified for the destination.
2462+**
2463+** The address is added to the pool normally. However, if IPT_POOL_DEL_dir
2464+** flag is set in ipt_pool_info.flags, the address is deleted from the pool.
2465+**
2466+** If a modification was done to the pool, we possibly return ACCEPT or DROP,
2467+** if the right IPT_POOL_MOD_dir_ACCEPT or _MOD_dir_DROP flags are set.
2468+** The IPT_POOL_INV_MOD_dir flag inverts the sense of the check (i.e. the
2469+** ACCEPT and DROP flags are evaluated when the pool was not modified.)
2470+*/
2471+
2472+static int
2473+do_check(const char *tablename,
2474+ const struct ipt_entry *e,
2475+ void *targinfo,
2476+ unsigned int targinfosize,
2477+ unsigned int hook_mask)
2478+{
2479+ const struct ipt_pool_info *ipi = targinfo;
2480+
2481+ if (targinfosize != IPT_ALIGN(sizeof(*ipi))) {
2482+ DEBUGP("POOL_check: size %u.\n", targinfosize);
2483+ return 0;
2484+ }
2485+ DEBUGP("ipt_POOL:do_check(%d,%d,%d)\n",ipi->src,ipi->dst,ipi->flags);
2486+ return 1;
2487+}
2488+
2489+static unsigned int
2490+do_target(struct sk_buff **pskb,
2491+ unsigned int hooknum,
2492+ const struct net_device *in,
2493+ const struct net_device *out,
2494+ const void *targinfo,
2495+ void *userinfo)
2496+{
2497+ const struct ipt_pool_info *ipi = targinfo;
2498+ int modified;
2499+ unsigned int verdict = IPT_CONTINUE;
2500+
2501+ if (ipi->src != IP_POOL_NONE) {
2502+ modified = ip_pool_mod(ipi->src, ntohl((*pskb)->nh.iph->saddr),
2503+ ipi->flags & IPT_POOL_DEL_SRC);
2504+ if (!!modified ^ !!(ipi->flags & IPT_POOL_INV_MOD_SRC)) {
2505+ if (ipi->flags & IPT_POOL_MOD_SRC_ACCEPT)
2506+ verdict = NF_ACCEPT;
2507+ else if (ipi->flags & IPT_POOL_MOD_SRC_DROP)
2508+ verdict = NF_DROP;
2509+ }
2510+ }
2511+ if (verdict == IPT_CONTINUE && ipi->dst != IP_POOL_NONE) {
2512+ modified = ip_pool_mod(ipi->dst, ntohl((*pskb)->nh.iph->daddr),
2513+ ipi->flags & IPT_POOL_DEL_DST);
2514+ if (!!modified ^ !!(ipi->flags & IPT_POOL_INV_MOD_DST)) {
2515+ if (ipi->flags & IPT_POOL_MOD_DST_ACCEPT)
2516+ verdict = NF_ACCEPT;
2517+ else if (ipi->flags & IPT_POOL_MOD_DST_DROP)
2518+ verdict = NF_DROP;
2519+ }
2520+ }
2521+ return verdict;
2522+}
2523+
2524+static struct ipt_target pool_reg
2525+= { { NULL, NULL }, "POOL", do_target, do_check, NULL, THIS_MODULE };
2526+
2527+static int __init init(void)
2528+{
2529+ DEBUGP("init ipt_POOL\n");
2530+ return ipt_register_target(&pool_reg);
2531+}
2532+
2533+static void __exit fini(void)
2534+{
2535+ DEBUGP("fini ipt_POOL\n");
2536+ ipt_unregister_target(&pool_reg);
2537+}
2538+
2539+module_init(init);
2540+module_exit(fini);
2541diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_TTL.c linux-2.6.6-rc1/net/ipv4/netfilter/ipt_TTL.c
2542--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_TTL.c 1970-01-01 01:00:00.000000000 +0100
2543+++ linux-2.6.6-rc1/net/ipv4/netfilter/ipt_TTL.c 2004-04-15 21:20:49.000000000 +0200
2544@@ -0,0 +1,120 @@
2545+/* TTL modification target for IP tables
2546+ * (C) 2000 by Harald Welte <laforge@gnumonks.org>
2547+ *
2548+ * Version: $Revision$
2549+ *
2550+ * This software is distributed under the terms of GNU GPL
2551+ */
2552+
2553+#include <linux/module.h>
2554+#include <linux/skbuff.h>
2555+#include <linux/ip.h>
2556+#include <net/checksum.h>
2557+
2558+#include <linux/netfilter_ipv4/ip_tables.h>
2559+#include <linux/netfilter_ipv4/ipt_TTL.h>
2560+
2561+MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
2562+MODULE_DESCRIPTION("IP tables TTL modification module");
2563+MODULE_LICENSE("GPL");
2564+
2565+static unsigned int
2566+ipt_ttl_target(struct sk_buff **pskb, const struct net_device *in,
2567+ const struct net_device *out, unsigned int hooknum,
2568+ const void *targinfo, void *userinfo)
2569+{
2570+ struct iphdr *iph;
2571+ const struct ipt_TTL_info *info = targinfo;
2572+ u_int16_t diffs[2];
2573+ int new_ttl;
2574+
2575+ if (!skb_ip_make_writable(pskb, (*pskb)->len))
2576+ return NF_DROP;
2577+
2578+ iph = (*pskb)->nh.iph;
2579+
2580+ switch (info->mode) {
2581+ case IPT_TTL_SET:
2582+ new_ttl = info->ttl;
2583+ break;
2584+ case IPT_TTL_INC:
2585+ new_ttl = iph->ttl + info->ttl;
2586+ if (new_ttl > 255)
2587+ new_ttl = 255;
2588+ break;
2589+ case IPT_TTL_DEC:
2590+ new_ttl = iph->ttl + info->ttl;
2591+ if (new_ttl < 0)
2592+ new_ttl = 0;
2593+ break;
2594+ default:
2595+ new_ttl = iph->ttl;
2596+ break;
2597+ }
2598+
2599+ if (new_ttl != iph->ttl) {
2600+ diffs[0] = htons(((unsigned)iph->ttl) << 8) ^ 0xFFFF;
2601+ iph->ttl = new_ttl;
2602+ diffs[1] = htons(((unsigned)iph->ttl) << 8);
2603+ iph->check = csum_fold(csum_partial((char *)diffs,
2604+ sizeof(diffs),
2605+ iph->check^0xFFFF));
2606+ (*pskb)->nfcache |= NFC_ALTERED;
2607+ }
2608+
2609+ return IPT_CONTINUE;
2610+}
2611+
2612+static int ipt_ttl_checkentry(const char *tablename,
2613+ const struct ipt_entry *e,
2614+ void *targinfo,
2615+ unsigned int targinfosize,
2616+ unsigned int hook_mask)
2617+{
2618+ struct ipt_TTL_info *info = targinfo;
2619+
2620+ if (targinfosize != IPT_ALIGN(sizeof(struct ipt_TTL_info))) {
2621+ printk(KERN_WARNING "TTL: targinfosize %u != %Zu\n",
2622+ targinfosize,
2623+ IPT_ALIGN(sizeof(struct ipt_TTL_info)));
2624+ return 0;
2625+ }
2626+
2627+ if (strcmp(tablename, "mangle")) {
2628+ printk(KERN_WARNING "TTL: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
2629+ return 0;
2630+ }
2631+
2632+ if (info->mode > IPT_TTL_MAXMODE) {
2633+ printk(KERN_WARNING "TTL: invalid or unknown Mode %u\n",
2634+ info->mode);
2635+ return 0;
2636+ }
2637+
2638+ if ((info->mode != IPT_TTL_SET) && (info->ttl == 0)) {
2639+ printk(KERN_WARNING "TTL: increment/decrement doesn't make sense with value 0\n");
2640+ return 0;
2641+ }
2642+
2643+ return 1;
2644+}
2645+
2646+static struct ipt_target ipt_TTL = {
2647+ .name = "TTL",
2648+ .target = ipt_ttl_target,
2649+ .checkentry = ipt_ttl_checkentry,
2650+ .me = THIS_MODULE
2651+};
2652+
2653+static int __init init(void)
2654+{
2655+ return ipt_register_target(&ipt_TTL);
2656+}
2657+
2658+static void __exit fini(void)
2659+{
2660+ ipt_unregister_target(&ipt_TTL);
2661+}
2662+
2663+module_init(init);
2664+module_exit(fini);
2665diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_ULOG.c linux-2.6.6-rc1/net/ipv4/netfilter/ipt_ULOG.c
2666--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_ULOG.c 2004-04-15 03:34:35.000000000 +0200
2667+++ linux-2.6.6-rc1/net/ipv4/netfilter/ipt_ULOG.c 2004-04-15 21:20:33.000000000 +0200
2668@@ -50,6 +50,7 @@
2669 #include <linux/netlink.h>
2670 #include <linux/netdevice.h>
2671 #include <linux/mm.h>
2672+#include <linux/netfilter.h>
2673 #include <linux/netfilter_ipv4/ip_tables.h>
2674 #include <linux/netfilter_ipv4/ipt_ULOG.h>
2675 #include <linux/netfilter_ipv4/lockhelp.h>
2676@@ -80,6 +81,10 @@
2677 MODULE_PARM(flushtimeout, "i");
2678 MODULE_PARM_DESC(flushtimeout, "buffer flush timeout");
2679
2680+static unsigned int nflog = 1;
2681+MODULE_PARM(nflog, "i");
2682+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
2683+
2684 /* global data structures */
2685
2686 typedef struct {
2687@@ -157,17 +162,17 @@
2688 return skb;
2689 }
2690
2691-static unsigned int ipt_ulog_target(struct sk_buff **pskb,
2692- const struct net_device *in,
2693- const struct net_device *out,
2694- unsigned int hooknum,
2695- const void *targinfo, void *userinfo)
2696+static void ipt_ulog_packet(unsigned int hooknum,
2697+ const struct sk_buff *skb,
2698+ const struct net_device *in,
2699+ const struct net_device *out,
2700+ const struct ipt_ulog_info *loginfo,
2701+ const char *prefix)
2702 {
2703 ulog_buff_t *ub;
2704 ulog_packet_msg_t *pm;
2705 size_t size, copy_len;
2706 struct nlmsghdr *nlh;
2707- struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
2708
2709 /* ffs == find first bit set, necessary because userspace
2710 * is already shifting groupnumber, but we need unshifted.
2711@@ -176,8 +181,8 @@
2712
2713 /* calculate the size of the skb needed */
2714 if ((loginfo->copy_range == 0) ||
2715- (loginfo->copy_range > (*pskb)->len)) {
2716- copy_len = (*pskb)->len;
2717+ (loginfo->copy_range > skb->len)) {
2718+ copy_len = skb->len;
2719 } else {
2720 copy_len = loginfo->copy_range;
2721 }
2722@@ -214,19 +219,21 @@
2723
2724 /* copy hook, prefix, timestamp, payload, etc. */
2725 pm->data_len = copy_len;
2726- pm->timestamp_sec = (*pskb)->stamp.tv_sec;
2727- pm->timestamp_usec = (*pskb)->stamp.tv_usec;
2728- pm->mark = (*pskb)->nfmark;
2729+ pm->timestamp_sec = skb->stamp.tv_sec;
2730+ pm->timestamp_usec = skb->stamp.tv_usec;
2731+ pm->mark = skb->nfmark;
2732 pm->hook = hooknum;
2733- if (loginfo->prefix[0] != '\0')
2734+ if (prefix != NULL)
2735+ strncpy(pm->prefix, prefix, sizeof(pm->prefix));
2736+ else if (loginfo->prefix[0] != '\0')
2737 strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
2738 else
2739 *(pm->prefix) = '\0';
2740
2741 if (in && in->hard_header_len > 0
2742- && (*pskb)->mac.raw != (void *) (*pskb)->nh.iph
2743+ && skb->mac.raw != (void *) skb->nh.iph
2744 && in->hard_header_len <= ULOG_MAC_LEN) {
2745- memcpy(pm->mac, (*pskb)->mac.raw, in->hard_header_len);
2746+ memcpy(pm->mac, skb->mac.raw, in->hard_header_len);
2747 pm->mac_len = in->hard_header_len;
2748 } else
2749 pm->mac_len = 0;
2750@@ -241,8 +248,8 @@
2751 else
2752 pm->outdev_name[0] = '\0';
2753
2754- /* copy_len <= (*pskb)->len, so can't fail. */
2755- if (skb_copy_bits(*pskb, 0, pm->payload, copy_len) < 0)
2756+ /* copy_len <= skb->len, so can't fail. */
2757+ if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0)
2758 BUG();
2759
2760 /* check if we are building multi-part messages */
2761@@ -266,8 +273,7 @@
2762
2763 UNLOCK_BH(&ulog_lock);
2764
2765- return IPT_CONTINUE;
2766-
2767+ return;
2768
2769 nlmsg_failure:
2770 PRINTR("ipt_ULOG: error during NLMSG_PUT\n");
2771@@ -276,8 +282,35 @@
2772 PRINTR("ipt_ULOG: Error building netlink message\n");
2773
2774 UNLOCK_BH(&ulog_lock);
2775+}
2776+
2777+static unsigned int ipt_ulog_target(struct sk_buff **pskb,
2778+ const struct net_device *in,
2779+ const struct net_device *out,
2780+ unsigned int hooknum,
2781+ const void *targinfo, void *userinfo)
2782+{
2783+ struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
2784
2785- return IPT_CONTINUE;
2786+ ipt_ulog_packet(hooknum, *pskb, in, out, loginfo, NULL);
2787+
2788+ return IPT_CONTINUE;
2789+}
2790+
2791+static void ipt_logfn(unsigned int hooknum,
2792+ const struct sk_buff *skb,
2793+ const struct net_device *in,
2794+ const struct net_device *out,
2795+ const char *prefix)
2796+{
2797+ struct ipt_ulog_info loginfo = {
2798+ .nl_group = ULOG_DEFAULT_NLGROUP,
2799+ .copy_range = 0,
2800+ .qthreshold = ULOG_DEFAULT_QTHRESHOLD,
2801+ .prefix = ""
2802+ };
2803+
2804+ ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
2805 }
2806
2807 static int ipt_ulog_checkentry(const char *tablename,
2808@@ -341,7 +374,9 @@
2809 sock_release(nflognl->sk_socket);
2810 return -EINVAL;
2811 }
2812-
2813+ if (nflog)
2814+ nf_log_register(PF_INET, &ipt_logfn);
2815+
2816 return 0;
2817 }
2818
2819@@ -352,6 +387,8 @@
2820
2821 DEBUGP("ipt_ULOG: cleanup_module\n");
2822
2823+ if (nflog)
2824+ nf_log_unregister(PF_INET, &ipt_logfn);
2825 ipt_unregister_target(&ipt_ulog_reg);
2826 sock_release(nflognl->sk_socket);
2827
2828diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_connlimit.c linux-2.6.6-rc1/net/ipv4/netfilter/ipt_connlimit.c
2829--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_connlimit.c 1970-01-01 01:00:00.000000000 +0100
2830+++ linux-2.6.6-rc1/net/ipv4/netfilter/ipt_connlimit.c 2004-04-15 21:20:53.000000000 +0200
2831@@ -0,0 +1,230 @@
2832+/*
2833+ * netfilter module to limit the number of parallel tcp
2834+ * connections per IP address.
2835+ * (c) 2000 Gerd Knorr <kraxel@bytesex.org>
2836+ * Nov 2002: Martin Bene <martin.bene@icomedias.com>:
2837+ * only ignore TIME_WAIT or gone connections
2838+ *
2839+ * based on ...
2840+ *
2841+ * Kernel module to match connection tracking information.
2842+ * GPL (C) 1999 Rusty Russell (rusty@rustcorp.com.au).
2843+ */
2844+#include <linux/module.h>
2845+#include <linux/skbuff.h>
2846+#include <linux/list.h>
2847+#include <linux/netfilter_ipv4/ip_conntrack.h>
2848+#include <linux/netfilter_ipv4/ip_conntrack_core.h>
2849+#include <linux/netfilter_ipv4/ip_conntrack_tcp.h>
2850+#include <linux/netfilter_ipv4/ip_tables.h>
2851+#include <linux/netfilter_ipv4/ipt_connlimit.h>
2852+
2853+#define DEBUG 0
2854+
2855+MODULE_LICENSE("GPL");
2856+
2857+/* we'll save the tuples of all connections we care about */
2858+struct ipt_connlimit_conn
2859+{
2860+ struct list_head list;
2861+ struct ip_conntrack_tuple tuple;
2862+};
2863+
2864+struct ipt_connlimit_data {
2865+ spinlock_t lock;
2866+ struct list_head iphash[256];
2867+};
2868+
2869+static int ipt_iphash(u_int32_t addr)
2870+{
2871+ int hash;
2872+
2873+ hash = addr & 0xff;
2874+ hash ^= (addr >> 8) & 0xff;
2875+ hash ^= (addr >> 16) & 0xff;
2876+ hash ^= (addr >> 24) & 0xff;
2877+ return hash;
2878+}
2879+
2880+static int count_them(struct ipt_connlimit_data *data,
2881+ u_int32_t addr, u_int32_t mask,
2882+ struct ip_conntrack *ct)
2883+{
2884+#if DEBUG
2885+ const static char *tcp[] = { "none", "established", "syn_sent", "syn_recv",
2886+ "fin_wait", "time_wait", "close", "close_wait",
2887+ "last_ack", "listen" };
2888+#endif
2889+ int addit = 1, matches = 0;
2890+ struct ip_conntrack_tuple tuple;
2891+ struct ip_conntrack_tuple_hash *found;
2892+ struct ipt_connlimit_conn *conn;
2893+ struct list_head *hash,*lh;
2894+
2895+ spin_lock(&data->lock);
2896+ tuple = ct->tuplehash[0].tuple;
2897+ hash = &data->iphash[ipt_iphash(addr & mask)];
2898+
2899+ /* check the saved connections */
2900+ for (lh = hash->next; lh != hash; lh = lh->next) {
2901+ conn = list_entry(lh,struct ipt_connlimit_conn,list);
2902+ found = ip_conntrack_find_get(&conn->tuple,ct);
2903+ if (0 == memcmp(&conn->tuple,&tuple,sizeof(tuple)) &&
2904+ found != NULL &&
2905+ found->ctrack->proto.tcp.state != TCP_CONNTRACK_TIME_WAIT) {
2906+ /* Just to be sure we have it only once in the list.
2907+ We should'nt see tuples twice unless someone hooks this
2908+ into a table without "-p tcp --syn" */
2909+ addit = 0;
2910+ }
2911+#if DEBUG
2912+ printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d %s\n",
2913+ ipt_iphash(addr & mask),
2914+ NIPQUAD(conn->tuple.src.ip), ntohs(conn->tuple.src.u.tcp.port),
2915+ NIPQUAD(conn->tuple.dst.ip), ntohs(conn->tuple.dst.u.tcp.port),
2916+ (NULL != found) ? tcp[found->ctrack->proto.tcp.state] : "gone");
2917+#endif
2918+ if (NULL == found) {
2919+ /* this one is gone */
2920+ lh = lh->prev;
2921+ list_del(lh->next);
2922+ kfree(conn);
2923+ continue;
2924+ }
2925+ if (found->ctrack->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT) {
2926+ /* we don't care about connections which are
2927+ closed already -> ditch it */
2928+ lh = lh->prev;
2929+ list_del(lh->next);
2930+ kfree(conn);
2931+ nf_conntrack_put(&found->ctrack->infos[0]);
2932+ continue;
2933+ }
2934+ if ((addr & mask) == (conn->tuple.src.ip & mask)) {
2935+ /* same source IP address -> be counted! */
2936+ matches++;
2937+ }
2938+ nf_conntrack_put(&found->ctrack->infos[0]);
2939+ }
2940+ if (addit) {
2941+ /* save the new connection in our list */
2942+#if DEBUG
2943+ printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d new\n",
2944+ ipt_iphash(addr & mask),
2945+ NIPQUAD(tuple.src.ip), ntohs(tuple.src.u.tcp.port),
2946+ NIPQUAD(tuple.dst.ip), ntohs(tuple.dst.u.tcp.port));
2947+#endif
2948+ conn = kmalloc(sizeof(*conn),GFP_ATOMIC);
2949+ if (NULL == conn)
2950+ return -1;
2951+ memset(conn,0,sizeof(*conn));
2952+ INIT_LIST_HEAD(&conn->list);
2953+ conn->tuple = tuple;
2954+ list_add(&conn->list,hash);
2955+ matches++;
2956+ }
2957+ spin_unlock(&data->lock);
2958+ return matches;
2959+}
2960+
2961+static int
2962+match(const struct sk_buff *skb,
2963+ const struct net_device *in,
2964+ const struct net_device *out,
2965+ const void *matchinfo,
2966+ int offset,
2967+ int *hotdrop)
2968+{
2969+ const struct ipt_connlimit_info *info = matchinfo;
2970+ int connections, match;
2971+ struct ip_conntrack *ct;
2972+ enum ip_conntrack_info ctinfo;
2973+
2974+ ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
2975+ if (NULL == ct) {
2976+ printk("ipt_connlimit: Oops: invalid ct state ?\n");
2977+ *hotdrop = 1;
2978+ return 0;
2979+ }
2980+ connections = count_them(info->data,skb->nh.iph->saddr,info->mask,ct);
2981+ if (-1 == connections) {
2982+ printk("ipt_connlimit: Hmm, kmalloc failed :-(\n");
2983+ *hotdrop = 1; /* let's free some memory :-) */
2984+ return 0;
2985+ }
2986+ match = (info->inverse) ? (connections <= info->limit) : (connections > info->limit);
2987+#if DEBUG
2988+ printk("ipt_connlimit: src=%u.%u.%u.%u mask=%u.%u.%u.%u "
2989+ "connections=%d limit=%d match=%s\n",
2990+ NIPQUAD(skb->nh.iph->saddr), NIPQUAD(info->mask),
2991+ connections, info->limit, match ? "yes" : "no");
2992+#endif
2993+
2994+ return match;
2995+}
2996+
2997+static int check(const char *tablename,
2998+ const struct ipt_ip *ip,
2999+ void *matchinfo,
3000+ unsigned int matchsize,
3001+ unsigned int hook_mask)
3002+{
3003+ struct ipt_connlimit_info *info = matchinfo;
3004+ int i;
3005+
3006+ /* verify size */
3007+ if (matchsize != IPT_ALIGN(sizeof(struct ipt_connlimit_info)))
3008+ return 0;
3009+
3010+ /* refuse anything but tcp */
3011+ if (ip->proto != IPPROTO_TCP)
3012+ return 0;
3013+
3014+ /* init private data */
3015+ info->data = kmalloc(sizeof(struct ipt_connlimit_data),GFP_KERNEL);
3016+ spin_lock_init(&(info->data->lock));
3017+ for (i = 0; i < 256; i++)
3018+ INIT_LIST_HEAD(&(info->data->iphash[i]));
3019+
3020+ return 1;
3021+}
3022+
3023+static void destroy(void *matchinfo, unsigned int matchinfosize)
3024+{
3025+ struct ipt_connlimit_info *info = matchinfo;
3026+ struct ipt_connlimit_conn *conn;
3027+ struct list_head *hash;
3028+ int i;
3029+
3030+ /* cleanup */
3031+ for (i = 0; i < 256; i++) {
3032+ hash = &(info->data->iphash[i]);
3033+ while (hash != hash->next) {
3034+ conn = list_entry(hash->next,struct ipt_connlimit_conn,list);
3035+ list_del(hash->next);
3036+ kfree(conn);
3037+ }
3038+ }
3039+ kfree(info->data);
3040+}
3041+
3042+static struct ipt_match connlimit_match = {
3043+ .name = "connlimit",
3044+ .match = &match,
3045+ .checkentry = &check,
3046+ .destroy = &destroy,
3047+ .me = THIS_MODULE
3048+};
3049+
3050+static int __init init(void)
3051+{
3052+ return ipt_register_match(&connlimit_match);
3053+}
3054+
3055+static void __exit fini(void)
3056+{
3057+ ipt_unregister_match(&connlimit_match);
3058+}
3059+
3060+module_init(init);
3061+module_exit(fini);
3062diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_conntrack.c linux-2.6.6-rc1/net/ipv4/netfilter/ipt_conntrack.c
3063--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_conntrack.c 2004-04-15 03:35:37.000000000 +0200
3064+++ linux-2.6.6-rc1/net/ipv4/netfilter/ipt_conntrack.c 2004-04-15 21:21:20.000000000 +0200
3065@@ -35,11 +35,13 @@
3066
3067 #define FWINV(bool,invflg) ((bool) ^ !!(sinfo->invflags & invflg))
3068
3069- if (ct)
3070- statebit = IPT_CONNTRACK_STATE_BIT(ctinfo);
3071- else
3072- statebit = IPT_CONNTRACK_STATE_INVALID;
3073-
3074+ if (skb->nfct == &ip_conntrack_untracked.infos[IP_CT_NEW])
3075+ statebit = IPT_CONNTRACK_STATE_UNTRACKED;
3076+ else if (ct)
3077+ statebit = IPT_CONNTRACK_STATE_BIT(ctinfo);
3078+ else
3079+ statebit = IPT_CONNTRACK_STATE_INVALID;
3080+
3081 if(sinfo->flags & IPT_CONNTRACK_STATE) {
3082 if (ct) {
3083 if(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip !=
3084diff -Nur --exclude '*.orig' linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_dstlimit.c linux-2.6.6-rc1/net/ipv4/netfilter/ipt_dstlimit.c
3085--- linux-2.6.6-rc1.org/net/ipv4/netfilter/ipt_dstlimit.c 1970-01-01 01:00:00.000000000 +0100
3086+++ linux-2.6.6-rc1/net/ipv4/netfilter/ipt_dstlimit.c 2004-04-15 21:20:56.000000000 +0200
3087@@ -0,0 +1,690 @@
3088+/* iptables match extension to limit the number of packets per second
3089+ * seperately for each destination.
3090+ *
3091+ * (C) 2003 by Harald Welte <laforge@netfilter.org>
3092+ *
3093+ * $Id$
3094+ *
3095+ * Development of this code was funded by Astaro AG, http://www.astaro.com/
3096+ *
3097+ * based on ipt_limit.c by:
3098