2.6.0-t7-netfilter-20031010.patch

   1 diff -Nur linux-2.6.0-test7.org/include/linux/netfilter.h linux-2.6.0-test7/include/linux/netfilter.h
   2 --- linux-2.6.0-test7.org/include/linux/netfilter.h     2003-10-08 21:24:06.000000000 +0200
   3 +++ linux-2.6.0-test7/include/linux/netfilter.h 2003-10-10 11:53:17.000000000 +0200
   4 @@ -23,6 +23,7 @@
   5     <= 0x2000 is used for protocol-flags. */
   6  #define NFC_UNKNOWN 0x4000
   7  #define NFC_ALTERED 0x8000
   8 +#define NFC_TRACE   0x10000
   9
  10  #ifdef __KERNEL__
  11  #include <linux/config.h>
  12 @@ -99,6 +100,24 @@
  13
  14  extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
  15
  16 +typedef void nf_logfn(unsigned int hooknum,
  17 +                     const struct sk_buff *skb,
  18 +                     const struct net_device *in,
  19 +                     const struct net_device *out,
  20 +                     const char *prefix);
  21 +
  22 +/* Function to register/unregister log function. */
  23 +int nf_log_register(int pf, nf_logfn *logfn);
  24 +void nf_log_unregister(int pf, nf_logfn *logfn);
  25 +
  26 +/* Calls the registered backend logging function */
  27 +void nf_log_packet(int pf,
  28 +                  unsigned int hooknum,
  29 +                  const struct sk_buff *skb,
  30 +                  const struct net_device *in,
  31 +                  const struct net_device *out,
  32 +                  const char *fmt, ...);
  33 +
  34  /* Activate hook; either okfn or kfree_skb called, unless a hook
  35     returns NF_STOLEN (in which case, it's up to the hook to deal with
  36     the consequences).
  37 diff -Nur linux-2.6.0-test7.org/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.6.0-test7/include/linux/netfilter_ipv4/ip_conntrack.h
  38 --- linux-2.6.0-test7.org/include/linux/netfilter_ipv4/ip_conntrack.h   2003-10-08 21:24:48.000000000 +0200
  39 +++ linux-2.6.0-test7/include/linux/netfilter_ipv4/ip_conntrack.h       2003-10-10 11:53:17.000000000 +0200
  40 @@ -268,6 +268,9 @@
  41
  42  extern unsigned int ip_conntrack_htable_size;
  43
  44 +/* A fake conntrack entry which never vanishes. */
  45 +extern struct ip_conntrack ip_conntrack_untracked;
  46 +
  47  /* eg. PROVIDES_CONNTRACK(ftp); */
  48  #define PROVIDES_CONNTRACK(name)                        \
  49          int needs_ip_conntrack_##name;                  \
  50 diff -Nur linux-2.6.0-test7.org/include/linux/netfilter_ipv4/ip_tables.h linux-2.6.0-test7/include/linux/netfilter_ipv4/ip_tables.h
  51 --- linux-2.6.0-test7.org/include/linux/netfilter_ipv4/ip_tables.h      2003-10-08 21:24:07.000000000 +0200
  52 +++ linux-2.6.0-test7/include/linux/netfilter_ipv4/ip_tables.h  2003-10-10 11:53:17.000000000 +0200
  53 @@ -134,6 +134,12 @@
  54         /* Back pointer */
  55         unsigned int comefrom;
  56
  57 +       /* Name of the chain */
  58 +       char *chainname;
  59 +
  60 +       /* Rule number in the chain. */
  61 +       u_int32_t rulenum;
  62 +
  63         /* Packet and byte counters. */
  64         struct ipt_counters counters;
  65
  66 diff -Nur linux-2.6.0-test7.org/include/linux/netfilter_ipv4/ipt_ULOG.h linux-2.6.0-test7/include/linux/netfilter_ipv4/ipt_ULOG.h
  67 --- linux-2.6.0-test7.org/include/linux/netfilter_ipv4/ipt_ULOG.h       2003-10-08 21:24:04.000000000 +0200
  68 +++ linux-2.6.0-test7/include/linux/netfilter_ipv4/ipt_ULOG.h   2003-10-10 11:52:57.000000000 +0200
  69 @@ -11,6 +11,9 @@
  70  #define NETLINK_NFLOG  5
  71  #endif
  72
  73 +#define NFLOG_DEFAULT_NLGROUP          1
  74 +#define NFLOG_DEFAULT_QTHRESHOLD       1
  75 +
  76  #define ULOG_MAC_LEN   80
  77  #define ULOG_PREFIX_LEN        32
  78
  79 diff -Nur linux-2.6.0-test7.org/include/linux/netfilter_ipv4/ipt_conntrack.h linux-2.6.0-test7/include/linux/netfilter_ipv4/ipt_conntrack.h
  80 --- linux-2.6.0-test7.org/include/linux/netfilter_ipv4/ipt_conntrack.h  2003-10-08 21:24:26.000000000 +0200
  81 +++ linux-2.6.0-test7/include/linux/netfilter_ipv4/ipt_conntrack.h      2003-10-10 11:53:17.000000000 +0200
  82 @@ -10,6 +10,7 @@
  83
  84  #define IPT_CONNTRACK_STATE_SNAT (1 << (IP_CT_NUMBER + 1))
  85  #define IPT_CONNTRACK_STATE_DNAT (1 << (IP_CT_NUMBER + 2))
  86 +#define IPT_CONNTRACK_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 3))
  87
  88  /* flags, invflags: */
  89  #define IPT_CONNTRACK_STATE    0x01
  90 diff -Nur linux-2.6.0-test7.org/include/linux/netfilter_ipv4/ipt_sctp.h linux-2.6.0-test7/include/linux/netfilter_ipv4/ipt_sctp.h
  91 --- linux-2.6.0-test7.org/include/linux/netfilter_ipv4/ipt_sctp.h       1970-01-01 01:00:00.000000000 +0100
  92 +++ linux-2.6.0-test7/include/linux/netfilter_ipv4/ipt_sctp.h   2003-10-10 11:53:27.000000000 +0200
  93 @@ -0,0 +1,25 @@
  94 +/* iptables module for matching the SCTP header
  95 + *
  96 + * (C) 2003 Harald Welte <laforge@gnumonks.org>
  97 + *
  98 + * This software is distributed under GNU GPL v2, 1991
  99 + *
 100 + * $Id$
 101 + */
 102 +#ifndef _IPT_SCTP_H
 103 +#define _IPT_SCTP_H
 104 +
 105 +struct ipt_sctp_info {
 106 +       u_int16_t spts[2];                      /* Souce port range */
 107 +       u_int16_t dpts[2];                      /* Destination port range */
 108 +       u_int32_t chunks;                       /* chunks to be matched */
 109 +       u_int32_t chunk_mask;                   /* chunk mask to be matched */
 110 +       u_int8_t invflags;                      /* Inverse flags */
 111 +};
 112 +
 113 +#define IPT_SCTP_INV_SRCPT     0x01    /* Invert the sense of source ports */
 114 +#define IPT_SCTP_INV_DSTPT     0x02    /* Invert the sense of dest ports */
 115 +#define IPT_SCTP_INV_CHUNKS    0x03    /* Invert the sense of chunks */
 116 +#define IPT_SCTP_INV_MASK      0x03    /* All possible flags */
 117 +
 118 +#endif /* _IPT_SCTP_H */
 119 diff -Nur linux-2.6.0-test7.org/include/linux/netfilter_ipv4/ipt_state.h linux-2.6.0-test7/include/linux/netfilter_ipv4/ipt_state.h
 120 --- linux-2.6.0-test7.org/include/linux/netfilter_ipv4/ipt_state.h      2003-10-08 21:24:42.000000000 +0200
 121 +++ linux-2.6.0-test7/include/linux/netfilter_ipv4/ipt_state.h  2003-10-10 11:53:17.000000000 +0200
 122 @@ -4,6 +4,8 @@
 123  #define IPT_STATE_BIT(ctinfo) (1 << ((ctinfo)%IP_CT_IS_REPLY+1))
 124  #define IPT_STATE_INVALID (1 << 0)
 125
 126 +#define IPT_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 1))
 127 +
 128  struct ipt_state_info
 129  {
 130         unsigned int statemask;
 131 diff -Nur linux-2.6.0-test7.org/include/linux/netfilter_ipv4.h linux-2.6.0-test7/include/linux/netfilter_ipv4.h
 132 --- linux-2.6.0-test7.org/include/linux/netfilter_ipv4.h        2003-10-08 21:24:32.000000000 +0200
 133 +++ linux-2.6.0-test7/include/linux/netfilter_ipv4.h    2003-10-10 11:53:17.000000000 +0200
 134 @@ -51,6 +51,8 @@
 135
 136  enum nf_ip_hook_priorities {
 137         NF_IP_PRI_FIRST = INT_MIN,
 138 +       NF_IP_PRI_CONNTRACK_DEFRAG = -400,
 139 +       NF_IP_PRI_RAW = -300,
 140         NF_IP_PRI_CONNTRACK = -200,
 141         NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
 142         NF_IP_PRI_MANGLE = -150,
 143 diff -Nur linux-2.6.0-test7.org/include/linux/netfilter_ipv6/ip6_tables.h linux-2.6.0-test7/include/linux/netfilter_ipv6/ip6_tables.h
 144 --- linux-2.6.0-test7.org/include/linux/netfilter_ipv6/ip6_tables.h     2003-10-08 21:24:51.000000000 +0200
 145 +++ linux-2.6.0-test7/include/linux/netfilter_ipv6/ip6_tables.h 2003-10-10 11:53:17.000000000 +0200
 146 @@ -140,6 +140,12 @@
 147         /* Back pointer */
 148         unsigned int comefrom;
 149
 150 +       /* Name of the chain */
 151 +       char *chainname;
 152 +
 153 +       /* Rule number in the chain. */
 154 +       u_int32_t rulenum;
 155 +
 156         /* Packet and byte counters. */
 157         struct ip6t_counters counters;
 158
 159 diff -Nur linux-2.6.0-test7.org/net/core/netfilter.c linux-2.6.0-test7/net/core/netfilter.c
 160 --- linux-2.6.0-test7.org/net/core/netfilter.c  2003-10-08 21:24:04.000000000 +0200
 161 +++ linux-2.6.0-test7/net/core/netfilter.c      2003-10-10 11:52:57.000000000 +0200
 162 @@ -8,8 +8,10 @@
 163   *
 164   * February 2000: Modified by James Morris to have 1 queue per protocol.
 165   * 15-Mar-2000:   Added NF_REPEAT --RR.
 166 + * 08-May-2003:          Internal logging interface added by Jozsef Kadlecsik.
 167   */
 168  #include <linux/config.h>
 169 +#include <linux/kernel.h>
 170  #include <linux/netfilter.h>
 171  #include <net/protocol.h>
 172  #include <linux/init.h>
 173 @@ -743,7 +745,70 @@
 174  EXPORT_SYMBOL(skb_ip_make_writable);
 175  #endif /*CONFIG_INET*/
 176
 177 +/* Internal logging interface, which relies on the real
 178 +   LOG target modules */
 179
 180 +#define NF_LOG_PREFIXLEN               128
 181 +
 182 +static nf_logfn *nf_logging[NPROTO]; /* = NULL */
 183 +static int reported = 0;
 184 +static spinlock_t nf_log_lock = SPIN_LOCK_UNLOCKED;
 185 +
 186 +int nf_log_register(int pf, nf_logfn *logfn)
 187 +{
 188 +       int ret = -EBUSY;
 189 +
 190 +       /* Any setup of logging members must be done before
 191 +        * substituting pointer. */
 192 +       smp_wmb();
 193 +       spin_lock(&nf_log_lock);
 194 +       if (!nf_logging[pf]) {
 195 +               nf_logging[pf] = logfn;
 196 +               ret = 0;
 197 +       }
 198 +       spin_unlock(&nf_log_lock);
 199 +       return ret;
 200 +}
 201 +
 202 +void nf_log_unregister(int pf, nf_logfn *logfn)
 203 +{
 204 +       spin_lock(&nf_log_lock);
 205 +       if (nf_logging[pf] == logfn)
 206 +               nf_logging[pf] = NULL;
 207 +       spin_unlock(&nf_log_lock);
 208 +
 209 +       /* Give time to concurrent readers. */
 210 +       synchronize_net();
 211 +}
 212 +
 213 +void nf_log_packet(int pf,
 214 +                  unsigned int hooknum,
 215 +                  const struct sk_buff *skb,
 216 +                  const struct net_device *in,
 217 +                  const struct net_device *out,
 218 +                  const char *fmt, ...)
 219 +{
 220 +       va_list args;
 221 +       char prefix[NF_LOG_PREFIXLEN];
 222 +       nf_logfn *logfn;
 223 +
 224 +       rcu_read_lock();
 225 +       logfn = nf_logging[pf];
 226 +       if (logfn) {
 227 +               va_start(args, fmt);
 228 +               vsnprintf(prefix, sizeof(prefix), fmt, args);
 229 +               va_end(args);
 230 +               /* We must read logging before nf_logfn[pf] */
 231 +               smp_read_barrier_depends();
 232 +               logfn(hooknum, skb, in, out, prefix);
 233 +       } else if (!reported) {
 234 +               printk(KERN_WARNING "nf_log_packet: can\'t log yet, "
 235 +                      "no backend logging module loaded in!\n");
 236 +               reported++;
 237 +       }
 238 +       rcu_read_unlock();
 239 +}
 240 +
 241  /* This does not belong here, but ipt_REJECT needs it if connection
 242     tracking in use: without this, connection may not be in hash table,
 243     and hence manufactured ICMP or RST packets will not be associated
 244 @@ -773,3 +838,6 @@
 245  EXPORT_SYMBOL(nf_unregister_hook);
 246  EXPORT_SYMBOL(nf_unregister_queue_handler);
 247  EXPORT_SYMBOL(nf_unregister_sockopt);
 248 +EXPORT_SYMBOL(nf_log_register);
 249 +EXPORT_SYMBOL(nf_log_unregister);
 250 +EXPORT_SYMBOL(nf_log_packet);
 251 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/Kconfig linux-2.6.0-test7/net/ipv4/netfilter/Kconfig
 252 --- linux-2.6.0-test7.org/net/ipv4/netfilter/Kconfig    2003-10-08 21:24:27.000000000 +0200
 253 +++ linux-2.6.0-test7/net/ipv4/netfilter/Kconfig        2003-10-10 11:53:27.000000000 +0200
 254 @@ -197,6 +197,15 @@
 255
 256           To compile it as a module, choose M here.  If unsure, say N.
 257
 258 +config IP_NF_MATCH_SCTP
 259 +       tristate "SCTP match support"
 260 +       depends on IP_NF_IPTABLES
 261 +       help
 262 +         This match allows iptables to match on the SCTP header.
 263 +
 264 +         If you want to compile it as a module, say M here and read
 265 +         <file:Documentation/modules.txt>. If unsure, say `N'.
 266 +
 267  config IP_NF_MATCH_LENGTH
 268         tristate "LENGTH match support"
 269         depends on IP_NF_IPTABLES
 270 @@ -527,6 +536,42 @@
 271
 272           To compile it as a module, choose M here.  If unsure, say N.
 273
 274 +config IP_NF_RAW
 275 +       tristate "Raw table"
 276 +       depends on IP_NF_IPTABLES
 277 +       help
 278 +         This option adds a `raw' table to iptables: see the man page for
 279 +         iptables(8).  This table is the very first in the netfilter
 280 +         framework and hooks in at the PREROUTING and OUTPUT chains.
 281 +         The TRACE and NOTRACK targets can be used in this table only.
 282 +
 283 +         To compile it as a module, choose M here.  If unsure, say N.
 284 +
 285 +config IP_NF_TARGET_TRACE
 286 +       tristate "TRACE target support"
 287 +       depends on IP_NF_RAW
 288 +       help
 289 +         The TRACE target allows packets to be traced as those matches
 290 +         any subsequent rule in any table/rule. The matched rule and
 291 +         the packet is logged with the prefix
 292 +
 293 +         TRACE: tablename/chainname/rulenum
 294 +
 295 +         if the ipt_LOG or ipt_ULOG targets are loaded in.
 296 +
 297 +         To compile it as a module, choose M here.  If unsure, say N.
 298 +
 299 +config IP_NF_TARGET_NOTRACK
 300 +       tristate "NOTRACK target support"
 301 +       depends on IP_NF_RAW
 302 +       help
 303 +         The NOTRACK target allows a select rule to specify which
 304 +         packets *not* to enter the conntrack/NAT subsystems
 305 +         with all the consequences (no ICMP error tracking,
 306 +         no protocol helpers for the selected packets).
 307 +
 308 +         To compile it as a module, choose M here.  If unsure, say N.
 309 +
 310  config IP_NF_ARPTABLES
 311         tristate "ARP tables support"
 312
 313 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/Makefile linux-2.6.0-test7/net/ipv4/netfilter/Makefile
 314 --- linux-2.6.0-test7.org/net/ipv4/netfilter/Makefile   2003-10-08 21:24:02.000000000 +0200
 315 +++ linux-2.6.0-test7/net/ipv4/netfilter/Makefile       2003-10-10 11:53:27.000000000 +0200
 316 @@ -34,12 +34,14 @@
 317  # generic IP tables
 318  obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
 319
 320 -# the three instances of ip_tables
 321 +# the four instances of ip_tables
 322  obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
 323  obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
 324  obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
 325 +obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
 326
 327  # matches
 328 +obj-$(CONFIG_IP_NF_MATCH_SCTP) += ipt_sctp.o
 329  obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
 330  obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
 331  obj-$(CONFIG_IP_NF_MATCH_MARK) += ipt_mark.o
 332 @@ -81,6 +83,8 @@
 333  obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
 334  obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
 335  obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
 336 +obj-$(CONFIG_IP_NF_TARGET_NOTRACK) += ipt_NOTRACK.o
 337 +obj-$(CONFIG_IP_NF_TARGET_TRACE) += ipt_TRACE.o
 338
 339  # generic ARP tables
 340  obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
 341 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ip_conntrack_amanda.c linux-2.6.0-test7/net/ipv4/netfilter/ip_conntrack_amanda.c
 342 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ip_conntrack_amanda.c      2003-10-08 21:24:17.000000000 +0200
 343 +++ linux-2.6.0-test7/net/ipv4/netfilter/ip_conntrack_amanda.c  2003-10-10 11:52:23.000000000 +0200
 344 @@ -210,5 +210,7 @@
 345  PROVIDES_CONNTRACK(amanda);
 346  EXPORT_SYMBOL(ip_amanda_lock);
 347
 348 +EXPORT_SYMBOL(ip_amanda_lock);
 349 +
 350  module_init(init);
 351  module_exit(fini);
 352 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ip_conntrack_core.c linux-2.6.0-test7/net/ipv4/netfilter/ip_conntrack_core.c
 353 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ip_conntrack_core.c        2003-10-08 21:24:00.000000000 +0200
 354 +++ linux-2.6.0-test7/net/ipv4/netfilter/ip_conntrack_core.c    2003-10-10 11:53:17.000000000 +0200
 355 @@ -29,8 +29,7 @@
 356  #include <linux/slab.h>
 357  #include <linux/random.h>
 358  #include <linux/jhash.h>
 359 -/* For ERR_PTR().  Yeah, I know... --RR */
 360 -#include <linux/fs.h>
 361 +#include <linux/err.h>
 362
 363  /* This rwlock protects the main hash table, protocol/helper/expected
 364     registrations, conntrack timers*/
 365 @@ -63,6 +62,7 @@
 366  static atomic_t ip_conntrack_count = ATOMIC_INIT(0);
 367  struct list_head *ip_conntrack_hash;
 368  static kmem_cache_t *ip_conntrack_cachep;
 369 +struct ip_conntrack ip_conntrack_untracked;
 370
 371  extern struct ip_conntrack_protocol ip_conntrack_generic_protocol;
 372
 373 @@ -808,18 +808,10 @@
 374         }
 375  #endif
 376
 377 -       /* Previously seen (loopback)?  Ignore.  Do this before
 378 -           fragment check. */
 379 +       /* Previously seen (loopback or untracked)?  Ignore. */
 380         if ((*pskb)->nfct)
 381                 return NF_ACCEPT;
 382
 383 -       /* Gather fragments. */
 384 -       if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
 385 -               *pskb = ip_ct_gather_frags(*pskb);
 386 -               if (!*pskb)
 387 -                       return NF_STOLEN;
 388 -       }
 389 -
 390         proto = ip_ct_find_proto((*pskb)->nh.iph->protocol);
 391
 392         /* It may be an icmp error... */
 393 @@ -953,7 +945,6 @@
 394                 }
 395         } else if (related_to->helper->max_expected &&
 396                    related_to->expecting >= related_to->helper->max_expected) {
 397 -               struct list_head *cur_item;
 398                 /* old == NULL */
 399                 if (!(related_to->helper->flags &
 400                       IP_CT_HELPER_F_REUSE_EXPECT)) {
 401 @@ -978,21 +969,14 @@
 402                        NIPQUAD(related_to->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip));
 403
 404                 /* choose the the oldest expectation to evict */
 405 -               list_for_each(cur_item, &related_to->sibling_list) {
 406 -                       struct ip_conntrack_expect *cur;
 407 -
 408 -                       cur = list_entry(cur_item,
 409 -                                        struct ip_conntrack_expect,
 410 -                                        expected_list);
 411 -                       if (cur->sibling == NULL) {
 412 -                               old = cur;
 413 +               list_for_each_entry(old, &related_to->sibling_list,
 414 +                                                     expected_list)
 415 +                       if (old->sibling == NULL)
 416                                 break;
 417 -                       }
 418 -               }
 419
 420 -               /* (!old) cannot happen, since related_to->expecting is the
 421 -                * number of unconfirmed expects */
 422 -               IP_NF_ASSERT(old);
 423 +               /* We cannot fail since related_to->expecting is the number
 424 +                * of unconfirmed expectations */
 425 +               IP_NF_ASSERT(old && old->sibling == NULL);
 426
 427                 /* newnat14 does not reuse the real allocated memory
 428                  * structures but rather unexpects the old and
 429 @@ -1024,7 +1008,7 @@
 430         atomic_set(&new->use, 1);
 431
 432         /* add to expected list for this connection */
 433 -       list_add(&new->expected_list, &related_to->sibling_list);
 434 +       list_add_tail(&new->expected_list, &related_to->sibling_list);
 435         /* add to global list of expectations */
 436         list_prepend(&ip_conntrack_expect_list, &new->list);
 437         /* add and start timer if required */
 438 @@ -1419,6 +1403,15 @@
 439
 440         /* For use by ipt_REJECT */
 441         ip_ct_attach = ip_conntrack_attach;
 442 +
 443 +       /* Set up fake conntrack:
 444 +           - to never be deleted, not in any hashes */
 445 +       atomic_set(&ip_conntrack_untracked.ct_general.use, 1);
 446 +       /*  - and look it like as a confirmed connection */
 447 +       set_bit(IPS_CONFIRMED_BIT, &ip_conntrack_untracked.status);
 448 +       /*  - and prepare the ctinfo field for NAT. */
 449 +       ip_conntrack_untracked.infos[IP_CT_NEW].master = &ip_conntrack_untracked.ct_general;
 450 +
 451         return ret;
 452
 453  err_free_hash:
 454 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.6.0-test7/net/ipv4/netfilter/ip_conntrack_standalone.c
 455 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ip_conntrack_standalone.c  2003-10-08 21:24:04.000000000 +0200
 456 +++ linux-2.6.0-test7/net/ipv4/netfilter/ip_conntrack_standalone.c      2003-10-10 11:53:17.000000000 +0200
 457 @@ -186,6 +186,26 @@
 458         return ip_conntrack_confirm(*pskb);
 459  }
 460
 461 +static unsigned int ip_conntrack_defrag(unsigned int hooknum,
 462 +                                       struct sk_buff **pskb,
 463 +                                       const struct net_device *in,
 464 +                                       const struct net_device *out,
 465 +                                       int (*okfn)(struct sk_buff *))
 466 +{
 467 +       /* Previously seen (loopback)?  Ignore.  Do this before
 468 +           fragment check. */
 469 +       if ((*pskb)->nfct)
 470 +               return NF_ACCEPT;
 471 +
 472 +       /* Gather fragments. */
 473 +       if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
 474 +               *pskb = ip_ct_gather_frags(*pskb);
 475 +               if (!*pskb)
 476 +                       return NF_STOLEN;
 477 +       }
 478 +       return NF_ACCEPT;
 479 +}
 480 +
 481  static unsigned int ip_refrag(unsigned int hooknum,
 482                               struct sk_buff **pskb,
 483                               const struct net_device *in,
 484 @@ -225,6 +245,15 @@
 485         return ip_conntrack_in(hooknum, pskb, in, out, okfn);
 486  }
 487
 488 +/* At the very first: defragment */
 489 +static struct nf_hook_ops ip_conntrack_defrag_ops = {
 490 +       .hook           = ip_conntrack_defrag,
 491 +       .owner          = THIS_MODULE,
 492 +       .pf             = PF_INET,
 493 +       .hooknum        = NF_IP_PRE_ROUTING,
 494 +       .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
 495 +};
 496 +
 497  /* Connection tracking may drop packets, but never alters them, so
 498     make it the first hook. */
 499  static struct nf_hook_ops ip_conntrack_in_ops = {
 500 @@ -367,10 +396,15 @@
 501         if (!proc) goto cleanup_init;
 502         proc->owner = THIS_MODULE;
 503
 504 +       ret = nf_register_hook(&ip_conntrack_defrag_ops);
 505 +       if (ret < 0) {
 506 +               printk("ip_conntrack: can't register pre-routing hook to defrag.\n");
 507 +               goto cleanup_proc;
 508 +       }
 509         ret = nf_register_hook(&ip_conntrack_in_ops);
 510         if (ret < 0) {
 511                 printk("ip_conntrack: can't register pre-routing hook.\n");
 512 -               goto cleanup_proc;
 513 +               goto cleanup_defragops;
 514         }
 515         ret = nf_register_hook(&ip_conntrack_local_out_ops);
 516         if (ret < 0) {
 517 @@ -408,6 +442,8 @@
 518         nf_unregister_hook(&ip_conntrack_local_out_ops);
 519   cleanup_inops:
 520         nf_unregister_hook(&ip_conntrack_in_ops);
 521 + cleanup_defragops:
 522 +       nf_unregister_hook(&ip_conntrack_defrag_ops);
 523   cleanup_proc:
 524         proc_net_remove("ip_conntrack");
 525   cleanup_init:
 526 @@ -499,5 +535,6 @@
 527  EXPORT_SYMBOL(ip_conntrack_expect_list);
 528  EXPORT_SYMBOL(ip_conntrack_lock);
 529  EXPORT_SYMBOL(ip_conntrack_hash);
 530 +EXPORT_SYMBOL(ip_conntrack_untracked);
 531  EXPORT_SYMBOL_GPL(ip_conntrack_find_get);
 532  EXPORT_SYMBOL_GPL(ip_conntrack_put);
 533 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ip_conntrack_tftp.c linux-2.6.0-test7/net/ipv4/netfilter/ip_conntrack_tftp.c
 534 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ip_conntrack_tftp.c        2003-10-08 21:24:03.000000000 +0200
 535 +++ linux-2.6.0-test7/net/ipv4/netfilter/ip_conntrack_tftp.c    2003-10-10 11:52:47.000000000 +0200
 536 @@ -97,8 +97,6 @@
 537
 538         for (i = 0 ; (i < MAX_PORTS) && ports[i] ; i++) {
 539                 /* Create helper structure */
 540 -               memset(&tftp[i], 0, sizeof(struct ip_conntrack_helper));
 541 -
 542                 tftp[i].tuple.dst.protonum = IPPROTO_UDP;
 543                 tftp[i].tuple.src.u.udp.port = htons(ports[i]);
 544                 tftp[i].mask.dst.protonum = 0xFFFF;
 545 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ip_nat_amanda.c linux-2.6.0-test7/net/ipv4/netfilter/ip_nat_amanda.c
 546 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ip_nat_amanda.c    2003-10-08 21:24:02.000000000 +0200
 547 +++ linux-2.6.0-test7/net/ipv4/netfilter/ip_nat_amanda.c        2003-10-10 11:52:47.000000000 +0200
 548 @@ -195,8 +195,6 @@
 549         struct ip_nat_helper *hlpr;
 550
 551         hlpr = &ip_nat_amanda_helper;
 552 -       memset(hlpr, 0, sizeof(struct ip_nat_helper));
 553 -
 554         hlpr->tuple.dst.protonum = IPPROTO_UDP;
 555         hlpr->tuple.src.u.udp.port = htons(10080);
 556         hlpr->mask.src.u.udp.port = 0xFFFF;
 557 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ip_nat_core.c linux-2.6.0-test7/net/ipv4/netfilter/ip_nat_core.c
 558 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ip_nat_core.c      2003-10-08 21:24:02.000000000 +0200
 559 +++ linux-2.6.0-test7/net/ipv4/netfilter/ip_nat_core.c  2003-10-10 11:53:17.000000000 +0200
 560 @@ -809,7 +809,7 @@
 561
 562                 /* Have to grab read lock before sibling_list traversal */
 563                 READ_LOCK(&ip_conntrack_lock);
 564 -               list_for_each(cur_item, &ct->sibling_list) {
 565 +               list_for_each_prev(cur_item, &ct->sibling_list) {
 566                         exp = list_entry(cur_item, struct ip_conntrack_expect,
 567                                          expected_list);
 568
 569 @@ -1009,7 +1009,11 @@
 570         /* FIXME: Man, this is a hack.  <SIGH> */
 571         IP_NF_ASSERT(ip_conntrack_destroyed == NULL);
 572         ip_conntrack_destroyed = &ip_nat_cleanup_conntrack;
 573 -
 574 +
 575 +       /* Initialize fake conntrack so that NAT will skip it */
 576 +       ip_conntrack_untracked.nat.info.initialized |=
 577 +               (1 << IP_NAT_MANIP_SRC) | (1 << IP_NAT_MANIP_DST);
 578 +
 579         return 0;
 580  }
 581
 582 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ip_nat_rule.c linux-2.6.0-test7/net/ipv4/netfilter/ip_nat_rule.c
 583 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ip_nat_rule.c      2003-10-08 21:24:04.000000000 +0200
 584 +++ linux-2.6.0-test7/net/ipv4/netfilter/ip_nat_rule.c  2003-10-10 11:53:17.000000000 +0200
 585 @@ -67,7 +67,7 @@
 586                 0,
 587                 sizeof(struct ipt_entry),
 588                 sizeof(struct ipt_standard),
 589 -               0, { 0, 0 }, { } },
 590 +               0, NULL, 0, { 0, 0 }, { } },
 591               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
 592                 -NF_ACCEPT - 1 } },
 593             /* POST_ROUTING */
 594 @@ -75,7 +75,7 @@
 595                 0,
 596                 sizeof(struct ipt_entry),
 597                 sizeof(struct ipt_standard),
 598 -               0, { 0, 0 }, { } },
 599 +               0, NULL, 0, { 0, 0 }, { } },
 600               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
 601                 -NF_ACCEPT - 1 } },
 602             /* LOCAL_OUT */
 603 @@ -83,7 +83,7 @@
 604                 0,
 605                 sizeof(struct ipt_entry),
 606                 sizeof(struct ipt_standard),
 607 -               0, { 0, 0 }, { } },
 608 +               0, NULL, 0, { 0, 0 }, { } },
 609               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
 610                 -NF_ACCEPT - 1 } }
 611      },
 612 @@ -92,7 +92,7 @@
 613         0,
 614         sizeof(struct ipt_entry),
 615         sizeof(struct ipt_error),
 616 -       0, { 0, 0 }, { } },
 617 +       0, NULL, 0, { 0, 0 }, { } },
 618        { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
 619           { } },
 620         "ERROR"
 621 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ip_nat_tftp.c linux-2.6.0-test7/net/ipv4/netfilter/ip_nat_tftp.c
 622 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ip_nat_tftp.c      2003-10-08 21:24:03.000000000 +0200
 623 +++ linux-2.6.0-test7/net/ipv4/netfilter/ip_nat_tftp.c  2003-10-10 11:52:47.000000000 +0200
 624 @@ -164,8 +164,6 @@
 625                 ports[0] = TFTP_PORT;
 626
 627         for (i = 0 ; (i < MAX_PORTS) && ports[i] ; i++) {
 628 -               memset(&tftp[i], 0, sizeof(struct ip_nat_helper));
 629 -
 630                 tftp[i].tuple.dst.protonum = IPPROTO_UDP;
 631                 tftp[i].tuple.src.u.udp.port = htons(ports[i]);
 632                 tftp[i].mask.dst.protonum = 0xFFFF;
 633 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ip_tables.c linux-2.6.0-test7/net/ipv4/netfilter/ip_tables.c
 634 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ip_tables.c        2003-10-08 21:24:02.000000000 +0200
 635 +++ linux-2.6.0-test7/net/ipv4/netfilter/ip_tables.c    2003-10-10 11:53:17.000000000 +0200
 636 @@ -11,6 +11,7 @@
 637  #include <linux/config.h>
 638  #include <linux/cache.h>
 639  #include <linux/skbuff.h>
 640 +#include <linux/socket.h>
 641  #include <linux/kmod.h>
 642  #include <linux/vmalloc.h>
 643  #include <linux/netdevice.h>
 644 @@ -23,8 +24,17 @@
 645  #include <asm/semaphore.h>
 646  #include <linux/proc_fs.h>
 647
 648 +#include <linux/netfilter.h>
 649  #include <linux/netfilter_ipv4/ip_tables.h>
 650
 651 +static const char *hooknames[] = {
 652 +       [NF_IP_PRE_ROUTING] "PREROUTING",
 653 +       [NF_IP_LOCAL_IN] "INPUT",
 654 +       [NF_IP_FORWARD] "FORWARD",
 655 +       [NF_IP_LOCAL_OUT] "OUTPUT",
 656 +       [NF_IP_POST_ROUTING] "POSTROUTING",
 657 +};
 658 +
 659  MODULE_LICENSE("GPL");
 660  MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 661  MODULE_DESCRIPTION("IPv4 packet filter");
 662 @@ -322,6 +332,12 @@
 663
 664                         t = ipt_get_target(e);
 665                         IP_NF_ASSERT(t->u.kernel.target);
 666 +
 667 +                       /* The packet traced and the rule isn't an unconditional return/END. */
 668 +                       if (((*pskb)->nfcache & NFC_TRACE) && e->rulenum) {
 669 +                               nf_log_packet(AF_INET, hook, *pskb, in, out, "TRACE: %s/%s/%u ",
 670 +                                                table->name, e->chainname, e->rulenum);
 671 +                       }
 672                         /* Standard target? */
 673                         if (!t->u.kernel.target->target) {
 674                                 int v;
 675 @@ -474,6 +490,29 @@
 676         return find_inlist_lock(&ipt_target, name, "ipt_", error, mutex);
 677  }
 678
 679 +static inline int
 680 +find_error_target(struct ipt_entry *s,
 681 +                 struct ipt_entry *e,
 682 +                 char **chainname)
 683 +{
 684 +       struct ipt_entry_target *t;
 685 +       static struct ipt_entry *found = NULL;
 686 +
 687 +       if (s == e) {
 688 +               if (!found)
 689 +                       return 0;
 690 +               t = ipt_get_target(found);
 691 +               if (strcmp(t->u.user.name,
 692 +                          IPT_ERROR_TARGET) == 0) {
 693 +                       *chainname = t->data;
 694 +                       return 1;
 695 +               }
 696 +       } else
 697 +               found = s;
 698 +
 699 +       return 0;
 700 +}
 701 +
 702  /* All zeroes == unconditional rule. */
 703  static inline int
 704  unconditional(const struct ipt_ip *ip)
 705 @@ -493,6 +532,8 @@
 706  mark_source_chains(struct ipt_table_info *newinfo, unsigned int valid_hooks)
 707  {
 708         unsigned int hook;
 709 +       char *chainname = NULL;
 710 +       u_int32_t rulenum;
 711
 712         /* No recursion; use packet counter to save back ptrs (reset
 713            to 0 as we leave), and comefrom to save source hook bitmask */
 714 @@ -506,6 +547,8 @@
 715
 716                 /* Set initial back pointer. */
 717                 e->counters.pcnt = pos;
 718 +               rulenum = 1;
 719 +               chainname = (char *) hooknames[hook];
 720
 721                 for (;;) {
 722                         struct ipt_standard_target *t
 723 @@ -518,6 +561,8 @@
 724                         }
 725                         e->comefrom
 726                                 |= ((1 << hook) | (1 << NF_IP_NUMHOOKS));
 727 +                       e->rulenum = rulenum++;
 728 +                       e->chainname = chainname;
 729
 730                         /* Unconditional return/END. */
 731                         if (e->target_offset == sizeof(struct ipt_entry)
 732 @@ -527,6 +572,10 @@
 733                             && unconditional(&e->ip)) {
 734                                 unsigned int oldpos, size;
 735
 736 +                               /* Set unconditional rulenum to zero. */
 737 +                               e->rulenum = 0;
 738 +                               e->counters.bcnt = 0;
 739 +
 740                                 /* Return: backtrack through the last
 741                                    big jump. */
 742                                 do {
 743 @@ -552,6 +601,11 @@
 744                                                 (newinfo->entries + pos);
 745                                 } while (oldpos == pos + e->next_offset);
 746
 747 +                               /* Restore chainname, rulenum. */
 748 +                               chainname = e->chainname;
 749 +                               rulenum = e->counters.bcnt;
 750 +                               e->counters.bcnt = 0;
 751 +
 752                                 /* Move along one */
 753                                 size = e->next_offset;
 754                                 e = (struct ipt_entry *)
 755 @@ -567,6 +621,17 @@
 756                                         /* This a jump; chase it. */
 757                                         duprintf("Jump rule %u -> %u\n",
 758                                                  pos, newpos);
 759 +                                       e->counters.bcnt = rulenum++;
 760 +                                       rulenum = 1;
 761 +                                       e = (struct ipt_entry *)
 762 +                                               (newinfo->entries + newpos);
 763 +                                       if (IPT_ENTRY_ITERATE(newinfo->entries,
 764 +                                                             newinfo->size,
 765 +                                                             find_error_target,
 766 +                                                             e, &chainname) == 0) {
 767 +                                               printk("ip_tables: table screwed up!\n");
 768 +                                               return 0;
 769 +                                       }
 770                                 } else {
 771                                         /* ... this is a fallthru */
 772                                         newpos = pos + e->next_offset;
 773 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ipt_LOG.c linux-2.6.0-test7/net/ipv4/netfilter/ipt_LOG.c
 774 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ipt_LOG.c  2003-10-08 21:24:43.000000000 +0200
 775 +++ linux-2.6.0-test7/net/ipv4/netfilter/ipt_LOG.c      2003-10-10 11:52:57.000000000 +0200
 776 @@ -4,12 +4,14 @@
 777  #include <linux/module.h>
 778  #include <linux/spinlock.h>
 779  #include <linux/skbuff.h>
 780 +#include <linux/socket.h>
 781  #include <linux/ip.h>
 782  #include <net/icmp.h>
 783  #include <net/udp.h>
 784  #include <net/tcp.h>
 785  #include <net/route.h>
 786
 787 +#include <linux/netfilter.h>
 788  #include <linux/netfilter_ipv4/ip_tables.h>
 789  #include <linux/netfilter_ipv4/ipt_LOG.h>
 790
 791 @@ -17,6 +19,10 @@
 792  MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 793  MODULE_DESCRIPTION("iptables syslog logging module");
 794
 795 +static unsigned int nflog = 1;
 796 +MODULE_PARM(nflog, "i");
 797 +MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
 798 +
 799  #if 0
 800  #define DEBUGP printk
 801  #else
 802 @@ -315,28 +321,25 @@
 803         /* maxlen = 230+   91  + 230 + 252 = 803 */
 804  }
 805
 806 -static unsigned int
 807 -ipt_log_target(struct sk_buff **pskb,
 808 +static void
 809 +ipt_log_packet(unsigned int hooknum,
 810 +              const struct sk_buff *skb,
 811                const struct net_device *in,
 812                const struct net_device *out,
 813 -              unsigned int hooknum,
 814 -              const void *targinfo,
 815 -              void *userinfo)
 816 +              const struct ipt_log_info *loginfo,
 817 +              const char *level_string,
 818 +              const char *prefix)
 819  {
 820 -       const struct ipt_log_info *loginfo = targinfo;
 821 -       char level_string[4] = "< >";
 822 -
 823 -       level_string[1] = '0' + (loginfo->level % 8);
 824         spin_lock_bh(&log_lock);
 825         printk(level_string);
 826         printk("%sIN=%s OUT=%s ",
 827 -              loginfo->prefix,
 828 +              prefix == NULL ? loginfo->prefix : prefix,
 829                in ? in->name : "",
 830                out ? out->name : "");
 831  #ifdef CONFIG_BRIDGE_NETFILTER
 832 -       if ((*pskb)->nf_bridge) {
 833 -               struct net_device *physindev = (*pskb)->nf_bridge->physindev;
 834 -               struct net_device *physoutdev = (*pskb)->nf_bridge->physoutdev;
 835 +       if (skb->nf_bridge) {
 836 +               struct net_device *physindev = skb->nf_bridge->physindev;
 837 +               struct net_device *physoutdev = skb->nf_bridge->physoutdev;
 838
 839                 if (physindev && in != physindev)
 840                         printk("PHYSIN=%s ", physindev->name);
 841 @@ -348,25 +351,56 @@
 842         if (in && !out) {
 843                 /* MAC logging for input chain only. */
 844                 printk("MAC=");
 845 -               if ((*pskb)->dev && (*pskb)->dev->hard_header_len
 846 -                   && (*pskb)->mac.raw != (void*)(*pskb)->nh.iph) {
 847 +               if (skb->dev && skb->dev->hard_header_len
 848 +                   && skb->mac.raw != (void*)skb->nh.iph) {
 849                         int i;
 850 -                       unsigned char *p = (*pskb)->mac.raw;
 851 -                       for (i = 0; i < (*pskb)->dev->hard_header_len; i++,p++)
 852 +                       unsigned char *p = skb->mac.raw;
 853 +                       for (i = 0; i < skb->dev->hard_header_len; i++,p++)
 854                                 printk("%02x%c", *p,
 855 -                                      i==(*pskb)->dev->hard_header_len - 1
 856 +                                      i==skb->dev->hard_header_len - 1
 857                                        ? ' ':':');
 858                 } else
 859                         printk(" ");
 860         }
 861
 862 -       dump_packet(loginfo, *pskb, 0);
 863 +       dump_packet(loginfo, skb, 0);
 864         printk("\n");
 865         spin_unlock_bh(&log_lock);
 866 +}
 867 +
 868 +static unsigned int
 869 +ipt_log_target(struct sk_buff **pskb,
 870 +              const struct net_device *in,
 871 +              const struct net_device *out,
 872 +              unsigned int hooknum,
 873 +              const void *targinfo,
 874 +              void *userinfo)
 875 +{
 876 +       const struct ipt_log_info *loginfo = targinfo;
 877 +       char level_string[4] = "< >";
 878 +
 879 +       level_string[1] = '0' + (loginfo->level % 8);
 880 +       ipt_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
 881
 882         return IPT_CONTINUE;
 883  }
 884
 885 +static void
 886 +ipt_logfn(unsigned int hooknum,
 887 +         const struct sk_buff *skb,
 888 +         const struct net_device *in,
 889 +         const struct net_device *out,
 890 +         const char *prefix)
 891 +{
 892 +       struct ipt_log_info loginfo = {
 893 +               .level = 0,
 894 +               .logflags = IPT_LOG_MASK,
 895 +               .prefix = ""
 896 +       };
 897 +
 898 +       ipt_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
 899 +}
 900 +
 901  static int ipt_log_checkentry(const char *tablename,
 902                               const struct ipt_entry *e,
 903                               void *targinfo,
 904 @@ -406,12 +440,17 @@
 905  {
 906         if (ipt_register_target(&ipt_log_reg))
 907                 return -EINVAL;
 908 +       if (nflog)
 909 +               nf_log_register(PF_INET, &ipt_logfn);
 910
 911         return 0;
 912  }
 913
 914  static void __exit fini(void)
 915  {
 916 +       if (nflog)
 917 +               nf_log_unregister(PF_INET, &ipt_logfn);
 918 +
 919         ipt_unregister_target(&ipt_log_reg);
 920  }
 921
 922 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ipt_NOTRACK.c linux-2.6.0-test7/net/ipv4/netfilter/ipt_NOTRACK.c
 923 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ipt_NOTRACK.c      1970-01-01 01:00:00.000000000 +0100
 924 +++ linux-2.6.0-test7/net/ipv4/netfilter/ipt_NOTRACK.c  2003-10-10 11:53:17.000000000 +0200
 925 @@ -0,0 +1,79 @@
 926 +/* This is a module which is used for setting up fake conntracks
 927 + * on packets so that they are not seen by the conntrack/NAT code.
 928 + */
 929 +#include <linux/module.h>
 930 +#include <linux/skbuff.h>
 931 +
 932 +#include <linux/netfilter_ipv4/ip_tables.h>
 933 +#include <linux/netfilter_ipv4/ip_conntrack.h>
 934 +
 935 +static unsigned int
 936 +target(struct sk_buff **pskb,
 937 +       const struct net_device *in,
 938 +       const struct net_device *out,
 939 +       unsigned int hooknum,
 940 +       const void *targinfo,
 941 +       void *userinfo)
 942 +{
 943 +       /* Previously seen (loopback)? Ignore. */
 944 +       if ((*pskb)->nfct != NULL)
 945 +               return IPT_CONTINUE;
 946 +
 947 +       /* Attach fake conntrack entry.
 948 +          If there is a real ct entry correspondig to this packet,
 949 +          it'll hang aroun till timing out. We don't deal with it
 950 +          for performance reasons. JK */
 951 +       (*pskb)->nfct = &ip_conntrack_untracked.infos[IP_CT_NEW];
 952 +       nf_conntrack_get((*pskb)->nfct);
 953 +
 954 +       return IPT_CONTINUE;
 955 +}
 956 +
 957 +static int
 958 +checkentry(const char *tablename,
 959 +          const struct ipt_entry *e,
 960 +           void *targinfo,
 961 +           unsigned int targinfosize,
 962 +           unsigned int hook_mask)
 963 +{
 964 +       if (targinfosize != 0) {
 965 +               printk(KERN_WARNING "NOTRACK: targinfosize %u != 0\n",
 966 +                      targinfosize);
 967 +               return 0;
 968 +       }
 969 +
 970 +       if (strcmp(tablename, "raw") != 0) {
 971 +               printk(KERN_WARNING "NOTRACK: can only be called from \"raw\" table, not \"%s\"\n", tablename);
 972 +               return 0;
 973 +       }
 974 +
 975 +       return 1;
 976 +}
 977 +
 978 +static struct ipt_target ipt_notrack_reg = {
 979 +       .name           = "NOTRACK",
 980 +       .target         = target,
 981 +       .checkentry     = checkentry,
 982 +       .destroy        = NULL,
 983 +       .me             = THIS_MODULE,
 984 +};
 985 +
 986 +static int __init init(void)
 987 +{
 988 +       if (ipt_register_target(&ipt_notrack_reg))
 989 +               return -EINVAL;
 990 +
 991 +       return 0;
 992 +}
 993 +
 994 +static void __exit fini(void)
 995 +{
 996 +       ipt_unregister_target(&ipt_notrack_reg);
 997 +}
 998 +
 999 +module_init(init);
1000 +module_exit(fini);
1001 +
1002 +MODULE_LICENSE("GPL");
1003 +MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1004 +MODULE_DESCRIPTION("IPv4 NOTRACK target");
1005 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ipt_TRACE.c linux-2.6.0-test7/net/ipv4/netfilter/ipt_TRACE.c
1006 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ipt_TRACE.c        1970-01-01 01:00:00.000000000 +0100
1007 +++ linux-2.6.0-test7/net/ipv4/netfilter/ipt_TRACE.c    2003-10-10 11:53:17.000000000 +0200
1008 @@ -0,0 +1,67 @@
1009 +/* This is a module which is used for setting
1010 + * the NFC_TRACE flag in the nfcache field of an skb.
1011 + */
1012 +#include <linux/module.h>
1013 +#include <linux/skbuff.h>
1014 +
1015 +#include <linux/netfilter_ipv4/ip_tables.h>
1016 +
1017 +static unsigned int
1018 +target(struct sk_buff **pskb,
1019 +       const struct net_device *in,
1020 +       const struct net_device *out,
1021 +       unsigned int hooknum,
1022 +       const void *targinfo,
1023 +       void *userinfo)
1024 +{
1025 +       (*pskb)->nfcache |= NFC_TRACE;
1026 +       return IPT_CONTINUE;
1027 +}
1028 +
1029 +static int
1030 +checkentry(const char *tablename,
1031 +          const struct ipt_entry *e,
1032 +           void *targinfo,
1033 +           unsigned int targinfosize,
1034 +           unsigned int hook_mask)
1035 +{
1036 +       if (targinfosize != 0) {
1037 +               printk(KERN_WARNING "TRACE: targinfosize %u != 0\n",
1038 +                      targinfosize);
1039 +               return 0;
1040 +       }
1041 +
1042 +       if (strcmp(tablename, "raw") != 0) {
1043 +               printk(KERN_WARNING "TRACE: can only be called from \"raw\" table, not \"%s\"\n", tablename);
1044 +               return 0;
1045 +       }
1046 +
1047 +       return 1;
1048 +}
1049 +
1050 +static struct ipt_target ipt_trace_reg = {
1051 +       .name           = "TRACE",
1052 +       .target         = target,
1053 +       .checkentry     = checkentry,
1054 +       .destroy        = NULL,
1055 +       .me             = THIS_MODULE,
1056 +};
1057 +
1058 +static int __init init(void)
1059 +{
1060 +       if (ipt_register_target(&ipt_trace_reg))
1061 +               return -EINVAL;
1062 +
1063 +       return 0;
1064 +}
1065 +
1066 +static void __exit fini(void)
1067 +{
1068 +       ipt_unregister_target(&ipt_trace_reg);
1069 +}
1070 +
1071 +module_init(init);
1072 +module_exit(fini);
1073 +MODULE_LICENSE("GPL");
1074 +MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1075 +MODULE_DESCRIPTION("IPv4 TRACE target");
1076 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ipt_ULOG.c linux-2.6.0-test7/net/ipv4/netfilter/ipt_ULOG.c
1077 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ipt_ULOG.c 2003-10-08 21:24:03.000000000 +0200
1078 +++ linux-2.6.0-test7/net/ipv4/netfilter/ipt_ULOG.c     2003-10-10 11:52:57.000000000 +0200
1079 @@ -45,6 +45,7 @@
1080  #include <linux/netlink.h>
1081  #include <linux/netdevice.h>
1082  #include <linux/mm.h>
1083 +#include <linux/netfilter.h>
1084  #include <linux/netfilter_ipv4/ip_tables.h>
1085  #include <linux/netfilter_ipv4/ipt_ULOG.h>
1086  #include <linux/netfilter_ipv4/lockhelp.h>
1087 @@ -75,6 +76,10 @@
1088  MODULE_PARM(flushtimeout, "i");
1089  MODULE_PARM_DESC(flushtimeout, "buffer flush timeout");
1090
1091 +static unsigned int nflog = 1;
1092 +MODULE_PARM(nflog, "i");
1093 +MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
1094 +
1095  /* global data structures */
1096
1097  typedef struct {
1098 @@ -152,17 +157,17 @@
1099         return skb;
1100  }
1101
1102 -static unsigned int ipt_ulog_target(struct sk_buff **pskb,
1103 -                                   const struct net_device *in,
1104 -                                   const struct net_device *out,
1105 -                                   unsigned int hooknum,
1106 -                                   const void *targinfo, void *userinfo)
1107 +static void ipt_ulog_packet(unsigned int hooknum,
1108 +                           const struct sk_buff *skb,
1109 +                           const struct net_device *in,
1110 +                           const struct net_device *out,
1111 +                           const struct ipt_ulog_info *loginfo,
1112 +                           const char *prefix)
1113  {
1114         ulog_buff_t *ub;
1115         ulog_packet_msg_t *pm;
1116         size_t size, copy_len;
1117         struct nlmsghdr *nlh;
1118 -       struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
1119
1120         /* ffs == find first bit set, necessary because userspace
1121          * is already shifting groupnumber, but we need unshifted.
1122 @@ -171,8 +176,8 @@
1123
1124         /* calculate the size of the skb needed */
1125         if ((loginfo->copy_range == 0) ||
1126 -           (loginfo->copy_range > (*pskb)->len)) {
1127 -               copy_len = (*pskb)->len;
1128 +           (loginfo->copy_range > skb->len)) {
1129 +               copy_len = skb->len;
1130         } else {
1131                 copy_len = loginfo->copy_range;
1132         }
1133 @@ -209,19 +214,21 @@
1134
1135         /* copy hook, prefix, timestamp, payload, etc. */
1136         pm->data_len = copy_len;
1137 -       pm->timestamp_sec = (*pskb)->stamp.tv_sec;
1138 -       pm->timestamp_usec = (*pskb)->stamp.tv_usec;
1139 -       pm->mark = (*pskb)->nfmark;
1140 +       pm->timestamp_sec = skb->stamp.tv_sec;
1141 +       pm->timestamp_usec = skb->stamp.tv_usec;
1142 +       pm->mark = skb->nfmark;
1143         pm->hook = hooknum;
1144 -       if (loginfo->prefix[0] != '\0')
1145 +       if (prefix != NULL)
1146 +               strncpy(pm->prefix, prefix, sizeof(pm->prefix));
1147 +       else if (loginfo->prefix[0] != '\0')
1148                 strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
1149         else
1150                 *(pm->prefix) = '\0';
1151
1152         if (in && in->hard_header_len > 0
1153 -           && (*pskb)->mac.raw != (void *) (*pskb)->nh.iph
1154 +           && skb->mac.raw != (void *) skb->nh.iph
1155             && in->hard_header_len <= ULOG_MAC_LEN) {
1156 -               memcpy(pm->mac, (*pskb)->mac.raw, in->hard_header_len);
1157 +               memcpy(pm->mac, skb->mac.raw, in->hard_header_len);
1158                 pm->mac_len = in->hard_header_len;
1159         } else
1160                 pm->mac_len = 0;
1161 @@ -236,8 +243,8 @@
1162         else
1163                 pm->outdev_name[0] = '\0';
1164
1165 -       /* copy_len <= (*pskb)->len, so can't fail. */
1166 -       if (skb_copy_bits(*pskb, 0, pm->payload, copy_len) < 0)
1167 +       /* copy_len <= skb->len, so can't fail. */
1168 +       if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0)
1169                 BUG();
1170
1171         /* check if we are building multi-part messages */
1172 @@ -261,8 +268,7 @@
1173
1174         UNLOCK_BH(&ulog_lock);
1175
1176 -       return IPT_CONTINUE;
1177 -
1178 +       return;
1179
1180  nlmsg_failure:
1181         PRINTR("ipt_ULOG: error during NLMSG_PUT\n");
1182 @@ -271,8 +277,35 @@
1183         PRINTR("ipt_ULOG: Error building netlink message\n");
1184
1185         UNLOCK_BH(&ulog_lock);
1186 +}
1187 +
1188 +static unsigned int ipt_ulog_target(struct sk_buff **pskb,
1189 +                                   const struct net_device *in,
1190 +                                   const struct net_device *out,
1191 +                                   unsigned int hooknum,
1192 +                                   const void *targinfo, void *userinfo)
1193 +{
1194 +       struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
1195
1196 -       return IPT_CONTINUE;
1197 +       ipt_ulog_packet(hooknum, *pskb, in, out, loginfo, NULL);
1198 +
1199 +       return IPT_CONTINUE;
1200 +}
1201 +
1202 +static void ipt_logfn(unsigned int hooknum,
1203 +                     const struct sk_buff *skb,
1204 +                     const struct net_device *in,
1205 +                     const struct net_device *out,
1206 +                     const char *prefix)
1207 +{
1208 +       struct ipt_ulog_info loginfo = {
1209 +               .nl_group = NFLOG_DEFAULT_NLGROUP,
1210 +               .copy_range = 0,
1211 +               .qthreshold = NFLOG_DEFAULT_QTHRESHOLD,
1212 +               .prefix = ""
1213 +       };
1214 +
1215 +       ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
1216  }
1217
1218  static int ipt_ulog_checkentry(const char *tablename,
1219 @@ -337,6 +370,9 @@
1220                 return -EINVAL;
1221         }
1222
1223 +       if (nflog)
1224 +               nf_log_register(PF_INET, &ipt_logfn);
1225 +
1226         return 0;
1227  }
1228
1229 @@ -347,6 +383,9 @@
1230
1231         DEBUGP("ipt_ULOG: cleanup_module\n");
1232
1233 +       if (nflog)
1234 +               nf_log_unregister(PF_INET, &ipt_logfn);
1235 +
1236         ipt_unregister_target(&ipt_ulog_reg);
1237         sock_release(nflognl->sk_socket);
1238
1239 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ipt_conntrack.c linux-2.6.0-test7/net/ipv4/netfilter/ipt_conntrack.c
1240 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ipt_conntrack.c    2003-10-08 21:24:44.000000000 +0200
1241 +++ linux-2.6.0-test7/net/ipv4/netfilter/ipt_conntrack.c        2003-10-10 11:53:17.000000000 +0200
1242 @@ -29,7 +29,9 @@
1243
1244  #define FWINV(bool,invflg) ((bool) ^ !!(sinfo->invflags & invflg))
1245
1246 -       if (ct)
1247 +       if (skb->nfct == &ip_conntrack_untracked.infos[IP_CT_NEW])
1248 +               statebit = IPT_CONNTRACK_STATE_UNTRACKED;
1249 +       else if (ct)
1250                 statebit = IPT_CONNTRACK_STATE_BIT(ctinfo);
1251         else
1252                 statebit = IPT_CONNTRACK_STATE_INVALID;
1253 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ipt_sctp.c linux-2.6.0-test7/net/ipv4/netfilter/ipt_sctp.c
1254 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ipt_sctp.c 1970-01-01 01:00:00.000000000 +0100
1255 +++ linux-2.6.0-test7/net/ipv4/netfilter/ipt_sctp.c     2003-10-10 11:53:27.000000000 +0200
1256 @@ -0,0 +1,125 @@
1257 +/* IP tables module for matching the SCTP header
1258 + *
1259 + * $ipt_sctp.c,v 1.3 2002/05/29 15:09:00 laforge Exp$
1260 + *
1261 + * (C) 2003 by Harald Welte <laforge@gnumonks.org>
1262 + *
1263 + * This software is distributed under the terms GNU GPL v2
1264 + */
1265 +
1266 +#include <linux/module.h>
1267 +#include <linux/skbuff.h>
1268 +#include <linux/sctp.h>
1269 +
1270 +#include <linux/netfilter_ipv4/ip_tables.h>
1271 +#include <linux/netfilter_ipv4/ipt_sctp.h>
1272 +
1273 +MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
1274 +MODULE_DESCRIPTION("IP tables SCTP matching module");
1275 +MODULE_LICENSE("GPL");
1276 +
1277 +/* Returns 1 if the port is matched by the range, 0 otherwise */
1278 +static inline int
1279 +port_match(u_int16_t min, u_int16_t max, u_int16_t port, int invert)
1280 +{
1281 +       int ret;
1282 +
1283 +       ret = (port >= min && port <= max) ^ invert;
1284 +       return ret;
1285 +}
1286 +
1287 +static int chunk_match(const struct sk_buff *skb, u_int32_t chunks, u_int32_t chunk_mask)
1288 +{
1289 +       sctp_chunkhdr_t *ch = (sctp_chunkhdr_t *) skb->data;
1290 +
1291 +       u_int32_t chunks_present = 0;
1292 +
1293 +       do {
1294 +               u_int8_t *ch_end;
1295 +               ch_end = ((u_int8_t *) ch) + WORD_ROUND(ntohs(ch->length));
1296 +
1297 +               if (ch->type < 32)
1298 +                       chunks_present |= (1 << ch_type);
1299 +               else if (ch->type == SCTP_CID_ASCONF)
1300 +                       chunks_present |= (1 << 31);
1301 +               else if (ch->type == SCTP_CID_ASCONF_ACK)
1302 +                       chunks_present |= (1 << 30);
1303 +
1304 +               ch = (sctp_chunkhdr_t *) ch_end;
1305 +       } while (ch_end < skb->tail);
1306 +
1307 +       return ((chunks_present& chunk_mask) == chunks);
1308 +}
1309 +
1310 +static int match(const struct sk_buff *skb, const struct net_device *in,
1311 +                const struct net_device *out, const void *matchinfo,
1312 +                int offset, const void *hdr, u_int16_t datalen,
1313 +                int *hotdrop)
1314 +{
1315 +       const struct ipt_sctp_info *info = matchinfo;
1316 +       const struct iphdr *iph = skb->nh.iph;
1317 +       const struct sctphdr *sh = (struct sctphdr *) skb->h.raw;
1318 +
1319 +       if (iph->protocol != IPPROTO_SCTP)
1320 +               return 0;
1321 +
1322 +       if (offset == 1) {
1323 +               duprintf("Dropping evil SCTP offset=1 frag.\n");
1324 +               *hotdrop = 1;
1325 +               return 0;
1326 +       } else if (offset == 0 && datalen < sizeof(struct sctphdr)) {
1327 +               /* We've been askd o examine this packet, and we can't.
1328 +                * Hence, no choice but to drop. */
1329 +               duprintf("Dropping evil SCTP offset=0 tinygram.\n");
1330 +               *hotdrop = 1;
1331 +               return 0;
1332 +       }
1333 +
1334 +       return (!offset
1335 +               && port_match(info->spts[0], info->spts[1],
1336 +                             ntohs(sh->source),
1337 +                             !!(info->invflags & IPT_SCTP_INV_SRCPT))
1338 +               && port_match(info->dpts[0], info->dpts[1],
1339 +                             ntohs(sh->dest),
1340 +                             !!(info->invflags & IPT_SCTP_INV_DSTPT))
1341 +               && chunk_match(skb, info->chunks, info->chunk_mask)
1342 +              );
1343 +}
1344 +
1345 +static int checkentry(const char *tablename, const struct ipt_ip *ip,
1346 +                     void *matchinfo, unsigned int matchsize,
1347 +                     unsigned int hook_mask)
1348 +{
1349 +       const struct ipt_sctp_info *info = matchinfo;
1350 +
1351 +       if (matchsize != IPT_ALIGN(sizeof(struct ipt_sctp_info)))
1352 +               return 0;
1353 +
1354 +       if (ip->proto != IPPROTO_SCTP && !(ip->invflags & IPT_INV_PROTO))
1355 +               return 0;
1356 +
1357 +       if !(info->invflags & ~IPT_SCTP_INV_MASK)
1358 +               return 0;
1359 +
1360 +       return 1;
1361 +}
1362 +
1363 +static struct ipt_match sctp_match = {
1364 +       .name           = "sctp",
1365 +       .match          = &match,
1366 +       .checkentry     = &checkentry,
1367 +       .me             = THIS_MODULE,
1368 +};
1369 +
1370 +static int __init init(void)
1371 +{
1372 +       return ipt_register_match(&sctp_match);
1373 +}
1374 +
1375 +static void __exit fini(void)
1376 +{
1377 +       ipt_unregister_match(&sctp_match);
1378 +}
1379 +
1380 +module_init(init);
1381 +module_exit(fini);
1382 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/ipt_state.c linux-2.6.0-test7/net/ipv4/netfilter/ipt_state.c
1383 --- linux-2.6.0-test7.org/net/ipv4/netfilter/ipt_state.c        2003-10-08 21:24:53.000000000 +0200
1384 +++ linux-2.6.0-test7/net/ipv4/netfilter/ipt_state.c    2003-10-10 11:53:17.000000000 +0200
1385 @@ -23,10 +23,12 @@
1386         enum ip_conntrack_info ctinfo;
1387         unsigned int statebit;
1388
1389 -       if (!ip_conntrack_get((struct sk_buff *)skb, &ctinfo))
1390 -               statebit = IPT_STATE_INVALID;
1391 -       else
1392 +       if (skb->nfct == &ip_conntrack_untracked.infos[IP_CT_NEW])
1393 +               statebit = IPT_STATE_UNTRACKED;
1394 +       else if (ip_conntrack_get((struct sk_buff *)skb, &ctinfo))
1395                 statebit = IPT_STATE_BIT(ctinfo);
1396 +       else
1397 +               statebit = IPT_STATE_INVALID;
1398
1399         return (sinfo->statemask & statebit);
1400  }
1401 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/iptable_filter.c linux-2.6.0-test7/net/ipv4/netfilter/iptable_filter.c
1402 --- linux-2.6.0-test7.org/net/ipv4/netfilter/iptable_filter.c   2003-10-08 21:24:04.000000000 +0200
1403 +++ linux-2.6.0-test7/net/ipv4/netfilter/iptable_filter.c       2003-10-10 11:53:17.000000000 +0200
1404 @@ -52,7 +52,7 @@
1405                 0,
1406                 sizeof(struct ipt_entry),
1407                 sizeof(struct ipt_standard),
1408 -               0, { 0, 0 }, { } },
1409 +               0, NULL, 0, { 0, 0 }, { } },
1410               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1411                 -NF_ACCEPT - 1 } },
1412             /* FORWARD */
1413 @@ -60,7 +60,7 @@
1414                 0,
1415                 sizeof(struct ipt_entry),
1416                 sizeof(struct ipt_standard),
1417 -               0, { 0, 0 }, { } },
1418 +               0, NULL, 0, { 0, 0 }, { } },
1419               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1420                 -NF_ACCEPT - 1 } },
1421             /* LOCAL_OUT */
1422 @@ -68,7 +68,7 @@
1423                 0,
1424                 sizeof(struct ipt_entry),
1425                 sizeof(struct ipt_standard),
1426 -               0, { 0, 0 }, { } },
1427 +               0, NULL, 0, { 0, 0 }, { } },
1428               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1429                 -NF_ACCEPT - 1 } }
1430      },
1431 @@ -77,7 +77,7 @@
1432         0,
1433         sizeof(struct ipt_entry),
1434         sizeof(struct ipt_error),
1435 -       0, { 0, 0 }, { } },
1436 +       0, NULL, 0, { 0, 0 }, { } },
1437        { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
1438           { } },
1439         "ERROR"
1440 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/iptable_mangle.c linux-2.6.0-test7/net/ipv4/netfilter/iptable_mangle.c
1441 --- linux-2.6.0-test7.org/net/ipv4/netfilter/iptable_mangle.c   2003-10-08 21:24:43.000000000 +0200
1442 +++ linux-2.6.0-test7/net/ipv4/netfilter/iptable_mangle.c       2003-10-10 11:53:17.000000000 +0200
1443 @@ -69,7 +69,7 @@
1444                 0,
1445                 sizeof(struct ipt_entry),
1446                 sizeof(struct ipt_standard),
1447 -               0, { 0, 0 }, { } },
1448 +               0, NULL, 0, { 0, 0 }, { } },
1449               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1450                 -NF_ACCEPT - 1 } },
1451             /* LOCAL_IN */
1452 @@ -77,7 +77,7 @@
1453                 0,
1454                 sizeof(struct ipt_entry),
1455                 sizeof(struct ipt_standard),
1456 -               0, { 0, 0 }, { } },
1457 +               0, NULL, 0, { 0, 0 }, { } },
1458               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1459                 -NF_ACCEPT - 1 } },
1460             /* FORWARD */
1461 @@ -85,7 +85,7 @@
1462                 0,
1463                 sizeof(struct ipt_entry),
1464                 sizeof(struct ipt_standard),
1465 -               0, { 0, 0 }, { } },
1466 +               0, NULL, 0, { 0, 0 }, { } },
1467               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1468                 -NF_ACCEPT - 1 } },
1469             /* LOCAL_OUT */
1470 @@ -93,7 +93,7 @@
1471                 0,
1472                 sizeof(struct ipt_entry),
1473                 sizeof(struct ipt_standard),
1474 -               0, { 0, 0 }, { } },
1475 +               0, NULL, 0, { 0, 0 }, { } },
1476               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1477                 -NF_ACCEPT - 1 } },
1478             /* POST_ROUTING */
1479 @@ -101,7 +101,7 @@
1480                 0,
1481                 sizeof(struct ipt_entry),
1482                 sizeof(struct ipt_standard),
1483 -               0, { 0, 0 }, { } },
1484 +               0, NULL, 0, { 0, 0 }, { } },
1485               { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1486                 -NF_ACCEPT - 1 } },
1487      },
1488 @@ -110,7 +110,7 @@
1489         0,
1490         sizeof(struct ipt_entry),
1491         sizeof(struct ipt_error),
1492 -       0, { 0, 0 }, { } },
1493 +       0, NULL, 0, { 0, 0 }, { } },
1494        { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
1495           { } },
1496         "ERROR"
1497 diff -Nur linux-2.6.0-test7.org/net/ipv4/netfilter/iptable_raw.c linux-2.6.0-test7/net/ipv4/netfilter/iptable_raw.c
1498 --- linux-2.6.0-test7.org/net/ipv4/netfilter/iptable_raw.c      1970-01-01 01:00:00.000000000 +0100
1499 +++ linux-2.6.0-test7/net/ipv4/netfilter/iptable_raw.c  2003-10-10 11:53:17.000000000 +0200
1500 @@ -0,0 +1,153 @@
1501 +/*
1502 + * 'raw' table, which is the very first hooked in at PRE_ROUTING and LOCAL_OUT .
1503 + *
1504 + * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
1505 + */
1506 +#include <linux/module.h>
1507 +#include <linux/netfilter_ipv4/ip_tables.h>
1508 +
1509 +#define RAW_VALID_HOOKS ((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT))
1510 +
1511 +/* Standard entry. */
1512 +struct ipt_standard
1513 +{
1514 +       struct ipt_entry entry;
1515 +       struct ipt_standard_target target;
1516 +};
1517 +
1518 +struct ipt_error_target
1519 +{
1520 +       struct ipt_entry_target target;
1521 +       char errorname[IPT_FUNCTION_MAXNAMELEN];
1522 +};
1523 +
1524 +struct ipt_error
1525 +{
1526 +       struct ipt_entry entry;
1527 +       struct ipt_error_target target;
1528 +};
1529 +
1530 +static struct
1531 +{
1532 +       struct ipt_replace repl;
1533 +       struct ipt_standard entries[2];
1534 +       struct ipt_error term;
1535 +} initial_table __initdata
1536 += { { "raw", RAW_VALID_HOOKS, 3,
1537 +      sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error),
1538 +      { [NF_IP_PRE_ROUTING] 0,
1539 +       [NF_IP_LOCAL_OUT] sizeof(struct ipt_standard) },
1540 +      { [NF_IP_PRE_ROUTING] 0,
1541 +       [NF_IP_LOCAL_OUT] sizeof(struct ipt_standard) },
1542 +      0, NULL, { } },
1543 +    {
1544 +           /* PRE_ROUTING */
1545 +           { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
1546 +               0,
1547 +               sizeof(struct ipt_entry),
1548 +               sizeof(struct ipt_standard),
1549 +               0, NULL, 0, { 0, 0 }, { } },
1550 +             { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1551 +               -NF_ACCEPT - 1 } },
1552 +           /* LOCAL_OUT */
1553 +           { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
1554 +               0,
1555 +               sizeof(struct ipt_entry),
1556 +               sizeof(struct ipt_standard),
1557 +               0, NULL, 0, { 0, 0 }, { } },
1558 +             { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
1559 +               -NF_ACCEPT - 1 } }
1560 +    },
1561 +    /* ERROR */
1562 +    { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
1563 +       0,
1564 +       sizeof(struct ipt_entry),
1565 +       sizeof(struct ipt_error),
1566 +       0, NULL, 0, { 0, 0 }, { } },
1567 +      { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
1568 +         { } },
1569 +       "ERROR"
1570 +      }
1571 +    }
1572 +};
1573 +
1574 +static struct ipt_table packet_raw = {
1575 +       .name = "raw",
1576 +       .table = &initial_table.repl,
1577 +       .valid_hooks =  RAW_VALID_HOOKS,
1578 +       .lock = RW_LOCK_UNLOCKED,
1579 +       .me = THIS_MODULE,
1580 +};
1581 +
1582 +/* The work comes in here from netfilter.c. */
1583 +static unsigned int
1584 +ipt_hook(unsigned int hook,
1585 +        struct sk_buff **pskb,
1586 +        const struct net_device *in,
1587 +        const struct net_device *out,
1588 +        int (*okfn)(struct sk_buff *))
1589 +{
1590 +       return ipt_do_table(pskb, hook, in, out, &packet_raw, NULL);
1591 +}
1592 +
1593 +/* 'raw' is the very first table. */
1594 +static struct nf_hook_ops ipt_ops[] = {
1595 +       {       /* PRE_ROUTING hook */
1596 +               .hook           = ipt_hook,
1597 +               .owner          = THIS_MODULE,
1598 +               .pf             = PF_INET,
1599 +               .hooknum        = NF_IP_PRE_ROUTING,
1600 +               .priority       = NF_IP_PRI_RAW,
1601 +       },
1602 +       {       /* LOCAL_OUT hook */
1603 +               .hook           = ipt_hook,
1604 +               .owner          = THIS_MODULE,
1605 +               .pf             = PF_INET,
1606 +               .hooknum        = NF_IP_LOCAL_OUT,
1607 +               .priority       = NF_IP_PRI_RAW,
1608 +       },
1609 +};
1610 +
1611 +static int __init init(void)
1612 +{
1613 +       int ret;
1614 +
1615 +       /* Register table */
1616 +       ret = ipt_register_table(&packet_raw);
1617 +       if (ret < 0)
1618 +               return ret;
1619 +
1620 +       /* Register hooks */
1621 +       ret = nf_register_hook(&ipt_ops[0]);
1622 +       if (ret < 0)
1623 +               goto cleanup_table;
1624 +
1625 +       ret = nf_register_hook(&ipt_ops[1]);
1626 +       if (ret < 0)
1627 +               goto cleanup_hook0;
1628 +
1629 +       return ret;
1630 +
1631 + cleanup_hook0:
1632 +       nf_unregister_hook(&ipt_ops[0]);
1633 + cleanup_table:
1634 +       ipt_unregister_table(&packet_raw);
1635 +
1636 +       return ret;
1637 +}
1638 +
1639 +static void __exit fini(void)
1640 +{
1641 +       unsigned int i;
1642 +
1643 +       for (i = 0; i < sizeof(ipt_ops)/sizeof(struct nf_hook_ops); i++)
1644 +               nf_unregister_hook(&ipt_ops[i]);
1645 +
1646 +       ipt_unregister_table(&packet_raw);
1647 +}
1648 +
1649 +module_init(init);
1650 +module_exit(fini);
1651 +MODULE_LICENSE("GPL");
1652 +MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1653 +MODULE_DESCRIPTION("IPv4 raw table");
1654 diff -Nur linux-2.6.0-test7.org/net/ipv6/netfilter/Kconfig linux-2.6.0-test7/net/ipv6/netfilter/Kconfig
1655 --- linux-2.6.0-test7.org/net/ipv6/netfilter/Kconfig    2003-10-08 21:24:43.000000000 +0200
1656 +++ linux-2.6.0-test7/net/ipv6/netfilter/Kconfig        2003-10-10 11:53:17.000000000 +0200
1657 @@ -217,6 +217,31 @@
1658
1659           To compile it as a module, choose M here.  If unsure, say N.
1660
1661 +config IP6_NF_RAW
1662 +       tristate "Raw table"
1663 +       depends on IP6_NF_IPTABLES
1664 +       help
1665 +         This option adds a `raw' table to iptables: see the man page for
1666 +         iptables(8).  This table is the very first in the netfilter
1667 +         framework and hooks in at the PREROUTING and OUTPUT chains.
1668 +         The TRACE target can be used in this table only.
1669 +
1670 +         To compile it as a module, choose M here.  If unsure, say N.
1671 +
1672 +config IP6_NF_TARGET_TRACE
1673 +       tristate "TRACE target support"
1674 +       depends on IP6_NF_RAW
1675 +       help
1676 +         The TRACE target allows packets to be traced as those matches
1677 +         any subsequent rule in any IPv6 netfilter table/rule. The matched
1678 +         rule and the packet is logged with the prefix
1679 +
1680 +         TRACE: tablename/chainname/rulenum
1681 +
1682 +         if the ip6t_LOG target is loaded in.
1683 +
1684 +         To compile it as a module, choose M here.  If unsure, say N.
1685 +
1686  #dep_tristate '  LOG target support' CONFIG_IP6_NF_TARGET_LOG $CONFIG_IP6_NF_IPTABLES
1687  endmenu
1688
1689 diff -Nur linux-2.6.0-test7.org/net/ipv6/netfilter/Makefile linux-2.6.0-test7/net/ipv6/netfilter/Makefile
1690 --- linux-2.6.0-test7.org/net/ipv6/netfilter/Makefile   2003-10-08 21:24:15.000000000 +0200
1691 +++ linux-2.6.0-test7/net/ipv6/netfilter/Makefile       2003-10-10 11:53:17.000000000 +0200
1692 @@ -18,7 +18,9 @@
1693  obj-$(CONFIG_IP6_NF_MATCH_OWNER) += ip6t_owner.o
1694  obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
1695  obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
1696 +obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
1697  obj-$(CONFIG_IP6_NF_TARGET_MARK) += ip6t_MARK.o
1698  obj-$(CONFIG_IP6_NF_QUEUE) += ip6_queue.o
1699  obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_LOG.o
1700 +obj-$(CONFIG_IP6_NF_TARGET_TRACE) += ip6t_TRACE.o
1701  obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
1702 diff -Nur linux-2.6.0-test7.org/net/ipv6/netfilter/ip6_tables.c linux-2.6.0-test7/net/ipv6/netfilter/ip6_tables.c
1703 --- linux-2.6.0-test7.org/net/ipv6/netfilter/ip6_tables.c       2003-10-08 21:24:43.000000000 +0200
1704 +++ linux-2.6.0-test7/net/ipv6/netfilter/ip6_tables.c   2003-10-10 11:53:18.000000000 +0200
1705 @@ -12,6 +12,7 @@
1706   */
1707  #include <linux/config.h>
1708  #include <linux/skbuff.h>
1709 +#include <linux/socket.h>
1710  #include <linux/kmod.h>
1711  #include <linux/vmalloc.h>
1712  #include <linux/netdevice.h>
1713 @@ -24,8 +25,17 @@
1714  #include <asm/semaphore.h>
1715  #include <linux/proc_fs.h>
1716
1717 +#include <linux/netfilter.h>
1718  #include <linux/netfilter_ipv6/ip6_tables.h>
1719
1720 +static const char *hook6names[] = {
1721 +       [NF_IP6_PRE_ROUTING] "PREROUTING",
1722 +       [NF_IP6_LOCAL_IN] "INPUT",
1723 +       [NF_IP6_FORWARD] "FORWARD",
1724 +       [NF_IP6_LOCAL_OUT] "OUTPUT",
1725 +       [NF_IP6_POST_ROUTING] "POSTROUTING",
1726 +};
1727 +
1728  MODULE_LICENSE("GPL");
1729  MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1730  MODULE_DESCRIPTION("IPv6 packet filter");
1731 @@ -403,6 +413,12 @@
1732
1733                         t = ip6t_get_target(e);
1734                         IP_NF_ASSERT(t->u.kernel.target);
1735 +
1736 +                       /* The packet traced and the rule isn't an unconditional return/END. */
1737 +                       if (((*pskb)->nfcache & NFC_TRACE) && e->rulenum) {
1738 +                               nf_log_packet(AF_INET6, hook, *pskb, in, out, "TRACE: %s/%s/%u ",
1739 +                                                 table->name, e->chainname, e->rulenum);
1740 +                       }
1741                         /* Standard target? */
1742                         if (!t->u.kernel.target->target) {
1743                                 int v;
1744 @@ -556,6 +572,29 @@
1745         return find_inlist_lock(&ip6t_target, name, "ip6t_", error, mutex);
1746  }
1747
1748 +static inline int
1749 +find_error_target(struct ip6t_entry *s,
1750 +                 struct ip6t_entry *e,
1751 +                 char **chainname)
1752 +{
1753 +       struct ip6t_entry_target *t;
1754 +       static struct ip6t_entry *found = NULL;
1755 +
1756 +       if (s == e) {
1757 +               if (!found)
1758 +                       return 0;
1759 +               t = ip6t_get_target(found);
1760 +               if (strcmp(t->u.user.name,
1761 +                          IP6T_ERROR_TARGET) == 0) {
1762 +                       *chainname = t->data;
1763 +                       return 1;
1764 +               }
1765 +       } else
1766 +               found = s;
1767 +
1768 +       return 0;
1769 +}
1770 +
1771  /* All zeroes == unconditional rule. */
1772  static inline int
1773  unconditional(const struct ip6t_ip6 *ipv6)
1774 @@ -575,6 +614,8 @@
1775  mark_source_chains(struct ip6t_table_info *newinfo, unsigned int valid_hooks)
1776  {
1777         unsigned int hook;
1778 +       char *chainname = NULL;
1779 +       u_int32_t rulenum;
1780
1781         /* No recursion; use packet counter to save back ptrs (reset
1782            to 0 as we leave), and comefrom to save source hook bitmask */
1783 @@ -588,6 +629,8 @@
1784
1785                 /* Set initial back pointer. */
1786                 e->counters.pcnt = pos;
1787 +               rulenum = 1;
1788 +               chainname = (char *) hook6names[hook];
1789
1790                 for (;;) {
1791                         struct ip6t_standard_target *t
1792 @@ -600,6 +643,8 @@
1793                         }
1794                         e->comefrom
1795                                 |= ((1 << hook) | (1 << NF_IP6_NUMHOOKS));
1796 +                       e->rulenum = rulenum++;
1797 +                       e->chainname = chainname;
1798
1799                         /* Unconditional return/END. */
1800                         if (e->target_offset == sizeof(struct ip6t_entry)
1801 @@ -609,6 +654,10 @@
1802                             && unconditional(&e->ipv6)) {
1803                                 unsigned int oldpos, size;
1804
1805 +                               /* Set unconditional rulenum to zero. */
1806 +                               e->rulenum = 0;
1807 +                               e->counters.bcnt = 0;
1808 +
1809                                 /* Return: backtrack through the last
1810                                    big jump. */
1811                                 do {
1812 @@ -634,6 +683,11 @@
1813                                                 (newinfo->entries + pos);
1814                                 } while (oldpos == pos + e->next_offset);
1815
1816 +                               /* Restore chainname, rulenum. */
1817 +                               chainname = e->chainname;
1818 +                               rulenum = e->counters.bcnt;
1819 +                               e->counters.bcnt = 0;
1820 +
1821                                 /* Move along one */
1822                                 size = e->next_offset;
1823                                 e = (struct ip6t_entry *)
1824 @@ -649,6 +703,17 @@
1825                                         /* This a jump; chase it. */
1826                                         duprintf("Jump rule %u -> %u\n",
1827                                                  pos, newpos);
1828 +                                       e->counters.bcnt = rulenum++;
1829 +                                       rulenum = 1;
1830 +                                       e = (struct ip6t_entry *)
1831 +                                               (newinfo->entries + newpos);
1832 +                                       if (IP6T_ENTRY_ITERATE(newinfo->entries,
1833 +                                                              newinfo->size,
1834 +                                                              find_error_target,
1835 +                                                              e, &chainname) == 0) {
1836 +                                               printk("ip6_tables: table screwed up!\n");
1837 +                                               return 0;
1838 +                                       }
1839                                 } else {
1840                                         /* ... this is a fallthru */
1841                                         newpos = pos + e->next_offset;
1842 diff -Nur linux-2.6.0-test7.org/net/ipv6/netfilter/ip6t_LOG.c linux-2.6.0-test7/net/ipv6/netfilter/ip6t_LOG.c
1843 --- linux-2.6.0-test7.org/net/ipv6/netfilter/ip6t_LOG.c 2003-10-08 21:24:03.000000000 +0200
1844 +++ linux-2.6.0-test7/net/ipv6/netfilter/ip6t_LOG.c     2003-10-10 11:52:57.000000000 +0200
1845 @@ -3,18 +3,24 @@
1846   */
1847  #include <linux/module.h>
1848  #include <linux/skbuff.h>
1849 +#include <linux/socket.h>
1850  #include <linux/ip.h>
1851  #include <linux/spinlock.h>
1852  #include <linux/icmpv6.h>
1853  #include <net/udp.h>
1854  #include <net/tcp.h>
1855  #include <net/ipv6.h>
1856 +#include <linux/netfilter.h>
1857  #include <linux/netfilter_ipv6/ip6_tables.h>
1858
1859  MODULE_AUTHOR("Jan Rekorajski <baggins@pld.org.pl>");
1860  MODULE_DESCRIPTION("IP6 tables LOG target module");
1861  MODULE_LICENSE("GPL");
1862
1863 +static unsigned int nflog = 1;
1864 +MODULE_PARM(nflog, "i");
1865 +MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
1866 +
1867  struct in_device;
1868  #include <net/route.h>
1869  #include <linux/netfilter_ipv6/ip6t_LOG.h>
1870 @@ -256,40 +262,38 @@
1871         }
1872  }
1873
1874 -static unsigned int
1875 -ip6t_log_target(struct sk_buff **pskb,
1876 -               unsigned int hooknum,
1877 -               const struct net_device *in,
1878 -               const struct net_device *out,
1879 -               const void *targinfo,
1880 -               void *userinfo)
1881 +static void
1882 +ip6t_log_packet(unsigned int hooknum,
1883 +               const struct sk_buff *skb,
1884 +               const struct net_device *in,
1885 +               const struct net_device *out,
1886 +               const struct ip6t_log_info *loginfo,
1887 +               const char *level_string,
1888 +               const char *prefix)
1889  {
1890 -       struct ipv6hdr *ipv6h = (*pskb)->nh.ipv6h;
1891 -       const struct ip6t_log_info *loginfo = targinfo;
1892 -       char level_string[4] = "< >";
1893 +       struct ipv6hdr *ipv6h = skb->nh.ipv6h;
1894
1895 -       level_string[1] = '0' + (loginfo->level % 8);
1896         spin_lock_bh(&log_lock);
1897         printk(level_string);
1898         printk("%sIN=%s OUT=%s ",
1899 -               loginfo->prefix,
1900 +               prefix == NULL ? loginfo->prefix : prefix,
1901                 in ? in->name : "",
1902                 out ? out->name : "");
1903         if (in && !out) {
1904                 /* MAC logging for input chain only. */
1905                 printk("MAC=");
1906 -               if ((*pskb)->dev && (*pskb)->dev->hard_header_len && (*pskb)->mac.raw != (void*)ipv6h) {
1907 -                       if ((*pskb)->dev->type != ARPHRD_SIT){
1908 +               if (skb->dev && skb->dev->hard_header_len && skb->mac.raw != (void*)ipv6h) {
1909 +                       if (skb->dev->type != ARPHRD_SIT){
1910                           int i;
1911 -                         unsigned char *p = (*pskb)->mac.raw;
1912 -                         for (i = 0; i < (*pskb)->dev->hard_header_len; i++,p++)
1913 +                         unsigned char *p = skb->mac.raw;
1914 +                         for (i = 0; i < skb->dev->hard_header_len; i++,p++)
1915                                 printk("%02x%c", *p,
1916 -                                       i==(*pskb)->dev->hard_header_len - 1
1917 +                                       i==skb->dev->hard_header_len - 1
1918                                         ? ' ':':');
1919                         } else {
1920                           int i;
1921 -                         unsigned char *p = (*pskb)->mac.raw;
1922 -                         if ( p - (ETH_ALEN*2+2) > (*pskb)->head ){
1923 +                         unsigned char *p = skb->mac.raw;
1924 +                         if ( p - (ETH_ALEN*2+2) > skb->head ){
1925                             p -= (ETH_ALEN+2);
1926                             for (i = 0; i < (ETH_ALEN); i++,p++)
1927                                 printk("%02x%s", *p,
1928 @@ -300,10 +304,10 @@
1929                                         i == ETH_ALEN-1 ? ' ' : ':');
1930                           }
1931
1932 -                         if (((*pskb)->dev->addr_len == 4) &&
1933 -                             (*pskb)->dev->hard_header_len > 20){
1934 +                         if ((skb->dev->addr_len == 4) &&
1935 +                             skb->dev->hard_header_len > 20){
1936                             printk("TUNNEL=");
1937 -                           p = (*pskb)->mac.raw + 12;
1938 +                           p = skb->mac.raw + 12;
1939                             for (i = 0; i < 4; i++,p++)
1940                                 printk("%3d%s", *p,
1941                                         i == 3 ? "->" : ".");
1942 @@ -319,10 +323,41 @@
1943         dump_packet(loginfo, ipv6h, 1);
1944         printk("\n");
1945         spin_unlock_bh(&log_lock);
1946 +}
1947 +
1948 +static unsigned int
1949 +ip6t_log_target(struct sk_buff **pskb,
1950 +               unsigned int hooknum,
1951 +               const struct net_device *in,
1952 +               const struct net_device *out,
1953 +               const void *targinfo,
1954 +               void *userinfo)
1955 +{
1956 +       const struct ip6t_log_info *loginfo = targinfo;
1957 +       char level_string[4] = "< >";
1958 +
1959 +       level_string[1] = '0' + (loginfo->level % 8);
1960 +       ip6t_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
1961
1962         return IP6T_CONTINUE;
1963  }
1964
1965 +static void
1966 +ip6t_logfn(unsigned int hooknum,
1967 +          const struct sk_buff *skb,
1968 +          const struct net_device *in,
1969 +          const struct net_device *out,
1970 +          const char *prefix)
1971 +{
1972 +       struct ip6t_log_info loginfo = {
1973 +               .level = 0,
1974 +               .logflags = IP6T_LOG_MASK,
1975 +               .prefix = ""
1976 +       };
1977 +
1978 +       ip6t_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
1979 +}
1980 +
1981  static int ip6t_log_checkentry(const char *tablename,
1982                                const struct ip6t_entry *e,
1983                                void *targinfo,
1984 @@ -359,12 +394,17 @@
1985  {
1986         if (ip6t_register_target(&ip6t_log_reg))
1987                 return -EINVAL;
1988 +       if (nflog)
1989 +               nf_log_register(PF_INET6, &ip6t_logfn);
1990
1991         return 0;
1992  }
1993
1994  static void __exit fini(void)
1995  {
1996 +       if (nflog)
1997 +               nf_log_register(PF_INET6, &ip6t_logfn);
1998 +
1999         ip6t_unregister_target(&ip6t_log_reg);
2000  }
2001
2002 diff -Nur linux-2.6.0-test7.org/net/ipv6/netfilter/ip6t_TRACE.c linux-2.6.0-test7/net/ipv6/netfilter/ip6t_TRACE.c
2003 --- linux-2.6.0-test7.org/net/ipv6/netfilter/ip6t_TRACE.c       1970-01-01 01:00:00.000000000 +0100
2004 +++ linux-2.6.0-test7/net/ipv6/netfilter/ip6t_TRACE.c   2003-10-10 11:53:18.000000000 +0200
2005 @@ -0,0 +1,69 @@
2006 +/* This is a module which is used for setting
2007 + * the NFC_TRACE flag in the nfcache field of an skb.
2008 + */
2009 +#include <linux/module.h>
2010 +#include <linux/skbuff.h>
2011 +
2012 +#include <linux/netfilter_ipv6/ip6_tables.h>
2013 +
2014 +static unsigned int
2015 +target(struct sk_buff **pskb,
2016 +       unsigned int hooknum,
2017 +       const struct net_device *in,
2018 +       const struct net_device *out,
2019 +       const void *targinfo,
2020 +       void *userinfo)
2021 +{
2022 +       (*pskb)->nfcache |= NFC_TRACE;
2023 +       return IP6T_CONTINUE;
2024 +}
2025 +
2026 +static int
2027 +checkentry(const char *tablename,
2028 +                  const struct ip6t_entry *e,
2029 +           void *targinfo,
2030 +           unsigned int targinfosize,
2031 +           unsigned int hook_mask)
2032 +{
2033 +       if (targinfosize != 0) {
2034 +               printk(KERN_WARNING "TRACE: targinfosize %u != 0\n",
2035 +                      targinfosize);
2036 +               return 0;
2037 +       }
2038 +
2039 +       if (strcmp(tablename, "raw") != 0) {
2040 +               printk(KERN_WARNING "TRACE: can only be called from \"raw\" table, not \"%s\"\n", tablename);
2041 +               return 0;
2042 +       }
2043 +
2044 +       return 1;
2045 +}
2046 +
2047 +static struct ip6t_target ip6t_trace_reg = {
2048 +       .name = "TRACE",
2049 +       .target = target,
2050 +       .checkentry = checkentry,
2051 +       .destroy = NULL,
2052 +       .me = THIS_MODULE,
2053 +};
2054 +
2055 +static int __init init(void)
2056 +{
2057 +       if (ip6t_register_target(&ip6t_trace_reg))
2058 +               return -EINVAL;
2059 +
2060 +       return 0;
2061 +}
2062 +
2063 +static void __exit fini(void)
2064 +{
2065 +       ip6t_unregister_target(&ip6t_trace_reg);
2066 +}
2067 +
2068 +module_init(init);
2069 +module_exit(fini);
2070 +
2071 +MODULE_LICENSE("GPL");
2072 +MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
2073 +MODULE_DESCRIPTION("IPv6 TRACE target");
2074 +
2075 \ No newline at end of file
2076 diff -Nur linux-2.6.0-test7.org/net/ipv6/netfilter/ip6table_filter.c linux-2.6.0-test7/net/ipv6/netfilter/ip6table_filter.c
2077 --- linux-2.6.0-test7.org/net/ipv6/netfilter/ip6table_filter.c  2003-10-08 21:24:01.000000000 +0200
2078 +++ linux-2.6.0-test7/net/ipv6/netfilter/ip6table_filter.c      2003-10-10 11:53:18.000000000 +0200
2079 @@ -52,7 +52,7 @@
2080                 0,
2081                 sizeof(struct ip6t_entry),
2082                 sizeof(struct ip6t_standard),
2083 -               0, { 0, 0 }, { } },
2084 +               0, NULL, 0, { 0, 0 }, { } },
2085               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2086                 -NF_ACCEPT - 1 } },
2087             /* FORWARD */
2088 @@ -60,7 +60,7 @@
2089                 0,
2090                 sizeof(struct ip6t_entry),
2091                 sizeof(struct ip6t_standard),
2092 -               0, { 0, 0 }, { } },
2093 +               0, NULL, 0, { 0, 0 }, { } },
2094               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2095                 -NF_ACCEPT - 1 } },
2096             /* LOCAL_OUT */
2097 @@ -68,7 +68,7 @@
2098                 0,
2099                 sizeof(struct ip6t_entry),
2100                 sizeof(struct ip6t_standard),
2101 -               0, { 0, 0 }, { } },
2102 +               0, NULL, 0, { 0, 0 }, { } },
2103               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2104                 -NF_ACCEPT - 1 } }
2105      },
2106 @@ -77,7 +77,7 @@
2107         0,
2108         sizeof(struct ip6t_entry),
2109         sizeof(struct ip6t_error),
2110 -       0, { 0, 0 }, { } },
2111 +       0, NULL, 0, { 0, 0 }, { } },
2112        { { { { IP6T_ALIGN(sizeof(struct ip6t_error_target)), IP6T_ERROR_TARGET } },
2113           { } },
2114         "ERROR"
2115 diff -Nur linux-2.6.0-test7.org/net/ipv6/netfilter/ip6table_mangle.c linux-2.6.0-test7/net/ipv6/netfilter/ip6table_mangle.c
2116 --- linux-2.6.0-test7.org/net/ipv6/netfilter/ip6table_mangle.c  2003-10-08 21:24:04.000000000 +0200
2117 +++ linux-2.6.0-test7/net/ipv6/netfilter/ip6table_mangle.c      2003-10-10 11:53:18.000000000 +0200
2118 @@ -66,7 +66,7 @@
2119                 0,
2120                 sizeof(struct ip6t_entry),
2121                 sizeof(struct ip6t_standard),
2122 -               0, { 0, 0 }, { } },
2123 +               0, NULL, 0, { 0, 0 }, { } },
2124               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2125                 -NF_ACCEPT - 1 } },
2126             /* LOCAL_IN */
2127 @@ -74,7 +74,7 @@
2128                 0,
2129                 sizeof(struct ip6t_entry),
2130                 sizeof(struct ip6t_standard),
2131 -               0, { 0, 0 }, { } },
2132 +               0, NULL, 0, { 0, 0 }, { } },
2133               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2134                 -NF_ACCEPT - 1 } },
2135             /* FORWARD */
2136 @@ -82,7 +82,7 @@
2137                 0,
2138                 sizeof(struct ip6t_entry),
2139                 sizeof(struct ip6t_standard),
2140 -               0, { 0, 0 }, { } },
2141 +               0, NULL, 0, { 0, 0 }, { } },
2142               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2143                 -NF_ACCEPT - 1 } },
2144             /* LOCAL_OUT */
2145 @@ -90,7 +90,7 @@
2146                 0,
2147                 sizeof(struct ip6t_entry),
2148                 sizeof(struct ip6t_standard),
2149 -               0, { 0, 0 }, { } },
2150 +               0, NULL, 0, { 0, 0 }, { } },
2151               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2152                 -NF_ACCEPT - 1 } },
2153             /* POST_ROUTING */
2154 @@ -98,7 +98,7 @@
2155                 0,
2156                 sizeof(struct ip6t_entry),
2157                 sizeof(struct ip6t_standard),
2158 -               0, { 0, 0 }, { } },
2159 +               0, NULL, 0, { 0, 0 }, { } },
2160               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2161                 -NF_ACCEPT - 1 } }
2162      },
2163 @@ -107,7 +107,7 @@
2164         0,
2165         sizeof(struct ip6t_entry),
2166         sizeof(struct ip6t_error),
2167 -       0, { 0, 0 }, { } },
2168 +       0, NULL, 0, { 0, 0 }, { } },
2169        { { { { IP6T_ALIGN(sizeof(struct ip6t_error_target)), IP6T_ERROR_TARGET } },
2170           { } },
2171         "ERROR"
2172 diff -Nur linux-2.6.0-test7.org/net/ipv6/netfilter/ip6table_raw.c linux-2.6.0-test7/net/ipv6/netfilter/ip6table_raw.c
2173 --- linux-2.6.0-test7.org/net/ipv6/netfilter/ip6table_raw.c     1970-01-01 01:00:00.000000000 +0100
2174 +++ linux-2.6.0-test7/net/ipv6/netfilter/ip6table_raw.c 2003-10-10 11:53:18.000000000 +0200
2175 @@ -0,0 +1,158 @@
2176 +/*
2177 + * IPv6 raw table, a port of the IPv4 raw table to IPv6
2178 + *
2179 + * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
2180 + */
2181 +#include <linux/module.h>
2182 +#include <linux/netfilter_ipv6/ip6_tables.h>
2183 +
2184 +#define RAW_VALID_HOOKS ((1 << NF_IP6_PRE_ROUTING) | (1 << NF_IP6_LOCAL_OUT))
2185 +
2186 +#if 0
2187 +#define DEBUGP(x, args...)     printk(KERN_DEBUG x, ## args)
2188 +#else
2189 +#define DEBUGP(x, args...)
2190 +#endif
2191 +
2192 +/* Standard entry. */
2193 +struct ip6t_standard
2194 +{
2195 +       struct ip6t_entry entry;
2196 +       struct ip6t_standard_target target;
2197 +};
2198 +
2199 +struct ip6t_error_target
2200 +{
2201 +       struct ip6t_entry_target target;
2202 +       char errorname[IP6T_FUNCTION_MAXNAMELEN];
2203 +};
2204 +
2205 +struct ip6t_error
2206 +{
2207 +       struct ip6t_entry entry;
2208 +       struct ip6t_error_target target;
2209 +};
2210 +
2211 +static struct
2212 +{
2213 +       struct ip6t_replace repl;
2214 +       struct ip6t_standard entries[2];
2215 +       struct ip6t_error term;
2216 +} initial_table __initdata
2217 += { { "raw", RAW_VALID_HOOKS, 3,
2218 +      sizeof(struct ip6t_standard) * 2 + sizeof(struct ip6t_error),
2219 +      { [NF_IP6_PRE_ROUTING]   0,
2220 +       [NF_IP6_LOCAL_OUT]      sizeof(struct ip6t_standard) },
2221 +      { [NF_IP6_PRE_ROUTING]   0,
2222 +       [NF_IP6_LOCAL_OUT]      sizeof(struct ip6t_standard) },
2223 +      0, NULL, { } },
2224 +    {
2225 +           /* PRE_ROUTING */
2226 +            { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
2227 +               0,
2228 +               sizeof(struct ip6t_entry),
2229 +               sizeof(struct ip6t_standard),
2230 +               0, NULL, 0, { 0, 0 }, { } },
2231 +             { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2232 +               -NF_ACCEPT - 1 } },
2233 +           /* LOCAL_OUT */
2234 +            { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
2235 +               0,
2236 +               sizeof(struct ip6t_entry),
2237 +               sizeof(struct ip6t_standard),
2238 +               0, NULL, 0, { 0, 0 }, { } },
2239 +             { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
2240 +               -NF_ACCEPT - 1 } },
2241 +    },
2242 +    /* ERROR */
2243 +    { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
2244 +       0,
2245 +       sizeof(struct ip6t_entry),
2246 +       sizeof(struct ip6t_error),
2247 +       0, NULL, 0, { 0, 0 }, { } },
2248 +      { { { { IP6T_ALIGN(sizeof(struct ip6t_error_target)), IP6T_ERROR_TARGET } },
2249 +         { } },
2250 +       "ERROR"
2251 +      }
2252 +    }
2253 +};
2254 +
2255 +static struct ip6t_table packet_raw = {
2256 +       .name = "raw",
2257 +       .table = &initial_table.repl,
2258 +       .valid_hooks = RAW_VALID_HOOKS,
2259 +       .lock = RW_LOCK_UNLOCKED,
2260 +       .me = THIS_MODULE
2261 +};
2262 +
2263 +/* The work comes in here from netfilter.c. */
2264 +static unsigned int
2265 +ip6t_hook(unsigned int hook,
2266 +        struct sk_buff **pskb,
2267 +        const struct net_device *in,
2268 +        const struct net_device *out,
2269 +        int (*okfn)(struct sk_buff *))
2270 +{
2271 +       return ip6t_do_table(pskb, hook, in, out, &packet_raw, NULL);
2272 +}
2273 +
2274 +static struct nf_hook_ops ip6t_ops[] = {
2275 +       { /* PRE_ROUTING */
2276 +               .hook = ip6t_hook,
2277 +               .owner = THIS_MODULE,
2278 +               .pf = PF_INET6,
2279 +               .hooknum = NF_IP6_PRE_ROUTING,
2280 +               .priority = NF_IP6_PRI_FIRST,
2281 +       },
2282 +       { /* LOCAL_OUT */
2283 +               .hook = ip6t_hook,
2284 +               .owner = THIS_MODULE,
2285 +               .pf = PF_INET6,
2286 +               .hooknum = NF_IP6_LOCAL_OUT,
2287 +               .priority = NF_IP6_PRI_FIRST,
2288 +       },
2289 +};
2290 +
2291 +static int __init init(void)
2292 +{
2293 +       int ret;
2294 +
2295 +       /* Register table */
2296 +       ret = ip6t_register_table(&packet_raw);
2297 +       if (ret < 0)
2298 +               return ret;
2299 +
2300 +       /* Register hooks */
2301 +       ret = nf_register_hook(&ip6t_ops[0]);
2302 +       if (ret < 0)
2303 +               goto cleanup_table;
2304 +
2305 +       ret = nf_register_hook(&ip6t_ops[1]);
2306 +       if (ret < 0)
2307 +               goto cleanup_hook0;
2308 +
2309 +       return ret;
2310 +
2311 + cleanup_hook0:
2312 +       nf_unregister_hook(&ip6t_ops[0]);
2313 + cleanup_table:
2314 +       ip6t_unregister_table(&packet_raw);
2315 +
2316 +       return ret;
2317 +}
2318 +
2319 +static void __exit fini(void)
2320 +{
2321 +       unsigned int i;
2322 +
2323 +       for (i = 0; i < sizeof(ip6t_ops)/sizeof(struct nf_hook_ops); i++)
2324 +               nf_unregister_hook(&ip6t_ops[i]);
2325 +
2326 +       ip6t_unregister_table(&packet_raw);
2327 +}
2328 +
2329 +module_init(init);
2330 +module_exit(fini);
2331 +MODULE_LICENSE("GPL");
2332 +MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
2333 +MODULE_DESCRIPTION("IPv6 raw table");
2334 diff -Nur linux-2.6.0-test7.org/netfilter-patch-o-matic/patches linux-2.6.0-test7/netfilter-patch-o-matic/patches
2335 --- linux-2.6.0-test7.org/netfilter-patch-o-matic/patches       1970-01-01 01:00:00.000000000 +0100
2336 +++ linux-2.6.0-test7/netfilter-patch-o-matic/patches   2003-10-10 11:54:22.000000000 +0200
2337 @@ -0,0 +1,23 @@
2338 +./base/01_sctp_match.patch
2339 +./pending/23_REJECT-headroom-tcprst.patch
2340 +./pending/24_rcu.patch
2341 +./pending/25-err-ptr.patch
2342 +./pending/26-memsets.patch
2343 +./pending/40_nf-log.patch
2344 +./pending/70_expect-evict-order.patch
2345 +./pending/71_raw.patch
2346 +./submitted/02_REJECT-headroom-tcprst.patch
2347 +./submitted/03_260t4-mirror-remove.patch
2348 +./submitted/03_physdev_bridged.patch
2349 +./submitted/04_260t4-unclean-remove.patch
2350 +./submitted/04_config-fix.patch
2351 +./submitted/75_nathelper-udp-csum.patch
2352 +./submitted/76_mangle_udp-sizecheck.patch
2353 +./submitted/77_destroy-conntrack.patch
2354 +./submitted/78_reject-localout.patch
2355 +./submitted/80_ip_conntrack-proc.patch
2356 +./submitted/82_irc-conntrack-mirc-serverlookup.patch
2357 +./submitted/83_nolocalout.patch
2358 +./submitted/84_local-nullbinding.patch
2359 +./submitted/85_ipv6header.patch
2360 +./submitted/86_getorigdst-tuple-zero.patch