AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-11-25 14:30:53 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'master' of git://dev.medozas.de/linux

Browse Source
This commit is contained in:
Patrick McHardy 2009-08-10 17:14:59 +02:00
commit dc05a564ab
79 changed files with 210 additions and 1719 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
Documentation/feature-removal-schedule.txt
View File

@ -235,31 +235,6 @@ Who: Thomas Gleixner <tglx@linutronix.de>
--------------------------- ---------------------------
What (Why): What (Why):
- include/linux/netfilter_ipv4/ipt_TOS.h ipt_tos.h header files
(superseded by xt_TOS/xt_tos target & match)
- "forwarding" header files like ipt_mac.h in
include/linux/netfilter_ipv4/ and include/linux/netfilter_ipv6/
- xt_CONNMARK match revision 0
(superseded by xt_CONNMARK match revision 1)
- xt_MARK target revisions 0 and 1
(superseded by xt_MARK match revision 2)
- xt_connmark match revision 0
(superseded by xt_connmark match revision 1)
- xt_conntrack match revision 0
(superseded by xt_conntrack match revision 1)
- xt_iprange match revision 0,
include/linux/netfilter_ipv4/ipt_iprange.h
(superseded by xt_iprange match revision 1)
- xt_mark match revision 0
(superseded by xt_mark match revision 1)
- xt_recent: the old ipt_recent proc dir - xt_recent: the old ipt_recent proc dir
(superseded by /proc/net/xt_recent) (superseded by /proc/net/xt_recent)

2
include/linux/netfilter/x_tables.h
View File

@ -238,9 +238,9 @@ struct xt_mtdtor_param {
*/ */
struct xt_target_param { struct xt_target_param {
const struct net_device *in, *out; const struct net_device *in, *out;
unsigned int hooknum;
const struct xt_target *target; const struct xt_target *target;
const void *targinfo; const void *targinfo;
unsigned int hooknum;
u_int8_t family; u_int8_t family;
}; };

6
include/linux/netfilter/xt_CONNMARK.h
View File

@ -18,12 +18,6 @@ enum {
XT_CONNMARK_RESTORE XT_CONNMARK_RESTORE
}; };
struct xt_connmark_target_info {
unsigned long mark;
unsigned long mask;
__u8 mode;
};
struct xt_connmark_tginfo1 { struct xt_connmark_tginfo1 {
__u32 ctmark, ctmask, nfmask; __u32 ctmark, ctmask, nfmask;
__u8 mode; __u8 mode;

17
include/linux/netfilter/xt_MARK.h
View File

@ -3,23 +3,6 @@
#include <linux/types.h> #include <linux/types.h>
/* Version 0 */
struct xt_mark_target_info {
unsigned long mark;
};
/* Version 1 */
enum {
XT_MARK_SET=0,
XT_MARK_AND,
XT_MARK_OR,
};
struct xt_mark_target_info_v1 {
unsigned long mark;
__u8 mode;
};
struct xt_mark_tginfo2 { struct xt_mark_tginfo2 {
__u32 mark, mask; __u32 mark, mask;
}; };

5
include/linux/netfilter/xt_connmark.h
View File

@ -12,11 +12,6 @@
* (at your option) any later version. * (at your option) any later version.
*/ */
struct xt_connmark_info {
unsigned long mark, mask;
__u8 invert;
};
struct xt_connmark_mtinfo1 { struct xt_connmark_mtinfo1 {
__u32 mark, mask; __u32 mark, mask;
__u8 invert; __u8 invert;

36
include/linux/netfilter/xt_conntrack.h
View File

@ -32,42 +32,6 @@ enum {
XT_CONNTRACK_DIRECTION = 1 << 12, XT_CONNTRACK_DIRECTION = 1 << 12,
}; };
/* This is exposed to userspace, so remains frozen in time. */
struct ip_conntrack_old_tuple
{
struct {
__be32 ip;
union {
__u16 all;
} u;
} src;
struct {
__be32 ip;
union {
__u16 all;
} u;
/* The protocol. */
__u16 protonum;
} dst;
};
struct xt_conntrack_info
{
unsigned int statemask, statusmask;
struct ip_conntrack_old_tuple tuple[IP_CT_DIR_MAX];
struct in_addr sipmsk[IP_CT_DIR_MAX], dipmsk[IP_CT_DIR_MAX];
unsigned long expires_min, expires_max;
/* Flags word */
__u8 flags;
/* Inverse flags */
__u8 invflags;
};
struct xt_conntrack_mtinfo1 { struct xt_conntrack_mtinfo1 {
union nf_inet_addr origsrc_addr, origsrc_mask; union nf_inet_addr origsrc_addr, origsrc_mask;
union nf_inet_addr origdst_addr, origdst_mask; union nf_inet_addr origdst_addr, origdst_mask;

5
include/linux/netfilter/xt_mark.h
View File

@ -3,11 +3,6 @@
#include <linux/types.h> #include <linux/types.h>
struct xt_mark_info {
unsigned long mark, mask;
__u8 invert;
};
struct xt_mark_mtinfo1 { struct xt_mark_mtinfo1 {
__u32 mark, mask; __u32 mark, mask;
__u8 invert; __u8 invert;

32
include/linux/netfilter_ipv4/Kbuild
View File

@ -1,46 +1,14 @@
header-y += ipt_CLASSIFY.h
header-y += ipt_CLUSTERIP.h header-y += ipt_CLUSTERIP.h
header-y += ipt_CONNMARK.h
header-y += ipt_DSCP.h
header-y += ipt_ECN.h header-y += ipt_ECN.h
header-y += ipt_LOG.h header-y += ipt_LOG.h
header-y += ipt_MARK.h
header-y += ipt_NFQUEUE.h
header-y += ipt_REJECT.h header-y += ipt_REJECT.h
header-y += ipt_SAME.h header-y += ipt_SAME.h
header-y += ipt_TCPMSS.h
header-y += ipt_TOS.h
header-y += ipt_TTL.h header-y += ipt_TTL.h
header-y += ipt_ULOG.h header-y += ipt_ULOG.h
header-y += ipt_addrtype.h header-y += ipt_addrtype.h
header-y += ipt_ah.h header-y += ipt_ah.h
header-y += ipt_comment.h
header-y += ipt_connbytes.h
header-y += ipt_connmark.h
header-y += ipt_conntrack.h
header-y += ipt_dccp.h
header-y += ipt_dscp.h
header-y += ipt_ecn.h header-y += ipt_ecn.h
header-y += ipt_esp.h
header-y += ipt_hashlimit.h
header-y += ipt_helper.h
header-y += ipt_iprange.h
header-y += ipt_length.h
header-y += ipt_limit.h
header-y += ipt_mac.h
header-y += ipt_mark.h
header-y += ipt_multiport.h
header-y += ipt_owner.h
header-y += ipt_physdev.h
header-y += ipt_pkttype.h
header-y += ipt_policy.h
header-y += ipt_realm.h header-y += ipt_realm.h
header-y += ipt_recent.h
header-y += ipt_sctp.h
header-y += ipt_state.h
header-y += ipt_string.h
header-y += ipt_tcpmss.h
header-y += ipt_tos.h
header-y += ipt_ttl.h header-y += ipt_ttl.h
unifdef-y += ip_queue.h unifdef-y += ip_queue.h

7
include/linux/netfilter_ipv4/ipt_CLASSIFY.h
View File

@ -1,7 +0,0 @@
#ifndef _IPT_CLASSIFY_H
#define _IPT_CLASSIFY_H
#include <linux/netfilter/xt_CLASSIFY.h>
#define ipt_classify_target_info xt_classify_target_info
#endif /*_IPT_CLASSIFY_H */

19
include/linux/netfilter_ipv4/ipt_CONNMARK.h
View File

@ -1,19 +0,0 @@
#ifndef _IPT_CONNMARK_H_target
#define _IPT_CONNMARK_H_target
/* Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
* by Henrik Nordstrom <hno@marasystems.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*/
#include <linux/netfilter/xt_CONNMARK.h>
#define IPT_CONNMARK_SET XT_CONNMARK_SET
#define IPT_CONNMARK_SAVE XT_CONNMARK_SAVE
#define IPT_CONNMARK_RESTORE XT_CONNMARK_RESTORE
#define ipt_connmark_target_info xt_connmark_target_info
#endif /*_IPT_CONNMARK_H_target*/

18
include/linux/netfilter_ipv4/ipt_DSCP.h
View File

@ -1,18 +0,0 @@
/* iptables module for setting the IPv4 DSCP field
*
* (C) 2002 Harald Welte <laforge@gnumonks.org>
* based on ipt_FTOS.c (C) 2000 by Matthew G. Marsh <mgm@paktronix.com>
* This software is distributed under GNU GPL v2, 1991
*
* See RFC2474 for a description of the DSCP field within the IP Header.
*
* ipt_DSCP.h,v 1.7 2002/03/14 12:03:13 laforge Exp
*/
#ifndef _IPT_DSCP_TARGET_H
#define _IPT_DSCP_TARGET_H
#include <linux/netfilter_ipv4/ipt_dscp.h>
#include <linux/netfilter/xt_DSCP.h>
#define ipt_DSCP_info xt_DSCP_info
#endif /* _IPT_DSCP_TARGET_H */

4
include/linux/netfilter_ipv4/ipt_ECN.h
View File

@ -8,9 +8,9 @@
*/ */
#ifndef _IPT_ECN_TARGET_H #ifndef _IPT_ECN_TARGET_H
#define _IPT_ECN_TARGET_H #define _IPT_ECN_TARGET_H
#include <linux/netfilter_ipv4/ipt_DSCP.h> #include <linux/netfilter/xt_DSCP.h>
#define IPT_ECN_IP_MASK (~IPT_DSCP_MASK) #define IPT_ECN_IP_MASK (~XT_DSCP_MASK)
#define IPT_ECN_OP_SET_IP 0x01 /* set ECN bits of IPv4 header */ #define IPT_ECN_OP_SET_IP 0x01 /* set ECN bits of IPv4 header */
#define IPT_ECN_OP_SET_ECE 0x10 /* set ECE bit of TCP header */ #define IPT_ECN_OP_SET_ECE 0x10 /* set ECE bit of TCP header */

18
include/linux/netfilter_ipv4/ipt_MARK.h
View File

@ -1,18 +0,0 @@
#ifndef _IPT_MARK_H_target
#define _IPT_MARK_H_target
/* Backwards compatibility for old userspace */
#include <linux/netfilter/xt_MARK.h>
/* Version 0 */
#define ipt_mark_target_info xt_mark_target_info
/* Version 1 */
#define IPT_MARK_SET XT_MARK_SET
#define IPT_MARK_AND XT_MARK_AND
#define IPT_MARK_OR XT_MARK_OR
#define ipt_mark_target_info_v1 xt_mark_target_info_v1
#endif /*_IPT_MARK_H_target*/

16
include/linux/netfilter_ipv4/ipt_NFQUEUE.h
View File

@ -1,16 +0,0 @@
/* iptables module for using NFQUEUE mechanism
*
* (C) 2005 Harald Welte <laforge@netfilter.org>
*
* This software is distributed under GNU GPL v2, 1991
*
*/
#ifndef _IPT_NFQ_TARGET_H
#define _IPT_NFQ_TARGET_H
/* Backwards compatibility for old userspace */
#include <linux/netfilter/xt_NFQUEUE.h>
#define ipt_NFQ_info xt_NFQ_info
#endif /* _IPT_DSCP_TARGET_H */

9
include/linux/netfilter_ipv4/ipt_TCPMSS.h
View File

@ -1,9 +0,0 @@
#ifndef _IPT_TCPMSS_H
#define _IPT_TCPMSS_H
#include <linux/netfilter/xt_TCPMSS.h>
#define ipt_tcpmss_info xt_tcpmss_info
#define IPT_TCPMSS_CLAMP_PMTU XT_TCPMSS_CLAMP_PMTU
#endif /*_IPT_TCPMSS_H*/

12
include/linux/netfilter_ipv4/ipt_TOS.h
View File

@ -1,12 +0,0 @@
#ifndef _IPT_TOS_H_target
#define _IPT_TOS_H_target
#ifndef IPTOS_NORMALSVC
#define IPTOS_NORMALSVC 0
#endif
struct ipt_tos_target_info {
u_int8_t tos;
};
#endif /*_IPT_TOS_H_target*/

10
include/linux/netfilter_ipv4/ipt_comment.h
View File

@ -1,10 +0,0 @@
#ifndef _IPT_COMMENT_H
#define _IPT_COMMENT_H
#include <linux/netfilter/xt_comment.h>
#define IPT_MAX_COMMENT_LEN XT_MAX_COMMENT_LEN
#define ipt_comment_info xt_comment_info
#endif /* _IPT_COMMENT_H */

18
include/linux/netfilter_ipv4/ipt_connbytes.h
View File

@ -1,18 +0,0 @@
#ifndef _IPT_CONNBYTES_H
#define _IPT_CONNBYTES_H
#include <linux/netfilter/xt_connbytes.h>
#define ipt_connbytes_what xt_connbytes_what
#define IPT_CONNBYTES_PKTS XT_CONNBYTES_PKTS
#define IPT_CONNBYTES_BYTES XT_CONNBYTES_BYTES
#define IPT_CONNBYTES_AVGPKT XT_CONNBYTES_AVGPKT
#define ipt_connbytes_direction xt_connbytes_direction
#define IPT_CONNBYTES_DIR_ORIGINAL XT_CONNBYTES_DIR_ORIGINAL
#define IPT_CONNBYTES_DIR_REPLY XT_CONNBYTES_DIR_REPLY
#define IPT_CONNBYTES_DIR_BOTH XT_CONNBYTES_DIR_BOTH
#define ipt_connbytes_info xt_connbytes_info
#endif

7
include/linux/netfilter_ipv4/ipt_connmark.h
View File

@ -1,7 +0,0 @@
#ifndef _IPT_CONNMARK_H
#define _IPT_CONNMARK_H
#include <linux/netfilter/xt_connmark.h>
#define ipt_connmark_info xt_connmark_info
#endif /*_IPT_CONNMARK_H*/

28
include/linux/netfilter_ipv4/ipt_conntrack.h
View File

@ -1,28 +0,0 @@
/* Header file for kernel module to match connection tracking information.
* GPL (C) 2001 Marc Boucher (marc@mbsi.ca).
*/
#ifndef _IPT_CONNTRACK_H
#define _IPT_CONNTRACK_H
#include <linux/netfilter/xt_conntrack.h>
#define IPT_CONNTRACK_STATE_BIT(ctinfo) XT_CONNTRACK_STATE_BIT(ctinfo)
#define IPT_CONNTRACK_STATE_INVALID XT_CONNTRACK_STATE_INVALID
#define IPT_CONNTRACK_STATE_SNAT XT_CONNTRACK_STATE_SNAT
#define IPT_CONNTRACK_STATE_DNAT XT_CONNTRACK_STATE_DNAT
#define IPT_CONNTRACK_STATE_UNTRACKED XT_CONNTRACK_STATE_UNTRACKED
/* flags, invflags: */
#define IPT_CONNTRACK_STATE XT_CONNTRACK_STATE
#define IPT_CONNTRACK_PROTO XT_CONNTRACK_PROTO
#define IPT_CONNTRACK_ORIGSRC XT_CONNTRACK_ORIGSRC
#define IPT_CONNTRACK_ORIGDST XT_CONNTRACK_ORIGDST
#define IPT_CONNTRACK_REPLSRC XT_CONNTRACK_REPLSRC
#define IPT_CONNTRACK_REPLDST XT_CONNTRACK_REPLDST
#define IPT_CONNTRACK_STATUS XT_CONNTRACK_STATUS
#define IPT_CONNTRACK_EXPIRES XT_CONNTRACK_EXPIRES
#define ipt_conntrack_info xt_conntrack_info
#endif /*_IPT_CONNTRACK_H*/

15
include/linux/netfilter_ipv4/ipt_dccp.h
View File

@ -1,15 +0,0 @@
#ifndef _IPT_DCCP_H_
#define _IPT_DCCP_H_
#include <linux/netfilter/xt_dccp.h>
#define IPT_DCCP_SRC_PORTS XT_DCCP_SRC_PORTS
#define IPT_DCCP_DEST_PORTS XT_DCCP_DEST_PORTS
#define IPT_DCCP_TYPE XT_DCCP_TYPE
#define IPT_DCCP_OPTION XT_DCCP_OPTION
#define IPT_DCCP_VALID_FLAGS XT_DCCP_VALID_FLAGS
#define ipt_dccp_info xt_dccp_info
#endif /* _IPT_DCCP_H_ */

21
include/linux/netfilter_ipv4/ipt_dscp.h
View File

@ -1,21 +0,0 @@
/* iptables module for matching the IPv4 DSCP field
*
* (C) 2002 Harald Welte <laforge@gnumonks.org>
* This software is distributed under GNU GPL v2, 1991
*
* See RFC2474 for a description of the DSCP field within the IP Header.
*
* ipt_dscp.h,v 1.3 2002/08/05 19:00:21 laforge Exp
*/
#ifndef _IPT_DSCP_H
#define _IPT_DSCP_H
#include <linux/netfilter/xt_dscp.h>
#define IPT_DSCP_MASK XT_DSCP_MASK
#define IPT_DSCP_SHIFT XT_DSCP_SHIFT
#define IPT_DSCP_MAX XT_DSCP_MAX
#define ipt_dscp_info xt_dscp_info
#endif /* _IPT_DSCP_H */

4
include/linux/netfilter_ipv4/ipt_ecn.h
View File

@ -8,9 +8,9 @@
*/ */
#ifndef _IPT_ECN_H #ifndef _IPT_ECN_H
#define _IPT_ECN_H #define _IPT_ECN_H
#include <linux/netfilter_ipv4/ipt_dscp.h> #include <linux/netfilter/xt_dscp.h>
#define IPT_ECN_IP_MASK (~IPT_DSCP_MASK) #define IPT_ECN_IP_MASK (~XT_DSCP_MASK)
#define IPT_ECN_OP_MATCH_IP 0x01 #define IPT_ECN_OP_MATCH_IP 0x01
#define IPT_ECN_OP_MATCH_ECE 0x10 #define IPT_ECN_OP_MATCH_ECE 0x10

10
include/linux/netfilter_ipv4/ipt_esp.h
View File

@ -1,10 +0,0 @@
#ifndef _IPT_ESP_H
#define _IPT_ESP_H
#include <linux/netfilter/xt_esp.h>
#define ipt_esp xt_esp
#define IPT_ESP_INV_SPI XT_ESP_INV_SPI
#define IPT_ESP_INV_MASK XT_ESP_INV_MASK
#endif /*_IPT_ESP_H*/

14
include/linux/netfilter_ipv4/ipt_hashlimit.h
View File

@ -1,14 +0,0 @@
#ifndef _IPT_HASHLIMIT_H
#define _IPT_HASHLIMIT_H
#include <linux/netfilter/xt_hashlimit.h>
#define IPT_HASHLIMIT_SCALE XT_HASHLIMIT_SCALE
#define IPT_HASHLIMIT_HASH_DIP XT_HASHLIMIT_HASH_DIP
#define IPT_HASHLIMIT_HASH_DPT XT_HASHLIMIT_HASH_DPT
#define IPT_HASHLIMIT_HASH_SIP XT_HASHLIMIT_HASH_SIP
#define IPT_HASHLIMIT_HASH_SPT XT_HASHLIMIT_HASH_SPT
#define ipt_hashlimit_info xt_hashlimit_info
#endif /* _IPT_HASHLIMIT_H */

7
include/linux/netfilter_ipv4/ipt_helper.h
View File

@ -1,7 +0,0 @@
#ifndef _IPT_HELPER_H
#define _IPT_HELPER_H
#include <linux/netfilter/xt_helper.h>
#define ipt_helper_info xt_helper_info
#endif /* _IPT_HELPER_H */

21
include/linux/netfilter_ipv4/ipt_iprange.h
View File

@ -1,21 +0,0 @@
#ifndef _IPT_IPRANGE_H
#define _IPT_IPRANGE_H
#include <linux/types.h>
#include <linux/netfilter/xt_iprange.h>
struct ipt_iprange {
/* Inclusive: network order. */
__be32 min_ip, max_ip;
};
struct ipt_iprange_info
{
struct ipt_iprange src;
struct ipt_iprange dst;
/* Flags from above */
u_int8_t flags;
};
#endif /* _IPT_IPRANGE_H */

7
include/linux/netfilter_ipv4/ipt_length.h
View File

@ -1,7 +0,0 @@
#ifndef _IPT_LENGTH_H
#define _IPT_LENGTH_H
#include <linux/netfilter/xt_length.h>
#define ipt_length_info xt_length_info
#endif /*_IPT_LENGTH_H*/

8
include/linux/netfilter_ipv4/ipt_limit.h
View File

@ -1,8 +0,0 @@
#ifndef _IPT_RATE_H
#define _IPT_RATE_H
#include <linux/netfilter/xt_limit.h>
#define IPT_LIMIT_SCALE XT_LIMIT_SCALE
#define ipt_rateinfo xt_rateinfo
#endif /*_IPT_RATE_H*/

7
include/linux/netfilter_ipv4/ipt_mac.h
View File

@ -1,7 +0,0 @@
#ifndef _IPT_MAC_H
#define _IPT_MAC_H
#include <linux/netfilter/xt_mac.h>
#define ipt_mac_info xt_mac_info
#endif /*_IPT_MAC_H*/

9
include/linux/netfilter_ipv4/ipt_mark.h
View File

@ -1,9 +0,0 @@
#ifndef _IPT_MARK_H
#define _IPT_MARK_H
/* Backwards compatibility for old userspace */
#include <linux/netfilter/xt_mark.h>
#define ipt_mark_info xt_mark_info
#endif /*_IPT_MARK_H*/

15
include/linux/netfilter_ipv4/ipt_multiport.h
View File

@ -1,15 +0,0 @@
#ifndef _IPT_MULTIPORT_H
#define _IPT_MULTIPORT_H
#include <linux/netfilter/xt_multiport.h>
#define IPT_MULTIPORT_SOURCE XT_MULTIPORT_SOURCE
#define IPT_MULTIPORT_DESTINATION XT_MULTIPORT_DESTINATION
#define IPT_MULTIPORT_EITHER XT_MULTIPORT_EITHER
#define IPT_MULTI_PORTS XT_MULTI_PORTS
#define ipt_multiport xt_multiport
#define ipt_multiport_v1 xt_multiport_v1
#endif /*_IPT_MULTIPORT_H*/

20
include/linux/netfilter_ipv4/ipt_owner.h
View File

@ -1,20 +0,0 @@
#ifndef _IPT_OWNER_H
#define _IPT_OWNER_H
/* match and invert flags */
#define IPT_OWNER_UID 0x01
#define IPT_OWNER_GID 0x02
#define IPT_OWNER_PID 0x04
#define IPT_OWNER_SID 0x08
#define IPT_OWNER_COMM 0x10
struct ipt_owner_info {
__kernel_uid32_t uid;
__kernel_gid32_t gid;
__kernel_pid_t pid;
__kernel_pid_t sid;
char comm[16];
u_int8_t match, invert; /* flags */
};
#endif /*_IPT_OWNER_H*/

17
include/linux/netfilter_ipv4/ipt_physdev.h
View File

@ -1,17 +0,0 @@
#ifndef _IPT_PHYSDEV_H
#define _IPT_PHYSDEV_H
/* Backwards compatibility for old userspace */
#include <linux/netfilter/xt_physdev.h>
#define IPT_PHYSDEV_OP_IN XT_PHYSDEV_OP_IN
#define IPT_PHYSDEV_OP_OUT XT_PHYSDEV_OP_OUT
#define IPT_PHYSDEV_OP_BRIDGED XT_PHYSDEV_OP_BRIDGED
#define IPT_PHYSDEV_OP_ISIN XT_PHYSDEV_OP_ISIN
#define IPT_PHYSDEV_OP_ISOUT XT_PHYSDEV_OP_ISOUT
#define IPT_PHYSDEV_OP_MASK XT_PHYSDEV_OP_MASK
#define ipt_physdev_info xt_physdev_info
#endif /*_IPT_PHYSDEV_H*/

7
include/linux/netfilter_ipv4/ipt_pkttype.h
View File

@ -1,7 +0,0 @@
#ifndef _IPT_PKTTYPE_H
#define _IPT_PKTTYPE_H
#include <linux/netfilter/xt_pkttype.h>
#define ipt_pkttype_info xt_pkttype_info
#endif /*_IPT_PKTTYPE_H*/

23
include/linux/netfilter_ipv4/ipt_policy.h
View File

@ -1,23 +0,0 @@
#ifndef _IPT_POLICY_H
#define _IPT_POLICY_H
#include <linux/netfilter/xt_policy.h>
#define IPT_POLICY_MAX_ELEM XT_POLICY_MAX_ELEM
/* ipt_policy_flags */
#define IPT_POLICY_MATCH_IN XT_POLICY_MATCH_IN
#define IPT_POLICY_MATCH_OUT XT_POLICY_MATCH_OUT
#define IPT_POLICY_MATCH_NONE XT_POLICY_MATCH_NONE
#define IPT_POLICY_MATCH_STRICT XT_POLICY_MATCH_STRICT
/* ipt_policy_modes */
#define IPT_POLICY_MODE_TRANSPORT XT_POLICY_MODE_TRANSPORT
#define IPT_POLICY_MODE_TUNNEL XT_POLICY_MODE_TUNNEL
#define ipt_policy_spec xt_policy_spec
#define ipt_policy_addr xt_policy_addr
#define ipt_policy_elem xt_policy_elem
#define ipt_policy_info xt_policy_info
#endif /* _IPT_POLICY_H */

21
include/linux/netfilter_ipv4/ipt_recent.h
View File

@ -1,21 +0,0 @@
#ifndef _IPT_RECENT_H
#define _IPT_RECENT_H
#include <linux/netfilter/xt_recent.h>
#define ipt_recent_info xt_recent_mtinfo
enum {
IPT_RECENT_CHECK = XT_RECENT_CHECK,
IPT_RECENT_SET = XT_RECENT_SET,
IPT_RECENT_UPDATE = XT_RECENT_UPDATE,
IPT_RECENT_REMOVE = XT_RECENT_REMOVE,
IPT_RECENT_TTL = XT_RECENT_TTL,
IPT_RECENT_SOURCE = XT_RECENT_SOURCE,
IPT_RECENT_DEST = XT_RECENT_DEST,
IPT_RECENT_NAME_LEN = XT_RECENT_NAME_LEN,
};
#endif /*_IPT_RECENT_H*/

105
include/linux/netfilter_ipv4/ipt_sctp.h
View File

@ -1,105 +0,0 @@
#ifndef _IPT_SCTP_H_
#define _IPT_SCTP_H_
#define IPT_SCTP_SRC_PORTS 0x01
#define IPT_SCTP_DEST_PORTS 0x02
#define IPT_SCTP_CHUNK_TYPES 0x04
#define IPT_SCTP_VALID_FLAGS 0x07
struct ipt_sctp_flag_info {
u_int8_t chunktype;
u_int8_t flag;
u_int8_t flag_mask;
};
#define IPT_NUM_SCTP_FLAGS 4
struct ipt_sctp_info {
u_int16_t dpts[2]; /* Min, Max */
u_int16_t spts[2]; /* Min, Max */
u_int32_t chunkmap[256 / sizeof (u_int32_t)]; /* Bit mask of chunks to be matched according to RFC 2960 */
#define SCTP_CHUNK_MATCH_ANY 0x01 /* Match if any of the chunk types are present */
#define SCTP_CHUNK_MATCH_ALL 0x02 /* Match if all of the chunk types are present */
#define SCTP_CHUNK_MATCH_ONLY 0x04 /* Match if these are the only chunk types present */
u_int32_t chunk_match_type;
struct ipt_sctp_flag_info flag_info[IPT_NUM_SCTP_FLAGS];
int flag_count;
u_int32_t flags;
u_int32_t invflags;
};
#define bytes(type) (sizeof(type) * 8)
#define SCTP_CHUNKMAP_SET(chunkmap, type) \
do { \
chunkmap[type / bytes(u_int32_t)] |= \
1 << (type % bytes(u_int32_t)); \
} while (0)
#define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \
do { \
chunkmap[type / bytes(u_int32_t)] &= \
~(1 << (type % bytes(u_int32_t))); \
} while (0)
#define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \
({ \
(chunkmap[type / bytes (u_int32_t)] & \
(1 << (type % bytes (u_int32_t)))) ? 1: 0; \
})
#define SCTP_CHUNKMAP_RESET(chunkmap) \
do { \
int i; \
for (i = 0; i < ARRAY_SIZE(chunkmap); i++) \
chunkmap[i] = 0; \
} while (0)
#define SCTP_CHUNKMAP_SET_ALL(chunkmap) \
do { \
int i; \
for (i = 0; i < ARRAY_SIZE(chunkmap); i++) \
chunkmap[i] = ~0; \
} while (0)
#define SCTP_CHUNKMAP_COPY(destmap, srcmap) \
do { \
int i; \
for (i = 0; i < ARRAY_SIZE(chunkmap); i++) \
destmap[i] = srcmap[i]; \
} while (0)
#define SCTP_CHUNKMAP_IS_CLEAR(chunkmap) \
({ \
int i; \
int flag = 1; \
for (i = 0; i < ARRAY_SIZE(chunkmap); i++) { \
if (chunkmap[i]) { \
flag = 0; \
break; \
} \
} \
flag; \
})
#define SCTP_CHUNKMAP_IS_ALL_SET(chunkmap) \
({ \
int i; \
int flag = 1; \
for (i = 0; i < ARRAY_SIZE(chunkmap); i++) { \
if (chunkmap[i] != ~0) { \
flag = 0; \
break; \
} \
} \
flag; \
})
#endif /* _IPT_SCTP_H_ */

15
include/linux/netfilter_ipv4/ipt_state.h
View File

@ -1,15 +0,0 @@
#ifndef _IPT_STATE_H
#define _IPT_STATE_H
/* Backwards compatibility for old userspace */
#include <linux/netfilter/xt_state.h>
#define IPT_STATE_BIT XT_STATE_BIT
#define IPT_STATE_INVALID XT_STATE_INVALID
#define IPT_STATE_UNTRACKED XT_STATE_UNTRACKED
#define ipt_state_info xt_state_info
#endif /*_IPT_STATE_H*/

10
include/linux/netfilter_ipv4/ipt_string.h
View File

@ -1,10 +0,0 @@
#ifndef _IPT_STRING_H
#define _IPT_STRING_H
#include <linux/netfilter/xt_string.h>
#define IPT_STRING_MAX_PATTERN_SIZE XT_STRING_MAX_PATTERN_SIZE
#define IPT_STRING_MAX_ALGO_NAME_SIZE XT_STRING_MAX_ALGO_NAME_SIZE
#define ipt_string_info xt_string_info
#endif /*_IPT_STRING_H*/

7
include/linux/netfilter_ipv4/ipt_tcpmss.h
View File

@ -1,7 +0,0 @@
#ifndef _IPT_TCPMSS_MATCH_H
#define _IPT_TCPMSS_MATCH_H
#include <linux/netfilter/xt_tcpmss.h>
#define ipt_tcpmss_match_info xt_tcpmss_match_info
#endif /*_IPT_TCPMSS_MATCH_H*/

13
include/linux/netfilter_ipv4/ipt_tos.h
View File

@ -1,13 +0,0 @@
#ifndef _IPT_TOS_H
#define _IPT_TOS_H
struct ipt_tos_info {
u_int8_t tos;
u_int8_t invert;
};
#ifndef IPTOS_NORMALSVC
#define IPTOS_NORMALSVC 0
#endif
#endif /*_IPT_TOS_H*/

12
include/linux/netfilter_ipv6/Kbuild
View File

@ -1,22 +1,12 @@
header-y += ip6t_HL.h header-y += ip6t_HL.h
header-y += ip6t_LOG.h header-y += ip6t_LOG.h
header-y += ip6t_MARK.h
header-y += ip6t_REJECT.h header-y += ip6t_REJECT.h
header-y += ip6t_ah.h header-y += ip6t_ah.h
header-y += ip6t_esp.h
header-y += ip6t_frag.h header-y += ip6t_frag.h
header-y += ip6t_hl.h
header-y += ip6t_ipv6header.h header-y += ip6t_ipv6header.h
header-y += ip6t_length.h header-y += ip6t_hl.h
header-y += ip6t_limit.h
header-y += ip6t_mac.h
header-y += ip6t_mark.h
header-y += ip6t_mh.h header-y += ip6t_mh.h
header-y += ip6t_multiport.h
header-y += ip6t_opts.h header-y += ip6t_opts.h
header-y += ip6t_owner.h
header-y += ip6t_physdev.h
header-y += ip6t_policy.h
header-y += ip6t_rt.h header-y += ip6t_rt.h
unifdef-y += ip6_tables.h unifdef-y += ip6_tables.h

9
include/linux/netfilter_ipv6/ip6t_MARK.h
View File

@ -1,9 +0,0 @@
#ifndef _IP6T_MARK_H_target
#define _IP6T_MARK_H_target
/* Backwards compatibility for old userspace */
#include <linux/netfilter/xt_MARK.h>
#define ip6t_mark_target_info xt_mark_target_info
#endif /*_IP6T_MARK_H_target*/

10
include/linux/netfilter_ipv6/ip6t_esp.h
View File

@ -1,10 +0,0 @@
#ifndef _IP6T_ESP_H
#define _IP6T_ESP_H
#include <linux/netfilter/xt_esp.h>
#define ip6t_esp xt_esp
#define IP6T_ESP_INV_SPI XT_ESP_INV_SPI
#define IP6T_ESP_INV_MASK XT_ESP_INV_MASK
#endif /*_IP6T_ESP_H*/

8
include/linux/netfilter_ipv6/ip6t_length.h
View File

@ -1,8 +0,0 @@
#ifndef _IP6T_LENGTH_H
#define _IP6T_LENGTH_H
#include <linux/netfilter/xt_length.h>
#define ip6t_length_info xt_length_info
#endif /*_IP6T_LENGTH_H*/

8
include/linux/netfilter_ipv6/ip6t_limit.h
View File

@ -1,8 +0,0 @@
#ifndef _IP6T_RATE_H
#define _IP6T_RATE_H
#include <linux/netfilter/xt_limit.h>
#define IP6T_LIMIT_SCALE XT_LIMIT_SCALE
#define ip6t_rateinfo xt_rateinfo
#endif /*_IP6T_RATE_H*/

7
include/linux/netfilter_ipv6/ip6t_mac.h
View File

@ -1,7 +0,0 @@
#ifndef _IP6T_MAC_H
#define _IP6T_MAC_H
#include <linux/netfilter/xt_mac.h>
#define ip6t_mac_info xt_mac_info
#endif /*_IP6T_MAC_H*/

9
include/linux/netfilter_ipv6/ip6t_mark.h
View File

@ -1,9 +0,0 @@
#ifndef _IP6T_MARK_H
#define _IP6T_MARK_H
/* Backwards compatibility for old userspace */
#include <linux/netfilter/xt_mark.h>
#define ip6t_mark_info xt_mark_info
#endif /*_IPT_MARK_H*/

14
include/linux/netfilter_ipv6/ip6t_multiport.h
View File

@ -1,14 +0,0 @@
#ifndef _IP6T_MULTIPORT_H
#define _IP6T_MULTIPORT_H
#include <linux/netfilter/xt_multiport.h>
#define IP6T_MULTIPORT_SOURCE XT_MULTIPORT_SOURCE
#define IP6T_MULTIPORT_DESTINATION XT_MULTIPORT_DESTINATION
#define IP6T_MULTIPORT_EITHER XT_MULTIPORT_EITHER
#define IP6T_MULTI_PORTS XT_MULTI_PORTS
#define ip6t_multiport xt_multiport
#endif /*_IP6T_MULTIPORT_H*/

18
include/linux/netfilter_ipv6/ip6t_owner.h
View File

@ -1,18 +0,0 @@
#ifndef _IP6T_OWNER_H
#define _IP6T_OWNER_H
/* match and invert flags */
#define IP6T_OWNER_UID 0x01
#define IP6T_OWNER_GID 0x02
#define IP6T_OWNER_PID 0x04
#define IP6T_OWNER_SID 0x08
struct ip6t_owner_info {
__kernel_uid32_t uid;
__kernel_gid32_t gid;
__kernel_pid_t pid;
__kernel_pid_t sid;
u_int8_t match, invert; /* flags */
};
#endif /*_IPT_OWNER_H*/

17
include/linux/netfilter_ipv6/ip6t_physdev.h
View File

@ -1,17 +0,0 @@
#ifndef _IP6T_PHYSDEV_H
#define _IP6T_PHYSDEV_H
/* Backwards compatibility for old userspace */
#include <linux/netfilter/xt_physdev.h>
#define IP6T_PHYSDEV_OP_IN XT_PHYSDEV_OP_IN
#define IP6T_PHYSDEV_OP_OUT XT_PHYSDEV_OP_OUT
#define IP6T_PHYSDEV_OP_BRIDGED XT_PHYSDEV_OP_BRIDGED
#define IP6T_PHYSDEV_OP_ISIN XT_PHYSDEV_OP_ISIN
#define IP6T_PHYSDEV_OP_ISOUT XT_PHYSDEV_OP_ISOUT
#define IP6T_PHYSDEV_OP_MASK XT_PHYSDEV_OP_MASK
#define ip6t_physdev_info xt_physdev_info
#endif /*_IP6T_PHYSDEV_H*/

23
include/linux/netfilter_ipv6/ip6t_policy.h
View File

@ -1,23 +0,0 @@
#ifndef _IP6T_POLICY_H
#define _IP6T_POLICY_H
#include <linux/netfilter/xt_policy.h>
#define IP6T_POLICY_MAX_ELEM XT_POLICY_MAX_ELEM
/* ip6t_policy_flags */
#define IP6T_POLICY_MATCH_IN XT_POLICY_MATCH_IN
#define IP6T_POLICY_MATCH_OUT XT_POLICY_MATCH_OUT
#define IP6T_POLICY_MATCH_NONE XT_POLICY_MATCH_NONE
#define IP6T_POLICY_MATCH_STRICT XT_POLICY_MATCH_STRICT
/* ip6t_policy_modes */
#define IP6T_POLICY_MODE_TRANSPORT XT_POLICY_MODE_TRANSPORT
#define IP6T_POLICY_MODE_TUNNEL XT_POLICY_MODE_TUNNEL
#define ip6t_policy_spec xt_policy_spec
#define ip6t_policy_addr xt_policy_addr
#define ip6t_policy_elem xt_policy_elem
#define ip6t_policy_info xt_policy_info
#endif /* _IP6T_POLICY_H */

6
net/bridge/netfilter/ebtable_filter.c
View File

@ -77,21 +77,21 @@ static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {
{ {
.hook = ebt_in_hook, .hook = ebt_in_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_BRIDGE, .pf = NFPROTO_BRIDGE,
.hooknum = NF_BR_LOCAL_IN, .hooknum = NF_BR_LOCAL_IN,
.priority = NF_BR_PRI_FILTER_BRIDGED, .priority = NF_BR_PRI_FILTER_BRIDGED,
}, },
{ {
.hook = ebt_in_hook, .hook = ebt_in_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_BRIDGE, .pf = NFPROTO_BRIDGE,
.hooknum = NF_BR_FORWARD, .hooknum = NF_BR_FORWARD,
.priority = NF_BR_PRI_FILTER_BRIDGED, .priority = NF_BR_PRI_FILTER_BRIDGED,
}, },
{ {
.hook = ebt_out_hook, .hook = ebt_out_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_BRIDGE, .pf = NFPROTO_BRIDGE,
.hooknum = NF_BR_LOCAL_OUT, .hooknum = NF_BR_LOCAL_OUT,
.priority = NF_BR_PRI_FILTER_OTHER, .priority = NF_BR_PRI_FILTER_OTHER,
}, },

6
net/bridge/netfilter/ebtable_nat.c
View File

@ -77,21 +77,21 @@ static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
{ {
.hook = ebt_nat_out, .hook = ebt_nat_out,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_BRIDGE, .pf = NFPROTO_BRIDGE,
.hooknum = NF_BR_LOCAL_OUT, .hooknum = NF_BR_LOCAL_OUT,
.priority = NF_BR_PRI_NAT_DST_OTHER, .priority = NF_BR_PRI_NAT_DST_OTHER,
}, },
{ {
.hook = ebt_nat_out, .hook = ebt_nat_out,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_BRIDGE, .pf = NFPROTO_BRIDGE,
.hooknum = NF_BR_POST_ROUTING, .hooknum = NF_BR_POST_ROUTING,
.priority = NF_BR_PRI_NAT_SRC, .priority = NF_BR_PRI_NAT_SRC,
}, },
{ {
.hook = ebt_nat_in, .hook = ebt_nat_in,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_BRIDGE, .pf = NFPROTO_BRIDGE,
.hooknum = NF_BR_PRE_ROUTING, .hooknum = NF_BR_PRE_ROUTING,
.priority = NF_BR_PRI_NAT_DST_BRIDGED, .priority = NF_BR_PRI_NAT_DST_BRIDGED,
}, },

44
net/ipv4/netfilter/arp_tables.c
View File

@ -8,7 +8,7 @@
* Copyright (C) 2002 David S. Miller (davem@redhat.com) * Copyright (C) 2002 David S. Miller (davem@redhat.com)
* *
*/ */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/kernel.h> #include <linux/kernel.h>
#include <linux/skbuff.h> #include <linux/skbuff.h>
#include <linux/netdevice.h> #include <linux/netdevice.h>
@ -341,15 +341,11 @@ unsigned int arpt_do_table(struct sk_buff *skb,
} }
/* All zeroes == unconditional rule. */ /* All zeroes == unconditional rule. */
static inline int unconditional(const struct arpt_arp *arp) static inline bool unconditional(const struct arpt_arp *arp)
{ {
unsigned int i; static const struct arpt_arp uncond;
for (i = 0; i < sizeof(*arp)/sizeof(__u32); i++) return memcmp(arp, &uncond, sizeof(uncond)) == 0;
if (((__u32 *)arp)[i])
return 0;
return 1;
} }
/* Figures out from what hook each rule can be called: returns 0 if /* Figures out from what hook each rule can be called: returns 0 if
@ -537,12 +533,28 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
return ret; return ret;
} }
static bool check_underflow(struct arpt_entry *e)
{
const struct arpt_entry_target *t;
unsigned int verdict;
if (!unconditional(&e->arp))
return false;
t = arpt_get_target(e);
if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
return false;
verdict = ((struct arpt_standard_target *)t)->verdict;
verdict = -verdict - 1;
return verdict == NF_DROP || verdict == NF_ACCEPT;
}
static inline int check_entry_size_and_hooks(struct arpt_entry *e, static inline int check_entry_size_and_hooks(struct arpt_entry *e,
struct xt_table_info *newinfo, struct xt_table_info *newinfo,
unsigned char *base, unsigned char *base,
unsigned char *limit, unsigned char *limit,
const unsigned int *hook_entries, const unsigned int *hook_entries,
const unsigned int *underflows, const unsigned int *underflows,
unsigned int valid_hooks,
unsigned int *i) unsigned int *i)
{ {
unsigned int h; unsigned int h;
@ -562,15 +574,21 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
/* Check hooks & underflows */ /* Check hooks & underflows */
for (h = 0; h < NF_ARP_NUMHOOKS; h++) { for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
if (!(valid_hooks & (1 << h)))
continue;
if ((unsigned char *)e - base == hook_entries[h]) if ((unsigned char *)e - base == hook_entries[h])
newinfo->hook_entry[h] = hook_entries[h]; newinfo->hook_entry[h] = hook_entries[h];
if ((unsigned char *)e - base == underflows[h]) if ((unsigned char *)e - base == underflows[h]) {
if (!check_underflow(e)) {
pr_err("Underflows must be unconditional and "
"use the STANDARD target with "
"ACCEPT/DROP\n");
return -EINVAL;
}
newinfo->underflow[h] = underflows[h]; newinfo->underflow[h] = underflows[h];
}
} }
/* FIXME: underflows must be unconditional, standard verdicts
< 0 (not ARPT_RETURN). --RR */
/* Clear counters and comefrom */ /* Clear counters and comefrom */
e->counters = ((struct xt_counters) { 0, 0 }); e->counters = ((struct xt_counters) { 0, 0 });
e->comefrom = 0; e->comefrom = 0;
@ -630,7 +648,7 @@ static int translate_table(const char *name,
newinfo, newinfo,
entry0, entry0,
entry0 + size, entry0 + size,
hook_entries, underflows, &i); hook_entries, underflows, valid_hooks, &i);
duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret); duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret);
if (ret != 0) if (ret != 0)
return ret; return ret;

48
net/ipv4/netfilter/ip_tables.c
View File

@ -8,6 +8,7 @@
* it under the terms of the GNU General Public License version 2 as * it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation. * published by the Free Software Foundation.
*/ */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/cache.h> #include <linux/cache.h>
#include <linux/capability.h> #include <linux/capability.h>
#include <linux/skbuff.h> #include <linux/skbuff.h>
@ -190,16 +191,11 @@ get_entry(void *base, unsigned int offset)
/* All zeroes == unconditional rule. */ /* All zeroes == unconditional rule. */
/* Mildly perf critical (only if packet tracing is on) */ /* Mildly perf critical (only if packet tracing is on) */
static inline int static inline bool unconditional(const struct ipt_ip *ip)
unconditional(const struct ipt_ip *ip)
{ {
unsigned int i; static const struct ipt_ip uncond;
for (i = 0; i < sizeof(*ip)/sizeof(__u32); i++) return memcmp(ip, &uncond, sizeof(uncond)) == 0;
if (((__u32 *)ip)[i])
return 0;
return 1;
#undef FWINV #undef FWINV
} }
@ -315,7 +311,6 @@ ipt_do_table(struct sk_buff *skb,
static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long)))); static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
const struct iphdr *ip; const struct iphdr *ip;
u_int16_t datalen;
bool hotdrop = false; bool hotdrop = false;
/* Initializing verdict to NF_DROP keeps gcc happy. */ /* Initializing verdict to NF_DROP keeps gcc happy. */
unsigned int verdict = NF_DROP; unsigned int verdict = NF_DROP;
@ -328,7 +323,6 @@ ipt_do_table(struct sk_buff *skb,
/* Initialization */ /* Initialization */
ip = ip_hdr(skb); ip = ip_hdr(skb);
datalen = skb->len - ip->ihl * 4;
indev = in ? in->name : nulldevname; indev = in ? in->name : nulldevname;
outdev = out ? out->name : nulldevname; outdev = out ? out->name : nulldevname;
/* We handle fragments by dealing with the first fragment as /* We handle fragments by dealing with the first fragment as
@ -427,8 +421,6 @@ ipt_do_table(struct sk_buff *skb,
#endif #endif
/* Target might have changed stuff. */ /* Target might have changed stuff. */
ip = ip_hdr(skb); ip = ip_hdr(skb);
datalen = skb->len - ip->ihl * 4;
if (verdict == IPT_CONTINUE) if (verdict == IPT_CONTINUE)
e = ipt_next_entry(e); e = ipt_next_entry(e);
else else
@ -716,6 +708,21 @@ find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
return ret; return ret;
} }
static bool check_underflow(struct ipt_entry *e)
{
const struct ipt_entry_target *t;
unsigned int verdict;
if (!unconditional(&e->ip))
return false;
t = ipt_get_target(e);
if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
return false;
verdict = ((struct ipt_standard_target *)t)->verdict;
verdict = -verdict - 1;
return verdict == NF_DROP || verdict == NF_ACCEPT;
}
static int static int
check_entry_size_and_hooks(struct ipt_entry *e, check_entry_size_and_hooks(struct ipt_entry *e,
struct xt_table_info *newinfo, struct xt_table_info *newinfo,
@ -723,6 +730,7 @@ check_entry_size_and_hooks(struct ipt_entry *e,
unsigned char *limit, unsigned char *limit,
const unsigned int *hook_entries, const unsigned int *hook_entries,
const unsigned int *underflows, const unsigned int *underflows,
unsigned int valid_hooks,
unsigned int *i) unsigned int *i)
{ {
unsigned int h; unsigned int h;
@ -742,15 +750,21 @@ check_entry_size_and_hooks(struct ipt_entry *e,
/* Check hooks & underflows */ /* Check hooks & underflows */
for (h = 0; h < NF_INET_NUMHOOKS; h++) { for (h = 0; h < NF_INET_NUMHOOKS; h++) {
if (!(valid_hooks & (1 << h)))
continue;
if ((unsigned char *)e - base == hook_entries[h]) if ((unsigned char *)e - base == hook_entries[h])
newinfo->hook_entry[h] = hook_entries[h]; newinfo->hook_entry[h] = hook_entries[h];
if ((unsigned char *)e - base == underflows[h]) if ((unsigned char *)e - base == underflows[h]) {
if (!check_underflow(e)) {
pr_err("Underflows must be unconditional and "
"use the STANDARD target with "
"ACCEPT/DROP\n");
return -EINVAL;
}
newinfo->underflow[h] = underflows[h]; newinfo->underflow[h] = underflows[h];
}
} }
/* FIXME: underflows must be unconditional, standard verdicts
< 0 (not IPT_RETURN). --RR */
/* Clear counters and comefrom */ /* Clear counters and comefrom */
e->counters = ((struct xt_counters) { 0, 0 }); e->counters = ((struct xt_counters) { 0, 0 });
e->comefrom = 0; e->comefrom = 0;
@ -813,7 +827,7 @@ translate_table(const char *name,
newinfo, newinfo,
entry0, entry0,
entry0 + size, entry0 + size,
hook_entries, underflows, &i); hook_entries, underflows, valid_hooks, &i);
if (ret != 0) if (ret != 0)
return ret; return ret;

8
net/ipv4/netfilter/iptable_filter.c
View File

@ -57,7 +57,7 @@ static struct xt_table packet_filter = {
.name = "filter", .name = "filter",
.valid_hooks = FILTER_VALID_HOOKS, .valid_hooks = FILTER_VALID_HOOKS,
.me = THIS_MODULE, .me = THIS_MODULE,
.af = AF_INET, .af = NFPROTO_IPV4,
}; };
/* The work comes in here from netfilter.c. */ /* The work comes in here from netfilter.c. */
@ -102,21 +102,21 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
{ {
.hook = ipt_local_in_hook, .hook = ipt_local_in_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_FILTER, .priority = NF_IP_PRI_FILTER,
}, },
{ {
.hook = ipt_hook, .hook = ipt_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP_PRI_FILTER, .priority = NF_IP_PRI_FILTER,
}, },
{ {
.hook = ipt_local_out_hook, .hook = ipt_local_out_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_FILTER, .priority = NF_IP_PRI_FILTER,
}, },

12
net/ipv4/netfilter/iptable_mangle.c
View File

@ -68,7 +68,7 @@ static struct xt_table packet_mangler = {
.name = "mangle", .name = "mangle",
.valid_hooks = MANGLE_VALID_HOOKS, .valid_hooks = MANGLE_VALID_HOOKS,
.me = THIS_MODULE, .me = THIS_MODULE,
.af = AF_INET, .af = NFPROTO_IPV4,
}; };
/* The work comes in here from netfilter.c. */ /* The work comes in here from netfilter.c. */
@ -162,35 +162,35 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
{ {
.hook = ipt_pre_routing_hook, .hook = ipt_pre_routing_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP_PRI_MANGLE, .priority = NF_IP_PRI_MANGLE,
}, },
{ {
.hook = ipt_local_in_hook, .hook = ipt_local_in_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_MANGLE, .priority = NF_IP_PRI_MANGLE,
}, },
{ {
.hook = ipt_forward_hook, .hook = ipt_forward_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP_PRI_MANGLE, .priority = NF_IP_PRI_MANGLE,
}, },
{ {
.hook = ipt_local_hook, .hook = ipt_local_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_MANGLE, .priority = NF_IP_PRI_MANGLE,
}, },
{ {
.hook = ipt_post_routing_hook, .hook = ipt_post_routing_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP_PRI_MANGLE, .priority = NF_IP_PRI_MANGLE,
}, },

6
net/ipv4/netfilter/iptable_raw.c
View File

@ -40,7 +40,7 @@ static struct xt_table packet_raw = {
.name = "raw", .name = "raw",
.valid_hooks = RAW_VALID_HOOKS, .valid_hooks = RAW_VALID_HOOKS,
.me = THIS_MODULE, .me = THIS_MODULE,
.af = AF_INET, .af = NFPROTO_IPV4,
}; };
/* The work comes in here from netfilter.c. */ /* The work comes in here from netfilter.c. */
@ -74,14 +74,14 @@ ipt_local_hook(unsigned int hook,
static struct nf_hook_ops ipt_ops[] __read_mostly = { static struct nf_hook_ops ipt_ops[] __read_mostly = {
{ {
.hook = ipt_hook, .hook = ipt_hook,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP_PRI_RAW, .priority = NF_IP_PRI_RAW,
.owner = THIS_MODULE, .owner = THIS_MODULE,
}, },
{ {
.hook = ipt_local_hook, .hook = ipt_local_hook,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_RAW, .priority = NF_IP_PRI_RAW,
.owner = THIS_MODULE, .owner = THIS_MODULE,

8
net/ipv4/netfilter/iptable_security.c
View File

@ -61,7 +61,7 @@ static struct xt_table security_table = {
.name = "security", .name = "security",
.valid_hooks = SECURITY_VALID_HOOKS, .valid_hooks = SECURITY_VALID_HOOKS,
.me = THIS_MODULE, .me = THIS_MODULE,
.af = AF_INET, .af = NFPROTO_IPV4,
}; };
static unsigned int static unsigned int
@ -105,21 +105,21 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
{ {
.hook = ipt_local_in_hook, .hook = ipt_local_in_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_SECURITY, .priority = NF_IP_PRI_SECURITY,
}, },
{ {
.hook = ipt_forward_hook, .hook = ipt_forward_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP_PRI_SECURITY, .priority = NF_IP_PRI_SECURITY,
}, },
{ {
.hook = ipt_local_out_hook, .hook = ipt_local_out_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_SECURITY, .priority = NF_IP_PRI_SECURITY,
}, },

8
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
View File

@ -158,28 +158,28 @@ static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
{ {
.hook = ipv4_conntrack_in, .hook = ipv4_conntrack_in,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP_PRI_CONNTRACK, .priority = NF_IP_PRI_CONNTRACK,
}, },
{ {
.hook = ipv4_conntrack_local, .hook = ipv4_conntrack_local,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_CONNTRACK, .priority = NF_IP_PRI_CONNTRACK,
}, },
{ {
.hook = ipv4_confirm, .hook = ipv4_confirm,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP_PRI_CONNTRACK_CONFIRM, .priority = NF_IP_PRI_CONNTRACK_CONFIRM,
}, },
{ {
.hook = ipv4_confirm, .hook = ipv4_confirm,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_CONNTRACK_CONFIRM, .priority = NF_IP_PRI_CONNTRACK_CONFIRM,
}, },

2
net/ipv4/netfilter/nf_nat_rule.c
View File

@ -62,7 +62,7 @@ static struct xt_table nat_table = {
.name = "nat", .name = "nat",
.valid_hooks = NAT_VALID_HOOKS, .valid_hooks = NAT_VALID_HOOKS,
.me = THIS_MODULE, .me = THIS_MODULE,
.af = AF_INET, .af = NFPROTO_IPV4,
}; };
/* Source NAT */ /* Source NAT */

8
net/ipv4/netfilter/nf_nat_standalone.c
View File

@ -251,7 +251,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
{ {
.hook = nf_nat_in, .hook = nf_nat_in,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP_PRI_NAT_DST, .priority = NF_IP_PRI_NAT_DST,
}, },
@ -259,7 +259,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
{ {
.hook = nf_nat_out, .hook = nf_nat_out,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP_PRI_NAT_SRC, .priority = NF_IP_PRI_NAT_SRC,
}, },
@ -267,7 +267,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
{ {
.hook = nf_nat_local_fn, .hook = nf_nat_local_fn,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_NAT_DST, .priority = NF_IP_PRI_NAT_DST,
}, },
@ -275,7 +275,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
{ {
.hook = nf_nat_fn, .hook = nf_nat_fn,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET, .pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_NAT_SRC, .priority = NF_IP_PRI_NAT_SRC,
}, },

45
net/ipv6/netfilter/ip6_tables.c
View File

@ -8,7 +8,7 @@
* it under the terms of the GNU General Public License version 2 as * it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation. * published by the Free Software Foundation.
*/ */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/capability.h> #include <linux/capability.h>
#include <linux/in.h> #include <linux/in.h>
#include <linux/skbuff.h> #include <linux/skbuff.h>
@ -222,16 +222,11 @@ get_entry(void *base, unsigned int offset)
/* All zeroes == unconditional rule. */ /* All zeroes == unconditional rule. */
/* Mildly perf critical (only if packet tracing is on) */ /* Mildly perf critical (only if packet tracing is on) */
static inline int static inline bool unconditional(const struct ip6t_ip6 *ipv6)
unconditional(const struct ip6t_ip6 *ipv6)
{ {
unsigned int i; static const struct ip6t_ip6 uncond;
for (i = 0; i < sizeof(*ipv6); i++) return memcmp(ipv6, &uncond, sizeof(uncond)) == 0;
if (((char *)ipv6)[i])
break;
return (i == sizeof(*ipv6));
} }
#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \ #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
@ -745,6 +740,21 @@ find_check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
return ret; return ret;
} }
static bool check_underflow(struct ip6t_entry *e)
{
const struct ip6t_entry_target *t;
unsigned int verdict;
if (!unconditional(&e->ipv6))
return false;
t = ip6t_get_target(e);
if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
return false;
verdict = ((struct ip6t_standard_target *)t)->verdict;
verdict = -verdict - 1;
return verdict == NF_DROP || verdict == NF_ACCEPT;
}
static int static int
check_entry_size_and_hooks(struct ip6t_entry *e, check_entry_size_and_hooks(struct ip6t_entry *e,
struct xt_table_info *newinfo, struct xt_table_info *newinfo,
@ -752,6 +762,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
unsigned char *limit, unsigned char *limit,
const unsigned int *hook_entries, const unsigned int *hook_entries,
const unsigned int *underflows, const unsigned int *underflows,
unsigned int valid_hooks,
unsigned int *i) unsigned int *i)
{ {
unsigned int h; unsigned int h;
@ -771,15 +782,21 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
/* Check hooks & underflows */ /* Check hooks & underflows */
for (h = 0; h < NF_INET_NUMHOOKS; h++) { for (h = 0; h < NF_INET_NUMHOOKS; h++) {
if (!(valid_hooks & (1 << h)))
continue;
if ((unsigned char *)e - base == hook_entries[h]) if ((unsigned char *)e - base == hook_entries[h])
newinfo->hook_entry[h] = hook_entries[h]; newinfo->hook_entry[h] = hook_entries[h];
if ((unsigned char *)e - base == underflows[h]) if ((unsigned char *)e - base == underflows[h]) {
if (!check_underflow(e)) {
pr_err("Underflows must be unconditional and "
"use the STANDARD target with "
"ACCEPT/DROP\n");
return -EINVAL;
}
newinfo->underflow[h] = underflows[h]; newinfo->underflow[h] = underflows[h];
}
} }
/* FIXME: underflows must be unconditional, standard verdicts
< 0 (not IP6T_RETURN). --RR */
/* Clear counters and comefrom */ /* Clear counters and comefrom */
e->counters = ((struct xt_counters) { 0, 0 }); e->counters = ((struct xt_counters) { 0, 0 });
e->comefrom = 0; e->comefrom = 0;
@ -842,7 +859,7 @@ translate_table(const char *name,
newinfo, newinfo,
entry0, entry0,
entry0 + size, entry0 + size,
hook_entries, underflows, &i); hook_entries, underflows, valid_hooks, &i);
if (ret != 0) if (ret != 0)
return ret; return ret;

8
net/ipv6/netfilter/ip6table_filter.c
View File

@ -55,7 +55,7 @@ static struct xt_table packet_filter = {
.name = "filter", .name = "filter",
.valid_hooks = FILTER_VALID_HOOKS, .valid_hooks = FILTER_VALID_HOOKS,
.me = THIS_MODULE, .me = THIS_MODULE,
.af = AF_INET6, .af = NFPROTO_IPV6,
}; };
/* The work comes in here from netfilter.c. */ /* The work comes in here from netfilter.c. */
@ -95,21 +95,21 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
{ {
.hook = ip6t_in_hook, .hook = ip6t_in_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP6_PRI_FILTER, .priority = NF_IP6_PRI_FILTER,
}, },
{ {
.hook = ip6t_in_hook, .hook = ip6t_in_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP6_PRI_FILTER, .priority = NF_IP6_PRI_FILTER,
}, },
{ {
.hook = ip6t_local_out_hook, .hook = ip6t_local_out_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_FILTER, .priority = NF_IP6_PRI_FILTER,
}, },

12
net/ipv6/netfilter/ip6table_mangle.c
View File

@ -61,7 +61,7 @@ static struct xt_table packet_mangler = {
.name = "mangle", .name = "mangle",
.valid_hooks = MANGLE_VALID_HOOKS, .valid_hooks = MANGLE_VALID_HOOKS,
.me = THIS_MODULE, .me = THIS_MODULE,
.af = AF_INET6, .af = NFPROTO_IPV6,
}; };
/* The work comes in here from netfilter.c. */ /* The work comes in here from netfilter.c. */
@ -136,35 +136,35 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
{ {
.hook = ip6t_in_hook, .hook = ip6t_in_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP6_PRI_MANGLE, .priority = NF_IP6_PRI_MANGLE,
}, },
{ {
.hook = ip6t_in_hook, .hook = ip6t_in_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP6_PRI_MANGLE, .priority = NF_IP6_PRI_MANGLE,
}, },
{ {
.hook = ip6t_in_hook, .hook = ip6t_in_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP6_PRI_MANGLE, .priority = NF_IP6_PRI_MANGLE,
}, },
{ {
.hook = ip6t_local_out_hook, .hook = ip6t_local_out_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_MANGLE, .priority = NF_IP6_PRI_MANGLE,
}, },
{ {
.hook = ip6t_post_routing_hook, .hook = ip6t_post_routing_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP6_PRI_MANGLE, .priority = NF_IP6_PRI_MANGLE,
}, },

6
net/ipv6/netfilter/ip6table_raw.c
View File

@ -39,7 +39,7 @@ static struct xt_table packet_raw = {
.name = "raw", .name = "raw",
.valid_hooks = RAW_VALID_HOOKS, .valid_hooks = RAW_VALID_HOOKS,
.me = THIS_MODULE, .me = THIS_MODULE,
.af = AF_INET6, .af = NFPROTO_IPV6,
}; };
/* The work comes in here from netfilter.c. */ /* The work comes in here from netfilter.c. */
@ -68,14 +68,14 @@ ip6t_local_out_hook(unsigned int hook,
static struct nf_hook_ops ip6t_ops[] __read_mostly = { static struct nf_hook_ops ip6t_ops[] __read_mostly = {
{ {
.hook = ip6t_pre_routing_hook, .hook = ip6t_pre_routing_hook,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP6_PRI_FIRST, .priority = NF_IP6_PRI_FIRST,
.owner = THIS_MODULE, .owner = THIS_MODULE,
}, },
{ {
.hook = ip6t_local_out_hook, .hook = ip6t_local_out_hook,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_FIRST, .priority = NF_IP6_PRI_FIRST,
.owner = THIS_MODULE, .owner = THIS_MODULE,

8
net/ipv6/netfilter/ip6table_security.c
View File

@ -60,7 +60,7 @@ static struct xt_table security_table = {
.name = "security", .name = "security",
.valid_hooks = SECURITY_VALID_HOOKS, .valid_hooks = SECURITY_VALID_HOOKS,
.me = THIS_MODULE, .me = THIS_MODULE,
.af = AF_INET6, .af = NFPROTO_IPV6,
}; };
static unsigned int static unsigned int
@ -101,21 +101,21 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
{ {
.hook = ip6t_local_in_hook, .hook = ip6t_local_in_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP6_PRI_SECURITY, .priority = NF_IP6_PRI_SECURITY,
}, },
{ {
.hook = ip6t_forward_hook, .hook = ip6t_forward_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_FORWARD, .hooknum = NF_INET_FORWARD,
.priority = NF_IP6_PRI_SECURITY, .priority = NF_IP6_PRI_SECURITY,
}, },
{ {
.hook = ip6t_local_out_hook, .hook = ip6t_local_out_hook,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_SECURITY, .priority = NF_IP6_PRI_SECURITY,
}, },

12
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
View File

@ -265,42 +265,42 @@ static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
{ {
.hook = ipv6_defrag, .hook = ipv6_defrag,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP6_PRI_CONNTRACK_DEFRAG, .priority = NF_IP6_PRI_CONNTRACK_DEFRAG,
}, },
{ {
.hook = ipv6_conntrack_in, .hook = ipv6_conntrack_in,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_PRE_ROUTING, .hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP6_PRI_CONNTRACK, .priority = NF_IP6_PRI_CONNTRACK,
}, },
{ {
.hook = ipv6_conntrack_local, .hook = ipv6_conntrack_local,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_CONNTRACK, .priority = NF_IP6_PRI_CONNTRACK,
}, },
{ {
.hook = ipv6_defrag, .hook = ipv6_defrag,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_OUT, .hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_CONNTRACK_DEFRAG, .priority = NF_IP6_PRI_CONNTRACK_DEFRAG,
}, },
{ {
.hook = ipv6_confirm, .hook = ipv6_confirm,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_POST_ROUTING, .hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP6_PRI_LAST, .priority = NF_IP6_PRI_LAST,
}, },
{ {
.hook = ipv6_confirm, .hook = ipv6_confirm,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.pf = PF_INET6, .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_IN, .hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP6_PRI_LAST-1, .priority = NF_IP6_PRI_LAST-1,
}, },

134
net/netfilter/xt_CONNMARK.c
View File

@ -35,45 +35,6 @@ MODULE_ALIAS("ip6t_CONNMARK");
#include <linux/netfilter/xt_CONNMARK.h> #include <linux/netfilter/xt_CONNMARK.h>
#include <net/netfilter/nf_conntrack_ecache.h> #include <net/netfilter/nf_conntrack_ecache.h>
static unsigned int
connmark_tg_v0(struct sk_buff *skb, const struct xt_target_param *par)
{
const struct xt_connmark_target_info *markinfo = par->targinfo;
struct nf_conn *ct;
enum ip_conntrack_info ctinfo;
u_int32_t diff;
u_int32_t mark;
u_int32_t newmark;
ct = nf_ct_get(skb, &ctinfo);
if (ct) {
switch(markinfo->mode) {
case XT_CONNMARK_SET:
newmark = (ct->mark & ~markinfo->mask) | markinfo->mark;
if (newmark != ct->mark) {
ct->mark = newmark;
nf_conntrack_event_cache(IPCT_MARK, ct);
}
break;
case XT_CONNMARK_SAVE:
newmark = (ct->mark & ~markinfo->mask) |
(skb->mark & markinfo->mask);
if (ct->mark != newmark) {
ct->mark = newmark;
nf_conntrack_event_cache(IPCT_MARK, ct);
}
break;
case XT_CONNMARK_RESTORE:
mark = skb->mark;
diff = (ct->mark ^ mark) & markinfo->mask;
skb->mark = mark ^ diff;
break;
}
}
return XT_CONTINUE;
}
static unsigned int static unsigned int
connmark_tg(struct sk_buff *skb, const struct xt_target_param *par) connmark_tg(struct sk_buff *skb, const struct xt_target_param *par)
{ {
@ -112,30 +73,6 @@ connmark_tg(struct sk_buff *skb, const struct xt_target_param *par)
return XT_CONTINUE; return XT_CONTINUE;
} }
static bool connmark_tg_check_v0(const struct xt_tgchk_param *par)
{
const struct xt_connmark_target_info *matchinfo = par->targinfo;
if (matchinfo->mode == XT_CONNMARK_RESTORE) {
if (strcmp(par->table, "mangle") != 0) {
printk(KERN_WARNING "CONNMARK: restore can only be "
"called from \"mangle\" table, not \"%s\"\n",
par->table);
return false;
}
}
if (matchinfo->mark > 0xffffffff || matchinfo->mask > 0xffffffff) {
printk(KERN_WARNING "CONNMARK: Only supports 32bit mark\n");
return false;
}
if (nf_ct_l3proto_try_module_get(par->family) < 0) {
printk(KERN_WARNING "can't load conntrack support for "
"proto=%u\n", par->family);
return false;
}
return true;
}
static bool connmark_tg_check(const struct xt_tgchk_param *par) static bool connmark_tg_check(const struct xt_tgchk_param *par)
{ {
if (nf_ct_l3proto_try_module_get(par->family) < 0) { if (nf_ct_l3proto_try_module_get(par->family) < 0) {
@ -151,74 +88,25 @@ static void connmark_tg_destroy(const struct xt_tgdtor_param *par)
nf_ct_l3proto_module_put(par->family); nf_ct_l3proto_module_put(par->family);
} }
#ifdef CONFIG_COMPAT static struct xt_target connmark_tg_reg __read_mostly = {
struct compat_xt_connmark_target_info { .name = "CONNMARK",
compat_ulong_t mark, mask; .revision = 1,
u_int8_t mode; .family = NFPROTO_UNSPEC,
u_int8_t __pad1; .checkentry = connmark_tg_check,
u_int16_t __pad2; .target = connmark_tg,
}; .targetsize = sizeof(struct xt_connmark_tginfo1),
.destroy = connmark_tg_destroy,
static void connmark_tg_compat_from_user_v0(void *dst, void *src) .me = THIS_MODULE,
{
const struct compat_xt_connmark_target_info *cm = src;
struct xt_connmark_target_info m = {
.mark = cm->mark,
.mask = cm->mask,
.mode = cm->mode,
};
memcpy(dst, &m, sizeof(m));
}
static int connmark_tg_compat_to_user_v0(void __user *dst, void *src)
{
const struct xt_connmark_target_info *m = src;
struct compat_xt_connmark_target_info cm = {
.mark = m->mark,
.mask = m->mask,
.mode = m->mode,
};
return copy_to_user(dst, &cm, sizeof(cm)) ? -EFAULT : 0;
}
#endif /* CONFIG_COMPAT */
static struct xt_target connmark_tg_reg[] __read_mostly = {
{
.name = "CONNMARK",
.revision = 0,
.family = NFPROTO_UNSPEC,
.checkentry = connmark_tg_check_v0,
.destroy = connmark_tg_destroy,
.target = connmark_tg_v0,
.targetsize = sizeof(struct xt_connmark_target_info),
#ifdef CONFIG_COMPAT
.compatsize = sizeof(struct compat_xt_connmark_target_info),
.compat_from_user = connmark_tg_compat_from_user_v0,
.compat_to_user = connmark_tg_compat_to_user_v0,
#endif
.me = THIS_MODULE
},
{
.name = "CONNMARK",
.revision = 1,
.family = NFPROTO_UNSPEC,
.checkentry = connmark_tg_check,
.target = connmark_tg,
.targetsize = sizeof(struct xt_connmark_tginfo1),
.destroy = connmark_tg_destroy,
.me = THIS_MODULE,
},
}; };
static int __init connmark_tg_init(void) static int __init connmark_tg_init(void)
{ {
return xt_register_targets(connmark_tg_reg, return xt_register_target(&connmark_tg_reg);
ARRAY_SIZE(connmark_tg_reg));
} }
static void __exit connmark_tg_exit(void) static void __exit connmark_tg_exit(void)
{ {
xt_unregister_targets(connmark_tg_reg, ARRAY_SIZE(connmark_tg_reg)); xt_unregister_target(&connmark_tg_reg);
} }
module_init(connmark_tg_init); module_init(connmark_tg_init);

46
net/netfilter/xt_DSCP.c
View File

@ -18,7 +18,6 @@
#include <linux/netfilter/x_tables.h> #include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_DSCP.h> #include <linux/netfilter/xt_DSCP.h>
#include <linux/netfilter_ipv4/ipt_TOS.h>
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("Xtables: DSCP/TOS field modification"); MODULE_DESCRIPTION("Xtables: DSCP/TOS field modification");
@ -72,41 +71,6 @@ static bool dscp_tg_check(const struct xt_tgchk_param *par)
return true; return true;
} }
static unsigned int
tos_tg_v0(struct sk_buff *skb, const struct xt_target_param *par)
{
const struct ipt_tos_target_info *info = par->targinfo;
struct iphdr *iph = ip_hdr(skb);
u_int8_t oldtos;
if ((iph->tos & IPTOS_TOS_MASK) != info->tos) {
if (!skb_make_writable(skb, sizeof(struct iphdr)))
return NF_DROP;
iph = ip_hdr(skb);
oldtos = iph->tos;
iph->tos = (iph->tos & IPTOS_PREC_MASK) | info->tos;
csum_replace2(&iph->check, htons(oldtos), htons(iph->tos));
}
return XT_CONTINUE;
}
static bool tos_tg_check_v0(const struct xt_tgchk_param *par)
{
const struct ipt_tos_target_info *info = par->targinfo;
const uint8_t tos = info->tos;
if (tos != IPTOS_LOWDELAY && tos != IPTOS_THROUGHPUT &&
tos != IPTOS_RELIABILITY && tos != IPTOS_MINCOST &&
tos != IPTOS_NORMALSVC) {
printk(KERN_WARNING "TOS: bad tos value %#x\n", tos);
return false;
}
return true;
}
static unsigned int static unsigned int
tos_tg(struct sk_buff *skb, const struct xt_target_param *par) tos_tg(struct sk_buff *skb, const struct xt_target_param *par)
{ {
@ -166,16 +130,6 @@ static struct xt_target dscp_tg_reg[] __read_mostly = {
.table = "mangle", .table = "mangle",
.me = THIS_MODULE, .me = THIS_MODULE,
}, },
{
.name = "TOS",
.revision = 0,
.family = NFPROTO_IPV4,
.table = "mangle",
.target = tos_tg_v0,
.targetsize = sizeof(struct ipt_tos_target_info),
.checkentry = tos_tg_check_v0,
.me = THIS_MODULE,
},
{ {
.name = "TOS", .name = "TOS",
.revision = 1, .revision = 1,

163
net/netfilter/xt_MARK.c
View File

@ -24,39 +24,6 @@ MODULE_DESCRIPTION("Xtables: packet mark modification");
MODULE_ALIAS("ipt_MARK"); MODULE_ALIAS("ipt_MARK");
MODULE_ALIAS("ip6t_MARK"); MODULE_ALIAS("ip6t_MARK");
static unsigned int
mark_tg_v0(struct sk_buff *skb, const struct xt_target_param *par)
{
const struct xt_mark_target_info *markinfo = par->targinfo;
skb->mark = markinfo->mark;
return XT_CONTINUE;
}
static unsigned int
mark_tg_v1(struct sk_buff *skb, const struct xt_target_param *par)
{
const struct xt_mark_target_info_v1 *markinfo = par->targinfo;
int mark = 0;
switch (markinfo->mode) {
case XT_MARK_SET:
mark = markinfo->mark;
break;
case XT_MARK_AND:
mark = skb->mark & markinfo->mark;
break;
case XT_MARK_OR:
mark = skb->mark | markinfo->mark;
break;
}
skb->mark = mark;
return XT_CONTINUE;
}
static unsigned int static unsigned int
mark_tg(struct sk_buff *skb, const struct xt_target_param *par) mark_tg(struct sk_buff *skb, const struct xt_target_param *par)
{ {
@ -66,135 +33,23 @@ mark_tg(struct sk_buff *skb, const struct xt_target_param *par)
return XT_CONTINUE; return XT_CONTINUE;
} }
static bool mark_tg_check_v0(const struct xt_tgchk_param *par) static struct xt_target mark_tg_reg __read_mostly = {
{ .name = "MARK",
const struct xt_mark_target_info *markinfo = par->targinfo; .revision = 2,
.family = NFPROTO_UNSPEC,
if (markinfo->mark > 0xffffffff) { .target = mark_tg,
printk(KERN_WARNING "MARK: Only supports 32bit wide mark\n"); .targetsize = sizeof(struct xt_mark_tginfo2),
return false; .me = THIS_MODULE,
}
return true;
}
static bool mark_tg_check_v1(const struct xt_tgchk_param *par)
{
const struct xt_mark_target_info_v1 *markinfo = par->targinfo;
if (markinfo->mode != XT_MARK_SET
&& markinfo->mode != XT_MARK_AND
&& markinfo->mode != XT_MARK_OR) {
printk(KERN_WARNING "MARK: unknown mode %u\n",
markinfo->mode);
return false;
}
if (markinfo->mark > 0xffffffff) {
printk(KERN_WARNING "MARK: Only supports 32bit wide mark\n");
return false;
}
return true;
}
#ifdef CONFIG_COMPAT
struct compat_xt_mark_target_info {
compat_ulong_t mark;
};
static void mark_tg_compat_from_user_v0(void *dst, void *src)
{
const struct compat_xt_mark_target_info *cm = src;
struct xt_mark_target_info m = {
.mark = cm->mark,
};
memcpy(dst, &m, sizeof(m));
}
static int mark_tg_compat_to_user_v0(void __user *dst, void *src)
{
const struct xt_mark_target_info *m = src;
struct compat_xt_mark_target_info cm = {
.mark = m->mark,
};
return copy_to_user(dst, &cm, sizeof(cm)) ? -EFAULT : 0;
}
struct compat_xt_mark_target_info_v1 {
compat_ulong_t mark;
u_int8_t mode;
u_int8_t __pad1;
u_int16_t __pad2;
};
static void mark_tg_compat_from_user_v1(void *dst, void *src)
{
const struct compat_xt_mark_target_info_v1 *cm = src;
struct xt_mark_target_info_v1 m = {
.mark = cm->mark,
.mode = cm->mode,
};
memcpy(dst, &m, sizeof(m));
}
static int mark_tg_compat_to_user_v1(void __user *dst, void *src)
{
const struct xt_mark_target_info_v1 *m = src;
struct compat_xt_mark_target_info_v1 cm = {
.mark = m->mark,
.mode = m->mode,
};
return copy_to_user(dst, &cm, sizeof(cm)) ? -EFAULT : 0;
}
#endif /* CONFIG_COMPAT */
static struct xt_target mark_tg_reg[] __read_mostly = {
{
.name = "MARK",
.family = NFPROTO_UNSPEC,
.revision = 0,
.checkentry = mark_tg_check_v0,
.target = mark_tg_v0,
.targetsize = sizeof(struct xt_mark_target_info),
#ifdef CONFIG_COMPAT
.compatsize = sizeof(struct compat_xt_mark_target_info),
.compat_from_user = mark_tg_compat_from_user_v0,
.compat_to_user = mark_tg_compat_to_user_v0,
#endif
.table = "mangle",
.me = THIS_MODULE,
},
{
.name = "MARK",
.family = NFPROTO_UNSPEC,
.revision = 1,
.checkentry = mark_tg_check_v1,
.target = mark_tg_v1,
.targetsize = sizeof(struct xt_mark_target_info_v1),
#ifdef CONFIG_COMPAT
.compatsize = sizeof(struct compat_xt_mark_target_info_v1),
.compat_from_user = mark_tg_compat_from_user_v1,
.compat_to_user = mark_tg_compat_to_user_v1,
#endif
.table = "mangle",
.me = THIS_MODULE,
},
{
.name = "MARK",
.revision = 2,
.family = NFPROTO_UNSPEC,
.target = mark_tg,
.targetsize = sizeof(struct xt_mark_tginfo2),
.me = THIS_MODULE,
},
}; };
static int __init mark_tg_init(void) static int __init mark_tg_init(void)
{ {
return xt_register_targets(mark_tg_reg, ARRAY_SIZE(mark_tg_reg)); return xt_register_target(&mark_tg_reg);
} }
static void __exit mark_tg_exit(void) static void __exit mark_tg_exit(void)
{ {
xt_unregister_targets(mark_tg_reg, ARRAY_SIZE(mark_tg_reg)); xt_unregister_target(&mark_tg_reg);
} }
module_init(mark_tg_init); module_init(mark_tg_init);

101
net/netfilter/xt_connmark.c
View File

@ -47,36 +47,6 @@ connmark_mt(const struct sk_buff *skb, const struct xt_match_param *par)
return ((ct->mark & info->mask) == info->mark) ^ info->invert; return ((ct->mark & info->mask) == info->mark) ^ info->invert;
} }
static bool
connmark_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
{
const struct xt_connmark_info *info = par->matchinfo;
const struct nf_conn *ct;
enum ip_conntrack_info ctinfo;
ct = nf_ct_get(skb, &ctinfo);
if (!ct)
return false;
return ((ct->mark & info->mask) == info->mark) ^ info->invert;
}
static bool connmark_mt_check_v0(const struct xt_mtchk_param *par)
{
const struct xt_connmark_info *cm = par->matchinfo;
if (cm->mark > 0xffffffff || cm->mask > 0xffffffff) {
printk(KERN_WARNING "connmark: only support 32bit mark\n");
return false;
}
if (nf_ct_l3proto_try_module_get(par->family) < 0) {
printk(KERN_WARNING "can't load conntrack support for "
"proto=%u\n", par->family);
return false;
}
return true;
}
static bool connmark_mt_check(const struct xt_mtchk_param *par) static bool connmark_mt_check(const struct xt_mtchk_param *par)
{ {
if (nf_ct_l3proto_try_module_get(par->family) < 0) { if (nf_ct_l3proto_try_module_get(par->family) < 0) {
@ -92,74 +62,25 @@ static void connmark_mt_destroy(const struct xt_mtdtor_param *par)
nf_ct_l3proto_module_put(par->family); nf_ct_l3proto_module_put(par->family);
} }
#ifdef CONFIG_COMPAT static struct xt_match connmark_mt_reg __read_mostly = {
struct compat_xt_connmark_info { .name = "connmark",
compat_ulong_t mark, mask; .revision = 1,
u_int8_t invert; .family = NFPROTO_UNSPEC,
u_int8_t __pad1; .checkentry = connmark_mt_check,
u_int16_t __pad2; .match = connmark_mt,
}; .matchsize = sizeof(struct xt_connmark_mtinfo1),
.destroy = connmark_mt_destroy,
static void connmark_mt_compat_from_user_v0(void *dst, void *src) .me = THIS_MODULE,
{
const struct compat_xt_connmark_info *cm = src;
struct xt_connmark_info m = {
.mark = cm->mark,
.mask = cm->mask,
.invert = cm->invert,
};
memcpy(dst, &m, sizeof(m));
}
static int connmark_mt_compat_to_user_v0(void __user *dst, void *src)
{
const struct xt_connmark_info *m = src;
struct compat_xt_connmark_info cm = {
.mark = m->mark,
.mask = m->mask,
.invert = m->invert,
};
return copy_to_user(dst, &cm, sizeof(cm)) ? -EFAULT : 0;
}
#endif /* CONFIG_COMPAT */
static struct xt_match connmark_mt_reg[] __read_mostly = {
{
.name = "connmark",
.revision = 0,
.family = NFPROTO_UNSPEC,
.checkentry = connmark_mt_check_v0,
.match = connmark_mt_v0,
.destroy = connmark_mt_destroy,
.matchsize = sizeof(struct xt_connmark_info),
#ifdef CONFIG_COMPAT
.compatsize = sizeof(struct compat_xt_connmark_info),
.compat_from_user = connmark_mt_compat_from_user_v0,
.compat_to_user = connmark_mt_compat_to_user_v0,
#endif
.me = THIS_MODULE
},
{
.name = "connmark",
.revision = 1,
.family = NFPROTO_UNSPEC,
.checkentry = connmark_mt_check,
.match = connmark_mt,
.matchsize = sizeof(struct xt_connmark_mtinfo1),
.destroy = connmark_mt_destroy,
.me = THIS_MODULE,
},
}; };
static int __init connmark_mt_init(void) static int __init connmark_mt_init(void)
{ {
return xt_register_matches(connmark_mt_reg, return xt_register_match(&connmark_mt_reg);
ARRAY_SIZE(connmark_mt_reg));
} }
static void __exit connmark_mt_exit(void) static void __exit connmark_mt_exit(void)
{ {
xt_unregister_matches(connmark_mt_reg, ARRAY_SIZE(connmark_mt_reg)); xt_unregister_match(&connmark_mt_reg);
} }
module_init(connmark_mt_init); module_init(connmark_mt_init);

155
net/netfilter/xt_conntrack.c
View File

@ -19,100 +19,11 @@
MODULE_LICENSE("GPL"); MODULE_LICENSE("GPL");
MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>"); MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>"); MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
MODULE_DESCRIPTION("Xtables: connection tracking state match"); MODULE_DESCRIPTION("Xtables: connection tracking state match");
MODULE_ALIAS("ipt_conntrack"); MODULE_ALIAS("ipt_conntrack");
MODULE_ALIAS("ip6t_conntrack"); MODULE_ALIAS("ip6t_conntrack");
static bool
conntrack_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
{
const struct xt_conntrack_info *sinfo = par->matchinfo;
const struct nf_conn *ct;
enum ip_conntrack_info ctinfo;
unsigned int statebit;
ct = nf_ct_get(skb, &ctinfo);
#define FWINV(bool, invflg) ((bool) ^ !!(sinfo->invflags & (invflg)))
if (ct == &nf_conntrack_untracked)
statebit = XT_CONNTRACK_STATE_UNTRACKED;
else if (ct)
statebit = XT_CONNTRACK_STATE_BIT(ctinfo);
else
statebit = XT_CONNTRACK_STATE_INVALID;
if (sinfo->flags & XT_CONNTRACK_STATE) {
if (ct) {
if (test_bit(IPS_SRC_NAT_BIT, &ct->status))
statebit |= XT_CONNTRACK_STATE_SNAT;
if (test_bit(IPS_DST_NAT_BIT, &ct->status))
statebit |= XT_CONNTRACK_STATE_DNAT;
}
if (FWINV((statebit & sinfo->statemask) == 0,
XT_CONNTRACK_STATE))
return false;
}
if (ct == NULL) {
if (sinfo->flags & ~XT_CONNTRACK_STATE)
return false;
return true;
}
if (sinfo->flags & XT_CONNTRACK_PROTO &&
FWINV(nf_ct_protonum(ct) !=
sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum,
XT_CONNTRACK_PROTO))
return false;
if (sinfo->flags & XT_CONNTRACK_ORIGSRC &&
FWINV((ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip &
sinfo->sipmsk[IP_CT_DIR_ORIGINAL].s_addr) !=
sinfo->tuple[IP_CT_DIR_ORIGINAL].src.ip,
XT_CONNTRACK_ORIGSRC))
return false;
if (sinfo->flags & XT_CONNTRACK_ORIGDST &&
FWINV((ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.ip &
sinfo->dipmsk[IP_CT_DIR_ORIGINAL].s_addr) !=
sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.ip,
XT_CONNTRACK_ORIGDST))
return false;
if (sinfo->flags & XT_CONNTRACK_REPLSRC &&
FWINV((ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip &
sinfo->sipmsk[IP_CT_DIR_REPLY].s_addr) !=
sinfo->tuple[IP_CT_DIR_REPLY].src.ip,
XT_CONNTRACK_REPLSRC))
return false;
if (sinfo->flags & XT_CONNTRACK_REPLDST &&
FWINV((ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip &
sinfo->dipmsk[IP_CT_DIR_REPLY].s_addr) !=
sinfo->tuple[IP_CT_DIR_REPLY].dst.ip,
XT_CONNTRACK_REPLDST))
return false;
if (sinfo->flags & XT_CONNTRACK_STATUS &&
FWINV((ct->status & sinfo->statusmask) == 0,
XT_CONNTRACK_STATUS))
return false;
if(sinfo->flags & XT_CONNTRACK_EXPIRES) {
unsigned long expires = timer_pending(&ct->timeout) ?
(ct->timeout.expires - jiffies)/HZ : 0;
if (FWINV(!(expires >= sinfo->expires_min &&
expires <= sinfo->expires_max),
XT_CONNTRACK_EXPIRES))
return false;
}
return true;
#undef FWINV
}
static bool static bool
conntrack_addrcmp(const union nf_inet_addr *kaddr, conntrack_addrcmp(const union nf_inet_addr *kaddr,
const union nf_inet_addr *uaddr, const union nf_inet_addr *uaddr,
@ -337,71 +248,7 @@ static void conntrack_mt_destroy_v1(const struct xt_mtdtor_param *par)
conntrack_mt_destroy(par); conntrack_mt_destroy(par);
} }
#ifdef CONFIG_COMPAT
struct compat_xt_conntrack_info
{
compat_uint_t statemask;
compat_uint_t statusmask;
struct ip_conntrack_old_tuple tuple[IP_CT_DIR_MAX];
struct in_addr sipmsk[IP_CT_DIR_MAX];
struct in_addr dipmsk[IP_CT_DIR_MAX];
compat_ulong_t expires_min;
compat_ulong_t expires_max;
u_int8_t flags;
u_int8_t invflags;
};
static void conntrack_mt_compat_from_user_v0(void *dst, void *src)
{
const struct compat_xt_conntrack_info *cm = src;
struct xt_conntrack_info m = {
.statemask = cm->statemask,
.statusmask = cm->statusmask,
.expires_min = cm->expires_min,
.expires_max = cm->expires_max,
.flags = cm->flags,
.invflags = cm->invflags,
};
memcpy(m.tuple, cm->tuple, sizeof(m.tuple));
memcpy(m.sipmsk, cm->sipmsk, sizeof(m.sipmsk));
memcpy(m.dipmsk, cm->dipmsk, sizeof(m.dipmsk));
memcpy(dst, &m, sizeof(m));
}
static int conntrack_mt_compat_to_user_v0(void __user *dst, void *src)
{
const struct xt_conntrack_info *m = src;
struct compat_xt_conntrack_info cm = {
.statemask = m->statemask,
.statusmask = m->statusmask,
.expires_min = m->expires_min,
.expires_max = m->expires_max,
.flags = m->flags,
.invflags = m->invflags,
};
memcpy(cm.tuple, m->tuple, sizeof(cm.tuple));
memcpy(cm.sipmsk, m->sipmsk, sizeof(cm.sipmsk));
memcpy(cm.dipmsk, m->dipmsk, sizeof(cm.dipmsk));
return copy_to_user(dst, &cm, sizeof(cm)) ? -EFAULT : 0;
}
#endif
static struct xt_match conntrack_mt_reg[] __read_mostly = { static struct xt_match conntrack_mt_reg[] __read_mostly = {
{
.name = "conntrack",
.revision = 0,
.family = NFPROTO_IPV4,
.match = conntrack_mt_v0,
.checkentry = conntrack_mt_check,
.destroy = conntrack_mt_destroy,
.matchsize = sizeof(struct xt_conntrack_info),
.me = THIS_MODULE,
#ifdef CONFIG_COMPAT
.compatsize = sizeof(struct compat_xt_conntrack_info),
.compat_from_user = conntrack_mt_compat_from_user_v0,
.compat_to_user = conntrack_mt_compat_to_user_v0,
#endif
},
{ {
.name = "conntrack", .name = "conntrack",
.revision = 1, .revision = 1,

17
net/netfilter/xt_dscp.c
View File

@ -15,7 +15,6 @@
#include <linux/netfilter/x_tables.h> #include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_dscp.h> #include <linux/netfilter/xt_dscp.h>
#include <linux/netfilter_ipv4/ipt_tos.h>
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("Xtables: DSCP/TOS field match"); MODULE_DESCRIPTION("Xtables: DSCP/TOS field match");
@ -55,14 +54,6 @@ static bool dscp_mt_check(const struct xt_mtchk_param *par)
return true; return true;
} }
static bool
tos_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
{
const struct ipt_tos_info *info = par->matchinfo;
return (ip_hdr(skb)->tos == info->tos) ^ info->invert;
}
static bool tos_mt(const struct sk_buff *skb, const struct xt_match_param *par) static bool tos_mt(const struct sk_buff *skb, const struct xt_match_param *par)
{ {
const struct xt_tos_match_info *info = par->matchinfo; const struct xt_tos_match_info *info = par->matchinfo;
@ -92,14 +83,6 @@ static struct xt_match dscp_mt_reg[] __read_mostly = {
.matchsize = sizeof(struct xt_dscp_info), .matchsize = sizeof(struct xt_dscp_info),
.me = THIS_MODULE, .me = THIS_MODULE,
}, },
{
.name = "tos",
.revision = 0,
.family = NFPROTO_IPV4,
.match = tos_mt_v0,
.matchsize = sizeof(struct ipt_tos_info),
.me = THIS_MODULE,
},
{ {
.name = "tos", .name = "tos",
.revision = 1, .revision = 1,

45
net/netfilter/xt_iprange.c
View File

@ -14,40 +14,6 @@
#include <linux/ipv6.h> #include <linux/ipv6.h>
#include <linux/netfilter/x_tables.h> #include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_iprange.h> #include <linux/netfilter/xt_iprange.h>
#include <linux/netfilter_ipv4/ipt_iprange.h>
static bool
iprange_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
{
const struct ipt_iprange_info *info = par->matchinfo;
const struct iphdr *iph = ip_hdr(skb);
if (info->flags & IPRANGE_SRC) {
if ((ntohl(iph->saddr) < ntohl(info->src.min_ip)
|| ntohl(iph->saddr) > ntohl(info->src.max_ip))
^ !!(info->flags & IPRANGE_SRC_INV)) {
pr_debug("src IP %pI4 NOT in range %s%pI4-%pI4\n",
&iph->saddr,
info->flags & IPRANGE_SRC_INV ? "(INV) " : "",
&info->src.min_ip,
&info->src.max_ip);
return false;
}
}
if (info->flags & IPRANGE_DST) {
if ((ntohl(iph->daddr) < ntohl(info->dst.min_ip)
|| ntohl(iph->daddr) > ntohl(info->dst.max_ip))
^ !!(info->flags & IPRANGE_DST_INV)) {
pr_debug("dst IP %pI4 NOT in range %s%pI4-%pI4\n",
&iph->daddr,
info->flags & IPRANGE_DST_INV ? "(INV) " : "",
&info->dst.min_ip,
&info->dst.max_ip);
return false;
}
}
return true;
}
static bool static bool
iprange_mt4(const struct sk_buff *skb, const struct xt_match_param *par) iprange_mt4(const struct sk_buff *skb, const struct xt_match_param *par)
@ -125,14 +91,6 @@ iprange_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
} }
static struct xt_match iprange_mt_reg[] __read_mostly = { static struct xt_match iprange_mt_reg[] __read_mostly = {
{
.name = "iprange",
.revision = 0,
.family = NFPROTO_IPV4,
.match = iprange_mt_v0,
.matchsize = sizeof(struct ipt_iprange_info),
.me = THIS_MODULE,
},
{ {
.name = "iprange", .name = "iprange",
.revision = 1, .revision = 1,
@ -164,7 +122,8 @@ static void __exit iprange_mt_exit(void)
module_init(iprange_mt_init); module_init(iprange_mt_init);
module_exit(iprange_mt_exit); module_exit(iprange_mt_exit);
MODULE_LICENSE("GPL"); MODULE_LICENSE("GPL");
MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>, Jan Engelhardt <jengelh@computergmbh.de>"); MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
MODULE_DESCRIPTION("Xtables: arbitrary IPv4 range matching"); MODULE_DESCRIPTION("Xtables: arbitrary IPv4 range matching");
MODULE_ALIAS("ipt_iprange"); MODULE_ALIAS("ipt_iprange");
MODULE_ALIAS("ip6t_iprange"); MODULE_ALIAS("ip6t_iprange");

86
net/netfilter/xt_mark.c
View File

@ -3,7 +3,7 @@
* *
* (C) 1999-2001 Marc Boucher <marc@mbsi.ca> * (C) 1999-2001 Marc Boucher <marc@mbsi.ca>
* Copyright © CC Computer Consultants GmbH, 2007 - 2008 * Copyright © CC Computer Consultants GmbH, 2007 - 2008
* Jan Engelhardt <jengelh@computergmbh.de> * Jan Engelhardt <jengelh@medozas.de>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as * it under the terms of the GNU General Public License version 2 as
@ -22,14 +22,6 @@ MODULE_DESCRIPTION("Xtables: packet mark match");
MODULE_ALIAS("ipt_mark"); MODULE_ALIAS("ipt_mark");
MODULE_ALIAS("ip6t_mark"); MODULE_ALIAS("ip6t_mark");
static bool
mark_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
{
const struct xt_mark_info *info = par->matchinfo;
return ((skb->mark & info->mask) == info->mark) ^ info->invert;
}
static bool static bool
mark_mt(const struct sk_buff *skb, const struct xt_match_param *par) mark_mt(const struct sk_buff *skb, const struct xt_match_param *par)
{ {
@ -38,81 +30,23 @@ mark_mt(const struct sk_buff *skb, const struct xt_match_param *par)
return ((skb->mark & info->mask) == info->mark) ^ info->invert; return ((skb->mark & info->mask) == info->mark) ^ info->invert;
} }
static bool mark_mt_check_v0(const struct xt_mtchk_param *par) static struct xt_match mark_mt_reg __read_mostly = {
{ .name = "mark",
const struct xt_mark_info *minfo = par->matchinfo; .revision = 1,
.family = NFPROTO_UNSPEC,
if (minfo->mark > 0xffffffff || minfo->mask > 0xffffffff) { .match = mark_mt,
printk(KERN_WARNING "mark: only supports 32bit mark\n"); .matchsize = sizeof(struct xt_mark_mtinfo1),
return false; .me = THIS_MODULE,
}
return true;
}
#ifdef CONFIG_COMPAT
struct compat_xt_mark_info {
compat_ulong_t mark, mask;
u_int8_t invert;
u_int8_t __pad1;
u_int16_t __pad2;
};
static void mark_mt_compat_from_user_v0(void *dst, void *src)
{
const struct compat_xt_mark_info *cm = src;
struct xt_mark_info m = {
.mark = cm->mark,
.mask = cm->mask,
.invert = cm->invert,
};
memcpy(dst, &m, sizeof(m));
}
static int mark_mt_compat_to_user_v0(void __user *dst, void *src)
{
const struct xt_mark_info *m = src;
struct compat_xt_mark_info cm = {
.mark = m->mark,
.mask = m->mask,
.invert = m->invert,
};
return copy_to_user(dst, &cm, sizeof(cm)) ? -EFAULT : 0;
}
#endif /* CONFIG_COMPAT */
static struct xt_match mark_mt_reg[] __read_mostly = {
{
.name = "mark",
.revision = 0,
.family = NFPROTO_UNSPEC,
.checkentry = mark_mt_check_v0,
.match = mark_mt_v0,
.matchsize = sizeof(struct xt_mark_info),
#ifdef CONFIG_COMPAT
.compatsize = sizeof(struct compat_xt_mark_info),
.compat_from_user = mark_mt_compat_from_user_v0,
.compat_to_user = mark_mt_compat_to_user_v0,
#endif
.me = THIS_MODULE,
},
{
.name = "mark",
.revision = 1,
.family = NFPROTO_UNSPEC,
.match = mark_mt,
.matchsize = sizeof(struct xt_mark_mtinfo1),
.me = THIS_MODULE,
},
}; };
static int __init mark_mt_init(void) static int __init mark_mt_init(void)
{ {
return xt_register_matches(mark_mt_reg, ARRAY_SIZE(mark_mt_reg)); return xt_register_match(&mark_mt_reg);
} }
static void __exit mark_mt_exit(void) static void __exit mark_mt_exit(void)
{ {
xt_unregister_matches(mark_mt_reg, ARRAY_SIZE(mark_mt_reg)); xt_unregister_match(&mark_mt_reg);
} }
module_init(mark_mt_init); module_init(mark_mt_init);

130
net/netfilter/xt_owner.c
View File

@ -5,7 +5,6 @@
* (C) 2000 Marc Boucher <marc@mbsi.ca> * (C) 2000 Marc Boucher <marc@mbsi.ca>
* *
* Copyright © CC Computer Consultants GmbH, 2007 - 2008 * Copyright © CC Computer Consultants GmbH, 2007 - 2008
* <jengelh@computergmbh.de>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as * it under the terms of the GNU General Public License version 2 as
@ -17,60 +16,6 @@
#include <net/sock.h> #include <net/sock.h>
#include <linux/netfilter/x_tables.h> #include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_owner.h> #include <linux/netfilter/xt_owner.h>
#include <linux/netfilter_ipv4/ipt_owner.h>
#include <linux/netfilter_ipv6/ip6t_owner.h>
static bool
owner_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
{
const struct ipt_owner_info *info = par->matchinfo;
const struct file *filp;
if (skb->sk == NULL || skb->sk->sk_socket == NULL)
return false;
filp = skb->sk->sk_socket->file;
if (filp == NULL)
return false;
if (info->match & IPT_OWNER_UID)
if ((filp->f_cred->fsuid != info->uid) ^
!!(info->invert & IPT_OWNER_UID))
return false;
if (info->match & IPT_OWNER_GID)
if ((filp->f_cred->fsgid != info->gid) ^
!!(info->invert & IPT_OWNER_GID))
return false;
return true;
}
static bool
owner_mt6_v0(const struct sk_buff *skb, const struct xt_match_param *par)
{
const struct ip6t_owner_info *info = par->matchinfo;
const struct file *filp;
if (skb->sk == NULL || skb->sk->sk_socket == NULL)
return false;
filp = skb->sk->sk_socket->file;
if (filp == NULL)
return false;
if (info->match & IP6T_OWNER_UID)
if ((filp->f_cred->fsuid != info->uid) ^
!!(info->invert & IP6T_OWNER_UID))
return false;
if (info->match & IP6T_OWNER_GID)
if ((filp->f_cred->fsgid != info->gid) ^
!!(info->invert & IP6T_OWNER_GID))
return false;
return true;
}
static bool static bool
owner_mt(const struct sk_buff *skb, const struct xt_match_param *par) owner_mt(const struct sk_buff *skb, const struct xt_match_param *par)
@ -107,81 +52,30 @@ owner_mt(const struct sk_buff *skb, const struct xt_match_param *par)
return true; return true;
} }
static bool owner_mt_check_v0(const struct xt_mtchk_param *par) static struct xt_match owner_mt_reg __read_mostly = {
{ .name = "owner",
const struct ipt_owner_info *info = par->matchinfo; .revision = 1,
.family = NFPROTO_UNSPEC,
if (info->match & (IPT_OWNER_PID | IPT_OWNER_SID | IPT_OWNER_COMM)) { .match = owner_mt,
printk(KERN_WARNING KBUILD_MODNAME .matchsize = sizeof(struct xt_owner_match_info),
": PID, SID and command matching is not " .hooks = (1 << NF_INET_LOCAL_OUT) |
"supported anymore\n"); (1 << NF_INET_POST_ROUTING),
return false; .me = THIS_MODULE,
}
return true;
}
static bool owner_mt6_check_v0(const struct xt_mtchk_param *par)
{
const struct ip6t_owner_info *info = par->matchinfo;
if (info->match & (IP6T_OWNER_PID | IP6T_OWNER_SID)) {
printk(KERN_WARNING KBUILD_MODNAME
": PID and SID matching is not supported anymore\n");
return false;
}
return true;
}
static struct xt_match owner_mt_reg[] __read_mostly = {
{
.name = "owner",
.revision = 0,
.family = NFPROTO_IPV4,
.match = owner_mt_v0,
.matchsize = sizeof(struct ipt_owner_info),
.checkentry = owner_mt_check_v0,
.hooks = (1 << NF_INET_LOCAL_OUT) |
(1 << NF_INET_POST_ROUTING),
.me = THIS_MODULE,
},
{
.name = "owner",
.revision = 0,
.family = NFPROTO_IPV6,
.match = owner_mt6_v0,
.matchsize = sizeof(struct ip6t_owner_info),
.checkentry = owner_mt6_check_v0,
.hooks = (1 << NF_INET_LOCAL_OUT) |
(1 << NF_INET_POST_ROUTING),
.me = THIS_MODULE,
},
{
.name = "owner",
.revision = 1,
.family = NFPROTO_UNSPEC,
.match = owner_mt,
.matchsize = sizeof(struct xt_owner_match_info),
.hooks = (1 << NF_INET_LOCAL_OUT) |
(1 << NF_INET_POST_ROUTING),
.me = THIS_MODULE,
},
}; };
static int __init owner_mt_init(void) static int __init owner_mt_init(void)
{ {
return xt_register_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg)); return xt_register_match(&owner_mt_reg);
} }
static void __exit owner_mt_exit(void) static void __exit owner_mt_exit(void)
{ {
xt_unregister_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg)); xt_unregister_match(&owner_mt_reg);
} }
module_init(owner_mt_init); module_init(owner_mt_init);
module_exit(owner_mt_exit); module_exit(owner_mt_exit);
MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>"); MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
MODULE_DESCRIPTION("Xtables: socket owner matching"); MODULE_DESCRIPTION("Xtables: socket owner matching");
MODULE_LICENSE("GPL"); MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_owner"); MODULE_ALIAS("ipt_owner");