Oops, something went wrong.
| @@ -1,81 +0,0 @@ | ||
| -/* This is a module which is used for setting the NFMARK field of an skb. */ | ||
| - | ||
| -/* (C) 1999-2001 Marc Boucher <marc@mbsi.ca> | ||
| - * | ||
| - * This program is free software; you can redistribute it and/or modify | ||
| - * it under the terms of the GNU General Public License version 2 as | ||
| - * published by the Free Software Foundation. | ||
| - */ | ||
| - | ||
| -#include <linux/module.h> | ||
| -#include <linux/skbuff.h> | ||
| -#include <linux/ip.h> | ||
| -#include <net/checksum.h> | ||
| - | ||
| -#include <linux/netfilter_ipv6/ip6_tables.h> | ||
| -#include <linux/netfilter_ipv6/ip6t_MARK.h> | ||
| - | ||
| -MODULE_LICENSE("GPL"); | ||
| -MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); | ||
| - | ||
| -static unsigned int | ||
| -target(struct sk_buff **pskb, | ||
| - const struct net_device *in, | ||
| - const struct net_device *out, | ||
| - unsigned int hooknum, | ||
| - const void *targinfo, | ||
| - void *userinfo) | ||
| -{ | ||
| - const struct ip6t_mark_target_info *markinfo = targinfo; | ||
| - | ||
| - if((*pskb)->nfmark != markinfo->mark) | ||
| - (*pskb)->nfmark = markinfo->mark; | ||
| - | ||
| - return IP6T_CONTINUE; | ||
| -} | ||
| - | ||
| -static int | ||
| -checkentry(const char *tablename, | ||
| - const struct ip6t_entry *e, | ||
| - void *targinfo, | ||
| - unsigned int targinfosize, | ||
| - unsigned int hook_mask) | ||
| -{ | ||
| - if (targinfosize != IP6T_ALIGN(sizeof(struct ip6t_mark_target_info))) { | ||
| - printk(KERN_WARNING "MARK: targinfosize %u != %Zu\n", | ||
| - targinfosize, | ||
| - IP6T_ALIGN(sizeof(struct ip6t_mark_target_info))); | ||
| - return 0; | ||
| - } | ||
| - | ||
| - if (strcmp(tablename, "mangle") != 0) { | ||
| - printk(KERN_WARNING "MARK: can only be called from \"mangle\" table, not \"%s\"\n", tablename); | ||
| - return 0; | ||
| - } | ||
| - | ||
| - return 1; | ||
| -} | ||
| - | ||
| -static struct ip6t_target ip6t_mark_reg = { | ||
| - .name = "MARK", | ||
| - .target = target, | ||
| - .checkentry = checkentry, | ||
| - .me = THIS_MODULE | ||
| -}; | ||
| - | ||
| -static int __init init(void) | ||
| -{ | ||
| - printk(KERN_DEBUG "registering ipv6 mark target\n"); | ||
| - if (ip6t_register_target(&ip6t_mark_reg)) | ||
| - return -EINVAL; | ||
| - | ||
| - return 0; | ||
| -} | ||
| - | ||
| -static void __exit fini(void) | ||
| -{ | ||
| - ip6t_unregister_target(&ip6t_mark_reg); | ||
| -} | ||
| - | ||
| -module_init(init); | ||
| -module_exit(fini); |
| @@ -1,70 +0,0 @@ | ||
| -/* ip6tables module for using new netfilter netlink queue | ||
| - * | ||
| - * (C) 2005 by Harald Welte <laforge@netfilter.org> | ||
| - * | ||
| - * This program is free software; you can redistribute it and/or modify | ||
| - * it under the terms of the GNU General Public License version 2 as | ||
| - * published by the Free Software Foundation. | ||
| - * | ||
| - */ | ||
| - | ||
| -#include <linux/module.h> | ||
| -#include <linux/skbuff.h> | ||
| - | ||
| -#include <linux/netfilter.h> | ||
| -#include <linux/netfilter_ipv6/ip6_tables.h> | ||
| -#include <linux/netfilter_ipv4/ipt_NFQUEUE.h> | ||
| - | ||
| -MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); | ||
| -MODULE_DESCRIPTION("ip6tables NFQUEUE target"); | ||
| -MODULE_LICENSE("GPL"); | ||
| - | ||
| -static unsigned int | ||
| -target(struct sk_buff **pskb, | ||
| - const struct net_device *in, | ||
| - const struct net_device *out, | ||
| - unsigned int hooknum, | ||
| - const void *targinfo, | ||
| - void *userinfo) | ||
| -{ | ||
| - const struct ipt_NFQ_info *tinfo = targinfo; | ||
| - | ||
| - return NF_QUEUE_NR(tinfo->queuenum); | ||
| -} | ||
| - | ||
| -static int | ||
| -checkentry(const char *tablename, | ||
| - const struct ip6t_entry *e, | ||
| - void *targinfo, | ||
| - unsigned int targinfosize, | ||
| - unsigned int hook_mask) | ||
| -{ | ||
| - if (targinfosize != IP6T_ALIGN(sizeof(struct ipt_NFQ_info))) { | ||
| - printk(KERN_WARNING "NFQUEUE: targinfosize %u != %Zu\n", | ||
| - targinfosize, | ||
| - IP6T_ALIGN(sizeof(struct ipt_NFQ_info))); | ||
| - return 0; | ||
| - } | ||
| - | ||
| - return 1; | ||
| -} | ||
| - | ||
| -static struct ip6t_target ipt_NFQ_reg = { | ||
| - .name = "NFQUEUE", | ||
| - .target = target, | ||
| - .checkentry = checkentry, | ||
| - .me = THIS_MODULE, | ||
| -}; | ||
| - | ||
| -static int __init init(void) | ||
| -{ | ||
| - return ip6t_register_target(&ipt_NFQ_reg); | ||
| -} | ||
| - | ||
| -static void __exit fini(void) | ||
| -{ | ||
| - ip6t_unregister_target(&ipt_NFQ_reg); | ||
| -} | ||
| - | ||
| -module_init(init); | ||
| -module_exit(fini); |
| @@ -1,66 +0,0 @@ | ||
| -/* Length Match - IPv6 Port */ | ||
| - | ||
| -/* (C) 1999-2001 James Morris <jmorros@intercode.com.au> | ||
| - * | ||
| - * This program is free software; you can redistribute it and/or modify | ||
| - * it under the terms of the GNU General Public License version 2 as | ||
| - * published by the Free Software Foundation. | ||
| - */ | ||
| - | ||
| - | ||
| -#include <linux/module.h> | ||
| -#include <linux/skbuff.h> | ||
| -#include <linux/netfilter_ipv6/ip6t_length.h> | ||
| -#include <linux/netfilter_ipv6/ip6_tables.h> | ||
| - | ||
| -MODULE_LICENSE("GPL"); | ||
| -MODULE_AUTHOR("James Morris <jmorris@intercode.com.au>"); | ||
| -MODULE_DESCRIPTION("IPv6 packet length match"); | ||
| - | ||
| -static int | ||
| -match(const struct sk_buff *skb, | ||
| - const struct net_device *in, | ||
| - const struct net_device *out, | ||
| - const void *matchinfo, | ||
| - int offset, | ||
| - unsigned int protoff, | ||
| - int *hotdrop) | ||
| -{ | ||
| - const struct ip6t_length_info *info = matchinfo; | ||
| - u_int16_t pktlen = ntohs(skb->nh.ipv6h->payload_len) + sizeof(struct ipv6hdr); | ||
| - | ||
| - return (pktlen >= info->min && pktlen <= info->max) ^ info->invert; | ||
| -} | ||
| - | ||
| -static int | ||
| -checkentry(const char *tablename, | ||
| - const struct ip6t_ip6 *ip, | ||
| - void *matchinfo, | ||
| - unsigned int matchsize, | ||
| - unsigned int hook_mask) | ||
| -{ | ||
| - if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_length_info))) | ||
| - return 0; | ||
| - | ||
| - return 1; | ||
| -} | ||
| - | ||
| -static struct ip6t_match length_match = { | ||
| - .name = "length", | ||
| - .match = &match, | ||
| - .checkentry = &checkentry, | ||
| - .me = THIS_MODULE, | ||
| -}; | ||
| - | ||
| -static int __init init(void) | ||
| -{ | ||
| - return ip6t_register_match(&length_match); | ||
| -} | ||
| - | ||
| -static void __exit fini(void) | ||
| -{ | ||
| - ip6t_unregister_match(&length_match); | ||
| -} | ||
| - | ||
| -module_init(init); | ||
| -module_exit(fini); |
| @@ -1,147 +0,0 @@ | ||
| -/* Kernel module to control the rate | ||
| - * | ||
| - * 2 September 1999: Changed from the target RATE to the match | ||
| - * `limit', removed logging. Did I mention that | ||
| - * Alexey is a fucking genius? | ||
| - * Rusty Russell (rusty@rustcorp.com.au). */ | ||
| - | ||
| -/* (C) 1999 Jérôme de Vivie <devivie@info.enserb.u-bordeaux.fr> | ||
| - * (C) 1999 Hervé Eychenne <eychenne@info.enserb.u-bordeaux.fr> | ||
| - * | ||
| - * This program is free software; you can redistribute it and/or modify | ||
| - * it under the terms of the GNU General Public License version 2 as | ||
| - * published by the Free Software Foundation. | ||
| - */ | ||
| - | ||
| -#include <linux/module.h> | ||
| -#include <linux/skbuff.h> | ||
| -#include <linux/spinlock.h> | ||
| -#include <linux/interrupt.h> | ||
| - | ||
| -#include <linux/netfilter_ipv6/ip6_tables.h> | ||
| -#include <linux/netfilter_ipv6/ip6t_limit.h> | ||
| - | ||
| -MODULE_LICENSE("GPL"); | ||
| -MODULE_AUTHOR("Herve Eychenne <rv@wallfire.org>"); | ||
| -MODULE_DESCRIPTION("rate limiting within ip6tables"); | ||
| - | ||
| -/* The algorithm used is the Simple Token Bucket Filter (TBF) | ||
| - * see net/sched/sch_tbf.c in the linux source tree | ||
| - */ | ||
| - | ||
| -static DEFINE_SPINLOCK(limit_lock); | ||
| - | ||
| -/* Rusty: This is my (non-mathematically-inclined) understanding of | ||
| - this algorithm. The `average rate' in jiffies becomes your initial | ||
| - amount of credit `credit' and the most credit you can ever have | ||
| - `credit_cap'. The `peak rate' becomes the cost of passing the | ||
| - test, `cost'. | ||
| - | ||
| - `prev' tracks the last packet hit: you gain one credit per jiffy. | ||
| - If you get credit balance more than this, the extra credit is | ||
| - discarded. Every time the match passes, you lose `cost' credits; | ||
| - if you don't have that many, the test fails. | ||
| - | ||
| - See Alexey's formal explanation in net/sched/sch_tbf.c. | ||
| - | ||
| - To avoid underflow, we multiply by 128 (ie. you get 128 credits per | ||
| - jiffy). Hence a cost of 2^32-1, means one pass per 32768 seconds | ||
| - at 1024HZ (or one every 9 hours). A cost of 1 means 12800 passes | ||
| - per second at 100HZ. */ | ||
| - | ||
| -#define CREDITS_PER_JIFFY 128 | ||
| - | ||
| -static int | ||
| -ip6t_limit_match(const struct sk_buff *skb, | ||
| - const struct net_device *in, | ||
| - const struct net_device *out, | ||
| - const void *matchinfo, | ||
| - int offset, | ||
| - unsigned int protoff, | ||
| - int *hotdrop) | ||
| -{ | ||
| - struct ip6t_rateinfo *r = ((struct ip6t_rateinfo *)matchinfo)->master; | ||
| - unsigned long now = jiffies; | ||
| - | ||
| - spin_lock_bh(&limit_lock); | ||
| - r->credit += (now - xchg(&r->prev, now)) * CREDITS_PER_JIFFY; | ||
| - if (r->credit > r->credit_cap) | ||
| - r->credit = r->credit_cap; | ||
| - | ||
| - if (r->credit >= r->cost) { | ||
| - /* We're not limited. */ | ||
| - r->credit -= r->cost; | ||
| - spin_unlock_bh(&limit_lock); | ||
| - return 1; | ||
| - } | ||
| - | ||
| - spin_unlock_bh(&limit_lock); | ||
| - return 0; | ||
| -} | ||
| - | ||
| -/* Precision saver. */ | ||
| -static u_int32_t | ||
| -user2credits(u_int32_t user) | ||
| -{ | ||
| - /* If multiplying would overflow... */ | ||
| - if (user > 0xFFFFFFFF / (HZ*CREDITS_PER_JIFFY)) | ||
| - /* Divide first. */ | ||
| - return (user / IP6T_LIMIT_SCALE) * HZ * CREDITS_PER_JIFFY; | ||
| - | ||
| - return (user * HZ * CREDITS_PER_JIFFY) / IP6T_LIMIT_SCALE; | ||
| -} | ||
| - | ||
| -static int | ||
| -ip6t_limit_checkentry(const char *tablename, | ||
| - const struct ip6t_ip6 *ip, | ||
| - void *matchinfo, | ||
| - unsigned int matchsize, | ||
| - unsigned int hook_mask) | ||
| -{ | ||
| - struct ip6t_rateinfo *r = matchinfo; | ||
| - | ||
| - if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_rateinfo))) | ||
| - return 0; | ||
| - | ||
| - /* Check for overflow. */ | ||
| - if (r->burst == 0 | ||
| - || user2credits(r->avg * r->burst) < user2credits(r->avg)) { | ||
| - printk("Call rusty: overflow in ip6t_limit: %u/%u\n", | ||
| - r->avg, r->burst); | ||
| - return 0; | ||
| - } | ||
| - | ||
| - /* User avg in seconds * IP6T_LIMIT_SCALE: convert to jiffies * | ||
| - 128. */ | ||
| - r->prev = jiffies; | ||
| - r->credit = user2credits(r->avg * r->burst); /* Credits full. */ | ||
| - r->credit_cap = user2credits(r->avg * r->burst); /* Credits full. */ | ||
| - r->cost = user2credits(r->avg); | ||
| - | ||
| - /* For SMP, we only want to use one set of counters. */ | ||
| - r->master = r; | ||
| - | ||
| - return 1; | ||
| -} | ||
| - | ||
| -static struct ip6t_match ip6t_limit_reg = { | ||
| - .name = "limit", | ||
| - .match = ip6t_limit_match, | ||
| - .checkentry = ip6t_limit_checkentry, | ||
| - .me = THIS_MODULE, | ||
| -}; | ||
| - | ||
| -static int __init init(void) | ||
| -{ | ||
| - if (ip6t_register_match(&ip6t_limit_reg)) | ||
| - return -EINVAL; | ||
| - return 0; | ||
| -} | ||
| - | ||
| -static void __exit fini(void) | ||
| -{ | ||
| - ip6t_unregister_match(&ip6t_limit_reg); | ||
| -} | ||
| - | ||
| -module_init(init); | ||
| -module_exit(fini); |
| @@ -1,81 +0,0 @@ | ||
| -/* Kernel module to match MAC address parameters. */ | ||
| - | ||
| -/* (C) 1999-2001 Paul `Rusty' Russell | ||
| - * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> | ||
| - * | ||
| - * This program is free software; you can redistribute it and/or modify | ||
| - * it under the terms of the GNU General Public License version 2 as | ||
| - * published by the Free Software Foundation. | ||
| - */ | ||
| - | ||
| -#include <linux/module.h> | ||
| -#include <linux/skbuff.h> | ||
| -#include <linux/if_ether.h> | ||
| -#include <linux/etherdevice.h> | ||
| - | ||
| -#include <linux/netfilter_ipv6/ip6t_mac.h> | ||
| -#include <linux/netfilter_ipv6/ip6_tables.h> | ||
| - | ||
| -MODULE_LICENSE("GPL"); | ||
| -MODULE_DESCRIPTION("MAC address matching module for IPv6"); | ||
| -MODULE_AUTHOR("Netfilter Core Teaam <coreteam@netfilter.org>"); | ||
| - | ||
| -static int | ||
| -match(const struct sk_buff *skb, | ||
| - const struct net_device *in, | ||
| - const struct net_device *out, | ||
| - const void *matchinfo, | ||
| - int offset, | ||
| - unsigned int protoff, | ||
| - int *hotdrop) | ||
| -{ | ||
| - const struct ip6t_mac_info *info = matchinfo; | ||
| - | ||
| - /* Is mac pointer valid? */ | ||
| - return (skb->mac.raw >= skb->head | ||
| - && (skb->mac.raw + ETH_HLEN) <= skb->data | ||
| - /* If so, compare... */ | ||
| - && ((!compare_ether_addr(eth_hdr(skb)->h_source, info->srcaddr)) | ||
| - ^ info->invert)); | ||
| -} | ||
| - | ||
| -static int | ||
| -ip6t_mac_checkentry(const char *tablename, | ||
| - const struct ip6t_ip6 *ip, | ||
| - void *matchinfo, | ||
| - unsigned int matchsize, | ||
| - unsigned int hook_mask) | ||
| -{ | ||
| - if (hook_mask | ||
| - & ~((1 << NF_IP6_PRE_ROUTING) | (1 << NF_IP6_LOCAL_IN) | ||
| - | (1 << NF_IP6_FORWARD))) { | ||
| - printk("ip6t_mac: only valid for PRE_ROUTING, LOCAL_IN or" | ||
| - " FORWARD\n"); | ||
| - return 0; | ||
| - } | ||
| - | ||
| - if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_mac_info))) | ||
| - return 0; | ||
| - | ||
| - return 1; | ||
| -} | ||
| - | ||
| -static struct ip6t_match mac_match = { | ||
| - .name = "mac", | ||
| - .match = &match, | ||
| - .checkentry = &ip6t_mac_checkentry, | ||
| - .me = THIS_MODULE, | ||
| -}; | ||
| - | ||
| -static int __init init(void) | ||
| -{ | ||
| - return ip6t_register_match(&mac_match); | ||
| -} | ||
| - | ||
| -static void __exit fini(void) | ||
| -{ | ||
| - ip6t_unregister_match(&mac_match); | ||
| -} | ||
| - | ||
| -module_init(init); | ||
| -module_exit(fini); |
| @@ -1,66 +0,0 @@ | ||
| -/* Kernel module to match NFMARK values. */ | ||
| - | ||
| -/* (C) 1999-2001 Marc Boucher <marc@mbsi.ca> | ||
| - * | ||
| - * This program is free software; you can redistribute it and/or modify | ||
| - * it under the terms of the GNU General Public License version 2 as | ||
| - * published by the Free Software Foundation. | ||
| - */ | ||
| - | ||
| - | ||
| -#include <linux/module.h> | ||
| -#include <linux/skbuff.h> | ||
| - | ||
| -#include <linux/netfilter_ipv6/ip6t_mark.h> | ||
| -#include <linux/netfilter_ipv6/ip6_tables.h> | ||
| - | ||
| -MODULE_LICENSE("GPL"); | ||
| -MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); | ||
| -MODULE_DESCRIPTION("ip6tables mark match"); | ||
| - | ||
| -static int | ||
| -match(const struct sk_buff *skb, | ||
| - const struct net_device *in, | ||
| - const struct net_device *out, | ||
| - const void *matchinfo, | ||
| - int offset, | ||
| - unsigned int protoff, | ||
| - int *hotdrop) | ||
| -{ | ||
| - const struct ip6t_mark_info *info = matchinfo; | ||
| - | ||
| - return ((skb->nfmark & info->mask) == info->mark) ^ info->invert; | ||
| -} | ||
| - | ||
| -static int | ||
| -checkentry(const char *tablename, | ||
| - const struct ip6t_ip6 *ip, | ||
| - void *matchinfo, | ||
| - unsigned int matchsize, | ||
| - unsigned int hook_mask) | ||
| -{ | ||
| - if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_mark_info))) | ||
| - return 0; | ||
| - | ||
| - return 1; | ||
| -} | ||
| - | ||
| -static struct ip6t_match mark_match = { | ||
| - .name = "mark", | ||
| - .match = &match, | ||
| - .checkentry = &checkentry, | ||
| - .me = THIS_MODULE, | ||
| -}; | ||
| - | ||
| -static int __init init(void) | ||
| -{ | ||
| - return ip6t_register_match(&mark_match); | ||
| -} | ||
| - | ||
| -static void __exit fini(void) | ||
| -{ | ||
| - ip6t_unregister_match(&mark_match); | ||
| -} | ||
| - | ||
| -module_init(init); | ||
| -module_exit(fini); |
| @@ -1,18 +1,49 @@ | ||
| netfilter-objs := core.o nf_log.o nf_queue.o nf_sockopt.o | ||
| +nf_conntrack-objs := nf_conntrack_core.o nf_conntrack_standalone.o nf_conntrack_l3proto_generic.o nf_conntrack_proto_generic.o nf_conntrack_proto_tcp.o nf_conntrack_proto_udp.o | ||
| obj-$(CONFIG_NETFILTER) = netfilter.o | ||
| obj-$(CONFIG_NETFILTER_NETLINK) += nfnetlink.o | ||
| obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += nfnetlink_queue.o | ||
| obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o | ||
| -nf_conntrack-objs := nf_conntrack_core.o nf_conntrack_standalone.o nf_conntrack_l3proto_generic.o nf_conntrack_proto_generic.o nf_conntrack_proto_tcp.o nf_conntrack_proto_udp.o | ||
| - | ||
| +# connection tracking | ||
| obj-$(CONFIG_NF_CONNTRACK) += nf_conntrack.o | ||
| -obj-$(CONFIG_NF_CONNTRACK_FTP) += nf_conntrack_ftp.o | ||
| # SCTP protocol connection tracking | ||
| obj-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o | ||
| # netlink interface for nf_conntrack | ||
| obj-$(CONFIG_NF_CT_NETLINK) += nf_conntrack_netlink.o | ||
| + | ||
| +# connection tracking helpers | ||
| +obj-$(CONFIG_NF_CONNTRACK_FTP) += nf_conntrack_ftp.o | ||
| + | ||
| +# generic X tables | ||
| +obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o | ||
| + | ||
| +# targets | ||
| +obj-$(CONFIG_NETFILTER_XT_TARGET_CLASSIFY) += xt_CLASSIFY.o | ||
| +obj-$(CONFIG_NETFILTER_XT_TARGET_CONNMARK) += xt_CONNMARK.o | ||
| +obj-$(CONFIG_NETFILTER_XT_TARGET_MARK) += xt_MARK.o | ||
| +obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE) += xt_NFQUEUE.o | ||
| +obj-$(CONFIG_NETFILTER_XT_TARGET_NOTRACK) += xt_NOTRACK.o | ||
| + | ||
| +# matches | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_COMMENT) += xt_comment.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_CONNBYTES) += xt_connbytes.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_CONNMARK) += xt_connmark.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_CONNTRACK) += xt_conntrack.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_LENGTH) += xt_length.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_LIMIT) += xt_limit.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_MAC) += xt_mac.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_MARK) += xt_mark.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_STRING) += xt_string.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_TCPMSS) += xt_tcpmss.o | ||
| +obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o |
| @@ -0,0 +1,107 @@ | ||
| +/* iptables module for using new netfilter netlink queue | ||
| + * | ||
| + * (C) 2005 by Harald Welte <laforge@netfilter.org> | ||
| + * | ||
| + * This program is free software; you can redistribute it and/or modify | ||
| + * it under the terms of the GNU General Public License version 2 as | ||
| + * published by the Free Software Foundation. | ||
| + * | ||
| + */ | ||
| + | ||
| +#include <linux/module.h> | ||
| +#include <linux/skbuff.h> | ||
| + | ||
| +#include <linux/netfilter.h> | ||
| +#include <linux/netfilter_arp.h> | ||
| +#include <linux/netfilter/x_tables.h> | ||
| +#include <linux/netfilter/xt_NFQUEUE.h> | ||
| + | ||
| +MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); | ||
| +MODULE_DESCRIPTION("[ip,ip6,arp]_tables NFQUEUE target"); | ||
| +MODULE_LICENSE("GPL"); | ||
| +MODULE_ALIAS("ipt_NFQUEUE"); | ||
| +MODULE_ALIAS("ip6t_NFQUEUE"); | ||
| +MODULE_ALIAS("arpt_NFQUEUE"); | ||
| + | ||
| +static unsigned int | ||
| +target(struct sk_buff **pskb, | ||
| + const struct net_device *in, | ||
| + const struct net_device *out, | ||
| + unsigned int hooknum, | ||
| + const void *targinfo, | ||
| + void *userinfo) | ||
| +{ | ||
| + const struct xt_NFQ_info *tinfo = targinfo; | ||
| + | ||
| + return NF_QUEUE_NR(tinfo->queuenum); | ||
| +} | ||
| + | ||
| +static int | ||
| +checkentry(const char *tablename, | ||
| + const void *entry, | ||
| + void *targinfo, | ||
| + unsigned int targinfosize, | ||
| + unsigned int hook_mask) | ||
| +{ | ||
| + if (targinfosize != XT_ALIGN(sizeof(struct xt_NFQ_info))) { | ||
| + printk(KERN_WARNING "NFQUEUE: targinfosize %u != %Zu\n", | ||
| + targinfosize, | ||
| + XT_ALIGN(sizeof(struct xt_NFQ_info))); | ||
| + return 0; | ||
| + } | ||
| + | ||
| + return 1; | ||
| +} | ||
| + | ||
| +static struct xt_target ipt_NFQ_reg = { | ||
| + .name = "NFQUEUE", | ||
| + .target = target, | ||
| + .checkentry = checkentry, | ||
| + .me = THIS_MODULE, | ||
| +}; | ||
| + | ||
| +static struct xt_target ip6t_NFQ_reg = { | ||
| + .name = "NFQUEUE", | ||
| + .target = target, | ||
| + .checkentry = checkentry, | ||
| + .me = THIS_MODULE, | ||
| +}; | ||
| + | ||
| +static struct xt_target arpt_NFQ_reg = { | ||
| + .name = "NFQUEUE", | ||
| + .target = target, | ||
| + .checkentry = checkentry, | ||
| + .me = THIS_MODULE, | ||
| +}; | ||
| + | ||
| +static int __init init(void) | ||
| +{ | ||
| + int ret; | ||
| + ret = xt_register_target(AF_INET, &ipt_NFQ_reg); | ||
| + if (ret) | ||
| + return ret; | ||
| + ret = xt_register_target(AF_INET6, &ip6t_NFQ_reg); | ||
| + if (ret) | ||
| + goto out_ip; | ||
| + ret = xt_register_target(NF_ARP, &arpt_NFQ_reg); | ||
| + if (ret) | ||
| + goto out_ip6; | ||
| + | ||
| + return ret; | ||
| +out_ip6: | ||
| + xt_unregister_target(AF_INET6, &ip6t_NFQ_reg); | ||
| +out_ip: | ||
| + xt_unregister_target(AF_INET, &ipt_NFQ_reg); | ||
| + | ||
| + return ret; | ||
| +} | ||
| + | ||
| +static void __exit fini(void) | ||
| +{ | ||
| + xt_unregister_target(NF_ARP, &arpt_NFQ_reg); | ||
| + xt_unregister_target(AF_INET6, &ip6t_NFQ_reg); | ||
| + xt_unregister_target(AF_INET, &ipt_NFQ_reg); | ||
| +} | ||
| + | ||
| +module_init(init); | ||
| +module_exit(fini); |
| @@ -0,0 +1,98 @@ | ||
| +/* Kernel module to match packet length. */ | ||
| +/* (C) 1999-2001 James Morris <jmorros@intercode.com.au> | ||
| + * | ||
| + * This program is free software; you can redistribute it and/or modify | ||
| + * it under the terms of the GNU General Public License version 2 as | ||
| + * published by the Free Software Foundation. | ||
| + */ | ||
| + | ||
| +#include <linux/module.h> | ||
| +#include <linux/skbuff.h> | ||
| +#include <net/ip.h> | ||
| + | ||
| +#include <linux/netfilter/xt_length.h> | ||
| +#include <linux/netfilter/x_tables.h> | ||
| + | ||
| +MODULE_AUTHOR("James Morris <jmorris@intercode.com.au>"); | ||
| +MODULE_DESCRIPTION("IP tables packet length matching module"); | ||
| +MODULE_LICENSE("GPL"); | ||
| +MODULE_ALIAS("ipt_length"); | ||
| +MODULE_ALIAS("ip6t_length"); | ||
| + | ||
| +static int | ||
| +match(const struct sk_buff *skb, | ||
| + const struct net_device *in, | ||
| + const struct net_device *out, | ||
| + const void *matchinfo, | ||
| + int offset, | ||
| + unsigned int protoff, | ||
| + int *hotdrop) | ||
| +{ | ||
| + const struct xt_length_info *info = matchinfo; | ||
| + u_int16_t pktlen = ntohs(skb->nh.iph->tot_len); | ||
| + | ||
| + return (pktlen >= info->min && pktlen <= info->max) ^ info->invert; | ||
| +} | ||
| + | ||
| +static int | ||
| +match6(const struct sk_buff *skb, | ||
| + const struct net_device *in, | ||
| + const struct net_device *out, | ||
| + const void *matchinfo, | ||
| + int offset, | ||
| + unsigned int protoff, | ||
| + int *hotdrop) | ||
| +{ | ||
| + const struct xt_length_info *info = matchinfo; | ||
| + u_int16_t pktlen = ntohs(skb->nh.ipv6h->payload_len) + sizeof(struct ipv6hdr); | ||
| + | ||
| + return (pktlen >= info->min && pktlen <= info->max) ^ info->invert; | ||
| +} | ||
| + | ||
| +static int | ||
| +checkentry(const char *tablename, | ||
| + const void *ip, | ||
| + void *matchinfo, | ||
| + unsigned int matchsize, | ||
| + unsigned int hook_mask) | ||
| +{ | ||
| + if (matchsize != XT_ALIGN(sizeof(struct xt_length_info))) | ||
| + return 0; | ||
| + | ||
| + return 1; | ||
| +} | ||
| + | ||
| +static struct xt_match length_match = { | ||
| + .name = "length", | ||
| + .match = &match, | ||
| + .checkentry = &checkentry, | ||
| + .me = THIS_MODULE, | ||
| +}; | ||
| +static struct xt_match length6_match = { | ||
| + .name = "length", | ||
| + .match = &match6, | ||
| + .checkentry = &checkentry, | ||
| + .me = THIS_MODULE, | ||
| +}; | ||
| + | ||
| +static int __init init(void) | ||
| +{ | ||
| + int ret; | ||
| + ret = xt_register_match(AF_INET, &length_match); | ||
| + if (ret) | ||
| + return ret; | ||
| + ret = xt_register_match(AF_INET6, &length6_match); | ||
| + if (ret) | ||
| + xt_unregister_match(AF_INET, &length_match); | ||
| + | ||
| + return ret; | ||
| +} | ||
| + | ||
| +static void __exit fini(void) | ||
| +{ | ||
| + xt_unregister_match(AF_INET, &length_match); | ||
| + xt_unregister_match(AF_INET6, &length6_match); | ||
| +} | ||
| + | ||
| +module_init(init); | ||
| +module_exit(fini); |