mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-22 15:02:32 +00:00
backport multiport stuff from 2.6 to 2.4 (disable rev0 support in iptables itself, only use the new stuff)
SVN-Revision: 3125
This commit is contained in:
Felix Fietkau
parent
d60beecb8c
commit
3d42118c52
221
openwrt/package/iptables/patches/04-multiport_v1.patch
Normal file
221
openwrt/package/iptables/patches/04-multiport_v1.patch
Normal file
@ -0,0 +1,221 @@
|
||||
diff -urN iptables.old/extensions/libipt_multiport.c iptables.dev/extensions/libipt_multiport.c
|
||||
--- iptables.old/extensions/libipt_multiport.c 2005-02-19 20:19:17.000000000 +0100
|
||||
+++ iptables.dev/extensions/libipt_multiport.c 2006-02-04 05:46:12.154127750 +0100
|
||||
@@ -8,24 +8,6 @@
|
||||
/* To ensure that iptables compiles with an old kernel */
|
||||
#include "../include/linux/netfilter_ipv4/ipt_multiport.h"
|
||||
|
||||
-/* Function which prints out usage message. */
|
||||
-static void
|
||||
-help(void)
|
||||
-{
|
||||
- printf(
|
||||
-"multiport v%s options:\n"
|
||||
-" --source-ports port[,port,port...]\n"
|
||||
-" --sports ...\n"
|
||||
-" match source port(s)\n"
|
||||
-" --destination-ports port[,port,port...]\n"
|
||||
-" --dports ...\n"
|
||||
-" match destination port(s)\n"
|
||||
-" --ports port[,port,port]\n"
|
||||
-" match both source and destination port(s)\n"
|
||||
-" NOTE: this kernel does not support port ranges in multiport.\n",
|
||||
-IPTABLES_VERSION);
|
||||
-}
|
||||
-
|
||||
static void
|
||||
help_v1(void)
|
||||
{
|
||||
@@ -75,26 +57,6 @@
|
||||
"invalid port/service `%s' specified", port);
|
||||
}
|
||||
|
||||
-static unsigned int
|
||||
-parse_multi_ports(const char *portstring, u_int16_t *ports, const char *proto)
|
||||
-{
|
||||
- char *buffer, *cp, *next;
|
||||
- unsigned int i;
|
||||
-
|
||||
- buffer = strdup(portstring);
|
||||
- if (!buffer) exit_error(OTHER_PROBLEM, "strdup failed");
|
||||
-
|
||||
- for (cp=buffer, i=0; cp && i<IPT_MULTI_PORTS; cp=next,i++)
|
||||
- {
|
||||
- next=strchr(cp, ',');
|
||||
- if (next) *next++='\0';
|
||||
- ports[i] = parse_port(cp, proto);
|
||||
- }
|
||||
- if (cp) exit_error(PARAMETER_PROBLEM, "too many ports specified");
|
||||
- free(buffer);
|
||||
- return i;
|
||||
-}
|
||||
-
|
||||
static void
|
||||
parse_multi_ports_v1(const char *portstring,
|
||||
struct ipt_multiport_v1 *multiinfo,
|
||||
@@ -160,58 +122,6 @@
|
||||
"multiport only works with TCP or UDP");
|
||||
}
|
||||
|
||||
-/* Function which parses command options; returns true if it
|
||||
- ate an option */
|
||||
-static int
|
||||
-parse(int c, char **argv, int invert, unsigned int *flags,
|
||||
- const struct ipt_entry *entry,
|
||||
- unsigned int *nfcache,
|
||||
- struct ipt_entry_match **match)
|
||||
-{
|
||||
- const char *proto;
|
||||
- struct ipt_multiport *multiinfo
|
||||
- = (struct ipt_multiport *)(*match)->data;
|
||||
-
|
||||
- switch (c) {
|
||||
- case '1':
|
||||
- check_inverse(argv[optind-1], &invert, &optind, 0);
|
||||
- proto = check_proto(entry);
|
||||
- multiinfo->count = parse_multi_ports(argv[optind-1],
|
||||
- multiinfo->ports, proto);
|
||||
- multiinfo->flags = IPT_MULTIPORT_SOURCE;
|
||||
- break;
|
||||
-
|
||||
- case '2':
|
||||
- check_inverse(argv[optind-1], &invert, &optind, 0);
|
||||
- proto = check_proto(entry);
|
||||
- multiinfo->count = parse_multi_ports(argv[optind-1],
|
||||
- multiinfo->ports, proto);
|
||||
- multiinfo->flags = IPT_MULTIPORT_DESTINATION;
|
||||
- break;
|
||||
-
|
||||
- case '3':
|
||||
- check_inverse(argv[optind-1], &invert, &optind, 0);
|
||||
- proto = check_proto(entry);
|
||||
- multiinfo->count = parse_multi_ports(argv[optind-1],
|
||||
- multiinfo->ports, proto);
|
||||
- multiinfo->flags = IPT_MULTIPORT_EITHER;
|
||||
- break;
|
||||
-
|
||||
- default:
|
||||
- return 0;
|
||||
- }
|
||||
-
|
||||
- if (invert)
|
||||
- exit_error(PARAMETER_PROBLEM,
|
||||
- "multiport does not support invert");
|
||||
-
|
||||
- if (*flags)
|
||||
- exit_error(PARAMETER_PROBLEM,
|
||||
- "multiport can only have one option");
|
||||
- *flags = 1;
|
||||
- return 1;
|
||||
-}
|
||||
-
|
||||
static int
|
||||
parse_v1(int c, char **argv, int invert, unsigned int *flags,
|
||||
const struct ipt_entry *entry,
|
||||
@@ -289,43 +199,6 @@
|
||||
printf("%s", service);
|
||||
}
|
||||
|
||||
-/* Prints out the matchinfo. */
|
||||
-static void
|
||||
-print(const struct ipt_ip *ip,
|
||||
- const struct ipt_entry_match *match,
|
||||
- int numeric)
|
||||
-{
|
||||
- const struct ipt_multiport *multiinfo
|
||||
- = (const struct ipt_multiport *)match->data;
|
||||
- unsigned int i;
|
||||
-
|
||||
- printf("multiport ");
|
||||
-
|
||||
- switch (multiinfo->flags) {
|
||||
- case IPT_MULTIPORT_SOURCE:
|
||||
- printf("sports ");
|
||||
- break;
|
||||
-
|
||||
- case IPT_MULTIPORT_DESTINATION:
|
||||
- printf("dports ");
|
||||
- break;
|
||||
-
|
||||
- case IPT_MULTIPORT_EITHER:
|
||||
- printf("ports ");
|
||||
- break;
|
||||
-
|
||||
- default:
|
||||
- printf("ERROR ");
|
||||
- break;
|
||||
- }
|
||||
-
|
||||
- for (i=0; i < multiinfo->count; i++) {
|
||||
- printf("%s", i ? "," : "");
|
||||
- print_port(multiinfo->ports[i], ip->proto, numeric);
|
||||
- }
|
||||
- printf(" ");
|
||||
-}
|
||||
-
|
||||
static void
|
||||
print_v1(const struct ipt_ip *ip,
|
||||
const struct ipt_entry_match *match,
|
||||
@@ -369,34 +242,6 @@
|
||||
printf(" ");
|
||||
}
|
||||
|
||||
-/* Saves the union ipt_matchinfo in parsable form to stdout. */
|
||||
-static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
|
||||
-{
|
||||
- const struct ipt_multiport *multiinfo
|
||||
- = (const struct ipt_multiport *)match->data;
|
||||
- unsigned int i;
|
||||
-
|
||||
- switch (multiinfo->flags) {
|
||||
- case IPT_MULTIPORT_SOURCE:
|
||||
- printf("--sports ");
|
||||
- break;
|
||||
-
|
||||
- case IPT_MULTIPORT_DESTINATION:
|
||||
- printf("--dports ");
|
||||
- break;
|
||||
-
|
||||
- case IPT_MULTIPORT_EITHER:
|
||||
- printf("--ports ");
|
||||
- break;
|
||||
- }
|
||||
-
|
||||
- for (i=0; i < multiinfo->count; i++) {
|
||||
- printf("%s", i ? "," : "");
|
||||
- print_port(multiinfo->ports[i], ip->proto, 1);
|
||||
- }
|
||||
- printf(" ");
|
||||
-}
|
||||
-
|
||||
static void save_v1(const struct ipt_ip *ip,
|
||||
const struct ipt_entry_match *match)
|
||||
{
|
||||
@@ -432,19 +277,20 @@
|
||||
printf(" ");
|
||||
}
|
||||
|
||||
+
|
||||
static struct iptables_match multiport = {
|
||||
.next = NULL,
|
||||
.name = "multiport",
|
||||
- .revision = 0,
|
||||
.version = IPTABLES_VERSION,
|
||||
- .size = IPT_ALIGN(sizeof(struct ipt_multiport)),
|
||||
- .userspacesize = IPT_ALIGN(sizeof(struct ipt_multiport)),
|
||||
- .help = &help,
|
||||
+ .revision = 0,
|
||||
+ .size = IPT_ALIGN(sizeof(struct ipt_multiport_v1)),
|
||||
+ .userspacesize = IPT_ALIGN(sizeof(struct ipt_multiport_v1)),
|
||||
+ .help = &help_v1,
|
||||
.init = &init,
|
||||
- .parse = &parse,
|
||||
+ .parse = &parse_v1,
|
||||
.final_check = &final_check,
|
||||
- .print = &print,
|
||||
- .save = &save,
|
||||
+ .print = &print_v1,
|
||||
+ .save = &save_v1,
|
||||
.extra_opts = opts
|
||||
};
|
||||
|
||||
@ -0,0 +1,242 @@
|
||||
diff -urN linux.old/include/linux/netfilter_ipv4/ipt_multiport.h linux.dev/include/linux/netfilter_ipv4/ipt_multiport.h
|
||||
--- linux.old/include/linux/netfilter_ipv4/ipt_multiport.h 2000-12-11 22:31:30.000000000 +0100
|
||||
+++ linux.dev/include/linux/netfilter_ipv4/ipt_multiport.h 2006-02-04 05:05:51.928476750 +0100
|
||||
@@ -18,4 +18,13 @@
|
||||
u_int8_t count; /* Number of ports */
|
||||
u_int16_t ports[IPT_MULTI_PORTS]; /* Ports */
|
||||
};
|
||||
+
|
||||
+struct ipt_multiport_v1
|
||||
+{
|
||||
+ u_int8_t flags; /* Type of comparison */
|
||||
+ u_int8_t count; /* Number of ports */
|
||||
+ u_int16_t ports[IPT_MULTI_PORTS]; /* Ports */
|
||||
+ u_int8_t pflags[IPT_MULTI_PORTS]; /* Port flags */
|
||||
+ u_int8_t invert; /* Invert flag */
|
||||
+};
|
||||
#endif /*_IPT_MULTIPORT_H*/
|
||||
diff -urN linux.old/net/ipv4/netfilter/ipt_multiport.c linux.dev/net/ipv4/netfilter/ipt_multiport.c
|
||||
--- linux.old/net/ipv4/netfilter/ipt_multiport.c 2003-06-13 16:51:39.000000000 +0200
|
||||
+++ linux.dev/net/ipv4/netfilter/ipt_multiport.c 2006-02-04 05:05:03.701462750 +0100
|
||||
@@ -1,5 +1,14 @@
|
||||
/* Kernel module to match one of a list of TCP/UDP ports: ports are in
|
||||
the same place so we can treat them as equal. */
|
||||
+
|
||||
+/* (C) 1999-2001 Paul `Rusty' Russell
|
||||
+ * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
|
||||
+ *
|
||||
+ * This program is free software; you can redistribute it and/or modify
|
||||
+ * it under the terms of the GNU General Public License version 2 as
|
||||
+ * published by the Free Software Foundation.
|
||||
+ */
|
||||
+
|
||||
#include <linux/module.h>
|
||||
#include <linux/types.h>
|
||||
#include <linux/udp.h>
|
||||
@@ -8,6 +17,10 @@
|
||||
#include <linux/netfilter_ipv4/ipt_multiport.h>
|
||||
#include <linux/netfilter_ipv4/ip_tables.h>
|
||||
|
||||
+MODULE_LICENSE("GPL");
|
||||
+MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
|
||||
+MODULE_DESCRIPTION("iptables multiple port match module");
|
||||
+
|
||||
#if 0
|
||||
#define duprintf(format, args...) printk(format , ## args)
|
||||
#else
|
||||
@@ -33,34 +46,109 @@
|
||||
return 0;
|
||||
}
|
||||
|
||||
+/* Returns 1 if the port is matched by the test, 0 otherwise. */
|
||||
+static inline int
|
||||
+ports_match_v1(const struct ipt_multiport_v1 *minfo,
|
||||
+ u_int16_t src, u_int16_t dst)
|
||||
+{
|
||||
+ unsigned int i;
|
||||
+ u_int16_t s, e;
|
||||
+
|
||||
+ for (i=0; i < minfo->count; i++) {
|
||||
+ s = minfo->ports[i];
|
||||
+
|
||||
+ if (minfo->pflags[i]) {
|
||||
+ /* range port matching */
|
||||
+ e = minfo->ports[++i];
|
||||
+ duprintf("src or dst matches with %d-%d?\n", s, e);
|
||||
+
|
||||
+ if (minfo->flags == IPT_MULTIPORT_SOURCE
|
||||
+ && src >= s && src <= e)
|
||||
+ return 1 ^ minfo->invert;
|
||||
+ if (minfo->flags == IPT_MULTIPORT_DESTINATION
|
||||
+ && dst >= s && dst <= e)
|
||||
+ return 1 ^ minfo->invert;
|
||||
+ if (minfo->flags == IPT_MULTIPORT_EITHER
|
||||
+ && ((dst >= s && dst <= e)
|
||||
+ || (src >= s && src <= e)))
|
||||
+ return 1 ^ minfo->invert;
|
||||
+ } else {
|
||||
+ /* exact port matching */
|
||||
+ duprintf("src or dst matches with %d?\n", s);
|
||||
+
|
||||
+ if (minfo->flags == IPT_MULTIPORT_SOURCE
|
||||
+ && src == s)
|
||||
+ return 1 ^ minfo->invert;
|
||||
+ if (minfo->flags == IPT_MULTIPORT_DESTINATION
|
||||
+ && dst == s)
|
||||
+ return 1 ^ minfo->invert;
|
||||
+ if (minfo->flags == IPT_MULTIPORT_EITHER
|
||||
+ && (src == s || dst == s))
|
||||
+ return 1 ^ minfo->invert;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ return minfo->invert;
|
||||
+}
|
||||
+
|
||||
static int
|
||||
match(const struct sk_buff *skb,
|
||||
const struct net_device *in,
|
||||
const struct net_device *out,
|
||||
const void *matchinfo,
|
||||
int offset,
|
||||
- const void *hdr,
|
||||
- u_int16_t datalen,
|
||||
int *hotdrop)
|
||||
{
|
||||
- const struct udphdr *udp = hdr;
|
||||
+ u16 _ports[2], *pptr;
|
||||
const struct ipt_multiport *multiinfo = matchinfo;
|
||||
|
||||
- /* Must be big enough to read ports. */
|
||||
- if (offset == 0 && datalen < sizeof(struct udphdr)) {
|
||||
+ if (offset)
|
||||
+ return 0;
|
||||
+
|
||||
+ pptr = skb_header_pointer(skb, skb->nh.iph->ihl * 4,
|
||||
+ sizeof(_ports), _ports);
|
||||
+ if (pptr == NULL) {
|
||||
/* We've been asked to examine this packet, and we
|
||||
- can't. Hence, no choice but to drop. */
|
||||
- duprintf("ipt_multiport:"
|
||||
- " Dropping evil offset=0 tinygram.\n");
|
||||
- *hotdrop = 1;
|
||||
- return 0;
|
||||
+ * can't. Hence, no choice but to drop.
|
||||
+ */
|
||||
+ duprintf("ipt_multiport:"
|
||||
+ " Dropping evil offset=0 tinygram.\n");
|
||||
+ *hotdrop = 1;
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
- /* Must not be a fragment. */
|
||||
- return !offset
|
||||
- && ports_match(multiinfo->ports,
|
||||
- multiinfo->flags, multiinfo->count,
|
||||
- ntohs(udp->source), ntohs(udp->dest));
|
||||
+ return ports_match(multiinfo->ports,
|
||||
+ multiinfo->flags, multiinfo->count,
|
||||
+ ntohs(pptr[0]), ntohs(pptr[1]));
|
||||
+}
|
||||
+
|
||||
+static int
|
||||
+match_v1(const struct sk_buff *skb,
|
||||
+ const struct net_device *in,
|
||||
+ const struct net_device *out,
|
||||
+ const void *matchinfo,
|
||||
+ int offset,
|
||||
+ int *hotdrop)
|
||||
+{
|
||||
+ u16 _ports[2], *pptr;
|
||||
+ const struct ipt_multiport_v1 *multiinfo = matchinfo;
|
||||
+
|
||||
+ if (offset)
|
||||
+ return 0;
|
||||
+
|
||||
+ pptr = skb_header_pointer(skb, skb->nh.iph->ihl * 4,
|
||||
+ sizeof(_ports), _ports);
|
||||
+ if (pptr == NULL) {
|
||||
+ /* We've been asked to examine this packet, and we
|
||||
+ * can't. Hence, no choice but to drop.
|
||||
+ */
|
||||
+ duprintf("ipt_multiport:"
|
||||
+ " Dropping evil offset=0 tinygram.\n");
|
||||
+ *hotdrop = 1;
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
+ return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));
|
||||
}
|
||||
|
||||
/* Called when user tries to insert an entry of this type. */
|
||||
@@ -71,34 +159,54 @@
|
||||
unsigned int matchsize,
|
||||
unsigned int hook_mask)
|
||||
{
|
||||
- const struct ipt_multiport *multiinfo = matchinfo;
|
||||
-
|
||||
- if (matchsize != IPT_ALIGN(sizeof(struct ipt_multiport)))
|
||||
- return 0;
|
||||
+ return (matchsize == IPT_ALIGN(sizeof(struct ipt_multiport)));
|
||||
+}
|
||||
|
||||
- /* Must specify proto == TCP/UDP, no unknown flags or bad count */
|
||||
- return (ip->proto == IPPROTO_TCP || ip->proto == IPPROTO_UDP)
|
||||
- && !(ip->invflags & IPT_INV_PROTO)
|
||||
- && matchsize == IPT_ALIGN(sizeof(struct ipt_multiport))
|
||||
- && (multiinfo->flags == IPT_MULTIPORT_SOURCE
|
||||
- || multiinfo->flags == IPT_MULTIPORT_DESTINATION
|
||||
- || multiinfo->flags == IPT_MULTIPORT_EITHER)
|
||||
- && multiinfo->count <= IPT_MULTI_PORTS;
|
||||
+static int
|
||||
+checkentry_v1(const char *tablename,
|
||||
+ const struct ipt_ip *ip,
|
||||
+ void *matchinfo,
|
||||
+ unsigned int matchsize,
|
||||
+ unsigned int hook_mask)
|
||||
+{
|
||||
+ return (matchsize == IPT_ALIGN(sizeof(struct ipt_multiport_v1)));
|
||||
}
|
||||
|
||||
-static struct ipt_match multiport_match
|
||||
-= { { NULL, NULL }, "multiport", &match, &checkentry, NULL, THIS_MODULE };
|
||||
+static struct ipt_match multiport_match = {
|
||||
+ .name = "multiport",
|
||||
+ .revision = 0,
|
||||
+ .match = &match,
|
||||
+ .checkentry = &checkentry,
|
||||
+ .me = THIS_MODULE,
|
||||
+};
|
||||
+
|
||||
+static struct ipt_match multiport_match_v1 = {
|
||||
+ .name = "multiport",
|
||||
+ .revision = 1,
|
||||
+ .match = &match_v1,
|
||||
+ .checkentry = &checkentry_v1,
|
||||
+ .me = THIS_MODULE,
|
||||
+};
|
||||
|
||||
static int __init init(void)
|
||||
{
|
||||
- return ipt_register_match(&multiport_match);
|
||||
+ int err;
|
||||
+
|
||||
+ err = ipt_register_match(&multiport_match);
|
||||
+ if (!err) {
|
||||
+ err = ipt_register_match(&multiport_match_v1);
|
||||
+ if (err)
|
||||
+ ipt_unregister_match(&multiport_match);
|
||||
+ }
|
||||
+
|
||||
+ return err;
|
||||
}
|
||||
|
||||
static void __exit fini(void)
|
||||
{
|
||||
ipt_unregister_match(&multiport_match);
|
||||
+ ipt_unregister_match(&multiport_match_v1);
|
||||
}
|
||||
|
||||
module_init(init);
|
||||
module_exit(fini);
|
||||
-MODULE_LICENSE("GPL");
|
||||
Loading…
Reference in New Issue
Block a user