diff options
author | Gabor Juhos <juhosg@openwrt.org> | 2008-04-15 06:11:23 +0000 |
---|---|---|
committer | Gabor Juhos <juhosg@openwrt.org> | 2008-04-15 06:11:23 +0000 |
commit | d80f43d15f4e1fb9c8c45fdafc7f0c8838573047 (patch) | |
tree | a2f4cbd0b328b674326665e96c88fd493ef8dc00 /target/linux/generic-2.6/patches/101-netfilter_layer7_pktmatch.patch | |
parent | ece27874c17a3f84bae9af15399c0d92beb2620e (diff) | |
download | master-31e0f0ae-d80f43d15f4e1fb9c8c45fdafc7f0c8838573047.tar.gz master-31e0f0ae-d80f43d15f4e1fb9c8c45fdafc7f0c8838573047.tar.bz2 master-31e0f0ae-d80f43d15f4e1fb9c8c45fdafc7f0c8838573047.zip |
update iptables to 1.4.0 (2.6 kernels only), refresh kernel patches
SVN-Revision: 10843
Diffstat (limited to 'target/linux/generic-2.6/patches/101-netfilter_layer7_pktmatch.patch')
-rw-r--r-- | target/linux/generic-2.6/patches/101-netfilter_layer7_pktmatch.patch | 83 |
1 files changed, 43 insertions, 40 deletions
diff --git a/target/linux/generic-2.6/patches/101-netfilter_layer7_pktmatch.patch b/target/linux/generic-2.6/patches/101-netfilter_layer7_pktmatch.patch index 966353ad2f..cabffacc14 100644 --- a/target/linux/generic-2.6/patches/101-netfilter_layer7_pktmatch.patch +++ b/target/linux/generic-2.6/patches/101-netfilter_layer7_pktmatch.patch @@ -1,37 +1,37 @@ -Index: linux-2.6.21.5/include/linux/netfilter_ipv4/ipt_layer7.h +Index: linux-2.6.21.7/include/linux/netfilter/xt_layer7.h =================================================================== ---- linux-2.6.21.5.orig/include/linux/netfilter_ipv4/ipt_layer7.h 2007-07-02 00:43:58.271086750 +0200 -+++ linux-2.6.21.5/include/linux/netfilter_ipv4/ipt_layer7.h 2007-07-02 01:36:08.914739750 +0200 -@@ -21,6 +21,7 @@ +--- linux-2.6.21.7.orig/include/linux/netfilter/xt_layer7.h ++++ linux-2.6.21.7/include/linux/netfilter/xt_layer7.h +@@ -8,6 +8,7 @@ struct xt_layer7_info { char protocol[MAX_PROTOCOL_LEN]; - char invert:1; char pattern[MAX_PATTERN_LEN]; -+ char pkt; + u_int8_t invert; ++ u_int8_t pkt; }; - #endif /* _IPT_LAYER7_H */ -Index: linux-2.6.21.5/net/ipv4/netfilter/ipt_layer7.c + #endif /* _XT_LAYER7_H */ +Index: linux-2.6.21.7/net/netfilter/xt_layer7.c =================================================================== ---- linux-2.6.21.5.orig/net/ipv4/netfilter/ipt_layer7.c 2007-07-02 01:27:54.195821750 +0200 -+++ linux-2.6.21.5/net/ipv4/netfilter/ipt_layer7.c 2007-07-02 01:37:01.990056750 +0200 -@@ -299,33 +299,34 @@ - } +--- linux-2.6.21.7.orig/net/netfilter/xt_layer7.c ++++ linux-2.6.21.7/net/netfilter/xt_layer7.c +@@ -297,34 +297,36 @@ static int match_no_append(struct nf_con } --/* add the new app data to the conntrack. Return number of bytes added. */ --static int add_data(struct ip_conntrack * master_conntrack, -- char * app_data, int appdatalen) + /* add the new app data to the conntrack. Return number of bytes added. */ +-static int add_data(struct nf_conn * master_conntrack, +- char * app_data, int appdatalen) +static int add_datastr(char *target, int offset, char *app_data, int len) { int length = 0, i; - int oldlength = master_conntrack->layer7.app_data_len; - -- // This is a fix for a race condition by Deti Fliegl. However, I'm not -- // clear on whether the race condition exists or whether this really -- // fixes it. I might just be being dense... Anyway, if it's not really -- // a fix, all it does is waste a very small amount of time. +- /* This is a fix for a race condition by Deti Fliegl. However, I'm not +- clear on whether the race condition exists or whether this really +- fixes it. I might just be being dense... Anyway, if it's not really +- a fix, all it does is waste a very small amount of time. */ - if(!master_conntrack->layer7.app_data) return 0; -+ if(!target) return 0; ++ ++ if (!target) return 0; /* Strip nulls. Make everything lower case (our regex lib doesn't do case insensitivity). Add it to the end of the current data. */ @@ -39,54 +39,55 @@ Index: linux-2.6.21.5/net/ipv4/netfilter/ipt_layer7.c - i < appdatalen; i++) { + for(i = 0; i < maxdatalen-offset-1 && i < len; i++) { if(app_data[i] != '\0') { + /* the kernel version of tolower mungs 'upper ascii' */ - master_conntrack->layer7.app_data[length+oldlength] = + target[length+offset] = - /* the kernel version of tolower mungs 'upper ascii' */ - isascii(app_data[i])? tolower(app_data[i]) : app_data[i]; + isascii(app_data[i])? + tolower(app_data[i]) : app_data[i]; length++; } } + target[length+offset] = '\0'; ++ ++ return length; ++} - master_conntrack->layer7.app_data[length+oldlength] = '\0'; - master_conntrack->layer7.app_data_len = length + oldlength; -+ return length; -+} -+ +/* add the new app data to the conntrack. Return number of bytes added. */ -+static int add_data(struct ip_conntrack * master_conntrack, -+ char * app_data, int appdatalen) ++static int add_data(struct nf_conn * master_conntrack, ++ char * app_data, int appdatalen) +{ + int length; -+ + + length = add_datastr(master_conntrack->layer7.app_data, master_conntrack->layer7.app_data_len, app_data, appdatalen); + master_conntrack->layer7.app_data_len += length; - return length; } -@@ -343,7 +344,7 @@ + +@@ -411,7 +413,7 @@ match(const struct sk_buff *skbin, + const struct xt_layer7_info * info = matchinfo; enum ip_conntrack_info master_ctinfo, ctinfo; - struct nf_conn *master_conntrack; - struct ip_conntrack *conntrack; + struct nf_conn *master_conntrack, *conntrack; - unsigned char * app_data; + unsigned char *app_data, *tmp_data; unsigned int pattern_result, appdatalen; regexp * comppattern; -@@ -365,8 +366,8 @@ +@@ -439,8 +441,8 @@ match(const struct sk_buff *skbin, master_conntrack = master_ct(master_conntrack); /* if we've classified it or seen too many packets */ - if(TOTAL_PACKETS > num_packets || - master_conntrack->layer7.app_proto) { + if(!info->pkt && (TOTAL_PACKETS > num_packets || -+ master_conntrack->layer7.app_proto)) { - - pattern_result = match_no_append(conntrack, master_conntrack, ctinfo, master_ctinfo, info); ++ master_conntrack->layer7.app_proto)) { -@@ -396,6 +397,23 @@ + pattern_result = match_no_append(conntrack, master_conntrack, + ctinfo, master_ctinfo, info); +@@ -473,6 +475,25 @@ match(const struct sk_buff *skbin, + /* the return value gets checked later, when we're ready to use it */ comppattern = compile_and_cache(info->pattern, info->protocol); - spin_unlock_bh(&list_lock); + if (info->pkt) { + tmp_data = kmalloc(maxdatalen, GFP_ATOMIC); @@ -99,12 +100,14 @@ Index: linux-2.6.21.5/net/ipv4/netfilter/ipt_layer7.c + tmp_data[0] = '\0'; + add_datastr(tmp_data, 0, app_data, appdatalen); + pattern_result = ((comppattern && regexec(comppattern, tmp_data)) ? 1 : 0); ++ + kfree(tmp_data); + tmp_data = NULL; ++ spin_unlock_bh(&l7_lock); + + return (pattern_result ^ info->invert); + } + /* On the first packet of a connection, allocate space for app data */ - write_lock(&ct_lock); - if(TOTAL_PACKETS == 1 && !skb->cb[0] && !master_conntrack->layer7.app_data) { + if(TOTAL_PACKETS == 1 && !skb->cb[0] && + !master_conntrack->layer7.app_data){ |