1 diff -Nur linux-2.4.32/include/linux/netfilter_ipv4/ipt_string.h linux-2.4.32.patch/include/linux/netfilter_ipv4/ipt_string.h
2 --- linux-2.4.32/include/linux/netfilter_ipv4/ipt_string.h 1970-01-01 01:00:00.000000000 +0100
3 +++ linux-2.4.32.patch/include/linux/netfilter_ipv4/ipt_string.h 2005-12-16 00:40:19.082509250 +0100
8 +#define IPT_STRING_MAX_PATTERN_SIZE 128
9 +#define IPT_STRING_MAX_ALGO_NAME_SIZE 16
11 +struct ipt_string_info
13 + u_int16_t from_offset;
14 + u_int16_t to_offset;
15 + char algo[IPT_STRING_MAX_ALGO_NAME_SIZE];
16 + char pattern[IPT_STRING_MAX_PATTERN_SIZE];
19 + struct ts_config __attribute__((aligned(8))) *config;
22 +#endif /*_IPT_STRING_H*/
23 diff -Nur linux-2.4.32/include/linux/textsearch.h linux-2.4.32.patch/include/linux/textsearch.h
24 --- linux-2.4.32/include/linux/textsearch.h 1970-01-01 01:00:00.000000000 +0100
25 +++ linux-2.4.32.patch/include/linux/textsearch.h 2005-12-16 11:15:34.838073000 +0100
27 +#ifndef __LINUX_TEXTSEARCH_H
28 +#define __LINUX_TEXTSEARCH_H
32 +#include <linux/types.h>
33 +#include <linux/list.h>
34 +#include <linux/kernel.h>
35 +#include <linux/module.h>
36 +#include <linux/slab.h>
39 +#define __bitwise__ __attribute__((bitwise))
43 +#ifdef __CHECK_ENDIAN__
44 +#define __bitwise __bitwise__
49 +typedef __u16 __bitwise __le16;
50 +typedef __u16 __bitwise __be16;
51 +typedef __u32 __bitwise __le32;
52 +typedef __u32 __bitwise __be32;
53 +#if defined(__GNUC__) && !defined(__STRICT_ANSI__)
54 +typedef __u64 __bitwise __le64;
55 +typedef __u64 __bitwise __be64;
59 +typedef unsigned __bitwise__ gfp_t;
65 + * TS_AUTOLOAD - Automatically load textsearch modules when needed
67 +#define TS_AUTOLOAD 1
70 + * struct ts_state - search state
71 + * @offset: offset for next match
72 + * @cb: control buffer, for persistant variables of get_next_block()
76 + unsigned int offset;
81 + * struct ts_ops - search module operations
82 + * @name: name of search algorithm
83 + * @init: initialization function to prepare a search
84 + * @find: find the next occurrence of the pattern
85 + * @destroy: destroy algorithm specific parts of a search configuration
86 + * @get_pattern: return head of pattern
87 + * @get_pattern_len: return length of pattern
88 + * @owner: module reference to algorithm
93 + struct ts_config * (*init)(const void *, unsigned int, gfp_t);
94 + unsigned int (*find)(struct ts_config *,
96 + void (*destroy)(struct ts_config *);
97 + void * (*get_pattern)(struct ts_config *);
98 + unsigned int (*get_pattern_len)(struct ts_config *);
99 + struct module *owner;
100 + struct list_head list;
104 + * struct ts_config - search configuration
105 + * @ops: operations of chosen algorithm
106 + * @get_next_block: callback to fetch the next block to search in
107 + * @finish: callback to finalize a search
111 + struct ts_ops *ops;
114 + * get_next_block - fetch next block of data
115 + * @consumed: number of bytes consumed by the caller
116 + * @dst: destination buffer
117 + * @conf: search configuration
118 + * @state: search state
120 + * Called repeatedly until 0 is returned. Must assign the
121 + * head of the next block of data to &*dst and return the length
122 + * of the block or 0 if at the end. consumed == 0 indicates
123 + * a new search. May store/read persistant values in state->cb.
125 + unsigned int (*get_next_block)(unsigned int consumed,
127 + struct ts_config *conf,
128 + struct ts_state *state);
131 + * finish - finalize/clean a series of get_next_block() calls
132 + * @conf: search configuration
133 + * @state: search state
135 + * Called after the last use of get_next_block(), may be used
136 + * to cleanup any leftovers.
138 + void (*finish)(struct ts_config *conf,
139 + struct ts_state *state);
143 + * textsearch_next - continue searching for a pattern
144 + * @conf: search configuration
145 + * @state: search state
147 + * Continues a search looking for more occurrences of the pattern.
148 + * textsearch_find() must be called to find the first occurrence
149 + * in order to reset the state.
151 + * Returns the position of the next occurrence of the pattern or
152 + * UINT_MAX if not match was found.
154 +static inline unsigned int textsearch_next(struct ts_config *conf,
155 + struct ts_state *state)
157 + unsigned int ret = conf->ops->find(conf, state);
160 + conf->finish(conf, state);
166 + * textsearch_find - start searching for a pattern
167 + * @conf: search configuration
168 + * @state: search state
170 + * Returns the position of first occurrence of the pattern or
171 + * UINT_MAX if no match was found.
173 +static inline unsigned int textsearch_find(struct ts_config *conf,
174 + struct ts_state *state)
177 + return textsearch_next(conf, state);
181 + * textsearch_get_pattern - return head of the pattern
182 + * @conf: search configuration
184 +static inline void *textsearch_get_pattern(struct ts_config *conf)
186 + return conf->ops->get_pattern(conf);
190 + * textsearch_get_pattern_len - return length of the pattern
191 + * @conf: search configuration
193 +static inline unsigned int textsearch_get_pattern_len(struct ts_config *conf)
195 + return conf->ops->get_pattern_len(conf);
198 +extern int textsearch_register(struct ts_ops *);
199 +extern int textsearch_unregister(struct ts_ops *);
200 +extern struct ts_config *textsearch_prepare(const char *, const void *,
201 + unsigned int, gfp_t, int);
202 +extern void textsearch_destroy(struct ts_config *conf);
203 +extern unsigned int textsearch_find_continuous(struct ts_config *,
205 + const void *, unsigned int);
208 +#define TS_PRIV_ALIGNTO 8
209 +#define TS_PRIV_ALIGN(len) (((len) + TS_PRIV_ALIGNTO-1) & ~(TS_PRIV_ALIGNTO-1))
211 +static inline struct ts_config *alloc_ts_config(size_t payload,
214 + struct ts_config *conf;
216 + conf = kmalloc(TS_PRIV_ALIGN(sizeof(*conf)) + payload, gfp_mask);
220 + memset(conf, 0, TS_PRIV_ALIGN(sizeof(*conf)) + payload);
224 +static inline void *ts_config_priv(struct ts_config *conf)
226 + return ((u8 *) conf + TS_PRIV_ALIGN(sizeof(struct ts_config)));
229 +#endif /* __KERNEL__ */
232 diff -Nur linux-2.4.32/net/ipv4/netfilter/Config.in linux-2.4.32.patch/net/ipv4/netfilter/Config.in
233 --- linux-2.4.32/net/ipv4/netfilter/Config.in 2005-01-19 15:10:13.000000000 +0100
234 +++ linux-2.4.32.patch/net/ipv4/netfilter/Config.in 2005-12-16 00:41:43.023755250 +0100
237 if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
238 dep_tristate ' Unclean match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_UNCLEAN $CONFIG_IP_NF_IPTABLES
239 + dep_tristate ' String match support (EXPERIMENTAL) ' CONFIG_IP_NF_MATCH_STRING $CONFIG_IP_NF_IPTABLES
240 dep_tristate ' Owner match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_OWNER $CONFIG_IP_NF_IPTABLES
243 diff -Nur linux-2.4.32/net/ipv4/netfilter/ipt_string.c linux-2.4.32.patch/net/ipv4/netfilter/ipt_string.c
244 --- linux-2.4.32/net/ipv4/netfilter/ipt_string.c 1970-01-01 01:00:00.000000000 +0100
245 +++ linux-2.4.32.patch/net/ipv4/netfilter/ipt_string.c 2005-12-16 00:40:48.436343750 +0100
247 +/* String matching match for iptables
249 + * (C) 2005 Pablo Neira Ayuso <pablo@eurodev.net>
251 + * This program is free software; you can redistribute it and/or modify
252 + * it under the terms of the GNU General Public License version 2 as
253 + * published by the Free Software Foundation.
256 +#include <linux/init.h>
257 +#include <linux/module.h>
258 +#include <linux/kernel.h>
259 +#include <linux/skbuff.h>
260 +#include <linux/netfilter_ipv4/ip_tables.h>
261 +#include <linux/netfilter_ipv4/ipt_string.h>
262 +#include <linux/textsearch.h>
264 +MODULE_AUTHOR("Pablo Neira Ayuso <pablo@eurodev.net>");
265 +MODULE_DESCRIPTION("IP tables string match module");
266 +MODULE_LICENSE("GPL");
268 +static int match(const struct sk_buff *skb,
269 + const struct net_device *in,
270 + const struct net_device *out,
271 + const void *matchinfo,
275 + struct ts_state state;
276 + struct ipt_string_info *conf = (struct ipt_string_info *) matchinfo;
278 + memset(&state, 0, sizeof(struct ts_state));
280 + return (skb_find_text((struct sk_buff *)skb, conf->from_offset,
281 + conf->to_offset, conf->config, &state)
282 + != UINT_MAX) && !conf->invert;
285 +#define STRING_TEXT_PRIV(m) ((struct ipt_string_info *) m)
287 +static int checkentry(const char *tablename,
288 + const struct ipt_ip *ip,
290 + unsigned int matchsize,
291 + unsigned int hook_mask)
293 + struct ipt_string_info *conf = matchinfo;
294 + struct ts_config *ts_conf;
296 + if (matchsize != IPT_ALIGN(sizeof(struct ipt_string_info)))
299 + /* Damn, can't handle this case properly with iptables... */
300 + if (conf->from_offset > conf->to_offset)
303 + ts_conf = textsearch_prepare(conf->algo, conf->pattern, conf->patlen,
304 + GFP_KERNEL, TS_AUTOLOAD);
305 + if (IS_ERR(ts_conf))
308 + conf->config = ts_conf;
313 +static void destroy(void *matchinfo, unsigned int matchsize)
315 + textsearch_destroy(STRING_TEXT_PRIV(matchinfo)->config);
318 +static struct ipt_match string_match = {
321 + .checkentry = checkentry,
322 + .destroy = destroy,
326 +static int __init init(void)
328 + return ipt_register_match(&string_match);
331 +static void __exit fini(void)
333 + ipt_unregister_match(&string_match);
338 diff -Nur linux-2.4.32/net/ipv4/netfilter/Makefile linux-2.4.32.patch/net/ipv4/netfilter/Makefile
339 --- linux-2.4.32/net/ipv4/netfilter/Makefile 2003-08-25 13:44:44.000000000 +0200
340 +++ linux-2.4.32.patch/net/ipv4/netfilter/Makefile 2005-12-16 00:42:10.929499250 +0100
342 obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
343 obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
344 obj-$(CONFIG_IP_NF_MATCH_UNCLEAN) += ipt_unclean.o
345 +obj-$(CONFIG_IP_NF_MATCH_STRING) += ipt_string.o
346 obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o