finally move buildroot-ng to trunk
[openwrt/staging/dedeckeh.git] / target / linux / generic-2.4 / patches / 607-netfilter_connmark.patch
1 diff -urN linux.old/include/linux/netfilter_ipv4/ip_conntrack.h linux.dev/include/linux/netfilter_ipv4/ip_conntrack.h
2 --- linux.old/include/linux/netfilter_ipv4/ip_conntrack.h 2005-08-20 20:02:06.619827000 +0200
3 +++ linux.dev/include/linux/netfilter_ipv4/ip_conntrack.h 2005-08-20 20:19:23.302029232 +0200
4 @@ -226,6 +226,9 @@
5 unsigned int app_data_len;
6 } layer7;
7 #endif
8 +#if defined(CONFIG_IP_NF_CONNTRACK_MARK)
9 + unsigned long mark;
10 +#endif
11 };
12
13 /* get master conntrack via master expectation */
14 diff -urN linux.old/include/linux/netfilter_ipv4/ipt_CONNMARK.h linux.dev/include/linux/netfilter_ipv4/ipt_CONNMARK.h
15 --- linux.old/include/linux/netfilter_ipv4/ipt_CONNMARK.h 1970-01-01 01:00:00.000000000 +0100
16 +++ linux.dev/include/linux/netfilter_ipv4/ipt_CONNMARK.h 2005-08-20 20:19:41.058329864 +0200
17 @@ -0,0 +1,25 @@
18 +#ifndef _IPT_CONNMARK_H_target
19 +#define _IPT_CONNMARK_H_target
20 +
21 +/* Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
22 + * by Henrik Nordstrom <hno@marasystems.com>
23 + *
24 + * This program is free software; you can redistribute it and/or modify
25 + * it under the terms of the GNU General Public License as published by
26 + * the Free Software Foundation; either version 2 of the License, or
27 + * (at your option) any later version.
28 + */
29 +
30 +enum {
31 + IPT_CONNMARK_SET = 0,
32 + IPT_CONNMARK_SAVE,
33 + IPT_CONNMARK_RESTORE
34 +};
35 +
36 +struct ipt_connmark_target_info {
37 + unsigned long mark;
38 + unsigned long mask;
39 + u_int8_t mode;
40 +};
41 +
42 +#endif /*_IPT_CONNMARK_H_target*/
43 diff -urN linux.old/include/linux/netfilter_ipv4/ipt_connmark.h linux.dev/include/linux/netfilter_ipv4/ipt_connmark.h
44 --- linux.old/include/linux/netfilter_ipv4/ipt_connmark.h 1970-01-01 01:00:00.000000000 +0100
45 +++ linux.dev/include/linux/netfilter_ipv4/ipt_connmark.h 2005-08-20 20:19:41.058329864 +0200
46 @@ -0,0 +1,18 @@
47 +#ifndef _IPT_CONNMARK_H
48 +#define _IPT_CONNMARK_H
49 +
50 +/* Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
51 + * by Henrik Nordstrom <hno@marasystems.com>
52 + *
53 + * This program is free software; you can redistribute it and/or modify
54 + * it under the terms of the GNU General Public License as published by
55 + * the Free Software Foundation; either version 2 of the License, or
56 + * (at your option) any later version.
57 + */
58 +
59 +struct ipt_connmark_info {
60 + unsigned long mark, mask;
61 + u_int8_t invert;
62 +};
63 +
64 +#endif /*_IPT_CONNMARK_H*/
65 diff -urN linux.old/net/ipv4/netfilter/Config.in linux.dev/net/ipv4/netfilter/Config.in
66 --- linux.old/net/ipv4/netfilter/Config.in 2005-08-20 20:02:09.325416000 +0200
67 +++ linux.dev/net/ipv4/netfilter/Config.in 2005-08-20 20:29:11.546602464 +0200
68 @@ -6,7 +6,8 @@
69
70 tristate 'Connection tracking (required for masq/NAT)' CONFIG_IP_NF_CONNTRACK
71 if [ "$CONFIG_IP_NF_CONNTRACK" != "n" ]; then
72 - dep_tristate ' FTP protocol support' CONFIG_IP_NF_FTP $CONFIG_IP_NF_CONNTRACK
73 + bool ' Connection mark tracking support' CONFIG_IP_NF_CONNTRACK_MARK
74 + dep_tristate ' FTP protocol support' CONFIG_IP_NF_FTP $CONFIG_IP_NF_CONNTRACKa
75 dep_tristate ' Amanda protocol support' CONFIG_IP_NF_AMANDA $CONFIG_IP_NF_CONNTRACK
76 dep_tristate ' TFTP protocol support' CONFIG_IP_NF_TFTP $CONFIG_IP_NF_CONNTRACK
77 dep_tristate ' IRC protocol support' CONFIG_IP_NF_IRC $CONFIG_IP_NF_CONNTRACK
78 @@ -42,6 +43,9 @@
79 if [ "$CONFIG_IP_NF_CONNTRACK" != "n" ]; then
80 dep_tristate ' Connection state match support' CONFIG_IP_NF_MATCH_STATE $CONFIG_IP_NF_CONNTRACK $CONFIG_IP_NF_IPTABLES
81 dep_tristate ' Connection tracking match support' CONFIG_IP_NF_MATCH_CONNTRACK $CONFIG_IP_NF_CONNTRACK $CONFIG_IP_NF_IPTABLES
82 + if [ "$CONFIG_IP_NF_CONNTRACK_MARK" != "n" ]; then
83 + dep_tristate ' Connection mark match support' CONFIG_IP_NF_MATCH_CONNMARK $CONFIG_IP_NF_IPTABLES
84 + fi
85 fi
86 if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
87 dep_tristate ' Unclean match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_UNCLEAN $CONFIG_IP_NF_IPTABLES
88 @@ -125,6 +129,9 @@
89
90 dep_tristate ' MARK target support' CONFIG_IP_NF_TARGET_MARK $CONFIG_IP_NF_MANGLE
91 fi
92 + if [ "$CONFIG_IP_NF_CONNTRACK_MARK" != "n" ]; then
93 + dep_tristate ' CONNMARK target support' CONFIG_IP_NF_TARGET_CONNMARK $CONFIG_IP_NF_IPTABLES
94 + fi
95 dep_tristate ' LOG target support' CONFIG_IP_NF_TARGET_LOG $CONFIG_IP_NF_IPTABLES
96 dep_tristate ' TTL target support' CONFIG_IP_NF_TARGET_TTL $CONFIG_IP_NF_IPTABLES
97 dep_tristate ' ULOG target support' CONFIG_IP_NF_TARGET_ULOG $CONFIG_IP_NF_IPTABLES
98 diff -urN linux.old/net/ipv4/netfilter/Makefile linux.dev/net/ipv4/netfilter/Makefile
99 --- linux.old/net/ipv4/netfilter/Makefile 2005-08-20 20:02:09.326416000 +0200
100 +++ linux.dev/net/ipv4/netfilter/Makefile 2005-08-20 20:29:54.081136232 +0200
101 @@ -93,6 +93,7 @@
102
103 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
104 obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
105 +obj-$(CONFIG_IP_NF_MATCH_CONNMARK) += ipt_connmark.o
106 obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
107 obj-$(CONFIG_IP_NF_MATCH_UNCLEAN) += ipt_unclean.o
108 obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
109 @@ -110,6 +111,7 @@
110 obj-$(CONFIG_IP_NF_TARGET_REDIRECT) += ipt_REDIRECT.o
111 obj-$(CONFIG_IP_NF_NAT_SNMP_BASIC) += ip_nat_snmp_basic.o
112 obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
113 +obj-$(CONFIG_IP_NF_TARGET_CONNMARK) += ipt_CONNMARK.o
114 obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
115 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
116 obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
117 diff -urN linux.old/net/ipv4/netfilter/ip_conntrack_core.c linux.dev/net/ipv4/netfilter/ip_conntrack_core.c
118 --- linux.old/net/ipv4/netfilter/ip_conntrack_core.c 2005-08-20 20:02:06.828795000 +0200
119 +++ linux.dev/net/ipv4/netfilter/ip_conntrack_core.c 2005-08-20 20:33:23.308328864 +0200
120 @@ -755,6 +755,9 @@
121 __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
122 conntrack->master = expected;
123 expected->sibling = conntrack;
124 +#ifdef CONFIG_IP_NF_CONNTRACK_MARK
125 + conntrack->mark = expected->expectant->mark;
126 +#endif
127 LIST_DELETE(&ip_conntrack_expect_list, expected);
128 expected->expectant->expecting--;
129 nf_conntrack_get(&master_ct(conntrack)->infos[0]);
130 diff -urN linux.old/net/ipv4/netfilter/ip_conntrack_standalone.c linux.dev/net/ipv4/netfilter/ip_conntrack_standalone.c
131 --- linux.old/net/ipv4/netfilter/ip_conntrack_standalone.c 2005-08-20 20:02:06.583833000 +0200
132 +++ linux.dev/net/ipv4/netfilter/ip_conntrack_standalone.c 2005-08-20 20:32:15.364657872 +0200
133 @@ -107,6 +107,9 @@
134 len += sprintf(buffer + len, "[ASSURED] ");
135 len += sprintf(buffer + len, "use=%u ",
136 atomic_read(&conntrack->ct_general.use));
137 + #if defined(CONFIG_IP_NF_CONNTRACK_MARK)
138 + len += sprintf(buffer + len, "mark=%ld ", conntrack->mark);
139 + #endif
140
141 #if defined(CONFIG_IP_NF_MATCH_LAYER7) || defined(CONFIG_IP_NF_MATCH_LAYER7_MODULE)
142 if(conntrack->layer7.app_proto)
143 diff -urN linux.old/net/ipv4/netfilter/ipt_CONNMARK.c linux.dev/net/ipv4/netfilter/ipt_CONNMARK.c
144 --- linux.old/net/ipv4/netfilter/ipt_CONNMARK.c 1970-01-01 01:00:00.000000000 +0100
145 +++ linux.dev/net/ipv4/netfilter/ipt_CONNMARK.c 2005-08-20 20:21:28.666970864 +0200
146 @@ -0,0 +1,118 @@
147 +/* This kernel module is used to modify the connection mark values, or
148 + * to optionally restore the skb nfmark from the connection mark
149 + *
150 + * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
151 + * by Henrik Nordstrom <hno@marasystems.com>
152 + *
153 + * This program is free software; you can redistribute it and/or modify
154 + * it under the terms of the GNU General Public License as published by
155 + * the Free Software Foundation; either version 2 of the License, or
156 + * (at your option) any later version.
157 + *
158 + * This program is distributed in the hope that it will be useful,
159 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
160 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
161 + * GNU General Public License for more details.
162 + *
163 + * You should have received a copy of the GNU General Public License
164 + * along with this program; if not, write to the Free Software
165 + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
166 + */
167 +#include <linux/module.h>
168 +#include <linux/skbuff.h>
169 +#include <linux/ip.h>
170 +#include <net/checksum.h>
171 +
172 +MODULE_AUTHOR("Henrik Nordstrom <hno@marasytems.com>");
173 +MODULE_DESCRIPTION("IP tables CONNMARK matching module");
174 +MODULE_LICENSE("GPL");
175 +
176 +#include <linux/netfilter_ipv4/ip_tables.h>
177 +#include <linux/netfilter_ipv4/ipt_CONNMARK.h>
178 +#include <linux/netfilter_ipv4/ip_conntrack.h>
179 +
180 +static unsigned int
181 +target(struct sk_buff **pskb,
182 + unsigned int hooknum,
183 + const struct net_device *in,
184 + const struct net_device *out,
185 + const void *targinfo,
186 + void *userinfo)
187 +{
188 + const struct ipt_connmark_target_info *markinfo = targinfo;
189 + unsigned long diff;
190 + unsigned long nfmark;
191 + unsigned long newmark;
192 +
193 + enum ip_conntrack_info ctinfo;
194 + struct ip_conntrack *ct = ip_conntrack_get((*pskb), &ctinfo);
195 + if (ct) {
196 + switch(markinfo->mode) {
197 + case IPT_CONNMARK_SET:
198 + newmark = (ct->mark & ~markinfo->mask) | markinfo->mark;
199 + if (newmark != ct->mark)
200 + ct->mark = newmark;
201 + break;
202 + case IPT_CONNMARK_SAVE:
203 + newmark = (ct->mark & ~markinfo->mask) | ((*pskb)->nfmark & markinfo->mask);
204 + if (ct->mark != newmark)
205 + ct->mark = newmark;
206 + break;
207 + case IPT_CONNMARK_RESTORE:
208 + nfmark = (*pskb)->nfmark;
209 + diff = (ct->mark ^ nfmark & markinfo->mask);
210 + if (diff != 0) {
211 + (*pskb)->nfmark = nfmark ^ diff;
212 + (*pskb)->nfcache |= NFC_ALTERED;
213 + }
214 + break;
215 + }
216 + }
217 +
218 + return IPT_CONTINUE;
219 +}
220 +
221 +static int
222 +checkentry(const char *tablename,
223 + const struct ipt_entry *e,
224 + void *targinfo,
225 + unsigned int targinfosize,
226 + unsigned int hook_mask)
227 +{
228 + struct ipt_connmark_target_info *matchinfo = targinfo;
229 + if (targinfosize != IPT_ALIGN(sizeof(struct ipt_connmark_target_info))) {
230 + printk(KERN_WARNING "CONNMARK: targinfosize %u != %Zu\n",
231 + targinfosize,
232 + IPT_ALIGN(sizeof(struct ipt_connmark_target_info)));
233 + return 0;
234 + }
235 +
236 + if (matchinfo->mode == IPT_CONNMARK_RESTORE) {
237 + if (strcmp(tablename, "mangle") != 0) {
238 + printk(KERN_WARNING "CONNMARK: restore can only be called from \"mangle\" table, not \"%s\"\n", tablename);
239 + return 0;
240 + }
241 + }
242 +
243 + return 1;
244 +}
245 +
246 +static struct ipt_target ipt_connmark_reg = {
247 + .name = "CONNMARK",
248 + .target = &target,
249 + .checkentry = &checkentry,
250 + .me = THIS_MODULE
251 +};
252 +
253 +static int __init init(void)
254 +{
255 + return ipt_register_target(&ipt_connmark_reg);
256 +}
257 +
258 +static void __exit fini(void)
259 +{
260 + ipt_unregister_target(&ipt_connmark_reg);
261 +}
262 +
263 +module_init(init);
264 +module_exit(fini);
265 diff -urN linux.old/net/ipv4/netfilter/ipt_connmark.c linux.dev/net/ipv4/netfilter/ipt_connmark.c
266 --- linux.old/net/ipv4/netfilter/ipt_connmark.c 1970-01-01 01:00:00.000000000 +0100
267 +++ linux.dev/net/ipv4/netfilter/ipt_connmark.c 2005-08-20 20:21:28.666970864 +0200
268 @@ -0,0 +1,83 @@
269 +/* This kernel module matches connection mark values set by the
270 + * CONNMARK target
271 + *
272 + * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
273 + * by Henrik Nordstrom <hno@marasystems.com>
274 + *
275 + * This program is free software; you can redistribute it and/or modify
276 + * it under the terms of the GNU General Public License as published by
277 + * the Free Software Foundation; either version 2 of the License, or
278 + * (at your option) any later version.
279 + *
280 + * This program is distributed in the hope that it will be useful,
281 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
282 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
283 + * GNU General Public License for more details.
284 + *
285 + * You should have received a copy of the GNU General Public License
286 + * along with this program; if not, write to the Free Software
287 + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
288 + */
289 +
290 +#include <linux/module.h>
291 +#include <linux/skbuff.h>
292 +
293 +MODULE_AUTHOR("Henrik Nordstrom <hno@marasytems.com>");
294 +MODULE_DESCRIPTION("IP tables connmark match module");
295 +MODULE_LICENSE("GPL");
296 +
297 +#include <linux/netfilter_ipv4/ip_tables.h>
298 +#include <linux/netfilter_ipv4/ipt_connmark.h>
299 +#include <linux/netfilter_ipv4/ip_conntrack.h>
300 +
301 +static int
302 +match(const struct sk_buff *skb,
303 + const struct net_device *in,
304 + const struct net_device *out,
305 + const void *matchinfo,
306 + int offset,
307 + const void *hdr,
308 + u_int16_t datalen,
309 + int *hotdrop)
310 +{
311 + const struct ipt_connmark_info *info = matchinfo;
312 + enum ip_conntrack_info ctinfo;
313 + struct ip_conntrack *ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
314 + if (!ct)
315 + return 0;
316 +
317 + return ((ct->mark & info->mask) == info->mark) ^ info->invert;
318 +}
319 +
320 +static int
321 +checkentry(const char *tablename,
322 + const struct ipt_ip *ip,
323 + void *matchinfo,
324 + unsigned int matchsize,
325 + unsigned int hook_mask)
326 +{
327 + if (matchsize != IPT_ALIGN(sizeof(struct ipt_connmark_info)))
328 + return 0;
329 +
330 + return 1;
331 +}
332 +
333 +static struct ipt_match connmark_match = {
334 + .name = "connmark",
335 + .match = &match,
336 + .checkentry = &checkentry,
337 + .me = THIS_MODULE
338 +};
339 +
340 +static int __init init(void)
341 +{
342 + return ipt_register_match(&connmark_match);
343 +}
344 +
345 +static void __exit fini(void)
346 +{
347 + ipt_unregister_match(&connmark_match);
348 +}
349 +
350 +module_init(init);
351 +module_exit(fini);