[package] iptables: add some musl portability fixes
[openwrt/svn-archive/archive.git] / package / network / utils / iptables / patches / 011-recent-add-reap.patch
1 From 20c706d4cba3227c9c44fb61c4d93b0ae84e1464 Mon Sep 17 00:00:00 2001
2 From: Tim Gardner <tim.gardner@canonical.com>
3 Date: Mon, 1 Mar 2010 19:00:29 -0700
4 Subject: [PATCH] xt_recent: Added XT_RECENT_REAP logic and man page documentation
5
6 Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
7 ---
8 extensions/libxt_recent.c | 20 ++++++++++++++++++++
9 extensions/libxt_recent.man | 5 +++++
10 include/linux/netfilter/xt_recent.h | 7 +++++++
11 3 files changed, 32 insertions(+), 0 deletions(-)
12
13 --- a/extensions/libxt_recent.c
14 +++ b/extensions/libxt_recent.c
15 @@ -20,6 +20,7 @@ static const struct option recent_opts[]
16 {.name = "name", .has_arg = true, .val = 208},
17 {.name = "rsource", .has_arg = false, .val = 209},
18 {.name = "rdest", .has_arg = false, .val = 210},
19 + {.name = "reap", .has_arg = false, .val = 211},
20 XT_GETOPT_TABLEEND,
21 };
22
23 @@ -37,6 +38,7 @@ static void recent_help(void)
24 " --hitcount hits For check and update commands above.\n"
25 " Specifies that the match will only occur if source address seen hits times.\n"
26 " May be used in conjunction with the seconds option.\n"
27 +" --reap Remove entries that have expired. Can only be used with --seconds\n"
28 " --rttl For check and update commands above.\n"
29 " Specifies that the match will only occur if the source address and the TTL\n"
30 " match between this packet and the one which was set.\n"
31 @@ -63,6 +65,8 @@ static void recent_init(struct xt_entry_
32 (XT_RECENT_SET | XT_RECENT_CHECK | \
33 XT_RECENT_UPDATE | XT_RECENT_REMOVE)
34
35 +#define XT_RECENT_SECONDS 1 << 31
36 +
37 static int recent_parse(int c, char **argv, int invert, unsigned int *flags,
38 const void *entry, struct xt_entry_match **match)
39 {
40 @@ -104,6 +108,7 @@ static int recent_parse(int c, char **ar
41
42 case 204:
43 info->seconds = atoi(optarg);
44 + *flags |= XT_RECENT_SECONDS;
45 break;
46
47 case 205:
48 @@ -139,6 +144,11 @@ static int recent_parse(int c, char **ar
49 info->side = XT_RECENT_DEST;
50 break;
51
52 + case 211:
53 + info->check_set |= XT_RECENT_REAP;
54 + *flags |= XT_RECENT_REAP;
55 + break;
56 +
57 default:
58 return 0;
59 }
60 @@ -157,6 +167,12 @@ static void recent_check(unsigned int fl
61 xtables_error(PARAMETER_PROBLEM,
62 "recent: --rttl may only be used with --rcheck or "
63 "--update");
64 + if ((flags & XT_RECENT_REAP) &&
65 + ((flags & (XT_RECENT_SET | XT_RECENT_REMOVE)) ||
66 + (!(flags & XT_RECENT_SECONDS))))
67 + xtables_error(PARAMETER_PROBLEM,
68 + "recent: --reap may only be used with --rcheck or "
69 + "--update and --seconds");
70 }
71
72 static void recent_print(const void *ip, const struct xt_entry_match *match,
73 @@ -185,6 +201,8 @@ static void recent_print(const void *ip,
74 printf("side: source ");
75 if (info->side == XT_RECENT_DEST)
76 printf("side: dest ");
77 + if (info->check_set & XT_RECENT_REAP)
78 + printf("reap ");
79 }
80
81 static void recent_save(const void *ip, const struct xt_entry_match *match)
82 @@ -211,6 +229,8 @@ static void recent_save(const void *ip,
83 printf("--rsource ");
84 if (info->side == XT_RECENT_DEST)
85 printf("--rdest ");
86 + if (info->check_set & XT_RECENT_REAP)
87 + printf("--reap ");
88 }
89
90 static struct xtables_match recent_mt_reg = {
91 --- a/extensions/libxt_recent.man
92 +++ b/extensions/libxt_recent.man
93 @@ -41,6 +41,11 @@ This option must be used in conjunction
94 \fB\-\-update\fP. When used, this will narrow the match to only happen when the
95 address is in the list and was seen within the last given number of seconds.
96 .TP
97 +\fB\-\-reap\fP \fIreap\fP
98 +This option must be used in conjunction with \fB\-\-seconds\fP. When used, this
99 +will remove entries with the most recent timestamp older then \fB\-\-seconds\fP
100 +since the last packet was received.
101 +.TP
102 \fB\-\-hitcount\fP \fIhits\fP
103 This option must be used in conjunction with one of \fB\-\-rcheck\fP or
104 \fB\-\-update\fP. When used, this will narrow the match to only happen when the
105 --- a/include/linux/netfilter/xt_recent.h
106 +++ b/include/linux/netfilter/xt_recent.h
107 @@ -23,6 +23,9 @@ enum {
108 #define XT_RECENT_VALID_FLAGS (XT_RECENT_CHECK|XT_RECENT_SET|XT_RECENT_UPDATE|\
109 XT_RECENT_REMOVE|XT_RECENT_TTL|XT_RECENT_REAP)
110
111 +/* Only allowed with --rcheck and --update */
112 +#define XT_RECENT_MODIFIERS (XT_RECENT_TTL|XT_RECENT_REAP)
113 +
114 struct xt_recent_mtinfo {
115 __u32 seconds;
116 __u32 hit_count;