From a58eaf210a223672f67c03d2070fa2fefdb2595b Mon Sep 17 00:00:00 2001 From: juhosg Date: Tue, 15 Apr 2008 06:11:23 +0000 Subject: update iptables to 1.4.0 (2.6 kernels only), refresh kernel patches git-svn-id: svn://svn.openwrt.org/openwrt/trunk@10843 3c298f89-4303-0410-b956-a3cf2f4a3e73 --- .../101-netfilter_layer7_pktmatch.patch | 68 ++++++++++++---------- 1 file changed, 36 insertions(+), 32 deletions(-) (limited to 'target/linux/generic-2.6/patches-2.6.22/101-netfilter_layer7_pktmatch.patch') diff --git a/target/linux/generic-2.6/patches-2.6.22/101-netfilter_layer7_pktmatch.patch b/target/linux/generic-2.6/patches-2.6.22/101-netfilter_layer7_pktmatch.patch index 5ac30a7c2..8f2456ffe 100644 --- a/target/linux/generic-2.6/patches-2.6.22/101-netfilter_layer7_pktmatch.patch +++ b/target/linux/generic-2.6/patches-2.6.22/101-netfilter_layer7_pktmatch.patch @@ -1,36 +1,37 @@ -Index: linux-2.6.22-rc6/include/linux/netfilter_ipv4/ipt_layer7.h +Index: linux-2.6.22.18/include/linux/netfilter/xt_layer7.h =================================================================== ---- linux-2.6.22-rc6.orig/include/linux/netfilter_ipv4/ipt_layer7.h 2007-07-02 03:23:28.597194750 +0200 -+++ linux-2.6.22-rc6/include/linux/netfilter_ipv4/ipt_layer7.h 2007-07-02 03:23:44.730203000 +0200 -@@ -21,6 +21,7 @@ +--- linux-2.6.22.18.orig/include/linux/netfilter/xt_layer7.h ++++ linux-2.6.22.18/include/linux/netfilter/xt_layer7.h +@@ -8,6 +8,7 @@ struct xt_layer7_info { char protocol[MAX_PROTOCOL_LEN]; - char invert:1; char pattern[MAX_PATTERN_LEN]; -+ char pkt; + u_int8_t invert; ++ u_int8_t pkt; }; - #endif /* _IPT_LAYER7_H */ -Index: linux-2.6.22-rc6/net/ipv4/netfilter/ipt_layer7.c + #endif /* _XT_LAYER7_H */ +Index: linux-2.6.22.18/net/netfilter/xt_layer7.c =================================================================== ---- linux-2.6.22-rc6.orig/net/ipv4/netfilter/ipt_layer7.c 2007-07-02 03:23:28.609195500 +0200 -+++ linux-2.6.22-rc6/net/ipv4/netfilter/ipt_layer7.c 2007-07-02 03:23:54.234797000 +0200 -@@ -300,33 +300,34 @@ +--- linux-2.6.22.18.orig/net/netfilter/xt_layer7.c ++++ linux-2.6.22.18/net/netfilter/xt_layer7.c +@@ -297,34 +297,36 @@ static int match_no_append(struct nf_con } /* add the new app data to the conntrack. Return number of bytes added. */ -static int add_data(struct nf_conn * master_conntrack, -- char * app_data, int appdatalen) +- char * app_data, int appdatalen) +static int add_datastr(char *target, int offset, char *app_data, int len) { int length = 0, i; - int oldlength = master_conntrack->layer7.app_data_len; - -- // This is a fix for a race condition by Deti Fliegl. However, I'm not -- // clear on whether the race condition exists or whether this really -- // fixes it. I might just be being dense... Anyway, if it's not really -- // a fix, all it does is waste a very small amount of time. +- /* This is a fix for a race condition by Deti Fliegl. However, I'm not +- clear on whether the race condition exists or whether this really +- fixes it. I might just be being dense... Anyway, if it's not really +- a fix, all it does is waste a very small amount of time. */ - if(!master_conntrack->layer7.app_data) return 0; -+ if(!target) return 0; ++ ++ if (!target) return 0; /* Strip nulls. Make everything lower case (our regex lib doesn't do case insensitivity). Add it to the end of the current data. */ @@ -38,15 +39,16 @@ Index: linux-2.6.22-rc6/net/ipv4/netfilter/ipt_layer7.c - i < appdatalen; i++) { + for(i = 0; i < maxdatalen-offset-1 && i < len; i++) { if(app_data[i] != '\0') { + /* the kernel version of tolower mungs 'upper ascii' */ - master_conntrack->layer7.app_data[length+oldlength] = + target[length+offset] = - /* the kernel version of tolower mungs 'upper ascii' */ - isascii(app_data[i])? tolower(app_data[i]) : app_data[i]; + isascii(app_data[i])? + tolower(app_data[i]) : app_data[i]; length++; } } + target[length+offset] = '\0'; -+ ++ + return length; +} @@ -54,7 +56,7 @@ Index: linux-2.6.22-rc6/net/ipv4/netfilter/ipt_layer7.c - master_conntrack->layer7.app_data_len = length + oldlength; +/* add the new app data to the conntrack. Return number of bytes added. */ +static int add_data(struct nf_conn * master_conntrack, -+ char * app_data, int appdatalen) ++ char * app_data, int appdatalen) +{ + int length; @@ -63,29 +65,29 @@ Index: linux-2.6.22-rc6/net/ipv4/netfilter/ipt_layer7.c return length; } -@@ -343,7 +344,7 @@ +@@ -411,7 +413,7 @@ match(const struct sk_buff *skbin, + const struct xt_layer7_info * info = matchinfo; enum ip_conntrack_info master_ctinfo, ctinfo; - struct nf_conn *master_conntrack; - struct nf_conn *conntrack; + struct nf_conn *master_conntrack, *conntrack; - unsigned char * app_data; + unsigned char *app_data, *tmp_data; unsigned int pattern_result, appdatalen; regexp * comppattern; -@@ -365,8 +366,8 @@ +@@ -439,8 +441,8 @@ match(const struct sk_buff *skbin, master_conntrack = master_ct(master_conntrack); /* if we've classified it or seen too many packets */ - if(TOTAL_PACKETS > num_packets || - master_conntrack->layer7.app_proto) { + if(!info->pkt && (TOTAL_PACKETS > num_packets || -+ master_conntrack->layer7.app_proto)) { - - pattern_result = match_no_append(conntrack, master_conntrack, ctinfo, master_ctinfo, info); ++ master_conntrack->layer7.app_proto)) { -@@ -396,6 +397,23 @@ + pattern_result = match_no_append(conntrack, master_conntrack, + ctinfo, master_ctinfo, info); +@@ -473,6 +475,25 @@ match(const struct sk_buff *skbin, + /* the return value gets checked later, when we're ready to use it */ comppattern = compile_and_cache(info->pattern, info->protocol); - spin_unlock_bh(&list_lock); + if (info->pkt) { + tmp_data = kmalloc(maxdatalen, GFP_ATOMIC); @@ -98,12 +100,14 @@ Index: linux-2.6.22-rc6/net/ipv4/netfilter/ipt_layer7.c + tmp_data[0] = '\0'; + add_datastr(tmp_data, 0, app_data, appdatalen); + pattern_result = ((comppattern && regexec(comppattern, tmp_data)) ? 1 : 0); ++ + kfree(tmp_data); + tmp_data = NULL; ++ spin_unlock_bh(&l7_lock); + + return (pattern_result ^ info->invert); + } + /* On the first packet of a connection, allocate space for app data */ - write_lock(&ct_lock); - if(TOTAL_PACKETS == 1 && !skb->cb[0] && !master_conntrack->layer7.app_data) { + if(TOTAL_PACKETS == 1 && !skb->cb[0] && + !master_conntrack->layer7.app_data){ -- cgit v1.2.3