backport multiport stuff from 2.6 to 2.4 (disable rev0 support in iptables itself, only use the new stuff)

SVN-Revision: 3125

1 files changed, 242 insertions, 0 deletions

diff --git a/openwrt/target/linux/generic-2.4/patches/619-nefilter_multiport_backport.patch b/openwrt/target/linux/generic-2.4/patches/619-nefilter_multiport_backport.patch
new file mode 100644
index 0000000..de6ca1c
--- /dev/null
+++ b/openwrt/target/linux/generic-2.4/patches/619-nefilter_multiport_backport.patch
@@ -0,0 +1,242 @@
+diff -urN linux.old/include/linux/netfilter_ipv4/ipt_multiport.h linux.dev/include/linux/netfilter_ipv4/ipt_multiport.h
+--- linux.old/include/linux/netfilter_ipv4/ipt_multiport.h	2000-12-11 22:31:30.000000000 +0100
++++ linux.dev/include/linux/netfilter_ipv4/ipt_multiport.h	2006-02-04 05:05:51.928476750 +0100
+@@ -18,4 +18,13 @@
+ 	u_int8_t count;				/* Number of ports */
+ 	u_int16_t ports[IPT_MULTI_PORTS];	/* Ports */
+ };
++
++struct ipt_multiport_v1
++{
++	u_int8_t flags;				/* Type of comparison */
++	u_int8_t count;				/* Number of ports */
++	u_int16_t ports[IPT_MULTI_PORTS];	/* Ports */
++	u_int8_t pflags[IPT_MULTI_PORTS];	/* Port flags */
++	u_int8_t invert;			/* Invert flag */
++};
+ #endif /*_IPT_MULTIPORT_H*/
+diff -urN linux.old/net/ipv4/netfilter/ipt_multiport.c linux.dev/net/ipv4/netfilter/ipt_multiport.c
+--- linux.old/net/ipv4/netfilter/ipt_multiport.c	2003-06-13 16:51:39.000000000 +0200
++++ linux.dev/net/ipv4/netfilter/ipt_multiport.c	2006-02-04 05:05:03.701462750 +0100
+@@ -1,5 +1,14 @@
+ /* Kernel module to match one of a list of TCP/UDP ports: ports are in
+    the same place so we can treat them as equal. */
++
++/* (C) 1999-2001 Paul `Rusty' Russell
++ * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
+ #include <linux/module.h>
+ #include <linux/types.h>
+ #include <linux/udp.h>
+@@ -8,6 +17,10 @@
+ #include <linux/netfilter_ipv4/ipt_multiport.h>
+ #include <linux/netfilter_ipv4/ip_tables.h>
+ 
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
++MODULE_DESCRIPTION("iptables multiple port match module");
++
+ #if 0
+ #define duprintf(format, args...) printk(format , ## args)
+ #else
+@@ -33,34 +46,109 @@
+ 	return 0;
+ }
+ 
++/* Returns 1 if the port is matched by the test, 0 otherwise. */
++static inline int
++ports_match_v1(const struct ipt_multiport_v1 *minfo,
++	       u_int16_t src, u_int16_t dst)
++{
++	unsigned int i;
++	u_int16_t s, e;
++
++	for (i=0; i < minfo->count; i++) {
++		s = minfo->ports[i];
++
++		if (minfo->pflags[i]) {
++			/* range port matching */
++			e = minfo->ports[++i];
++			duprintf("src or dst matches with %d-%d?\n", s, e);
++
++			if (minfo->flags == IPT_MULTIPORT_SOURCE
++			    && src >= s && src <= e)
++				return 1 ^ minfo->invert;
++			if (minfo->flags == IPT_MULTIPORT_DESTINATION
++			    && dst >= s && dst <= e)
++				return 1 ^ minfo->invert;
++			if (minfo->flags == IPT_MULTIPORT_EITHER
++			    && ((dst >= s && dst <= e)
++				|| (src >= s && src <= e)))
++				return 1 ^ minfo->invert;
++		} else {
++			/* exact port matching */
++			duprintf("src or dst matches with %d?\n", s);
++
++			if (minfo->flags == IPT_MULTIPORT_SOURCE
++			    && src == s)
++				return 1 ^ minfo->invert;
++			if (minfo->flags == IPT_MULTIPORT_DESTINATION
++			    && dst == s)
++				return 1 ^ minfo->invert;
++			if (minfo->flags == IPT_MULTIPORT_EITHER
++			    && (src == s || dst == s))
++				return 1 ^ minfo->invert;
++		}
++	}
++ 
++ 	return minfo->invert;
++}
++
+ static int
+ match(const struct sk_buff *skb,
+       const struct net_device *in,
+       const struct net_device *out,
+       const void *matchinfo,
+       int offset,
+-      const void *hdr,
+-      u_int16_t datalen,
+       int *hotdrop)
+ {
+-	const struct udphdr *udp = hdr;
++	u16 _ports[2], *pptr;
+ 	const struct ipt_multiport *multiinfo = matchinfo;
+ 
+-	/* Must be big enough to read ports. */
+-	if (offset == 0 && datalen < sizeof(struct udphdr)) {
++	if (offset)
++		return 0;
++
++	pptr = skb_header_pointer(skb, skb->nh.iph->ihl * 4,
++				  sizeof(_ports), _ports);
++	if (pptr == NULL) {
+ 		/* We've been asked to examine this packet, and we
+-		   can't.  Hence, no choice but to drop. */
+-			duprintf("ipt_multiport:"
+-				 " Dropping evil offset=0 tinygram.\n");
+-			*hotdrop = 1;
+-			return 0;
++		 * can't.  Hence, no choice but to drop.
++		 */
++		duprintf("ipt_multiport:"
++			 " Dropping evil offset=0 tinygram.\n");
++		*hotdrop = 1;
++		return 0;
+ 	}
+ 
+-	/* Must not be a fragment. */
+-	return !offset
+-		&& ports_match(multiinfo->ports,
+-			       multiinfo->flags, multiinfo->count,
+-			       ntohs(udp->source), ntohs(udp->dest));
++	return ports_match(multiinfo->ports,
++			   multiinfo->flags, multiinfo->count,
++			   ntohs(pptr[0]), ntohs(pptr[1]));
++}
++
++static int
++match_v1(const struct sk_buff *skb,
++	 const struct net_device *in,
++	 const struct net_device *out,
++	 const void *matchinfo,
++	 int offset,
++	 int *hotdrop)
++{
++	u16 _ports[2], *pptr;
++	const struct ipt_multiport_v1 *multiinfo = matchinfo;
++
++	if (offset)
++		return 0;
++
++	pptr = skb_header_pointer(skb, skb->nh.iph->ihl * 4,
++				  sizeof(_ports), _ports);
++	if (pptr == NULL) {
++		/* We've been asked to examine this packet, and we
++		 * can't.  Hence, no choice but to drop.
++		 */
++		duprintf("ipt_multiport:"
++			 " Dropping evil offset=0 tinygram.\n");
++		*hotdrop = 1;
++		return 0;
++	}
++
++	return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));
+ }
+ 
+ /* Called when user tries to insert an entry of this type. */
+@@ -71,34 +159,54 @@
+ 	   unsigned int matchsize,
+ 	   unsigned int hook_mask)
+ {
+-	const struct ipt_multiport *multiinfo = matchinfo;
+-
+-	if (matchsize != IPT_ALIGN(sizeof(struct ipt_multiport)))
+-		return 0;
++	return (matchsize == IPT_ALIGN(sizeof(struct ipt_multiport)));
++}
+ 
+-	/* Must specify proto == TCP/UDP, no unknown flags or bad count */
+-	return (ip->proto == IPPROTO_TCP || ip->proto == IPPROTO_UDP)
+-		&& !(ip->invflags & IPT_INV_PROTO)
+-		&& matchsize == IPT_ALIGN(sizeof(struct ipt_multiport))
+-		&& (multiinfo->flags == IPT_MULTIPORT_SOURCE
+-		    || multiinfo->flags == IPT_MULTIPORT_DESTINATION
+-		    || multiinfo->flags == IPT_MULTIPORT_EITHER)
+-		&& multiinfo->count <= IPT_MULTI_PORTS;
++static int
++checkentry_v1(const char *tablename,
++	      const struct ipt_ip *ip,
++	      void *matchinfo,
++	      unsigned int matchsize,
++	      unsigned int hook_mask)
++{
++	return (matchsize == IPT_ALIGN(sizeof(struct ipt_multiport_v1)));
+ }
+ 
+-static struct ipt_match multiport_match
+-= { { NULL, NULL }, "multiport", &match, &checkentry, NULL, THIS_MODULE };
++static struct ipt_match multiport_match = {
++	.name		= "multiport",
++	.revision	= 0,
++	.match		= &match,
++	.checkentry	= &checkentry,
++	.me		= THIS_MODULE,
++};
++
++static struct ipt_match multiport_match_v1 = {
++	.name		= "multiport",
++	.revision	= 1,
++	.match		= &match_v1,
++	.checkentry	= &checkentry_v1,
++	.me		= THIS_MODULE,
++};
+ 
+ static int __init init(void)
+ {
+-	return ipt_register_match(&multiport_match);
++	int err;
++
++	err = ipt_register_match(&multiport_match);
++	if (!err) {
++		err = ipt_register_match(&multiport_match_v1);
++		if (err)
++			ipt_unregister_match(&multiport_match);
++	}
++
++	return err;
+ }
+ 
+ static void __exit fini(void)
+ {
+ 	ipt_unregister_match(&multiport_match);
++	ipt_unregister_match(&multiport_match_v1);
+ }
+ 
+ module_init(init);
+ module_exit(fini);
+-MODULE_LICENSE("GPL");