target/linux/generic-2.4/patches/609-netfilter_string.patch

   1 diff -Nur linux-2.4.32/include/linux/netfilter_ipv4/ipt_string.h linux-2.4.32.patch/include/linux/netfilter_ipv4/ipt_string.h
   2 --- linux-2.4.32/include/linux/netfilter_ipv4/ipt_string.h      1970-01-01 01:00:00.000000000 +0100
   3 +++ linux-2.4.32.patch/include/linux/netfilter_ipv4/ipt_string.h        2005-12-16 00:40:19.082509250 +0100
   4 @@ -0,0 +1,18 @@
   5 +#ifndef _IPT_STRING_H
   6 +#define _IPT_STRING_H
   7 +
   8 +#define IPT_STRING_MAX_PATTERN_SIZE 128
   9 +#define IPT_STRING_MAX_ALGO_NAME_SIZE 16
  10 +
  11 +struct ipt_string_info
  12 +{
  13 +       u_int16_t from_offset;
  14 +       u_int16_t to_offset;
  15 +       char      algo[IPT_STRING_MAX_ALGO_NAME_SIZE];
  16 +       char      pattern[IPT_STRING_MAX_PATTERN_SIZE];
  17 +       u_int8_t  patlen;
  18 +       u_int8_t  invert;
  19 +       struct ts_config __attribute__((aligned(8))) *config;
  20 +};
  21 +
  22 +#endif /*_IPT_STRING_H*/
  23 diff -Nur linux-2.4.32/include/linux/textsearch.h linux-2.4.32.patch/include/linux/textsearch.h
  24 --- linux-2.4.32/include/linux/textsearch.h     1970-01-01 01:00:00.000000000 +0100
  25 +++ linux-2.4.32.patch/include/linux/textsearch.h       2005-12-16 11:15:34.838073000 +0100
  26 @@ -0,0 +1,205 @@
  27 +#ifndef __LINUX_TEXTSEARCH_H
  28 +#define __LINUX_TEXTSEARCH_H
  29 +
  30 +#ifdef __KERNEL__
  31 +
  32 +#include <linux/types.h>
  33 +#include <linux/list.h>
  34 +#include <linux/kernel.h>
  35 +#include <linux/module.h>
  36 +#include <linux/slab.h>
  37 +
  38 +#ifdef __CHECKER__
  39 +#define __bitwise__ __attribute__((bitwise))
  40 +#else
  41 +#define __bitwise__
  42 +#endif
  43 +#ifdef __CHECK_ENDIAN__
  44 +#define __bitwise __bitwise__
  45 +#else
  46 +#define __bitwise
  47 +#endif
  48 +
  49 +typedef __u16 __bitwise __le16;
  50 +typedef __u16 __bitwise __be16;
  51 +typedef __u32 __bitwise __le32;
  52 +typedef __u32 __bitwise __be32;
  53 +#if defined(__GNUC__) && !defined(__STRICT_ANSI__)
  54 +typedef __u64 __bitwise __le64;
  55 +typedef __u64 __bitwise __be64;
  56 +#endif
  57 +
  58 +#ifdef __KERNEL__
  59 +typedef unsigned __bitwise__ gfp_t;
  60 +#endif
  61 +
  62 +struct ts_config;
  63 +
  64 +/**
  65 + * TS_AUTOLOAD - Automatically load textsearch modules when needed
  66 + */
  67 +#define TS_AUTOLOAD    1
  68 +
  69 +/**
  70 + * struct ts_state - search state
  71 + * @offset: offset for next match
  72 + * @cb: control buffer, for persistant variables of get_next_block()
  73 + */
  74 +struct ts_state
  75 +{
  76 +       unsigned int            offset;
  77 +       char                    cb[40];
  78 +};
  79 +
  80 +/**
  81 + * struct ts_ops - search module operations
  82 + * @name: name of search algorithm
  83 + * @init: initialization function to prepare a search
  84 + * @find: find the next occurrence of the pattern
  85 + * @destroy: destroy algorithm specific parts of a search configuration
  86 + * @get_pattern: return head of pattern
  87 + * @get_pattern_len: return length of pattern
  88 + * @owner: module reference to algorithm
  89 + */
  90 +struct ts_ops
  91 +{
  92 +       const char              *name;
  93 +       struct ts_config *      (*init)(const void *, unsigned int, gfp_t);
  94 +       unsigned int            (*find)(struct ts_config *,
  95 +                                       struct ts_state *);
  96 +       void                    (*destroy)(struct ts_config *);
  97 +       void *                  (*get_pattern)(struct ts_config *);
  98 +       unsigned int            (*get_pattern_len)(struct ts_config *);
  99 +       struct module           *owner;
 100 +       struct list_head        list;
 101 +};
 102 +
 103 +/**
 104 + * struct ts_config - search configuration
 105 + * @ops: operations of chosen algorithm
 106 + * @get_next_block: callback to fetch the next block to search in
 107 + * @finish: callback to finalize a search
 108 + */
 109 +struct ts_config
 110 +{
 111 +       struct ts_ops           *ops;
 112 +
 113 +       /**
 114 +        * get_next_block - fetch next block of data
 115 +        * @consumed: number of bytes consumed by the caller
 116 +        * @dst: destination buffer
 117 +        * @conf: search configuration
 118 +        * @state: search state
 119 +        *
 120 +        * Called repeatedly until 0 is returned. Must assign the
 121 +        * head of the next block of data to &*dst and return the length
 122 +        * of the block or 0 if at the end. consumed == 0 indicates
 123 +        * a new search. May store/read persistant values in state->cb.
 124 +        */
 125 +       unsigned int            (*get_next_block)(unsigned int consumed,
 126 +                                                 const u8 **dst,
 127 +                                                 struct ts_config *conf,
 128 +                                                 struct ts_state *state);
 129 +
 130 +       /**
 131 +        * finish - finalize/clean a series of get_next_block() calls
 132 +        * @conf: search configuration
 133 +        * @state: search state
 134 +        *
 135 +        * Called after the last use of get_next_block(), may be used
 136 +        * to cleanup any leftovers.
 137 +        */
 138 +       void                    (*finish)(struct ts_config *conf,
 139 +                                         struct ts_state *state);
 140 +};
 141 +
 142 +/**
 143 + * textsearch_next - continue searching for a pattern
 144 + * @conf: search configuration
 145 + * @state: search state
 146 + *
 147 + * Continues a search looking for more occurrences of the pattern.
 148 + * textsearch_find() must be called to find the first occurrence
 149 + * in order to reset the state.
 150 + *
 151 + * Returns the position of the next occurrence of the pattern or
 152 + * UINT_MAX if not match was found.
 153 + */
 154 +static inline unsigned int textsearch_next(struct ts_config *conf,
 155 +                                          struct ts_state *state)
 156 +{
 157 +       unsigned int ret = conf->ops->find(conf, state);
 158 +
 159 +       if (conf->finish)
 160 +               conf->finish(conf, state);
 161 +
 162 +       return ret;
 163 +}
 164 +
 165 +/**
 166 + * textsearch_find - start searching for a pattern
 167 + * @conf: search configuration
 168 + * @state: search state
 169 + *
 170 + * Returns the position of first occurrence of the pattern or
 171 + * UINT_MAX if no match was found.
 172 + */
 173 +static inline unsigned int textsearch_find(struct ts_config *conf,
 174 +                                          struct ts_state *state)
 175 +{
 176 +       state->offset = 0;
 177 +       return textsearch_next(conf, state);
 178 +}
 179 +
 180 +/**
 181 + * textsearch_get_pattern - return head of the pattern
 182 + * @conf: search configuration
 183 + */
 184 +static inline void *textsearch_get_pattern(struct ts_config *conf)
 185 +{
 186 +       return conf->ops->get_pattern(conf);
 187 +}
 188 +
 189 +/**
 190 + * textsearch_get_pattern_len - return length of the pattern
 191 + * @conf: search configuration
 192 + */
 193 +static inline unsigned int textsearch_get_pattern_len(struct ts_config *conf)
 194 +{
 195 +       return conf->ops->get_pattern_len(conf);
 196 +}
 197 +
 198 +extern int textsearch_register(struct ts_ops *);
 199 +extern int textsearch_unregister(struct ts_ops *);
 200 +extern struct ts_config *textsearch_prepare(const char *, const void *,
 201 +                                           unsigned int, gfp_t, int);
 202 +extern void textsearch_destroy(struct ts_config *conf);
 203 +extern unsigned int textsearch_find_continuous(struct ts_config *,
 204 +                                              struct ts_state *,
 205 +                                              const void *, unsigned int);
 206 +
 207 +
 208 +#define TS_PRIV_ALIGNTO        8
 209 +#define TS_PRIV_ALIGN(len) (((len) + TS_PRIV_ALIGNTO-1) & ~(TS_PRIV_ALIGNTO-1))
 210 +
 211 +static inline struct ts_config *alloc_ts_config(size_t payload,
 212 +                                               gfp_t gfp_mask)
 213 +{
 214 +       struct ts_config *conf;
 215 +
 216 +       conf = kmalloc(TS_PRIV_ALIGN(sizeof(*conf)) + payload, gfp_mask);
 217 +       if (conf == NULL)
 218 +               return -ENOMEM;
 219 +
 220 +       memset(conf, 0, TS_PRIV_ALIGN(sizeof(*conf)) + payload);
 221 +       return conf;
 222 +}
 223 +
 224 +static inline void *ts_config_priv(struct ts_config *conf)
 225 +{
 226 +       return ((u8 *) conf + TS_PRIV_ALIGN(sizeof(struct ts_config)));
 227 +}
 228 +
 229 +#endif /* __KERNEL__ */
 230 +
 231 +#endif
 232 diff -Nur linux-2.4.32/net/ipv4/netfilter/Config.in linux-2.4.32.patch/net/ipv4/netfilter/Config.in
 233 --- linux-2.4.32/net/ipv4/netfilter/Config.in   2005-01-19 15:10:13.000000000 +0100
 234 +++ linux-2.4.32.patch/net/ipv4/netfilter/Config.in     2005-12-16 00:41:43.023755250 +0100
 235 @@ -42,6 +42,7 @@
 236    fi
 237    if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
 238      dep_tristate '  Unclean match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_UNCLEAN $CONFIG_IP_NF_IPTABLES
 239 +    dep_tristate '  String match support (EXPERIMENTAL) ' CONFIG_IP_NF_MATCH_STRING $CONFIG_IP_NF_IPTABLES
 240      dep_tristate '  Owner match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_OWNER $CONFIG_IP_NF_IPTABLES
 241    fi
 242  # The targets
 243 diff -Nur linux-2.4.32/net/ipv4/netfilter/ipt_string.c linux-2.4.32.patch/net/ipv4/netfilter/ipt_string.c
 244 --- linux-2.4.32/net/ipv4/netfilter/ipt_string.c        1970-01-01 01:00:00.000000000 +0100
 245 +++ linux-2.4.32.patch/net/ipv4/netfilter/ipt_string.c  2005-12-16 00:40:48.436343750 +0100
 246 @@ -0,0 +1,91 @@
 247 +/* String matching match for iptables
 248 + *
 249 + * (C) 2005 Pablo Neira Ayuso <pablo@eurodev.net>
 250 + *
 251 + * This program is free software; you can redistribute it and/or modify
 252 + * it under the terms of the GNU General Public License version 2 as
 253 + * published by the Free Software Foundation.
 254 + */
 255 +
 256 +#include <linux/init.h>
 257 +#include <linux/module.h>
 258 +#include <linux/kernel.h>
 259 +#include <linux/skbuff.h>
 260 +#include <linux/netfilter_ipv4/ip_tables.h>
 261 +#include <linux/netfilter_ipv4/ipt_string.h>
 262 +#include <linux/textsearch.h>
 263 +
 264 +MODULE_AUTHOR("Pablo Neira Ayuso <pablo@eurodev.net>");
 265 +MODULE_DESCRIPTION("IP tables string match module");
 266 +MODULE_LICENSE("GPL");
 267 +
 268 +static int match(const struct sk_buff *skb,
 269 +                const struct net_device *in,
 270 +                const struct net_device *out,
 271 +                const void *matchinfo,
 272 +                int offset,
 273 +                int *hotdrop)
 274 +{
 275 +       struct ts_state state;
 276 +       struct ipt_string_info *conf = (struct ipt_string_info *) matchinfo;
 277 +
 278 +       memset(&state, 0, sizeof(struct ts_state));
 279 +
 280 +       return (skb_find_text((struct sk_buff *)skb, conf->from_offset,
 281 +                            conf->to_offset, conf->config, &state)
 282 +                            != UINT_MAX) && !conf->invert;
 283 +}
 284 +
 285 +#define STRING_TEXT_PRIV(m) ((struct ipt_string_info *) m)
 286 +
 287 +static int checkentry(const char *tablename,
 288 +                     const struct ipt_ip *ip,
 289 +                     void *matchinfo,
 290 +                     unsigned int matchsize,
 291 +                     unsigned int hook_mask)
 292 +{
 293 +       struct ipt_string_info *conf = matchinfo;
 294 +       struct ts_config *ts_conf;
 295 +
 296 +       if (matchsize != IPT_ALIGN(sizeof(struct ipt_string_info)))
 297 +               return 0;
 298 +
 299 +       /* Damn, can't handle this case properly with iptables... */
 300 +       if (conf->from_offset > conf->to_offset)
 301 +               return 0;
 302 +
 303 +       ts_conf = textsearch_prepare(conf->algo, conf->pattern, conf->patlen,
 304 +                                    GFP_KERNEL, TS_AUTOLOAD);
 305 +       if (IS_ERR(ts_conf))
 306 +               return 0;
 307 +
 308 +       conf->config = ts_conf;
 309 +
 310 +       return 1;
 311 +}
 312 +
 313 +static void destroy(void *matchinfo, unsigned int matchsize)
 314 +{
 315 +       textsearch_destroy(STRING_TEXT_PRIV(matchinfo)->config);
 316 +}
 317 +
 318 +static struct ipt_match string_match = {
 319 +       .name           = "string",
 320 +       .match          = match,
 321 +       .checkentry     = checkentry,
 322 +       .destroy        = destroy,
 323 +       .me             = THIS_MODULE
 324 +};
 325 +
 326 +static int __init init(void)
 327 +{
 328 +       return ipt_register_match(&string_match);
 329 +}
 330 +
 331 +static void __exit fini(void)
 332 +{
 333 +       ipt_unregister_match(&string_match);
 334 +}
 335 +
 336 +module_init(init);
 337 +module_exit(fini);
 338 diff -Nur linux-2.4.32/net/ipv4/netfilter/Makefile linux-2.4.32.patch/net/ipv4/netfilter/Makefile
 339 --- linux-2.4.32/net/ipv4/netfilter/Makefile    2003-08-25 13:44:44.000000000 +0200
 340 +++ linux-2.4.32.patch/net/ipv4/netfilter/Makefile      2005-12-16 00:42:10.929499250 +0100
 341 @@ -85,6 +85,7 @@
 342  obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
 343  obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
 344  obj-$(CONFIG_IP_NF_MATCH_UNCLEAN) += ipt_unclean.o
 345 +obj-$(CONFIG_IP_NF_MATCH_STRING) += ipt_string.o
 346  obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
 347
 348  # targets