API tools faq
paste
Advertisement
Guest User

totherescue_linux-baytrail48

a guest
Jan 10th, 2017
24
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Diff 19.30 KB | None | 0 0
raw download clone embed print report
  1. diff -Nur a/include/uapi/linux/netfilter/xt_connmark.h b/include/uapi/linux/netfilter/xt_connmark.h
  2. --- a/include/uapi/linux/netfilter/xt_connmark.h    1970-01-01 02:00:00.000000000 +0200
  3. +++ b/include/uapi/linux/netfilter/xt_connmark.h    2017-01-09 19:37:16.000000000 +0200
  4. @@ -0,0 +1,31 @@
  5. +#ifndef _XT_CONNMARK_H
  6. +#define _XT_CONNMARK_H
  7. +
  8. +#include <linux/types.h>
  9. +
  10. +/* Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
  11. + * by Henrik Nordstrom <hno@marasystems.com>
  12. + *
  13. + * This program is free software; you can redistribute it and/or modify
  14. + * it under the terms of the GNU General Public License as published by
  15. + * the Free Software Foundation; either version 2 of the License, or
  16. + * (at your option) any later version.
  17. + */
  18. +
  19. +enum {
  20. +   XT_CONNMARK_SET = 0,
  21. +   XT_CONNMARK_SAVE,
  22. +   XT_CONNMARK_RESTORE
  23. +};
  24. +
  25. +struct xt_connmark_tginfo1 {
  26. +   __u32 ctmark, ctmask, nfmask;
  27. +   __u8 mode;
  28. +};
  29. +
  30. +struct xt_connmark_mtinfo1 {
  31. +   __u32 mark, mask;
  32. +   __u8 invert;
  33. +};
  34. +
  35. +#endif /*_XT_CONNMARK_H*/
  36. diff -Nur a/include/uapi/linux/netfilter/xt_dscp.h b/include/uapi/linux/netfilter/xt_dscp.h
  37. --- a/include/uapi/linux/netfilter/xt_dscp.h    1970-01-01 02:00:00.000000000 +0200
  38. +++ b/include/uapi/linux/netfilter/xt_dscp.h    2017-01-09 19:37:16.000000000 +0200
  39. @@ -0,0 +1,31 @@
  40. +/* x_tables module for matching the IPv4/IPv6 DSCP field
  41. + *
  42. + * (C) 2002 Harald Welte <laforge@gnumonks.org>
  43. + * This software is distributed under GNU GPL v2, 1991
  44. + *
  45. + * See RFC2474 for a description of the DSCP field within the IP Header.
  46. + *
  47. + * xt_dscp.h,v 1.3 2002/08/05 19:00:21 laforge Exp
  48. +*/
  49. +#ifndef _XT_DSCP_H
  50. +#define _XT_DSCP_H
  51. +
  52. +#include <linux/types.h>
  53. +
  54. +#define XT_DSCP_MASK   0xfc    /* 11111100 */
  55. +#define XT_DSCP_SHIFT  2
  56. +#define XT_DSCP_MAX    0x3f    /* 00111111 */
  57. +
  58. +/* match info */
  59. +struct xt_dscp_info {
  60. +   __u8 dscp;
  61. +   __u8 invert;
  62. +};
  63. +
  64. +struct xt_tos_match_info {
  65. +   __u8 tos_mask;
  66. +   __u8 tos_value;
  67. +   __u8 invert;
  68. +};
  69. +
  70. +#endif /* _XT_DSCP_H */
  71. diff -Nur a/include/uapi/linux/netfilter/xt_mark.h b/include/uapi/linux/netfilter/xt_mark.h
  72. --- a/include/uapi/linux/netfilter/xt_mark.h    1970-01-01 02:00:00.000000000 +0200
  73. +++ b/include/uapi/linux/netfilter/xt_mark.h    2017-01-09 19:37:16.000000000 +0200
  74. @@ -0,0 +1,15 @@
  75. +#ifndef _XT_MARK_H
  76. +#define _XT_MARK_H
  77. +
  78. +#include <linux/types.h>
  79. +
  80. +struct xt_mark_tginfo2 {
  81. +   __u32 mark, mask;
  82. +};
  83. +
  84. +struct xt_mark_mtinfo1 {
  85. +   __u32 mark, mask;
  86. +   __u8 invert;
  87. +};
  88. +
  89. +#endif /*_XT_MARK_H*/
  90. diff -Nur a/include/uapi/linux/netfilter/xt_rateest.h b/include/uapi/linux/netfilter/xt_rateest.h
  91. --- a/include/uapi/linux/netfilter/xt_rateest.h 1970-01-01 02:00:00.000000000 +0200
  92. +++ b/include/uapi/linux/netfilter/xt_rateest.h 2017-01-09 19:37:16.000000000 +0200
  93. @@ -0,0 +1,38 @@
  94. +#ifndef _XT_RATEEST_MATCH_H
  95. +#define _XT_RATEEST_MATCH_H
  96. +
  97. +#include <linux/types.h>
  98. +#include <linux/if.h>
  99. +
  100. +enum xt_rateest_match_flags {
  101. +   XT_RATEEST_MATCH_INVERT = 1<<0,
  102. +   XT_RATEEST_MATCH_ABS    = 1<<1,
  103. +   XT_RATEEST_MATCH_REL    = 1<<2,
  104. +   XT_RATEEST_MATCH_DELTA  = 1<<3,
  105. +   XT_RATEEST_MATCH_BPS    = 1<<4,
  106. +   XT_RATEEST_MATCH_PPS    = 1<<5,
  107. +};
  108. +
  109. +enum xt_rateest_match_mode {
  110. +   XT_RATEEST_MATCH_NONE,
  111. +   XT_RATEEST_MATCH_EQ,
  112. +   XT_RATEEST_MATCH_LT,
  113. +   XT_RATEEST_MATCH_GT,
  114. +};
  115. +
  116. +struct xt_rateest_match_info {
  117. +   char            name1[IFNAMSIZ];
  118. +   char            name2[IFNAMSIZ];
  119. +   __u16       flags;
  120. +   __u16       mode;
  121. +   __u32       bps1;
  122. +   __u32       pps1;
  123. +   __u32       bps2;
  124. +   __u32       pps2;
  125. +
  126. +   /* Used internally by the kernel */
  127. +   struct xt_rateest   *est1 __attribute__((aligned(8)));
  128. +   struct xt_rateest   *est2 __attribute__((aligned(8)));
  129. +};
  130. +
  131. +#endif /* _XT_RATEEST_MATCH_H */
  132. diff -Nur a/include/uapi/linux/netfilter/xt_tcpmss.h b/include/uapi/linux/netfilter/xt_tcpmss.h
  133. --- a/include/uapi/linux/netfilter/xt_tcpmss.h  1970-01-01 02:00:00.000000000 +0200
  134. +++ b/include/uapi/linux/netfilter/xt_tcpmss.h  2017-01-09 19:37:16.000000000 +0200
  135. @@ -0,0 +1,11 @@
  136. +#ifndef _XT_TCPMSS_MATCH_H
  137. +#define _XT_TCPMSS_MATCH_H
  138. +
  139. +#include <linux/types.h>
  140. +
  141. +struct xt_tcpmss_match_info {
  142. +    __u16 mss_min, mss_max;
  143. +    __u8 invert;
  144. +};
  145. +
  146. +#endif /*_XT_TCPMSS_MATCH_H*/
  147. diff -Nur a/include/uapi/linux/netfilter_ipv4/ipt_ecn.h b/include/uapi/linux/netfilter_ipv4/ipt_ecn.h
  148. --- a/include/uapi/linux/netfilter_ipv4/ipt_ecn.h   1970-01-01 02:00:00.000000000 +0200
  149. +++ b/include/uapi/linux/netfilter_ipv4/ipt_ecn.h   2017-01-09 19:37:16.000000000 +0200
  150. @@ -0,0 +1,15 @@
  151. +#ifndef _IPT_ECN_H
  152. +#define _IPT_ECN_H
  153. +
  154. +#include <linux/netfilter/xt_ecn.h>
  155. +#define ipt_ecn_info xt_ecn_info
  156. +
  157. +enum {
  158. +   IPT_ECN_IP_MASK       = XT_ECN_IP_MASK,
  159. +   IPT_ECN_OP_MATCH_IP   = XT_ECN_OP_MATCH_IP,
  160. +   IPT_ECN_OP_MATCH_ECE  = XT_ECN_OP_MATCH_ECE,
  161. +   IPT_ECN_OP_MATCH_CWR  = XT_ECN_OP_MATCH_CWR,
  162. +   IPT_ECN_OP_MATCH_MASK = XT_ECN_OP_MATCH_MASK,
  163. +};
  164. +
  165. +#endif /* IPT_ECN_H */
  166. diff -Nur a/include/uapi/linux/netfilter_ipv4/ipt_ttl.h b/include/uapi/linux/netfilter_ipv4/ipt_ttl.h
  167. --- a/include/uapi/linux/netfilter_ipv4/ipt_ttl.h   1970-01-01 02:00:00.000000000 +0200
  168. +++ b/include/uapi/linux/netfilter_ipv4/ipt_ttl.h   2017-01-09 19:37:16.000000000 +0200
  169. @@ -0,0 +1,23 @@
  170. +/* IP tables module for matching the value of the TTL
  171. + * (C) 2000 by Harald Welte <laforge@gnumonks.org> */
  172. +
  173. +#ifndef _IPT_TTL_H
  174. +#define _IPT_TTL_H
  175. +
  176. +#include <linux/types.h>
  177. +
  178. +enum {
  179. +   IPT_TTL_EQ = 0,     /* equals */
  180. +   IPT_TTL_NE,     /* not equals */
  181. +   IPT_TTL_LT,     /* less than */
  182. +   IPT_TTL_GT,     /* greater than */
  183. +};
  184. +
  185. +
  186. +struct ipt_ttl_info {
  187. +   __u8    mode;
  188. +   __u8    ttl;
  189. +};
  190. +
  191. +
  192. +#endif
  193. diff -Nur a/include/uapi/linux/netfilter_ipv6/ip6t_hl.h b/include/uapi/linux/netfilter_ipv6/ip6t_hl.h
  194. --- a/include/uapi/linux/netfilter_ipv6/ip6t_hl.h   1970-01-01 02:00:00.000000000 +0200
  195. +++ b/include/uapi/linux/netfilter_ipv6/ip6t_hl.h   2017-01-09 19:37:16.000000000 +0200
  196. @@ -0,0 +1,24 @@
  197. +/* ip6tables module for matching the Hop Limit value
  198. + * Maciej Soltysiak <solt@dns.toxicfilms.tv>
  199. + * Based on HW's ttl module */
  200. +
  201. +#ifndef _IP6T_HL_H
  202. +#define _IP6T_HL_H
  203. +
  204. +#include <linux/types.h>
  205. +
  206. +enum {
  207. +   IP6T_HL_EQ = 0,     /* equals */
  208. +   IP6T_HL_NE,     /* not equals */
  209. +   IP6T_HL_LT,     /* less than */
  210. +   IP6T_HL_GT,     /* greater than */
  211. +};
  212. +
  213. +
  214. +struct ip6t_hl_info {
  215. +   __u8    mode;
  216. +   __u8    hop_limit;
  217. +};
  218. +
  219. +
  220. +#endif
  221. diff -Nur a/net/netfilter/xt_dscp.c b/net/netfilter/xt_dscp.c
  222. --- a/net/netfilter/xt_dscp.c   1970-01-01 02:00:00.000000000 +0200
  223. +++ b/net/netfilter/xt_dscp.c   2017-01-09 19:37:16.000000000 +0200
  224. @@ -0,0 +1,115 @@
  225. +/* IP tables module for matching the value of the IPv4/IPv6 DSCP field
  226. + *
  227. + * (C) 2002 by Harald Welte <laforge@netfilter.org>
  228. + *
  229. + * This program is free software; you can redistribute it and/or modify
  230. + * it under the terms of the GNU General Public License version 2 as
  231. + * published by the Free Software Foundation.
  232. + */
  233. +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  234. +#include <linux/module.h>
  235. +#include <linux/skbuff.h>
  236. +#include <linux/ip.h>
  237. +#include <linux/ipv6.h>
  238. +#include <net/dsfield.h>
  239. +
  240. +#include <linux/netfilter/x_tables.h>
  241. +#include <linux/netfilter/xt_dscp.h>
  242. +
  243. +MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
  244. +MODULE_DESCRIPTION("Xtables: DSCP/TOS field match");
  245. +MODULE_LICENSE("GPL");
  246. +MODULE_ALIAS("ipt_dscp");
  247. +MODULE_ALIAS("ip6t_dscp");
  248. +MODULE_ALIAS("ipt_tos");
  249. +MODULE_ALIAS("ip6t_tos");
  250. +
  251. +static bool
  252. +dscp_mt(const struct sk_buff *skb, struct xt_action_param *par)
  253. +{
  254. +   const struct xt_dscp_info *info = par->matchinfo;
  255. +   u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT;
  256. +
  257. +   return (dscp == info->dscp) ^ !!info->invert;
  258. +}
  259. +
  260. +static bool
  261. +dscp_mt6(const struct sk_buff *skb, struct xt_action_param *par)
  262. +{
  263. +   const struct xt_dscp_info *info = par->matchinfo;
  264. +   u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT;
  265. +
  266. +   return (dscp == info->dscp) ^ !!info->invert;
  267. +}
  268. +
  269. +static int dscp_mt_check(const struct xt_mtchk_param *par)
  270. +{
  271. +   const struct xt_dscp_info *info = par->matchinfo;
  272. +
  273. +   if (info->dscp > XT_DSCP_MAX) {
  274. +       pr_info("dscp %x out of range\n", info->dscp);
  275. +       return -EDOM;
  276. +   }
  277. +
  278. +   return 0;
  279. +}
  280. +
  281. +static bool tos_mt(const struct sk_buff *skb, struct xt_action_param *par)
  282. +{
  283. +   const struct xt_tos_match_info *info = par->matchinfo;
  284. +
  285. +   if (par->family == NFPROTO_IPV4)
  286. +       return ((ip_hdr(skb)->tos & info->tos_mask) ==
  287. +              info->tos_value) ^ !!info->invert;
  288. +   else
  289. +       return ((ipv6_get_dsfield(ipv6_hdr(skb)) & info->tos_mask) ==
  290. +              info->tos_value) ^ !!info->invert;
  291. +}
  292. +
  293. +static struct xt_match dscp_mt_reg[] __read_mostly = {
  294. +   {
  295. +       .name       = "dscp",
  296. +       .family     = NFPROTO_IPV4,
  297. +       .checkentry = dscp_mt_check,
  298. +       .match      = dscp_mt,
  299. +       .matchsize  = sizeof(struct xt_dscp_info),
  300. +       .me     = THIS_MODULE,
  301. +   },
  302. +   {
  303. +       .name       = "dscp",
  304. +       .family     = NFPROTO_IPV6,
  305. +       .checkentry = dscp_mt_check,
  306. +       .match      = dscp_mt6,
  307. +       .matchsize  = sizeof(struct xt_dscp_info),
  308. +       .me     = THIS_MODULE,
  309. +   },
  310. +   {
  311. +       .name       = "tos",
  312. +       .revision   = 1,
  313. +       .family     = NFPROTO_IPV4,
  314. +       .match      = tos_mt,
  315. +       .matchsize  = sizeof(struct xt_tos_match_info),
  316. +       .me     = THIS_MODULE,
  317. +   },
  318. +   {
  319. +       .name       = "tos",
  320. +       .revision   = 1,
  321. +       .family     = NFPROTO_IPV6,
  322. +       .match      = tos_mt,
  323. +       .matchsize  = sizeof(struct xt_tos_match_info),
  324. +       .me     = THIS_MODULE,
  325. +   },
  326. +};
  327. +
  328. +static int __init dscp_mt_init(void)
  329. +{
  330. +   return xt_register_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg));
  331. +}
  332. +
  333. +static void __exit dscp_mt_exit(void)
  334. +{
  335. +   xt_unregister_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg));
  336. +}
  337. +
  338. +module_init(dscp_mt_init);
  339. +module_exit(dscp_mt_exit);
  340. diff -Nur a/net/netfilter/xt_hl.c b/net/netfilter/xt_hl.c
  341. --- a/net/netfilter/xt_hl.c 1970-01-01 02:00:00.000000000 +0200
  342. +++ b/net/netfilter/xt_hl.c 2017-01-09 19:37:16.000000000 +0200
  343. @@ -0,0 +1,96 @@
  344. +/*
  345. + * IP tables module for matching the value of the TTL
  346. + * (C) 2000,2001 by Harald Welte <laforge@netfilter.org>
  347. + *
  348. + * Hop Limit matching module
  349. + * (C) 2001-2002 Maciej Soltysiak <solt@dns.toxicfilms.tv>
  350. + *
  351. + * This program is free software; you can redistribute it and/or modify
  352. + * it under the terms of the GNU General Public License version 2 as
  353. + * published by the Free Software Foundation.
  354. + */
  355. +
  356. +#include <linux/ip.h>
  357. +#include <linux/ipv6.h>
  358. +#include <linux/module.h>
  359. +#include <linux/skbuff.h>
  360. +
  361. +#include <linux/netfilter/x_tables.h>
  362. +#include <linux/netfilter_ipv4/ipt_ttl.h>
  363. +#include <linux/netfilter_ipv6/ip6t_hl.h>
  364. +
  365. +MODULE_AUTHOR("Maciej Soltysiak <solt@dns.toxicfilms.tv>");
  366. +MODULE_DESCRIPTION("Xtables: Hoplimit/TTL field match");
  367. +MODULE_LICENSE("GPL");
  368. +MODULE_ALIAS("ipt_ttl");
  369. +MODULE_ALIAS("ip6t_hl");
  370. +
  371. +static bool ttl_mt(const struct sk_buff *skb, struct xt_action_param *par)
  372. +{
  373. +   const struct ipt_ttl_info *info = par->matchinfo;
  374. +   const u8 ttl = ip_hdr(skb)->ttl;
  375. +
  376. +   switch (info->mode) {
  377. +   case IPT_TTL_EQ:
  378. +       return ttl == info->ttl;
  379. +   case IPT_TTL_NE:
  380. +       return ttl != info->ttl;
  381. +   case IPT_TTL_LT:
  382. +       return ttl < info->ttl;
  383. +   case IPT_TTL_GT:
  384. +       return ttl > info->ttl;
  385. +   }
  386. +
  387. +   return false;
  388. +}
  389. +
  390. +static bool hl_mt6(const struct sk_buff *skb, struct xt_action_param *par)
  391. +{
  392. +   const struct ip6t_hl_info *info = par->matchinfo;
  393. +   const struct ipv6hdr *ip6h = ipv6_hdr(skb);
  394. +
  395. +   switch (info->mode) {
  396. +   case IP6T_HL_EQ:
  397. +       return ip6h->hop_limit == info->hop_limit;
  398. +   case IP6T_HL_NE:
  399. +       return ip6h->hop_limit != info->hop_limit;
  400. +   case IP6T_HL_LT:
  401. +       return ip6h->hop_limit < info->hop_limit;
  402. +   case IP6T_HL_GT:
  403. +       return ip6h->hop_limit > info->hop_limit;
  404. +   }
  405. +
  406. +   return false;
  407. +}
  408. +
  409. +static struct xt_match hl_mt_reg[] __read_mostly = {
  410. +   {
  411. +       .name       = "ttl",
  412. +       .revision   = 0,
  413. +       .family     = NFPROTO_IPV4,
  414. +       .match      = ttl_mt,
  415. +       .matchsize  = sizeof(struct ipt_ttl_info),
  416. +       .me         = THIS_MODULE,
  417. +   },
  418. +   {
  419. +       .name       = "hl",
  420. +       .revision   = 0,
  421. +       .family     = NFPROTO_IPV6,
  422. +       .match      = hl_mt6,
  423. +       .matchsize  = sizeof(struct ip6t_hl_info),
  424. +       .me         = THIS_MODULE,
  425. +   },
  426. +};
  427. +
  428. +static int __init hl_mt_init(void)
  429. +{
  430. +   return xt_register_matches(hl_mt_reg, ARRAY_SIZE(hl_mt_reg));
  431. +}
  432. +
  433. +static void __exit hl_mt_exit(void)
  434. +{
  435. +   xt_unregister_matches(hl_mt_reg, ARRAY_SIZE(hl_mt_reg));
  436. +}
  437. +
  438. +module_init(hl_mt_init);
  439. +module_exit(hl_mt_exit);
  440. diff -Nur a/net/netfilter/xt_rateest.c b/net/netfilter/xt_rateest.c
  441. --- a/net/netfilter/xt_rateest.c    1970-01-01 02:00:00.000000000 +0200
  442. +++ b/net/netfilter/xt_rateest.c    2017-01-09 19:37:16.000000000 +0200
  443. @@ -0,0 +1,157 @@
  444. +/*
  445. + * (C) 2007 Patrick McHardy <kaber@trash.net>
  446. + *
  447. + * This program is free software; you can redistribute it and/or modify
  448. + * it under the terms of the GNU General Public License version 2 as
  449. + * published by the Free Software Foundation.
  450. + */
  451. +#include <linux/module.h>
  452. +#include <linux/skbuff.h>
  453. +#include <linux/gen_stats.h>
  454. +
  455. +#include <linux/netfilter/x_tables.h>
  456. +#include <linux/netfilter/xt_rateest.h>
  457. +#include <net/netfilter/xt_rateest.h>
  458. +
  459. +
  460. +static bool
  461. +xt_rateest_mt(const struct sk_buff *skb, struct xt_action_param *par)
  462. +{
  463. +   const struct xt_rateest_match_info *info = par->matchinfo;
  464. +   struct gnet_stats_rate_est64 *r;
  465. +   u_int32_t bps1, bps2, pps1, pps2;
  466. +   bool ret = true;
  467. +
  468. +   spin_lock_bh(&info->est1->lock);
  469. +   r = &info->est1->rstats;
  470. +   if (info->flags & XT_RATEEST_MATCH_DELTA) {
  471. +       bps1 = info->bps1 >= r->bps ? info->bps1 - r->bps : 0;
  472. +       pps1 = info->pps1 >= r->pps ? info->pps1 - r->pps : 0;
  473. +   } else {
  474. +       bps1 = r->bps;
  475. +       pps1 = r->pps;
  476. +   }
  477. +   spin_unlock_bh(&info->est1->lock);
  478. +
  479. +   if (info->flags & XT_RATEEST_MATCH_ABS) {
  480. +       bps2 = info->bps2;
  481. +       pps2 = info->pps2;
  482. +   } else {
  483. +       spin_lock_bh(&info->est2->lock);
  484. +       r = &info->est2->rstats;
  485. +       if (info->flags & XT_RATEEST_MATCH_DELTA) {
  486. +           bps2 = info->bps2 >= r->bps ? info->bps2 - r->bps : 0;
  487. +           pps2 = info->pps2 >= r->pps ? info->pps2 - r->pps : 0;
  488. +       } else {
  489. +           bps2 = r->bps;
  490. +           pps2 = r->pps;
  491. +       }
  492. +       spin_unlock_bh(&info->est2->lock);
  493. +   }
  494. +
  495. +   switch (info->mode) {
  496. +   case XT_RATEEST_MATCH_LT:
  497. +       if (info->flags & XT_RATEEST_MATCH_BPS)
  498. +           ret &= bps1 < bps2;
  499. +       if (info->flags & XT_RATEEST_MATCH_PPS)
  500. +           ret &= pps1 < pps2;
  501. +       break;
  502. +   case XT_RATEEST_MATCH_GT:
  503. +       if (info->flags & XT_RATEEST_MATCH_BPS)
  504. +           ret &= bps1 > bps2;
  505. +       if (info->flags & XT_RATEEST_MATCH_PPS)
  506. +           ret &= pps1 > pps2;
  507. +       break;
  508. +   case XT_RATEEST_MATCH_EQ:
  509. +       if (info->flags & XT_RATEEST_MATCH_BPS)
  510. +           ret &= bps1 == bps2;
  511. +       if (info->flags & XT_RATEEST_MATCH_PPS)
  512. +           ret &= pps1 == pps2;
  513. +       break;
  514. +   }
  515. +
  516. +   ret ^= info->flags & XT_RATEEST_MATCH_INVERT ? true : false;
  517. +   return ret;
  518. +}
  519. +
  520. +static int xt_rateest_mt_checkentry(const struct xt_mtchk_param *par)
  521. +{
  522. +   struct xt_rateest_match_info *info = par->matchinfo;
  523. +   struct xt_rateest *est1, *est2;
  524. +   int ret = -EINVAL;
  525. +
  526. +   if (hweight32(info->flags & (XT_RATEEST_MATCH_ABS |
  527. +                    XT_RATEEST_MATCH_REL)) != 1)
  528. +       goto err1;
  529. +
  530. +   if (!(info->flags & (XT_RATEEST_MATCH_BPS | XT_RATEEST_MATCH_PPS)))
  531. +       goto err1;
  532. +
  533. +   switch (info->mode) {
  534. +   case XT_RATEEST_MATCH_EQ:
  535. +   case XT_RATEEST_MATCH_LT:
  536. +   case XT_RATEEST_MATCH_GT:
  537. +       break;
  538. +   default:
  539. +       goto err1;
  540. +   }
  541. +
  542. +   ret  = -ENOENT;
  543. +   est1 = xt_rateest_lookup(info->name1);
  544. +   if (!est1)
  545. +       goto err1;
  546. +
  547. +   est2 = NULL;
  548. +   if (info->flags & XT_RATEEST_MATCH_REL) {
  549. +       est2 = xt_rateest_lookup(info->name2);
  550. +       if (!est2)
  551. +           goto err2;
  552. +   }
  553. +
  554. +   info->est1 = est1;
  555. +   info->est2 = est2;
  556. +   return 0;
  557. +
  558. +err2:
  559. +   xt_rateest_put(est1);
  560. +err1:
  561. +   return ret;
  562. +}
  563. +
  564. +static void xt_rateest_mt_destroy(const struct xt_mtdtor_param *par)
  565. +{
  566. +   struct xt_rateest_match_info *info = par->matchinfo;
  567. +
  568. +   xt_rateest_put(info->est1);
  569. +   if (info->est2)
  570. +       xt_rateest_put(info->est2);
  571. +}
  572. +
  573. +static struct xt_match xt_rateest_mt_reg __read_mostly = {
  574. +   .name       = "rateest",
  575. +   .revision   = 0,
  576. +   .family     = NFPROTO_UNSPEC,
  577. +   .match      = xt_rateest_mt,
  578. +   .checkentry = xt_rateest_mt_checkentry,
  579. +   .destroy    = xt_rateest_mt_destroy,
  580. +   .matchsize  = sizeof(struct xt_rateest_match_info),
  581. +   .me         = THIS_MODULE,
  582. +};
  583. +
  584. +static int __init xt_rateest_mt_init(void)
  585. +{
  586. +   return xt_register_match(&xt_rateest_mt_reg);
  587. +}
  588. +
  589. +static void __exit xt_rateest_mt_fini(void)
  590. +{
  591. +   xt_unregister_match(&xt_rateest_mt_reg);
  592. +}
  593. +
  594. +MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
  595. +MODULE_LICENSE("GPL");
  596. +MODULE_DESCRIPTION("xtables rate estimator match");
  597. +MODULE_ALIAS("ipt_rateest");
  598. +MODULE_ALIAS("ip6t_rateest");
  599. +module_init(xt_rateest_mt_init);
  600. +module_exit(xt_rateest_mt_fini);
  601. diff -Nur a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
  602. --- a/net/netfilter/xt_tcpmss.c 1970-01-01 02:00:00.000000000 +0200
  603. +++ b/net/netfilter/xt_tcpmss.c 2017-01-09 19:37:16.000000000 +0200
  604. @@ -0,0 +1,110 @@
  605. +/* Kernel module to match TCP MSS values. */
  606. +
  607. +/* Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
  608. + * Portions (C) 2005 by Harald Welte <laforge@netfilter.org>
  609. + *
  610. + * This program is free software; you can redistribute it and/or modify
  611. + * it under the terms of the GNU General Public License version 2 as
  612. + * published by the Free Software Foundation.
  613. + */
  614. +
  615. +#include <linux/module.h>
  616. +#include <linux/skbuff.h>
  617. +#include <net/tcp.h>
  618. +
  619. +#include <linux/netfilter/xt_tcpmss.h>
  620. +#include <linux/netfilter/x_tables.h>
  621. +
  622. +#include <linux/netfilter_ipv4/ip_tables.h>
  623. +#include <linux/netfilter_ipv6/ip6_tables.h>
  624. +
  625. +MODULE_LICENSE("GPL");
  626. +MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
  627. +MODULE_DESCRIPTION("Xtables: TCP MSS match");
  628. +MODULE_ALIAS("ipt_tcpmss");
  629. +MODULE_ALIAS("ip6t_tcpmss");
  630. +
  631. +static bool
  632. +tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
  633. +{
  634. +   const struct xt_tcpmss_match_info *info = par->matchinfo;
  635. +   const struct tcphdr *th;
  636. +   struct tcphdr _tcph;
  637. +   /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
  638. +   const u_int8_t *op;
  639. +   u8 _opt[15 * 4 - sizeof(_tcph)];
  640. +   unsigned int i, optlen;
  641. +
  642. +   /* If we don't have the whole header, drop packet. */
  643. +   th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
  644. +   if (th == NULL)
  645. +       goto dropit;
  646. +
  647. +   /* Malformed. */
  648. +   if (th->doff*4 < sizeof(*th))
  649. +       goto dropit;
  650. +
  651. +   optlen = th->doff*4 - sizeof(*th);
  652. +   if (!optlen)
  653. +       goto out;
  654. +
  655. +   /* Truncated options. */
  656. +   op = skb_header_pointer(skb, par->thoff + sizeof(*th), optlen, _opt);
  657. +   if (op == NULL)
  658. +       goto dropit;
  659. +
  660. +   for (i = 0; i < optlen; ) {
  661. +       if (op[i] == TCPOPT_MSS
  662. +           && (optlen - i) >= TCPOLEN_MSS
  663. +           && op[i+1] == TCPOLEN_MSS) {
  664. +           u_int16_t mssval;
  665. +
  666. +           mssval = (op[i+2] << 8) | op[i+3];
  667. +
  668. +           return (mssval >= info->mss_min &&
  669. +               mssval <= info->mss_max) ^ info->invert;
  670. +       }
  671. +       if (op[i] < 2)
  672. +           i++;
  673. +       else
  674. +           i += op[i+1] ? : 1;
  675. +   }
  676. +out:
  677. +   return info->invert;
  678. +
  679. +dropit:
  680. +   par->hotdrop = true;
  681. +   return false;
  682. +}
  683. +
  684. +static struct xt_match tcpmss_mt_reg[] __read_mostly = {
  685. +   {
  686. +       .name       = "tcpmss",
  687. +       .family     = NFPROTO_IPV4,
  688. +       .match      = tcpmss_mt,
  689. +       .matchsize  = sizeof(struct xt_tcpmss_match_info),
  690. +       .proto      = IPPROTO_TCP,
  691. +       .me     = THIS_MODULE,
  692. +   },
  693. +   {
  694. +       .name       = "tcpmss",
  695. +       .family     = NFPROTO_IPV6,
  696. +       .match      = tcpmss_mt,
  697. +       .matchsize  = sizeof(struct xt_tcpmss_match_info),
  698. +       .proto      = IPPROTO_TCP,
  699. +       .me     = THIS_MODULE,
  700. +   },
  701. +};
  702. +
  703. +static int __init tcpmss_mt_init(void)
  704. +{
  705. +   return xt_register_matches(tcpmss_mt_reg, ARRAY_SIZE(tcpmss_mt_reg));
  706. +}
  707. +
  708. +static void __exit tcpmss_mt_exit(void)
  709. +{
  710. +   xt_unregister_matches(tcpmss_mt_reg, ARRAY_SIZE(tcpmss_mt_reg));
  711. +}
  712. +
  713. +module_init(tcpmss_mt_init);
  714. +module_exit(tcpmss_mt_exit);
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!