update layer7 netfilter patch for kernel 2.4
SVN-Revision: 1781
This commit is contained in:
Waldemar Brodkorb
parent
4a998fa50b
commit
92c81ec0fd
1 changed files with 321 additions and 293 deletions
|
|
@ -1,7 +1,7 @@
|
|||
diff -Nurp linux-2.4.26-stock/Documentation/Configure.help linux-2.4.26-layer7-clean/Documentation/Configure.help
|
||||
--- linux-2.4.26-stock/Documentation/Configure.help 2004-04-14 08:05:24.000000000 -0500
|
||||
+++ linux-2.4.26-layer7-clean/Documentation/Configure.help 2004-06-21 00:18:14.000000000 -0500
|
||||
@@ -28819,6 +28819,23 @@ CONFIG_SOUND_WM97XX
|
||||
diff -Nurp linux-2.4.30/Documentation/Configure.help linux-2.4.30-layer7/Documentation/Configure.help
|
||||
--- linux-2.4.30/Documentation/Configure.help 2005-04-03 20:42:19.000000000 -0500
|
||||
+++ linux-2.4.30-layer7/Documentation/Configure.help 2005-05-03 18:37:03.000000000 -0500
|
||||
@@ -29056,6 +29056,23 @@ CONFIG_SOUND_WM97XX
|
||||
|
||||
If unsure, say N.
|
||||
|
||||
|
|
@ -25,9 +25,9 @@ diff -Nurp linux-2.4.26-stock/Documentation/Configure.help linux-2.4.26-layer7-c
|
|||
#
|
||||
# A couple of things I keep forgetting:
|
||||
# capitalize: AppleTalk, Ethernet, DOS, DMA, FAT, FTP, Internet,
|
||||
diff -Nurp linux-2.4.26-stock/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.4.26-layer7-clean/include/linux/netfilter_ipv4/ip_conntrack.h
|
||||
--- linux-2.4.26-stock/include/linux/netfilter_ipv4/ip_conntrack.h 2004-04-14 08:05:40.000000000 -0500
|
||||
+++ linux-2.4.26-layer7-clean/include/linux/netfilter_ipv4/ip_conntrack.h 2004-06-21 00:18:28.000000000 -0500
|
||||
diff -Nurp linux-2.4.30/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.4.30-layer7/include/linux/netfilter_ipv4/ip_conntrack.h
|
||||
--- linux-2.4.30/include/linux/netfilter_ipv4/ip_conntrack.h 2005-04-03 20:42:20.000000000 -0500
|
||||
+++ linux-2.4.30-layer7/include/linux/netfilter_ipv4/ip_conntrack.h 2005-05-03 18:37:03.000000000 -0500
|
||||
@@ -207,6 +207,17 @@ struct ip_conntrack
|
||||
} nat;
|
||||
#endif /* CONFIG_IP_NF_NAT_NEEDED */
|
||||
|
|
@ -46,9 +46,9 @@ diff -Nurp linux-2.4.26-stock/include/linux/netfilter_ipv4/ip_conntrack.h linux-
|
|||
};
|
||||
|
||||
/* get master conntrack via master expectation */
|
||||
diff -Nurp linux-2.4.26-stock/include/linux/netfilter_ipv4/ipt_layer7.h linux-2.4.26-layer7-clean/include/linux/netfilter_ipv4/ipt_layer7.h
|
||||
--- linux-2.4.26-stock/include/linux/netfilter_ipv4/ipt_layer7.h 1969-12-31 18:00:00.000000000 -0600
|
||||
+++ linux-2.4.26-layer7-clean/include/linux/netfilter_ipv4/ipt_layer7.h 2004-06-21 00:18:28.000000000 -0500
|
||||
diff -Nurp linux-2.4.30/include/linux/netfilter_ipv4/ipt_layer7.h linux-2.4.30-layer7/include/linux/netfilter_ipv4/ipt_layer7.h
|
||||
--- linux-2.4.30/include/linux/netfilter_ipv4/ipt_layer7.h 1969-12-31 18:00:00.000000000 -0600
|
||||
+++ linux-2.4.30-layer7/include/linux/netfilter_ipv4/ipt_layer7.h 2005-05-03 18:37:03.000000000 -0500
|
||||
@@ -0,0 +1,26 @@
|
||||
+/*
|
||||
+ By Matthew Strait <quadong@users.sf.net>, Dec 2003.
|
||||
|
|
@ -76,9 +76,9 @@ diff -Nurp linux-2.4.26-stock/include/linux/netfilter_ipv4/ipt_layer7.h linux-2.
|
|||
+};
|
||||
+
|
||||
+#endif /* _IPT_LAYER7_H */
|
||||
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/Config.in linux-2.4.26-layer7-clean/net/ipv4/netfilter/Config.in
|
||||
--- linux-2.4.26-stock/net/ipv4/netfilter/Config.in 2003-08-25 06:44:44.000000000 -0500
|
||||
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/Config.in 2004-06-21 00:15:23.000000000 -0500
|
||||
diff -Nurp linux-2.4.30/net/ipv4/netfilter/Config.in linux-2.4.30-layer7/net/ipv4/netfilter/Config.in
|
||||
--- linux-2.4.30/net/ipv4/netfilter/Config.in 2005-01-19 08:10:13.000000000 -0600
|
||||
+++ linux-2.4.30-layer7/net/ipv4/netfilter/Config.in 2005-05-03 18:37:03.000000000 -0500
|
||||
@@ -43,6 +43,10 @@ if [ "$CONFIG_IP_NF_IPTABLES" != "n" ];
|
||||
if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
|
||||
dep_tristate ' Unclean match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_UNCLEAN $CONFIG_IP_NF_IPTABLES
|
||||
|
|
@ -90,29 +90,27 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/Config.in linux-2.4.26-layer7-c
|
|||
fi
|
||||
# The targets
|
||||
dep_tristate ' Packet filtering' CONFIG_IP_NF_FILTER $CONFIG_IP_NF_IPTABLES
|
||||
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/Makefile linux-2.4.26-layer7-clean/net/ipv4/netfilter/Makefile
|
||||
--- linux-2.4.26-stock/net/ipv4/netfilter/Makefile 2003-08-25 06:44:44.000000000 -0500
|
||||
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/Makefile 2004-06-21 00:15:22.000000000 -0500
|
||||
@@ -87,6 +87,8 @@ obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += i
|
||||
diff -Nurp linux-2.4.30/net/ipv4/netfilter/Makefile linux-2.4.30-layer7/net/ipv4/netfilter/Makefile
|
||||
--- linux-2.4.30/net/ipv4/netfilter/Makefile 2003-08-25 06:44:44.000000000 -0500
|
||||
+++ linux-2.4.30-layer7/net/ipv4/netfilter/Makefile 2005-05-03 18:44:12.000000000 -0500
|
||||
@@ -86,6 +86,7 @@ obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_s
|
||||
obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
|
||||
obj-$(CONFIG_IP_NF_MATCH_UNCLEAN) += ipt_unclean.o
|
||||
obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
|
||||
|
||||
+obj-$(CONFIG_IP_NF_MATCH_LAYER7) += ipt_layer7.o
|
||||
+
|
||||
|
||||
# targets
|
||||
obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
|
||||
obj-$(CONFIG_IP_NF_TARGET_MIRROR) += ipt_MIRROR.o
|
||||
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_core.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/ip_conntrack_core.c
|
||||
--- linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_core.c 2004-02-18 07:36:32.000000000 -0600
|
||||
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/ip_conntrack_core.c 2004-06-21 00:15:22.000000000 -0500
|
||||
@@ -339,6 +339,15 @@ destroy_conntrack(struct nf_conntrack *n
|
||||
diff -Nurp linux-2.4.30/net/ipv4/netfilter/ip_conntrack_core.c linux-2.4.30-layer7/net/ipv4/netfilter/ip_conntrack_core.c
|
||||
--- linux-2.4.30/net/ipv4/netfilter/ip_conntrack_core.c 2005-04-03 20:42:20.000000000 -0500
|
||||
+++ linux-2.4.30-layer7/net/ipv4/netfilter/ip_conntrack_core.c 2005-05-03 18:37:03.000000000 -0500
|
||||
@@ -346,6 +346,14 @@ destroy_conntrack(struct nf_conntrack *n
|
||||
}
|
||||
kfree(ct->master);
|
||||
}
|
||||
+
|
||||
+ #if defined(CONFIG_IP_NF_MATCH_LAYER7) || defined(CONFIG_IP_NF_MATCH_LAYER7_MODULE)
|
||||
+ /* This ought to get free'd somewhere. How about here? */
|
||||
+ if(ct->layer7.app_proto) /* this is sufficient, right? */
|
||||
+ if(ct->layer7.app_proto)
|
||||
+ kfree(ct->layer7.app_proto);
|
||||
+ if(ct->layer7.app_data)
|
||||
+ kfree(ct->layer7.app_data);
|
||||
|
|
@ -121,9 +119,9 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_core.c linux-2.4.2
|
|||
WRITE_UNLOCK(&ip_conntrack_lock);
|
||||
|
||||
if (master)
|
||||
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/ip_conntrack_standalone.c
|
||||
--- linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-02-18 07:36:32.000000000 -0600
|
||||
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-06-21 00:15:22.000000000 -0500
|
||||
diff -Nurp linux-2.4.30/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.4.30-layer7/net/ipv4/netfilter/ip_conntrack_standalone.c
|
||||
--- linux-2.4.30/net/ipv4/netfilter/ip_conntrack_standalone.c 2005-04-03 20:42:20.000000000 -0500
|
||||
+++ linux-2.4.30-layer7/net/ipv4/netfilter/ip_conntrack_standalone.c 2005-05-03 18:37:03.000000000 -0500
|
||||
@@ -107,6 +107,13 @@ print_conntrack(char *buffer, struct ip_
|
||||
len += sprintf(buffer + len, "[ASSURED] ");
|
||||
len += sprintf(buffer + len, "use=%u ",
|
||||
|
|
@ -138,17 +136,17 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_standalone.c linux
|
|||
len += sprintf(buffer + len, "\n");
|
||||
|
||||
return len;
|
||||
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/ipt_layer7.c
|
||||
--- linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c 1969-12-31 18:00:00.000000000 -0600
|
||||
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/ipt_layer7.c 2004-06-27 19:06:51.000000000 -0500
|
||||
@@ -0,0 +1,540 @@
|
||||
diff -Nurp linux-2.4.30/net/ipv4/netfilter/ipt_layer7.c linux-2.4.30-layer7/net/ipv4/netfilter/ipt_layer7.c
|
||||
--- linux-2.4.30/net/ipv4/netfilter/ipt_layer7.c 1969-12-31 18:00:00.000000000 -0600
|
||||
+++ linux-2.4.30-layer7/net/ipv4/netfilter/ipt_layer7.c 2005-05-03 18:37:03.000000000 -0500
|
||||
@@ -0,0 +1,557 @@
|
||||
+/*
|
||||
+ Kernel module to match application layer (OSI layer 7)
|
||||
+ data in connections.
|
||||
+
|
||||
+ http://l7-filter.sf.net
|
||||
+
|
||||
+ By Matthew Strait and Ethan Sommer, 2003.
|
||||
+ By Matthew Strait and Ethan Sommer, 2003-2005.
|
||||
+
|
||||
+ This program is free software; you can redistribute it and/or
|
||||
+ modify it under the terms of the GNU General Public License
|
||||
|
|
@ -167,6 +165,7 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
|
|||
+#include <linux/ctype.h>
|
||||
+#include <net/ip.h>
|
||||
+#include <net/tcp.h>
|
||||
+#include <linux/netfilter_ipv4/lockhelp.h>
|
||||
+
|
||||
+#include "regexp/regexp.c"
|
||||
+
|
||||
|
|
@ -178,99 +177,41 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
|
|||
+MODULE_DESCRIPTION("iptables application layer match module");
|
||||
+
|
||||
+#if defined(CONFIG_IP_NF_MATCH_LAYER7_DEBUG)
|
||||
+ #define DPRINTK(format,args...) printk(format,##args)
|
||||
+ #define DPRINTK(format,args...) printk(format,##args)
|
||||
+#else
|
||||
+ #define DPRINTK(format,args...)
|
||||
+ #define DPRINTK(format,args...)
|
||||
+#endif
|
||||
+
|
||||
+#define TOTAL_PACKETS master_conntrack->layer7.numpackets
|
||||
+
|
||||
+/* Number of packets whose data we look at.
|
||||
+This can be modified through /proc/net/layer7_numpackets */
|
||||
+static int num_packets = 8;
|
||||
+
|
||||
+static struct pattern_cache {
|
||||
+ char * regex_string;
|
||||
+ regexp * pattern;
|
||||
+ struct pattern_cache * next;
|
||||
+ char * regex_string;
|
||||
+ regexp * pattern;
|
||||
+ struct pattern_cache * next;
|
||||
+} * first_pattern_cache = NULL;
|
||||
+
|
||||
+/* I'm new to locking. Here are my assumptions:
|
||||
+
|
||||
+- No one is going to write to /proc/net/layer7_numpackets over and over
|
||||
+ within a short period of time, and if they did, nothing awful would happen.
|
||||
+- No one will write to /proc/net/layer7_numpackets over and over very fast;
|
||||
+ if they did, nothing awful would happen.
|
||||
+
|
||||
+- This code will never be processing the same packet twice at the same time,
|
||||
+ because iptables rules need to be traversed in order.
|
||||
+ because iptables rules are traversed in order.
|
||||
+
|
||||
+- It doesn't matter if two packets from different connections are in here at
|
||||
+ the same time, because they don't share any data.
|
||||
+
|
||||
+- It _does_ matter if two packets from the same connection are here at the same
|
||||
+ time. In this case, the things we have to protect are the conntracks and
|
||||
+ the list of compiled patterns.
|
||||
+ time. In this case, we have to protect the conntracks and the list of
|
||||
+ compiled patterns.
|
||||
+*/
|
||||
+DECLARE_RWLOCK(ct_lock);
|
||||
+DECLARE_LOCK(list_lock);
|
||||
+
|
||||
+/* Use instead of regcomp. As we expect to be seeing the same regexps over and
|
||||
+over again, it make sense to cache the results. */
|
||||
+static regexp * compile_and_cache(char * regex_string, char * protocol)
|
||||
+{
|
||||
+ struct pattern_cache * node = first_pattern_cache;
|
||||
+ struct pattern_cache * last_pattern_cache = first_pattern_cache;
|
||||
+ struct pattern_cache * tmp;
|
||||
+ unsigned int len;
|
||||
+
|
||||
+ while (node != NULL) {
|
||||
+ if (!strcmp(node->regex_string, regex_string))
|
||||
+ return node->pattern;
|
||||
+
|
||||
+ last_pattern_cache = node;/* points at the last non-NULL node */
|
||||
+ node = node->next;
|
||||
+ }
|
||||
+
|
||||
+ /* If we reach the end of the list, then we have not yet cached
|
||||
+ the pattern for this regex. Let's do that now.
|
||||
+ Be paranoid about running out of memory to avoid list corruption. */
|
||||
+ tmp = kmalloc(sizeof(struct pattern_cache), GFP_ATOMIC);
|
||||
+
|
||||
+ if(!tmp) {
|
||||
+ printk(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n");
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ tmp->regex_string = kmalloc(strlen(regex_string) + 1, GFP_ATOMIC);
|
||||
+ tmp->pattern = kmalloc(sizeof(struct regexp), GFP_ATOMIC);
|
||||
+
|
||||
+ if(!tmp->regex_string || !tmp->pattern) {
|
||||
+ printk(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n");
|
||||
+ kfree(tmp->regex_string);
|
||||
+ kfree(tmp->pattern);
|
||||
+ kfree(tmp);
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ tmp->next = NULL;
|
||||
+ /* Ok. The new node is all ready now. */
|
||||
+ node = tmp;
|
||||
+
|
||||
+ if(first_pattern_cache == NULL) /* list is empty */
|
||||
+ first_pattern_cache = node; /* make node the beginning */
|
||||
+ else
|
||||
+ last_pattern_cache->next = node; /* attach node to the end */
|
||||
+
|
||||
+ /* copy the string and compile the regex */
|
||||
+ len = strlen(regex_string);
|
||||
+ node->pattern = regcomp(regex_string, &len);
|
||||
+ if ( !node->pattern ) {
|
||||
+ printk(KERN_ERR "layer7: Error compiling regexp \"%s\" (%s)\n",
|
||||
+ regex_string, protocol);
|
||||
+ /* pattern is now cached as NULL, so we won't try again. */
|
||||
+ }
|
||||
+
|
||||
+ strcpy(node->regex_string, regex_string);
|
||||
+ return node->pattern;
|
||||
+}
|
||||
+
|
||||
+#if CONFIG_IP_NF_MATCH_LAYER7_DEBUG
|
||||
+/* Converts an unfriendly string into a friendly one by
|
||||
+replacing unprintables with periods and all whitespace with " ". */
|
||||
|
|
@ -280,9 +221,10 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
|
|||
+ int i;
|
||||
+
|
||||
+ if(!f) {
|
||||
+ printk(KERN_ERR "layer7: out of memory in friendly_print, bailing.\n");
|
||||
+ return NULL;
|
||||
+ }
|
||||
+ if (net_ratelimit())
|
||||
+ printk(KERN_ERR "layer7: out of memory in friendly_print, bailing.\n");
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ for(i = 0; i < strlen(s); i++){
|
||||
+ if(isprint(s[i]) && s[i] < 128) f[i] = s[i];
|
||||
|
|
@ -303,7 +245,8 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
|
|||
+ return (char)(i - 10 + 'a');
|
||||
+ break;
|
||||
+ default:
|
||||
+ printk("Problem in dec2hex\n");
|
||||
+ if (net_ratelimit())
|
||||
+ printk("Problem in dec2hex\n");
|
||||
+ return '\0';
|
||||
+ }
|
||||
+}
|
||||
|
|
@ -314,9 +257,10 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
|
|||
+ int i;
|
||||
+
|
||||
+ if(!g) {
|
||||
+ printk(KERN_ERR "layer7: out of memory in hex_print, bailing.\n");
|
||||
+ return NULL;
|
||||
+ }
|
||||
+ if (net_ratelimit())
|
||||
+ printk(KERN_ERR "layer7: out of memory in hex_print, bailing.\n");
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ for(i = 0; i < strlen(s); i++) {
|
||||
+ g[i*3 ] = dec2hex(s[i]/16);
|
||||
|
|
@ -329,17 +273,68 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
|
|||
+}
|
||||
+#endif // DEBUG
|
||||
+
|
||||
+/* Use instead of regcomp. As we expect to be seeing the same regexps over and
|
||||
+over again, it make sense to cache the results. */
|
||||
+static regexp * compile_and_cache(char * regex_string, char * protocol)
|
||||
+{
|
||||
+ struct pattern_cache * node = first_pattern_cache;
|
||||
+ struct pattern_cache * last_pattern_cache = first_pattern_cache;
|
||||
+ struct pattern_cache * tmp;
|
||||
+ unsigned int len;
|
||||
+
|
||||
+/* The following functions are here in case we get ported into an environment
|
||||
+(ebtables?) where skb->nh.iph->protocol isn't set. They assume that skb->data
|
||||
+points at the beginning of the IP datagram, which is true for iptables (but in
|
||||
+QoS it points to the beginning of the Ethernet frame). */
|
||||
+#if 0
|
||||
+#define IP_PROTO_OFFSET 9
|
||||
+static int is_tcp_over_ipv4 (const struct sk_buff *skb){return(skb->data[IP_PROTO_OFFSET]==IPPROTO_TCP );}
|
||||
+static int is_udp_over_ipv4 (const struct sk_buff *skb){return(skb->data[IP_PROTO_OFFSET]==IPPROTO_UDP );}
|
||||
+static int is_icmp_over_ipv4(const struct sk_buff *skb){return(skb->data[IP_PROTO_OFFSET]==IPPROTO_ICMP);}
|
||||
+#endif
|
||||
+ while (node != NULL) {
|
||||
+ if (!strcmp(node->regex_string, regex_string))
|
||||
+ return node->pattern;
|
||||
+
|
||||
+ last_pattern_cache = node;/* points at the last non-NULL node */
|
||||
+ node = node->next;
|
||||
+ }
|
||||
+
|
||||
+ /* If we reach the end of the list, then we have not yet cached
|
||||
+ the pattern for this regex. Let's do that now.
|
||||
+ Be paranoid about running out of memory to avoid list corruption. */
|
||||
+ tmp = kmalloc(sizeof(struct pattern_cache), GFP_ATOMIC);
|
||||
+
|
||||
+ if(!tmp) {
|
||||
+ if (net_ratelimit())
|
||||
+ printk(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n");
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ tmp->regex_string = kmalloc(strlen(regex_string) + 1, GFP_ATOMIC);
|
||||
+ tmp->pattern = kmalloc(sizeof(struct regexp), GFP_ATOMIC);
|
||||
+ tmp->next = NULL;
|
||||
+
|
||||
+ if(!tmp->regex_string || !tmp->pattern) {
|
||||
+ if (net_ratelimit())
|
||||
+ printk(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n");
|
||||
+ kfree(tmp->regex_string);
|
||||
+ kfree(tmp->pattern);
|
||||
+ kfree(tmp);
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ /* Ok. The new node is all ready now. */
|
||||
+ node = tmp;
|
||||
+
|
||||
+ if(first_pattern_cache == NULL) /* list is empty */
|
||||
+ first_pattern_cache = node; /* make node the beginning */
|
||||
+ else
|
||||
+ last_pattern_cache->next = node; /* attach node to the end */
|
||||
+
|
||||
+ /* copy the string and compile the regex */
|
||||
+ len = strlen(regex_string);
|
||||
+ DPRINTK("About to compile this: \"%s\"\n", regex_string);
|
||||
+ node->pattern = regcomp(regex_string, &len);
|
||||
+ if ( !node->pattern ) {
|
||||
+ if (net_ratelimit())
|
||||
+ printk(KERN_ERR "layer7: Error compiling regexp \"%s\" (%s)\n", regex_string, protocol);
|
||||
+ /* pattern is now cached as NULL, so we won't try again. */
|
||||
+ }
|
||||
+
|
||||
+ strcpy(node->regex_string, regex_string);
|
||||
+ return node->pattern;
|
||||
+}
|
||||
+
|
||||
+static int can_handle(const struct sk_buff *skb)
|
||||
+{
|
||||
|
|
@ -357,73 +352,86 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
|
|||
+{
|
||||
+ /* In case we are ported somewhere (ebtables?) where skb->nh.iph
|
||||
+ isn't set, this can be gotten from 4*(skb->data[0] & 0x0f) as well. */
|
||||
+ int ip_hl = 4*skb->nh.iph->ihl;
|
||||
+ int ip_hl = 4*skb->nh.iph->ihl;
|
||||
+
|
||||
+ if( skb->nh.iph->protocol == IPPROTO_TCP ) {
|
||||
+ /* 12 == offset into TCP header for the header length field.
|
||||
+ if( skb->nh.iph->protocol == IPPROTO_TCP ) {
|
||||
+ /* 12 == offset into TCP header for the header length field.
|
||||
+ Can't get this with skb->h.th->doff because the tcphdr
|
||||
+ struct doesn't get set when routing (this is confirmed to be
|
||||
+ true in Netfilter as well as QoS.) */
|
||||
+ int tcp_hl = 4*(skb->data[ip_hl + 12] >> 4);
|
||||
+ int tcp_hl = 4*(skb->data[ip_hl + 12] >> 4);
|
||||
+
|
||||
+ return ip_hl + tcp_hl;
|
||||
+ } else if( skb->nh.iph->protocol == IPPROTO_UDP ) {
|
||||
+ return ip_hl + 8; /* UDP header is always 8 bytes */
|
||||
+ } else if( skb->nh.iph->protocol == IPPROTO_ICMP ) {
|
||||
+ return ip_hl + 8; /* ICMP header is 8 bytes */
|
||||
+ } else {
|
||||
+ printk(KERN_ERR "layer7: tried to handle unknown protocol!\n");
|
||||
+ return ip_hl + 8; /* something reasonable */
|
||||
+ }
|
||||
+ return ip_hl + tcp_hl;
|
||||
+ } else if( skb->nh.iph->protocol == IPPROTO_UDP ) {
|
||||
+ return ip_hl + 8; /* UDP header is always 8 bytes */
|
||||
+ } else if( skb->nh.iph->protocol == IPPROTO_ICMP ) {
|
||||
+ return ip_hl + 8; /* ICMP header is 8 bytes */
|
||||
+ } else {
|
||||
+ if (net_ratelimit())
|
||||
+ printk(KERN_ERR "layer7: tried to handle unknown protocol!\n");
|
||||
+ return ip_hl + 8; /* something reasonable */
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+/* handles whether there's a match when we aren't appending data anymore */
|
||||
+static int match_no_append(struct ip_conntrack * conntrack,
|
||||
+ struct ip_conntrack * master_conntrack,
|
||||
+static int match_no_append(struct ip_conntrack * conntrack, struct ip_conntrack * master_conntrack,
|
||||
+ enum ip_conntrack_info ctinfo, enum ip_conntrack_info master_ctinfo,
|
||||
+ struct ipt_layer7_info * info)
|
||||
+{
|
||||
+ /* If we're in here, we don't care about the app data anymore */
|
||||
+ /* If we're in here, throw the app data away */
|
||||
+ WRITE_LOCK(&ct_lock);
|
||||
+ if(master_conntrack->layer7.app_data != NULL) {
|
||||
+
|
||||
+ #ifdef CONFIG_IP_NF_MATCH_LAYER7_DEBUG
|
||||
+ if(!master_conntrack->layer7.app_proto) {
|
||||
+ char * f = friendly_print(master_conntrack->layer7.app_data);
|
||||
+ char * g = hex_print(master_conntrack->layer7.app_data);
|
||||
+ DPRINTK("\nGave up on the %d length stream: \n%s\n",
|
||||
+ master_conntrack->layer7.app_data_len, f);
|
||||
+ DPRINTK("\nIn hex: %s\n", g);
|
||||
+ kfree(f);
|
||||
+ kfree(g);
|
||||
+ }
|
||||
+ #endif
|
||||
+ #ifdef CONFIG_IP_NF_MATCH_LAYER7_DEBUG
|
||||
+ if(!master_conntrack->layer7.app_proto) {
|
||||
+ char * f = friendly_print(master_conntrack->layer7.app_data);
|
||||
+ char * g = hex_print(master_conntrack->layer7.app_data);
|
||||
+ DPRINTK("\nl7-filter gave up after %d bytes (%d packets):\n%s\n",
|
||||
+ strlen(f),
|
||||
+ TOTAL_PACKETS, f);
|
||||
+ kfree(f);
|
||||
+ DPRINTK("In hex: %s\n", g);
|
||||
+ kfree(g);
|
||||
+ }
|
||||
+ #endif
|
||||
+
|
||||
+ kfree(master_conntrack->layer7.app_data);
|
||||
+ master_conntrack->layer7.app_data = NULL; /* don't free again */
|
||||
+ }
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
+
|
||||
+ /* Is top-level master (possibly self) classified? */
|
||||
+ if(master_conntrack->layer7.app_proto) {
|
||||
+ if(!strcmp(master_conntrack->layer7.app_proto, info->protocol))
|
||||
+ {
|
||||
+ /* set own .protocol (for /proc/net/ip_conntrack) */
|
||||
+ WRITE_LOCK(&ct_lock);
|
||||
+ if(!conntrack->layer7.app_proto) {
|
||||
+ conntrack->layer7.app_proto = kmalloc(strlen(info->protocol), GFP_ATOMIC);
|
||||
+ if(!conntrack->layer7.app_proto){
|
||||
+ printk(KERN_ERR "layer7: out of memory in match_no_append, bailing.\n");
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
+ strcpy(conntrack->layer7.app_proto, info->protocol);
|
||||
+ }
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
+ if(master_conntrack->layer7.app_proto){
|
||||
+ /* Here child connections set their .app_proto (for /proc/net/ip_conntrack) */
|
||||
+ WRITE_LOCK(&ct_lock);
|
||||
+ if(!conntrack->layer7.app_proto) {
|
||||
+ conntrack->layer7.app_proto = kmalloc(strlen(master_conntrack->layer7.app_proto)+1, GFP_ATOMIC);
|
||||
+ if(!conntrack->layer7.app_proto){
|
||||
+ if (net_ratelimit())
|
||||
+ printk(KERN_ERR "layer7: out of memory in match_no_append, bailing.\n");
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
+ return 1;
|
||||
+ }
|
||||
+ strcpy(conntrack->layer7.app_proto, master_conntrack->layer7.app_proto);
|
||||
+ }
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
+
|
||||
+ return 1;
|
||||
+ } else return 0;
|
||||
+ } else return 0; /* no clasification */
|
||||
+ return (!strcmp(master_conntrack->layer7.app_proto, info->protocol));
|
||||
+ }
|
||||
+ else {
|
||||
+ /* If not classified, set to "unknown" to distinguish from
|
||||
+ connections that are still being tested. */
|
||||
+ WRITE_LOCK(&ct_lock);
|
||||
+ master_conntrack->layer7.app_proto = kmalloc(strlen("unknown")+1, GFP_ATOMIC);
|
||||
+ if(!master_conntrack->layer7.app_proto){
|
||||
+ if (net_ratelimit())
|
||||
+ printk(KERN_ERR "layer7: out of memory in match_no_append, bailing.\n");
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
+ return 1;
|
||||
+ }
|
||||
+ strcpy(master_conntrack->layer7.app_proto, "unknown");
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
+ return 0;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+/* add the new app data to the conntrack. Return number of bytes added. */
|
||||
|
|
@ -433,8 +441,8 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
|
|||
+ int length = 0, i;
|
||||
+ int oldlength = master_conntrack->layer7.app_data_len;
|
||||
+
|
||||
+ /* Strip nulls. Make everything lower case (our regex lib doesn't
|
||||
+ do case insensitivity). Add it to the end of the current data. */
|
||||
+ /* Strip nulls. Make everything lower case (our regex lib doesn't
|
||||
+ do case insensitivity). Add it to the end of the current data. */
|
||||
+ for(i = 0; i < CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN-oldlength-1 &&
|
||||
+ i < appdatalen; i++) {
|
||||
+ if(app_data[i] != '\0') {
|
||||
|
|
@ -453,89 +461,96 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
|
|||
+
|
||||
+/* Returns true on match and false otherwise. */
|
||||
+static int match(/* const */struct sk_buff *skb, const struct net_device *in,
|
||||
+ const struct net_device *out, const void *matchinfo,
|
||||
+ int offset, int *hotdrop)
|
||||
+ const struct net_device *out, const void *matchinfo,
|
||||
+ int offset, int *hotdrop)
|
||||
+{
|
||||
+ struct ipt_layer7_info * info = (struct ipt_layer7_info *)matchinfo;
|
||||
+ enum ip_conntrack_info master_ctinfo, ctinfo;
|
||||
+ struct ip_conntrack *master_conntrack, *conntrack;
|
||||
+ enum ip_conntrack_info master_ctinfo, ctinfo;
|
||||
+ struct ip_conntrack *master_conntrack, *conntrack;
|
||||
+ unsigned char * app_data;
|
||||
+ unsigned int pattern_result, appdatalen;
|
||||
+ regexp * comppattern;
|
||||
+
|
||||
+ if(!can_handle(skb)){
|
||||
+ DPRINTK("layer7: This is some protocol I can't handle\n");
|
||||
+ DPRINTK("layer7: This is some protocol I can't handle.\n");
|
||||
+ return info->invert;
|
||||
+ }
|
||||
+
|
||||
+ LOCK_BH(&list_lock);
|
||||
+ comppattern = compile_and_cache(info->pattern, info->protocol);
|
||||
+ UNLOCK_BH(&list_lock);
|
||||
+ /* the return value gets checked later, when we're ready to use it */
|
||||
+
|
||||
+ app_data = skb->data + app_data_offset(skb);
|
||||
+ appdatalen = skb->tail - app_data;
|
||||
+
|
||||
+ /* Treat the parent and all its children together as one connection,
|
||||
+ except for the purpose of setting conntrack->layer7.pattern in the
|
||||
+ except for the purpose of setting conntrack->layer7.app_proto in the
|
||||
+ actual connection. This makes /proc/net/ip_conntrack somewhat more
|
||||
+ satisfying. */
|
||||
+ if(!(conntrack = ip_conntrack_get((struct sk_buff *)skb, &ctinfo)) ||
|
||||
+ !(master_conntrack = ip_conntrack_get((struct sk_buff *)skb, &master_ctinfo))) {
|
||||
+ DPRINTK("layer7: packet is not from a known connection, giving up.\n");
|
||||
+ if(!(conntrack = ip_conntrack_get((struct sk_buff *)skb, &ctinfo)) ||
|
||||
+ !(master_conntrack = ip_conntrack_get((struct sk_buff *)skb, &master_ctinfo))) {
|
||||
+ DPRINTK("layer7: packet is not from a known connection, giving up.\n");
|
||||
+ return info->invert;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ /* Try to get a master conntrack (and its master etc) for FTP, etc. */
|
||||
+ while (master_ct(master_conntrack) != NULL)
|
||||
+ master_conntrack = master_ct(master_conntrack);
|
||||
+ /* Try to get a master conntrack (and its master etc) for FTP, etc. */
|
||||
+ while (master_ct(master_conntrack) != NULL)
|
||||
+ master_conntrack = master_ct(master_conntrack);
|
||||
+
|
||||
+ /* skb->cb[0] == seen. Avoid doing things twice if there are two layer7
|
||||
+ rules. I'm not sure that using cb for this purpose is correct, although
|
||||
+ it says "put your private variables there" and this seems to qualify.
|
||||
+ But it doesn't look like it's being used for anything else in the
|
||||
+ sk_buffs that make it here. I'm open to suggestions for how to be able
|
||||
+ to write to cb without making the compiler angry. That I can't figure
|
||||
+ this out is an argument against this being correct. */
|
||||
+ if(!skb->cb[0]){
|
||||
+ WRITE_LOCK(&ct_lock);
|
||||
+ master_conntrack->layer7.numpackets++;/*starts at 0 via memset*/
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
+ }
|
||||
+
|
||||
+ /* if we've classified it or seen too many packets */
|
||||
+ if(TOTAL_PACKETS > num_packets ||
|
||||
+ master_conntrack->layer7.app_proto) {
|
||||
+
|
||||
+ pattern_result = match_no_append(conntrack, master_conntrack, ctinfo, master_ctinfo, info);
|
||||
+
|
||||
+ /* skb->cb[0] == seen. Avoid doing things twice if there are two l7
|
||||
+ rules. I'm not sure that using cb for this purpose is correct, although
|
||||
+ it says "put your private variables there". But it doesn't look like it
|
||||
+ is being used for anything else in the skbs that make it here. How can
|
||||
+ I write to cb without making the compiler angry? */
|
||||
+ skb->cb[0] = 1; /* marking it seen here is probably irrelevant, but consistant */
|
||||
+
|
||||
+ return (pattern_result ^ info->invert);
|
||||
+ }
|
||||
+
|
||||
+ if(skb_is_nonlinear(skb)){
|
||||
+ if(skb_linearize(skb, GFP_ATOMIC) != 0){
|
||||
+ if (net_ratelimit())
|
||||
+ printk(KERN_ERR "layer7: failed to linearize packet, bailing.\n");
|
||||
+ return info->invert;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ /* now that the skb is linearized, it's safe to set these. */
|
||||
+ app_data = skb->data + app_data_offset(skb);
|
||||
+ appdatalen = skb->tail - app_data;
|
||||
+
|
||||
+ LOCK_BH(&list_lock);
|
||||
+ /* the return value gets checked later, when we're ready to use it */
|
||||
+ comppattern = compile_and_cache(info->pattern, info->protocol);
|
||||
+ UNLOCK_BH(&list_lock);
|
||||
+
|
||||
+ /* On the first packet of a connection, allocate space for app data */
|
||||
+ WRITE_LOCK(&ct_lock);
|
||||
+ if(master_conntrack->layer7.numpackets == 1 && !skb->cb[0]) {
|
||||
+ if(TOTAL_PACKETS == 1 && !skb->cb[0] && !master_conntrack->layer7.app_data) {
|
||||
+ master_conntrack->layer7.app_data = kmalloc(CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN, GFP_ATOMIC);
|
||||
+ if(!master_conntrack->layer7.app_data){
|
||||
+ printk(KERN_ERR "layer7: out of memory in match, bailing.\n");
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
+ return info->invert;
|
||||
+ }
|
||||
+ if(!master_conntrack->layer7.app_data){
|
||||
+ if (net_ratelimit())
|
||||
+ printk(KERN_ERR "layer7: out of memory in match, bailing.\n");
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
+ return info->invert;
|
||||
+ }
|
||||
+
|
||||
+ master_conntrack->layer7.app_data[0] = '\0';
|
||||
+ }
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
+
|
||||
+ /* if we've classified it or seen too many packets */
|
||||
+ if(master_conntrack->layer7.numpackets > num_packets ||
|
||||
+ master_conntrack->layer7.app_proto) {
|
||||
+
|
||||
+ pattern_result = match_no_append(conntrack, master_conntrack, info);
|
||||
+
|
||||
+ /* mark the packet seen (probably irrelevant, but consistant) */
|
||||
+ skb->cb[0] = 1;
|
||||
+
|
||||
+ return (pattern_result ^ info->invert);
|
||||
+ }
|
||||
+
|
||||
+ /* Can end up here, but unallocated, if numpackets is increased during
|
||||
+ /* Can be here, but unallocated, if numpackets is increased near
|
||||
+ the beginning of a connection */
|
||||
+ if(master_conntrack->layer7.app_data == NULL)
|
||||
+ return (info->invert); /* unmatched */
|
||||
+
|
||||
+ if(!skb->cb[0]) {
|
||||
+ int newbytes;
|
||||
+ if(!skb->cb[0]){
|
||||
+ int newbytes;
|
||||
+ WRITE_LOCK(&ct_lock);
|
||||
+ newbytes = add_data(master_conntrack, app_data, appdatalen);
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
|
|
@ -547,37 +562,41 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
|
|||
+ }
|
||||
+ }
|
||||
+
|
||||
+ /* If looking for "unknown", then never match. "Unknown" means that
|
||||
+ we've given up; we're still trying with these packets. */
|
||||
+ if(!strcmp(info->protocol, "unknown")) {
|
||||
+ pattern_result = 0;
|
||||
+ /* If the regexp failed to compile, don't bother running it */
|
||||
+ if(comppattern && regexec(comppattern, master_conntrack->layer7.app_data)) {
|
||||
+ } else if(comppattern && regexec(comppattern, master_conntrack->layer7.app_data)) {
|
||||
+ DPRINTK("layer7: regexec positive: %s!\n", info->protocol);
|
||||
+ pattern_result = 1;
|
||||
+ } else pattern_result = 0;
|
||||
+
|
||||
+ if(pattern_result) {
|
||||
+ WRITE_LOCK(&ct_lock);
|
||||
+ conntrack->layer7.app_proto = kmalloc(strlen(info->protocol), GFP_ATOMIC);
|
||||
+ if(!conntrack->layer7.app_proto){
|
||||
+ printk(KERN_ERR "layer7: out of memory in match, bailing.\n");
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
+ return (pattern_result ^ info->invert);
|
||||
+ }
|
||||
+
|
||||
+ strcpy(conntrack->layer7.app_proto, info->protocol);
|
||||
+ master_conntrack->layer7.app_proto = kmalloc(strlen(info->protocol)+1, GFP_ATOMIC);
|
||||
+ if(!master_conntrack->layer7.app_proto){
|
||||
+ if (net_ratelimit())
|
||||
+ printk(KERN_ERR "layer7: out of memory in match, bailing.\n");
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
+ return (pattern_result ^ info->invert);
|
||||
+ }
|
||||
+ strcpy(master_conntrack->layer7.app_proto, info->protocol);
|
||||
+ WRITE_UNLOCK(&ct_lock);
|
||||
+ }
|
||||
+
|
||||
+ /* mark the packet seen */
|
||||
+ skb->cb[0] = 1;
|
||||
+
|
||||
+ return (pattern_result ^ info->invert);
|
||||
+ return (pattern_result ^ info->invert);
|
||||
+}
|
||||
+
|
||||
+static int checkentry(const char *tablename, const struct ipt_ip *ip,
|
||||
+ void *matchinfo, unsigned int matchsize, unsigned int hook_mask)
|
||||
+ void *matchinfo, unsigned int matchsize, unsigned int hook_mask)
|
||||
+{
|
||||
+ if (matchsize != IPT_ALIGN(sizeof(struct ipt_layer7_info)))
|
||||
+ return 0;
|
||||
+ return 1;
|
||||
+ if (matchsize != IPT_ALIGN(sizeof(struct ipt_layer7_info)))
|
||||
+ return 0;
|
||||
+ return 1;
|
||||
+}
|
||||
+
|
||||
+static struct ipt_match layer7_match = {
|
||||
|
|
@ -590,87 +609,83 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
|
|||
+/* taken from drivers/video/modedb.c */
|
||||
+static int my_atoi(const char *s)
|
||||
+{
|
||||
+ int val = 0;
|
||||
+ int val = 0;
|
||||
+
|
||||
+ for (;; s++) {
|
||||
+ switch (*s) {
|
||||
+ case '0'...'9':
|
||||
+ val = 10*val+(*s-'0');
|
||||
+ break;
|
||||
+ default:
|
||||
+ return val;
|
||||
+ }
|
||||
+ }
|
||||
+ for (;; s++) {
|
||||
+ switch (*s) {
|
||||
+ case '0'...'9':
|
||||
+ val = 10*val+(*s-'0');
|
||||
+ break;
|
||||
+ default:
|
||||
+ return val;
|
||||
+ }
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+/* write out num_packets to userland. */
|
||||
+static int layer7_read_proc(char* page, char ** start, off_t off, int count,
|
||||
+ int* eof, void * data)
|
||||
+ int* eof, void * data)
|
||||
+{
|
||||
+ if(num_packets > 99)
|
||||
+ printk(KERN_ERR "layer7: NOT REACHED. num_packets too big\n");
|
||||
+
|
||||
+ page[0] = num_packets/10 + '0';
|
||||
+ page[1] = num_packets%10 + '0';
|
||||
+ page[2] = '\n';
|
||||
+ page[3] = '\0';
|
||||
+
|
||||
+ *eof=1;
|
||||
+ if(num_packets > 99 && net_ratelimit())
|
||||
+ printk(KERN_ERR "layer7: NOT REACHED. num_packets too big\n");
|
||||
+
|
||||
+ page[0] = num_packets/10 + '0';
|
||||
+ page[1] = num_packets%10 + '0';
|
||||
+ page[2] = '\n';
|
||||
+ page[3] = '\0';
|
||||
+
|
||||
+ *eof=1;
|
||||
+
|
||||
+ return 3;
|
||||
+ return 3;
|
||||
+}
|
||||
+
|
||||
+/* Read in num_packets from userland */
|
||||
+static int layer7_write_proc(struct file* file, const char* buffer,
|
||||
+ unsigned long count, void *data)
|
||||
+ unsigned long count, void *data)
|
||||
+{
|
||||
+ char * foo = kmalloc(count, GFP_ATOMIC);
|
||||
+ char * foo = kmalloc(count, GFP_ATOMIC);
|
||||
+
|
||||
+ if(!foo){
|
||||
+ printk(KERN_ERR "layer7: out of memory, bailing. num_packets unchanged.\n");
|
||||
+ return count;
|
||||
+ }
|
||||
+ if(!foo){
|
||||
+ if (net_ratelimit())
|
||||
+ printk(KERN_ERR "layer7: out of memory, bailing. num_packets unchanged.\n");
|
||||
+ return count;
|
||||
+ }
|
||||
+
|
||||
+ /* copy in the data from userland */
|
||||
+ copy_from_user(foo, buffer, count);
|
||||
+ copy_from_user(foo, buffer, count);
|
||||
+
|
||||
+ num_packets = my_atoi(foo);
|
||||
+ num_packets = my_atoi(foo);
|
||||
+ kfree (foo);
|
||||
+
|
||||
+ /* This has an arbitrary limit to make the math easier. I'm lazy.
|
||||
+ /* This has an arbitrary limit to make the math easier. I'm lazy.
|
||||
+ But anyway, 99 is a LOT! If you want more, you're doing it wrong! */
|
||||
+ if(num_packets > 99) {
|
||||
+ printk(KERN_WARNING "layer7: num_packets can't be > 99.\n");
|
||||
+ num_packets = 99;
|
||||
+ } else if(num_packets < 1) {
|
||||
+ printk(KERN_WARNING "layer7: num_packets can't be < 1.\n");
|
||||
+ num_packets = 1;
|
||||
+ }
|
||||
+ if(num_packets > 99) {
|
||||
+ printk(KERN_WARNING "layer7: num_packets can't be > 99.\n");
|
||||
+ num_packets = 99;
|
||||
+ } else if(num_packets < 1) {
|
||||
+ printk(KERN_WARNING "layer7: num_packets can't be < 1.\n");
|
||||
+ num_packets = 1;
|
||||
+ }
|
||||
+
|
||||
+ return count;
|
||||
+ return count;
|
||||
+}
|
||||
+
|
||||
+/* register the proc file */
|
||||
+static void layer7_init_proc(void)
|
||||
+{
|
||||
+ struct proc_dir_entry* entry;
|
||||
+
|
||||
+ /* create the file */
|
||||
+ entry = create_proc_entry("layer7_numpackets", 0644, proc_net);
|
||||
+
|
||||
+ /* set the callback functions */
|
||||
+ struct proc_dir_entry* entry;
|
||||
+ entry = create_proc_entry("layer7_numpackets", 0644, proc_net);
|
||||
+ entry->read_proc = layer7_read_proc;
|
||||
+ entry->write_proc = layer7_write_proc;
|
||||
+}
|
||||
+
|
||||
+static void layer7_cleanup_proc(void)
|
||||
+{
|
||||
+ remove_proc_entry("layer7_numpackets", proc_net);
|
||||
+ remove_proc_entry("layer7_numpackets", proc_net);
|
||||
+}
|
||||
+
|
||||
+static int __init init(void)
|
||||
+{
|
||||
+ layer7_init_proc();
|
||||
+ layer7_init_proc();
|
||||
+ return ipt_register_match(&layer7_match);
|
||||
+}
|
||||
+
|
||||
|
|
@ -682,9 +697,9 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
|
|||
+
|
||||
+module_init(init);
|
||||
+module_exit(fini);
|
||||
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regexp.c
|
||||
--- linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.c 1969-12-31 18:00:00.000000000 -0600
|
||||
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regexp.c 2004-06-27 19:07:00.000000000 -0500
|
||||
diff -Nurp linux-2.4.30/net/ipv4/netfilter/regexp/regexp.c linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regexp.c
|
||||
--- linux-2.4.30/net/ipv4/netfilter/regexp/regexp.c 1969-12-31 18:00:00.000000000 -0600
|
||||
+++ linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regexp.c 2005-05-03 18:37:03.000000000 -0500
|
||||
@@ -0,0 +1,1195 @@
|
||||
+/*
|
||||
+ * regcomp and regexec -- regsub and regerror are elsewhere
|
||||
|
|
@ -1881,10 +1896,10 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.c linux-2.4.26-la
|
|||
+#endif
|
||||
+
|
||||
+
|
||||
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.h linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regexp.h
|
||||
--- linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.h 1969-12-31 18:00:00.000000000 -0600
|
||||
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regexp.h 2004-06-27 19:07:00.000000000 -0500
|
||||
@@ -0,0 +1,27 @@
|
||||
diff -Nurp linux-2.4.30/net/ipv4/netfilter/regexp/regexp.h linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regexp.h
|
||||
--- linux-2.4.30/net/ipv4/netfilter/regexp/regexp.h 1969-12-31 18:00:00.000000000 -0600
|
||||
+++ linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regexp.h 2005-05-03 18:37:03.000000000 -0500
|
||||
@@ -0,0 +1,40 @@
|
||||
+/*
|
||||
+ * Definitions etc. for regexp(3) routines.
|
||||
+ *
|
||||
|
|
@ -1895,6 +1910,19 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.h linux-2.4.26-la
|
|||
+#ifndef REGEXP_H
|
||||
+#define REGEXP_H
|
||||
+
|
||||
+/*
|
||||
+http://www.opensource.apple.com/darwinsource/10.3/expect-1/expect/expect.h ,
|
||||
+which contains a version of this library, says:
|
||||
+
|
||||
+ *
|
||||
+ * NSUBEXP must be at least 10, and no greater than 117 or the parser
|
||||
+ * will not work properly.
|
||||
+ *
|
||||
+
|
||||
+However, it looks rather like this library is limited to 10. If you think
|
||||
+otherwise, let us know.
|
||||
+*/
|
||||
+
|
||||
+#define NSUBEXP 10
|
||||
+typedef struct regexp {
|
||||
+ char *startp[NSUBEXP];
|
||||
|
|
@ -1912,18 +1940,18 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.h linux-2.4.26-la
|
|||
+void regerror(char *s);
|
||||
+
|
||||
+#endif
|
||||
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regmagic.h linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regmagic.h
|
||||
--- linux-2.4.26-stock/net/ipv4/netfilter/regexp/regmagic.h 1969-12-31 18:00:00.000000000 -0600
|
||||
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regmagic.h 2004-06-27 19:07:00.000000000 -0500
|
||||
diff -Nurp linux-2.4.30/net/ipv4/netfilter/regexp/regmagic.h linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regmagic.h
|
||||
--- linux-2.4.30/net/ipv4/netfilter/regexp/regmagic.h 1969-12-31 18:00:00.000000000 -0600
|
||||
+++ linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regmagic.h 2005-05-03 18:37:03.000000000 -0500
|
||||
@@ -0,0 +1,5 @@
|
||||
+/*
|
||||
+ * The first byte of the regexp internal "program" is actually this magic
|
||||
+ * number; the start node begins in the second byte.
|
||||
+ */
|
||||
+#define MAGIC 0234
|
||||
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regsub.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regsub.c
|
||||
--- linux-2.4.26-stock/net/ipv4/netfilter/regexp/regsub.c 1969-12-31 18:00:00.000000000 -0600
|
||||
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regsub.c 2004-06-27 19:07:00.000000000 -0500
|
||||
diff -Nurp linux-2.4.30/net/ipv4/netfilter/regexp/regsub.c linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regsub.c
|
||||
--- linux-2.4.30/net/ipv4/netfilter/regexp/regsub.c 1969-12-31 18:00:00.000000000 -0600
|
||||
+++ linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regsub.c 2005-05-03 18:37:03.000000000 -0500
|
||||
@@ -0,0 +1,95 @@
|
||||
+/*
|
||||
+ * regsub
|
||||
|
|
|
|||
Loading…
Reference in a new issue