hsist
/
freifunkist-firmware
6
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netfilter: support /proc conntrack flushing of specific ip addresses

Browse Source 
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

SVN-Revision: 42092
master
Jo-Philipp Wich 10 years ago
parent 9aeb0cff11
commit 56be9f4a9a
6 changed files with 282 additions and 60 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 53
      target/linux/generic/patches-3.10/604-netfilter_conntrack_flush.patch
  2. 53
      target/linux/generic/patches-3.13/604-netfilter_conntrack_flush.patch
  3. 53
      target/linux/generic/patches-3.14/604-netfilter_conntrack_flush.patch
  4. 53
      target/linux/generic/patches-3.3/604-netfilter_conntrack_flush.patch
  5. 53
      target/linux/generic/patches-3.8/604-netfilter_conntrack_flush.patch
  6. 53
      target/linux/generic/patches-3.9/604-netfilter_conntrack_flush.patch

53
target/linux/generic/patches-3.10/604-netfilter_conntrack_flush.patch
Unescape View File

@ -1,12 +1,35 @@
--- a/net/netfilter/nf_conntrack_standalone.c --- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c
@@ -268,10 +268,34 @@ static int ct_open(struct inode *inode, @@ -17,6 +17,7 @@
#include <linux/percpu.h>
#include <linux/netdevice.h>
#include <linux/security.h>
+#include <linux/inet.h>
#include <net/net_namespace.h>
#ifdef CONFIG_SYSCTL
#include <linux/sysctl.h>
@@ -268,10 +269,63 @@ static int ct_open(struct inode *inode,
sizeof(struct ct_iter_state)); sizeof(struct ct_iter_state));
} }
+static int kill_all(struct nf_conn *i, void *data) +struct kill_request {
+ u16 family;
+ union nf_inet_addr addr;
+};
+
+static int kill_matching(struct nf_conn *i, void *data)
+{ +{
+ struct kill_request *kr = data;
+ struct nf_conntrack_tuple *t = &i->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+
+ if (!kr->family)
+ return 1; + return 1;
+
+ if (t->src.l3num != kr->family)
+ return 0;
+
+ return (nf_inet_addr_cmp(&kr->addr, &t->src.u3) ||
+ nf_inet_addr_cmp(&kr->addr, &t->dst.u3));
+} +}
+ +
+static ssize_t ct_file_write(struct file *file, const char __user *buf, +static ssize_t ct_file_write(struct file *file, const char __user *buf,
@ -14,16 +37,30 @@
+{ +{
+ struct seq_file *seq = file->private_data; + struct seq_file *seq = file->private_data;
+ struct net *net = seq_file_net(seq); + struct net *net = seq_file_net(seq);
+ struct kill_request kr = { };
+ char req[INET6_ADDRSTRLEN] = { };
+ +
+ if (count) { + if (count == 0)
+ char c; + return 0;
+ +
+ if (get_user(c, buf)) + if (count >= INET6_ADDRSTRLEN)
+ count = INET6_ADDRSTRLEN - 1;
+
+ if (copy_from_user(req, buf, count))
+ return -EFAULT; + return -EFAULT;
+ +
+ if (c == 'f') + if (strnchr(req, count, ':')) {
+ nf_ct_iterate_cleanup(net, kill_all, NULL); + kr.family = AF_INET6;
+ if (!in6_pton(req, count, (void *)&kr.addr, '\n', NULL))
+ return -EINVAL;
+ } else if (strnchr(req, count, '.')) {
+ kr.family = AF_INET;
+ if (!in4_pton(req, count, (void *)&kr.addr, '\n', NULL))
+ return -EINVAL;
+ } + }
+
+ nf_ct_iterate_cleanup(net, kill_matching, &kr);
+
+ return count; + return count;
+} +}
+ +
@ -35,7 +72,7 @@
.llseek = seq_lseek, .llseek = seq_lseek,
.release = seq_release_net, .release = seq_release_net,
}; };
@@ -373,7 +397,7 @@ static int nf_conntrack_standalone_init_ @@ -373,7 +427,7 @@ static int nf_conntrack_standalone_init_
{ {
struct proc_dir_entry *pde; struct proc_dir_entry *pde;

53
target/linux/generic/patches-3.13/604-netfilter_conntrack_flush.patch
Unescape View File

@ -1,12 +1,35 @@
--- a/net/netfilter/nf_conntrack_standalone.c --- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c
@@ -268,10 +268,34 @@ static int ct_open(struct inode *inode, @@ -17,6 +17,7 @@
#include <linux/percpu.h>
#include <linux/netdevice.h>
#include <linux/security.h>
+#include <linux/inet.h>
#include <net/net_namespace.h>
#ifdef CONFIG_SYSCTL
#include <linux/sysctl.h>
@@ -268,10 +269,63 @@ static int ct_open(struct inode *inode,
sizeof(struct ct_iter_state)); sizeof(struct ct_iter_state));
} }
+static int kill_all(struct nf_conn *i, void *data) +struct kill_request {
+ u16 family;
+ union nf_inet_addr addr;
+};
+
+static int kill_matching(struct nf_conn *i, void *data)
+{ +{
+ struct kill_request *kr = data;
+ struct nf_conntrack_tuple *t = &i->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+
+ if (!kr->family)
+ return 1; + return 1;
+
+ if (t->src.l3num != kr->family)
+ return 0;
+
+ return (nf_inet_addr_cmp(&kr->addr, &t->src.u3) ||
+ nf_inet_addr_cmp(&kr->addr, &t->dst.u3));
+} +}
+ +
+static ssize_t ct_file_write(struct file *file, const char __user *buf, +static ssize_t ct_file_write(struct file *file, const char __user *buf,
@ -14,16 +37,30 @@
+{ +{
+ struct seq_file *seq = file->private_data; + struct seq_file *seq = file->private_data;
+ struct net *net = seq_file_net(seq); + struct net *net = seq_file_net(seq);
+ struct kill_request kr = { };
+ char req[INET6_ADDRSTRLEN] = { };
+ +
+ if (count) { + if (count == 0)
+ char c; + return 0;
+ +
+ if (get_user(c, buf)) + if (count >= INET6_ADDRSTRLEN)
+ count = INET6_ADDRSTRLEN - 1;
+
+ if (copy_from_user(req, buf, count))
+ return -EFAULT; + return -EFAULT;
+ +
+ if (c == 'f') + if (strnchr(req, count, ':')) {
+ nf_ct_iterate_cleanup(net, kill_all, NULL, 0, 0); + kr.family = AF_INET6;
+ if (!in6_pton(req, count, (void *)&kr.addr, '\n', NULL))
+ return -EINVAL;
+ } else if (strnchr(req, count, '.')) {
+ kr.family = AF_INET;
+ if (!in4_pton(req, count, (void *)&kr.addr, '\n', NULL))
+ return -EINVAL;
+ } + }
+
+ nf_ct_iterate_cleanup(net, kill_matching, &kr);
+
+ return count; + return count;
+} +}
+ +
@ -35,7 +72,7 @@
.llseek = seq_lseek, .llseek = seq_lseek,
.release = seq_release_net, .release = seq_release_net,
}; };
@@ -373,7 +397,7 @@ static int nf_conntrack_standalone_init_ @@ -373,7 +427,7 @@ static int nf_conntrack_standalone_init_
{ {
struct proc_dir_entry *pde; struct proc_dir_entry *pde;

53
target/linux/generic/patches-3.14/604-netfilter_conntrack_flush.patch
Unescape View File

@ -1,12 +1,35 @@
--- a/net/netfilter/nf_conntrack_standalone.c --- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c
@@ -268,10 +268,34 @@ static int ct_open(struct inode *inode, @@ -17,6 +17,7 @@
#include <linux/percpu.h>
#include <linux/netdevice.h>
#include <linux/security.h>
+#include <linux/inet.h>
#include <net/net_namespace.h>
#ifdef CONFIG_SYSCTL
#include <linux/sysctl.h>
@@ -268,10 +269,63 @@ static int ct_open(struct inode *inode,
sizeof(struct ct_iter_state)); sizeof(struct ct_iter_state));
} }
+static int kill_all(struct nf_conn *i, void *data) +struct kill_request {
+ u16 family;
+ union nf_inet_addr addr;
+};
+
+static int kill_matching(struct nf_conn *i, void *data)
+{ +{
+ struct kill_request *kr = data;
+ struct nf_conntrack_tuple *t = &i->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+
+ if (!kr->family)
+ return 1; + return 1;
+
+ if (t->src.l3num != kr->family)
+ return 0;
+
+ return (nf_inet_addr_cmp(&kr->addr, &t->src.u3) ||
+ nf_inet_addr_cmp(&kr->addr, &t->dst.u3));
+} +}
+ +
+static ssize_t ct_file_write(struct file *file, const char __user *buf, +static ssize_t ct_file_write(struct file *file, const char __user *buf,
@ -14,16 +37,30 @@
+{ +{
+ struct seq_file *seq = file->private_data; + struct seq_file *seq = file->private_data;
+ struct net *net = seq_file_net(seq); + struct net *net = seq_file_net(seq);
+ struct kill_request kr = { };
+ char req[INET6_ADDRSTRLEN] = { };
+ +
+ if (count) { + if (count == 0)
+ char c; + return 0;
+ +
+ if (get_user(c, buf)) + if (count >= INET6_ADDRSTRLEN)
+ count = INET6_ADDRSTRLEN - 1;
+
+ if (copy_from_user(req, buf, count))
+ return -EFAULT; + return -EFAULT;
+ +
+ if (c == 'f') + if (strnchr(req, count, ':')) {
+ nf_ct_iterate_cleanup(net, kill_all, NULL, 0, 0); + kr.family = AF_INET6;
+ if (!in6_pton(req, count, (void *)&kr.addr, '\n', NULL))
+ return -EINVAL;
+ } else if (strnchr(req, count, '.')) {
+ kr.family = AF_INET;
+ if (!in4_pton(req, count, (void *)&kr.addr, '\n', NULL))
+ return -EINVAL;
+ } + }
+
+ nf_ct_iterate_cleanup(net, kill_matching, &kr);
+
+ return count; + return count;
+} +}
+ +
@ -35,7 +72,7 @@
.llseek = seq_lseek, .llseek = seq_lseek,
.release = seq_release_net, .release = seq_release_net,
}; };
@@ -373,7 +397,7 @@ static int nf_conntrack_standalone_init_ @@ -373,7 +427,7 @@ static int nf_conntrack_standalone_init_
{ {
struct proc_dir_entry *pde; struct proc_dir_entry *pde;

53
target/linux/generic/patches-3.3/604-netfilter_conntrack_flush.patch
Unescape View File

@ -1,12 +1,35 @@
--- a/net/netfilter/nf_conntrack_standalone.c --- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c
@@ -267,10 +267,34 @@ static int ct_open(struct inode *inode, @@ -16,6 +16,7 @@
#include <linux/percpu.h>
#include <linux/netdevice.h>
#include <linux/security.h>
+#include <linux/inet.h>
#include <net/net_namespace.h>
#ifdef CONFIG_SYSCTL
#include <linux/sysctl.h>
@@ -267,10 +268,63 @@ static int ct_open(struct inode *inode,
sizeof(struct ct_iter_state)); sizeof(struct ct_iter_state));
} }
+static int kill_all(struct nf_conn *i, void *data) +struct kill_request {
+ u16 family;
+ union nf_inet_addr addr;
+};
+
+static int kill_matching(struct nf_conn *i, void *data)
+{ +{
+ struct kill_request *kr = data;
+ struct nf_conntrack_tuple *t = &i->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+
+ if (!kr->family)
+ return 1; + return 1;
+
+ if (t->src.l3num != kr->family)
+ return 0;
+
+ return (nf_inet_addr_cmp(&kr->addr, &t->src.u3) ||
+ nf_inet_addr_cmp(&kr->addr, &t->dst.u3));
+} +}
+ +
+static ssize_t ct_file_write(struct file *file, const char __user *buf, +static ssize_t ct_file_write(struct file *file, const char __user *buf,
@ -14,16 +37,30 @@
+{ +{
+ struct seq_file *seq = file->private_data; + struct seq_file *seq = file->private_data;
+ struct net *net = seq_file_net(seq); + struct net *net = seq_file_net(seq);
+ struct kill_request kr = { };
+ char req[INET6_ADDRSTRLEN] = { };
+ +
+ if (count) { + if (count == 0)
+ char c; + return 0;
+ +
+ if (get_user(c, buf)) + if (count >= INET6_ADDRSTRLEN)
+ count = INET6_ADDRSTRLEN - 1;
+
+ if (copy_from_user(req, buf, count))
+ return -EFAULT; + return -EFAULT;
+ +
+ if (c == 'f') + if (strnchr(req, count, ':')) {
+ nf_ct_iterate_cleanup(net, kill_all, NULL); + kr.family = AF_INET6;
+ if (!in6_pton(req, count, (void *)&kr.addr, '\n', NULL))
+ return -EINVAL;
+ } else if (strnchr(req, count, '.')) {
+ kr.family = AF_INET;
+ if (!in4_pton(req, count, (void *)&kr.addr, '\n', NULL))
+ return -EINVAL;
+ } + }
+
+ nf_ct_iterate_cleanup(net, kill_matching, &kr);
+
+ return count; + return count;
+} +}
+ +
@ -35,7 +72,7 @@
.llseek = seq_lseek, .llseek = seq_lseek,
.release = seq_release_net, .release = seq_release_net,
}; };
@@ -372,7 +396,7 @@ static int nf_conntrack_standalone_init_ @@ -372,7 +426,7 @@ static int nf_conntrack_standalone_init_
{ {
struct proc_dir_entry *pde; struct proc_dir_entry *pde;

53
target/linux/generic/patches-3.8/604-netfilter_conntrack_flush.patch
Unescape View File

@ -1,12 +1,35 @@
--- a/net/netfilter/nf_conntrack_standalone.c --- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c
@@ -267,10 +267,34 @@ static int ct_open(struct inode *inode, @@ -16,6 +16,7 @@
#include <linux/percpu.h>
#include <linux/netdevice.h>
#include <linux/security.h>
+#include <linux/inet.h>
#include <net/net_namespace.h>
#ifdef CONFIG_SYSCTL
#include <linux/sysctl.h>
@@ -267,10 +268,63 @@ static int ct_open(struct inode *inode,
sizeof(struct ct_iter_state)); sizeof(struct ct_iter_state));
} }
+static int kill_all(struct nf_conn *i, void *data) +struct kill_request {
+ u16 family;
+ union nf_inet_addr addr;
+};
+
+static int kill_matching(struct nf_conn *i, void *data)
+{ +{
+ struct kill_request *kr = data;
+ struct nf_conntrack_tuple *t = &i->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+
+ if (!kr->family)
+ return 1; + return 1;
+
+ if (t->src.l3num != kr->family)
+ return 0;
+
+ return (nf_inet_addr_cmp(&kr->addr, &t->src.u3) ||
+ nf_inet_addr_cmp(&kr->addr, &t->dst.u3));
+} +}
+ +
+static ssize_t ct_file_write(struct file *file, const char __user *buf, +static ssize_t ct_file_write(struct file *file, const char __user *buf,
@ -14,16 +37,30 @@
+{ +{
+ struct seq_file *seq = file->private_data; + struct seq_file *seq = file->private_data;
+ struct net *net = seq_file_net(seq); + struct net *net = seq_file_net(seq);
+ struct kill_request kr = { };
+ char req[INET6_ADDRSTRLEN] = { };
+ +
+ if (count) { + if (count == 0)
+ char c; + return 0;
+ +
+ if (get_user(c, buf)) + if (count >= INET6_ADDRSTRLEN)
+ count = INET6_ADDRSTRLEN - 1;
+
+ if (copy_from_user(req, buf, count))
+ return -EFAULT; + return -EFAULT;
+ +
+ if (c == 'f') + if (strnchr(req, count, ':')) {
+ nf_ct_iterate_cleanup(net, kill_all, NULL); + kr.family = AF_INET6;
+ if (!in6_pton(req, count, (void *)&kr.addr, '\n', NULL))
+ return -EINVAL;
+ } else if (strnchr(req, count, '.')) {
+ kr.family = AF_INET;
+ if (!in4_pton(req, count, (void *)&kr.addr, '\n', NULL))
+ return -EINVAL;
+ } + }
+
+ nf_ct_iterate_cleanup(net, kill_matching, &kr);
+
+ return count; + return count;
+} +}
+ +
@ -35,7 +72,7 @@
.llseek = seq_lseek, .llseek = seq_lseek,
.release = seq_release_net, .release = seq_release_net,
}; };
@@ -372,7 +396,7 @@ static int nf_conntrack_standalone_init_ @@ -372,7 +426,7 @@ static int nf_conntrack_standalone_init_
{ {
struct proc_dir_entry *pde; struct proc_dir_entry *pde;

53
target/linux/generic/patches-3.9/604-netfilter_conntrack_flush.patch
Unescape View File

@ -1,12 +1,35 @@
--- a/net/netfilter/nf_conntrack_standalone.c --- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c
@@ -267,10 +267,34 @@ static int ct_open(struct inode *inode, @@ -16,6 +16,7 @@
#include <linux/percpu.h>
#include <linux/netdevice.h>
#include <linux/security.h>
+#include <linux/inet.h>
#include <net/net_namespace.h>
#ifdef CONFIG_SYSCTL
#include <linux/sysctl.h>
@@ -267,10 +268,63 @@ static int ct_open(struct inode *inode,
sizeof(struct ct_iter_state)); sizeof(struct ct_iter_state));
} }
+static int kill_all(struct nf_conn *i, void *data) +struct kill_request {
+ u16 family;
+ union nf_inet_addr addr;
+};
+
+static int kill_matching(struct nf_conn *i, void *data)
+{ +{
+ struct kill_request *kr = data;
+ struct nf_conntrack_tuple *t = &i->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+
+ if (!kr->family)
+ return 1; + return 1;
+
+ if (t->src.l3num != kr->family)
+ return 0;
+
+ return (nf_inet_addr_cmp(&kr->addr, &t->src.u3) ||
+ nf_inet_addr_cmp(&kr->addr, &t->dst.u3));
+} +}
+ +
+static ssize_t ct_file_write(struct file *file, const char __user *buf, +static ssize_t ct_file_write(struct file *file, const char __user *buf,
@ -14,16 +37,30 @@
+{ +{
+ struct seq_file *seq = file->private_data; + struct seq_file *seq = file->private_data;
+ struct net *net = seq_file_net(seq); + struct net *net = seq_file_net(seq);
+ struct kill_request kr = { };
+ char req[INET6_ADDRSTRLEN] = { };
+ +
+ if (count) { + if (count == 0)
+ char c; + return 0;
+ +
+ if (get_user(c, buf)) + if (count >= INET6_ADDRSTRLEN)
+ count = INET6_ADDRSTRLEN - 1;
+
+ if (copy_from_user(req, buf, count))
+ return -EFAULT; + return -EFAULT;
+ +
+ if (c == 'f') + if (strnchr(req, count, ':')) {
+ nf_ct_iterate_cleanup(net, kill_all, NULL); + kr.family = AF_INET6;
+ if (!in6_pton(req, count, (void *)&kr.addr, '\n', NULL))
+ return -EINVAL;
+ } else if (strnchr(req, count, '.')) {
+ kr.family = AF_INET;
+ if (!in4_pton(req, count, (void *)&kr.addr, '\n', NULL))
+ return -EINVAL;
+ } + }
+
+ nf_ct_iterate_cleanup(net, kill_matching, &kr);
+
+ return count; + return count;
+} +}
+ +
@ -35,7 +72,7 @@
.llseek = seq_lseek, .llseek = seq_lseek,
.release = seq_release_net, .release = seq_release_net,
}; };
@@ -372,7 +396,7 @@ static int nf_conntrack_standalone_init_ @@ -372,7 +426,7 @@ static int nf_conntrack_standalone_init_
{ {
struct proc_dir_entry *pde; struct proc_dir_entry *pde;

Write Preview
Loading…
Cancel
Save