hsist
/
freifunkist-firmware
6
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

update layer7 netfilter patch for kernel 2.4

Browse Source 
SVN-Revision: 1781
master
Waldemar Brodkorb 20 years ago
parent 4a998fa50b
commit 92c81ec0fd
1 changed files with 325 additions and 297 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 622
      openwrt/target/linux/linux-2.4/patches/generic/102-netfilter_layer7.patch

622
openwrt/target/linux/linux-2.4/patches/generic/102-netfilter_layer7.patch
Unescape View File

@ -1,7 +1,7 @@
diff -Nurp linux-2.4.26-stock/Documentation/Configure.help linux-2.4.26-layer7-clean/Documentation/Configure.help diff -Nurp linux-2.4.30/Documentation/Configure.help linux-2.4.30-layer7/Documentation/Configure.help
--- linux-2.4.26-stock/Documentation/Configure.help 2004-04-14 08:05:24.000000000 -0500 --- linux-2.4.30/Documentation/Configure.help 2005-04-03 20:42:19.000000000 -0500
+++ linux-2.4.26-layer7-clean/Documentation/Configure.help 2004-06-21 00:18:14.000000000 -0500 +++ linux-2.4.30-layer7/Documentation/Configure.help 2005-05-03 18:37:03.000000000 -0500
@@ -28819,6 +28819,23 @@ CONFIG_SOUND_WM97XX @@ -29056,6 +29056,23 @@ CONFIG_SOUND_WM97XX
If unsure, say N. If unsure, say N.
@ -25,9 +25,9 @@ diff -Nurp linux-2.4.26-stock/Documentation/Configure.help linux-2.4.26-layer7-c
# #
# A couple of things I keep forgetting: # A couple of things I keep forgetting:
# capitalize: AppleTalk, Ethernet, DOS, DMA, FAT, FTP, Internet, # capitalize: AppleTalk, Ethernet, DOS, DMA, FAT, FTP, Internet,
diff -Nurp linux-2.4.26-stock/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.4.26-layer7-clean/include/linux/netfilter_ipv4/ip_conntrack.h diff -Nurp linux-2.4.30/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.4.30-layer7/include/linux/netfilter_ipv4/ip_conntrack.h
--- linux-2.4.26-stock/include/linux/netfilter_ipv4/ip_conntrack.h 2004-04-14 08:05:40.000000000 -0500 --- linux-2.4.30/include/linux/netfilter_ipv4/ip_conntrack.h 2005-04-03 20:42:20.000000000 -0500
+++ linux-2.4.26-layer7-clean/include/linux/netfilter_ipv4/ip_conntrack.h 2004-06-21 00:18:28.000000000 -0500 +++ linux-2.4.30-layer7/include/linux/netfilter_ipv4/ip_conntrack.h 2005-05-03 18:37:03.000000000 -0500
@@ -207,6 +207,17 @@ struct ip_conntrack @@ -207,6 +207,17 @@ struct ip_conntrack
} nat; } nat;
#endif /* CONFIG_IP_NF_NAT_NEEDED */ #endif /* CONFIG_IP_NF_NAT_NEEDED */
@ -46,9 +46,9 @@ diff -Nurp linux-2.4.26-stock/include/linux/netfilter_ipv4/ip_conntrack.h linux-
}; };
/* get master conntrack via master expectation */ /* get master conntrack via master expectation */
diff -Nurp linux-2.4.26-stock/include/linux/netfilter_ipv4/ipt_layer7.h linux-2.4.26-layer7-clean/include/linux/netfilter_ipv4/ipt_layer7.h diff -Nurp linux-2.4.30/include/linux/netfilter_ipv4/ipt_layer7.h linux-2.4.30-layer7/include/linux/netfilter_ipv4/ipt_layer7.h
--- linux-2.4.26-stock/include/linux/netfilter_ipv4/ipt_layer7.h 1969-12-31 18:00:00.000000000 -0600 --- linux-2.4.30/include/linux/netfilter_ipv4/ipt_layer7.h 1969-12-31 18:00:00.000000000 -0600
+++ linux-2.4.26-layer7-clean/include/linux/netfilter_ipv4/ipt_layer7.h 2004-06-21 00:18:28.000000000 -0500 +++ linux-2.4.30-layer7/include/linux/netfilter_ipv4/ipt_layer7.h 2005-05-03 18:37:03.000000000 -0500
@@ -0,0 +1,26 @@ @@ -0,0 +1,26 @@
+/* +/*
+ By Matthew Strait <quadong@users.sf.net>, Dec 2003. + By Matthew Strait <quadong@users.sf.net>, Dec 2003.
@ -76,9 +76,9 @@ diff -Nurp linux-2.4.26-stock/include/linux/netfilter_ipv4/ipt_layer7.h linux-2.
+}; +};
+ +
+#endif /* _IPT_LAYER7_H */ +#endif /* _IPT_LAYER7_H */
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/Config.in linux-2.4.26-layer7-clean/net/ipv4/netfilter/Config.in diff -Nurp linux-2.4.30/net/ipv4/netfilter/Config.in linux-2.4.30-layer7/net/ipv4/netfilter/Config.in
--- linux-2.4.26-stock/net/ipv4/netfilter/Config.in 2003-08-25 06:44:44.000000000 -0500 --- linux-2.4.30/net/ipv4/netfilter/Config.in 2005-01-19 08:10:13.000000000 -0600
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/Config.in 2004-06-21 00:15:23.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/Config.in 2005-05-03 18:37:03.000000000 -0500
@@ -43,6 +43,10 @@ if [ "$CONFIG_IP_NF_IPTABLES" != "n" ]; @@ -43,6 +43,10 @@ if [ "$CONFIG_IP_NF_IPTABLES" != "n" ];
if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
dep_tristate ' Unclean match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_UNCLEAN $CONFIG_IP_NF_IPTABLES dep_tristate ' Unclean match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_UNCLEAN $CONFIG_IP_NF_IPTABLES
@ -90,29 +90,27 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/Config.in linux-2.4.26-layer7-c
fi fi
# The targets # The targets
dep_tristate ' Packet filtering' CONFIG_IP_NF_FILTER $CONFIG_IP_NF_IPTABLES dep_tristate ' Packet filtering' CONFIG_IP_NF_FILTER $CONFIG_IP_NF_IPTABLES
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/Makefile linux-2.4.26-layer7-clean/net/ipv4/netfilter/Makefile diff -Nurp linux-2.4.30/net/ipv4/netfilter/Makefile linux-2.4.30-layer7/net/ipv4/netfilter/Makefile
--- linux-2.4.26-stock/net/ipv4/netfilter/Makefile 2003-08-25 06:44:44.000000000 -0500 --- linux-2.4.30/net/ipv4/netfilter/Makefile 2003-08-25 06:44:44.000000000 -0500
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/Makefile 2004-06-21 00:15:22.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/Makefile 2005-05-03 18:44:12.000000000 -0500
@@ -87,6 +87,8 @@ obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += i @@ -86,6 +86,7 @@ obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_s
obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
obj-$(CONFIG_IP_NF_MATCH_UNCLEAN) += ipt_unclean.o obj-$(CONFIG_IP_NF_MATCH_UNCLEAN) += ipt_unclean.o
obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
+obj-$(CONFIG_IP_NF_MATCH_LAYER7) += ipt_layer7.o +obj-$(CONFIG_IP_NF_MATCH_LAYER7) += ipt_layer7.o
+
# targets # targets
obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
obj-$(CONFIG_IP_NF_TARGET_MIRROR) += ipt_MIRROR.o diff -Nurp linux-2.4.30/net/ipv4/netfilter/ip_conntrack_core.c linux-2.4.30-layer7/net/ipv4/netfilter/ip_conntrack_core.c
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_core.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/ip_conntrack_core.c --- linux-2.4.30/net/ipv4/netfilter/ip_conntrack_core.c 2005-04-03 20:42:20.000000000 -0500
--- linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_core.c 2004-02-18 07:36:32.000000000 -0600 +++ linux-2.4.30-layer7/net/ipv4/netfilter/ip_conntrack_core.c 2005-05-03 18:37:03.000000000 -0500
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/ip_conntrack_core.c 2004-06-21 00:15:22.000000000 -0500 @@ -346,6 +346,14 @@ destroy_conntrack(struct nf_conntrack *n
@@ -339,6 +339,15 @@ destroy_conntrack(struct nf_conntrack *n
} }
kfree(ct->master); kfree(ct->master);
} }
+ +
+ #if defined(CONFIG_IP_NF_MATCH_LAYER7) || defined(CONFIG_IP_NF_MATCH_LAYER7_MODULE) + #if defined(CONFIG_IP_NF_MATCH_LAYER7) || defined(CONFIG_IP_NF_MATCH_LAYER7_MODULE)
+ /* This ought to get free'd somewhere. How about here? */ + if(ct->layer7.app_proto)
+ if(ct->layer7.app_proto) /* this is sufficient, right? */
+ kfree(ct->layer7.app_proto); + kfree(ct->layer7.app_proto);
+ if(ct->layer7.app_data) + if(ct->layer7.app_data)
+ kfree(ct->layer7.app_data); + kfree(ct->layer7.app_data);
@ -121,9 +119,9 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_core.c linux-2.4.2
WRITE_UNLOCK(&ip_conntrack_lock); WRITE_UNLOCK(&ip_conntrack_lock);
if (master) if (master)
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/ip_conntrack_standalone.c diff -Nurp linux-2.4.30/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.4.30-layer7/net/ipv4/netfilter/ip_conntrack_standalone.c
--- linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-02-18 07:36:32.000000000 -0600 --- linux-2.4.30/net/ipv4/netfilter/ip_conntrack_standalone.c 2005-04-03 20:42:20.000000000 -0500
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-06-21 00:15:22.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/ip_conntrack_standalone.c 2005-05-03 18:37:03.000000000 -0500
@@ -107,6 +107,13 @@ print_conntrack(char *buffer, struct ip_ @@ -107,6 +107,13 @@ print_conntrack(char *buffer, struct ip_
len += sprintf(buffer + len, "[ASSURED] "); len += sprintf(buffer + len, "[ASSURED] ");
len += sprintf(buffer + len, "use=%u ", len += sprintf(buffer + len, "use=%u ",
@ -138,17 +136,17 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_standalone.c linux
len += sprintf(buffer + len, "\n"); len += sprintf(buffer + len, "\n");
return len; return len;
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/ipt_layer7.c diff -Nurp linux-2.4.30/net/ipv4/netfilter/ipt_layer7.c linux-2.4.30-layer7/net/ipv4/netfilter/ipt_layer7.c
--- linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c 1969-12-31 18:00:00.000000000 -0600 --- linux-2.4.30/net/ipv4/netfilter/ipt_layer7.c 1969-12-31 18:00:00.000000000 -0600
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/ipt_layer7.c 2004-06-27 19:06:51.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/ipt_layer7.c 2005-05-03 18:37:03.000000000 -0500
@@ -0,0 +1,540 @@ @@ -0,0 +1,557 @@
+/* +/*
+ Kernel module to match application layer (OSI layer 7) + Kernel module to match application layer (OSI layer 7)
+ data in connections. + data in connections.
+ +
+ http://l7-filter.sf.net + http://l7-filter.sf.net
+ +
+ By Matthew Strait and Ethan Sommer, 2003. + By Matthew Strait and Ethan Sommer, 2003-2005.
+ +
+ This program is free software; you can redistribute it and/or + This program is free software; you can redistribute it and/or
+ modify it under the terms of the GNU General Public License + modify it under the terms of the GNU General Public License
@ -167,6 +165,7 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+#include <linux/ctype.h> +#include <linux/ctype.h>
+#include <net/ip.h> +#include <net/ip.h>
+#include <net/tcp.h> +#include <net/tcp.h>
+#include <linux/netfilter_ipv4/lockhelp.h>
+ +
+#include "regexp/regexp.c" +#include "regexp/regexp.c"
+ +
@ -178,99 +177,41 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+MODULE_DESCRIPTION("iptables application layer match module"); +MODULE_DESCRIPTION("iptables application layer match module");
+ +
+#if defined(CONFIG_IP_NF_MATCH_LAYER7_DEBUG) +#if defined(CONFIG_IP_NF_MATCH_LAYER7_DEBUG)
+ #define DPRINTK(format,args...) printk(format,##args) + #define DPRINTK(format,args...) printk(format,##args)
+#else +#else
+ #define DPRINTK(format,args...) + #define DPRINTK(format,args...)
+#endif +#endif
+ +
+#define TOTAL_PACKETS master_conntrack->layer7.numpackets
+
+/* Number of packets whose data we look at. +/* Number of packets whose data we look at.
+This can be modified through /proc/net/layer7_numpackets */ +This can be modified through /proc/net/layer7_numpackets */
+static int num_packets = 8; +static int num_packets = 8;
+ +
+static struct pattern_cache { +static struct pattern_cache {
+ char * regex_string; + char * regex_string;
+ regexp * pattern; + regexp * pattern;
+ struct pattern_cache * next; + struct pattern_cache * next;
+} * first_pattern_cache = NULL; +} * first_pattern_cache = NULL;
+ +
+/* I'm new to locking. Here are my assumptions: +/* I'm new to locking. Here are my assumptions:
+ +
+- No one is going to write to /proc/net/layer7_numpackets over and over +- No one will write to /proc/net/layer7_numpackets over and over very fast;
+ within a short period of time, and if they did, nothing awful would happen. + if they did, nothing awful would happen.
+ +
+- This code will never be processing the same packet twice at the same time, +- This code will never be processing the same packet twice at the same time,
+ because iptables rules need to be traversed in order. + because iptables rules are traversed in order.
+ +
+- It doesn't matter if two packets from different connections are in here at +- It doesn't matter if two packets from different connections are in here at
+ the same time, because they don't share any data. + the same time, because they don't share any data.
+ +
+- It _does_ matter if two packets from the same connection are here at the same +- It _does_ matter if two packets from the same connection are here at the same
+ time. In this case, the things we have to protect are the conntracks and + time. In this case, we have to protect the conntracks and the list of
+ the list of compiled patterns. + compiled patterns.
+*/ +*/
+DECLARE_RWLOCK(ct_lock); +DECLARE_RWLOCK(ct_lock);
+DECLARE_LOCK(list_lock); +DECLARE_LOCK(list_lock);
+ +
+/* Use instead of regcomp. As we expect to be seeing the same regexps over and
+over again, it make sense to cache the results. */
+static regexp * compile_and_cache(char * regex_string, char * protocol)
+{
+ struct pattern_cache * node = first_pattern_cache;
+ struct pattern_cache * last_pattern_cache = first_pattern_cache;
+ struct pattern_cache * tmp;
+ unsigned int len;
+
+ while (node != NULL) {
+ if (!strcmp(node->regex_string, regex_string))
+ return node->pattern;
+
+ last_pattern_cache = node;/* points at the last non-NULL node */
+ node = node->next;
+ }
+
+ /* If we reach the end of the list, then we have not yet cached
+ the pattern for this regex. Let's do that now.
+ Be paranoid about running out of memory to avoid list corruption. */
+ tmp = kmalloc(sizeof(struct pattern_cache), GFP_ATOMIC);
+
+ if(!tmp) {
+ printk(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n");
+ return NULL;
+ }
+
+ tmp->regex_string = kmalloc(strlen(regex_string) + 1, GFP_ATOMIC);
+ tmp->pattern = kmalloc(sizeof(struct regexp), GFP_ATOMIC);
+
+ if(!tmp->regex_string || !tmp->pattern) {
+ printk(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n");
+ kfree(tmp->regex_string);
+ kfree(tmp->pattern);
+ kfree(tmp);
+ return NULL;
+ }
+
+ tmp->next = NULL;
+ /* Ok. The new node is all ready now. */
+ node = tmp;
+
+ if(first_pattern_cache == NULL) /* list is empty */
+ first_pattern_cache = node; /* make node the beginning */
+ else
+ last_pattern_cache->next = node; /* attach node to the end */
+
+ /* copy the string and compile the regex */
+ len = strlen(regex_string);
+ node->pattern = regcomp(regex_string, &len);
+ if ( !node->pattern ) {
+ printk(KERN_ERR "layer7: Error compiling regexp \"%s\" (%s)\n",
+ regex_string, protocol);
+ /* pattern is now cached as NULL, so we won't try again. */
+ }
+
+ strcpy(node->regex_string, regex_string);
+ return node->pattern;
+}
+
+#if CONFIG_IP_NF_MATCH_LAYER7_DEBUG +#if CONFIG_IP_NF_MATCH_LAYER7_DEBUG
+/* Converts an unfriendly string into a friendly one by +/* Converts an unfriendly string into a friendly one by
+replacing unprintables with periods and all whitespace with " ". */ +replacing unprintables with periods and all whitespace with " ". */
@ -280,9 +221,10 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+ int i; + int i;
+ +
+ if(!f) { + if(!f) {
+ printk(KERN_ERR "layer7: out of memory in friendly_print, bailing.\n"); + if (net_ratelimit())
+ return NULL; + printk(KERN_ERR "layer7: out of memory in friendly_print, bailing.\n");
+ } + return NULL;
+ }
+ +
+ for(i = 0; i < strlen(s); i++){ + for(i = 0; i < strlen(s); i++){
+ if(isprint(s[i]) && s[i] < 128) f[i] = s[i]; + if(isprint(s[i]) && s[i] < 128) f[i] = s[i];
@ -303,7 +245,8 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+ return (char)(i - 10 + 'a'); + return (char)(i - 10 + 'a');
+ break; + break;
+ default: + default:
+ printk("Problem in dec2hex\n"); + if (net_ratelimit())
+ printk("Problem in dec2hex\n");
+ return '\0'; + return '\0';
+ } + }
+} +}
@ -314,9 +257,10 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+ int i; + int i;
+ +
+ if(!g) { + if(!g) {
+ printk(KERN_ERR "layer7: out of memory in hex_print, bailing.\n"); + if (net_ratelimit())
+ return NULL; + printk(KERN_ERR "layer7: out of memory in hex_print, bailing.\n");
+ } + return NULL;
+ }
+ +
+ for(i = 0; i < strlen(s); i++) { + for(i = 0; i < strlen(s); i++) {
+ g[i*3 ] = dec2hex(s[i]/16); + g[i*3 ] = dec2hex(s[i]/16);
@ -329,17 +273,68 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+} +}
+#endif // DEBUG +#endif // DEBUG
+ +
+/* Use instead of regcomp. As we expect to be seeing the same regexps over and
+over again, it make sense to cache the results. */
+static regexp * compile_and_cache(char * regex_string, char * protocol)
+{
+ struct pattern_cache * node = first_pattern_cache;
+ struct pattern_cache * last_pattern_cache = first_pattern_cache;
+ struct pattern_cache * tmp;
+ unsigned int len;
+
+ while (node != NULL) {
+ if (!strcmp(node->regex_string, regex_string))
+ return node->pattern;
+ +
+/* The following functions are here in case we get ported into an environment + last_pattern_cache = node;/* points at the last non-NULL node */
+(ebtables?) where skb->nh.iph->protocol isn't set. They assume that skb->data + node = node->next;
+points at the beginning of the IP datagram, which is true for iptables (but in + }
+QoS it points to the beginning of the Ethernet frame). */ +
+#if 0 + /* If we reach the end of the list, then we have not yet cached
+#define IP_PROTO_OFFSET 9 + the pattern for this regex. Let's do that now.
+static int is_tcp_over_ipv4 (const struct sk_buff *skb){return(skb->data[IP_PROTO_OFFSET]==IPPROTO_TCP );} + Be paranoid about running out of memory to avoid list corruption. */
+static int is_udp_over_ipv4 (const struct sk_buff *skb){return(skb->data[IP_PROTO_OFFSET]==IPPROTO_UDP );} + tmp = kmalloc(sizeof(struct pattern_cache), GFP_ATOMIC);
+static int is_icmp_over_ipv4(const struct sk_buff *skb){return(skb->data[IP_PROTO_OFFSET]==IPPROTO_ICMP);} +
+#endif + if(!tmp) {
+ if (net_ratelimit())
+ printk(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n");
+ return NULL;
+ }
+
+ tmp->regex_string = kmalloc(strlen(regex_string) + 1, GFP_ATOMIC);
+ tmp->pattern = kmalloc(sizeof(struct regexp), GFP_ATOMIC);
+ tmp->next = NULL;
+
+ if(!tmp->regex_string || !tmp->pattern) {
+ if (net_ratelimit())
+ printk(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n");
+ kfree(tmp->regex_string);
+ kfree(tmp->pattern);
+ kfree(tmp);
+ return NULL;
+ }
+
+ /* Ok. The new node is all ready now. */
+ node = tmp;
+
+ if(first_pattern_cache == NULL) /* list is empty */
+ first_pattern_cache = node; /* make node the beginning */
+ else
+ last_pattern_cache->next = node; /* attach node to the end */
+
+ /* copy the string and compile the regex */
+ len = strlen(regex_string);
+ DPRINTK("About to compile this: \"%s\"\n", regex_string);
+ node->pattern = regcomp(regex_string, &len);
+ if ( !node->pattern ) {
+ if (net_ratelimit())
+ printk(KERN_ERR "layer7: Error compiling regexp \"%s\" (%s)\n", regex_string, protocol);
+ /* pattern is now cached as NULL, so we won't try again. */
+ }
+
+ strcpy(node->regex_string, regex_string);
+ return node->pattern;
+}
+ +
+static int can_handle(const struct sk_buff *skb) +static int can_handle(const struct sk_buff *skb)
+{ +{
@ -357,73 +352,86 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+{ +{
+ /* In case we are ported somewhere (ebtables?) where skb->nh.iph + /* In case we are ported somewhere (ebtables?) where skb->nh.iph
+ isn't set, this can be gotten from 4*(skb->data[0] & 0x0f) as well. */ + isn't set, this can be gotten from 4*(skb->data[0] & 0x0f) as well. */
+ int ip_hl = 4*skb->nh.iph->ihl; + int ip_hl = 4*skb->nh.iph->ihl;
+ +
+ if( skb->nh.iph->protocol == IPPROTO_TCP ) { + if( skb->nh.iph->protocol == IPPROTO_TCP ) {
+ /* 12 == offset into TCP header for the header length field. + /* 12 == offset into TCP header for the header length field.
+ Can't get this with skb->h.th->doff because the tcphdr + Can't get this with skb->h.th->doff because the tcphdr
+ struct doesn't get set when routing (this is confirmed to be + struct doesn't get set when routing (this is confirmed to be
+ true in Netfilter as well as QoS.) */ + true in Netfilter as well as QoS.) */
+ int tcp_hl = 4*(skb->data[ip_hl + 12] >> 4); + int tcp_hl = 4*(skb->data[ip_hl + 12] >> 4);
+ +
+ return ip_hl + tcp_hl; + return ip_hl + tcp_hl;
+ } else if( skb->nh.iph->protocol == IPPROTO_UDP ) { + } else if( skb->nh.iph->protocol == IPPROTO_UDP ) {
+ return ip_hl + 8; /* UDP header is always 8 bytes */ + return ip_hl + 8; /* UDP header is always 8 bytes */
+ } else if( skb->nh.iph->protocol == IPPROTO_ICMP ) { + } else if( skb->nh.iph->protocol == IPPROTO_ICMP ) {
+ return ip_hl + 8; /* ICMP header is 8 bytes */ + return ip_hl + 8; /* ICMP header is 8 bytes */
+ } else { + } else {
+ printk(KERN_ERR "layer7: tried to handle unknown protocol!\n"); + if (net_ratelimit())
+ return ip_hl + 8; /* something reasonable */ + printk(KERN_ERR "layer7: tried to handle unknown protocol!\n");
+ } + return ip_hl + 8; /* something reasonable */
+ }
+} +}
+ +
+/* handles whether there's a match when we aren't appending data anymore */ +/* handles whether there's a match when we aren't appending data anymore */
+static int match_no_append(struct ip_conntrack * conntrack, +static int match_no_append(struct ip_conntrack * conntrack, struct ip_conntrack * master_conntrack,
+ struct ip_conntrack * master_conntrack, + enum ip_conntrack_info ctinfo, enum ip_conntrack_info master_ctinfo,
+ struct ipt_layer7_info * info) + struct ipt_layer7_info * info)
+{ +{
+ /* If we're in here, we don't care about the app data anymore */ + /* If we're in here, throw the app data away */
+ WRITE_LOCK(&ct_lock); + WRITE_LOCK(&ct_lock);
+ if(master_conntrack->layer7.app_data != NULL) { + if(master_conntrack->layer7.app_data != NULL) {
+ +
+ #ifdef CONFIG_IP_NF_MATCH_LAYER7_DEBUG + #ifdef CONFIG_IP_NF_MATCH_LAYER7_DEBUG
+ if(!master_conntrack->layer7.app_proto) { + if(!master_conntrack->layer7.app_proto) {
+ char * f = friendly_print(master_conntrack->layer7.app_data); + char * f = friendly_print(master_conntrack->layer7.app_data);
+ char * g = hex_print(master_conntrack->layer7.app_data); + char * g = hex_print(master_conntrack->layer7.app_data);
+ DPRINTK("\nGave up on the %d length stream: \n%s\n", + DPRINTK("\nl7-filter gave up after %d bytes (%d packets):\n%s\n",
+ master_conntrack->layer7.app_data_len, f); + strlen(f),
+ DPRINTK("\nIn hex: %s\n", g); + TOTAL_PACKETS, f);
+ kfree(f); + kfree(f);
+ kfree(g); + DPRINTK("In hex: %s\n", g);
+ } + kfree(g);
+ #endif + }
+ #endif
+ +
+ kfree(master_conntrack->layer7.app_data); + kfree(master_conntrack->layer7.app_data);
+ master_conntrack->layer7.app_data = NULL; /* don't free again */ + master_conntrack->layer7.app_data = NULL; /* don't free again */
+ } + }
+ WRITE_UNLOCK(&ct_lock); + WRITE_UNLOCK(&ct_lock);
+ +
+ /* Is top-level master (possibly self) classified? */ + if(master_conntrack->layer7.app_proto){
+ if(master_conntrack->layer7.app_proto) { + /* Here child connections set their .app_proto (for /proc/net/ip_conntrack) */
+ if(!strcmp(master_conntrack->layer7.app_proto, info->protocol)) + WRITE_LOCK(&ct_lock);
+ { + if(!conntrack->layer7.app_proto) {
+ /* set own .protocol (for /proc/net/ip_conntrack) */ + conntrack->layer7.app_proto = kmalloc(strlen(master_conntrack->layer7.app_proto)+1, GFP_ATOMIC);
+ WRITE_LOCK(&ct_lock); + if(!conntrack->layer7.app_proto){
+ if(!conntrack->layer7.app_proto) { + if (net_ratelimit())
+ conntrack->layer7.app_proto = kmalloc(strlen(info->protocol), GFP_ATOMIC); + printk(KERN_ERR "layer7: out of memory in match_no_append, bailing.\n");
+ if(!conntrack->layer7.app_proto){ + WRITE_UNLOCK(&ct_lock);
+ printk(KERN_ERR "layer7: out of memory in match_no_append, bailing.\n"); + return 1;
+ WRITE_UNLOCK(&ct_lock); + }
+ return 1; + strcpy(conntrack->layer7.app_proto, master_conntrack->layer7.app_proto);
+ } + }
+ + WRITE_UNLOCK(&ct_lock);
+ strcpy(conntrack->layer7.app_proto, info->protocol);
+ }
+ WRITE_UNLOCK(&ct_lock);
+ +
+ return 1; + return (!strcmp(master_conntrack->layer7.app_proto, info->protocol));
+ } else return 0; + }
+ } else return 0; /* no clasification */ + else {
+ /* If not classified, set to "unknown" to distinguish from
+ connections that are still being tested. */
+ WRITE_LOCK(&ct_lock);
+ master_conntrack->layer7.app_proto = kmalloc(strlen("unknown")+1, GFP_ATOMIC);
+ if(!master_conntrack->layer7.app_proto){
+ if (net_ratelimit())
+ printk(KERN_ERR "layer7: out of memory in match_no_append, bailing.\n");
+ WRITE_UNLOCK(&ct_lock);
+ return 1;
+ }
+ strcpy(master_conntrack->layer7.app_proto, "unknown");
+ WRITE_UNLOCK(&ct_lock);
+ return 0;
+ }
+} +}
+ +
+/* add the new app data to the conntrack. Return number of bytes added. */ +/* add the new app data to the conntrack. Return number of bytes added. */
@ -433,8 +441,8 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+ int length = 0, i; + int length = 0, i;
+ int oldlength = master_conntrack->layer7.app_data_len; + int oldlength = master_conntrack->layer7.app_data_len;
+ +
+ /* Strip nulls. Make everything lower case (our regex lib doesn't + /* Strip nulls. Make everything lower case (our regex lib doesn't
+ do case insensitivity). Add it to the end of the current data. */ + do case insensitivity). Add it to the end of the current data. */
+ for(i = 0; i < CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN-oldlength-1 && + for(i = 0; i < CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN-oldlength-1 &&
+ i < appdatalen; i++) { + i < appdatalen; i++) {
+ if(app_data[i] != '\0') { + if(app_data[i] != '\0') {
@ -453,89 +461,96 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+ +
+/* Returns true on match and false otherwise. */ +/* Returns true on match and false otherwise. */
+static int match(/* const */struct sk_buff *skb, const struct net_device *in, +static int match(/* const */struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, const void *matchinfo, + const struct net_device *out, const void *matchinfo,
+ int offset, int *hotdrop) + int offset, int *hotdrop)
+{ +{
+ struct ipt_layer7_info * info = (struct ipt_layer7_info *)matchinfo; + struct ipt_layer7_info * info = (struct ipt_layer7_info *)matchinfo;
+ enum ip_conntrack_info master_ctinfo, ctinfo; + enum ip_conntrack_info master_ctinfo, ctinfo;
+ struct ip_conntrack *master_conntrack, *conntrack; + struct ip_conntrack *master_conntrack, *conntrack;
+ unsigned char * app_data; + unsigned char * app_data;
+ unsigned int pattern_result, appdatalen; + unsigned int pattern_result, appdatalen;
+ regexp * comppattern; + regexp * comppattern;
+ +
+ if(!can_handle(skb)){ + if(!can_handle(skb)){
+ DPRINTK("layer7: This is some protocol I can't handle\n"); + DPRINTK("layer7: This is some protocol I can't handle.\n");
+ return info->invert; + return info->invert;
+ } + }
+ +
+ LOCK_BH(&list_lock);
+ comppattern = compile_and_cache(info->pattern, info->protocol);
+ UNLOCK_BH(&list_lock);
+ /* the return value gets checked later, when we're ready to use it */
+
+ app_data = skb->data + app_data_offset(skb);
+ appdatalen = skb->tail - app_data;
+
+ /* Treat the parent and all its children together as one connection, + /* Treat the parent and all its children together as one connection,
+ except for the purpose of setting conntrack->layer7.pattern in the + except for the purpose of setting conntrack->layer7.app_proto in the
+ actual connection. This makes /proc/net/ip_conntrack somewhat more + actual connection. This makes /proc/net/ip_conntrack somewhat more
+ satisfying. */ + satisfying. */
+ if(!(conntrack = ip_conntrack_get((struct sk_buff *)skb, &ctinfo)) || + if(!(conntrack = ip_conntrack_get((struct sk_buff *)skb, &ctinfo)) ||
+ !(master_conntrack = ip_conntrack_get((struct sk_buff *)skb, &master_ctinfo))) { + !(master_conntrack = ip_conntrack_get((struct sk_buff *)skb, &master_ctinfo))) {
+ DPRINTK("layer7: packet is not from a known connection, giving up.\n"); + DPRINTK("layer7: packet is not from a known connection, giving up.\n");
+ return info->invert; + return info->invert;
+ } + }
+ +
+ /* Try to get a master conntrack (and its master etc) for FTP, etc. */ + /* Try to get a master conntrack (and its master etc) for FTP, etc. */
+ while (master_ct(master_conntrack) != NULL) + while (master_ct(master_conntrack) != NULL)
+ master_conntrack = master_ct(master_conntrack); + master_conntrack = master_ct(master_conntrack);
+ +
+ /* skb->cb[0] == seen. Avoid doing things twice if there are two layer7
+ rules. I'm not sure that using cb for this purpose is correct, although
+ it says "put your private variables there" and this seems to qualify.
+ But it doesn't look like it's being used for anything else in the
+ sk_buffs that make it here. I'm open to suggestions for how to be able
+ to write to cb without making the compiler angry. That I can't figure
+ this out is an argument against this being correct. */
+ if(!skb->cb[0]){ + if(!skb->cb[0]){
+ WRITE_LOCK(&ct_lock); + WRITE_LOCK(&ct_lock);
+ master_conntrack->layer7.numpackets++;/*starts at 0 via memset*/ + master_conntrack->layer7.numpackets++;/*starts at 0 via memset*/
+ WRITE_UNLOCK(&ct_lock); + WRITE_UNLOCK(&ct_lock);
+ } + }
+ +
+ /* if we've classified it or seen too many packets */
+ if(TOTAL_PACKETS > num_packets ||
+ master_conntrack->layer7.app_proto) {
+
+ pattern_result = match_no_append(conntrack, master_conntrack, ctinfo, master_ctinfo, info);
+
+ /* skb->cb[0] == seen. Avoid doing things twice if there are two l7
+ rules. I'm not sure that using cb for this purpose is correct, although
+ it says "put your private variables there". But it doesn't look like it
+ is being used for anything else in the skbs that make it here. How can
+ I write to cb without making the compiler angry? */
+ skb->cb[0] = 1; /* marking it seen here is probably irrelevant, but consistant */
+
+ return (pattern_result ^ info->invert);
+ }
+
+ if(skb_is_nonlinear(skb)){
+ if(skb_linearize(skb, GFP_ATOMIC) != 0){
+ if (net_ratelimit())
+ printk(KERN_ERR "layer7: failed to linearize packet, bailing.\n");
+ return info->invert;
+ }
+ }
+
+ /* now that the skb is linearized, it's safe to set these. */
+ app_data = skb->data + app_data_offset(skb);
+ appdatalen = skb->tail - app_data;
+
+ LOCK_BH(&list_lock);
+ /* the return value gets checked later, when we're ready to use it */
+ comppattern = compile_and_cache(info->pattern, info->protocol);
+ UNLOCK_BH(&list_lock);
+
+ /* On the first packet of a connection, allocate space for app data */ + /* On the first packet of a connection, allocate space for app data */
+ WRITE_LOCK(&ct_lock); + WRITE_LOCK(&ct_lock);
+ if(master_conntrack->layer7.numpackets == 1 && !skb->cb[0]) { + if(TOTAL_PACKETS == 1 && !skb->cb[0] && !master_conntrack->layer7.app_data) {
+ master_conntrack->layer7.app_data = kmalloc(CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN, GFP_ATOMIC); + master_conntrack->layer7.app_data = kmalloc(CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN, GFP_ATOMIC);
+ if(!master_conntrack->layer7.app_data){ + if(!master_conntrack->layer7.app_data){
+ printk(KERN_ERR "layer7: out of memory in match, bailing.\n"); + if (net_ratelimit())
+ WRITE_UNLOCK(&ct_lock); + printk(KERN_ERR "layer7: out of memory in match, bailing.\n");
+ return info->invert; + WRITE_UNLOCK(&ct_lock);
+ } + return info->invert;
+ }
+ +
+ master_conntrack->layer7.app_data[0] = '\0'; + master_conntrack->layer7.app_data[0] = '\0';
+ } + }
+ WRITE_UNLOCK(&ct_lock); + WRITE_UNLOCK(&ct_lock);
+ +
+ /* if we've classified it or seen too many packets */ + /* Can be here, but unallocated, if numpackets is increased near
+ if(master_conntrack->layer7.numpackets > num_packets ||
+ master_conntrack->layer7.app_proto) {
+
+ pattern_result = match_no_append(conntrack, master_conntrack, info);
+
+ /* mark the packet seen (probably irrelevant, but consistant) */
+ skb->cb[0] = 1;
+
+ return (pattern_result ^ info->invert);
+ }
+
+ /* Can end up here, but unallocated, if numpackets is increased during
+ the beginning of a connection */ + the beginning of a connection */
+ if(master_conntrack->layer7.app_data == NULL) + if(master_conntrack->layer7.app_data == NULL)
+ return (info->invert); /* unmatched */ + return (info->invert); /* unmatched */
+ +
+ if(!skb->cb[0]) { + if(!skb->cb[0]){
+ int newbytes; + int newbytes;
+ WRITE_LOCK(&ct_lock); + WRITE_LOCK(&ct_lock);
+ newbytes = add_data(master_conntrack, app_data, appdatalen); + newbytes = add_data(master_conntrack, app_data, appdatalen);
+ WRITE_UNLOCK(&ct_lock); + WRITE_UNLOCK(&ct_lock);
@ -547,37 +562,41 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+ } + }
+ } + }
+ +
+ /* If looking for "unknown", then never match. "Unknown" means that
+ we've given up; we're still trying with these packets. */
+ if(!strcmp(info->protocol, "unknown")) {
+ pattern_result = 0;
+ /* If the regexp failed to compile, don't bother running it */ + /* If the regexp failed to compile, don't bother running it */
+ if(comppattern && regexec(comppattern, master_conntrack->layer7.app_data)) { + } else if(comppattern && regexec(comppattern, master_conntrack->layer7.app_data)) {
+ DPRINTK("layer7: regexec positive: %s!\n", info->protocol); + DPRINTK("layer7: regexec positive: %s!\n", info->protocol);
+ pattern_result = 1; + pattern_result = 1;
+ } else pattern_result = 0; + } else pattern_result = 0;
+ +
+ if(pattern_result) { + if(pattern_result) {
+ WRITE_LOCK(&ct_lock); + WRITE_LOCK(&ct_lock);
+ conntrack->layer7.app_proto = kmalloc(strlen(info->protocol), GFP_ATOMIC); + master_conntrack->layer7.app_proto = kmalloc(strlen(info->protocol)+1, GFP_ATOMIC);
+ if(!conntrack->layer7.app_proto){ + if(!master_conntrack->layer7.app_proto){
+ printk(KERN_ERR "layer7: out of memory in match, bailing.\n"); + if (net_ratelimit())
+ WRITE_UNLOCK(&ct_lock); + printk(KERN_ERR "layer7: out of memory in match, bailing.\n");
+ return (pattern_result ^ info->invert); + WRITE_UNLOCK(&ct_lock);
+ } + return (pattern_result ^ info->invert);
+ + }
+ strcpy(conntrack->layer7.app_proto, info->protocol); + strcpy(master_conntrack->layer7.app_proto, info->protocol);
+ WRITE_UNLOCK(&ct_lock); + WRITE_UNLOCK(&ct_lock);
+ } + }
+ +
+ /* mark the packet seen */ + /* mark the packet seen */
+ skb->cb[0] = 1; + skb->cb[0] = 1;
+ +
+ return (pattern_result ^ info->invert); + return (pattern_result ^ info->invert);
+} +}
+ +
+static int checkentry(const char *tablename, const struct ipt_ip *ip, +static int checkentry(const char *tablename, const struct ipt_ip *ip,
+ void *matchinfo, unsigned int matchsize, unsigned int hook_mask) + void *matchinfo, unsigned int matchsize, unsigned int hook_mask)
+{ +{
+ if (matchsize != IPT_ALIGN(sizeof(struct ipt_layer7_info))) + if (matchsize != IPT_ALIGN(sizeof(struct ipt_layer7_info)))
+ return 0; + return 0;
+ return 1; + return 1;
+} +}
+ +
+static struct ipt_match layer7_match = { +static struct ipt_match layer7_match = {
@ -590,87 +609,83 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+/* taken from drivers/video/modedb.c */ +/* taken from drivers/video/modedb.c */
+static int my_atoi(const char *s) +static int my_atoi(const char *s)
+{ +{
+ int val = 0; + int val = 0;
+ +
+ for (;; s++) { + for (;; s++) {
+ switch (*s) { + switch (*s) {
+ case '0'...'9': + case '0'...'9':
+ val = 10*val+(*s-'0'); + val = 10*val+(*s-'0');
+ break; + break;
+ default: + default:
+ return val; + return val;
+ } + }
+ } + }
+} +}
+ +
+/* write out num_packets to userland. */ +/* write out num_packets to userland. */
+static int layer7_read_proc(char* page, char ** start, off_t off, int count, +static int layer7_read_proc(char* page, char ** start, off_t off, int count,
+ int* eof, void * data) + int* eof, void * data)
+{ +{
+ if(num_packets > 99) + if(num_packets > 99 && net_ratelimit())
+ printk(KERN_ERR "layer7: NOT REACHED. num_packets too big\n"); + printk(KERN_ERR "layer7: NOT REACHED. num_packets too big\n");
+ +
+ page[0] = num_packets/10 + '0'; + page[0] = num_packets/10 + '0';
+ page[1] = num_packets%10 + '0'; + page[1] = num_packets%10 + '0';
+ page[2] = '\n'; + page[2] = '\n';
+ page[3] = '\0'; + page[3] = '\0';
+ +
+ *eof=1; + *eof=1;
+ +
+ return 3; + return 3;
+} +}
+ +
+/* Read in num_packets from userland */ +/* Read in num_packets from userland */
+static int layer7_write_proc(struct file* file, const char* buffer, +static int layer7_write_proc(struct file* file, const char* buffer,
+ unsigned long count, void *data) + unsigned long count, void *data)
+{ +{
+ char * foo = kmalloc(count, GFP_ATOMIC); + char * foo = kmalloc(count, GFP_ATOMIC);
+ +
+ if(!foo){ + if(!foo){
+ printk(KERN_ERR "layer7: out of memory, bailing. num_packets unchanged.\n"); + if (net_ratelimit())
+ return count; + printk(KERN_ERR "layer7: out of memory, bailing. num_packets unchanged.\n");
+ } + return count;
+ }
+ +
+ /* copy in the data from userland */ + copy_from_user(foo, buffer, count);
+ copy_from_user(foo, buffer, count);
+ +
+ num_packets = my_atoi(foo); + num_packets = my_atoi(foo);
+ kfree (foo); + kfree (foo);
+ +
+ /* This has an arbitrary limit to make the math easier. I'm lazy. + /* This has an arbitrary limit to make the math easier. I'm lazy.
+ But anyway, 99 is a LOT! If you want more, you're doing it wrong! */ + But anyway, 99 is a LOT! If you want more, you're doing it wrong! */
+ if(num_packets > 99) { + if(num_packets > 99) {
+ printk(KERN_WARNING "layer7: num_packets can't be > 99.\n"); + printk(KERN_WARNING "layer7: num_packets can't be > 99.\n");
+ num_packets = 99; + num_packets = 99;
+ } else if(num_packets < 1) { + } else if(num_packets < 1) {
+ printk(KERN_WARNING "layer7: num_packets can't be < 1.\n"); + printk(KERN_WARNING "layer7: num_packets can't be < 1.\n");
+ num_packets = 1; + num_packets = 1;
+ } + }
+ +
+ return count; + return count;
+} +}
+ +
+/* register the proc file */ +/* register the proc file */
+static void layer7_init_proc(void) +static void layer7_init_proc(void)
+{ +{
+ struct proc_dir_entry* entry; + struct proc_dir_entry* entry;
+ + entry = create_proc_entry("layer7_numpackets", 0644, proc_net);
+ /* create the file */
+ entry = create_proc_entry("layer7_numpackets", 0644, proc_net);
+
+ /* set the callback functions */
+ entry->read_proc = layer7_read_proc; + entry->read_proc = layer7_read_proc;
+ entry->write_proc = layer7_write_proc; + entry->write_proc = layer7_write_proc;
+} +}
+ +
+static void layer7_cleanup_proc(void) +static void layer7_cleanup_proc(void)
+{ +{
+ remove_proc_entry("layer7_numpackets", proc_net); + remove_proc_entry("layer7_numpackets", proc_net);
+} +}
+ +
+static int __init init(void) +static int __init init(void)
+{ +{
+ layer7_init_proc(); + layer7_init_proc();
+ return ipt_register_match(&layer7_match); + return ipt_register_match(&layer7_match);
+} +}
+ +
@ -682,9 +697,9 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+ +
+module_init(init); +module_init(init);
+module_exit(fini); +module_exit(fini);
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regexp.c diff -Nurp linux-2.4.30/net/ipv4/netfilter/regexp/regexp.c linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regexp.c
--- linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.c 1969-12-31 18:00:00.000000000 -0600 --- linux-2.4.30/net/ipv4/netfilter/regexp/regexp.c 1969-12-31 18:00:00.000000000 -0600
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regexp.c 2004-06-27 19:07:00.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regexp.c 2005-05-03 18:37:03.000000000 -0500
@@ -0,0 +1,1195 @@ @@ -0,0 +1,1195 @@
+/* +/*
+ * regcomp and regexec -- regsub and regerror are elsewhere + * regcomp and regexec -- regsub and regerror are elsewhere
@ -1881,10 +1896,10 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.c linux-2.4.26-la
+#endif +#endif
+ +
+ +
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.h linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regexp.h diff -Nurp linux-2.4.30/net/ipv4/netfilter/regexp/regexp.h linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regexp.h
--- linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.h 1969-12-31 18:00:00.000000000 -0600 --- linux-2.4.30/net/ipv4/netfilter/regexp/regexp.h 1969-12-31 18:00:00.000000000 -0600
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regexp.h 2004-06-27 19:07:00.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regexp.h 2005-05-03 18:37:03.000000000 -0500
@@ -0,0 +1,27 @@ @@ -0,0 +1,40 @@
+/* +/*
+ * Definitions etc. for regexp(3) routines. + * Definitions etc. for regexp(3) routines.
+ * + *
@ -1895,6 +1910,19 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.h linux-2.4.26-la
+#ifndef REGEXP_H +#ifndef REGEXP_H
+#define REGEXP_H +#define REGEXP_H
+ +
+/*
+http://www.opensource.apple.com/darwinsource/10.3/expect-1/expect/expect.h ,
+which contains a version of this library, says:
+
+ *
+ * NSUBEXP must be at least 10, and no greater than 117 or the parser
+ * will not work properly.
+ *
+
+However, it looks rather like this library is limited to 10. If you think
+otherwise, let us know.
+*/
+
+#define NSUBEXP 10 +#define NSUBEXP 10
+typedef struct regexp { +typedef struct regexp {
+ char *startp[NSUBEXP]; + char *startp[NSUBEXP];
@ -1912,18 +1940,18 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.h linux-2.4.26-la
+void regerror(char *s); +void regerror(char *s);
+ +
+#endif +#endif
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regmagic.h linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regmagic.h diff -Nurp linux-2.4.30/net/ipv4/netfilter/regexp/regmagic.h linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regmagic.h
--- linux-2.4.26-stock/net/ipv4/netfilter/regexp/regmagic.h 1969-12-31 18:00:00.000000000 -0600 --- linux-2.4.30/net/ipv4/netfilter/regexp/regmagic.h 1969-12-31 18:00:00.000000000 -0600
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regmagic.h 2004-06-27 19:07:00.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regmagic.h 2005-05-03 18:37:03.000000000 -0500
@@ -0,0 +1,5 @@ @@ -0,0 +1,5 @@
+/* +/*
+ * The first byte of the regexp internal "program" is actually this magic + * The first byte of the regexp internal "program" is actually this magic
+ * number; the start node begins in the second byte. + * number; the start node begins in the second byte.
+ */ + */
+#define MAGIC 0234 +#define MAGIC 0234
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regsub.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regsub.c diff -Nurp linux-2.4.30/net/ipv4/netfilter/regexp/regsub.c linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regsub.c
--- linux-2.4.26-stock/net/ipv4/netfilter/regexp/regsub.c 1969-12-31 18:00:00.000000000 -0600 --- linux-2.4.30/net/ipv4/netfilter/regexp/regsub.c 1969-12-31 18:00:00.000000000 -0600
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regsub.c 2004-06-27 19:07:00.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regsub.c 2005-05-03 18:37:03.000000000 -0500
@@ -0,0 +1,95 @@ @@ -0,0 +1,95 @@
+/* +/*
+ * regsub + * regsub

Write Preview
Loading…
Cancel
Save