add layer7 to iptables/kernel
[openwrt.git] / openwrt / package / iptables / patches / 02-layer7-1.1.patch
1 diff -Nurp iptables-1.3.0-stock/extensions/.layer7-test iptables-1.3.0-layer7/extensions/.layer7-test
2 --- iptables-1.3.0-stock/extensions/.layer7-test 1969-12-31 18:00:00.000000000 -0600
3 +++ iptables-1.3.0-layer7/extensions/.layer7-test 2005-03-01 22:12:06.000000000 -0600
4 @@ -0,0 +1,2 @@
5 +#! /bin/sh
6 +[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_layer7.h ] && echo layer7
7 diff -Nurp iptables-1.3.0-stock/extensions/libipt_layer7.c iptables-1.3.0-layer7/extensions/libipt_layer7.c
8 --- iptables-1.3.0-stock/extensions/libipt_layer7.c 1969-12-31 18:00:00.000000000 -0600
9 +++ iptables-1.3.0-layer7/extensions/libipt_layer7.c 2005-03-06 22:14:13.000000000 -0600
10 @@ -0,0 +1,357 @@
11 +/*
12 + Shared library add-on to iptables to add layer 7 matching support.
13 +
14 + By Matthew Strait <quadong@users.sf.net>, Oct 2003.
15 +
16 + http://l7-filter.sf.net
17 +
18 + This program is free software; you can redistribute it and/or
19 + modify it under the terms of the GNU General Public License
20 + as published by the Free Software Foundation; either version
21 + 2 of the License, or (at your option) any later version.
22 + http://www.gnu.org/licenses/gpl.txt
23 +
24 + Based on libipt_string.c (C) 2000 Emmanuel Roger <winfield@freegates.be>
25 +*/
26 +
27 +#define _GNU_SOURCE
28 +#include <stdio.h>
29 +#include <netdb.h>
30 +#include <string.h>
31 +#include <stdlib.h>
32 +#include <getopt.h>
33 +#include <ctype.h>
34 +#include <dirent.h>
35 +
36 +#include <iptables.h>
37 +#include <linux/netfilter_ipv4/ipt_layer7.h>
38 +
39 +#define MAX_FN_LEN 256
40 +
41 +static char l7dir[MAX_FN_LEN] = "\0";
42 +
43 +/* Function which prints out usage message. */
44 +static void help(void)
45 +{
46 + printf(
47 + "LAYER7 match v%s options:\n"
48 + "--l7dir <directory> : Look for patterns here instead of /etc/l7-protocols/\n"
49 + " (--l7dir must be specified before --l7proto if used!)\n"
50 + "--l7proto [!] <name> : Match the protocol defined in /etc/l7-protocols/name.pat\n",
51 + IPTABLES_VERSION);
52 + fputc('\n', stdout);
53 +}
54 +
55 +static struct option opts[] = {
56 + { .name = "l7proto", .has_arg = 1, .flag = 0, .val = '1' },
57 + { .name = "l7dir", .has_arg = 1, .flag = 0, .val = '2' },
58 + { .name = 0 }
59 +};
60 +
61 +/* Initialize the match. */
62 +static void init(struct ipt_entry_match *m, unsigned int *nfcache)
63 +{
64 + *nfcache |= NFC_UNKNOWN;
65 +}
66 +
67 +/* reads filename, puts protocol info into layer7_protocol_info, number of protocols to numprotos */
68 +int parse_protocol_file(char * filename, const unsigned char * protoname, struct ipt_layer7_info *info)
69 +{
70 + FILE * f;
71 + char * line = NULL;
72 + size_t len = 0;
73 +
74 + enum { protocol, pattern, done } datatype = protocol;
75 +
76 + f = fopen(filename, "r");
77 +
78 + if(!f)
79 + return 0;
80 +
81 + while(getline(&line, &len, f) != -1)
82 + {
83 + if(strlen(line) < 2 || line[0] == '#')
84 + continue;
85 +
86 + /* strip the pesky newline... */
87 + if(line[strlen(line) - 1] == '\n')
88 + line[strlen(line) - 1] = '\0';
89 +
90 + if(datatype == protocol)
91 + {
92 + if(strcmp(line, protoname))
93 + exit_error(OTHER_PROBLEM,
94 + "Protocol name (%s) doesn't match file name (%s). Bailing out\n",
95 + protoname, filename);
96 +
97 + if(strlen(line) >= MAX_PROTOCOL_LEN)
98 + exit_error(PARAMETER_PROBLEM,
99 + "Protocol name in %s too long!", filename);
100 + strncpy(info->protocol, line, MAX_PROTOCOL_LEN);
101 +
102 + datatype = pattern;
103 + }
104 + else if(datatype == pattern)
105 + {
106 + if(strlen(line) >= MAX_PATTERN_LEN)
107 + exit_error(PARAMETER_PROBLEM, "Pattern in %s too long!", filename);
108 + strncpy(info->pattern, line, MAX_PATTERN_LEN);
109 +
110 + datatype = done;
111 + break;
112 + }
113 + else
114 + exit_error(OTHER_PROBLEM, "Internal error");
115 + }
116 +
117 + if(datatype != done)
118 + exit_error(OTHER_PROBLEM, "Failed to get all needed data from %s", filename);
119 +
120 + if(line) free(line);
121 + fclose(f);
122 +
123 + return 1;
124 +
125 +/*
126 + fprintf(stderr, "protocol: %s\npattern: %s\n\n",
127 + info->protocol,
128 + info->pattern);
129 +*/
130 +}
131 +
132 +static int hex2dec(char c)
133 +{
134 + switch (c)
135 + {
136 + case '0' ... '9':
137 + return c - '0';
138 + case 'a' ... 'f':
139 + return c - 'a' + 10;
140 + case 'A' ... 'F':
141 + return c - 'A' + 10;
142 + default:
143 + exit_error(OTHER_PROBLEM, "hex2dec: bad value!\n");
144 + return 0;
145 + }
146 +}
147 +
148 +/* takes a string with \xHH escapes and returns one with the characters
149 +they stand for */
150 +static char * pre_process(char * s)
151 +{
152 + char * result = malloc(strlen(s) + 1);
153 + int sindex = 0, rindex = 0;
154 + while( sindex < strlen(s) )
155 + {
156 + if( sindex + 3 < strlen(s) &&
157 + s[sindex] == '\\' && s[sindex+1] == 'x' &&
158 + isxdigit(s[sindex + 2]) && isxdigit(s[sindex + 3]) )
159 + {
160 + /* carefully remember to call tolower here... */
161 + result[rindex] = tolower( hex2dec(s[sindex + 2])*16 +
162 + hex2dec(s[sindex + 3] ) );
163 + sindex += 3; /* 4 total */
164 + }
165 + else
166 + result[rindex] = tolower(s[sindex]);
167 +
168 + sindex++;
169 + rindex++;
170 + }
171 + result[rindex] = '\0';
172 +
173 + return result;
174 +}
175 +
176 +#define MAX_SUBDIRS 128
177 +char ** readl7dir(char * dirname)
178 +{
179 + DIR * scratchdir;
180 + struct dirent ** namelist;
181 + char ** subdirs = malloc(MAX_SUBDIRS * sizeof(char *));
182 +
183 + int n, d = 1;
184 + subdirs[0] = "";
185 +
186 + n = scandir(dirname, &namelist, 0, alphasort);
187 +
188 + if (n < 0)
189 + {
190 + perror("scandir");
191 + exit_error(OTHER_PROBLEM, "Couldn't open %s\n", dirname);
192 + }
193 + else
194 + {
195 + while(n--)
196 + {
197 + char fulldirname[MAX_FN_LEN];
198 +
199 + snprintf(fulldirname, MAX_FN_LEN, "%s/%s", dirname, namelist[n]->d_name);
200 +
201 + if((scratchdir = opendir(fulldirname)) != NULL)
202 + {
203 + closedir(scratchdir);
204 +
205 + if(!strcmp(namelist[n]->d_name, ".") ||
206 + !strcmp(namelist[n]->d_name, ".."))
207 + /* do nothing */ ;
208 + else
209 + {
210 + subdirs[d] = malloc(strlen(namelist[n]->d_name) + 1);
211 + strcpy(subdirs[d], namelist[n]->d_name);
212 + d++;
213 + if(d >= MAX_SUBDIRS - 1)
214 + {
215 + fprintf(stderr,
216 + "Too many subdirectories, skipping the rest!\n");
217 + break;
218 + }
219 + }
220 + }
221 + free(namelist[n]);
222 + }
223 + free(namelist);
224 + }
225 +
226 + subdirs[d] = NULL;
227 +
228 + return subdirs;
229 +}
230 +
231 +static void
232 +parse_layer7_protocol(const unsigned char *s, struct ipt_layer7_info *info)
233 +{
234 + char filename[MAX_FN_LEN];
235 + char * dir = NULL;
236 + char ** subdirs;
237 + int n = 0, done = 0;
238 +
239 + if(strlen(l7dir) > 0)
240 + dir = l7dir;
241 + else
242 + dir = "/etc/l7-protocols";
243 +
244 + subdirs = readl7dir(dir);
245 +
246 + while(subdirs[n] != NULL)
247 + {
248 + int c = snprintf(filename, MAX_FN_LEN, "%s/%s/%s.pat", dir, subdirs[n], s);
249 +
250 + //fprintf(stderr, "Trying to find pattern in %s ... ", filename);
251 +
252 + if(c > MAX_FN_LEN)
253 + {
254 + exit_error(OTHER_PROBLEM,
255 + "Filename beginning with %s is too long!\n", filename);
256 + }
257 +
258 + /* read in the pattern from the file */
259 + if(parse_protocol_file(filename, s, info))
260 + {
261 + //fprintf(stderr, "found\n");
262 + done = 1;
263 + break;
264 + }
265 +
266 + //fprintf(stderr, "not found\n");
267 +
268 + n++;
269 + }
270 +
271 + if(!done)
272 + exit_error(OTHER_PROBLEM,
273 + "Couldn't find a pattern definition file for %s.\n", s);
274 +
275 + /* process \xHH escapes and tolower everything. (our regex lib has no
276 + case insensitivity option.) */
277 + strncpy(info->pattern, pre_process(info->pattern), MAX_PATTERN_LEN);
278 +}
279 +
280 +/* Function which parses command options; returns true if it ate an option */
281 +static int parse(int c, char **argv, int invert, unsigned int *flags,
282 + const struct ipt_entry *entry, unsigned int *nfcache,
283 + struct ipt_entry_match **match)
284 +{
285 + struct ipt_layer7_info *layer7info =
286 + (struct ipt_layer7_info *)(*match)->data;
287 +
288 + switch (c) {
289 + case '1':
290 + check_inverse(optarg, &invert, &optind, 0);
291 + parse_layer7_protocol(argv[optind-1], layer7info);
292 + if (invert)
293 + layer7info->invert = 1;
294 + *flags = 1;
295 + break;
296 +
297 + case '2':
298 + /* not going to use this, but maybe we need to strip a ! anyway (?) */
299 + check_inverse(optarg, &invert, &optind, 0);
300 +
301 + if(strlen(argv[optind-1]) >= MAX_FN_LEN)
302 + exit_error(PARAMETER_PROBLEM, "directory name too long\n");
303 +
304 + strncpy(l7dir, argv[optind-1], MAX_FN_LEN);
305 +
306 + *flags = 1;
307 + break;
308 +
309 + default:
310 + return 0;
311 + }
312 +
313 + return 1;
314 +}
315 +
316 +/* Final check; must have specified --pattern. */
317 +static void final_check(unsigned int flags)
318 +{
319 + if (!flags)
320 + exit_error(PARAMETER_PROBLEM,
321 + "LAYER7 match: You must specify `--pattern'");
322 +}
323 +
324 +static void print_protocol(char s[], int invert, int numeric)
325 +{
326 + fputs("l7proto ", stdout);
327 + if (invert) fputc('!', stdout);
328 + printf("%s ", s);
329 +}
330 +
331 +/* Prints out the matchinfo. */
332 +static void print(const struct ipt_ip *ip,
333 + const struct ipt_entry_match *match,
334 + int numeric)
335 +{
336 + printf("LAYER7 ");
337 +
338 + print_protocol(((struct ipt_layer7_info *)match->data)->protocol,
339 + ((struct ipt_layer7_info *)match->data)->invert, numeric);
340 +}
341 +/* Saves the union ipt_matchinfo in parsable form to stdout. */
342 +static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
343 +{
344 + const struct ipt_layer7_info *info =
345 + (const struct ipt_layer7_info*) match->data;
346 +
347 + printf("--l7proto %s%s ", (info->invert) ? "! ": "", info->protocol);
348 +}
349 +
350 +static struct iptables_match layer7 = {
351 + .name = "layer7",
352 + .version = IPTABLES_VERSION,
353 + .size = IPT_ALIGN(sizeof(struct ipt_layer7_info)),
354 + .userspacesize = IPT_ALIGN(sizeof(struct ipt_layer7_info)),
355 + .help = &help,
356 + .init = &init,
357 + .parse = &parse,
358 + .final_check = &final_check,
359 + .print = &print,
360 + .save = &save,
361 + .extra_opts = opts
362 +};
363 +
364 +void _init(void)
365 +{
366 + register_match(&layer7);
367 +}
368 diff -Nurp iptables-1.3.0-stock/extensions/libipt_layer7.c.orig iptables-1.3.0-layer7/extensions/libipt_layer7.c.orig
369 --- iptables-1.3.0-stock/extensions/libipt_layer7.c.orig 1969-12-31 18:00:00.000000000 -0600
370 +++ iptables-1.3.0-layer7/extensions/libipt_layer7.c.orig 2005-03-06 22:20:28.000000000 -0600
371 @@ -0,0 +1,357 @@
372 +/*
373 + Shared library add-on to iptables to add layer 7 matching support.
374 +
375 + By Matthew Strait <quadong@users.sf.net>, Oct 2003.
376 +
377 + http://l7-filter.sf.net
378 +
379 + This program is free software; you can redistribute it and/or
380 + modify it under the terms of the GNU General Public License
381 + as published by the Free Software Foundation; either version
382 + 2 of the License, or (at your option) any later version.
383 + http://www.gnu.org/licenses/gpl.txt
384 +
385 + Based on libipt_string.c (C) 2000 Emmanuel Roger <winfield@freegates.be>
386 +*/
387 +
388 +#define _GNU_SOURCE
389 +#include <stdio.h>
390 +#include <netdb.h>
391 +#include <string.h>
392 +#include <stdlib.h>
393 +#include <getopt.h>
394 +#include <ctype.h>
395 +#include <dirent.h>
396 +
397 +#include <iptables.h>
398 +#include <linux/netfilter_ipv4/ipt_layer7.h>
399 +
400 +#define MAX_FN_LEN 256
401 +
402 +static char l7dir[MAX_FN_LEN] = "\0";
403 +
404 +/* Function which prints out usage message. */
405 +static void help(void)
406 +{
407 + printf(
408 + "LAYER7 match v%s options:\n"
409 + "--l7dir <directory> : Look for patterns here instead of /etc/l7-protocols/\n"
410 + " (--l7dir must be specified before --l7proto if used!)\n"
411 + "--l7proto [!] <name> : Match the protocol defined in /etc/l7-protocols/name.pat\n",
412 + IPTABLES_VERSION);
413 + fputc('\n', stdout);
414 +}
415 +
416 +static struct option opts[] = {
417 + { .name = "l7proto", .has_arg = 1, .flag = 0, .val = '1' },
418 + { .name = "l7dir", .has_arg = 1, .flag = 0, .val = '2' },
419 + { .name = 0 }
420 +};
421 +
422 +/* Initialize the match. */
423 +static void init(struct ipt_entry_match *m, unsigned int *nfcache)
424 +{
425 + *nfcache |= NFC_UNKNOWN;
426 +}
427 +
428 +/* reads filename, puts protocol info into layer7_protocol_info, number of protocols to numprotos */
429 +int parse_protocol_file(char * filename, const unsigned char * protoname, struct ipt_layer7_info *info)
430 +{
431 + FILE * f;
432 + char * line = NULL;
433 + int len = 0;
434 +
435 + enum { protocol, pattern, done } datatype = protocol;
436 +
437 + f = fopen(filename, "r");
438 +
439 + if(!f)
440 + return 0;
441 +
442 + while(getline(&line, &len, f) != -1)
443 + {
444 + if(strlen(line) < 2 || line[0] == '#')
445 + continue;
446 +
447 + /* strip the pesky newline... */
448 + if(line[strlen(line) - 1] == '\n')
449 + line[strlen(line) - 1] = '\0';
450 +
451 + if(datatype == protocol)
452 + {
453 + if(strcmp(line, protoname))
454 + exit_error(OTHER_PROBLEM,
455 + "Protocol name (%s) doesn't match file name (%s). Bailing out\n",
456 + protoname, filename);
457 +
458 + if(strlen(line) >= MAX_PROTOCOL_LEN)
459 + exit_error(PARAMETER_PROBLEM,
460 + "Protocol name in %s too long!", filename);
461 + strncpy(info->protocol, line, MAX_PROTOCOL_LEN);
462 +
463 + datatype = pattern;
464 + }
465 + else if(datatype == pattern)
466 + {
467 + if(strlen(line) >= MAX_PATTERN_LEN)
468 + exit_error(PARAMETER_PROBLEM, "Pattern in %s too long!", filename);
469 + strncpy(info->pattern, line, MAX_PATTERN_LEN);
470 +
471 + datatype = done;
472 + break;
473 + }
474 + else
475 + exit_error(OTHER_PROBLEM, "Internal error");
476 + }
477 +
478 + if(datatype != done)
479 + exit_error(OTHER_PROBLEM, "Failed to get all needed data from %s", filename);
480 +
481 + if(line) free(line);
482 + fclose(f);
483 +
484 + return 1;
485 +
486 +/*
487 + fprintf(stderr, "protocol: %s\npattern: %s\n\n",
488 + info->protocol,
489 + info->pattern);
490 +*/
491 +}
492 +
493 +static int hex2dec(char c)
494 +{
495 + switch (c)
496 + {
497 + case '0' ... '9':
498 + return c - '0';
499 + case 'a' ... 'f':
500 + return c - 'a' + 10;
501 + case 'A' ... 'F':
502 + return c - 'A' + 10;
503 + default:
504 + exit_error(OTHER_PROBLEM, "hex2dec: bad value!\n");
505 + return 0;
506 + }
507 +}
508 +
509 +/* takes a string with \xHH escapes and returns one with the characters
510 +they stand for */
511 +static char * pre_process(char * s)
512 +{
513 + char * result = malloc(strlen(s) + 1);
514 + int sindex = 0, rindex = 0;
515 + while( sindex < strlen(s) )
516 + {
517 + if( sindex + 3 < strlen(s) &&
518 + s[sindex] == '\\' && s[sindex+1] == 'x' &&
519 + isxdigit(s[sindex + 2]) && isxdigit(s[sindex + 3]) )
520 + {
521 + /* carefully remember to call tolower here... */
522 + result[rindex] = tolower( hex2dec(s[sindex + 2])*16 +
523 + hex2dec(s[sindex + 3] ) );
524 + sindex += 3; /* 4 total */
525 + }
526 + else
527 + result[rindex] = tolower(s[sindex]);
528 +
529 + sindex++;
530 + rindex++;
531 + }
532 + result[rindex] = '\0';
533 +
534 + return result;
535 +}
536 +
537 +#define MAX_SUBDIRS 128
538 +char ** readl7dir(char * dirname)
539 +{
540 + DIR * scratchdir;
541 + struct dirent ** namelist;
542 + char ** subdirs = malloc(MAX_SUBDIRS * sizeof(char *));
543 +
544 + int n, d = 1;
545 + subdirs[0] = "";
546 +
547 + n = scandir(dirname, &namelist, 0, alphasort);
548 +
549 + if (n < 0)
550 + {
551 + perror("scandir");
552 + exit_error(OTHER_PROBLEM, "Couldn't open %s\n", dirname);
553 + }
554 + else
555 + {
556 + while(n--)
557 + {
558 + char fulldirname[MAX_FN_LEN];
559 +
560 + snprintf(fulldirname, MAX_FN_LEN, "%s/%s", dirname, namelist[n]->d_name);
561 +
562 + if((scratchdir = opendir(fulldirname)) != NULL)
563 + {
564 + closedir(scratchdir);
565 +
566 + if(!strcmp(namelist[n]->d_name, ".") ||
567 + !strcmp(namelist[n]->d_name, ".."))
568 + /* do nothing */ ;
569 + else
570 + {
571 + subdirs[d] = malloc(strlen(namelist[n]->d_name) + 1);
572 + strcpy(subdirs[d], namelist[n]->d_name);
573 + d++;
574 + if(d >= MAX_SUBDIRS - 1)
575 + {
576 + fprintf(stderr,
577 + "Too many subdirectories, skipping the rest!\n");
578 + break;
579 + }
580 + }
581 + }
582 + free(namelist[n]);
583 + }
584 + free(namelist);
585 + }
586 +
587 + subdirs[d] = NULL;
588 +
589 + return subdirs;
590 +}
591 +
592 +static void
593 +parse_layer7_protocol(const unsigned char *s, struct ipt_layer7_info *info)
594 +{
595 + char filename[MAX_FN_LEN];
596 + char * dir = NULL;
597 + char ** subdirs;
598 + int n = 0, done = 0;
599 +
600 + if(strlen(l7dir) > 0)
601 + dir = l7dir;
602 + else
603 + dir = "/etc/l7-protocols";
604 +
605 + subdirs = readl7dir(dir);
606 +
607 + while(subdirs[n] != NULL)
608 + {
609 + int c = snprintf(filename, MAX_FN_LEN, "%s/%s/%s.pat", dir, subdirs[n], s);
610 +
611 + //fprintf(stderr, "Trying to find pattern in %s ... ", filename);
612 +
613 + if(c > MAX_FN_LEN)
614 + {
615 + exit_error(OTHER_PROBLEM,
616 + "Filename beginning with %s is too long!\n", filename);
617 + }
618 +
619 + /* read in the pattern from the file */
620 + if(parse_protocol_file(filename, s, info))
621 + {
622 + //fprintf(stderr, "found\n");
623 + done = 1;
624 + break;
625 + }
626 +
627 + //fprintf(stderr, "not found\n");
628 +
629 + n++;
630 + }
631 +
632 + if(!done)
633 + exit_error(OTHER_PROBLEM,
634 + "Couldn't find a pattern definition file for %s.\n", s);
635 +
636 + /* process \xHH escapes and tolower everything. (our regex lib has no
637 + case insensitivity option.) */
638 + strncpy(info->pattern, pre_process(info->pattern), MAX_PATTERN_LEN);
639 +}
640 +
641 +/* Function which parses command options; returns true if it ate an option */
642 +static int parse(int c, char **argv, int invert, unsigned int *flags,
643 + const struct ipt_entry *entry, unsigned int *nfcache,
644 + struct ipt_entry_match **match)
645 +{
646 + struct ipt_layer7_info *layer7info =
647 + (struct ipt_layer7_info *)(*match)->data;
648 +
649 + switch (c) {
650 + case '1':
651 + check_inverse(optarg, &invert, &optind, 0);
652 + parse_layer7_protocol(argv[optind-1], layer7info);
653 + if (invert)
654 + layer7info->invert = 1;
655 + *flags = 1;
656 + break;
657 +
658 + case '2':
659 + /* not going to use this, but maybe we need to strip a ! anyway (?) */
660 + check_inverse(optarg, &invert, &optind, 0);
661 +
662 + if(strlen(argv[optind-1]) >= MAX_FN_LEN)
663 + exit_error(PARAMETER_PROBLEM, "directory name too long\n");
664 +
665 + strncpy(l7dir, argv[optind-1], MAX_FN_LEN);
666 +
667 + *flags = 1;
668 + break;
669 +
670 + default:
671 + return 0;
672 + }
673 +
674 + return 1;
675 +}
676 +
677 +/* Final check; must have specified --pattern. */
678 +static void final_check(unsigned int flags)
679 +{
680 + if (!flags)
681 + exit_error(PARAMETER_PROBLEM,
682 + "LAYER7 match: You must specify `--pattern'");
683 +}
684 +
685 +static void print_protocol(char s[], int invert, int numeric)
686 +{
687 + fputs("l7proto ", stdout);
688 + if (invert) fputc('!', stdout);
689 + printf("%s ", s);
690 +}
691 +
692 +/* Prints out the matchinfo. */
693 +static void print(const struct ipt_ip *ip,
694 + const struct ipt_entry_match *match,
695 + int numeric)
696 +{
697 + printf("LAYER7 ");
698 +
699 + print_protocol(((struct ipt_layer7_info *)match->data)->protocol,
700 + ((struct ipt_layer7_info *)match->data)->invert, numeric);
701 +}
702 +/* Saves the union ipt_matchinfo in parsable form to stdout. */
703 +static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
704 +{
705 + const struct ipt_layer7_info *info =
706 + (const struct ipt_layer7_info*) match->data;
707 +
708 + printf("--l7proto %s%s ", (info->invert) ? "! ": "", info->protocol);
709 +}
710 +
711 +static struct iptables_match layer7 = {
712 + .name = "layer7",
713 + .version = IPTABLES_VERSION,
714 + .size = IPT_ALIGN(sizeof(struct ipt_layer7_info)),
715 + .userspacesize = IPT_ALIGN(sizeof(struct ipt_layer7_info)),
716 + .help = &help,
717 + .init = &init,
718 + .parse = &parse,
719 + .final_check = &final_check,
720 + .print = &print,
721 + .save = &save,
722 + .extra_opts = opts
723 +};
724 +
725 +void _init(void)
726 +{
727 + register_match(&layer7);
728 +}
729 diff -Nurp iptables-1.3.0-stock/extensions/libipt_layer7.man iptables-1.3.0-layer7/extensions/libipt_layer7.man
730 --- iptables-1.3.0-stock/extensions/libipt_layer7.man 1969-12-31 18:00:00.000000000 -0600
731 +++ iptables-1.3.0-layer7/extensions/libipt_layer7.man 2005-03-01 22:12:06.000000000 -0600
732 @@ -0,0 +1,13 @@
733 +This module matches packets based on the application layer data of
734 +their connections. It uses regular expression matching to compare
735 +the application layer data to regular expressions found it the layer7
736 +configuration files. This is an experimental module which can be found at
737 +http://l7-filter.sf.net. It takes two options.
738 +.TP
739 +.BI "--l7proto " "\fIprotocol\fP"
740 +Match the specified protocol. The protocol name must match a file
741 +name in /etc/l7-protocols/
742 +.TP
743 +.BI "--l7dir " "\fIdirectory\fP"
744 +Use \fIdirectory\fP instead of /etc/l7-protocols/
745 +
746 --- iptables-1.3.1/extensions/Makefile.orig 2005-04-01 23:02:50.000000000 +0200
747 +++ iptables-1.3.1/extensions/Makefile 2005-04-01 23:03:06.000000000 +0200
748 @@ -11,6 +11,8 @@
749
750 # ipp2p
751 PF_EXT_SLIB += ipp2p
752 +# layer7
753 +PF_EXT_SLIB += layer7
754
755 # Optionals
756 PF_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T)))
This page took 0.071178 seconds and 5 git commands to generate.