X-Git-Url: http://git.rohieb.name/openwrt.git/blobdiff_plain/a3df50fd61e049a5827878459d7bf0b9e670f2ba..41010d8a600c32dd5095b25828fba5104522bcb8:/target/linux/generic-2.6/patches/101-netfilter_layer7_pktmatch.patch diff --git a/target/linux/generic-2.6/patches/101-netfilter_layer7_pktmatch.patch b/target/linux/generic-2.6/patches/101-netfilter_layer7_pktmatch.patch index 2d7f058ca..cabffacc1 100644 --- a/target/linux/generic-2.6/patches/101-netfilter_layer7_pktmatch.patch +++ b/target/linux/generic-2.6/patches/101-netfilter_layer7_pktmatch.patch @@ -1,35 +1,37 @@ -diff -urN linux-2.6.21.1.old/include/linux/netfilter_ipv4/ipt_layer7.h linux-2.6.21.1.dev/include/linux/netfilter_ipv4/ipt_layer7.h ---- linux-2.6.21.1.old/include/linux/netfilter_ipv4/ipt_layer7.h 2007-05-26 20:17:47.624408296 +0200 -+++ linux-2.6.21.1.dev/include/linux/netfilter_ipv4/ipt_layer7.h 2007-05-26 20:17:48.729240336 +0200 -@@ -21,6 +21,7 @@ +Index: linux-2.6.21.7/include/linux/netfilter/xt_layer7.h +=================================================================== +--- linux-2.6.21.7.orig/include/linux/netfilter/xt_layer7.h ++++ linux-2.6.21.7/include/linux/netfilter/xt_layer7.h +@@ -8,6 +8,7 @@ struct xt_layer7_info { char protocol[MAX_PROTOCOL_LEN]; - char invert:1; char pattern[MAX_PATTERN_LEN]; -+ char pkt; + u_int8_t invert; ++ u_int8_t pkt; }; - #endif /* _IPT_LAYER7_H */ -diff -urN linux-2.6.21.1.old/net/ipv4/netfilter/ipt_layer7.c linux-2.6.21.1.dev/net/ipv4/netfilter/ipt_layer7.c ---- linux-2.6.21.1.old/net/ipv4/netfilter/ipt_layer7.c 2007-05-26 20:17:47.626407992 +0200 -+++ linux-2.6.21.1.dev/net/ipv4/netfilter/ipt_layer7.c 2007-05-26 20:17:48.729240336 +0200 -@@ -296,33 +296,34 @@ - } + #endif /* _XT_LAYER7_H */ +Index: linux-2.6.21.7/net/netfilter/xt_layer7.c +=================================================================== +--- linux-2.6.21.7.orig/net/netfilter/xt_layer7.c ++++ linux-2.6.21.7/net/netfilter/xt_layer7.c +@@ -297,34 +297,36 @@ static int match_no_append(struct nf_con } --/* add the new app data to the conntrack. Return number of bytes added. */ --static int add_data(struct ip_conntrack * master_conntrack, -- char * app_data, int appdatalen) + /* add the new app data to the conntrack. Return number of bytes added. */ +-static int add_data(struct nf_conn * master_conntrack, +- char * app_data, int appdatalen) +static int add_datastr(char *target, int offset, char *app_data, int len) { int length = 0, i; - int oldlength = master_conntrack->layer7.app_data_len; - -- // This is a fix for a race condition by Deti Fliegl. However, I'm not -- // clear on whether the race condition exists or whether this really -- // fixes it. I might just be being dense... Anyway, if it's not really -- // a fix, all it does is waste a very small amount of time. +- /* This is a fix for a race condition by Deti Fliegl. However, I'm not +- clear on whether the race condition exists or whether this really +- fixes it. I might just be being dense... Anyway, if it's not really +- a fix, all it does is waste a very small amount of time. */ - if(!master_conntrack->layer7.app_data) return 0; -+ if(!target) return 0; ++ ++ if (!target) return 0; /* Strip nulls. Make everything lower case (our regex lib doesn't do case insensitivity). Add it to the end of the current data. */ @@ -37,54 +39,55 @@ diff -urN linux-2.6.21.1.old/net/ipv4/netfilter/ipt_layer7.c linux-2.6.21.1.dev/ - i < appdatalen; i++) { + for(i = 0; i < maxdatalen-offset-1 && i < len; i++) { if(app_data[i] != '\0') { + /* the kernel version of tolower mungs 'upper ascii' */ - master_conntrack->layer7.app_data[length+oldlength] = + target[length+offset] = - /* the kernel version of tolower mungs 'upper ascii' */ - isascii(app_data[i])? tolower(app_data[i]) : app_data[i]; + isascii(app_data[i])? + tolower(app_data[i]) : app_data[i]; length++; } } + target[length+offset] = '\0'; ++ ++ return length; ++} - master_conntrack->layer7.app_data[length+oldlength] = '\0'; - master_conntrack->layer7.app_data_len = length + oldlength; -+ return length; -+} -+ +/* add the new app data to the conntrack. Return number of bytes added. */ -+static int add_data(struct ip_conntrack * master_conntrack, -+ char * app_data, int appdatalen) ++static int add_data(struct nf_conn * master_conntrack, ++ char * app_data, int appdatalen) +{ + int length; -+ + + length = add_datastr(master_conntrack->layer7.app_data, master_conntrack->layer7.app_data_len, app_data, appdatalen); + master_conntrack->layer7.app_data_len += length; - return length; } -@@ -339,7 +340,7 @@ - struct ipt_layer7_info * info = (struct ipt_layer7_info *)matchinfo; + +@@ -411,7 +413,7 @@ match(const struct sk_buff *skbin, + const struct xt_layer7_info * info = matchinfo; enum ip_conntrack_info master_ctinfo, ctinfo; - struct ip_conntrack *master_conntrack, *conntrack; + struct nf_conn *master_conntrack, *conntrack; - unsigned char * app_data; + unsigned char *app_data, *tmp_data; unsigned int pattern_result, appdatalen; regexp * comppattern; -@@ -362,8 +363,8 @@ +@@ -439,8 +441,8 @@ match(const struct sk_buff *skbin, master_conntrack = master_ct(master_conntrack); /* if we've classified it or seen too many packets */ - if(TOTAL_PACKETS > num_packets || - master_conntrack->layer7.app_proto) { + if(!info->pkt && (TOTAL_PACKETS > num_packets || -+ master_conntrack->layer7.app_proto)) { - - pattern_result = match_no_append(conntrack, master_conntrack, ctinfo, master_ctinfo, info); ++ master_conntrack->layer7.app_proto)) { -@@ -394,6 +395,23 @@ + pattern_result = match_no_append(conntrack, master_conntrack, + ctinfo, master_ctinfo, info); +@@ -473,6 +475,25 @@ match(const struct sk_buff *skbin, + /* the return value gets checked later, when we're ready to use it */ comppattern = compile_and_cache(info->pattern, info->protocol); - spin_unlock_bh(&list_lock); + if (info->pkt) { + tmp_data = kmalloc(maxdatalen, GFP_ATOMIC); @@ -97,12 +100,14 @@ diff -urN linux-2.6.21.1.old/net/ipv4/netfilter/ipt_layer7.c linux-2.6.21.1.dev/ + tmp_data[0] = '\0'; + add_datastr(tmp_data, 0, app_data, appdatalen); + pattern_result = ((comppattern && regexec(comppattern, tmp_data)) ? 1 : 0); ++ + kfree(tmp_data); + tmp_data = NULL; ++ spin_unlock_bh(&l7_lock); + + return (pattern_result ^ info->invert); + } + /* On the first packet of a connection, allocate space for app data */ - write_lock(&ct_lock); - if(TOTAL_PACKETS == 1 && !skb->cb[0] && !master_conntrack->layer7.app_data) { + if(TOTAL_PACKETS == 1 && !skb->cb[0] && + !master_conntrack->layer7.app_data){