package/iptables/patches/02-layer7-1.1.patch

   1 diff -Nurp iptables-1.3.0-stock/extensions/.layer7-test iptables-1.3.0-layer7/extensions/.layer7-test
   2 --- iptables-1.3.0-stock/extensions/.layer7-test        1969-12-31 18:00:00.000000000 -0600
   3 +++ iptables-1.3.0-layer7/extensions/.layer7-test       2005-03-01 22:12:06.000000000 -0600
   4 @@ -0,0 +1,2 @@
   5 +#! /bin/sh
   6 +[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_layer7.h ] && echo layer7
   7 diff -Nurp iptables-1.3.0-stock/extensions/libipt_layer7.c iptables-1.3.0-layer7/extensions/libipt_layer7.c
   8 --- iptables-1.3.0-stock/extensions/libipt_layer7.c     1969-12-31 18:00:00.000000000 -0600
   9 +++ iptables-1.3.0-layer7/extensions/libipt_layer7.c    2005-03-06 22:14:13.000000000 -0600
  10 @@ -0,0 +1,357 @@
  11 +/*
  12 +   Shared library add-on to iptables to add layer 7 matching support.
  13 +
  14 +   By Matthew Strait <quadong@users.sf.net>, Oct 2003.
  15 +
  16 +   http://l7-filter.sf.net
  17 +
  18 +   This program is free software; you can redistribute it and/or
  19 +   modify it under the terms of the GNU General Public License
  20 +   as published by the Free Software Foundation; either version
  21 +   2 of the License, or (at your option) any later version.
  22 +   http://www.gnu.org/licenses/gpl.txt
  23 +
  24 +   Based on libipt_string.c (C) 2000 Emmanuel Roger <winfield@freegates.be>
  25 +*/
  26 +
  27 +#define _GNU_SOURCE
  28 +#include <stdio.h>
  29 +#include <netdb.h>
  30 +#include <string.h>
  31 +#include <stdlib.h>
  32 +#include <getopt.h>
  33 +#include <ctype.h>
  34 +#include <dirent.h>
  35 +
  36 +#include <iptables.h>
  37 +#include <linux/netfilter_ipv4/ipt_layer7.h>
  38 +
  39 +#define MAX_FN_LEN 256
  40 +
  41 +static char l7dir[MAX_FN_LEN] = "\0";
  42 +
  43 +/* Function which prints out usage message. */
  44 +static void help(void)
  45 +{
  46 +       printf(
  47 +       "LAYER7 match v%s options:\n"
  48 +       "--l7dir <directory>  : Look for patterns here instead of /etc/l7-protocols/\n"
  49 +       "                       (--l7dir must be specified before --l7proto if used!)\n"
  50 +       "--l7proto [!] <name> : Match the protocol defined in /etc/l7-protocols/name.pat\n",
  51 +       IPTABLES_VERSION);
  52 +       fputc('\n', stdout);
  53 +}
  54 +
  55 +static struct option opts[] = {
  56 +       { .name = "l7proto", .has_arg = 1, .flag = 0, .val = '1' },
  57 +       { .name = "l7dir",   .has_arg = 1, .flag = 0, .val = '2' },
  58 +       { .name = 0 }
  59 +};
  60 +
  61 +/* Initialize the match. */
  62 +static void init(struct ipt_entry_match *m, unsigned int *nfcache)
  63 +{
  64 +       *nfcache |= NFC_UNKNOWN;
  65 +}
  66 +
  67 +/* reads filename, puts protocol info into layer7_protocol_info, number of protocols to numprotos */
  68 +int parse_protocol_file(char * filename, const unsigned char * protoname, struct ipt_layer7_info *info)
  69 +{
  70 +       FILE * f;
  71 +       char * line = NULL;
  72 +       size_t len = 0;
  73 +
  74 +       enum { protocol, pattern, done } datatype = protocol;
  75 +
  76 +       f = fopen(filename, "r");
  77 +
  78 +       if(!f)
  79 +               return 0;
  80 +
  81 +       while(getline(&line, &len, f) != -1)
  82 +       {
  83 +               if(strlen(line) < 2 || line[0] == '#')
  84 +                       continue;
  85 +
  86 +               /* strip the pesky newline... */
  87 +               if(line[strlen(line) - 1] == '\n')
  88 +                       line[strlen(line) - 1] = '\0';
  89 +
  90 +               if(datatype == protocol)
  91 +               {
  92 +                       if(strcmp(line, protoname))
  93 +                               exit_error(OTHER_PROBLEM,
  94 +                                       "Protocol name (%s) doesn't match file name (%s).  Bailing out\n",
  95 +                                       protoname, filename);
  96 +
  97 +                       if(strlen(line) >= MAX_PROTOCOL_LEN)
  98 +                                exit_error(PARAMETER_PROBLEM,
  99 +                                       "Protocol name in %s too long!", filename);
 100 +                       strncpy(info->protocol, line, MAX_PROTOCOL_LEN);
 101 +
 102 +                       datatype = pattern;
 103 +               }
 104 +               else if(datatype == pattern)
 105 +               {
 106 +                       if(strlen(line) >= MAX_PATTERN_LEN)
 107 +                                exit_error(PARAMETER_PROBLEM, "Pattern in %s too long!", filename);
 108 +                       strncpy(info->pattern, line, MAX_PATTERN_LEN);
 109 +
 110 +                       datatype = done;
 111 +                       break;
 112 +               }
 113 +               else
 114 +                       exit_error(OTHER_PROBLEM, "Internal error");
 115 +       }
 116 +
 117 +       if(datatype != done)
 118 +               exit_error(OTHER_PROBLEM, "Failed to get all needed data from %s", filename);
 119 +
 120 +       if(line) free(line);
 121 +       fclose(f);
 122 +
 123 +       return 1;
 124 +
 125 +/*
 126 +       fprintf(stderr, "protocol: %s\npattern: %s\n\n",
 127 +                       info->protocol,
 128 +                       info->pattern);
 129 +*/
 130 +}
 131 +
 132 +static int hex2dec(char c)
 133 +{
 134 +        switch (c)
 135 +        {
 136 +                case '0' ... '9':
 137 +                        return c - '0';
 138 +                case 'a' ... 'f':
 139 +                        return c - 'a' + 10;
 140 +                case 'A' ... 'F':
 141 +                        return c - 'A' + 10;
 142 +                default:
 143 +                        exit_error(OTHER_PROBLEM, "hex2dec: bad value!\n");
 144 +                        return 0;
 145 +        }
 146 +}
 147 +
 148 +/* takes a string with \xHH escapes and returns one with the characters
 149 +they stand for */
 150 +static char * pre_process(char * s)
 151 +{
 152 +       char * result = malloc(strlen(s) + 1);
 153 +       int sindex = 0, rindex = 0;
 154 +        while( sindex < strlen(s) )
 155 +        {
 156 +            if( sindex + 3 < strlen(s) &&
 157 +                s[sindex] == '\\' && s[sindex+1] == 'x' &&
 158 +                isxdigit(s[sindex + 2]) && isxdigit(s[sindex + 3]) )
 159 +                {
 160 +                        /* carefully remember to call tolower here... */
 161 +                        result[rindex] = tolower( hex2dec(s[sindex + 2])*16 +
 162 +                                                  hex2dec(s[sindex + 3] ) );
 163 +                        sindex += 3; /* 4 total */
 164 +                }
 165 +                else
 166 +                        result[rindex] = tolower(s[sindex]);
 167 +
 168 +               sindex++;
 169 +               rindex++;
 170 +        }
 171 +       result[rindex] = '\0';
 172 +
 173 +       return result;
 174 +}
 175 +
 176 +#define MAX_SUBDIRS 128
 177 +char ** readl7dir(char * dirname)
 178 +{
 179 +        DIR             * scratchdir;
 180 +        struct dirent   ** namelist;
 181 +       char ** subdirs = malloc(MAX_SUBDIRS * sizeof(char *));
 182 +
 183 +        int n, d = 1;
 184 +       subdirs[0] = "";
 185 +
 186 +        n = scandir(dirname, &namelist, 0, alphasort);
 187 +
 188 +       if (n < 0)
 189 +       {
 190 +            perror("scandir");
 191 +           exit_error(OTHER_PROBLEM, "Couldn't open %s\n", dirname);
 192 +       }
 193 +        else
 194 +       {
 195 +               while(n--)
 196 +               {
 197 +                       char fulldirname[MAX_FN_LEN];
 198 +
 199 +                       snprintf(fulldirname, MAX_FN_LEN, "%s/%s", dirname, namelist[n]->d_name);
 200 +
 201 +                       if((scratchdir = opendir(fulldirname)) != NULL)
 202 +                       {
 203 +                               closedir(scratchdir);
 204 +
 205 +                               if(!strcmp(namelist[n]->d_name, ".") ||
 206 +                                  !strcmp(namelist[n]->d_name, ".."))
 207 +                                       /* do nothing */ ;
 208 +                               else
 209 +                               {
 210 +                                       subdirs[d] = malloc(strlen(namelist[n]->d_name) + 1);
 211 +                                       strcpy(subdirs[d], namelist[n]->d_name);
 212 +                                       d++;
 213 +                                       if(d >= MAX_SUBDIRS - 1)
 214 +                                       {
 215 +                                               fprintf(stderr,
 216 +                                                 "Too many subdirectories, skipping the rest!\n");
 217 +                                               break;
 218 +                                       }
 219 +                               }
 220 +                       }
 221 +                       free(namelist[n]);
 222 +               }
 223 +               free(namelist);
 224 +        }
 225 +
 226 +       subdirs[d] = NULL;
 227 +
 228 +       return subdirs;
 229 +}
 230 +
 231 +static void
 232 +parse_layer7_protocol(const unsigned char *s, struct ipt_layer7_info *info)
 233 +{
 234 +       char filename[MAX_FN_LEN];
 235 +       char * dir = NULL;
 236 +       char ** subdirs;
 237 +       int n = 0, done = 0;
 238 +
 239 +       if(strlen(l7dir) > 0)
 240 +               dir = l7dir;
 241 +       else
 242 +               dir = "/etc/l7-protocols";
 243 +
 244 +       subdirs = readl7dir(dir);
 245 +
 246 +       while(subdirs[n] != NULL)
 247 +       {
 248 +               int c = snprintf(filename, MAX_FN_LEN, "%s/%s/%s.pat", dir, subdirs[n], s);
 249 +
 250 +               //fprintf(stderr, "Trying to find pattern in %s ... ", filename);
 251 +
 252 +               if(c > MAX_FN_LEN)
 253 +               {
 254 +                       exit_error(OTHER_PROBLEM,
 255 +                               "Filename beginning with %s is too long!\n", filename);
 256 +               }
 257 +
 258 +               /* read in the pattern from the file */
 259 +               if(parse_protocol_file(filename, s, info))
 260 +               {
 261 +                       //fprintf(stderr, "found\n");
 262 +                       done = 1;
 263 +                       break;
 264 +               }
 265 +
 266 +               //fprintf(stderr, "not found\n");
 267 +
 268 +               n++;
 269 +       }
 270 +
 271 +       if(!done)
 272 +               exit_error(OTHER_PROBLEM,
 273 +                       "Couldn't find a pattern definition file for %s.\n", s);
 274 +
 275 +       /* process \xHH escapes and tolower everything. (our regex lib has no
 276 +       case insensitivity option.) */
 277 +       strncpy(info->pattern, pre_process(info->pattern), MAX_PATTERN_LEN);
 278 +}
 279 +
 280 +/* Function which parses command options; returns true if it ate an option */
 281 +static int parse(int c, char **argv, int invert, unsigned int *flags,
 282 +      const struct ipt_entry *entry, unsigned int *nfcache,
 283 +      struct ipt_entry_match **match)
 284 +{
 285 +       struct ipt_layer7_info *layer7info =
 286 +               (struct ipt_layer7_info *)(*match)->data;
 287 +
 288 +       switch (c) {
 289 +       case '1':
 290 +               check_inverse(optarg, &invert, &optind, 0);
 291 +               parse_layer7_protocol(argv[optind-1], layer7info);
 292 +               if (invert)
 293 +                       layer7info->invert = 1;
 294 +               *flags = 1;
 295 +               break;
 296 +
 297 +       case '2':
 298 +               /* not going to use this, but maybe we need to strip a ! anyway (?) */
 299 +               check_inverse(optarg, &invert, &optind, 0);
 300 +
 301 +               if(strlen(argv[optind-1]) >= MAX_FN_LEN)
 302 +                       exit_error(PARAMETER_PROBLEM, "directory name too long\n");
 303 +
 304 +               strncpy(l7dir, argv[optind-1], MAX_FN_LEN);
 305 +
 306 +               *flags = 1;
 307 +               break;
 308 +
 309 +       default:
 310 +               return 0;
 311 +       }
 312 +
 313 +       return 1;
 314 +}
 315 +
 316 +/* Final check; must have specified --pattern. */
 317 +static void final_check(unsigned int flags)
 318 +{
 319 +       if (!flags)
 320 +               exit_error(PARAMETER_PROBLEM,
 321 +                          "LAYER7 match: You must specify `--pattern'");
 322 +}
 323 +
 324 +static void print_protocol(char s[], int invert, int numeric)
 325 +{
 326 +       fputs("l7proto ", stdout);
 327 +       if (invert) fputc('!', stdout);
 328 +       printf("%s ", s);
 329 +}
 330 +
 331 +/* Prints out the matchinfo. */
 332 +static void print(const struct ipt_ip *ip,
 333 +      const struct ipt_entry_match *match,
 334 +      int numeric)
 335 +{
 336 +       printf("LAYER7 ");
 337 +
 338 +       print_protocol(((struct ipt_layer7_info *)match->data)->protocol,
 339 +                 ((struct ipt_layer7_info *)match->data)->invert, numeric);
 340 +}
 341 +/* Saves the union ipt_matchinfo in parsable form to stdout. */
 342 +static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
 343 +{
 344 +        const struct ipt_layer7_info *info =
 345 +            (const struct ipt_layer7_info*) match->data;
 346 +
 347 +        printf("--l7proto %s%s ", (info->invert)   ? "! ": "", info->protocol);
 348 +}
 349 +
 350 +static struct iptables_match layer7 = {
 351 +    .name          = "layer7",
 352 +    .version       = IPTABLES_VERSION,
 353 +    .size          = IPT_ALIGN(sizeof(struct ipt_layer7_info)),
 354 +    .userspacesize = IPT_ALIGN(sizeof(struct ipt_layer7_info)),
 355 +    .help          = &help,
 356 +    .init          = &init,
 357 +    .parse         = &parse,
 358 +    .final_check   = &final_check,
 359 +    .print         = &print,
 360 +    .save          = &save,
 361 +    .extra_opts    = opts
 362 +};
 363 +
 364 +void _init(void)
 365 +{
 366 +       register_match(&layer7);
 367 +}
 368 diff -Nurp iptables-1.3.0-stock/extensions/libipt_layer7.c.orig iptables-1.3.0-layer7/extensions/libipt_layer7.c.orig
 369 --- iptables-1.3.0-stock/extensions/libipt_layer7.c.orig        1969-12-31 18:00:00.000000000 -0600
 370 +++ iptables-1.3.0-layer7/extensions/libipt_layer7.c.orig       2005-03-06 22:20:28.000000000 -0600
 371 @@ -0,0 +1,357 @@
 372 +/*
 373 +   Shared library add-on to iptables to add layer 7 matching support.
 374 +
 375 +   By Matthew Strait <quadong@users.sf.net>, Oct 2003.
 376 +
 377 +   http://l7-filter.sf.net
 378 +
 379 +   This program is free software; you can redistribute it and/or
 380 +   modify it under the terms of the GNU General Public License
 381 +   as published by the Free Software Foundation; either version
 382 +   2 of the License, or (at your option) any later version.
 383 +   http://www.gnu.org/licenses/gpl.txt
 384 +
 385 +   Based on libipt_string.c (C) 2000 Emmanuel Roger <winfield@freegates.be>
 386 +*/
 387 +
 388 +#define _GNU_SOURCE
 389 +#include <stdio.h>
 390 +#include <netdb.h>
 391 +#include <string.h>
 392 +#include <stdlib.h>
 393 +#include <getopt.h>
 394 +#include <ctype.h>
 395 +#include <dirent.h>
 396 +
 397 +#include <iptables.h>
 398 +#include <linux/netfilter_ipv4/ipt_layer7.h>
 399 +
 400 +#define MAX_FN_LEN 256
 401 +
 402 +static char l7dir[MAX_FN_LEN] = "\0";
 403 +
 404 +/* Function which prints out usage message. */
 405 +static void help(void)
 406 +{
 407 +       printf(
 408 +       "LAYER7 match v%s options:\n"
 409 +       "--l7dir <directory>  : Look for patterns here instead of /etc/l7-protocols/\n"
 410 +       "                       (--l7dir must be specified before --l7proto if used!)\n"
 411 +       "--l7proto [!] <name> : Match the protocol defined in /etc/l7-protocols/name.pat\n",
 412 +       IPTABLES_VERSION);
 413 +       fputc('\n', stdout);
 414 +}
 415 +
 416 +static struct option opts[] = {
 417 +       { .name = "l7proto", .has_arg = 1, .flag = 0, .val = '1' },
 418 +       { .name = "l7dir",   .has_arg = 1, .flag = 0, .val = '2' },
 419 +       { .name = 0 }
 420 +};
 421 +
 422 +/* Initialize the match. */
 423 +static void init(struct ipt_entry_match *m, unsigned int *nfcache)
 424 +{
 425 +       *nfcache |= NFC_UNKNOWN;
 426 +}
 427 +
 428 +/* reads filename, puts protocol info into layer7_protocol_info, number of protocols to numprotos */
 429 +int parse_protocol_file(char * filename, const unsigned char * protoname, struct ipt_layer7_info *info)
 430 +{
 431 +       FILE * f;
 432 +       char * line = NULL;
 433 +       int len = 0;
 434 +
 435 +       enum { protocol, pattern, done } datatype = protocol;
 436 +
 437 +       f = fopen(filename, "r");
 438 +
 439 +       if(!f)
 440 +               return 0;
 441 +
 442 +       while(getline(&line, &len, f) != -1)
 443 +       {
 444 +               if(strlen(line) < 2 || line[0] == '#')
 445 +                       continue;
 446 +
 447 +               /* strip the pesky newline... */
 448 +               if(line[strlen(line) - 1] == '\n')
 449 +                       line[strlen(line) - 1] = '\0';
 450 +
 451 +               if(datatype == protocol)
 452 +               {
 453 +                       if(strcmp(line, protoname))
 454 +                               exit_error(OTHER_PROBLEM,
 455 +                                       "Protocol name (%s) doesn't match file name (%s).  Bailing out\n",
 456 +                                       protoname, filename);
 457 +
 458 +                       if(strlen(line) >= MAX_PROTOCOL_LEN)
 459 +                                exit_error(PARAMETER_PROBLEM,
 460 +                                       "Protocol name in %s too long!", filename);
 461 +                       strncpy(info->protocol, line, MAX_PROTOCOL_LEN);
 462 +
 463 +                       datatype = pattern;
 464 +               }
 465 +               else if(datatype == pattern)
 466 +               {
 467 +                       if(strlen(line) >= MAX_PATTERN_LEN)
 468 +                                exit_error(PARAMETER_PROBLEM, "Pattern in %s too long!", filename);
 469 +                       strncpy(info->pattern, line, MAX_PATTERN_LEN);
 470 +
 471 +                       datatype = done;
 472 +                       break;
 473 +               }
 474 +               else
 475 +                       exit_error(OTHER_PROBLEM, "Internal error");
 476 +       }
 477 +
 478 +       if(datatype != done)
 479 +               exit_error(OTHER_PROBLEM, "Failed to get all needed data from %s", filename);
 480 +
 481 +       if(line) free(line);
 482 +       fclose(f);
 483 +
 484 +       return 1;
 485 +
 486 +/*
 487 +       fprintf(stderr, "protocol: %s\npattern: %s\n\n",
 488 +                       info->protocol,
 489 +                       info->pattern);
 490 +*/
 491 +}
 492 +
 493 +static int hex2dec(char c)
 494 +{
 495 +        switch (c)
 496 +        {
 497 +                case '0' ... '9':
 498 +                        return c - '0';
 499 +                case 'a' ... 'f':
 500 +                        return c - 'a' + 10;
 501 +                case 'A' ... 'F':
 502 +                        return c - 'A' + 10;
 503 +                default:
 504 +                        exit_error(OTHER_PROBLEM, "hex2dec: bad value!\n");
 505 +                        return 0;
 506 +        }
 507 +}
 508 +
 509 +/* takes a string with \xHH escapes and returns one with the characters
 510 +they stand for */
 511 +static char * pre_process(char * s)
 512 +{
 513 +       char * result = malloc(strlen(s) + 1);
 514 +       int sindex = 0, rindex = 0;
 515 +        while( sindex < strlen(s) )
 516 +        {
 517 +            if( sindex + 3 < strlen(s) &&
 518 +                s[sindex] == '\\' && s[sindex+1] == 'x' &&
 519 +                isxdigit(s[sindex + 2]) && isxdigit(s[sindex + 3]) )
 520 +                {
 521 +                        /* carefully remember to call tolower here... */
 522 +                        result[rindex] = tolower( hex2dec(s[sindex + 2])*16 +
 523 +                                                  hex2dec(s[sindex + 3] ) );
 524 +                        sindex += 3; /* 4 total */
 525 +                }
 526 +                else
 527 +                        result[rindex] = tolower(s[sindex]);
 528 +
 529 +               sindex++;
 530 +               rindex++;
 531 +        }
 532 +       result[rindex] = '\0';
 533 +
 534 +       return result;
 535 +}
 536 +
 537 +#define MAX_SUBDIRS 128
 538 +char ** readl7dir(char * dirname)
 539 +{
 540 +        DIR             * scratchdir;
 541 +        struct dirent   ** namelist;
 542 +       char ** subdirs = malloc(MAX_SUBDIRS * sizeof(char *));
 543 +
 544 +        int n, d = 1;
 545 +       subdirs[0] = "";
 546 +
 547 +        n = scandir(dirname, &namelist, 0, alphasort);
 548 +
 549 +       if (n < 0)
 550 +       {
 551 +            perror("scandir");
 552 +           exit_error(OTHER_PROBLEM, "Couldn't open %s\n", dirname);
 553 +       }
 554 +        else
 555 +       {
 556 +               while(n--)
 557 +               {
 558 +                       char fulldirname[MAX_FN_LEN];
 559 +
 560 +                       snprintf(fulldirname, MAX_FN_LEN, "%s/%s", dirname, namelist[n]->d_name);
 561 +
 562 +                       if((scratchdir = opendir(fulldirname)) != NULL)
 563 +                       {
 564 +                               closedir(scratchdir);
 565 +
 566 +                               if(!strcmp(namelist[n]->d_name, ".") ||
 567 +                                  !strcmp(namelist[n]->d_name, ".."))
 568 +                                       /* do nothing */ ;
 569 +                               else
 570 +                               {
 571 +                                       subdirs[d] = malloc(strlen(namelist[n]->d_name) + 1);
 572 +                                       strcpy(subdirs[d], namelist[n]->d_name);
 573 +                                       d++;
 574 +                                       if(d >= MAX_SUBDIRS - 1)
 575 +                                       {
 576 +                                               fprintf(stderr,
 577 +                                                 "Too many subdirectories, skipping the rest!\n");
 578 +                                               break;
 579 +                                       }
 580 +                               }
 581 +                       }
 582 +                       free(namelist[n]);
 583 +               }
 584 +               free(namelist);
 585 +        }
 586 +
 587 +       subdirs[d] = NULL;
 588 +
 589 +       return subdirs;
 590 +}
 591 +
 592 +static void
 593 +parse_layer7_protocol(const unsigned char *s, struct ipt_layer7_info *info)
 594 +{
 595 +       char filename[MAX_FN_LEN];
 596 +       char * dir = NULL;
 597 +       char ** subdirs;
 598 +       int n = 0, done = 0;
 599 +
 600 +       if(strlen(l7dir) > 0)
 601 +               dir = l7dir;
 602 +       else
 603 +               dir = "/etc/l7-protocols";
 604 +
 605 +       subdirs = readl7dir(dir);
 606 +
 607 +       while(subdirs[n] != NULL)
 608 +       {
 609 +               int c = snprintf(filename, MAX_FN_LEN, "%s/%s/%s.pat", dir, subdirs[n], s);
 610 +
 611 +               //fprintf(stderr, "Trying to find pattern in %s ... ", filename);
 612 +
 613 +               if(c > MAX_FN_LEN)
 614 +               {
 615 +                       exit_error(OTHER_PROBLEM,
 616 +                               "Filename beginning with %s is too long!\n", filename);
 617 +               }
 618 +
 619 +               /* read in the pattern from the file */
 620 +               if(parse_protocol_file(filename, s, info))
 621 +               {
 622 +                       //fprintf(stderr, "found\n");
 623 +                       done = 1;
 624 +                       break;
 625 +               }
 626 +
 627 +               //fprintf(stderr, "not found\n");
 628 +
 629 +               n++;
 630 +       }
 631 +
 632 +       if(!done)
 633 +               exit_error(OTHER_PROBLEM,
 634 +                       "Couldn't find a pattern definition file for %s.\n", s);
 635 +
 636 +       /* process \xHH escapes and tolower everything. (our regex lib has no
 637 +       case insensitivity option.) */
 638 +       strncpy(info->pattern, pre_process(info->pattern), MAX_PATTERN_LEN);
 639 +}
 640 +
 641 +/* Function which parses command options; returns true if it ate an option */
 642 +static int parse(int c, char **argv, int invert, unsigned int *flags,
 643 +      const struct ipt_entry *entry, unsigned int *nfcache,
 644 +      struct ipt_entry_match **match)
 645 +{
 646 +       struct ipt_layer7_info *layer7info =
 647 +               (struct ipt_layer7_info *)(*match)->data;
 648 +
 649 +       switch (c) {
 650 +       case '1':
 651 +               check_inverse(optarg, &invert, &optind, 0);
 652 +               parse_layer7_protocol(argv[optind-1], layer7info);
 653 +               if (invert)
 654 +                       layer7info->invert = 1;
 655 +               *flags = 1;
 656 +               break;
 657 +
 658 +       case '2':
 659 +               /* not going to use this, but maybe we need to strip a ! anyway (?) */
 660 +               check_inverse(optarg, &invert, &optind, 0);
 661 +
 662 +               if(strlen(argv[optind-1]) >= MAX_FN_LEN)
 663 +                       exit_error(PARAMETER_PROBLEM, "directory name too long\n");
 664 +
 665 +               strncpy(l7dir, argv[optind-1], MAX_FN_LEN);
 666 +
 667 +               *flags = 1;
 668 +               break;
 669 +
 670 +       default:
 671 +               return 0;
 672 +       }
 673 +
 674 +       return 1;
 675 +}
 676 +
 677 +/* Final check; must have specified --pattern. */
 678 +static void final_check(unsigned int flags)
 679 +{
 680 +       if (!flags)
 681 +               exit_error(PARAMETER_PROBLEM,
 682 +                          "LAYER7 match: You must specify `--pattern'");
 683 +}
 684 +
 685 +static void print_protocol(char s[], int invert, int numeric)
 686 +{
 687 +       fputs("l7proto ", stdout);
 688 +       if (invert) fputc('!', stdout);
 689 +       printf("%s ", s);
 690 +}
 691 +
 692 +/* Prints out the matchinfo. */
 693 +static void print(const struct ipt_ip *ip,
 694 +      const struct ipt_entry_match *match,
 695 +      int numeric)
 696 +{
 697 +       printf("LAYER7 ");
 698 +
 699 +       print_protocol(((struct ipt_layer7_info *)match->data)->protocol,
 700 +                 ((struct ipt_layer7_info *)match->data)->invert, numeric);
 701 +}
 702 +/* Saves the union ipt_matchinfo in parsable form to stdout. */
 703 +static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
 704 +{
 705 +        const struct ipt_layer7_info *info =
 706 +            (const struct ipt_layer7_info*) match->data;
 707 +
 708 +        printf("--l7proto %s%s ", (info->invert)   ? "! ": "", info->protocol);
 709 +}
 710 +
 711 +static struct iptables_match layer7 = {
 712 +    .name          = "layer7",
 713 +    .version       = IPTABLES_VERSION,
 714 +    .size          = IPT_ALIGN(sizeof(struct ipt_layer7_info)),
 715 +    .userspacesize = IPT_ALIGN(sizeof(struct ipt_layer7_info)),
 716 +    .help          = &help,
 717 +    .init          = &init,
 718 +    .parse         = &parse,
 719 +    .final_check   = &final_check,
 720 +    .print         = &print,
 721 +    .save          = &save,
 722 +    .extra_opts    = opts
 723 +};
 724 +
 725 +void _init(void)
 726 +{
 727 +       register_match(&layer7);
 728 +}
 729 diff -Nurp iptables-1.3.0-stock/extensions/libipt_layer7.man iptables-1.3.0-layer7/extensions/libipt_layer7.man
 730 --- iptables-1.3.0-stock/extensions/libipt_layer7.man   1969-12-31 18:00:00.000000000 -0600
 731 +++ iptables-1.3.0-layer7/extensions/libipt_layer7.man  2005-03-01 22:12:06.000000000 -0600
 732 @@ -0,0 +1,13 @@
 733 +This module matches packets based on the application layer data of
 734 +their connections.  It uses regular expression matching to compare
 735 +the application layer data to regular expressions found it the layer7
 736 +configuration files.  This is an experimental module which can be found at
 737 +http://l7-filter.sf.net.  It takes two options.
 738 +.TP
 739 +.BI "--l7proto " "\fIprotocol\fP"
 740 +Match the specified protocol.  The protocol name must match a file
 741 +name in /etc/l7-protocols/
 742 +.TP
 743 +.BI "--l7dir " "\fIdirectory\fP"
 744 +Use \fIdirectory\fP instead of /etc/l7-protocols/
 745 +
 746 --- iptables-1.3.1/extensions/Makefile.orig     2005-04-01 23:02:50.000000000 +0200
 747 +++ iptables-1.3.1/extensions/Makefile  2005-04-01 23:03:06.000000000 +0200
 748 @@ -11,6 +11,8 @@
 749
 750  # ipp2p
 751  PF_EXT_SLIB += ipp2p
 752 +# layer7
 753 +PF_EXT_SLIB += layer7
 754
 755  # Optionals
 756  PF_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T)))