oops. committed the wrong patch files for the multiport backport

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@3126 3c298f89-4303-0410-b956-a3cf2f4a3e73

diff --git a/openwrt/target/linux/generic-2.4/patches/619-nefilter_multiport_backport.patch b/openwrt/target/linux/generic-2.4/patches/619-nefilter_multiport_backport.patch
index de6ca1c..c34f9ec 100644 (file)
--- a/openwrt/target/linux/generic-2.4/patches/619-nefilter_multiport_backport.patch
+++ b/openwrt/target/linux/generic-2.4/patches/619-nefilter_multiport_backport.patch
@@ -1,23 +1,24 @@
 diff -urN linux.old/include/linux/netfilter_ipv4/ipt_multiport.h linux.dev/include/linux/netfilter_ipv4/ipt_multiport.h
 --- linux.old/include/linux/netfilter_ipv4/ipt_multiport.h     2000-12-11 22:31:30.000000000 +0100
 diff -urN linux.old/include/linux/netfilter_ipv4/ipt_multiport.h linux.dev/include/linux/netfilter_ipv4/ipt_multiport.h
 --- linux.old/include/linux/netfilter_ipv4/ipt_multiport.h     2000-12-11 22:31:30.000000000 +0100

-+++ linux.dev/include/linux/netfilter_ipv4/ipt_multiport.h     2006-02-04 05:05:51.928476750 +0100
-@@ -18,4 +18,13 @@
++++ linux.dev/include/linux/netfilter_ipv4/ipt_multiport.h     2006-02-04 05:23:54.318518250 +0100
+@@ -11,11 +11,12 @@
+ 
+ #define IPT_MULTI_PORTS       15
+ 
+-/* Must fit inside union ipt_matchinfo: 16 bytes */
+-struct ipt_multiport
++struct ipt_multiport_v1
+ {
+       u_int8_t flags;                         /* Type of comparison */

        u_int8_t count;                         /* Number of ports */
        u_int16_t ports[IPT_MULTI_PORTS];       /* Ports */
        u_int8_t count;                         /* Number of ports */
        u_int16_t ports[IPT_MULTI_PORTS];       /* Ports */

- };
-+
-+struct ipt_multiport_v1
-+{
-+      u_int8_t flags;                         /* Type of comparison */
-+      u_int8_t count;                         /* Number of ports */
-+      u_int16_t ports[IPT_MULTI_PORTS];       /* Ports */

 +      u_int8_t pflags[IPT_MULTI_PORTS];       /* Port flags */
 +      u_int8_t invert;                        /* Invert flag */
 +      u_int8_t pflags[IPT_MULTI_PORTS];       /* Port flags */
 +      u_int8_t invert;                        /* Invert flag */

-+};
+ };

  #endif /*_IPT_MULTIPORT_H*/
 diff -urN linux.old/net/ipv4/netfilter/ipt_multiport.c linux.dev/net/ipv4/netfilter/ipt_multiport.c
 --- linux.old/net/ipv4/netfilter/ipt_multiport.c       2003-06-13 16:51:39.000000000 +0200
  #endif /*_IPT_MULTIPORT_H*/
 diff -urN linux.old/net/ipv4/netfilter/ipt_multiport.c linux.dev/net/ipv4/netfilter/ipt_multiport.c
 --- linux.old/net/ipv4/netfilter/ipt_multiport.c       2003-06-13 16:51:39.000000000 +0200

-+++ linux.dev/net/ipv4/netfilter/ipt_multiport.c       2006-02-04 05:05:03.701462750 +0100
++++ linux.dev/net/ipv4/netfilter/ipt_multiport.c       2006-02-04 05:34:27.362081000 +0100

 @@ -1,5 +1,14 @@
  /* Kernel module to match one of a list of TCP/UDP ports: ports are in
     the same place so we can treat them as equal. */
 @@ -1,5 +1,14 @@
  /* Kernel module to match one of a list of TCP/UDP ports: ports are in
     the same place so we can treat them as equal. */


@@ -33,7 +34,7 @@ diff -urN linux.old/net/ipv4/netfilter/ipt_multiport.c linux.dev/net/ipv4/netfil
  #include <linux/module.h>
  #include <linux/types.h>
  #include <linux/udp.h>
  #include <linux/module.h>
  #include <linux/types.h>
  #include <linux/udp.h>

-@@ -8,6 +17,10 @@
+@@ -8,97 +17,136 @@

  #include <linux/netfilter_ipv4/ipt_multiport.h>
  #include <linux/netfilter_ipv4/ip_tables.h>
  
  #include <linux/netfilter_ipv4/ipt_multiport.h>
  #include <linux/netfilter_ipv4/ip_tables.h>
  


@@ -44,18 +45,45 @@ diff -urN linux.old/net/ipv4/netfilter/ipt_multiport.c linux.dev/net/ipv4/netfil
  #if 0
  #define duprintf(format, args...) printk(format , ## args)
  #else
  #if 0
  #define duprintf(format, args...) printk(format , ## args)
  #else

-@@ -33,34 +46,109 @@
-       return 0;
- }
+ #define duprintf(format, args...)
+ #endif

  
  

-+/* Returns 1 if the port is matched by the test, 0 otherwise. */
-+static inline int
++/* from linux 2.6 skbuff.h */
++static inline void *skb_header_pointer(const struct sk_buff *skb, int offset,
++                                     int len, void *buffer)
++{
++      int hlen = skb_headlen(skb);
++
++      if (hlen - offset >= len)
++              return skb->data + offset;
++
++      if (skb_copy_bits(skb, offset, buffer, len) < 0)
++              return NULL;
++
++      return buffer;
++}
++
++
+ /* Returns 1 if the port is matched by the test, 0 otherwise. */
+ static inline int
+-ports_match(const u_int16_t *portlist, enum ipt_multiport_flags flags,
+-          u_int8_t count, u_int16_t src, u_int16_t dst)

 +ports_match_v1(const struct ipt_multiport_v1 *minfo,
 +             u_int16_t src, u_int16_t dst)
 +ports_match_v1(const struct ipt_multiport_v1 *minfo,
 +             u_int16_t src, u_int16_t dst)

-+{
-+      unsigned int i;
+ {
+       unsigned int i;
+-      for (i=0; i<count; i++) {
+-              if (flags != IPT_MULTIPORT_DESTINATION
+-                  && portlist[i] == src)
+-                      return 1;
+-
+-              if (flags != IPT_MULTIPORT_SOURCE
+-                  && portlist[i] == dst)
+-                      return 1;
+-      }

 +      u_int16_t s, e;
 +      u_int16_t s, e;

-+
+ 
+-      return 0;

 +      for (i=0; i < minfo->count; i++) {
 +              s = minfo->ports[i];
 +
 +      for (i=0; i < minfo->count; i++) {
 +              s = minfo->ports[i];
 +


@@ -91,27 +119,34 @@ diff -urN linux.old/net/ipv4/netfilter/ipt_multiport.c linux.dev/net/ipv4/netfil
 +      }
 + 
 +      return minfo->invert;
 +      }
 + 
 +      return minfo->invert;

-+}
-+
+ }
+ 

  static int
  static int

- match(const struct sk_buff *skb,
-       const struct net_device *in,
-       const struct net_device *out,
-       const void *matchinfo,
-       int offset,
+-match(const struct sk_buff *skb,
+-      const struct net_device *in,
+-      const struct net_device *out,
+-      const void *matchinfo,
+-      int offset,

 -      const void *hdr,
 -      u_int16_t datalen,
 -      const void *hdr,
 -      u_int16_t datalen,

-       int *hotdrop)
+-      int *hotdrop)
++match_v1(const struct sk_buff *skb,
++       const struct net_device *in,
++       const struct net_device *out,
++       const void *matchinfo,
++       int offset,
++       int *hotdrop)

  {
 -      const struct udphdr *udp = hdr;
  {
 -      const struct udphdr *udp = hdr;

+-      const struct ipt_multiport *multiinfo = matchinfo;

 +      u16 _ports[2], *pptr;
 +      u16 _ports[2], *pptr;

-       const struct ipt_multiport *multiinfo = matchinfo;
++      const struct ipt_multiport_v1 *multiinfo = matchinfo;
++
++      if (offset)
++              return 0;

  
 -      /* Must be big enough to read ports. */
 -      if (offset == 0 && datalen < sizeof(struct udphdr)) {
  
 -      /* Must be big enough to read ports. */
 -      if (offset == 0 && datalen < sizeof(struct udphdr)) {

-+      if (offset)
-+              return 0;
-+

 +      pptr = skb_header_pointer(skb, skb->nh.iph->ihl * 4,
 +                                sizeof(_ports), _ports);
 +      if (pptr == NULL) {
 +      pptr = skb_header_pointer(skb, skb->nh.iph->ihl * 4,
 +                                sizeof(_ports), _ports);
 +      if (pptr == NULL) {


@@ -134,52 +169,27 @@ diff -urN linux.old/net/ipv4/netfilter/ipt_multiport.c linux.dev/net/ipv4/netfil
 -              && ports_match(multiinfo->ports,
 -                             multiinfo->flags, multiinfo->count,
 -                             ntohs(udp->source), ntohs(udp->dest));
 -              && ports_match(multiinfo->ports,
 -                             multiinfo->flags, multiinfo->count,
 -                             ntohs(udp->source), ntohs(udp->dest));

-+      return ports_match(multiinfo->ports,
-+                         multiinfo->flags, multiinfo->count,
-+                         ntohs(pptr[0]), ntohs(pptr[1]));
-+}
-+
-+static int
-+match_v1(const struct sk_buff *skb,
-+       const struct net_device *in,
-+       const struct net_device *out,
-+       const void *matchinfo,
-+       int offset,
-+       int *hotdrop)
-+{
-+      u16 _ports[2], *pptr;
-+      const struct ipt_multiport_v1 *multiinfo = matchinfo;
-+
-+      if (offset)
-+              return 0;
-+
-+      pptr = skb_header_pointer(skb, skb->nh.iph->ihl * 4,
-+                                sizeof(_ports), _ports);
-+      if (pptr == NULL) {
-+              /* We've been asked to examine this packet, and we
-+               * can't.  Hence, no choice but to drop.
-+               */
-+              duprintf("ipt_multiport:"
-+                       " Dropping evil offset=0 tinygram.\n");
-+              *hotdrop = 1;
-+              return 0;
-+      }
-+

 +      return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));
  }
  
 +      return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));
  }
  

- /* Called when user tries to insert an entry of this type. */
-@@ -71,34 +159,54 @@
-          unsigned int matchsize,
-          unsigned int hook_mask)
+-/* Called when user tries to insert an entry of this type. */
+ static int
+-checkentry(const char *tablename,
+-         const struct ipt_ip *ip,
+-         void *matchinfo,
+-         unsigned int matchsize,
+-         unsigned int hook_mask)
++checkentry_v1(const char *tablename,
++            const struct ipt_ip *ip,
++            void *matchinfo,
++            unsigned int matchsize,
++            unsigned int hook_mask)

  {
 -      const struct ipt_multiport *multiinfo = matchinfo;
 -
 -      if (matchsize != IPT_ALIGN(sizeof(struct ipt_multiport)))
 -              return 0;
  {
 -      const struct ipt_multiport *multiinfo = matchinfo;
 -
 -      if (matchsize != IPT_ALIGN(sizeof(struct ipt_multiport)))
 -              return 0;

-+      return (matchsize == IPT_ALIGN(sizeof(struct ipt_multiport)));
-+}
- 
+-

 -      /* Must specify proto == TCP/UDP, no unknown flags or bad count */
 -      return (ip->proto == IPPROTO_TCP || ip->proto == IPPROTO_UDP)
 -              && !(ip->invflags & IPT_INV_PROTO)
 -      /* Must specify proto == TCP/UDP, no unknown flags or bad count */
 -      return (ip->proto == IPPROTO_TCP || ip->proto == IPPROTO_UDP)
 -              && !(ip->invflags & IPT_INV_PROTO)


@@ -188,29 +198,13 @@ diff -urN linux.old/net/ipv4/netfilter/ipt_multiport.c linux.dev/net/ipv4/netfil
 -                  || multiinfo->flags == IPT_MULTIPORT_DESTINATION
 -                  || multiinfo->flags == IPT_MULTIPORT_EITHER)
 -              && multiinfo->count <= IPT_MULTI_PORTS;
 -                  || multiinfo->flags == IPT_MULTIPORT_DESTINATION
 -                  || multiinfo->flags == IPT_MULTIPORT_EITHER)
 -              && multiinfo->count <= IPT_MULTI_PORTS;

-+static int
-+checkentry_v1(const char *tablename,
-+            const struct ipt_ip *ip,
-+            void *matchinfo,
-+            unsigned int matchsize,
-+            unsigned int hook_mask)
-+{

 +      return (matchsize == IPT_ALIGN(sizeof(struct ipt_multiport_v1)));
  }
  
 -static struct ipt_match multiport_match
 -= { { NULL, NULL }, "multiport", &match, &checkentry, NULL, THIS_MODULE };
 +      return (matchsize == IPT_ALIGN(sizeof(struct ipt_multiport_v1)));
  }
  
 -static struct ipt_match multiport_match
 -= { { NULL, NULL }, "multiport", &match, &checkentry, NULL, THIS_MODULE };

-+static struct ipt_match multiport_match = {
-+      .name           = "multiport",
-+      .revision       = 0,
-+      .match          = &match,
-+      .checkentry     = &checkentry,
-+      .me             = THIS_MODULE,
-+};
-+

 +static struct ipt_match multiport_match_v1 = {
 +      .name           = "multiport",
 +static struct ipt_match multiport_match_v1 = {
 +      .name           = "multiport",

-+      .revision       = 1,

 +      .match          = &match_v1,
 +      .checkentry     = &checkentry_v1,
 +      .me             = THIS_MODULE,
 +      .match          = &match_v1,
 +      .checkentry     = &checkentry_v1,
 +      .me             = THIS_MODULE,


@@ -221,19 +215,14 @@ diff -urN linux.old/net/ipv4/netfilter/ipt_multiport.c linux.dev/net/ipv4/netfil
 -      return ipt_register_match(&multiport_match);
 +      int err;
 +
 -      return ipt_register_match(&multiport_match);
 +      int err;
 +

-+      err = ipt_register_match(&multiport_match);
-+      if (!err) {
-+              err = ipt_register_match(&multiport_match_v1);
-+              if (err)
-+                      ipt_unregister_match(&multiport_match);
-+      }
++      err = ipt_register_match(&multiport_match_v1);

 +
 +      return err;
  }
  
  static void __exit fini(void)
  {
 +
 +      return err;
  }
  
  static void __exit fini(void)
  {

-       ipt_unregister_match(&multiport_match);
+-      ipt_unregister_match(&multiport_match);

 +      ipt_unregister_match(&multiport_match_v1);
  }
  
 +      ipt_unregister_match(&multiport_match_v1);
  }