--- /dev/null
+diff -urN iptables.old/extensions/libipt_multiport.c iptables.dev/extensions/libipt_multiport.c
+--- iptables.old/extensions/libipt_multiport.c 2005-02-19 20:19:17.000000000 +0100
++++ iptables.dev/extensions/libipt_multiport.c 2006-02-04 05:46:12.154127750 +0100
+@@ -8,24 +8,6 @@
+ /* To ensure that iptables compiles with an old kernel */
+ #include "../include/linux/netfilter_ipv4/ipt_multiport.h"
+
+-/* Function which prints out usage message. */
+-static void
+-help(void)
+-{
+- printf(
+-"multiport v%s options:\n"
+-" --source-ports port[,port,port...]\n"
+-" --sports ...\n"
+-" match source port(s)\n"
+-" --destination-ports port[,port,port...]\n"
+-" --dports ...\n"
+-" match destination port(s)\n"
+-" --ports port[,port,port]\n"
+-" match both source and destination port(s)\n"
+-" NOTE: this kernel does not support port ranges in multiport.\n",
+-IPTABLES_VERSION);
+-}
+-
+ static void
+ help_v1(void)
+ {
+@@ -75,26 +57,6 @@
+ "invalid port/service `%s' specified", port);
+ }
+
+-static unsigned int
+-parse_multi_ports(const char *portstring, u_int16_t *ports, const char *proto)
+-{
+- char *buffer, *cp, *next;
+- unsigned int i;
+-
+- buffer = strdup(portstring);
+- if (!buffer) exit_error(OTHER_PROBLEM, "strdup failed");
+-
+- for (cp=buffer, i=0; cp && i<IPT_MULTI_PORTS; cp=next,i++)
+- {
+- next=strchr(cp, ',');
+- if (next) *next++='\0';
+- ports[i] = parse_port(cp, proto);
+- }
+- if (cp) exit_error(PARAMETER_PROBLEM, "too many ports specified");
+- free(buffer);
+- return i;
+-}
+-
+ static void
+ parse_multi_ports_v1(const char *portstring,
+ struct ipt_multiport_v1 *multiinfo,
+@@ -160,58 +122,6 @@
+ "multiport only works with TCP or UDP");
+ }
+
+-/* Function which parses command options; returns true if it
+- ate an option */
+-static int
+-parse(int c, char **argv, int invert, unsigned int *flags,
+- const struct ipt_entry *entry,
+- unsigned int *nfcache,
+- struct ipt_entry_match **match)
+-{
+- const char *proto;
+- struct ipt_multiport *multiinfo
+- = (struct ipt_multiport *)(*match)->data;
+-
+- switch (c) {
+- case '1':
+- check_inverse(argv[optind-1], &invert, &optind, 0);
+- proto = check_proto(entry);
+- multiinfo->count = parse_multi_ports(argv[optind-1],
+- multiinfo->ports, proto);
+- multiinfo->flags = IPT_MULTIPORT_SOURCE;
+- break;
+-
+- case '2':
+- check_inverse(argv[optind-1], &invert, &optind, 0);
+- proto = check_proto(entry);
+- multiinfo->count = parse_multi_ports(argv[optind-1],
+- multiinfo->ports, proto);
+- multiinfo->flags = IPT_MULTIPORT_DESTINATION;
+- break;
+-
+- case '3':
+- check_inverse(argv[optind-1], &invert, &optind, 0);
+- proto = check_proto(entry);
+- multiinfo->count = parse_multi_ports(argv[optind-1],
+- multiinfo->ports, proto);
+- multiinfo->flags = IPT_MULTIPORT_EITHER;
+- break;
+-
+- default:
+- return 0;
+- }
+-
+- if (invert)
+- exit_error(PARAMETER_PROBLEM,
+- "multiport does not support invert");
+-
+- if (*flags)
+- exit_error(PARAMETER_PROBLEM,
+- "multiport can only have one option");
+- *flags = 1;
+- return 1;
+-}
+-
+ static int
+ parse_v1(int c, char **argv, int invert, unsigned int *flags,
+ const struct ipt_entry *entry,
+@@ -289,43 +199,6 @@
+ printf("%s", service);
+ }
+
+-/* Prints out the matchinfo. */
+-static void
+-print(const struct ipt_ip *ip,
+- const struct ipt_entry_match *match,
+- int numeric)
+-{
+- const struct ipt_multiport *multiinfo
+- = (const struct ipt_multiport *)match->data;
+- unsigned int i;
+-
+- printf("multiport ");
+-
+- switch (multiinfo->flags) {
+- case IPT_MULTIPORT_SOURCE:
+- printf("sports ");
+- break;
+-
+- case IPT_MULTIPORT_DESTINATION:
+- printf("dports ");
+- break;
+-
+- case IPT_MULTIPORT_EITHER:
+- printf("ports ");
+- break;
+-
+- default:
+- printf("ERROR ");
+- break;
+- }
+-
+- for (i=0; i < multiinfo->count; i++) {
+- printf("%s", i ? "," : "");
+- print_port(multiinfo->ports[i], ip->proto, numeric);
+- }
+- printf(" ");
+-}
+-
+ static void
+ print_v1(const struct ipt_ip *ip,
+ const struct ipt_entry_match *match,
+@@ -369,34 +242,6 @@
+ printf(" ");
+ }
+
+-/* Saves the union ipt_matchinfo in parsable form to stdout. */
+-static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
+-{
+- const struct ipt_multiport *multiinfo
+- = (const struct ipt_multiport *)match->data;
+- unsigned int i;
+-
+- switch (multiinfo->flags) {
+- case IPT_MULTIPORT_SOURCE:
+- printf("--sports ");
+- break;
+-
+- case IPT_MULTIPORT_DESTINATION:
+- printf("--dports ");
+- break;
+-
+- case IPT_MULTIPORT_EITHER:
+- printf("--ports ");
+- break;
+- }
+-
+- for (i=0; i < multiinfo->count; i++) {
+- printf("%s", i ? "," : "");
+- print_port(multiinfo->ports[i], ip->proto, 1);
+- }
+- printf(" ");
+-}
+-
+ static void save_v1(const struct ipt_ip *ip,
+ const struct ipt_entry_match *match)
+ {
+@@ -432,19 +277,20 @@
+ printf(" ");
+ }
+
++
+ static struct iptables_match multiport = {
+ .next = NULL,
+ .name = "multiport",
+- .revision = 0,
+ .version = IPTABLES_VERSION,
+- .size = IPT_ALIGN(sizeof(struct ipt_multiport)),
+- .userspacesize = IPT_ALIGN(sizeof(struct ipt_multiport)),
+- .help = &help,
++ .revision = 0,
++ .size = IPT_ALIGN(sizeof(struct ipt_multiport_v1)),
++ .userspacesize = IPT_ALIGN(sizeof(struct ipt_multiport_v1)),
++ .help = &help_v1,
+ .init = &init,
+- .parse = &parse,
++ .parse = &parse_v1,
+ .final_check = &final_check,
+- .print = &print,
+- .save = &save,
++ .print = &print_v1,
++ .save = &save_v1,
+ .extra_opts = opts
+ };
+
--- /dev/null
+diff -urN linux.old/include/linux/netfilter_ipv4/ipt_multiport.h linux.dev/include/linux/netfilter_ipv4/ipt_multiport.h
+--- linux.old/include/linux/netfilter_ipv4/ipt_multiport.h 2000-12-11 22:31:30.000000000 +0100
++++ linux.dev/include/linux/netfilter_ipv4/ipt_multiport.h 2006-02-04 05:05:51.928476750 +0100
+@@ -18,4 +18,13 @@
+ u_int8_t count; /* Number of ports */
+ u_int16_t ports[IPT_MULTI_PORTS]; /* Ports */
+ };
++
++struct ipt_multiport_v1
++{
++ u_int8_t flags; /* Type of comparison */
++ u_int8_t count; /* Number of ports */
++ u_int16_t ports[IPT_MULTI_PORTS]; /* Ports */
++ u_int8_t pflags[IPT_MULTI_PORTS]; /* Port flags */
++ u_int8_t invert; /* Invert flag */
++};
+ #endif /*_IPT_MULTIPORT_H*/
+diff -urN linux.old/net/ipv4/netfilter/ipt_multiport.c linux.dev/net/ipv4/netfilter/ipt_multiport.c
+--- linux.old/net/ipv4/netfilter/ipt_multiport.c 2003-06-13 16:51:39.000000000 +0200
++++ linux.dev/net/ipv4/netfilter/ipt_multiport.c 2006-02-04 05:05:03.701462750 +0100
+@@ -1,5 +1,14 @@
+ /* Kernel module to match one of a list of TCP/UDP ports: ports are in
+ the same place so we can treat them as equal. */
++
++/* (C) 1999-2001 Paul `Rusty' Russell
++ * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
+ #include <linux/module.h>
+ #include <linux/types.h>
+ #include <linux/udp.h>
+@@ -8,6 +17,10 @@
+ #include <linux/netfilter_ipv4/ipt_multiport.h>
+ #include <linux/netfilter_ipv4/ip_tables.h>
+
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
++MODULE_DESCRIPTION("iptables multiple port match module");
++
+ #if 0
+ #define duprintf(format, args...) printk(format , ## args)
+ #else
+@@ -33,34 +46,109 @@
+ return 0;
+ }
+
++/* Returns 1 if the port is matched by the test, 0 otherwise. */
++static inline int
++ports_match_v1(const struct ipt_multiport_v1 *minfo,
++ u_int16_t src, u_int16_t dst)
++{
++ unsigned int i;
++ u_int16_t s, e;
++
++ for (i=0; i < minfo->count; i++) {
++ s = minfo->ports[i];
++
++ if (minfo->pflags[i]) {
++ /* range port matching */
++ e = minfo->ports[++i];
++ duprintf("src or dst matches with %d-%d?\n", s, e);
++
++ if (minfo->flags == IPT_MULTIPORT_SOURCE
++ && src >= s && src <= e)
++ return 1 ^ minfo->invert;
++ if (minfo->flags == IPT_MULTIPORT_DESTINATION
++ && dst >= s && dst <= e)
++ return 1 ^ minfo->invert;
++ if (minfo->flags == IPT_MULTIPORT_EITHER
++ && ((dst >= s && dst <= e)
++ || (src >= s && src <= e)))
++ return 1 ^ minfo->invert;
++ } else {
++ /* exact port matching */
++ duprintf("src or dst matches with %d?\n", s);
++
++ if (minfo->flags == IPT_MULTIPORT_SOURCE
++ && src == s)
++ return 1 ^ minfo->invert;
++ if (minfo->flags == IPT_MULTIPORT_DESTINATION
++ && dst == s)
++ return 1 ^ minfo->invert;
++ if (minfo->flags == IPT_MULTIPORT_EITHER
++ && (src == s || dst == s))
++ return 1 ^ minfo->invert;
++ }
++ }
++
++ return minfo->invert;
++}
++
+ static int
+ match(const struct sk_buff *skb,
+ const struct net_device *in,
+ const struct net_device *out,
+ const void *matchinfo,
+ int offset,
+- const void *hdr,
+- u_int16_t datalen,
+ int *hotdrop)
+ {
+- const struct udphdr *udp = hdr;
++ u16 _ports[2], *pptr;
+ const struct ipt_multiport *multiinfo = matchinfo;
+
+- /* Must be big enough to read ports. */
+- if (offset == 0 && datalen < sizeof(struct udphdr)) {
++ if (offset)
++ return 0;
++
++ pptr = skb_header_pointer(skb, skb->nh.iph->ihl * 4,
++ sizeof(_ports), _ports);
++ if (pptr == NULL) {
+ /* We've been asked to examine this packet, and we
+- can't. Hence, no choice but to drop. */
+- duprintf("ipt_multiport:"
+- " Dropping evil offset=0 tinygram.\n");
+- *hotdrop = 1;
+- return 0;
++ * can't. Hence, no choice but to drop.
++ */
++ duprintf("ipt_multiport:"
++ " Dropping evil offset=0 tinygram.\n");
++ *hotdrop = 1;
++ return 0;
+ }
+
+- /* Must not be a fragment. */
+- return !offset
+- && ports_match(multiinfo->ports,
+- multiinfo->flags, multiinfo->count,
+- ntohs(udp->source), ntohs(udp->dest));
++ return ports_match(multiinfo->ports,
++ multiinfo->flags, multiinfo->count,
++ ntohs(pptr[0]), ntohs(pptr[1]));
++}
++
++static int
++match_v1(const struct sk_buff *skb,
++ const struct net_device *in,
++ const struct net_device *out,
++ const void *matchinfo,
++ int offset,
++ int *hotdrop)
++{
++ u16 _ports[2], *pptr;
++ const struct ipt_multiport_v1 *multiinfo = matchinfo;
++
++ if (offset)
++ return 0;
++
++ pptr = skb_header_pointer(skb, skb->nh.iph->ihl * 4,
++ sizeof(_ports), _ports);
++ if (pptr == NULL) {
++ /* We've been asked to examine this packet, and we
++ * can't. Hence, no choice but to drop.
++ */
++ duprintf("ipt_multiport:"
++ " Dropping evil offset=0 tinygram.\n");
++ *hotdrop = 1;
++ return 0;
++ }
++
++ return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));
+ }
+
+ /* Called when user tries to insert an entry of this type. */
+@@ -71,34 +159,54 @@
+ unsigned int matchsize,
+ unsigned int hook_mask)
+ {
+- const struct ipt_multiport *multiinfo = matchinfo;
+-
+- if (matchsize != IPT_ALIGN(sizeof(struct ipt_multiport)))
+- return 0;
++ return (matchsize == IPT_ALIGN(sizeof(struct ipt_multiport)));
++}
+
+- /* Must specify proto == TCP/UDP, no unknown flags or bad count */
+- return (ip->proto == IPPROTO_TCP || ip->proto == IPPROTO_UDP)
+- && !(ip->invflags & IPT_INV_PROTO)
+- && matchsize == IPT_ALIGN(sizeof(struct ipt_multiport))
+- && (multiinfo->flags == IPT_MULTIPORT_SOURCE
+- || multiinfo->flags == IPT_MULTIPORT_DESTINATION
+- || multiinfo->flags == IPT_MULTIPORT_EITHER)
+- && multiinfo->count <= IPT_MULTI_PORTS;
++static int
++checkentry_v1(const char *tablename,
++ const struct ipt_ip *ip,
++ void *matchinfo,
++ unsigned int matchsize,
++ unsigned int hook_mask)
++{
++ return (matchsize == IPT_ALIGN(sizeof(struct ipt_multiport_v1)));
+ }
+
+-static struct ipt_match multiport_match
+-= { { NULL, NULL }, "multiport", &match, &checkentry, NULL, THIS_MODULE };
++static struct ipt_match multiport_match = {
++ .name = "multiport",
++ .revision = 0,
++ .match = &match,
++ .checkentry = &checkentry,
++ .me = THIS_MODULE,
++};
++
++static struct ipt_match multiport_match_v1 = {
++ .name = "multiport",
++ .revision = 1,
++ .match = &match_v1,
++ .checkentry = &checkentry_v1,
++ .me = THIS_MODULE,
++};
+
+ static int __init init(void)
+ {
+- return ipt_register_match(&multiport_match);
++ int err;
++
++ err = ipt_register_match(&multiport_match);
++ if (!err) {
++ err = ipt_register_match(&multiport_match_v1);
++ if (err)
++ ipt_unregister_match(&multiport_match);
++ }
++
++ return err;
+ }
+
+ static void __exit fini(void)
+ {
+ ipt_unregister_match(&multiport_match);
++ ipt_unregister_match(&multiport_match_v1);
+ }
+
+ module_init(init);
+ module_exit(fini);
+-MODULE_LICENSE("GPL");
projects / openwrt.git / commitdiff