SOURCES (LINUX_2_6): linux-2.6-nf-string.patch (NEW) - new string ...
pluto
pluto at pld-linux.org
Fri Sep 16 00:15:41 CEST 2005
Author: pluto Date: Thu Sep 15 22:15:41 2005 GMT
Module: SOURCES Tag: LINUX_2_6
---- Log message:
- new string match (it uses kernel's textsearch engine).
---- Files affected:
SOURCES:
linux-2.6-nf-string.patch (NONE -> 1.1.2.1) (NEW)
---- Diffs:
================================================================
Index: SOURCES/linux-2.6-nf-string.patch
diff -u /dev/null SOURCES/linux-2.6-nf-string.patch:1.1.2.1
--- /dev/null Fri Sep 16 00:15:41 2005
+++ SOURCES/linux-2.6-nf-string.patch Fri Sep 16 00:15:36 2005
@@ -0,0 +1,148 @@
+Index: netfilter-2.6.14/net/ipv4/netfilter/ipt_string.c
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ netfilter-2.6.14/net/ipv4/netfilter/ipt_string.c 2005-08-20 18:48:57.000000000 +0200
+@@ -0,0 +1,91 @@
++/* String matching match for iptables
++ *
++ * (C) 2005 Pablo Neira Ayuso <pablo at eurodev.net>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/skbuff.h>
++#include <linux/netfilter_ipv4/ip_tables.h>
++#include <linux/netfilter_ipv4/ipt_string.h>
++#include <linux/textsearch.h>
++
++MODULE_AUTHOR("Pablo Neira Ayuso <pablo at eurodev.net>");
++MODULE_DESCRIPTION("IP tables string match module");
++MODULE_LICENSE("GPL");
++
++static int match(const struct sk_buff *skb,
++ const struct net_device *in,
++ const struct net_device *out,
++ const void *matchinfo,
++ int offset,
++ int *hotdrop)
++{
++ struct ts_state state;
++ struct ipt_string_info *conf = (struct ipt_string_info *) matchinfo;
++
++ memset(&state, 0, sizeof(struct ts_state));
++
++ return (skb_find_text((struct sk_buff *)skb, conf->from_offset,
++ conf->to_offset, conf->config, &state)
++ != UINT_MAX) && !conf->invert;
++}
++
++#define STRING_TEXT_PRIV(m) ((struct ipt_string_info *) m)
++
++static int checkentry(const char *tablename,
++ const struct ipt_ip *ip,
++ void *matchinfo,
++ unsigned int matchsize,
++ unsigned int hook_mask)
++{
++ struct ipt_string_info *conf = matchinfo;
++ struct ts_config *ts_conf;
++
++ if (matchsize != IPT_ALIGN(sizeof(struct ipt_string_info)))
++ return 0;
++
++ /* Damn, can't handle this case properly with iptables... */
++ if (conf->from_offset > conf->to_offset)
++ return 0;
++
++ ts_conf = textsearch_prepare(conf->algo, conf->pattern, conf->patlen,
++ GFP_KERNEL, TS_AUTOLOAD);
++ if (IS_ERR(ts_conf))
++ return 0;
++
++ conf->config = ts_conf;
++
++ return 1;
++}
++
++static void destroy(void *matchinfo, unsigned int matchsize)
++{
++ textsearch_destroy(STRING_TEXT_PRIV(matchinfo)->config);
++}
++
++static struct ipt_match string_match = {
++ .name = "string",
++ .match = match,
++ .checkentry = checkentry,
++ .destroy = destroy,
++ .me = THIS_MODULE
++};
++
++static int __init init(void)
++{
++ return ipt_register_match(&string_match);
++}
++
++static void __exit fini(void)
++{
++ ipt_unregister_match(&string_match);
++}
++
++module_init(init);
++module_exit(fini);
+Index: netfilter-2.6.14/net/ipv4/netfilter/Makefile
+===================================================================
+--- netfilter-2.6.14.orig/net/ipv4/netfilter/Makefile 2005-08-20 18:48:49.000000000 +0200
++++ netfilter-2.6.14/net/ipv4/netfilter/Makefile 2005-08-20 18:48:57.000000000 +0200
+@@ -0,0 +0,1 @@
++obj-$(CONFIG_IP_NF_MATCH_STRING) += ipt_string.o
+Index: netfilter-2.6.14/net/ipv4/netfilter/Kconfig
+===================================================================
+--- netfilter-2.6.14.orig/net/ipv4/netfilter/Kconfig 2005-08-20 18:48:50.000000000 +0200
++++ netfilter-2.6.14/net/ipv4/netfilter/Kconfig 2005-08-20 18:48:57.000000000 +0200
+@@ -410,6 +410,18 @@
+ destination IP' or `500pps from any given source IP' with a single
+ IPtables rule.
+
++config IP_NF_MATCH_STRING
++ tristate 'string match support'
++ depends on IP_NF_IPTABLES
++ select TEXTSEARCH
++ select TEXTSEARCH_KMP
++ select TEXTSEARCH_FSM
++ help
++ This option adds a `string' match, which allows you to look for
++ pattern matchings in packets.
++
++ To compile it as a module, choose M here. If unsure, say N.
++
+ # `filter', generic and specific targets
+ config IP_NF_FILTER
+ tristate "Packet filtering"
+Index: netfilter-2.6.14/include/linux/netfilter_ipv4/ipt_string.h
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ netfilter-2.6.14/include/linux/netfilter_ipv4/ipt_string.h 2005-08-20 18:50:14.000000000 +0200
+@@ -0,0 +1,18 @@
++#ifndef _IPT_STRING_H
++#define _IPT_STRING_H
++
++#define IPT_STRING_MAX_PATTERN_SIZE 128
++#define IPT_STRING_MAX_ALGO_NAME_SIZE 16
++
++struct ipt_string_info
++{
++ u_int16_t from_offset;
++ u_int16_t to_offset;
++ char algo[IPT_STRING_MAX_ALGO_NAME_SIZE];
++ char pattern[IPT_STRING_MAX_PATTERN_SIZE];
++ u_int8_t patlen;
++ u_int8_t invert;
++ struct ts_config __attribute__((aligned(8))) *config;
++};
++
++#endif /*_IPT_STRING_H*/
================================================================
More information about the pld-cvs-commit
mailing list