SOURCES (LINUX_2_6): linux-2.6-nf-string.patch (NEW) - new string ...

pluto pluto at pld-linux.org
Fri Sep 16 00:15:41 CEST 2005


Author: pluto                        Date: Thu Sep 15 22:15:41 2005 GMT
Module: SOURCES                       Tag: LINUX_2_6
---- Log message:
- new string match (it uses kernel's textsearch engine).

---- Files affected:
SOURCES:
   linux-2.6-nf-string.patch (NONE -> 1.1.2.1)  (NEW)

---- Diffs:

================================================================
Index: SOURCES/linux-2.6-nf-string.patch
diff -u /dev/null SOURCES/linux-2.6-nf-string.patch:1.1.2.1
--- /dev/null	Fri Sep 16 00:15:41 2005
+++ SOURCES/linux-2.6-nf-string.patch	Fri Sep 16 00:15:36 2005
@@ -0,0 +1,148 @@
+Index: netfilter-2.6.14/net/ipv4/netfilter/ipt_string.c
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ netfilter-2.6.14/net/ipv4/netfilter/ipt_string.c	2005-08-20 18:48:57.000000000 +0200
+@@ -0,0 +1,91 @@
++/* String matching match for iptables
++ * 
++ * (C) 2005 Pablo Neira Ayuso <pablo at eurodev.net>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/skbuff.h>
++#include <linux/netfilter_ipv4/ip_tables.h>
++#include <linux/netfilter_ipv4/ipt_string.h>
++#include <linux/textsearch.h>
++
++MODULE_AUTHOR("Pablo Neira Ayuso <pablo at eurodev.net>");
++MODULE_DESCRIPTION("IP tables string match module");
++MODULE_LICENSE("GPL");
++
++static int match(const struct sk_buff *skb,
++		 const struct net_device *in,
++		 const struct net_device *out,
++		 const void *matchinfo,
++		 int offset,
++		 int *hotdrop)
++{
++	struct ts_state state;
++	struct ipt_string_info *conf = (struct ipt_string_info *) matchinfo;
++
++	memset(&state, 0, sizeof(struct ts_state));
++
++	return (skb_find_text((struct sk_buff *)skb, conf->from_offset, 
++			     conf->to_offset, conf->config, &state) 
++			     != UINT_MAX) && !conf->invert;
++}
++
++#define STRING_TEXT_PRIV(m) ((struct ipt_string_info *) m)
++
++static int checkentry(const char *tablename,
++		      const struct ipt_ip *ip,
++		      void *matchinfo,
++		      unsigned int matchsize,
++		      unsigned int hook_mask)
++{
++	struct ipt_string_info *conf = matchinfo;
++	struct ts_config *ts_conf;
++
++	if (matchsize != IPT_ALIGN(sizeof(struct ipt_string_info)))
++		return 0;
++
++	/* Damn, can't handle this case properly with iptables... */
++	if (conf->from_offset > conf->to_offset)
++		return 0;
++
++	ts_conf = textsearch_prepare(conf->algo, conf->pattern, conf->patlen,
++				     GFP_KERNEL, TS_AUTOLOAD);
++	if (IS_ERR(ts_conf))
++		return 0;
++
++	conf->config = ts_conf;
++
++	return 1;
++}
++
++static void destroy(void *matchinfo, unsigned int matchsize)
++{
++	textsearch_destroy(STRING_TEXT_PRIV(matchinfo)->config);
++}
++
++static struct ipt_match string_match = {
++	.name 		= "string",
++	.match 		= match,
++	.checkentry	= checkentry,
++	.destroy 	= destroy,
++	.me 		= THIS_MODULE
++};
++
++static int __init init(void)
++{
++	return ipt_register_match(&string_match);
++}
++
++static void __exit fini(void)
++{
++	ipt_unregister_match(&string_match);
++}
++
++module_init(init);
++module_exit(fini);
+Index: netfilter-2.6.14/net/ipv4/netfilter/Makefile
+===================================================================
+--- netfilter-2.6.14.orig/net/ipv4/netfilter/Makefile	2005-08-20 18:48:49.000000000 +0200
++++ netfilter-2.6.14/net/ipv4/netfilter/Makefile	2005-08-20 18:48:57.000000000 +0200
+@@ -0,0 +0,1 @@
++obj-$(CONFIG_IP_NF_MATCH_STRING) += ipt_string.o
+Index: netfilter-2.6.14/net/ipv4/netfilter/Kconfig
+===================================================================
+--- netfilter-2.6.14.orig/net/ipv4/netfilter/Kconfig	2005-08-20 18:48:50.000000000 +0200
++++ netfilter-2.6.14/net/ipv4/netfilter/Kconfig	2005-08-20 18:48:57.000000000 +0200
+@@ -410,6 +410,18 @@
+ 	  destination IP' or `500pps from any given source IP'  with a single
+ 	  IPtables rule.
+ 
++config IP_NF_MATCH_STRING
++	tristate  'string match support'
++	depends on IP_NF_IPTABLES 
++	select TEXTSEARCH
++	select TEXTSEARCH_KMP
++	select TEXTSEARCH_FSM
++	help
++	  This option adds a `string' match, which allows you to look for
++	  pattern matchings in packets.
++
++	  To compile it as a module, choose M here.  If unsure, say N.
++
+ # `filter', generic and specific targets
+ config IP_NF_FILTER
+ 	tristate "Packet filtering"
+Index: netfilter-2.6.14/include/linux/netfilter_ipv4/ipt_string.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ netfilter-2.6.14/include/linux/netfilter_ipv4/ipt_string.h	2005-08-20 18:50:14.000000000 +0200
+@@ -0,0 +1,18 @@
++#ifndef _IPT_STRING_H
++#define _IPT_STRING_H
++
++#define IPT_STRING_MAX_PATTERN_SIZE 128
++#define IPT_STRING_MAX_ALGO_NAME_SIZE 16
++
++struct ipt_string_info
++{
++	u_int16_t from_offset;
++	u_int16_t to_offset;
++	char	  algo[IPT_STRING_MAX_ALGO_NAME_SIZE];
++	char 	  pattern[IPT_STRING_MAX_PATTERN_SIZE];
++	u_int8_t  patlen;
++	u_int8_t  invert;
++	struct ts_config __attribute__((aligned(8))) *config;
++};
++
++#endif /*_IPT_STRING_H*/
================================================================



More information about the pld-cvs-commit mailing list