SOURCES (LINUX_2_6): kernel-pom-ng-TARPIT.patch, kernel-pom-ng-con...

baggins baggins at pld-linux.org
Tue Aug 7 18:51:13 CEST 2007


Author: baggins                      Date: Tue Aug  7 16:51:13 2007 GMT
Module: SOURCES                       Tag: LINUX_2_6
---- Log message:
- patch-o-matic-ng-20070806

---- Files affected:
SOURCES:
   kernel-pom-ng-TARPIT.patch (1.1.2.1 -> 1.1.2.2) , kernel-pom-ng-connlimit.patch (1.1.2.1 -> 1.1.2.2) , kernel-pom-ng-ipp2p.patch (1.1.2.1 -> 1.1.2.2) , kernel-pom-ng-set.patch (1.1.2.1 -> 1.1.2.2) , kernel-pom-ng-time.patch (1.1.2.1 -> 1.1.2.2) , kernel-pom-ng-u32.patch (1.1.2.1 -> 1.1.2.2) 

---- Diffs:

================================================================
Index: SOURCES/kernel-pom-ng-TARPIT.patch
diff -u SOURCES/kernel-pom-ng-TARPIT.patch:1.1.2.1 SOURCES/kernel-pom-ng-TARPIT.patch:1.1.2.2
--- SOURCES/kernel-pom-ng-TARPIT.patch:1.1.2.1	Wed May 30 13:53:30 2007
+++ SOURCES/kernel-pom-ng-TARPIT.patch	Tue Aug  7 18:51:07 2007
@@ -1,44 +1,7 @@
-diff -NurpP --minimal linux-2.6.21.a/net/ipv4/netfilter/Kconfig linux-2.6.21.b/net/ipv4/netfilter/Kconfig
---- linux-2.6.21.a/net/ipv4/netfilter/Kconfig	2007-05-30 11:41:48.000000000 +0200
-+++ linux-2.6.21.b/net/ipv4/netfilter/Kconfig	2007-05-30 11:42:48.000000000 +0200
-@@ -830,5 +830,22 @@ config IP_NF_TARGET_ROUTE
- 	  Documentation/modules.txt.  The module will be called ipt_ROUTE.o.
- 	  If unsure, say `N'.
- 
-+config IP_NF_TARGET_TARPIT
-+	tristate 'TARPIT target support'
-+	depends on IP_NF_FILTER
-+	help
-+	  Adds a TARPIT target to iptables, which captures and holds
-+	  incoming TCP connections using no local per-connection resources.
-+	  Connections are accepted, but immediately switched to the persist
-+	  state (0 byte window), in which the remote side stops sending data
-+	  and asks to continue every 60-240 seconds.  Attempts to close the
-+	  connection are ignored, forcing the remote side to time out the
-+	  connection in 12-24 minutes.
-+	
-+	  This offers similar functionality to LaBrea
-+	  <http://www.hackbusters.net/LaBrea/> but doesn't require dedicated
-+	  hardware or IPs.  Any TCP port that you would normally DROP or REJECT
-+	  can instead become a tarpit.
-+
- endmenu
- 
-diff -NurpP --minimal linux-2.6.21.a/net/ipv4/netfilter/Makefile linux-2.6.21.b/net/ipv4/netfilter/Makefile
---- linux-2.6.21.a/net/ipv4/netfilter/Makefile	2007-05-30 11:41:48.000000000 +0200
-+++ linux-2.6.21.b/net/ipv4/netfilter/Makefile	2007-05-30 11:42:49.000000000 +0200
-@@ -99,6 +99,7 @@ obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ip
- 
- # targets
- obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
-+obj-$(CONFIG_IP_NF_TARGET_TARPIT) += ipt_TARPIT.o
- obj-$(CONFIG_IP_NF_TARGET_TOS) += ipt_TOS.o
- obj-$(CONFIG_IP_NF_TARGET_ECN) += ipt_ECN.o
- obj-$(CONFIG_IP_NF_TARGET_IMQ) += ipt_IMQ.o
-diff -NurpP --minimal linux-2.6.21.a/net/ipv4/netfilter/ipt_TARPIT.c linux-2.6.21.b/net/ipv4/netfilter/ipt_TARPIT.c
---- linux-2.6.21.a/net/ipv4/netfilter/ipt_TARPIT.c	1970-01-01 01:00:00.000000000 +0100
-+++ linux-2.6.21.b/net/ipv4/netfilter/ipt_TARPIT.c	2007-05-30 11:42:49.000000000 +0200
-@@ -0,0 +1,292 @@
+diff -Nru linux-2.6.22/net/ipv4/netfilter/ipt_TARPIT.c linux-2.6.22-pom2patch/net/ipv4/netfilter/ipt_TARPIT.c
+--- linux-2.6.22/net/ipv4/netfilter/ipt_TARPIT.c	1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.22-pom2patch/net/ipv4/netfilter/ipt_TARPIT.c	2007-08-07 18:38:14.000000000 +0200
+@@ -0,0 +1,291 @@
 +/*
 + * Kernel module to capture and hold incoming TCP connections using
 + * no local per-connection resources.
@@ -87,7 +50,6 @@
 +#include <net/route.h>
 +#include <linux/random.h>
 +#include <linux/netfilter_ipv4/ip_tables.h>
-+#include <linux/netfilter/x_tables.h>
 +
 +#if 0
 +#define DEBUGP printk
@@ -102,12 +64,11 @@
 +static int ip_direct_send(struct sk_buff *skb)
 +{
 +	struct dst_entry *dst = skb->dst;
-+	struct hh_cache *hh = dst->hh;
 +
-+	if (hh) {
-+		return neigh_hh_output(dst->hh, skb);
-+	} else if (dst->neighbour)
-+		return dst->neighbour->output(skb);
++        if (dst->hh)
++                return neigh_hh_output(dst->hh, skb);
++        else if (dst->neighbour)
++                return dst->neighbour->output(skb);
 +
 +	if (net_ratelimit())
 +		printk(KERN_DEBUG "TARPIT ip_direct_send: no header cache and no neighbor!\n");
@@ -312,8 +273,9 @@
 +	return 1;
 +}
 +
-+static struct ipt_target ipt_tarpit_reg = {
++static struct xt_target ipt_tarpit_reg = {
 +	.name = "TARPIT",
++	.family = AF_INET,
 +	.target = tarpit,
 +	.checkentry = check,
 +	.me = THIS_MODULE
@@ -331,3 +293,40 @@
 +
 +module_init(init);
 +module_exit(fini);
+diff -Nru linux-2.6.22/net/ipv4/netfilter/Kconfig linux-2.6.22-pom2patch/net/ipv4/netfilter/Kconfig
+--- linux-2.6.22/net/ipv4/netfilter/Kconfig	2007-07-09 01:32:17.000000000 +0200
++++ linux-2.6.22-pom2patch/net/ipv4/netfilter/Kconfig	2007-08-07 18:38:14.000000000 +0200
+@@ -402,5 +402,22 @@
+ 	  Allows altering the ARP packet payload: source and destination
+ 	  hardware and network addresses.
+ 
++config IP_NF_TARGET_TARPIT
++	tristate 'TARPIT target support'
++	depends on IP_NF_FILTER
++	help
++	  Adds a TARPIT target to iptables, which captures and holds
++	  incoming TCP connections using no local per-connection resources.
++	  Connections are accepted, but immediately switched to the persist
++	  state (0 byte window), in which the remote side stops sending data
++	  and asks to continue every 60-240 seconds.  Attempts to close the
++	  connection are ignored, forcing the remote side to time out the
++	  connection in 12-24 minutes.
++	
++	  This offers similar functionality to LaBrea
++	  <http://www.hackbusters.net/LaBrea/> but doesn't require dedicated
++	  hardware or IPs.  Any TCP port that you would normally DROP or REJECT
++	  can instead become a tarpit.
++
+ endmenu
+ 
+diff -Nru linux-2.6.22/net/ipv4/netfilter/Makefile linux-2.6.22-pom2patch/net/ipv4/netfilter/Makefile
+--- linux-2.6.22/net/ipv4/netfilter/Makefile	2007-07-09 01:32:17.000000000 +0200
++++ linux-2.6.22-pom2patch/net/ipv4/netfilter/Makefile	2007-08-07 18:38:14.000000000 +0200
+@@ -52,6 +52,7 @@
+ 
+ # targets
+ obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
++obj-$(CONFIG_IP_NF_TARGET_TARPIT) += ipt_TARPIT.o
+ obj-$(CONFIG_IP_NF_TARGET_TOS) += ipt_TOS.o
+ obj-$(CONFIG_IP_NF_TARGET_ECN) += ipt_ECN.o
+ obj-$(CONFIG_IP_NF_TARGET_MASQUERADE) += ipt_MASQUERADE.o

================================================================
Index: SOURCES/kernel-pom-ng-connlimit.patch
diff -u SOURCES/kernel-pom-ng-connlimit.patch:1.1.2.1 SOURCES/kernel-pom-ng-connlimit.patch:1.1.2.2
--- SOURCES/kernel-pom-ng-connlimit.patch:1.1.2.1	Wed May 30 13:53:30 2007
+++ SOURCES/kernel-pom-ng-connlimit.patch	Tue Aug  7 18:51:08 2007
@@ -1,6 +1,6 @@
-diff -NurpP --minimal linux-2.6.21.a/include/linux/netfilter_ipv4/ipt_connlimit.h linux-2.6.21.b/include/linux/netfilter_ipv4/ipt_connlimit.h
---- linux-2.6.21.a/include/linux/netfilter_ipv4/ipt_connlimit.h	1970-01-01 01:00:00.000000000 +0100
-+++ linux-2.6.21.b/include/linux/netfilter_ipv4/ipt_connlimit.h	2007-05-30 12:04:08.000000000 +0200
+diff -Nru linux-2.6.22/include/linux/netfilter_ipv4/ipt_connlimit.h linux-2.6.22-pom2patch/include/linux/netfilter_ipv4/ipt_connlimit.h
+--- linux-2.6.22/include/linux/netfilter_ipv4/ipt_connlimit.h	1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.22-pom2patch/include/linux/netfilter_ipv4/ipt_connlimit.h	2007-08-07 18:38:25.000000000 +0200
 @@ -0,0 +1,12 @@
 +#ifndef _IPT_CONNLIMIT_H
 +#define _IPT_CONNLIMIT_H
@@ -14,48 +14,16 @@
 +	struct ipt_connlimit_data *data;
 +};
 +#endif /* _IPT_CONNLIMIT_H */
-diff -NurpP --minimal linux-2.6.21.a/net/ipv4/netfilter/Kconfig linux-2.6.21.b/net/ipv4/netfilter/Kconfig
---- linux-2.6.21.a/net/ipv4/netfilter/Kconfig	2007-05-30 12:02:56.000000000 +0200
-+++ linux-2.6.21.b/net/ipv4/netfilter/Kconfig	2007-05-30 12:04:08.000000000 +0200
-@@ -911,5 +911,15 @@ config IP_NF_TARGET_IPMARK
- 
- 
- 
-+config IP_NF_MATCH_CONNLIMIT
-+	tristate  'Connections/IP limit match support'
-+	depends on IP_NF_IPTABLES
-+	help
-+	  This match allows you to restrict the number of parallel TCP
-+	  connections to a server per client IP address (or address block).
-+	
-+	  If you want to compile it as a module, say M here and read
-+	  Documentation/modules.txt.  If unsure, say `N'.
-+
- endmenu
- 
-diff -NurpP --minimal linux-2.6.21.a/net/ipv4/netfilter/Makefile linux-2.6.21.b/net/ipv4/netfilter/Makefile
---- linux-2.6.21.a/net/ipv4/netfilter/Makefile	2007-05-30 12:02:56.000000000 +0200
-+++ linux-2.6.21.b/net/ipv4/netfilter/Makefile	2007-05-30 12:04:08.000000000 +0200
-@@ -90,6 +90,7 @@ obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
- obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
- obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
- obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
-+obj-$(CONFIG_IP_NF_MATCH_CONNLIMIT) += ipt_connlimit.o
- 
- obj-$(CONFIG_IP_NF_MATCH_IPV4OPTIONS) += ipt_ipv4options.o
- 
-diff -NurpP --minimal linux-2.6.21.a/net/ipv4/netfilter/ipt_connlimit.c linux-2.6.21.b/net/ipv4/netfilter/ipt_connlimit.c
---- linux-2.6.21.a/net/ipv4/netfilter/ipt_connlimit.c	1970-01-01 01:00:00.000000000 +0100
-+++ linux-2.6.21.b/net/ipv4/netfilter/ipt_connlimit.c	2007-05-30 12:04:47.000000000 +0200
-@@ -0,0 +1,260 @@
+diff -Nru linux-2.6.22/net/ipv4/netfilter/ipt_connlimit.c linux-2.6.22-pom2patch/net/ipv4/netfilter/ipt_connlimit.c
+--- linux-2.6.22/net/ipv4/netfilter/ipt_connlimit.c	1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.22-pom2patch/net/ipv4/netfilter/ipt_connlimit.c	2007-08-07 18:38:25.000000000 +0200
+@@ -0,0 +1,340 @@
 +/*
 + * netfilter module to limit the number of parallel tcp
 + * connections per IP address.
 + *   (c) 2000 Gerd Knorr <kraxel at bytesex.org>
 + *   Nov 2002: Martin Bene <martin.bene at icomedias.com>:
 + *		only ignore TIME_WAIT or gone connections
-+ *   Feb 2007: Marek Guevara Braun <mguevara at pld-linux.org>:
-+ *   		from ip_conntrack to nf_conntrack
 + *
 + * based on ...
 + *
@@ -66,11 +34,21 @@
 +#include <linux/skbuff.h>
 +#include <linux/version.h>
 +#include <linux/list.h>
-+#include <linux/netfilter/x_tables.h>
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
++#define CONFIG_NF_CONNTRACK_SUPPORT
++#endif
++
++#ifdef CONFIG_NF_CONNTRACK_SUPPORT
 +#include <net/netfilter/nf_conntrack.h>
 +#include <net/netfilter/nf_conntrack_core.h>
-+#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
-+#include <net/netfilter/nf_conntrack_compat.h>
++#include <linux/netfilter/nf_conntrack_tcp.h>
++#else
++#include <linux/netfilter_ipv4/ip_conntrack.h>
++#include <linux/netfilter_ipv4/ip_conntrack_core.h>
++#include <linux/netfilter_ipv4/ip_conntrack_tcp.h>
++#endif
++
 +#include <linux/netfilter_ipv4/ip_tables.h>
 +#include <linux/netfilter_ipv4/ipt_connlimit.h>
 +
@@ -82,7 +60,11 @@
 +struct ipt_connlimit_conn
 +{
 +        struct list_head list;
++#ifndef CONFIG_NF_CONNTRACK_SUPPORT
++	struct ip_conntrack_tuple tuple;
++#else
 +	struct nf_conntrack_tuple tuple;
++#endif
 +};
 +
 +struct ipt_connlimit_data {
@@ -97,7 +79,12 @@
 +
 +static int count_them(struct ipt_connlimit_data *data,
 +		      u_int32_t addr, u_int32_t mask,
++#ifndef CONFIG_NF_CONNTRACK_SUPPORT
++		      struct ip_conntrack *ct)
++#else
 +		      struct nf_conn *ct)
++#endif
++
 +{
 +#if DEBUG
 +	const static char *tcp[] = { "none", "established", "syn_sent", "syn_recv",
@@ -105,8 +92,13 @@
 +				     "last_ack", "listen" };
 +#endif
 +	int addit = 1, matches = 0;
++#ifndef CONFIG_NF_CONNTRACK_SUPPORT
++	struct ip_conntrack_tuple tuple;
++	struct ip_conntrack_tuple_hash *found;
++#else
 +	struct nf_conntrack_tuple tuple;
 +	struct nf_conntrack_tuple_hash *found;
++#endif
 +	struct ipt_connlimit_conn *conn;
 +	struct list_head *hash,*lh;
 +
@@ -116,11 +108,22 @@
 +
 +	/* check the saved connections */
 +	for (lh = hash->next; lh != hash; lh = lh->next) {
++#ifndef CONFIG_NF_CONNTRACK_SUPPORT
++		struct ip_conntrack *found_ct = NULL;
++		conn = list_entry(lh, struct ipt_connlimit_conn, list);
++		found = ip_conntrack_find_get(&conn->tuple, ct);
++#else
 +		struct nf_conn *found_ct = NULL;
-+		conn = list_entry(lh,struct ipt_connlimit_conn,list);
-+		found = nf_conntrack_find_get(&conn->tuple,ct);
++		conn = list_entry(lh, struct ipt_connlimit_conn, list);
++		found = nf_conntrack_find_get(&conn->tuple, ct);
++#endif
++
 +		 if (found != NULL 
++#ifndef CONFIG_NF_CONNTRACK_SUPPORT
++		     && (found_ct = tuplehash_to_ctrack(found)) != NULL
++#else
 +		     && (found_ct = nf_ct_tuplehash_to_ctrack(found)) != NULL
++#endif
 +		     && 0 == memcmp(&conn->tuple,&tuple,sizeof(tuple)) 
 +		     && found_ct->proto.tcp.state != TCP_CONNTRACK_TIME_WAIT) {
 +			/* Just to be sure we have it only once in the list.
@@ -131,8 +134,13 @@
 +#if DEBUG
 +		printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d %s\n",
 +		       ipt_iphash(addr & mask),
++#ifndef CONFIG_NF_CONNTRACK_SUPPORT
 +		       NIPQUAD(conn->tuple.src.ip), ntohs(conn->tuple.src.u.tcp.port),
 +		       NIPQUAD(conn->tuple.dst.ip), ntohs(conn->tuple.dst.u.tcp.port),
++#else
++		       NIPQUAD(conn->tuple.src.u3.ip), ntohs(conn->tuple.src.u.tcp.port),
++		       NIPQUAD(conn->tuple.dst.u3.ip), ntohs(conn->tuple.dst.u.tcp.port),
++#endif
 +		       (NULL != found) ? tcp[found_ct->proto.tcp.state] : "gone");
 +#endif
 +		if (NULL == found) {
@@ -151,7 +159,11 @@
 +			nf_conntrack_put(&found_ct->ct_general);
 +			continue;
 +		}
++#ifndef CONFIG_NF_CONNTRACK_SUPPORT
++		if ((addr & mask) == (conn->tuple.src.ip & mask)) {
++#else
 +		if ((addr & mask) == (conn->tuple.src.u3.ip & mask)) {
++#endif
 +			/* same source IP address -> be counted! */
 +			matches++;
 +		}
@@ -162,8 +174,14 @@
 +#if DEBUG
 +		printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d new\n",
 +		       ipt_iphash(addr & mask),
++#ifndef CONFIG_NF_CONNTRACK_SUPPORT
 +		       NIPQUAD(tuple.src.ip), ntohs(tuple.src.u.tcp.port),
 +		       NIPQUAD(tuple.dst.ip), ntohs(tuple.dst.u.tcp.port));
++#else
++		       NIPQUAD(tuple.src.u3.ip), ntohs(tuple.src.u.tcp.port),
++		       NIPQUAD(tuple.dst.u3.ip), ntohs(tuple.dst.u.tcp.port));
++#endif
++
 +#endif
 +		conn = kmalloc(sizeof(*conn),GFP_ATOMIC);
 +		if (NULL == conn) {
@@ -196,16 +214,28 @@
 +{
 +	const struct ipt_connlimit_info *info = matchinfo;
 +	int connections, rv;
++#ifndef CONFIG_NF_CONNTRACK_SUPPORT
++	struct ip_conntrack *ct;
++	enum ip_conntrack_info ctinfo;
++
++	ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
++#else
 +	struct nf_conn *ct;
 +	enum ip_conntrack_info ctinfo;
 +
-+	ct = nf_ct_get(skb, &ctinfo);
++	ct = nf_ct_get((struct sk_buff *)skb, &ctinfo);
++#endif
 +	if (NULL == ct) {
 +		printk("ipt_connlimit: Oops: invalid ct state ?\n");
 +		*hotdrop = 1;
 +		return 0;
 +	}
-+	connections = count_them(info->data,skb->nh.iph->saddr,info->mask,ct);
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
++	connections = count_them(info->data, ip_hdr(skb)->saddr, info->mask, ct);
++#else
++	connections = count_them(info->data, skb->nh.iph->saddr, info->mask, ct);
++#endif
 +	if (-1 == connections) {
 +		printk("ipt_connlimit: Hmm, kmalloc failed :-(\n");
 +		*hotdrop = 1; /* let's free some memory :-) */
@@ -222,17 +252,19 @@
 +	return rv;
 +}
 +
-+static int check(const char *tablename,
++static int checkentry(const char *tablename,
 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
 +		 const void *ip_void,
 +#else
-+		 
++		 const struct ipt_ip *ip,
 +#endif
 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
 +		 const struct xt_match *match,
 +#endif
 +		 void *matchinfo,
-+		 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
++		 unsigned int matchsize,
++#endif
 +		 unsigned int hook_mask)
 +{
 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
@@ -265,7 +297,11 @@
 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
 +		    const struct xt_match *match,
 +#endif
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
++		    void *matchinfo, unsigned int matchsize)
++#else
 +		    void *matchinfo)
++#endif
 +{
 +	struct ipt_connlimit_info *info = matchinfo;
 +	struct ipt_connlimit_conn *conn;
@@ -284,27 +320,71 @@
 +	kfree(info->data);
 +}
 +
-+static struct xt_match connlimit_match = { 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
++static struct xt_match connlimit_match = {
++#else
++static struct ipt_match connlimit_match = { 
++#endif
 +	.name		= "connlimit",
-+	.family 	= AF_INET,
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
++	.family		= AF_INET,
++#endif
 +	.match		= &match,
 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
 +	.matchsize	= sizeof(struct ipt_connlimit_info),
 +#endif
-+	.checkentry	= &check,
++	.checkentry	= &checkentry,
 +	.destroy	= &destroy,
 +	.me		= THIS_MODULE
 +};
 +
 +static int __init init(void)
 +{
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
 +	return xt_register_match(&connlimit_match);
++#else
++	return ipt_register_match(&connlimit_match);
++#endif
 +}
 +
 +static void __exit fini(void)
 +{
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
 +	xt_unregister_match(&connlimit_match);
++#else
++	ipt_unregister_match(&connlimit_match);
++#endif
 +}
 +
 +module_init(init);
 +module_exit(fini);
+diff -Nru linux-2.6.22/net/ipv4/netfilter/Kconfig linux-2.6.22-pom2patch/net/ipv4/netfilter/Kconfig
+--- linux-2.6.22/net/ipv4/netfilter/Kconfig	2007-07-09 01:32:17.000000000 +0200
++++ linux-2.6.22-pom2patch/net/ipv4/netfilter/Kconfig	2007-08-07 18:38:25.000000000 +0200
+@@ -402,5 +402,15 @@
+ 	  Allows altering the ARP packet payload: source and destination
+ 	  hardware and network addresses.
+ 
++config IP_NF_MATCH_CONNLIMIT
++	tristate  'Connections/IP limit match support'
++	depends on IP_NF_IPTABLES
++	help
++	  This match allows you to restrict the number of parallel TCP
++	  connections to a server per client IP address (or address block).
++	
++	  If you want to compile it as a module, say M here and read
++	  Documentation/modules.txt.  If unsure, say `N'.
++
+ endmenu
+ 
+diff -Nru linux-2.6.22/net/ipv4/netfilter/Makefile linux-2.6.22-pom2patch/net/ipv4/netfilter/Makefile
+--- linux-2.6.22/net/ipv4/netfilter/Makefile	2007-07-09 01:32:17.000000000 +0200
++++ linux-2.6.22-pom2patch/net/ipv4/netfilter/Makefile	2007-08-07 18:38:25.000000000 +0200
+@@ -44,6 +44,7 @@
+ obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
+ obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
+ obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
++obj-$(CONFIG_IP_NF_MATCH_CONNLIMIT) += ipt_connlimit.o
+ obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
+ obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
+ obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o

================================================================
Index: SOURCES/kernel-pom-ng-ipp2p.patch
diff -u SOURCES/kernel-pom-ng-ipp2p.patch:1.1.2.1 SOURCES/kernel-pom-ng-ipp2p.patch:1.1.2.2
--- SOURCES/kernel-pom-ng-ipp2p.patch:1.1.2.1	Wed May 30 13:53:30 2007
+++ SOURCES/kernel-pom-ng-ipp2p.patch	Tue Aug  7 18:51:08 2007
@@ -1,6 +1,6 @@
-diff -NurpP --minimal linux-2.6.21.a/include/linux/netfilter_ipv4/ipt_ipp2p.h linux-2.6.21.b/include/linux/netfilter_ipv4/ipt_ipp2p.h
---- linux-2.6.21.a/include/linux/netfilter_ipv4/ipt_ipp2p.h	1970-01-01 01:00:00.000000000 +0100
-+++ linux-2.6.21.b/include/linux/netfilter_ipv4/ipt_ipp2p.h	2007-05-30 12:10:42.000000000 +0200
+diff -Nru linux-2.6.22/include/linux/netfilter_ipv4/ipt_ipp2p.h linux-2.6.22-pom2patch/include/linux/netfilter_ipv4/ipt_ipp2p.h
+--- linux-2.6.22/include/linux/netfilter_ipv4/ipt_ipp2p.h	1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.22-pom2patch/include/linux/netfilter_ipv4/ipt_ipp2p.h	2007-08-07 18:38:54.000000000 +0200
 @@ -0,0 +1,31 @@
 +#ifndef __IPT_IPP2P_H
 +#define __IPT_IPP2P_H
@@ -33,46 +33,15 @@
 +#define IPP2P_MUTE		(1 << 14)
 +#define IPP2P_WASTE		(1 << 15)
 +#define IPP2P_XDCC		(1 << 16)
-diff -NurpP --minimal linux-2.6.21.a/net/ipv4/netfilter/Kconfig linux-2.6.21.b/net/ipv4/netfilter/Kconfig
---- linux-2.6.21.a/net/ipv4/netfilter/Kconfig	2007-05-30 12:09:52.000000000 +0200
-+++ linux-2.6.21.b/net/ipv4/netfilter/Kconfig	2007-05-30 12:10:42.000000000 +0200
-@@ -937,5 +937,15 @@ config IP_NF_MATCH_GEOIP
-           called `ipt_geoip'.  If unsure, say `N'.
- 
- 
-+config IP_NF_MATCH_IPP2P
-+	tristate  'IPP2P match support'
-+	depends on IP_NF_IPTABLES
-+	help
-+	  This option makes possible to match some P2P packets
-+	  therefore helps controlling such traffic.
-+	
-+	  If you want to compile it as a module, say M here and read
-+	  <file:Documentation/modules.txt>.  If unsure, say `N'.
-+
- endmenu
- 
-diff -NurpP --minimal linux-2.6.21.a/net/ipv4/netfilter/Makefile linux-2.6.21.b/net/ipv4/netfilter/Makefile
---- linux-2.6.21.a/net/ipv4/netfilter/Makefile	2007-05-30 12:09:52.000000000 +0200
-+++ linux-2.6.21.b/net/ipv4/netfilter/Makefile	2007-05-30 12:10:42.000000000 +0200
-@@ -95,6 +95,7 @@ obj-$(CONFIG_IP_NF_MATCH_CONNLIMIT) += i
- obj-$(CONFIG_IP_NF_MATCH_IPV4OPTIONS) += ipt_ipv4options.o
- 
- obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
-+obj-$(CONFIG_IP_NF_MATCH_IPP2P) += ipt_ipp2p.o
- obj-$(CONFIG_IP_NF_MATCH_GEOIP) += ipt_geoip.o
- obj-$(CONFIG_IP_NF_MATCH_U32) += ipt_u32.o
- obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
-diff -NurpP --minimal linux-2.6.21.a/net/ipv4/netfilter/ipt_ipp2p.c linux-2.6.21.b/net/ipv4/netfilter/ipt_ipp2p.c
---- linux-2.6.21.a/net/ipv4/netfilter/ipt_ipp2p.c	1970-01-01 01:00:00.000000000 +0100
-+++ linux-2.6.21.b/net/ipv4/netfilter/ipt_ipp2p.c	2007-05-30 12:10:42.000000000 +0200
-@@ -0,0 +1,888 @@
+diff -Nru linux-2.6.22/net/ipv4/netfilter/ipt_ipp2p.c linux-2.6.22-pom2patch/net/ipv4/netfilter/ipt_ipp2p.c
+--- linux-2.6.22/net/ipv4/netfilter/ipt_ipp2p.c	1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.22-pom2patch/net/ipv4/netfilter/ipt_ipp2p.c	2007-08-07 18:38:54.000000000 +0200
+@@ -0,0 +1,904 @@
 +#if defined(MODVERSIONS)
 +#include <linux/modversions.h>
 +#endif
 +#include <linux/module.h>
 +#include <linux/version.h>
-+#include <linux/netfilter/x_tables.h>
 +#include <linux/netfilter_ipv4/ip_tables.h>
 +#include <linux/netfilter_ipv4/ipt_ipp2p.h>
 +#include <net/tcp.h>
@@ -816,7 +785,11 @@
 +{
 +    const struct ipt_p2p_info *info = matchinfo;
 +    unsigned char  *haystack;
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
++    struct iphdr *ip = ip_hdr(skb);
++#else
 +    struct iphdr *ip = skb->nh.iph;
++#endif
 +    int p2p_result = 0, i = 0;
 +//    int head_len;
 +    int hlen = ntohs(ip->tot_len)-(ip->ihl*4);	/*hlen = packet-data length*/
@@ -916,8 +889,11 @@
 +									    
 +
 +
-+
-+static struct xt_match ipp2p_match = { 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
++static struct xt_match ipp2p_match = {
++#else
++static struct ipt_match ipp2p_match = { 
++#endif
 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
 +	{ NULL, NULL }, 
 +	"ipp2p", 
@@ -928,7 +904,9 @@
 +#endif
 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
 +	.name		= "ipp2p",
-+	.family 	= AF_INET,
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
++	.family		= AF_INET,
++#endif
 +	.match		= &match,
 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
 +	.matchsize	= sizeof(struct ipt_p2p_info),
@@ -942,12 +920,20 @@
 +static int __init init(void)
 +{
 +    printk(KERN_INFO "IPP2P v%s loading\n", IPP2P_VERSION);
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
 +    return xt_register_match(&ipp2p_match);
++#else
++    return ipt_register_match(&ipp2p_match);
++#endif
 +}
 +	
 +static void __exit fini(void)
 +{
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
 +    xt_unregister_match(&ipp2p_match);
++#else
++    ipt_unregister_match(&ipp2p_match);
++#endif
 +    printk(KERN_INFO "IPP2P v%s unloaded\n", IPP2P_VERSION);    
 +}
 +	
@@ -955,3 +941,33 @@
 +module_exit(fini);
 +
<<Diff was trimmed, longer than 597 lines>>

---- CVS-web:
    http://cvs.pld-linux.org/SOURCES/kernel-pom-ng-TARPIT.patch?r1=1.1.2.1&r2=1.1.2.2&f=u
    http://cvs.pld-linux.org/SOURCES/kernel-pom-ng-connlimit.patch?r1=1.1.2.1&r2=1.1.2.2&f=u
    http://cvs.pld-linux.org/SOURCES/kernel-pom-ng-ipp2p.patch?r1=1.1.2.1&r2=1.1.2.2&f=u
    http://cvs.pld-linux.org/SOURCES/kernel-pom-ng-set.patch?r1=1.1.2.1&r2=1.1.2.2&f=u
    http://cvs.pld-linux.org/SOURCES/kernel-pom-ng-time.patch?r1=1.1.2.1&r2=1.1.2.2&f=u
    http://cvs.pld-linux.org/SOURCES/kernel-pom-ng-u32.patch?r1=1.1.2.1&r2=1.1.2.2&f=u



More information about the pld-cvs-commit mailing list