aboutsummaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/netfilter/ipt_ECN.c141
-rw-r--r--net/ipv4/tcp.c3
-rw-r--r--net/netfilter/xt_MARK.c56
-rw-r--r--net/netfilter/xt_RATEEST.c183
-rw-r--r--net/netfilter/xt_connmark.c87
-rw-r--r--net/netfilter/xt_dscp.c115
-rw-r--r--net/netfilter/xt_hl.c108
-rw-r--r--net/netfilter/xt_tcpmss.c110
8 files changed, 3 insertions, 800 deletions
diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
deleted file mode 100644
index f7e2fa0974d..00000000000
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ /dev/null
@@ -1,141 +0,0 @@
-/* iptables module for the IPv4 and TCP ECN bits, Version 1.5
- *
- * (C) 2002 by Harald Welte <laforge@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
-*/
-
-#include <linux/in.h>
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/ip.h>
-#include <net/ip.h>
-#include <linux/tcp.h>
-#include <net/checksum.h>
-
-#include <linux/netfilter/x_tables.h>
-#include <linux/netfilter_ipv4/ip_tables.h>
-#include <linux/netfilter_ipv4/ipt_ECN.h>
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
-MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag modification");
-
-/* set ECT codepoint from IP header.
- * return false if there was an error. */
-static inline bool
-set_ect_ip(struct sk_buff *skb, const struct ipt_ECN_info *einfo)
-{
- struct iphdr *iph = ip_hdr(skb);
-
- if ((iph->tos & IPT_ECN_IP_MASK) != (einfo->ip_ect & IPT_ECN_IP_MASK)) {
- __u8 oldtos;
- if (!skb_make_writable(skb, sizeof(struct iphdr)))
- return false;
- iph = ip_hdr(skb);
- oldtos = iph->tos;
- iph->tos &= ~IPT_ECN_IP_MASK;
- iph->tos |= (einfo->ip_ect & IPT_ECN_IP_MASK);
- csum_replace2(&iph->check, htons(oldtos), htons(iph->tos));
- }
- return true;
-}
-
-/* Return false if there was an error. */
-static inline bool
-set_ect_tcp(struct sk_buff *skb, const struct ipt_ECN_info *einfo)
-{
- struct tcphdr _tcph, *tcph;
- __be16 oldval;
-
- /* Not enought header? */
- tcph = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
- if (!tcph)
- return false;
-
- if ((!(einfo->operation & IPT_ECN_OP_SET_ECE) ||
- tcph->ece == einfo->proto.tcp.ece) &&
- (!(einfo->operation & IPT_ECN_OP_SET_CWR) ||
- tcph->cwr == einfo->proto.tcp.cwr))
- return true;
-
- if (!skb_make_writable(skb, ip_hdrlen(skb) + sizeof(*tcph)))
- return false;
- tcph = (void *)ip_hdr(skb) + ip_hdrlen(skb);
-
- oldval = ((__be16 *)tcph)[6];
- if (einfo->operation & IPT_ECN_OP_SET_ECE)
- tcph->ece = einfo->proto.tcp.ece;
- if (einfo->operation & IPT_ECN_OP_SET_CWR)
- tcph->cwr = einfo->proto.tcp.cwr;
-
- inet_proto_csum_replace2(&tcph->check, skb,
- oldval, ((__be16 *)tcph)[6], 0);
- return true;
-}
-
-static unsigned int
-ecn_tg(struct sk_buff *skb, const struct xt_target_param *par)
-{
- const struct ipt_ECN_info *einfo = par->targinfo;
-
- if (einfo->operation & IPT_ECN_OP_SET_IP)
- if (!set_ect_ip(skb, einfo))
- return NF_DROP;
-
- if (einfo->operation & (IPT_ECN_OP_SET_ECE | IPT_ECN_OP_SET_CWR)
- && ip_hdr(skb)->protocol == IPPROTO_TCP)
- if (!set_ect_tcp(skb, einfo))
- return NF_DROP;
-
- return XT_CONTINUE;
-}
-
-static bool ecn_tg_check(const struct xt_tgchk_param *par)
-{
- const struct ipt_ECN_info *einfo = par->targinfo;
- const struct ipt_entry *e = par->entryinfo;
-
- if (einfo->operation & IPT_ECN_OP_MASK) {
- printk(KERN_WARNING "ECN: unsupported ECN operation %x\n",
- einfo->operation);
- return false;
- }
- if (einfo->ip_ect & ~IPT_ECN_IP_MASK) {
- printk(KERN_WARNING "ECN: new ECT codepoint %x out of mask\n",
- einfo->ip_ect);
- return false;
- }
- if ((einfo->operation & (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR))
- && (e->ip.proto != IPPROTO_TCP || (e->ip.invflags & XT_INV_PROTO))) {
- printk(KERN_WARNING "ECN: cannot use TCP operations on a "
- "non-tcp rule\n");
- return false;
- }
- return true;
-}
-
-static struct xt_target ecn_tg_reg __read_mostly = {
- .name = "ECN",
- .family = NFPROTO_IPV4,
- .target = ecn_tg,
- .targetsize = sizeof(struct ipt_ECN_info),
- .table = "mangle",
- .checkentry = ecn_tg_check,
- .me = THIS_MODULE,
-};
-
-static int __init ecn_tg_init(void)
-{
- return xt_register_target(&ecn_tg_reg);
-}
-
-static void __exit ecn_tg_exit(void)
-{
- xt_unregister_target(&ecn_tg_reg);
-}
-
-module_init(ecn_tg_init);
-module_exit(ecn_tg_exit);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 72fa141d17d..b66a1d32de4 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -658,10 +658,13 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
}
if (sk->sk_shutdown & RCV_SHUTDOWN)
{
+
+/* SH - 04/15/11 - removed print, these were filling up logs in some environments
printk(KERN_ERR "%s:%s:%d\n"
"breaking %d\n",
__FUNCTION__, __FILE__, __LINE__,
ret);
+*/
break;
}
if (sk->sk_state == TCP_CLOSE) {
diff --git a/net/netfilter/xt_MARK.c b/net/netfilter/xt_MARK.c
deleted file mode 100644
index 225f8d11e17..00000000000
--- a/net/netfilter/xt_MARK.c
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * xt_MARK - Netfilter module to modify the NFMARK field of an skb
- *
- * (C) 1999-2001 Marc Boucher <marc@mbsi.ca>
- * Copyright © CC Computer Consultants GmbH, 2007 - 2008
- * Jan Engelhardt <jengelh@computergmbh.de>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/ip.h>
-#include <net/checksum.h>
-
-#include <linux/netfilter/x_tables.h>
-#include <linux/netfilter/xt_MARK.h>
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
-MODULE_DESCRIPTION("Xtables: packet mark modification");
-MODULE_ALIAS("ipt_MARK");
-MODULE_ALIAS("ip6t_MARK");
-
-static unsigned int
-mark_tg(struct sk_buff *skb, const struct xt_target_param *par)
-{
- const struct xt_mark_tginfo2 *info = par->targinfo;
-
- skb->mark = (skb->mark & ~info->mask) ^ info->mark;
- return XT_CONTINUE;
-}
-
-static struct xt_target mark_tg_reg __read_mostly = {
- .name = "MARK",
- .revision = 2,
- .family = NFPROTO_UNSPEC,
- .target = mark_tg,
- .targetsize = sizeof(struct xt_mark_tginfo2),
- .me = THIS_MODULE,
-};
-
-static int __init mark_tg_init(void)
-{
- return xt_register_target(&mark_tg_reg);
-}
-
-static void __exit mark_tg_exit(void)
-{
- xt_unregister_target(&mark_tg_reg);
-}
-
-module_init(mark_tg_init);
-module_exit(mark_tg_exit);
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
deleted file mode 100644
index d80b8192e0d..00000000000
--- a/net/netfilter/xt_RATEEST.c
+++ /dev/null
@@ -1,183 +0,0 @@
-/*
- * (C) 2007 Patrick McHardy <kaber@trash.net>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/gen_stats.h>
-#include <linux/jhash.h>
-#include <linux/rtnetlink.h>
-#include <linux/random.h>
-#include <net/gen_stats.h>
-#include <net/netlink.h>
-
-#include <linux/netfilter/x_tables.h>
-#include <linux/netfilter/xt_RATEEST.h>
-#include <net/netfilter/xt_rateest.h>
-
-static DEFINE_MUTEX(xt_rateest_mutex);
-
-#define RATEEST_HSIZE 16
-static struct hlist_head rateest_hash[RATEEST_HSIZE] __read_mostly;
-static unsigned int jhash_rnd __read_mostly;
-
-static unsigned int xt_rateest_hash(const char *name)
-{
- return jhash(name, FIELD_SIZEOF(struct xt_rateest, name), jhash_rnd) &
- (RATEEST_HSIZE - 1);
-}
-
-static void xt_rateest_hash_insert(struct xt_rateest *est)
-{
- unsigned int h;
-
- h = xt_rateest_hash(est->name);
- hlist_add_head(&est->list, &rateest_hash[h]);
-}
-
-struct xt_rateest *xt_rateest_lookup(const char *name)
-{
- struct xt_rateest *est;
- struct hlist_node *n;
- unsigned int h;
-
- h = xt_rateest_hash(name);
- mutex_lock(&xt_rateest_mutex);
- hlist_for_each_entry(est, n, &rateest_hash[h], list) {
- if (strcmp(est->name, name) == 0) {
- est->refcnt++;
- mutex_unlock(&xt_rateest_mutex);
- return est;
- }
- }
- mutex_unlock(&xt_rateest_mutex);
- return NULL;
-}
-EXPORT_SYMBOL_GPL(xt_rateest_lookup);
-
-void xt_rateest_put(struct xt_rateest *est)
-{
- mutex_lock(&xt_rateest_mutex);
- if (--est->refcnt == 0) {
- hlist_del(&est->list);
- gen_kill_estimator(&est->bstats, &est->rstats);
- kfree(est);
- }
- mutex_unlock(&xt_rateest_mutex);
-}
-EXPORT_SYMBOL_GPL(xt_rateest_put);
-
-static unsigned int
-xt_rateest_tg(struct sk_buff *skb, const struct xt_target_param *par)
-{
- const struct xt_rateest_target_info *info = par->targinfo;
- struct gnet_stats_basic_packed *stats = &info->est->bstats;
-
- spin_lock_bh(&info->est->lock);
- stats->bytes += skb->len;
- stats->packets++;
- spin_unlock_bh(&info->est->lock);
-
- return XT_CONTINUE;
-}
-
-static bool xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
-{
- struct xt_rateest_target_info *info = par->targinfo;
- struct xt_rateest *est;
- struct {
- struct nlattr opt;
- struct gnet_estimator est;
- } cfg;
-
- est = xt_rateest_lookup(info->name);
- if (est) {
- /*
- * If estimator parameters are specified, they must match the
- * existing estimator.
- */
- if ((!info->interval && !info->ewma_log) ||
- (info->interval != est->params.interval ||
- info->ewma_log != est->params.ewma_log)) {
- xt_rateest_put(est);
- return false;
- }
- info->est = est;
- return true;
- }
-
- est = kzalloc(sizeof(*est), GFP_KERNEL);
- if (!est)
- goto err1;
-
- strlcpy(est->name, info->name, sizeof(est->name));
- spin_lock_init(&est->lock);
- est->refcnt = 1;
- est->params.interval = info->interval;
- est->params.ewma_log = info->ewma_log;
-
- cfg.opt.nla_len = nla_attr_size(sizeof(cfg.est));
- cfg.opt.nla_type = TCA_STATS_RATE_EST;
- cfg.est.interval = info->interval;
- cfg.est.ewma_log = info->ewma_log;
-
- if (gen_new_estimator(&est->bstats, &est->rstats, &est->lock,
- &cfg.opt) < 0)
- goto err2;
-
- info->est = est;
- xt_rateest_hash_insert(est);
-
- return true;
-
-err2:
- kfree(est);
-err1:
- return false;
-}
-
-static void xt_rateest_tg_destroy(const struct xt_tgdtor_param *par)
-{
- struct xt_rateest_target_info *info = par->targinfo;
-
- xt_rateest_put(info->est);
-}
-
-static struct xt_target xt_rateest_tg_reg __read_mostly = {
- .name = "RATEEST",
- .revision = 0,
- .family = NFPROTO_UNSPEC,
- .target = xt_rateest_tg,
- .checkentry = xt_rateest_tg_checkentry,
- .destroy = xt_rateest_tg_destroy,
- .targetsize = sizeof(struct xt_rateest_target_info),
- .me = THIS_MODULE,
-};
-
-static int __init xt_rateest_tg_init(void)
-{
- unsigned int i;
-
- for (i = 0; i < ARRAY_SIZE(rateest_hash); i++)
- INIT_HLIST_HEAD(&rateest_hash[i]);
-
- get_random_bytes(&jhash_rnd, sizeof(jhash_rnd));
- return xt_register_target(&xt_rateest_tg_reg);
-}
-
-static void __exit xt_rateest_tg_fini(void)
-{
- xt_unregister_target(&xt_rateest_tg_reg);
-}
-
-
-MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("Xtables: packet rate estimator");
-MODULE_ALIAS("ipt_RATEEST");
-MODULE_ALIAS("ip6t_RATEEST");
-module_init(xt_rateest_tg_init);
-module_exit(xt_rateest_tg_fini);
diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
deleted file mode 100644
index 122aa8b0147..00000000000
--- a/net/netfilter/xt_connmark.c
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * xt_connmark - Netfilter module to match connection mark values
- *
- * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
- * by Henrik Nordstrom <hno@marasystems.com>
- * Copyright © CC Computer Consultants GmbH, 2007 - 2008
- * Jan Engelhardt <jengelh@computergmbh.de>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <net/netfilter/nf_conntrack.h>
-#include <linux/netfilter/x_tables.h>
-#include <linux/netfilter/xt_connmark.h>
-
-MODULE_AUTHOR("Henrik Nordstrom <hno@marasystems.com>");
-MODULE_DESCRIPTION("Xtables: connection mark match");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("ipt_connmark");
-MODULE_ALIAS("ip6t_connmark");
-
-static bool
-connmark_mt(const struct sk_buff *skb, const struct xt_match_param *par)
-{
- const struct xt_connmark_mtinfo1 *info = par->matchinfo;
- enum ip_conntrack_info ctinfo;
- const struct nf_conn *ct;
-
- ct = nf_ct_get(skb, &ctinfo);
- if (ct == NULL)
- return false;
-
- return ((ct->mark & info->mask) == info->mark) ^ info->invert;
-}
-
-static bool connmark_mt_check(const struct xt_mtchk_param *par)
-{
- if (nf_ct_l3proto_try_module_get(par->family) < 0) {
- printk(KERN_WARNING "cannot load conntrack support for "
- "proto=%u\n", par->family);
- return false;
- }
- return true;
-}
-
-static void connmark_mt_destroy(const struct xt_mtdtor_param *par)
-{
- nf_ct_l3proto_module_put(par->family);
-}
-
-static struct xt_match connmark_mt_reg __read_mostly = {
- .name = "connmark",
- .revision = 1,
- .family = NFPROTO_UNSPEC,
- .checkentry = connmark_mt_check,
- .match = connmark_mt,
- .matchsize = sizeof(struct xt_connmark_mtinfo1),
- .destroy = connmark_mt_destroy,
- .me = THIS_MODULE,
-};
-
-static int __init connmark_mt_init(void)
-{
- return xt_register_match(&connmark_mt_reg);
-}
-
-static void __exit connmark_mt_exit(void)
-{
- xt_unregister_match(&connmark_mt_reg);
-}
-
-module_init(connmark_mt_init);
-module_exit(connmark_mt_exit);
diff --git a/net/netfilter/xt_dscp.c b/net/netfilter/xt_dscp.c
deleted file mode 100644
index 0280d3a8c16..00000000000
--- a/net/netfilter/xt_dscp.c
+++ /dev/null
@@ -1,115 +0,0 @@
-/* IP tables module for matching the value of the IPv4/IPv6 DSCP field
- *
- * (C) 2002 by Harald Welte <laforge@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/ip.h>
-#include <linux/ipv6.h>
-#include <net/dsfield.h>
-
-#include <linux/netfilter/x_tables.h>
-#include <linux/netfilter/xt_dscp.h>
-
-MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
-MODULE_DESCRIPTION("Xtables: DSCP/TOS field match");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("ipt_dscp");
-MODULE_ALIAS("ip6t_dscp");
-MODULE_ALIAS("ipt_tos");
-MODULE_ALIAS("ip6t_tos");
-
-static bool
-dscp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
-{
- const struct xt_dscp_info *info = par->matchinfo;
- u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT;
-
- return (dscp == info->dscp) ^ !!info->invert;
-}
-
-static bool
-dscp_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
-{
- const struct xt_dscp_info *info = par->matchinfo;
- u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT;
-
- return (dscp == info->dscp) ^ !!info->invert;
-}
-
-static bool dscp_mt_check(const struct xt_mtchk_param *par)
-{
- const struct xt_dscp_info *info = par->matchinfo;
-
- if (info->dscp > XT_DSCP_MAX) {
- printk(KERN_ERR "xt_dscp: dscp %x out of range\n", info->dscp);
- return false;
- }
-
- return true;
-}
-
-static bool tos_mt(const struct sk_buff *skb, const struct xt_match_param *par)
-{
- const struct xt_tos_match_info *info = par->matchinfo;
-
- if (par->match->family == NFPROTO_IPV4)
- return ((ip_hdr(skb)->tos & info->tos_mask) ==
- info->tos_value) ^ !!info->invert;
- else
- return ((ipv6_get_dsfield(ipv6_hdr(skb)) & info->tos_mask) ==
- info->tos_value) ^ !!info->invert;
-}
-
-static struct xt_match dscp_mt_reg[] __read_mostly = {
- {
- .name = "dscp",
- .family = NFPROTO_IPV4,
- .checkentry = dscp_mt_check,
- .match = dscp_mt,
- .matchsize = sizeof(struct xt_dscp_info),
- .me = THIS_MODULE,
- },
- {
- .name = "dscp",
- .family = NFPROTO_IPV6,
- .checkentry = dscp_mt_check,
- .match = dscp_mt6,
- .matchsize = sizeof(struct xt_dscp_info),
- .me = THIS_MODULE,
- },
- {
- .name = "tos",
- .revision = 1,
- .family = NFPROTO_IPV4,
- .match = tos_mt,
- .matchsize = sizeof(struct xt_tos_match_info),
- .me = THIS_MODULE,
- },
- {
- .name = "tos",
- .revision = 1,
- .family = NFPROTO_IPV6,
- .match = tos_mt,
- .matchsize = sizeof(struct xt_tos_match_info),
- .me = THIS_MODULE,
- },
-};
-
-static int __init dscp_mt_init(void)
-{
- return xt_register_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg));
-}
-
-static void __exit dscp_mt_exit(void)
-{
- xt_unregister_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg));
-}
-
-module_init(dscp_mt_init);
-module_exit(dscp_mt_exit);
diff --git a/net/netfilter/xt_hl.c b/net/netfilter/xt_hl.c
deleted file mode 100644
index 7726154c87b..00000000000
--- a/net/netfilter/xt_hl.c
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * IP tables module for matching the value of the TTL
- * (C) 2000,2001 by Harald Welte <laforge@netfilter.org>
- *
- * Hop Limit matching module
- * (C) 2001-2002 Maciej Soltysiak <solt@dns.toxicfilms.tv>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/ip.h>
-#include <linux/ipv6.h>
-#include <linux/module.h>
-#include <linux/skbuff.h>
-
-#include <linux/netfilter/x_tables.h>
-#include <linux/netfilter_ipv4/ipt_ttl.h>
-#include <linux/netfilter_ipv6/ip6t_hl.h>
-
-MODULE_AUTHOR("Maciej Soltysiak <solt@dns.toxicfilms.tv>");
-MODULE_DESCRIPTION("Xtables: Hoplimit/TTL field match");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("ipt_ttl");
-MODULE_ALIAS("ip6t_hl");
-
-static bool ttl_mt(const struct sk_buff *skb, const struct xt_match_param *par)
-{
- const struct ipt_ttl_info *info = par->matchinfo;
- const u8 ttl = ip_hdr(skb)->ttl;
-
- switch (info->mode) {
- case IPT_TTL_EQ:
- return ttl == info->ttl;
- case IPT_TTL_NE:
- return ttl != info->ttl;
- case IPT_TTL_LT:
- return ttl < info->ttl;
- case IPT_TTL_GT:
- return ttl > info->ttl;
- default:
- printk(KERN_WARNING "ipt_ttl: unknown mode %d\n",
- info->mode);
- return false;
- }
-
- return false;
-}
-
-static bool hl_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
-{
- const struct ip6t_hl_info *info = par->matchinfo;
- const struct ipv6hdr *ip6h = ipv6_hdr(skb);
-
- switch (info->mode) {
- case IP6T_HL_EQ:
- return ip6h->hop_limit == info->hop_limit;
- break;
- case IP6T_HL_NE:
- return ip6h->hop_limit != info->hop_limit;
- break;
- case IP6T_HL_LT:
- return ip6h->hop_limit < info->hop_limit;
- break;
- case IP6T_HL_GT:
- return ip6h->hop_limit > info->hop_limit;
- break;
- default:
- printk(KERN_WARNING "ip6t_hl: unknown mode %d\n",
- info->mode);
- return false;
- }
-
- return false;
-}
-
-static struct xt_match hl_mt_reg[] __read_mostly = {
- {
- .name = "ttl",
- .revision = 0,
- .family = NFPROTO_IPV4,
- .match = ttl_mt,
- .matchsize = sizeof(struct ipt_ttl_info),
- .me = THIS_MODULE,
- },
- {
- .name = "hl",
- .revision = 0,
- .family = NFPROTO_IPV6,
- .match = hl_mt6,
- .matchsize = sizeof(struct ip6t_hl_info),
- .me = THIS_MODULE,
- },
-};
-
-static int __init hl_mt_init(void)
-{
- return xt_register_matches(hl_mt_reg, ARRAY_SIZE(hl_mt_reg));
-}
-
-static void __exit hl_mt_exit(void)
-{
- xt_unregister_matches(hl_mt_reg, ARRAY_SIZE(hl_mt_reg));
-}
-
-module_init(hl_mt_init);
-module_exit(hl_mt_exit);
diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
deleted file mode 100644
index 4809b34b10f..00000000000
--- a/net/netfilter/xt_tcpmss.c
+++ /dev/null
@@ -1,110 +0,0 @@
-/* Kernel module to match TCP MSS values. */
-
-/* Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
- * Portions (C) 2005 by Harald Welte <laforge@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <net/tcp.h>
-
-#include <linux/netfilter/xt_tcpmss.h>
-#include <linux/netfilter/x_tables.h>
-
-#include <linux/netfilter_ipv4/ip_tables.h>
-#include <linux/netfilter_ipv6/ip6_tables.h>
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
-MODULE_DESCRIPTION("Xtables: TCP MSS match");
-MODULE_ALIAS("ipt_tcpmss");
-MODULE_ALIAS("ip6t_tcpmss");
-
-static bool
-tcpmss_mt(const struct sk_buff *skb, const struct xt_match_param *par)
-{
- const struct xt_tcpmss_match_info *info = par->matchinfo;
- const struct tcphdr *th;
- struct tcphdr _tcph;
- /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
- const u_int8_t *op;
- u8 _opt[15 * 4 - sizeof(_tcph)];
- unsigned int i, optlen;
-
- /* If we don't have the whole header, drop packet. */
- th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
- if (th == NULL)
- goto dropit;
-
- /* Malformed. */
- if (th->doff*4 < sizeof(*th))
- goto dropit;
-
- optlen = th->doff*4 - sizeof(*th);
- if (!optlen)
- goto out;
-
- /* Truncated options. */
- op = skb_header_pointer(skb, par->thoff + sizeof(*th), optlen, _opt);
- if (op == NULL)
- goto dropit;
-
- for (i = 0; i < optlen; ) {
- if (op[i] == TCPOPT_MSS
- && (optlen - i) >= TCPOLEN_MSS
- && op[i+1] == TCPOLEN_MSS) {
- u_int16_t mssval;
-
- mssval = (op[i+2] << 8) | op[i+3];
-
- return (mssval >= info->mss_min &&
- mssval <= info->mss_max) ^ info->invert;
- }
- if (op[i] < 2)
- i++;
- else
- i += op[i+1] ? : 1;
- }
-out:
- return info->invert;
-
-dropit:
- *par->hotdrop = true;
- return false;
-}
-
-static struct xt_match tcpmss_mt_reg[] __read_mostly = {
- {
- .name = "tcpmss",
- .family = NFPROTO_IPV4,
- .match = tcpmss_mt,
- .matchsize = sizeof(struct xt_tcpmss_match_info),
- .proto = IPPROTO_TCP,
- .me = THIS_MODULE,
- },
- {
- .name = "tcpmss",
- .family = NFPROTO_IPV6,
- .match = tcpmss_mt,
- .matchsize = sizeof(struct xt_tcpmss_match_info),
- .proto = IPPROTO_TCP,
- .me = THIS_MODULE,
- },
-};
-
-static int __init tcpmss_mt_init(void)
-{
- return xt_register_matches(tcpmss_mt_reg, ARRAY_SIZE(tcpmss_mt_reg));
-}
-
-static void __exit tcpmss_mt_exit(void)
-{
- xt_unregister_matches(tcpmss_mt_reg, ARRAY_SIZE(tcpmss_mt_reg));
-}
-
-module_init(tcpmss_mt_init);
-module_exit(tcpmss_mt_exit);
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2024-11-22 15:26:08 +0000