diff -Nru linux-2.4.17_mvl21/net/ipv4/netfilter/iptable_mangle.c linux-2.4.17_mvl21/net/ipv4/netfilter/iptable_mangle.c --- linux-2.4.17_mvl21/net/ipv4/netfilter/iptable_mangle.c Sun Sep 30 21:26:08 2001 +++ linux-2.4.17_mvl21/net/ipv4/netfilter/iptable_mangle.c Sun Dec 2 23:12:56 2001 @@ -2,6 +2,8 @@ * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x. * * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling + * + * Extended to all five netfilter hooks by Brad Chapman & Harald Welte */ #include #include @@ -12,7 +14,11 @@ #include #include -#define MANGLE_VALID_HOOKS ((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT)) +#define MANGLE_VALID_HOOKS ((1 << NF_IP_PRE_ROUTING) | \ + (1 << NF_IP_LOCAL_IN) | \ + (1 << NF_IP_FORWARD) | \ + (1 << NF_IP_LOCAL_OUT) | \ + (1 << NF_IP_POST_ROUTING)) /* Standard entry. */ struct ipt_standard @@ -33,18 +39,25 @@ struct ipt_error_target target; }; +/* Ouch - five different hooks? Maybe this should be a config option..... -- BC */ static struct { struct ipt_replace repl; - struct ipt_standard entries[2]; + struct ipt_standard entries[5]; struct ipt_error term; } initial_table __initdata -= { { "mangle", MANGLE_VALID_HOOKS, 3, - sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error), - { [NF_IP_PRE_ROUTING] 0, - [NF_IP_LOCAL_OUT] sizeof(struct ipt_standard) }, - { [NF_IP_PRE_ROUTING] 0, - [NF_IP_LOCAL_OUT] sizeof(struct ipt_standard) }, += { { "mangle", MANGLE_VALID_HOOKS, 6, + sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error), + { [NF_IP_PRE_ROUTING] 0, + [NF_IP_LOCAL_IN] sizeof(struct ipt_standard), + [NF_IP_FORWARD] sizeof(struct ipt_standard) * 2, + [NF_IP_LOCAL_OUT] sizeof(struct ipt_standard) * 3, + [NF_IP_POST_ROUTING] sizeof(struct ipt_standard) * 4 }, + { [NF_IP_PRE_ROUTING] 0, + [NF_IP_LOCAL_IN] sizeof(struct ipt_standard), + [NF_IP_FORWARD] sizeof(struct ipt_standard) * 2, + [NF_IP_LOCAL_OUT] sizeof(struct ipt_standard) * 3, + [NF_IP_POST_ROUTING] sizeof(struct ipt_standard) * 4 }, 0, NULL, { } }, { /* PRE_ROUTING */ @@ -55,6 +68,22 @@ 0, { 0, 0 }, { } }, { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } }, -NF_ACCEPT - 1 } }, + /* LOCAL_IN */ + { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, + 0, + sizeof(struct ipt_entry), + sizeof(struct ipt_standard), + 0, { 0, 0 }, { } }, + { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } }, + -NF_ACCEPT - 1 } }, + /* FORWARD */ + { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, + 0, + sizeof(struct ipt_entry), + sizeof(struct ipt_standard), + 0, { 0, 0 }, { } }, + { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } }, + -NF_ACCEPT - 1 } }, /* LOCAL_OUT */ { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 0, @@ -62,7 +91,15 @@ sizeof(struct ipt_standard), 0, { 0, 0 }, { } }, { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } }, - -NF_ACCEPT - 1 } } + -NF_ACCEPT - 1 } }, + /* POST_ROUTING */ + { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, + 0, + sizeof(struct ipt_entry), + sizeof(struct ipt_standard), + 0, { 0, 0 }, { } }, + { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } }, + -NF_ACCEPT - 1 } }, }, /* ERROR */ { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, @@ -83,7 +120,7 @@ /* The work comes in here from netfilter.c. */ static unsigned int -ipt_hook(unsigned int hook, +ipt_route_hook(unsigned int hook, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, @@ -121,7 +158,7 @@ } static unsigned int -ipt_local_out_hook(unsigned int hook, +ipt_local_hook(unsigned int hook, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, @@ -159,9 +196,16 @@ } static struct nf_hook_ops ipt_ops[] -= { { { NULL, NULL }, ipt_hook, PF_INET, NF_IP_PRE_ROUTING, NF_IP_PRI_MANGLE }, - { { NULL, NULL }, ipt_local_out_hook, PF_INET, NF_IP_LOCAL_OUT, - NF_IP_PRI_MANGLE } += { { { NULL, NULL }, ipt_route_hook, PF_INET, NF_IP_PRE_ROUTING, + NF_IP_PRI_MANGLE }, + { { NULL, NULL }, ipt_local_hook, PF_INET, NF_IP_LOCAL_IN, + NF_IP_PRI_MANGLE }, + { { NULL, NULL }, ipt_route_hook, PF_INET, NF_IP_FORWARD, + NF_IP_PRI_MANGLE }, + { { NULL, NULL }, ipt_local_hook, PF_INET, NF_IP_LOCAL_OUT, + NF_IP_PRI_MANGLE }, + { { NULL, NULL }, ipt_route_hook, PF_INET, NF_IP_POST_ROUTING, + NF_IP_PRI_MANGLE } }; static int __init init(void) @@ -182,8 +226,26 @@ if (ret < 0) goto cleanup_hook0; + ret = nf_register_hook(&ipt_ops[2]); + if (ret < 0) + goto cleanup_hook1; + + ret = nf_register_hook(&ipt_ops[3]); + if (ret < 0) + goto cleanup_hook2; + + ret = nf_register_hook(&ipt_ops[4]); + if (ret < 0) + goto cleanup_hook3; + return ret; + cleanup_hook3: + nf_unregister_hook(&ipt_ops[3]); + cleanup_hook2: + nf_unregister_hook(&ipt_ops[2]); + cleanup_hook1: + nf_unregister_hook(&ipt_ops[1]); cleanup_hook0: nf_unregister_hook(&ipt_ops[0]); cleanup_table: diff -Nru linux-2.4.17_mvl21/net/ipv6/netfilter/ip6table_mangle.c linux-2.4.17_mvl21/net/ipv6/netfilter/ip6table_mangle.c --- linux-2.4.17_mvl21/net/ipv6/netfilter/ip6table_mangle.c Sun Sep 30 21:26:09 2001 +++ linux-2.4.17_mvl21/net/ipv6/netfilter/ip6table_mangle.c Sun Dec 2 23:11:14 2001 @@ -1,14 +1,18 @@ /* * IPv6 packet mangling table, a port of the IPv4 mangle table to IPv6 * - * Copyright (C) 2000 by Harald Welte + * Copyright (C) 2000-2001 by Harald Welte */ #include #include -#define MANGLE_VALID_HOOKS ((1 << NF_IP6_PRE_ROUTING) | (1 << NF_IP6_LOCAL_OUT)) +#define MANGLE_VALID_HOOKS ((1 << NF_IP6_PRE_ROUTING) | \ + (1 << NF_IP6_LOCAL_IN) | \ + (1 << NF_IP6_FORWARD) | \ + (1 << NF_IP6_LOCAL_OUT) | \ + (1 << NF_IP6_POST_ROUTING)) -#if 1 +#if 0 #define DEBUGP(x, args...) printk(KERN_DEBUG x, ## args) #else #define DEBUGP(x, args...) @@ -36,19 +40,41 @@ static struct { struct ip6t_replace repl; - struct ip6t_standard entries[2]; + struct ip6t_standard entries[5]; struct ip6t_error term; } initial_table __initdata -= { { "mangle", MANGLE_VALID_HOOKS, 3, - sizeof(struct ip6t_standard) * 2 + sizeof(struct ip6t_error), - { [NF_IP6_PRE_ROUTING] 0, - [NF_IP6_LOCAL_OUT] sizeof(struct ip6t_standard) }, - { [NF_IP6_PRE_ROUTING] 0, - [NF_IP6_LOCAL_OUT] sizeof(struct ip6t_standard) }, += { { "mangle", MANGLE_VALID_HOOKS, 6, + sizeof(struct ip6t_standard) * 5 + sizeof(struct ip6t_error), + { [NF_IP6_PRE_ROUTING] 0, + [NF_IP6_LOCAL_IN] sizeof(struct ip6t_standard), + [NF_IP6_FORWARD] sizeof(struct ip6t_standard) * 2, + [NF_IP6_LOCAL_OUT] sizeof(struct ip6t_standard) * 3, + [NF_IP6_POST_ROUTING] sizeof(struct ip6t_standard) * 4}, + { [NF_IP6_PRE_ROUTING] 0, + [NF_IP6_LOCAL_IN] sizeof(struct ip6t_standard), + [NF_IP6_FORWARD] sizeof(struct ip6t_standard) * 2, + [NF_IP6_LOCAL_OUT] sizeof(struct ip6t_standard) * 3, + [NF_IP6_POST_ROUTING] sizeof(struct ip6t_standard) * 4}, 0, NULL, { } }, { /* PRE_ROUTING */ - { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 }, + { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 }, + 0, + sizeof(struct ip6t_entry), + sizeof(struct ip6t_standard), + 0, { 0, 0 }, { } }, + { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } }, + -NF_ACCEPT - 1 } }, + /* LOCAL_IN */ + { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 }, + 0, + sizeof(struct ip6t_entry), + sizeof(struct ip6t_standard), + 0, { 0, 0 }, { } }, + { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } }, + -NF_ACCEPT - 1 } }, + /* FORWARD */ + { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 0, sizeof(struct ip6t_entry), sizeof(struct ip6t_standard), @@ -56,6 +82,14 @@ { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } }, -NF_ACCEPT - 1 } }, /* LOCAL_OUT */ + { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 }, + 0, + sizeof(struct ip6t_entry), + sizeof(struct ip6t_standard), + 0, { 0, 0 }, { } }, + { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } }, + -NF_ACCEPT - 1 } }, + /* POST_ROUTING */ { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 0, sizeof(struct ip6t_entry), @@ -83,7 +117,7 @@ /* The work comes in here from netfilter.c. */ static unsigned int -ip6t_hook(unsigned int hook, +ip6t_route_hook(unsigned int hook, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, @@ -93,7 +127,7 @@ } static unsigned int -ip6t_local_out_hook(unsigned int hook, +ip6t_local_hook(unsigned int hook, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, @@ -142,9 +176,11 @@ } static struct nf_hook_ops ip6t_ops[] -= { { { NULL, NULL }, ip6t_hook, PF_INET6, NF_IP6_PRE_ROUTING, NF_IP6_PRI_MANGLE }, - { { NULL, NULL }, ip6t_local_out_hook, PF_INET6, NF_IP6_LOCAL_OUT, - NF_IP6_PRI_MANGLE } += { { { NULL, NULL }, ip6t_route_hook, PF_INET6, NF_IP6_PRE_ROUTING, NF_IP6_PRI_MANGLE }, + { { NULL, NULL }, ip6t_local_hook, PF_INET6, NF_IP6_LOCAL_IN, NF_IP6_PRI_MANGLE }, + { { NULL, NULL }, ip6t_route_hook, PF_INET6, NF_IP6_FORWARD, NF_IP6_PRI_MANGLE }, + { { NULL, NULL }, ip6t_local_hook, PF_INET6, NF_IP6_LOCAL_OUT, NF_IP6_PRI_MANGLE }, + { { NULL, NULL }, ip6t_route_hook, PF_INET6, NF_IP6_POST_ROUTING, NF_IP6_PRI_MANGLE } }; static int __init init(void) @@ -165,8 +201,26 @@ if (ret < 0) goto cleanup_hook0; + ret = nf_register_hook(&ip6t_ops[2]); + if (ret < 0) + goto cleanup_hook1; + + ret = nf_register_hook(&ip6t_ops[3]); + if (ret < 0) + goto cleanup_hook2; + + ret = nf_register_hook(&ip6t_ops[4]); + if (ret < 0) + goto cleanup_hook3; + return ret; + cleanup_hook3: + nf_unregister_hook(&ip6t_ops[3]); + cleanup_hook2: + nf_unregister_hook(&ip6t_ops[2]); + cleanup_hook1: + nf_unregister_hook(&ip6t_ops[1]); cleanup_hook0: nf_unregister_hook(&ip6t_ops[0]); cleanup_table: