addrtype match

PATCH Superseded Patrick McHardy 3 participants 10 messages Apr 8, 2003 – Apr 11, 2003 netfilter

Share & tools

Patrick McHardy

author

2003-04-08 16:02 UTC #0 lore raw

PATCH 1/1 addrtype match

This patch adds a new match "addrtype" which can be used to match the result of inet_addr_type, which is what routing thinks of an address. We use it for automatic generated rules where DNAT rules can be generated with just an interface match because the local ip may be unknown at rule generation time. The match is then used to exclude local addresses from DNAT. Please consider for inclusion.

Bye,
Patrick

patch-o-matic/extra/addrtype.patch +145 -0

diff -urN a/patch-o-matic/extra/addrtype.patch b/patch-o-matic/extra/addrtype.patch
@@ -0,0 +1,145 @@
+diff -urN a/include/linux/netfilter_ipv4/ipt_addrtype.h b/include/linux/netfilter_ipv4/ipt_addrtype.h
+--- a/include/linux/netfilter_ipv4/ipt_addrtype.h	1970-01-01 01:00:00.000000000 +0100
++++ b/include/linux/netfilter_ipv4/ipt_addrtype.h	2003-04-08 13:38:02.000000000 +0200
+@@ -0,0 +1,26 @@
++#ifndef _IPT_ADDRTYPE_H
++#define _IPT_ADDRTYPE_H
++
++/* from linux/rtnetlink.h */
++
++#define IPT_ADDRTYPE_RTN_UNSPEC		0x0001
++#define IPT_ADDRTYPE_RTN_UNICAST	0x0002
++#define IPT_ADDRTYPE_RTN_LOCAL		0x0004
++#define IPT_ADDRTYPE_RTN_BROADCAST	0x0008
++#define IPT_ADDRTYPE_RTN_ANYCAST	0x0010
++#define IPT_ADDRTYPE_RTN_MULTICAST	0x0020
++#define IPT_ADDRTYPE_RTN_BLACKHOLE	0x0040
++#define IPT_ADDRTYPE_RTN_UNREACHABLE	0x0080
++#define IPT_ADDRTYPE_RTN_PROHIBIT	0x0100
++#define IPT_ADDRTYPE_RTN_THROW		0x0200
++#define IPT_ADDRTYPE_RTN_NAT		0x0400
++#define IPT_ADDRTYPE_RTN_XRESOLVE	0x0800
++
++struct ipt_addrtype_info {
++	u_int16_t	source;
++	u_int16_t	dest;
++	int		invert_source;	/* -m addtype ! --source .. */
++	int		invert_dest;	/* -m addrtype ! --dest .. */
++};
++
++#endif
+diff -urN a/net/ipv4/netfilter/ipt_addrtype.c b/net/ipv4/netfilter/ipt_addrtype.c
+--- a/net/ipv4/netfilter/ipt_addrtype.c	1970-01-01 01:00:00.000000000 +0100
++++ b/net/ipv4/netfilter/ipt_addrtype.c	2003-04-08 15:41:05.000000000 +0200
+@@ -0,0 +1,111 @@
++#include <linux/module.h>
++#include <linux/skbuff.h>
++#include <linux/netdevice.h>
++
++#include <net/route.h>
++
++#include <linux/netfilter_ipv4/ipt_addrtype.h>
++#include <linux/netfilter_ipv4/ip_tables.h>
++
++MODULE_LICENSE("GPL");
++
++static int match_type(u_int32_t addr, u_int16_t types)
++{
++	unsigned type = inet_addr_type(addr);
++
++	switch(type) {
++		case RTN_UNSPEC:
++			if (types&IPT_ADDRTYPE_RTN_UNSPEC)
++				return 1;
++			break;
++		case RTN_UNICAST:
++			if (types&IPT_ADDRTYPE_RTN_UNICAST)
++				return 1;
++			break;
++		case RTN_LOCAL:
++			if (types&IPT_ADDRTYPE_RTN_LOCAL)
++				return 1;
++			break;
++		case RTN_BROADCAST:
++			if (type&IPT_ADDRTYPE_RTN_BROADCAST)
++				return 1;
++			break;
++		case RTN_ANYCAST:
++			if (types&IPT_ADDRTYPE_RTN_ANYCAST)
++				return 1;
++			break;
++		case RTN_MULTICAST:
++			if (types&IPT_ADDRTYPE_RTN_MULTICAST)
++				return 1;
++			break;
++		case RTN_BLACKHOLE:
++			if (types&IPT_ADDRTYPE_RTN_BLACKHOLE)
++				return 1;
++			break;
++		case RTN_UNREACHABLE:
++			if (types&IPT_ADDRTYPE_RTN_UNREACHABLE)
++				return 1;
++			break;
++		case RTN_PROHIBIT:
++			if (types&IPT_ADDRTYPE_RTN_PROHIBIT)
++				return 1;
++			break;
++		case RTN_THROW:
++			if (types&IPT_ADDRTYPE_RTN_THROW)
++				return 1;
++			break;
++		case RTN_NAT:
++			if (types&IPT_ADDRTYPE_RTN_NAT)
++				return 1;
++			break;
++		case RTN_XRESOLVE:
++			if (types&IPT_ADDRTYPE_RTN_XRESOLVE)
++				return 1;
++			break;
++	}
++	return 0;
++}
++
++static int match(const struct sk_buff *skb, const struct net_device *in,
++		 const struct net_device *out, const void *matchinfo,
++		 int offset, const void *hdr, u_int16_t datalen,
++		 int *hotdrop)
++{
++	const struct ipt_addrtype_info *info = matchinfo;
++	const struct iphdr *iph = skb->nh.iph;
++	int ret = 1;
++
++	if (info->source)
++		ret &= match_type(iph->saddr, info->source)^info->invert_source;
++	if (info->dest)
++		ret &= match_type(iph->daddr, info->dest)^info->invert_dest;
++	
++	return ret;
++}
++
++static int checkentry(const char *tablename, const struct ipt_ip *ip,
++		      void *matchinfo, unsigned int matchsize,
++		      unsigned int hook_mask)
++{
++	if (matchsize != IPT_ALIGN(sizeof(struct ipt_addrtype_info)))
++		return 0;
++
++	return 1;
++}
++
++static struct ipt_match addrtype_match = { { NULL, NULL }, "addrtype", &match,
++		&checkentry, NULL, THIS_MODULE };
++
++static int __init init(void)
++{
++	return ipt_register_match(&addrtype_match);
++}
++
++static void __exit fini(void)
++{
++	ipt_unregister_match(&addrtype_match);
++
++}
++
++module_init(init);
++module_exit(fini);

patch-o-matic/extra/addrtype.patch.config.in +2 -0

diff -urN a/patch-o-matic/extra/addrtype.patch.config.in b/patch-o-matic/extra/addrtype.patch.config.in
@@ -0,0 +1,2 @@
+  dep_tristate '  TTL match support' CONFIG_IP_NF_MATCH_TTL $CONFIG_IP_NF_IPTABLES
+  dep_tristate '  address type match support' CONFIG_IP_NF_MATCH_ADDRTYPE $CONFIG_IP_NF_IPTABLES

patch-o-matic/extra/addrtype.patch.help +28 -0

diff -urN a/patch-o-matic/extra/addrtype.patch.help b/patch-o-matic/extra/addrtype.patch.help
@@ -0,0 +1,28 @@
+Author: Patrick McHardy <[email protected]>
+Status: Working
+
+This match allows you to match address types as seen by the routing code.
+Valid types (from include/linux/rtnetlink.h) are:
+
+UNSPEC
+UNICAST
+LOCAL
+BROADCAST
+ANYCAST
+MULTICAST
+BLACKHOLE
+UNREACHABLE
+PROHIBIT
+THROW
+NAT
+XRESOLVE
+
+Usage:
+	-m addrtype --source type[,type..] --dest type[,type..]
+
+Example:
+
+	iptables ... -m addrtype --source LOCAL ...
+	iptables ... -m addrtype --dest ANYCAST ...
+
+

patch-o-matic/extra/addrtype.patch.makefile +2 -0

diff -urN a/patch-o-matic/extra/addrtype.patch.makefile b/patch-o-matic/extra/addrtype.patch.makefile
@@ -0,0 +1,2 @@
+obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
+obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o

userspace/extensions/.addrtype-test +5 -0

diff -urN a/userspace/extensions/.addrtype-test b/userspace/extensions/.addrtype-test
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+if test -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_addrtype.h; then
+	echo "addrtype"
+fi

userspace/extensions/libipt_addrtype.c +245 -0

245 lines not on this page · raw message

Martin Josefsson

2003-04-08 20:31 UTC #1 lore raw

Quoted 6 lines · Patrick McHardy

This patch adds a new match "addrtype" which can be used to match the result of inet_addr_type, which is what routing thinks of an address. We use it for automatic generated rules where DNAT rules can be generated with just an interface match because the local ip may be unknown at rule generation time. The match is then used to exclude local addresses from DNAT. Please consider for inclusion.

Might come in handy.

Quoted 6 lines

++/* from linux/rtnetlink.h */
++
++#define IPT_ADDRTYPE_RTN_UNSPEC 0x0001
++#define IPT_ADDRTYPE_RTN_UNICAST 0x0002
++#define IPT_ADDRTYPE_RTN_LOCAL 0x0004
++#define IPT_ADDRTYPE_RTN_BROADCAST 0x0008

Quoted 8 lines

++#define IPT_ADDRTYPE_RTN_ANYCAST 0x0010
++#define IPT_ADDRTYPE_RTN_MULTICAST 0x0020
++#define IPT_ADDRTYPE_RTN_BLACKHOLE 0x0040
++#define IPT_ADDRTYPE_RTN_UNREACHABLE 0x0080
++#define IPT_ADDRTYPE_RTN_PROHIBIT 0x0100
++#define IPT_ADDRTYPE_RTN_THROW 0x0200
++#define IPT_ADDRTYPE_RTN_NAT 0x0400
++#define IPT_ADDRTYPE_RTN_XRESOLVE 0x0800

Ok, duplicated and renumbered so you can use them as a bitmap. Might deserve a comment as to why they were duplicated, might not be totally obvious (took me a moment to realize it :)

Quoted 5 lines

++ switch(type) {
++ case RTN_UNSPEC:
++ if (types&IPT_ADDRTYPE_RTN_UNSPEC)
++ return 1;
++ break;

The kernel codingstyle says that there should be spaces around the & .

Quoted 9 lines

++static int checkentry(const char *tablename, const struct ipt_ip *ip,
++ void *matchinfo, unsigned int matchsize,
++ unsigned int hook_mask)
++{
++ if (matchsize != IPT_ALIGN(sizeof(struct ipt_addrtype_info)))
++ return 0;
++
++ return 1;
++}

A printk that tells the user what went wrong might be a nice thing. It's missing from a lot of modules and I plan to fix that in the future.

userspace/extensions/libipt_addrtype.c line 1

Quoted 5 lines

diff -urN a/userspace/extensions/libipt_addrtype.c b/userspace/extensions/libipt_addrtype.c
userspace/extensions/libipt_addrtype.c +1 -0
@@ -0,0 +1,245 @@
+/* Shared library add-on to iptables to add TTL matching support 

copy-and-forgot-to-edit? :)

userspace/extensions/libipt_addrtype.c line 132

Quoted 6 lines

userspace/extensions/libipt_addrtype.c +6 -0

+static void print_type(u_int16_t types) {
+	const char *sep = "";
+	if (types&IPT_ADDRTYPE_RTN_UNSPEC) {
+		printf("%sUNSPEC", sep);
+		sep = ",";
+	}

Sure this is userspace but I'd like to see spaces around & here as well :)

Signature · 1 line

/Martin

Patrick McHardy

author

2003-04-08 23:28 UTC #2 lore raw

Hi Martin,
thanks for your suggestions, i will make a new patch and resubmit it tomorrow.

Bye,
Patrick

Patrick McHardy

author

2003-04-09 01:37 UTC #3 lore raw

In reply to Martin Josefsson

Hi Martin,
this is an updated version of the addrtype match with the changes you suggested. it's probably not be the most useful match in the world but as you said, it might come handy ;)

Thanks,
Patrick

patch-o-matic/extra/addrtype.patch +148 -0

diff -urN a/patch-o-matic/extra/addrtype.patch b/patch-o-matic/extra/addrtype.patch
@@ -0,0 +1,148 @@
+diff -urN a/include/linux/netfilter_ipv4/ipt_addrtype.h b/include/linux/netfilter_ipv4/ipt_addrtype.h
+--- a/include/linux/netfilter_ipv4/ipt_addrtype.h	1970-01-01 01:00:00.000000000 +0100
++++ b/include/linux/netfilter_ipv4/ipt_addrtype.h	2003-04-09 03:20:01.000000000 +0200
+@@ -0,0 +1,26 @@
++#ifndef _IPT_ADDRTYPE_H
++#define _IPT_ADDRTYPE_H
++
++/* from linux/rtnetlink.h, renumbered to be useable as a bitmap */
++
++#define IPT_ADDRTYPE_RTN_UNSPEC		0x0001
++#define IPT_ADDRTYPE_RTN_UNICAST	0x0002
++#define IPT_ADDRTYPE_RTN_LOCAL		0x0004
++#define IPT_ADDRTYPE_RTN_BROADCAST	0x0008
++#define IPT_ADDRTYPE_RTN_ANYCAST	0x0010
++#define IPT_ADDRTYPE_RTN_MULTICAST	0x0020
++#define IPT_ADDRTYPE_RTN_BLACKHOLE	0x0040
++#define IPT_ADDRTYPE_RTN_UNREACHABLE	0x0080
++#define IPT_ADDRTYPE_RTN_PROHIBIT	0x0100
++#define IPT_ADDRTYPE_RTN_THROW		0x0200
++#define IPT_ADDRTYPE_RTN_NAT		0x0400
++#define IPT_ADDRTYPE_RTN_XRESOLVE	0x0800
++
++struct ipt_addrtype_info {
++	u_int16_t	source;
++	u_int16_t	dest;
++	int		invert_source;	/* -m addtype ! --source .. */
++	int		invert_dest;	/* -m addrtype ! --dest .. */
++};
++
++#endif
+diff -urN a/net/ipv4/netfilter/ipt_addrtype.c b/net/ipv4/netfilter/ipt_addrtype.c
+--- a/net/ipv4/netfilter/ipt_addrtype.c	1970-01-01 01:00:00.000000000 +0100
++++ b/net/ipv4/netfilter/ipt_addrtype.c	2003-04-09 03:22:18.000000000 +0200
+@@ -0,0 +1,114 @@
++#include <linux/module.h>
++#include <linux/skbuff.h>
++#include <linux/netdevice.h>
++
++#include <net/route.h>
++
++#include <linux/netfilter_ipv4/ipt_addrtype.h>
++#include <linux/netfilter_ipv4/ip_tables.h>
++
++MODULE_LICENSE("GPL");
++
++static int match_type(u_int32_t addr, u_int16_t types)
++{
++	unsigned type = inet_addr_type(addr);
++
++	switch(type) {
++		case RTN_UNSPEC:
++			if (types & IPT_ADDRTYPE_RTN_UNSPEC)
++				return 1;
++			break;
++		case RTN_UNICAST:
++			if (types & IPT_ADDRTYPE_RTN_UNICAST)
++				return 1;
++			break;
++		case RTN_LOCAL:
++			if (types & IPT_ADDRTYPE_RTN_LOCAL)
++				return 1;
++			break;
++		case RTN_BROADCAST:
++			if (type & IPT_ADDRTYPE_RTN_BROADCAST)
++				return 1;
++			break;
++		case RTN_ANYCAST:
++			if (types & IPT_ADDRTYPE_RTN_ANYCAST)
++				return 1;
++			break;
++		case RTN_MULTICAST:
++			if (types & IPT_ADDRTYPE_RTN_MULTICAST)
++				return 1;
++			break;
++		case RTN_BLACKHOLE:
++			if (types & IPT_ADDRTYPE_RTN_BLACKHOLE)
++				return 1;
++			break;
++		case RTN_UNREACHABLE:
++			if (types & IPT_ADDRTYPE_RTN_UNREACHABLE)
++				return 1;
++			break;
++		case RTN_PROHIBIT:
++			if (types & IPT_ADDRTYPE_RTN_PROHIBIT)
++				return 1;
++			break;
++		case RTN_THROW:
++			if (types & IPT_ADDRTYPE_RTN_THROW)
++				return 1;
++			break;
++		case RTN_NAT:
++			if (types & IPT_ADDRTYPE_RTN_NAT)
++				return 1;
++			break;
++		case RTN_XRESOLVE:
++			if (types & IPT_ADDRTYPE_RTN_XRESOLVE)
++				return 1;
++			break;
++	}
++	return 0;
++}
++
++static int match(const struct sk_buff *skb, const struct net_device *in,
++		 const struct net_device *out, const void *matchinfo,
++		 int offset, const void *hdr, u_int16_t datalen,
++		 int *hotdrop)
++{
++	const struct ipt_addrtype_info *info = matchinfo;
++	const struct iphdr *iph = skb->nh.iph;
++	int ret = 1;
++
++	if (info->source)
++		ret &= match_type(iph->saddr, info->source)^info->invert_source;
++	if (info->dest)
++		ret &= match_type(iph->daddr, info->dest)^info->invert_dest;
++	
++	return ret;
++}
++
++static int checkentry(const char *tablename, const struct ipt_ip *ip,
++		      void *matchinfo, unsigned int matchsize,
++		      unsigned int hook_mask)
++{
++	if (matchsize != IPT_ALIGN(sizeof(struct ipt_addrtype_info))) {
++		printk(KERN_ERR "ipt_addrtype: invalid size (%u != %u)\n.",
++		       matchsize, IPT_ALIGN(sizeof(struct ipt_addrtype_info)));
++		return 0;
++	}
++
++	return 1;
++}
++
++static struct ipt_match addrtype_match = { { NULL, NULL }, "addrtype", &match,
++		&checkentry, NULL, THIS_MODULE };
++
++static int __init init(void)
++{
++	return ipt_register_match(&addrtype_match);
++}
++
++static void __exit fini(void)
++{
++	ipt_unregister_match(&addrtype_match);
++
++}
++
++module_init(init);
++module_exit(fini);

patch-o-matic/extra/addrtype.patch.config.in +2 -0

diff -urN a/patch-o-matic/extra/addrtype.patch.config.in b/patch-o-matic/extra/addrtype.patch.config.in
@@ -0,0 +1,2 @@
+  dep_tristate '  TTL match support' CONFIG_IP_NF_MATCH_TTL $CONFIG_IP_NF_IPTABLES
+  dep_tristate '  address type match support' CONFIG_IP_NF_MATCH_ADDRTYPE $CONFIG_IP_NF_IPTABLES

patch-o-matic/extra/addrtype.patch.help +28 -0

diff -urN a/patch-o-matic/extra/addrtype.patch.help b/patch-o-matic/extra/addrtype.patch.help
@@ -0,0 +1,28 @@
+Author: Patrick McHardy <[email protected]>
+Status: Working
+
+This match allows you to match address types as seen by the routing code.
+Valid types (from include/linux/rtnetlink.h) are:
+
+UNSPEC
+UNICAST
+LOCAL
+BROADCAST
+ANYCAST
+MULTICAST
+BLACKHOLE
+UNREACHABLE
+PROHIBIT
+THROW
+NAT
+XRESOLVE
+
+Usage:
+	-m addrtype --source type[,type..] --dest type[,type..]
+
+Example:
+
+	iptables ... -m addrtype --source LOCAL ...
+	iptables ... -m addrtype --dest ANYCAST ...
+
+

patch-o-matic/extra/addrtype.patch.makefile +2 -0

diff -urN a/patch-o-matic/extra/addrtype.patch.makefile b/patch-o-matic/extra/addrtype.patch.makefile
@@ -0,0 +1,2 @@
+obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
+obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o

userspace/extensions/.addrtype-test +5 -0

diff -urN a/userspace/extensions/.addrtype-test b/userspace/extensions/.addrtype-test
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+if test -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_addrtype.h; then
+	echo "addrtype"
+fi

userspace/extensions/libipt_addrtype.c +245 -0

245 lines not on this page · raw message

Martin Josefsson

2003-04-09 11:21 UTC #4 lore raw

Quoted 4 lines · Patrick McHardy

Hi Martin,
this is an updated version of the addrtype match with the changes you suggested. it's probably not be the most useful match in the world but as you said, it might come handy ;)

Don't know why I didn't think of this last night... I plead temporary insanity :)

Quoted 17 lines

______________________________________________________________________
++/* from linux/rtnetlink.h, renumbered to be useable as a bitmap */ ++
++#define IPT_ADDRTYPE_RTN_UNSPEC 0x0001
++#define IPT_ADDRTYPE_RTN_UNICAST 0x0002
++#define IPT_ADDRTYPE_RTN_LOCAL 0x0004
++#define IPT_ADDRTYPE_RTN_BROADCAST 0x0008
++#define IPT_ADDRTYPE_RTN_ANYCAST 0x0010
++#define IPT_ADDRTYPE_RTN_MULTICAST 0x0020
++#define IPT_ADDRTYPE_RTN_BLACKHOLE 0x0040
++#define IPT_ADDRTYPE_RTN_UNREACHABLE 0x0080
++#define IPT_ADDRTYPE_RTN_PROHIBIT 0x0100
++#define IPT_ADDRTYPE_RTN_THROW 0x0200
++#define IPT_ADDRTYPE_RTN_NAT 0x0400
++#define IPT_ADDRTYPE_RTN_XRESOLVE 0x0800

There actually isn't any real need to duplicate and renumber.. just use (1 << RTN_UNSPEC) .... I think enum starts at 1 but that will only mean you loose one bit, you don't need 32 bits anyway :)

Quoted 4 lines

++static int match_type(u_int32_t addr, u_int16_t types) ++{
++ unsigned type = inet_addr_type(addr);
++

	if (type <= 31)
		if (types & (1 << type))
			return 1;

Quoted 2 lines

++ return 0;
++}

Maybe that would do it? I don't like big switch statements if they can be avoided.

userspace below:

userspace/extensions/libipt_addrtype.c line 40

Quoted 7 lines

userspace/extensions/libipt_addrtype.c +7 -0

+static int
+parse_type(const char *type, size_t strlen, u_int16_t *i)
+{
+	if (strncasecmp(type, "UNSPEC", strlen) == 0)
+		*i |= IPT_ADDRTYPE_RTN_UNSPEC;
+	else if (strncasecmp(type, "UNICAST", strlen) == 0)
+		*i |= IPT_ADDRTYPE_RTN_UNICAST;

Maybe this can be solved by a table that's looped through?

userspace/extensions/libipt_addrtype.c line 132

Quoted 6 lines

userspace/extensions/libipt_addrtype.c +6 -0

+static void print_type(u_int16_t types) {
+	const char *sep = "";
+	if (types & IPT_ADDRTYPE_RTN_UNSPEC) {
+		printf("%sUNSPEC", sep);
+		sep = ",";
+	}

Same table could be used here

Oh, it could be used in the help() function as well.

Sorry about all the extra comments now after you've already made a new patch... the only thing I really want to see is the removal of the code duplication in the kernel. The table in userspace would just be a lot nicer than all the if-statements, and to me almost more readable.

Signature · 1 line

/Martin

Patrick McHardy

author

2003-04-09 11:29 UTC #5 lore raw

Hi Martin,

Quoted 3 lines · Martin Josefsson

There actually isn't any real need to duplicate and renumber.. just use (1 << RTN_UNSPEC) .... I think enum starts at 1 but that will only mean you loose one bit, you don't need 32 bits anyway :)

...

Quoted 4 lines

Sorry about all the extra comments now after you've already made a new patch... the only thing I really want to see is the removal of the code duplication in the kernel. The table in userspace would just be a lot nicer than all the if-statements, and to me almost more readable.

No harm done, i was just starting to make some of the changes you suggested when your mail arrived, i too don't like big switch statements ;)

Thanks again,
Patrick

Patrick McHardy

author

2003-04-09 12:50 UTC #6 lore raw

In reply to Martin Josefsson

Hi Martin,
this is an updated version of the addrtype match, matching is now done with a bitmask of types built in userspace. Code is a lot smaller and nicer ;)

Bye,
Patrick

patch-o-matic/extra/addrtype.patch +84 -0

diff -urN a/patch-o-matic/extra/addrtype.patch b/patch-o-matic/extra/addrtype.patch
@@ -0,0 +1,84 @@
+diff -urN a/include/linux/netfilter_ipv4/ipt_addrtype.h b/include/linux/netfilter_ipv4/ipt_addrtype.h
+--- a/include/linux/netfilter_ipv4/ipt_addrtype.h	1970-01-01 01:00:00.000000000 +0100
++++ b/include/linux/netfilter_ipv4/ipt_addrtype.h	2003-04-09 13:42:03.000000000 +0200
+@@ -0,0 +1,11 @@
++#ifndef _IPT_ADDRTYPE_H
++#define _IPT_ADDRTYPE_H
++
++struct ipt_addrtype_info {
++	u_int16_t	source;		/* source-type mask */
++	u_int16_t	dest;		/* dest-type mask */
++	int		invert_source;
++	int		invert_dest;
++};
++
++#endif
+diff -urN a/net/ipv4/netfilter/ipt_addrtype.c b/net/ipv4/netfilter/ipt_addrtype.c
+--- a/net/ipv4/netfilter/ipt_addrtype.c	1970-01-01 01:00:00.000000000 +0100
++++ b/net/ipv4/netfilter/ipt_addrtype.c	2003-04-09 13:43:50.000000000 +0200
+@@ -0,0 +1,65 @@
++/*
++ *  iptables module to match inet_addr_type() of an ip.
++ */
++
++#include <linux/module.h>
++#include <linux/skbuff.h>
++#include <linux/netdevice.h>
++#include <net/route.h>
++
++#include <linux/netfilter_ipv4/ipt_addrtype.h>
++#include <linux/netfilter_ipv4/ip_tables.h>
++
++MODULE_LICENSE("GPL");
++
++static inline int match_type(u_int32_t addr, u_int16_t mask)
++{
++	return !!(mask & (1 << inet_addr_type(addr)));
++}
++
++static int match(const struct sk_buff *skb, const struct net_device *in,
++		 const struct net_device *out, const void *matchinfo,
++		 int offset, const void *hdr, u_int16_t datalen,
++		 int *hotdrop)
++{
++	const struct ipt_addrtype_info *info = matchinfo;
++	const struct iphdr *iph = skb->nh.iph;
++	int ret = 1;
++
++	if (info->source)
++		ret &= match_type(iph->saddr, info->source)^info->invert_source;
++	if (info->dest)
++		ret &= match_type(iph->daddr, info->dest)^info->invert_dest;
++	
++	return ret;
++}
++
++static int checkentry(const char *tablename, const struct ipt_ip *ip,
++		      void *matchinfo, unsigned int matchsize,
++		      unsigned int hook_mask)
++{
++	if (matchsize != IPT_ALIGN(sizeof(struct ipt_addrtype_info))) {
++		printk(KERN_ERR "ipt_addrtype: invalid size (%u != %u)\n.",
++		       matchsize, IPT_ALIGN(sizeof(struct ipt_addrtype_info)));
++		return 0;
++	}
++
++	return 1;
++}
++
++static struct ipt_match addrtype_match = { { NULL, NULL }, "addrtype", &match,
++		&checkentry, NULL, THIS_MODULE };
++
++static int __init init(void)
++{
++	return ipt_register_match(&addrtype_match);
++}
++
++static void __exit fini(void)
++{
++	ipt_unregister_match(&addrtype_match);
++
++}
++
++module_init(init);
++module_exit(fini);

patch-o-matic/extra/addrtype.patch.config.in +2 -0

diff -urN a/patch-o-matic/extra/addrtype.patch.config.in b/patch-o-matic/extra/addrtype.patch.config.in
@@ -0,0 +1,2 @@
+  dep_tristate '  TTL match support' CONFIG_IP_NF_MATCH_TTL $CONFIG_IP_NF_IPTABLES
+  dep_tristate '  address type match support' CONFIG_IP_NF_MATCH_ADDRTYPE $CONFIG_IP_NF_IPTABLES

patch-o-matic/extra/addrtype.patch.help +28 -0

diff -urN a/patch-o-matic/extra/addrtype.patch.help b/patch-o-matic/extra/addrtype.patch.help
@@ -0,0 +1,28 @@
+Author: Patrick McHardy <[email protected]>
+Status: Working
+
+This match allows you to match address types as seen by the routing code.
+Valid types (from include/linux/rtnetlink.h) are:
+
+UNSPEC
+UNICAST
+LOCAL
+BROADCAST
+ANYCAST
+MULTICAST
+BLACKHOLE
+UNREACHABLE
+PROHIBIT
+THROW
+NAT
+XRESOLVE
+
+Usage:
+	-m addrtype --source type[,type..] --dest type[,type..]
+
+Example:
+
+	iptables ... -m addrtype --source LOCAL ...
+	iptables ... -m addrtype --dest ANYCAST ...
+
+

patch-o-matic/extra/addrtype.patch.makefile +2 -0

diff -urN a/patch-o-matic/extra/addrtype.patch.makefile b/patch-o-matic/extra/addrtype.patch.makefile
@@ -0,0 +1,2 @@
+obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
+obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o

userspace/extensions/.addrtype-test +5 -0

diff -urN a/userspace/extensions/.addrtype-test b/userspace/extensions/.addrtype-test
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+if test -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_addrtype.h; then
+	echo "addrtype"
+fi

userspace/extensions/libipt_addrtype.c +216 -0

216 lines not on this page · raw message

Patrick McHardy

author

2003-04-09 13:28 UTC #7 lore raw

Once again a new patch, it seems it wasn't very clever to name the options --source and --dest, iptables ate the --source option before it was passed to the match. they are now renamed to --stype and --dtype.

Bye
Patrick

Quoted 10 lines · Patrick McHardy

Hi Martin,
this is an updated version of the addrtype match, matching is now done with a bitmask of types built in userspace. Code is a lot smaller and nicer ;)
Bye,
Patrick

patch-o-matic/extra/CLASSIFY.patch +89 -0

diff -urN a/patch-o-matic/extra/CLASSIFY.patch b/patch-o-matic/extra/CLASSIFY.patch
@@ -0,0 +1,89 @@
+diff -urN a/include/linux/netfilter_ipv4/ipt_CLASSIFY.h b/include/linux/netfilter_ipv4/ipt_CLASSIFY.h
+--- a/include/linux/netfilter_ipv4/ipt_CLASSIFY.h	1970-01-01 01:00:00.000000000 +0100
++++ b/include/linux/netfilter_ipv4/ipt_CLASSIFY.h	2003-04-09 02:50:19.000000000 +0200
+@@ -0,0 +1,8 @@
++#ifndef _IPT_CLASSIFY_H
++#define _IPT_CLASSIFY_H
++
++struct ipt_classify_target_info {
++	unsigned int priority;
++};
++
++#endif /*_IPT_CLASSIFY_H */
+diff -urN a/net/ipv4/netfilter/ipt_CLASSIFY.c b/net/ipv4/netfilter/ipt_CLASSIFY.c
+--- a/net/ipv4/netfilter/ipt_CLASSIFY.c	1970-01-01 01:00:00.000000000 +0100
++++ b/net/ipv4/netfilter/ipt_CLASSIFY.c	2003-04-09 02:58:08.000000000 +0200
+@@ -0,0 +1,73 @@
++/* This is a module which is used for setting the skb->priority field of an skb for qdisc classification. */
++#include <linux/module.h>
++#include <linux/skbuff.h>
++#include <linux/ip.h>
++#include <net/checksum.h>
++
++#include <linux/netfilter_ipv4/ip_tables.h>
++#include <linux/netfilter_ipv4/ipt_CLASSIFY.h>
++
++static unsigned int
++target(struct sk_buff **pskb,
++       unsigned int hooknum,
++       const struct net_device *in,
++       const struct net_device *out,
++       const void *targinfo,
++       void *userinfo)
++{
++	const struct ipt_classify_target_info *clinfo = targinfo;
++
++	if((*pskb)->priority != clinfo->priority) {
++		(*pskb)->priority = clinfo->priority;
++		(*pskb)->nfcache |= NFC_ALTERED;
++	}
++
++	return IPT_CONTINUE;
++}
++
++static int
++checkentry(const char *tablename,
++	   const struct ipt_entry *e,
++           void *targinfo,
++           unsigned int targinfosize,
++           unsigned int hook_mask)
++{
++	if (targinfosize != IPT_ALIGN(sizeof(struct ipt_classify_target_info))){
++		printk(KERN_ERR "CLASSIFY: invalid size (%u != %u).\n",
++		       targinfosize,
++		       IPT_ALIGN(sizeof(struct ipt_classify_target_info)));
++		return 0;
++	}
++	
++	if (hook_mask & ~(1 << NF_IP_POST_ROUTING)) {
++		printk(KERN_ERR "CLASSIFY: only valid in POST_ROUTING.\n");
++		return 0;
++	}
++
++	if (strcmp(tablename, "mangle") != 0) {
++		printk(KERN_WARNING "CLASSIFY: can only be called from \"mangle\" table, not \"%s\".\n", tablename);
++		return 0;
++	}
++
++	return 1;
++}
++
++static struct ipt_target ipt_classify_reg
++= { { NULL, NULL }, "CLASSIFY", target, checkentry, NULL, THIS_MODULE };
++
++static int __init init(void)
++{
++	if (ipt_register_target(&ipt_classify_reg))
++		return -EINVAL;
++
++	return 0;
++}
++
++static void __exit fini(void)
++{
++	ipt_unregister_target(&ipt_classify_reg);
++}
++
++module_init(init);
++module_exit(fini);
++MODULE_LICENSE("GPL");

patch-o-matic/extra/CLASSIFY.patch.config.in +2 -0

diff -urN a/patch-o-matic/extra/CLASSIFY.patch.config.in b/patch-o-matic/extra/CLASSIFY.patch.config.in
@@ -0,0 +1,2 @@
+    dep_tristate '    MARK target support' CONFIG_IP_NF_TARGET_MARK $CONFIG_IP_NF_MANGLE
+    dep_tristate '    CLASSIFY target support (EXPERIMENTAL)' CONFIG_IP_NF_TARGET_CLASSIFY $CONFIG_IP_NF_FILTER

patch-o-matic/extra/CLASSIFY.patch.help +18 -0

diff -urN a/patch-o-matic/extra/CLASSIFY.patch.help b/patch-o-matic/extra/CLASSIFY.patch.help
@@ -0,0 +1,18 @@
+Author: Patrick McHardy <[email protected]>
+Status: working
+
+This patch adds support for the CLASSIFY target which sets skb->priority.
+Some qdiscs can use this value for classification, among these are
+
+- atm
+- cbq
+- dsmark
+- pfifo_fast
+- htb
+- prio
+
+This target is only valid in the POST_ROUTING chain of the mangle table.
+
+Usage:
+	iptables -t mangle -A POSTROUTING .. -j CLASSIFY --set-class MAJOR:MINOR
+

patch-o-matic/extra/CLASSIFY.patch.makefile +2 -0

diff -urN a/patch-o-matic/extra/CLASSIFY.patch.makefile b/patch-o-matic/extra/CLASSIFY.patch.makefile
@@ -0,0 +1,2 @@
+obj-$(CONFIG_IP_NF_TARGET_MIRROR) += ipt_MIRROR.o
+obj-$(CONFIG_IP_NF_TARGET_CLASSIFY) += ipt_CLASSIFY.o

userspace/extensions/.CLASSIFY-test +3 -0

diff -urN a/userspace/extensions/.CLASSIFY-test b/userspace/extensions/.CLASSIFY-test
@@ -0,0 +1,3 @@
+#! /bin/sh
+[ -f $KERNEL_DIR/net/ipv4/netfilter/ipt_CLASSIFY.c ] && echo CLASSIFY
+

userspace/extensions/libipt_CLASSIFY.c +130 -0

130 lines not on this page · raw message

Jozsef Kadlecsik

2003-04-11 10:01 UTC #8 lore raw

Quoted 3 lines · Patrick McHardy

Once again a new patch, it seems it wasn't very clever to name the options --source and --dest, iptables ate the --source option before it was passed to the match. they are now renamed to --stype and --dtype.

You attached the CLASSIFY target patch instead of the corrected addrtype patch :-)

Before sending the real patch, please add an addrtype.configure.help. That was missing from the previous versions.

Best regards,
Jozsef
-
E-mail : [email protected], [email protected] PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics

          H-1525 Budapest 114, POB. 49, Hungary

Patrick McHardy

author

2003-04-11 14:27 UTC #9 lore raw

Hi Jozsef,
thanks for applying all the other patches. Here is the addrtype match again, with configure.help.

Thanks,
Patrick

Quoted 8 lines · Jozsef Kadlecsik

Before sending the real patch, please add an addrtype.configure.help. That was missing from the previous versions.
Best regards,
Jozsef

patch-o-matic/extra/addrtype.patch +84 -0

diff -urN a/patch-o-matic/extra/addrtype.patch b/patch-o-matic/extra/addrtype.patch
@@ -0,0 +1,84 @@
+diff -urN a/include/linux/netfilter_ipv4/ipt_addrtype.h b/include/linux/netfilter_ipv4/ipt_addrtype.h
+--- a/include/linux/netfilter_ipv4/ipt_addrtype.h	1970-01-01 01:00:00.000000000 +0100
++++ b/include/linux/netfilter_ipv4/ipt_addrtype.h	2003-04-09 13:42:03.000000000 +0200
+@@ -0,0 +1,11 @@
++#ifndef _IPT_ADDRTYPE_H
++#define _IPT_ADDRTYPE_H
++
++struct ipt_addrtype_info {
++	u_int16_t	source;		/* source-type mask */
++	u_int16_t	dest;		/* dest-type mask */
++	int		invert_source;
++	int		invert_dest;
++};
++
++#endif
+diff -urN a/net/ipv4/netfilter/ipt_addrtype.c b/net/ipv4/netfilter/ipt_addrtype.c
+--- a/net/ipv4/netfilter/ipt_addrtype.c	1970-01-01 01:00:00.000000000 +0100
++++ b/net/ipv4/netfilter/ipt_addrtype.c	2003-04-09 13:43:50.000000000 +0200
+@@ -0,0 +1,65 @@
++/*
++ *  iptables module to match inet_addr_type() of an ip.
++ */
++
++#include <linux/module.h>
++#include <linux/skbuff.h>
++#include <linux/netdevice.h>
++#include <net/route.h>
++
++#include <linux/netfilter_ipv4/ipt_addrtype.h>
++#include <linux/netfilter_ipv4/ip_tables.h>
++
++MODULE_LICENSE("GPL");
++
++static inline int match_type(u_int32_t addr, u_int16_t mask)
++{
++	return !!(mask & (1 << inet_addr_type(addr)));
++}
++
++static int match(const struct sk_buff *skb, const struct net_device *in,
++		 const struct net_device *out, const void *matchinfo,
++		 int offset, const void *hdr, u_int16_t datalen,
++		 int *hotdrop)
++{
++	const struct ipt_addrtype_info *info = matchinfo;
++	const struct iphdr *iph = skb->nh.iph;
++	int ret = 1;
++
++	if (info->source)
++		ret &= match_type(iph->saddr, info->source)^info->invert_source;
++	if (info->dest)
++		ret &= match_type(iph->daddr, info->dest)^info->invert_dest;
++	
++	return ret;
++}
++
++static int checkentry(const char *tablename, const struct ipt_ip *ip,
++		      void *matchinfo, unsigned int matchsize,
++		      unsigned int hook_mask)
++{
++	if (matchsize != IPT_ALIGN(sizeof(struct ipt_addrtype_info))) {
++		printk(KERN_ERR "ipt_addrtype: invalid size (%u != %u)\n.",
++		       matchsize, IPT_ALIGN(sizeof(struct ipt_addrtype_info)));
++		return 0;
++	}
++
++	return 1;
++}
++
++static struct ipt_match addrtype_match = { { NULL, NULL }, "addrtype", &match,
++		&checkentry, NULL, THIS_MODULE };
++
++static int __init init(void)
++{
++	return ipt_register_match(&addrtype_match);
++}
++
++static void __exit fini(void)
++{
++	ipt_unregister_match(&addrtype_match);
++
++}
++
++module_init(init);
++module_exit(fini);

patch-o-matic/extra/addrtype.patch.config.in +2 -0

diff -urN a/patch-o-matic/extra/addrtype.patch.config.in b/patch-o-matic/extra/addrtype.patch.config.in
@@ -0,0 +1,2 @@
+  dep_tristate '  TTL match support' CONFIG_IP_NF_MATCH_TTL $CONFIG_IP_NF_IPTABLES
+  dep_tristate '  address type match support' CONFIG_IP_NF_MATCH_ADDRTYPE $CONFIG_IP_NF_IPTABLES

patch-o-matic/extra/addrtype.patch.configure.help +8 -0

diff -urN a/patch-o-matic/extra/addrtype.patch.configure.help b/patch-o-matic/extra/addrtype.patch.configure.help
@@ -0,0 +1,8 @@
+CONFIG_IP_NF_MATCH_LIMIT
+addrtype match support
+CONFIG_IP_NF_MATCH_ADDRTYPE
+  This option allows you to match what routing thinks of an address,
+  eg. UNICAST, LOCAL, BROADCAST, ...
+
+  If you want to compile it as a module, say M here and read
+  Documentation/modules.txt.  If unsure, say `N'.

patch-o-matic/extra/addrtype.patch.help +28 -0

diff -urN a/patch-o-matic/extra/addrtype.patch.help b/patch-o-matic/extra/addrtype.patch.help
@@ -0,0 +1,28 @@
+Author: Patrick McHardy <[email protected]>
+Status: Working
+
+This match allows you to match address types as seen by the routing code.
+Valid types (from include/linux/rtnetlink.h) are:
+
+UNSPEC
+UNICAST
+LOCAL
+BROADCAST
+ANYCAST
+MULTICAST
+BLACKHOLE
+UNREACHABLE
+PROHIBIT
+THROW
+NAT
+XRESOLVE
+
+Usage:
+	-m addrtype --stype type[,type..] --dtype type[,type..]
+
+Example:
+
+	iptables ... -m addrtype --stype LOCAL ...
+	iptables ... -m addrtype --dtype ANYCAST ...
+
+

patch-o-matic/extra/addrtype.patch.makefile +2 -0

diff -urN a/patch-o-matic/extra/addrtype.patch.makefile b/patch-o-matic/extra/addrtype.patch.makefile
@@ -0,0 +1,2 @@
+obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
+obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o

userspace/extensions/.addrtype-test +5 -0

diff -urN a/userspace/extensions/.addrtype-test b/userspace/extensions/.addrtype-test
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+if test -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_addrtype.h; then
+	echo "addrtype"
+fi

userspace/extensions/libipt_addrtype.c +214 -0

214 lines not on this page · raw message