hak5
/
openwrt
mirror of https://github.com/hak5/openwrt.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

update layer7 netfilter patch for kernel 2.4 

SVN-Revision: 1781
lede-17.01
Waldemar Brodkorb 2005-08-28 23:19:23 +00:00
parent 4a998fa50b
commit 92c81ec0fd
1 changed files with 321 additions and 293 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

608
openwrt/target/linux/linux-2.4/patches/generic/102-netfilter_layer7.patch
View File

@ -1,7 +1,7 @@
diff -Nurp linux-2.4.26-stock/Documentation/Configure.help linux-2.4.26-layer7-clean/Documentation/Configure.help diff -Nurp linux-2.4.30/Documentation/Configure.help linux-2.4.30-layer7/Documentation/Configure.help
--- linux-2.4.26-stock/Documentation/Configure.help 2004-04-14 08:05:24.000000000 -0500 --- linux-2.4.30/Documentation/Configure.help 2005-04-03 20:42:19.000000000 -0500
+++ linux-2.4.26-layer7-clean/Documentation/Configure.help 2004-06-21 00:18:14.000000000 -0500 +++ linux-2.4.30-layer7/Documentation/Configure.help 2005-05-03 18:37:03.000000000 -0500
@@ -28819,6 +28819,23 @@ CONFIG_SOUND_WM97XX @@ -29056,6 +29056,23 @@ CONFIG_SOUND_WM97XX
If unsure, say N. If unsure, say N.
@ -25,9 +25,9 @@ diff -Nurp linux-2.4.26-stock/Documentation/Configure.help linux-2.4.26-layer7-c
# #
# A couple of things I keep forgetting: # A couple of things I keep forgetting:
# capitalize: AppleTalk, Ethernet, DOS, DMA, FAT, FTP, Internet, # capitalize: AppleTalk, Ethernet, DOS, DMA, FAT, FTP, Internet,
diff -Nurp linux-2.4.26-stock/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.4.26-layer7-clean/include/linux/netfilter_ipv4/ip_conntrack.h diff -Nurp linux-2.4.30/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.4.30-layer7/include/linux/netfilter_ipv4/ip_conntrack.h
--- linux-2.4.26-stock/include/linux/netfilter_ipv4/ip_conntrack.h 2004-04-14 08:05:40.000000000 -0500 --- linux-2.4.30/include/linux/netfilter_ipv4/ip_conntrack.h 2005-04-03 20:42:20.000000000 -0500
+++ linux-2.4.26-layer7-clean/include/linux/netfilter_ipv4/ip_conntrack.h 2004-06-21 00:18:28.000000000 -0500 +++ linux-2.4.30-layer7/include/linux/netfilter_ipv4/ip_conntrack.h 2005-05-03 18:37:03.000000000 -0500
@@ -207,6 +207,17 @@ struct ip_conntrack @@ -207,6 +207,17 @@ struct ip_conntrack
} nat; } nat;
#endif /* CONFIG_IP_NF_NAT_NEEDED */ #endif /* CONFIG_IP_NF_NAT_NEEDED */
@ -46,9 +46,9 @@ diff -Nurp linux-2.4.26-stock/include/linux/netfilter_ipv4/ip_conntrack.h linux-
}; };
/* get master conntrack via master expectation */ /* get master conntrack via master expectation */
diff -Nurp linux-2.4.26-stock/include/linux/netfilter_ipv4/ipt_layer7.h linux-2.4.26-layer7-clean/include/linux/netfilter_ipv4/ipt_layer7.h diff -Nurp linux-2.4.30/include/linux/netfilter_ipv4/ipt_layer7.h linux-2.4.30-layer7/include/linux/netfilter_ipv4/ipt_layer7.h
--- linux-2.4.26-stock/include/linux/netfilter_ipv4/ipt_layer7.h 1969-12-31 18:00:00.000000000 -0600 --- linux-2.4.30/include/linux/netfilter_ipv4/ipt_layer7.h 1969-12-31 18:00:00.000000000 -0600
+++ linux-2.4.26-layer7-clean/include/linux/netfilter_ipv4/ipt_layer7.h 2004-06-21 00:18:28.000000000 -0500 +++ linux-2.4.30-layer7/include/linux/netfilter_ipv4/ipt_layer7.h 2005-05-03 18:37:03.000000000 -0500
@@ -0,0 +1,26 @@ @@ -0,0 +1,26 @@
+/* +/*
+ By Matthew Strait <quadong@users.sf.net>, Dec 2003. + By Matthew Strait <quadong@users.sf.net>, Dec 2003.
@ -76,9 +76,9 @@ diff -Nurp linux-2.4.26-stock/include/linux/netfilter_ipv4/ipt_layer7.h linux-2.
+}; +};
+ +
+#endif /* _IPT_LAYER7_H */ +#endif /* _IPT_LAYER7_H */
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/Config.in linux-2.4.26-layer7-clean/net/ipv4/netfilter/Config.in diff -Nurp linux-2.4.30/net/ipv4/netfilter/Config.in linux-2.4.30-layer7/net/ipv4/netfilter/Config.in
--- linux-2.4.26-stock/net/ipv4/netfilter/Config.in 2003-08-25 06:44:44.000000000 -0500 --- linux-2.4.30/net/ipv4/netfilter/Config.in 2005-01-19 08:10:13.000000000 -0600
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/Config.in 2004-06-21 00:15:23.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/Config.in 2005-05-03 18:37:03.000000000 -0500
@@ -43,6 +43,10 @@ if [ "$CONFIG_IP_NF_IPTABLES" != "n" ]; @@ -43,6 +43,10 @@ if [ "$CONFIG_IP_NF_IPTABLES" != "n" ];
if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
dep_tristate ' Unclean match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_UNCLEAN $CONFIG_IP_NF_IPTABLES dep_tristate ' Unclean match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_UNCLEAN $CONFIG_IP_NF_IPTABLES
@ -90,29 +90,27 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/Config.in linux-2.4.26-layer7-c
fi fi
# The targets # The targets
dep_tristate ' Packet filtering' CONFIG_IP_NF_FILTER $CONFIG_IP_NF_IPTABLES dep_tristate ' Packet filtering' CONFIG_IP_NF_FILTER $CONFIG_IP_NF_IPTABLES
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/Makefile linux-2.4.26-layer7-clean/net/ipv4/netfilter/Makefile diff -Nurp linux-2.4.30/net/ipv4/netfilter/Makefile linux-2.4.30-layer7/net/ipv4/netfilter/Makefile
--- linux-2.4.26-stock/net/ipv4/netfilter/Makefile 2003-08-25 06:44:44.000000000 -0500 --- linux-2.4.30/net/ipv4/netfilter/Makefile 2003-08-25 06:44:44.000000000 -0500
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/Makefile 2004-06-21 00:15:22.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/Makefile 2005-05-03 18:44:12.000000000 -0500
@@ -87,6 +87,8 @@ obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += i @@ -86,6 +86,7 @@ obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_s
obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
obj-$(CONFIG_IP_NF_MATCH_UNCLEAN) += ipt_unclean.o obj-$(CONFIG_IP_NF_MATCH_UNCLEAN) += ipt_unclean.o
obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
+obj-$(CONFIG_IP_NF_MATCH_LAYER7) += ipt_layer7.o +obj-$(CONFIG_IP_NF_MATCH_LAYER7) += ipt_layer7.o
+
# targets # targets
obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
obj-$(CONFIG_IP_NF_TARGET_MIRROR) += ipt_MIRROR.o diff -Nurp linux-2.4.30/net/ipv4/netfilter/ip_conntrack_core.c linux-2.4.30-layer7/net/ipv4/netfilter/ip_conntrack_core.c
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_core.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/ip_conntrack_core.c --- linux-2.4.30/net/ipv4/netfilter/ip_conntrack_core.c 2005-04-03 20:42:20.000000000 -0500
--- linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_core.c 2004-02-18 07:36:32.000000000 -0600 +++ linux-2.4.30-layer7/net/ipv4/netfilter/ip_conntrack_core.c 2005-05-03 18:37:03.000000000 -0500
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/ip_conntrack_core.c 2004-06-21 00:15:22.000000000 -0500 @@ -346,6 +346,14 @@ destroy_conntrack(struct nf_conntrack *n
@@ -339,6 +339,15 @@ destroy_conntrack(struct nf_conntrack *n
} }
kfree(ct->master); kfree(ct->master);
} }
+ +
+ #if defined(CONFIG_IP_NF_MATCH_LAYER7) || defined(CONFIG_IP_NF_MATCH_LAYER7_MODULE) + #if defined(CONFIG_IP_NF_MATCH_LAYER7) || defined(CONFIG_IP_NF_MATCH_LAYER7_MODULE)
+ /* This ought to get free'd somewhere. How about here? */ + if(ct->layer7.app_proto)
+ if(ct->layer7.app_proto) /* this is sufficient, right? */
+ kfree(ct->layer7.app_proto); + kfree(ct->layer7.app_proto);
+ if(ct->layer7.app_data) + if(ct->layer7.app_data)
+ kfree(ct->layer7.app_data); + kfree(ct->layer7.app_data);
@ -121,9 +119,9 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_core.c linux-2.4.2
WRITE_UNLOCK(&ip_conntrack_lock); WRITE_UNLOCK(&ip_conntrack_lock);
if (master) if (master)
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/ip_conntrack_standalone.c diff -Nurp linux-2.4.30/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.4.30-layer7/net/ipv4/netfilter/ip_conntrack_standalone.c
--- linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-02-18 07:36:32.000000000 -0600 --- linux-2.4.30/net/ipv4/netfilter/ip_conntrack_standalone.c 2005-04-03 20:42:20.000000000 -0500
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-06-21 00:15:22.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/ip_conntrack_standalone.c 2005-05-03 18:37:03.000000000 -0500
@@ -107,6 +107,13 @@ print_conntrack(char *buffer, struct ip_ @@ -107,6 +107,13 @@ print_conntrack(char *buffer, struct ip_
len += sprintf(buffer + len, "[ASSURED] "); len += sprintf(buffer + len, "[ASSURED] ");
len += sprintf(buffer + len, "use=%u ", len += sprintf(buffer + len, "use=%u ",
@ -138,17 +136,17 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ip_conntrack_standalone.c linux
len += sprintf(buffer + len, "\n"); len += sprintf(buffer + len, "\n");
return len; return len;
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/ipt_layer7.c diff -Nurp linux-2.4.30/net/ipv4/netfilter/ipt_layer7.c linux-2.4.30-layer7/net/ipv4/netfilter/ipt_layer7.c
--- linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c 1969-12-31 18:00:00.000000000 -0600 --- linux-2.4.30/net/ipv4/netfilter/ipt_layer7.c 1969-12-31 18:00:00.000000000 -0600
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/ipt_layer7.c 2004-06-27 19:06:51.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/ipt_layer7.c 2005-05-03 18:37:03.000000000 -0500
@@ -0,0 +1,540 @@ @@ -0,0 +1,557 @@
+/* +/*
+ Kernel module to match application layer (OSI layer 7) + Kernel module to match application layer (OSI layer 7)
+ data in connections. + data in connections.
+ +
+ http://l7-filter.sf.net + http://l7-filter.sf.net
+ +
+ By Matthew Strait and Ethan Sommer, 2003. + By Matthew Strait and Ethan Sommer, 2003-2005.
+ +
+ This program is free software; you can redistribute it and/or + This program is free software; you can redistribute it and/or
+ modify it under the terms of the GNU General Public License + modify it under the terms of the GNU General Public License
@ -167,6 +165,7 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+#include <linux/ctype.h> +#include <linux/ctype.h>
+#include <net/ip.h> +#include <net/ip.h>
+#include <net/tcp.h> +#include <net/tcp.h>
+#include <linux/netfilter_ipv4/lockhelp.h>
+ +
+#include "regexp/regexp.c" +#include "regexp/regexp.c"
+ +
@ -178,99 +177,41 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+MODULE_DESCRIPTION("iptables application layer match module"); +MODULE_DESCRIPTION("iptables application layer match module");
+ +
+#if defined(CONFIG_IP_NF_MATCH_LAYER7_DEBUG) +#if defined(CONFIG_IP_NF_MATCH_LAYER7_DEBUG)
+ #define DPRINTK(format,args...) printk(format,##args) + #define DPRINTK(format,args...) printk(format,##args)
+#else +#else
+ #define DPRINTK(format,args...) + #define DPRINTK(format,args...)
+#endif +#endif
+ +
+#define TOTAL_PACKETS master_conntrack->layer7.numpackets
+
+/* Number of packets whose data we look at. +/* Number of packets whose data we look at.
+This can be modified through /proc/net/layer7_numpackets */ +This can be modified through /proc/net/layer7_numpackets */
+static int num_packets = 8; +static int num_packets = 8;
+ +
+static struct pattern_cache { +static struct pattern_cache {
+ char * regex_string; + char * regex_string;
+ regexp * pattern; + regexp * pattern;
+ struct pattern_cache * next; + struct pattern_cache * next;
+} * first_pattern_cache = NULL; +} * first_pattern_cache = NULL;
+ +
+/* I'm new to locking. Here are my assumptions: +/* I'm new to locking. Here are my assumptions:
+ +
+- No one is going to write to /proc/net/layer7_numpackets over and over +- No one will write to /proc/net/layer7_numpackets over and over very fast;
+ within a short period of time, and if they did, nothing awful would happen. + if they did, nothing awful would happen.
+ +
+- This code will never be processing the same packet twice at the same time, +- This code will never be processing the same packet twice at the same time,
+ because iptables rules need to be traversed in order. + because iptables rules are traversed in order.
+ +
+- It doesn't matter if two packets from different connections are in here at +- It doesn't matter if two packets from different connections are in here at
+ the same time, because they don't share any data. + the same time, because they don't share any data.
+ +
+- It _does_ matter if two packets from the same connection are here at the same +- It _does_ matter if two packets from the same connection are here at the same
+ time. In this case, the things we have to protect are the conntracks and + time. In this case, we have to protect the conntracks and the list of
+ the list of compiled patterns. + compiled patterns.
+*/ +*/
+DECLARE_RWLOCK(ct_lock); +DECLARE_RWLOCK(ct_lock);
+DECLARE_LOCK(list_lock); +DECLARE_LOCK(list_lock);
+ +
+/* Use instead of regcomp. As we expect to be seeing the same regexps over and
+over again, it make sense to cache the results. */
+static regexp * compile_and_cache(char * regex_string, char * protocol)
+{
+ struct pattern_cache * node = first_pattern_cache;
+ struct pattern_cache * last_pattern_cache = first_pattern_cache;
+ struct pattern_cache * tmp;
+ unsigned int len;
+
+ while (node != NULL) {
+ if (!strcmp(node->regex_string, regex_string))
+ return node->pattern;
+
+ last_pattern_cache = node;/* points at the last non-NULL node */
+ node = node->next;
+ }
+
+ /* If we reach the end of the list, then we have not yet cached
+ the pattern for this regex. Let's do that now.
+ Be paranoid about running out of memory to avoid list corruption. */
+ tmp = kmalloc(sizeof(struct pattern_cache), GFP_ATOMIC);
+
+ if(!tmp) {
+ printk(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n");
+ return NULL;
+ }
+
+ tmp->regex_string = kmalloc(strlen(regex_string) + 1, GFP_ATOMIC);
+ tmp->pattern = kmalloc(sizeof(struct regexp), GFP_ATOMIC);
+
+ if(!tmp->regex_string || !tmp->pattern) {
+ printk(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n");
+ kfree(tmp->regex_string);
+ kfree(tmp->pattern);
+ kfree(tmp);
+ return NULL;
+ }
+
+ tmp->next = NULL;
+ /* Ok. The new node is all ready now. */
+ node = tmp;
+
+ if(first_pattern_cache == NULL) /* list is empty */
+ first_pattern_cache = node; /* make node the beginning */
+ else
+ last_pattern_cache->next = node; /* attach node to the end */
+
+ /* copy the string and compile the regex */
+ len = strlen(regex_string);
+ node->pattern = regcomp(regex_string, &len);
+ if ( !node->pattern ) {
+ printk(KERN_ERR "layer7: Error compiling regexp \"%s\" (%s)\n",
+ regex_string, protocol);
+ /* pattern is now cached as NULL, so we won't try again. */
+ }
+
+ strcpy(node->regex_string, regex_string);
+ return node->pattern;
+}
+
+#if CONFIG_IP_NF_MATCH_LAYER7_DEBUG +#if CONFIG_IP_NF_MATCH_LAYER7_DEBUG
+/* Converts an unfriendly string into a friendly one by +/* Converts an unfriendly string into a friendly one by
+replacing unprintables with periods and all whitespace with " ". */ +replacing unprintables with periods and all whitespace with " ". */
@ -280,9 +221,10 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+ int i; + int i;
+ +
+ if(!f) { + if(!f) {
+ printk(KERN_ERR "layer7: out of memory in friendly_print, bailing.\n"); + if (net_ratelimit())
+ return NULL; + printk(KERN_ERR "layer7: out of memory in friendly_print, bailing.\n");
+ } + return NULL;
+ }
+ +
+ for(i = 0; i < strlen(s); i++){ + for(i = 0; i < strlen(s); i++){
+ if(isprint(s[i]) && s[i] < 128) f[i] = s[i]; + if(isprint(s[i]) && s[i] < 128) f[i] = s[i];
@ -303,7 +245,8 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+ return (char)(i - 10 + 'a'); + return (char)(i - 10 + 'a');
+ break; + break;
+ default: + default:
+ printk("Problem in dec2hex\n"); + if (net_ratelimit())
+ printk("Problem in dec2hex\n");
+ return '\0'; + return '\0';
+ } + }
+} +}
@ -314,9 +257,10 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+ int i; + int i;
+ +
+ if(!g) { + if(!g) {
+ printk(KERN_ERR "layer7: out of memory in hex_print, bailing.\n"); + if (net_ratelimit())
+ return NULL; + printk(KERN_ERR "layer7: out of memory in hex_print, bailing.\n");
+ } + return NULL;
+ }
+ +
+ for(i = 0; i < strlen(s); i++) { + for(i = 0; i < strlen(s); i++) {
+ g[i*3 ] = dec2hex(s[i]/16); + g[i*3 ] = dec2hex(s[i]/16);
@ -329,17 +273,68 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+} +}
+#endif // DEBUG +#endif // DEBUG
+ +
+/* Use instead of regcomp. As we expect to be seeing the same regexps over and
+over again, it make sense to cache the results. */
+static regexp * compile_and_cache(char * regex_string, char * protocol)
+{
+ struct pattern_cache * node = first_pattern_cache;
+ struct pattern_cache * last_pattern_cache = first_pattern_cache;
+ struct pattern_cache * tmp;
+ unsigned int len;
+ +
+/* The following functions are here in case we get ported into an environment + while (node != NULL) {
+(ebtables?) where skb->nh.iph->protocol isn't set. They assume that skb->data + if (!strcmp(node->regex_string, regex_string))
+points at the beginning of the IP datagram, which is true for iptables (but in + return node->pattern;
+QoS it points to the beginning of the Ethernet frame). */ +
+#if 0 + last_pattern_cache = node;/* points at the last non-NULL node */
+#define IP_PROTO_OFFSET 9 + node = node->next;
+static int is_tcp_over_ipv4 (const struct sk_buff *skb){return(skb->data[IP_PROTO_OFFSET]==IPPROTO_TCP );} + }
+static int is_udp_over_ipv4 (const struct sk_buff *skb){return(skb->data[IP_PROTO_OFFSET]==IPPROTO_UDP );} +
+static int is_icmp_over_ipv4(const struct sk_buff *skb){return(skb->data[IP_PROTO_OFFSET]==IPPROTO_ICMP);} + /* If we reach the end of the list, then we have not yet cached
+#endif + the pattern for this regex. Let's do that now.
+ Be paranoid about running out of memory to avoid list corruption. */
+ tmp = kmalloc(sizeof(struct pattern_cache), GFP_ATOMIC);
+
+ if(!tmp) {
+ if (net_ratelimit())
+ printk(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n");
+ return NULL;
+ }
+
+ tmp->regex_string = kmalloc(strlen(regex_string) + 1, GFP_ATOMIC);
+ tmp->pattern = kmalloc(sizeof(struct regexp), GFP_ATOMIC);
+ tmp->next = NULL;
+
+ if(!tmp->regex_string || !tmp->pattern) {
+ if (net_ratelimit())
+ printk(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n");
+ kfree(tmp->regex_string);
+ kfree(tmp->pattern);
+ kfree(tmp);
+ return NULL;
+ }
+
+ /* Ok. The new node is all ready now. */
+ node = tmp;
+
+ if(first_pattern_cache == NULL) /* list is empty */
+ first_pattern_cache = node; /* make node the beginning */
+ else
+ last_pattern_cache->next = node; /* attach node to the end */
+
+ /* copy the string and compile the regex */
+ len = strlen(regex_string);
+ DPRINTK("About to compile this: \"%s\"\n", regex_string);
+ node->pattern = regcomp(regex_string, &len);
+ if ( !node->pattern ) {
+ if (net_ratelimit())
+ printk(KERN_ERR "layer7: Error compiling regexp \"%s\" (%s)\n", regex_string, protocol);
+ /* pattern is now cached as NULL, so we won't try again. */
+ }
+
+ strcpy(node->regex_string, regex_string);
+ return node->pattern;
+}
+ +
+static int can_handle(const struct sk_buff *skb) +static int can_handle(const struct sk_buff *skb)
+{ +{
@ -357,73 +352,86 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+{ +{
+ /* In case we are ported somewhere (ebtables?) where skb->nh.iph + /* In case we are ported somewhere (ebtables?) where skb->nh.iph
+ isn't set, this can be gotten from 4*(skb->data[0] & 0x0f) as well. */ + isn't set, this can be gotten from 4*(skb->data[0] & 0x0f) as well. */
+ int ip_hl = 4*skb->nh.iph->ihl; + int ip_hl = 4*skb->nh.iph->ihl;
+ +
+ if( skb->nh.iph->protocol == IPPROTO_TCP ) { + if( skb->nh.iph->protocol == IPPROTO_TCP ) {
+ /* 12 == offset into TCP header for the header length field. + /* 12 == offset into TCP header for the header length field.
+ Can't get this with skb->h.th->doff because the tcphdr + Can't get this with skb->h.th->doff because the tcphdr
+ struct doesn't get set when routing (this is confirmed to be + struct doesn't get set when routing (this is confirmed to be
+ true in Netfilter as well as QoS.) */ + true in Netfilter as well as QoS.) */
+ int tcp_hl = 4*(skb->data[ip_hl + 12] >> 4); + int tcp_hl = 4*(skb->data[ip_hl + 12] >> 4);
+ +
+ return ip_hl + tcp_hl; + return ip_hl + tcp_hl;
+ } else if( skb->nh.iph->protocol == IPPROTO_UDP ) { + } else if( skb->nh.iph->protocol == IPPROTO_UDP ) {
+ return ip_hl + 8; /* UDP header is always 8 bytes */ + return ip_hl + 8; /* UDP header is always 8 bytes */
+ } else if( skb->nh.iph->protocol == IPPROTO_ICMP ) { + } else if( skb->nh.iph->protocol == IPPROTO_ICMP ) {
+ return ip_hl + 8; /* ICMP header is 8 bytes */ + return ip_hl + 8; /* ICMP header is 8 bytes */
+ } else { + } else {
+ printk(KERN_ERR "layer7: tried to handle unknown protocol!\n"); + if (net_ratelimit())
+ return ip_hl + 8; /* something reasonable */ + printk(KERN_ERR "layer7: tried to handle unknown protocol!\n");
+ } + return ip_hl + 8; /* something reasonable */
+ }
+} +}
+ +
+/* handles whether there's a match when we aren't appending data anymore */ +/* handles whether there's a match when we aren't appending data anymore */
+static int match_no_append(struct ip_conntrack * conntrack, +static int match_no_append(struct ip_conntrack * conntrack, struct ip_conntrack * master_conntrack,
+ struct ip_conntrack * master_conntrack, + enum ip_conntrack_info ctinfo, enum ip_conntrack_info master_ctinfo,
+ struct ipt_layer7_info * info) + struct ipt_layer7_info * info)
+{ +{
+ /* If we're in here, we don't care about the app data anymore */ + /* If we're in here, throw the app data away */
+ WRITE_LOCK(&ct_lock); + WRITE_LOCK(&ct_lock);
+ if(master_conntrack->layer7.app_data != NULL) { + if(master_conntrack->layer7.app_data != NULL) {
+ +
+ #ifdef CONFIG_IP_NF_MATCH_LAYER7_DEBUG + #ifdef CONFIG_IP_NF_MATCH_LAYER7_DEBUG
+ if(!master_conntrack->layer7.app_proto) { + if(!master_conntrack->layer7.app_proto) {
+ char * f = friendly_print(master_conntrack->layer7.app_data); + char * f = friendly_print(master_conntrack->layer7.app_data);
+ char * g = hex_print(master_conntrack->layer7.app_data); + char * g = hex_print(master_conntrack->layer7.app_data);
+ DPRINTK("\nGave up on the %d length stream: \n%s\n", + DPRINTK("\nl7-filter gave up after %d bytes (%d packets):\n%s\n",
+ master_conntrack->layer7.app_data_len, f); + strlen(f),
+ DPRINTK("\nIn hex: %s\n", g); + TOTAL_PACKETS, f);
+ kfree(f); + kfree(f);
+ kfree(g); + DPRINTK("In hex: %s\n", g);
+ } + kfree(g);
+ #endif + }
+ #endif
+ +
+ kfree(master_conntrack->layer7.app_data); + kfree(master_conntrack->layer7.app_data);
+ master_conntrack->layer7.app_data = NULL; /* don't free again */ + master_conntrack->layer7.app_data = NULL; /* don't free again */
+ } + }
+ WRITE_UNLOCK(&ct_lock); + WRITE_UNLOCK(&ct_lock);
+ +
+ /* Is top-level master (possibly self) classified? */ + if(master_conntrack->layer7.app_proto){
+ if(master_conntrack->layer7.app_proto) { + /* Here child connections set their .app_proto (for /proc/net/ip_conntrack) */
+ if(!strcmp(master_conntrack->layer7.app_proto, info->protocol)) + WRITE_LOCK(&ct_lock);
+ { + if(!conntrack->layer7.app_proto) {
+ /* set own .protocol (for /proc/net/ip_conntrack) */ + conntrack->layer7.app_proto = kmalloc(strlen(master_conntrack->layer7.app_proto)+1, GFP_ATOMIC);
+ WRITE_LOCK(&ct_lock); + if(!conntrack->layer7.app_proto){
+ if(!conntrack->layer7.app_proto) { + if (net_ratelimit())
+ conntrack->layer7.app_proto = kmalloc(strlen(info->protocol), GFP_ATOMIC); + printk(KERN_ERR "layer7: out of memory in match_no_append, bailing.\n");
+ if(!conntrack->layer7.app_proto){ + WRITE_UNLOCK(&ct_lock);
+ printk(KERN_ERR "layer7: out of memory in match_no_append, bailing.\n"); + return 1;
+ WRITE_UNLOCK(&ct_lock); + }
+ return 1; + strcpy(conntrack->layer7.app_proto, master_conntrack->layer7.app_proto);
+ } + }
+ WRITE_UNLOCK(&ct_lock);
+ +
+ strcpy(conntrack->layer7.app_proto, info->protocol); + return (!strcmp(master_conntrack->layer7.app_proto, info->protocol));
+ } + }
+ else {
+ /* If not classified, set to "unknown" to distinguish from
+ connections that are still being tested. */
+ WRITE_LOCK(&ct_lock);
+ master_conntrack->layer7.app_proto = kmalloc(strlen("unknown")+1, GFP_ATOMIC);
+ if(!master_conntrack->layer7.app_proto){
+ if (net_ratelimit())
+ printk(KERN_ERR "layer7: out of memory in match_no_append, bailing.\n");
+ WRITE_UNLOCK(&ct_lock); + WRITE_UNLOCK(&ct_lock);
+ + return 1;
+ return 1; + }
+ } else return 0; + strcpy(master_conntrack->layer7.app_proto, "unknown");
+ } else return 0; /* no clasification */ + WRITE_UNLOCK(&ct_lock);
+ return 0;
+ }
+} +}
+ +
+/* add the new app data to the conntrack. Return number of bytes added. */ +/* add the new app data to the conntrack. Return number of bytes added. */
@ -433,8 +441,8 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+ int length = 0, i; + int length = 0, i;
+ int oldlength = master_conntrack->layer7.app_data_len; + int oldlength = master_conntrack->layer7.app_data_len;
+ +
+ /* Strip nulls. Make everything lower case (our regex lib doesn't + /* Strip nulls. Make everything lower case (our regex lib doesn't
+ do case insensitivity). Add it to the end of the current data. */ + do case insensitivity). Add it to the end of the current data. */
+ for(i = 0; i < CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN-oldlength-1 && + for(i = 0; i < CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN-oldlength-1 &&
+ i < appdatalen; i++) { + i < appdatalen; i++) {
+ if(app_data[i] != '\0') { + if(app_data[i] != '\0') {
@ -453,89 +461,96 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+ +
+/* Returns true on match and false otherwise. */ +/* Returns true on match and false otherwise. */
+static int match(/* const */struct sk_buff *skb, const struct net_device *in, +static int match(/* const */struct sk_buff *skb, const struct net_device *in,
+ const struct net_device *out, const void *matchinfo, + const struct net_device *out, const void *matchinfo,
+ int offset, int *hotdrop) + int offset, int *hotdrop)
+{ +{
+ struct ipt_layer7_info * info = (struct ipt_layer7_info *)matchinfo; + struct ipt_layer7_info * info = (struct ipt_layer7_info *)matchinfo;
+ enum ip_conntrack_info master_ctinfo, ctinfo; + enum ip_conntrack_info master_ctinfo, ctinfo;
+ struct ip_conntrack *master_conntrack, *conntrack; + struct ip_conntrack *master_conntrack, *conntrack;
+ unsigned char * app_data; + unsigned char * app_data;
+ unsigned int pattern_result, appdatalen; + unsigned int pattern_result, appdatalen;
+ regexp * comppattern; + regexp * comppattern;
+ +
+ if(!can_handle(skb)){ + if(!can_handle(skb)){
+ DPRINTK("layer7: This is some protocol I can't handle\n"); + DPRINTK("layer7: This is some protocol I can't handle.\n");
+ return info->invert; + return info->invert;
+ } + }
+ +
+ LOCK_BH(&list_lock);
+ comppattern = compile_and_cache(info->pattern, info->protocol);
+ UNLOCK_BH(&list_lock);
+ /* the return value gets checked later, when we're ready to use it */
+
+ app_data = skb->data + app_data_offset(skb);
+ appdatalen = skb->tail - app_data;
+
+ /* Treat the parent and all its children together as one connection, + /* Treat the parent and all its children together as one connection,
+ except for the purpose of setting conntrack->layer7.pattern in the + except for the purpose of setting conntrack->layer7.app_proto in the
+ actual connection. This makes /proc/net/ip_conntrack somewhat more + actual connection. This makes /proc/net/ip_conntrack somewhat more
+ satisfying. */ + satisfying. */
+ if(!(conntrack = ip_conntrack_get((struct sk_buff *)skb, &ctinfo)) || + if(!(conntrack = ip_conntrack_get((struct sk_buff *)skb, &ctinfo)) ||
+ !(master_conntrack = ip_conntrack_get((struct sk_buff *)skb, &master_ctinfo))) { + !(master_conntrack = ip_conntrack_get((struct sk_buff *)skb, &master_ctinfo))) {
+ DPRINTK("layer7: packet is not from a known connection, giving up.\n"); + DPRINTK("layer7: packet is not from a known connection, giving up.\n");
+ return info->invert; + return info->invert;
+ } + }
+ +
+ /* Try to get a master conntrack (and its master etc) for FTP, etc. */ + /* Try to get a master conntrack (and its master etc) for FTP, etc. */
+ while (master_ct(master_conntrack) != NULL) + while (master_ct(master_conntrack) != NULL)
+ master_conntrack = master_ct(master_conntrack); + master_conntrack = master_ct(master_conntrack);
+ +
+ /* skb->cb[0] == seen. Avoid doing things twice if there are two layer7
+ rules. I'm not sure that using cb for this purpose is correct, although
+ it says "put your private variables there" and this seems to qualify.
+ But it doesn't look like it's being used for anything else in the
+ sk_buffs that make it here. I'm open to suggestions for how to be able
+ to write to cb without making the compiler angry. That I can't figure
+ this out is an argument against this being correct. */
+ if(!skb->cb[0]){ + if(!skb->cb[0]){
+ WRITE_LOCK(&ct_lock); + WRITE_LOCK(&ct_lock);
+ master_conntrack->layer7.numpackets++;/*starts at 0 via memset*/ + master_conntrack->layer7.numpackets++;/*starts at 0 via memset*/
+ WRITE_UNLOCK(&ct_lock); + WRITE_UNLOCK(&ct_lock);
+ } + }
+ +
+ /* if we've classified it or seen too many packets */
+ if(TOTAL_PACKETS > num_packets ||
+ master_conntrack->layer7.app_proto) {
+
+ pattern_result = match_no_append(conntrack, master_conntrack, ctinfo, master_ctinfo, info);
+
+ /* skb->cb[0] == seen. Avoid doing things twice if there are two l7
+ rules. I'm not sure that using cb for this purpose is correct, although
+ it says "put your private variables there". But it doesn't look like it
+ is being used for anything else in the skbs that make it here. How can
+ I write to cb without making the compiler angry? */
+ skb->cb[0] = 1; /* marking it seen here is probably irrelevant, but consistant */
+
+ return (pattern_result ^ info->invert);
+ }
+
+ if(skb_is_nonlinear(skb)){
+ if(skb_linearize(skb, GFP_ATOMIC) != 0){
+ if (net_ratelimit())
+ printk(KERN_ERR "layer7: failed to linearize packet, bailing.\n");
+ return info->invert;
+ }
+ }
+
+ /* now that the skb is linearized, it's safe to set these. */
+ app_data = skb->data + app_data_offset(skb);
+ appdatalen = skb->tail - app_data;
+
+ LOCK_BH(&list_lock);
+ /* the return value gets checked later, when we're ready to use it */
+ comppattern = compile_and_cache(info->pattern, info->protocol);
+ UNLOCK_BH(&list_lock);
+
+ /* On the first packet of a connection, allocate space for app data */ + /* On the first packet of a connection, allocate space for app data */
+ WRITE_LOCK(&ct_lock); + WRITE_LOCK(&ct_lock);
+ if(master_conntrack->layer7.numpackets == 1 && !skb->cb[0]) { + if(TOTAL_PACKETS == 1 && !skb->cb[0] && !master_conntrack->layer7.app_data) {
+ master_conntrack->layer7.app_data = kmalloc(CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN, GFP_ATOMIC); + master_conntrack->layer7.app_data = kmalloc(CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN, GFP_ATOMIC);
+ if(!master_conntrack->layer7.app_data){ + if(!master_conntrack->layer7.app_data){
+ printk(KERN_ERR "layer7: out of memory in match, bailing.\n"); + if (net_ratelimit())
+ WRITE_UNLOCK(&ct_lock); + printk(KERN_ERR "layer7: out of memory in match, bailing.\n");
+ return info->invert; + WRITE_UNLOCK(&ct_lock);
+ } + return info->invert;
+ }
+ +
+ master_conntrack->layer7.app_data[0] = '\0'; + master_conntrack->layer7.app_data[0] = '\0';
+ } + }
+ WRITE_UNLOCK(&ct_lock); + WRITE_UNLOCK(&ct_lock);
+ +
+ /* if we've classified it or seen too many packets */ + /* Can be here, but unallocated, if numpackets is increased near
+ if(master_conntrack->layer7.numpackets > num_packets ||
+ master_conntrack->layer7.app_proto) {
+
+ pattern_result = match_no_append(conntrack, master_conntrack, info);
+
+ /* mark the packet seen (probably irrelevant, but consistant) */
+ skb->cb[0] = 1;
+
+ return (pattern_result ^ info->invert);
+ }
+
+ /* Can end up here, but unallocated, if numpackets is increased during
+ the beginning of a connection */ + the beginning of a connection */
+ if(master_conntrack->layer7.app_data == NULL) + if(master_conntrack->layer7.app_data == NULL)
+ return (info->invert); /* unmatched */ + return (info->invert); /* unmatched */
+ +
+ if(!skb->cb[0]) { + if(!skb->cb[0]){
+ int newbytes; + int newbytes;
+ WRITE_LOCK(&ct_lock); + WRITE_LOCK(&ct_lock);
+ newbytes = add_data(master_conntrack, app_data, appdatalen); + newbytes = add_data(master_conntrack, app_data, appdatalen);
+ WRITE_UNLOCK(&ct_lock); + WRITE_UNLOCK(&ct_lock);
@ -547,37 +562,41 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+ } + }
+ } + }
+ +
+ /* If looking for "unknown", then never match. "Unknown" means that
+ we've given up; we're still trying with these packets. */
+ if(!strcmp(info->protocol, "unknown")) {
+ pattern_result = 0;
+ /* If the regexp failed to compile, don't bother running it */ + /* If the regexp failed to compile, don't bother running it */
+ if(comppattern && regexec(comppattern, master_conntrack->layer7.app_data)) { + } else if(comppattern && regexec(comppattern, master_conntrack->layer7.app_data)) {
+ DPRINTK("layer7: regexec positive: %s!\n", info->protocol); + DPRINTK("layer7: regexec positive: %s!\n", info->protocol);
+ pattern_result = 1; + pattern_result = 1;
+ } else pattern_result = 0; + } else pattern_result = 0;
+ +
+ if(pattern_result) { + if(pattern_result) {
+ WRITE_LOCK(&ct_lock); + WRITE_LOCK(&ct_lock);
+ conntrack->layer7.app_proto = kmalloc(strlen(info->protocol), GFP_ATOMIC); + master_conntrack->layer7.app_proto = kmalloc(strlen(info->protocol)+1, GFP_ATOMIC);
+ if(!conntrack->layer7.app_proto){ + if(!master_conntrack->layer7.app_proto){
+ printk(KERN_ERR "layer7: out of memory in match, bailing.\n"); + if (net_ratelimit())
+ WRITE_UNLOCK(&ct_lock); + printk(KERN_ERR "layer7: out of memory in match, bailing.\n");
+ return (pattern_result ^ info->invert); + WRITE_UNLOCK(&ct_lock);
+ } + return (pattern_result ^ info->invert);
+ + }
+ strcpy(conntrack->layer7.app_proto, info->protocol); + strcpy(master_conntrack->layer7.app_proto, info->protocol);
+ WRITE_UNLOCK(&ct_lock); + WRITE_UNLOCK(&ct_lock);
+ } + }
+ +
+ /* mark the packet seen */ + /* mark the packet seen */
+ skb->cb[0] = 1; + skb->cb[0] = 1;
+ +
+ return (pattern_result ^ info->invert); + return (pattern_result ^ info->invert);
+} +}
+ +
+static int checkentry(const char *tablename, const struct ipt_ip *ip, +static int checkentry(const char *tablename, const struct ipt_ip *ip,
+ void *matchinfo, unsigned int matchsize, unsigned int hook_mask) + void *matchinfo, unsigned int matchsize, unsigned int hook_mask)
+{ +{
+ if (matchsize != IPT_ALIGN(sizeof(struct ipt_layer7_info))) + if (matchsize != IPT_ALIGN(sizeof(struct ipt_layer7_info)))
+ return 0; + return 0;
+ return 1; + return 1;
+} +}
+ +
+static struct ipt_match layer7_match = { +static struct ipt_match layer7_match = {
@ -590,87 +609,83 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+/* taken from drivers/video/modedb.c */ +/* taken from drivers/video/modedb.c */
+static int my_atoi(const char *s) +static int my_atoi(const char *s)
+{ +{
+ int val = 0; + int val = 0;
+ +
+ for (;; s++) { + for (;; s++) {
+ switch (*s) { + switch (*s) {
+ case '0'...'9': + case '0'...'9':
+ val = 10*val+(*s-'0'); + val = 10*val+(*s-'0');
+ break; + break;
+ default: + default:
+ return val; + return val;
+ } + }
+ } + }
+} +}
+ +
+/* write out num_packets to userland. */ +/* write out num_packets to userland. */
+static int layer7_read_proc(char* page, char ** start, off_t off, int count, +static int layer7_read_proc(char* page, char ** start, off_t off, int count,
+ int* eof, void * data) + int* eof, void * data)
+{ +{
+ if(num_packets > 99) + if(num_packets > 99 && net_ratelimit())
+ printk(KERN_ERR "layer7: NOT REACHED. num_packets too big\n"); + printk(KERN_ERR "layer7: NOT REACHED. num_packets too big\n");
+ +
+ page[0] = num_packets/10 + '0'; + page[0] = num_packets/10 + '0';
+ page[1] = num_packets%10 + '0'; + page[1] = num_packets%10 + '0';
+ page[2] = '\n'; + page[2] = '\n';
+ page[3] = '\0'; + page[3] = '\0';
+ +
+ *eof=1; + *eof=1;
+ +
+ return 3; + return 3;
+} +}
+ +
+/* Read in num_packets from userland */ +/* Read in num_packets from userland */
+static int layer7_write_proc(struct file* file, const char* buffer, +static int layer7_write_proc(struct file* file, const char* buffer,
+ unsigned long count, void *data) + unsigned long count, void *data)
+{ +{
+ char * foo = kmalloc(count, GFP_ATOMIC); + char * foo = kmalloc(count, GFP_ATOMIC);
+ +
+ if(!foo){ + if(!foo){
+ printk(KERN_ERR "layer7: out of memory, bailing. num_packets unchanged.\n"); + if (net_ratelimit())
+ return count; + printk(KERN_ERR "layer7: out of memory, bailing. num_packets unchanged.\n");
+ } + return count;
+ }
+ +
+ /* copy in the data from userland */ + copy_from_user(foo, buffer, count);
+ copy_from_user(foo, buffer, count);
+ +
+ num_packets = my_atoi(foo); + num_packets = my_atoi(foo);
+ kfree (foo); + kfree (foo);
+ +
+ /* This has an arbitrary limit to make the math easier. I'm lazy. + /* This has an arbitrary limit to make the math easier. I'm lazy.
+ But anyway, 99 is a LOT! If you want more, you're doing it wrong! */ + But anyway, 99 is a LOT! If you want more, you're doing it wrong! */
+ if(num_packets > 99) { + if(num_packets > 99) {
+ printk(KERN_WARNING "layer7: num_packets can't be > 99.\n"); + printk(KERN_WARNING "layer7: num_packets can't be > 99.\n");
+ num_packets = 99; + num_packets = 99;
+ } else if(num_packets < 1) { + } else if(num_packets < 1) {
+ printk(KERN_WARNING "layer7: num_packets can't be < 1.\n"); + printk(KERN_WARNING "layer7: num_packets can't be < 1.\n");
+ num_packets = 1; + num_packets = 1;
+ } + }
+ +
+ return count; + return count;
+} +}
+ +
+/* register the proc file */ +/* register the proc file */
+static void layer7_init_proc(void) +static void layer7_init_proc(void)
+{ +{
+ struct proc_dir_entry* entry; + struct proc_dir_entry* entry;
+ + entry = create_proc_entry("layer7_numpackets", 0644, proc_net);
+ /* create the file */
+ entry = create_proc_entry("layer7_numpackets", 0644, proc_net);
+
+ /* set the callback functions */
+ entry->read_proc = layer7_read_proc; + entry->read_proc = layer7_read_proc;
+ entry->write_proc = layer7_write_proc; + entry->write_proc = layer7_write_proc;
+} +}
+ +
+static void layer7_cleanup_proc(void) +static void layer7_cleanup_proc(void)
+{ +{
+ remove_proc_entry("layer7_numpackets", proc_net); + remove_proc_entry("layer7_numpackets", proc_net);
+} +}
+ +
+static int __init init(void) +static int __init init(void)
+{ +{
+ layer7_init_proc(); + layer7_init_proc();
+ return ipt_register_match(&layer7_match); + return ipt_register_match(&layer7_match);
+} +}
+ +
@ -682,9 +697,9 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/ipt_layer7.c linux-2.4.26-layer
+ +
+module_init(init); +module_init(init);
+module_exit(fini); +module_exit(fini);
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regexp.c diff -Nurp linux-2.4.30/net/ipv4/netfilter/regexp/regexp.c linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regexp.c
--- linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.c 1969-12-31 18:00:00.000000000 -0600 --- linux-2.4.30/net/ipv4/netfilter/regexp/regexp.c 1969-12-31 18:00:00.000000000 -0600
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regexp.c 2004-06-27 19:07:00.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regexp.c 2005-05-03 18:37:03.000000000 -0500
@@ -0,0 +1,1195 @@ @@ -0,0 +1,1195 @@
+/* +/*
+ * regcomp and regexec -- regsub and regerror are elsewhere + * regcomp and regexec -- regsub and regerror are elsewhere
@ -1881,10 +1896,10 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.c linux-2.4.26-la
+#endif +#endif
+ +
+ +
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.h linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regexp.h diff -Nurp linux-2.4.30/net/ipv4/netfilter/regexp/regexp.h linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regexp.h
--- linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.h 1969-12-31 18:00:00.000000000 -0600 --- linux-2.4.30/net/ipv4/netfilter/regexp/regexp.h 1969-12-31 18:00:00.000000000 -0600
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regexp.h 2004-06-27 19:07:00.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regexp.h 2005-05-03 18:37:03.000000000 -0500
@@ -0,0 +1,27 @@ @@ -0,0 +1,40 @@
+/* +/*
+ * Definitions etc. for regexp(3) routines. + * Definitions etc. for regexp(3) routines.
+ * + *
@ -1895,6 +1910,19 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.h linux-2.4.26-la
+#ifndef REGEXP_H +#ifndef REGEXP_H
+#define REGEXP_H +#define REGEXP_H
+ +
+/*
+http://www.opensource.apple.com/darwinsource/10.3/expect-1/expect/expect.h ,
+which contains a version of this library, says:
+
+ *
+ * NSUBEXP must be at least 10, and no greater than 117 or the parser
+ * will not work properly.
+ *
+
+However, it looks rather like this library is limited to 10. If you think
+otherwise, let us know.
+*/
+
+#define NSUBEXP 10 +#define NSUBEXP 10
+typedef struct regexp { +typedef struct regexp {
+ char *startp[NSUBEXP]; + char *startp[NSUBEXP];
@ -1912,18 +1940,18 @@ diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regexp.h linux-2.4.26-la
+void regerror(char *s); +void regerror(char *s);
+ +
+#endif +#endif
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regmagic.h linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regmagic.h diff -Nurp linux-2.4.30/net/ipv4/netfilter/regexp/regmagic.h linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regmagic.h
--- linux-2.4.26-stock/net/ipv4/netfilter/regexp/regmagic.h 1969-12-31 18:00:00.000000000 -0600 --- linux-2.4.30/net/ipv4/netfilter/regexp/regmagic.h 1969-12-31 18:00:00.000000000 -0600
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regmagic.h 2004-06-27 19:07:00.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regmagic.h 2005-05-03 18:37:03.000000000 -0500
@@ -0,0 +1,5 @@ @@ -0,0 +1,5 @@
+/* +/*
+ * The first byte of the regexp internal "program" is actually this magic + * The first byte of the regexp internal "program" is actually this magic
+ * number; the start node begins in the second byte. + * number; the start node begins in the second byte.
+ */ + */
+#define MAGIC 0234 +#define MAGIC 0234
diff -Nurp linux-2.4.26-stock/net/ipv4/netfilter/regexp/regsub.c linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regsub.c diff -Nurp linux-2.4.30/net/ipv4/netfilter/regexp/regsub.c linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regsub.c
--- linux-2.4.26-stock/net/ipv4/netfilter/regexp/regsub.c 1969-12-31 18:00:00.000000000 -0600 --- linux-2.4.30/net/ipv4/netfilter/regexp/regsub.c 1969-12-31 18:00:00.000000000 -0600
+++ linux-2.4.26-layer7-clean/net/ipv4/netfilter/regexp/regsub.c 2004-06-27 19:07:00.000000000 -0500 +++ linux-2.4.30-layer7/net/ipv4/netfilter/regexp/regsub.c 2005-05-03 18:37:03.000000000 -0500
@@ -0,0 +1,95 @@ @@ -0,0 +1,95 @@
+/* +/*
+ * regsub + * regsub