]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commitdiff
netfilter: Combine ipt_ttl and ip6t_hl source
authorJan Engelhardt <jengelh@medozas.de>
Wed, 18 Feb 2009 17:39:31 +0000 (18:39 +0100)
committerPatrick McHardy <kaber@trash.net>
Wed, 18 Feb 2009 17:39:31 +0000 (18:39 +0100)
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
net/ipv4/netfilter/Kconfig
net/ipv4/netfilter/Makefile
net/ipv4/netfilter/ipt_ttl.c [deleted file]
net/ipv6/netfilter/Kconfig
net/ipv6/netfilter/Makefile
net/ipv6/netfilter/ip6t_hl.c [deleted file]
net/netfilter/Kconfig
net/netfilter/Makefile
net/netfilter/xt_hl.c [new file with mode: 0644]

index 3ad9f43b4c45fe0a84c841fe90ff66249db50ae4..40ad41f19b72ba65f48f312d575170779cfd1a42 100644 (file)
@@ -92,15 +92,6 @@ config IP_NF_MATCH_ECN
 
          To compile it as a module, choose M here.  If unsure, say N.
 
-config IP_NF_MATCH_TTL
-       tristate '"ttl" match support'
-       depends on NETFILTER_ADVANCED
-       help
-         This adds CONFIG_IP_NF_MATCH_TTL option, which enabled the user
-         to match packets by their TTL value.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-
 # `filter', generic and specific targets
 config IP_NF_FILTER
        tristate "Packet filtering"
index 20b0c37155fb3b802c1fa899dcb753263db7d73a..48111594ee9bf4921a64a09760b3423840c79d4c 100644 (file)
@@ -51,7 +51,6 @@ obj-$(CONFIG_IP_NF_SECURITY) += iptable_security.o
 obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
 obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
-obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
 
 # targets
 obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o
diff --git a/net/ipv4/netfilter/ipt_ttl.c b/net/ipv4/netfilter/ipt_ttl.c
deleted file mode 100644 (file)
index 297f1cb..0000000
+++ /dev/null
@@ -1,63 +0,0 @@
-/* IP tables module for matching the value of the TTL
- *
- * (C) 2000,2001 by Harald Welte <laforge@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/ip.h>
-#include <linux/module.h>
-#include <linux/skbuff.h>
-
-#include <linux/netfilter_ipv4/ipt_ttl.h>
-#include <linux/netfilter/x_tables.h>
-
-MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
-MODULE_DESCRIPTION("Xtables: IPv4 TTL field match");
-MODULE_LICENSE("GPL");
-
-static bool ttl_mt(const struct sk_buff *skb, const struct xt_match_param *par)
-{
-       const struct ipt_ttl_info *info = par->matchinfo;
-       const u8 ttl = ip_hdr(skb)->ttl;
-
-       switch (info->mode) {
-               case IPT_TTL_EQ:
-                       return ttl == info->ttl;
-               case IPT_TTL_NE:
-                       return ttl != info->ttl;
-               case IPT_TTL_LT:
-                       return ttl < info->ttl;
-               case IPT_TTL_GT:
-                       return ttl > info->ttl;
-               default:
-                       printk(KERN_WARNING "ipt_ttl: unknown mode %d\n",
-                               info->mode);
-                       return false;
-       }
-
-       return false;
-}
-
-static struct xt_match ttl_mt_reg __read_mostly = {
-       .name           = "ttl",
-       .family         = NFPROTO_IPV4,
-       .match          = ttl_mt,
-       .matchsize      = sizeof(struct ipt_ttl_info),
-       .me             = THIS_MODULE,
-};
-
-static int __init ttl_mt_init(void)
-{
-       return xt_register_match(&ttl_mt_reg);
-}
-
-static void __exit ttl_mt_exit(void)
-{
-       xt_unregister_match(&ttl_mt_reg);
-}
-
-module_init(ttl_mt_init);
-module_exit(ttl_mt_exit);
index 6a42a968c4983dbd31a69ca70cba3c35af5c80c2..4a8d7ecd6d097cd7f0e7f875b85bd64a2c2cd352 100644 (file)
@@ -94,15 +94,6 @@ config IP6_NF_MATCH_OPTS
 
          To compile it as a module, choose M here.  If unsure, say N.
 
-config IP6_NF_MATCH_HL
-       tristate '"hl" match support'
-       depends on NETFILTER_ADVANCED
-       help
-         HL matching allows you to match packets based on the hop
-         limit of the packet.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-
 config IP6_NF_MATCH_IPV6HEADER
        tristate '"ipv6header" IPv6 Extension Headers Match'
        default m if NETFILTER_ADVANCED=n
index 61a4570d0ede4ee2dd919191bf3c126b58f87077..aafbba30c899fac569184a5ef9943f13ecfdb3b9 100644 (file)
@@ -20,7 +20,6 @@ obj-$(CONFIG_NF_CONNTRACK_IPV6) += nf_conntrack_ipv6.o
 obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o
 obj-$(CONFIG_IP6_NF_MATCH_EUI64) += ip6t_eui64.o
 obj-$(CONFIG_IP6_NF_MATCH_FRAG) += ip6t_frag.o
-obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
 obj-$(CONFIG_IP6_NF_MATCH_IPV6HEADER) += ip6t_ipv6header.o
 obj-$(CONFIG_IP6_NF_MATCH_MH) += ip6t_mh.o
 obj-$(CONFIG_IP6_NF_MATCH_OPTS) += ip6t_hbh.o
diff --git a/net/ipv6/netfilter/ip6t_hl.c b/net/ipv6/netfilter/ip6t_hl.c
deleted file mode 100644 (file)
index c964dca..0000000
+++ /dev/null
@@ -1,68 +0,0 @@
-/* Hop Limit matching module */
-
-/* (C) 2001-2002 Maciej Soltysiak <solt@dns.toxicfilms.tv>
- * Based on HW's ttl module
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/ipv6.h>
-#include <linux/module.h>
-#include <linux/skbuff.h>
-
-#include <linux/netfilter_ipv6/ip6t_hl.h>
-#include <linux/netfilter/x_tables.h>
-
-MODULE_AUTHOR("Maciej Soltysiak <solt@dns.toxicfilms.tv>");
-MODULE_DESCRIPTION("Xtables: IPv6 Hop Limit field match");
-MODULE_LICENSE("GPL");
-
-static bool hl_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
-{
-       const struct ip6t_hl_info *info = par->matchinfo;
-       const struct ipv6hdr *ip6h = ipv6_hdr(skb);
-
-       switch (info->mode) {
-               case IP6T_HL_EQ:
-                       return ip6h->hop_limit == info->hop_limit;
-                       break;
-               case IP6T_HL_NE:
-                       return ip6h->hop_limit != info->hop_limit;
-                       break;
-               case IP6T_HL_LT:
-                       return ip6h->hop_limit < info->hop_limit;
-                       break;
-               case IP6T_HL_GT:
-                       return ip6h->hop_limit > info->hop_limit;
-                       break;
-               default:
-                       printk(KERN_WARNING "ip6t_hl: unknown mode %d\n",
-                               info->mode);
-                       return false;
-       }
-
-       return false;
-}
-
-static struct xt_match hl_mt6_reg __read_mostly = {
-       .name           = "hl",
-       .family         = NFPROTO_IPV6,
-       .match          = hl_mt6,
-       .matchsize      = sizeof(struct ip6t_hl_info),
-       .me             = THIS_MODULE,
-};
-
-static int __init hl_mt6_init(void)
-{
-       return xt_register_match(&hl_mt6_reg);
-}
-
-static void __exit hl_mt6_exit(void)
-{
-       xt_unregister_match(&hl_mt6_reg);
-}
-
-module_init(hl_mt6_init);
-module_exit(hl_mt6_exit);
index d99f29b7b98003a0cccf915a9657f5fab66240e4..0eb98b4fbf44a6e4ec0a919b34a0dbfa6f068c7a 100644 (file)
@@ -620,6 +620,14 @@ config NETFILTER_XT_MATCH_HELPER
 
          To compile it as a module, choose M here.  If unsure, say Y.
 
+config NETFILTER_XT_MATCH_HL
+       tristate '"hl" hoplimit/TTL match support'
+       depends on NETFILTER_ADVANCED
+       ---help---
+       HL matching allows you to match packets based on the hoplimit
+       in the IPv6 header, or the time-to-live field in the IPv4
+       header of the packet.
+
 config NETFILTER_XT_MATCH_IPRANGE
        tristate '"iprange" address range match support'
        depends on NETFILTER_ADVANCED
index 6ebe0482265bed0cd5d9e9eaf72c42b47207c98f..da73ed25701ce51c277fd5a317e6e2952c99fe1e 100644 (file)
@@ -68,6 +68,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_LENGTH) += xt_length.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_LIMIT) += xt_limit.o
diff --git a/net/netfilter/xt_hl.c b/net/netfilter/xt_hl.c
new file mode 100644 (file)
index 0000000..7726154
--- /dev/null
@@ -0,0 +1,108 @@
+/*
+ * IP tables module for matching the value of the TTL
+ * (C) 2000,2001 by Harald Welte <laforge@netfilter.org>
+ *
+ * Hop Limit matching module
+ * (C) 2001-2002 Maciej Soltysiak <solt@dns.toxicfilms.tv>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_ipv4/ipt_ttl.h>
+#include <linux/netfilter_ipv6/ip6t_hl.h>
+
+MODULE_AUTHOR("Maciej Soltysiak <solt@dns.toxicfilms.tv>");
+MODULE_DESCRIPTION("Xtables: Hoplimit/TTL field match");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_ttl");
+MODULE_ALIAS("ip6t_hl");
+
+static bool ttl_mt(const struct sk_buff *skb, const struct xt_match_param *par)
+{
+       const struct ipt_ttl_info *info = par->matchinfo;
+       const u8 ttl = ip_hdr(skb)->ttl;
+
+       switch (info->mode) {
+               case IPT_TTL_EQ:
+                       return ttl == info->ttl;
+               case IPT_TTL_NE:
+                       return ttl != info->ttl;
+               case IPT_TTL_LT:
+                       return ttl < info->ttl;
+               case IPT_TTL_GT:
+                       return ttl > info->ttl;
+               default:
+                       printk(KERN_WARNING "ipt_ttl: unknown mode %d\n",
+                               info->mode);
+                       return false;
+       }
+
+       return false;
+}
+
+static bool hl_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
+{
+       const struct ip6t_hl_info *info = par->matchinfo;
+       const struct ipv6hdr *ip6h = ipv6_hdr(skb);
+
+       switch (info->mode) {
+               case IP6T_HL_EQ:
+                       return ip6h->hop_limit == info->hop_limit;
+                       break;
+               case IP6T_HL_NE:
+                       return ip6h->hop_limit != info->hop_limit;
+                       break;
+               case IP6T_HL_LT:
+                       return ip6h->hop_limit < info->hop_limit;
+                       break;
+               case IP6T_HL_GT:
+                       return ip6h->hop_limit > info->hop_limit;
+                       break;
+               default:
+                       printk(KERN_WARNING "ip6t_hl: unknown mode %d\n",
+                               info->mode);
+                       return false;
+       }
+
+       return false;
+}
+
+static struct xt_match hl_mt_reg[] __read_mostly = {
+       {
+               .name       = "ttl",
+               .revision   = 0,
+               .family     = NFPROTO_IPV4,
+               .match      = ttl_mt,
+               .matchsize  = sizeof(struct ipt_ttl_info),
+               .me         = THIS_MODULE,
+       },
+       {
+               .name       = "hl",
+               .revision   = 0,
+               .family     = NFPROTO_IPV6,
+               .match      = hl_mt6,
+               .matchsize  = sizeof(struct ip6t_hl_info),
+               .me         = THIS_MODULE,
+       },
+};
+
+static int __init hl_mt_init(void)
+{
+       return xt_register_matches(hl_mt_reg, ARRAY_SIZE(hl_mt_reg));
+}
+
+static void __exit hl_mt_exit(void)
+{
+       xt_unregister_matches(hl_mt_reg, ARRAY_SIZE(hl_mt_reg));
+}
+
+module_init(hl_mt_init);
+module_exit(hl_mt_exit);