1 diff -Nurb linux-2.6.27-521/include/linux/netfilter/xt_MARK.h linux-2.6.27-522-ol/include/linux/netfilter/xt_MARK.h
2 --- linux-2.6.27-521/include/linux/netfilter/xt_MARK.h 2008-10-09 18:13:53.000000000 -0400
3 +++ linux-2.6.27-522-ol/include/linux/netfilter/xt_MARK.h 2009-06-02 10:02:16.000000000 -0400
11 struct xt_mark_target_info_v1 {
12 diff -Nurb linux-2.6.27-521/include/linux/netfilter/xt_SETXID.h linux-2.6.27-522-ol/include/linux/netfilter/xt_SETXID.h
13 --- linux-2.6.27-521/include/linux/netfilter/xt_SETXID.h 1969-12-31 19:00:00.000000000 -0500
14 +++ linux-2.6.27-522-ol/include/linux/netfilter/xt_SETXID.h 2009-06-02 10:02:16.000000000 -0400
16 +#ifndef _XT_SETXID_H_target
17 +#define _XT_SETXID_H_target
24 +struct xt_setxid_target_info_v1 {
29 +#endif /*_XT_SETXID_H_target*/
30 diff -Nurb linux-2.6.27-521/include/linux/netfilter_ipv4/ipt_MARK.h linux-2.6.27-522-ol/include/linux/netfilter_ipv4/ipt_MARK.h
31 --- linux-2.6.27-521/include/linux/netfilter_ipv4/ipt_MARK.h 2008-10-09 18:13:53.000000000 -0400
32 +++ linux-2.6.27-522-ol/include/linux/netfilter_ipv4/ipt_MARK.h 2009-06-02 10:02:16.000000000 -0400
34 #define IPT_MARK_SET XT_MARK_SET
35 #define IPT_MARK_AND XT_MARK_AND
36 #define IPT_MARK_OR XT_MARK_OR
37 +#define IPT_MARK_COPYXID XT_MARK_COPYXID
39 #define ipt_mark_target_info_v1 xt_mark_target_info_v1
41 diff -Nurb linux-2.6.27-521/include/linux/netfilter_ipv4/ipt_SETXID.h linux-2.6.27-522-ol/include/linux/netfilter_ipv4/ipt_SETXID.h
42 --- linux-2.6.27-521/include/linux/netfilter_ipv4/ipt_SETXID.h 1969-12-31 19:00:00.000000000 -0500
43 +++ linux-2.6.27-522-ol/include/linux/netfilter_ipv4/ipt_SETXID.h 2009-06-02 10:02:16.000000000 -0400
45 +#ifndef _IPT_SETXID_H_target
46 +#define _IPT_SETXID_H_target
48 +/* Backwards compatibility for old userspace */
50 +#include <linux/netfilter/xt_SETXID.h>
53 +#define IPT_SET_PACKET_XID XT_SET_PACKET_XID
55 +#define ipt_setxid_target_info_v1 xt_setxid_target_info_v1
57 +#endif /*_IPT_SETXID_H_target*/
58 diff -Nurb linux-2.6.27-521/include/net/netfilter/nf_conntrack.h linux-2.6.27-522-ol/include/net/netfilter/nf_conntrack.h
59 --- linux-2.6.27-521/include/net/netfilter/nf_conntrack.h 2008-10-09 18:13:53.000000000 -0400
60 +++ linux-2.6.27-522-ol/include/net/netfilter/nf_conntrack.h 2009-06-02 10:02:16.000000000 -0400
62 /* Storage reserved for other modules: */
63 union nf_conntrack_proto proto;
65 + /* PLANETLAB. VNET-specific */
66 + int xid[IP_CT_DIR_MAX];
69 struct nf_ct_ext *ext;
71 diff -Nurb linux-2.6.27-521/net/netfilter/Kconfig linux-2.6.27-522-ol/net/netfilter/Kconfig
72 --- linux-2.6.27-521/net/netfilter/Kconfig 2008-10-09 18:13:53.000000000 -0400
73 +++ linux-2.6.27-522-ol/net/netfilter/Kconfig 2009-06-02 10:02:16.000000000 -0400
75 This option adds a "TCPOPTSTRIP" target, which allows you to strip
76 TCP options from TCP packets.
78 +config NETFILTER_XT_TARGET_SETXID
79 + tristate '"SETXID" target support'
80 + depends on NETFILTER_XTABLES
82 + This option adds a `SETXID' target, which allows you to alter the
85 config NETFILTER_XT_MATCH_COMMENT
86 tristate '"comment" match support'
87 depends on NETFILTER_XTABLES
88 diff -Nurb linux-2.6.27-521/net/netfilter/Makefile linux-2.6.27-522-ol/net/netfilter/Makefile
89 --- linux-2.6.27-521/net/netfilter/Makefile 2008-10-09 18:13:53.000000000 -0400
90 +++ linux-2.6.27-522-ol/net/netfilter/Makefile 2009-06-02 10:02:16.000000000 -0400
92 obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
95 +obj-$(CONFIG_NETFILTER_XT_TARGET_SETXID) += xt_SETXID.o
96 obj-$(CONFIG_NETFILTER_XT_TARGET_CLASSIFY) += xt_CLASSIFY.o
97 obj-$(CONFIG_NETFILTER_XT_TARGET_CONNMARK) += xt_CONNMARK.o
98 obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
99 diff -Nurb linux-2.6.27-521/net/netfilter/nf_conntrack_core.c linux-2.6.27-522-ol/net/netfilter/nf_conntrack_core.c
100 --- linux-2.6.27-521/net/netfilter/nf_conntrack_core.c 2008-10-09 18:13:53.000000000 -0400
101 +++ linux-2.6.27-522-ol/net/netfilter/nf_conntrack_core.c 2009-06-02 10:02:16.000000000 -0400
103 /* Overload tuple linked list to put us in unconfirmed list. */
104 hlist_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode, &unconfirmed);
106 + ct->xid[IP_CT_DIR_ORIGINAL] = -1;
107 + ct->xid[IP_CT_DIR_REPLY] = -1;
109 spin_unlock_bh(&nf_conntrack_lock);
112 diff -Nurb linux-2.6.27-521/net/netfilter/xt_MARK.c linux-2.6.27-522/net/netfilter/xt_MARK.c
113 --- linux-2.6.27-521/net/netfilter/xt_MARK.c 2008-10-09 18:13:53.000000000 -0400
114 +++ linux-2.6.27-522/net/netfilter/xt_MARK.c 2009-06-02 11:12:59.000000000 -0400
116 #include <linux/module.h>
117 #include <linux/skbuff.h>
118 #include <linux/ip.h>
119 +#include <net/udp.h>
120 #include <net/checksum.h>
121 +#include <net/route.h>
122 +#include <net/inet_hashtables.h>
123 +#include <net/net_namespace.h>
125 +#include <net/netfilter/nf_conntrack.h>
127 #include <linux/netfilter/x_tables.h>
128 #include <linux/netfilter/xt_MARK.h>
130 MODULE_ALIAS("ipt_MARK");
131 MODULE_ALIAS("ip6t_MARK");
133 +extern DEFINE_PER_CPU(int, sknid_elevator);
136 mark_tg_v0(struct sk_buff *skb, const struct net_device *in,
137 const struct net_device *out, unsigned int hooknum,
142 +#define PEERCRED_SET(x) ((x!=0) && (x!=(unsigned int)-1))
145 +static inline u_int16_t
146 +get_dst_port(struct nf_conntrack_tuple *tuple)
148 + switch (tuple->dst.protonum) {
150 + /* XXX Truncate 32-bit GRE key to 16 bits */
151 + return tuple->dst.u.gre.key;
153 + /* Bind on ICMP echo ID */
154 + return tuple->src.u.icmp.id;
156 + return tuple->dst.u.tcp.port;
158 + return tuple->dst.u.udp.port;
160 + return tuple->dst.u.all;
164 +static inline u_int16_t
165 +get_src_port(struct nf_conntrack_tuple *tuple)
167 + switch (tuple->dst.protonum) {
169 + /* XXX Truncate 32-bit GRE key to 16 bits */
170 + return htons(ntohl(tuple->src.u.gre.key));
172 + /* Bind on ICMP echo ID */
173 + return tuple->src.u.icmp.id;
175 + return tuple->src.u.tcp.port;
177 + return tuple->src.u.udp.port;
179 + return tuple->src.u.all;
183 +static struct sock *__udp4_lib_lookup(__be32 saddr, __be16 sport,
184 + __be32 daddr, __be16 dport,
185 + int dif, struct hlist_head udptable[])
187 + struct sock *sk, *result = NULL;
188 + struct hlist_node *node;
189 + unsigned short hnum = ntohs(dport);
192 + read_lock(&udp_hash_lock);
194 + sk_for_each(sk, node, &udptable[hnum & (UDP_HTABLE_SIZE - 1)]) {
195 + struct inet_sock *inet = inet_sk(sk);
197 + if (sk->sk_hash == hnum && !ipv6_only_sock(sk)) {
198 + int score = (sk->sk_family == PF_INET ? 1 : 0);
200 + if (inet->rcv_saddr) {
201 + if (inet->rcv_saddr != daddr)
205 + /* block non nx_info ips */
206 + if (!v4_addr_in_nx_info(sk->sk_nx_info,
207 + daddr, NXA_MASK_BIND))
211 + if (inet->daddr != saddr)
216 + if (inet->dport != sport)
220 + if (sk->sk_bound_dev_if) {
221 + if (sk->sk_bound_dev_if != dif)
228 + } else if (score > badness) {
237 + read_unlock(&udp_hash_lock);
241 mark_tg(struct sk_buff *skb, const struct net_device *in,
242 const struct net_device *out, unsigned int hooknum,
243 const struct xt_target *target, const void *targinfo)
245 const struct xt_mark_tginfo2 *info = targinfo;
247 + enum ip_conntrack_info ctinfo;
248 + struct sock *connection_sk;
250 + struct nf_conn *ct;
251 + extern struct inet_hashinfo tcp_hashinfo;
252 + enum ip_conntrack_dir dir;
256 + u_int16_t proto, src_port;
260 + if (info->mark == ~0U) {
262 + dif = ((struct rtable *)(skb->dst))->rt_iif;
264 + ct = nf_ct_get(skb, &ctinfo);
266 + goto out_mark_finish;
268 + dir = CTINFO2DIR(ctinfo);
269 + src_ip = ct->tuplehash[dir].tuple.src.u3.ip;
270 + dst_ip = ct->tuplehash[dir].tuple.dst.u3.ip;
271 + src_port = get_src_port(&ct->tuplehash[dir].tuple);
272 + proto = ct->tuplehash[dir].tuple.dst.protonum;
274 + ip = ct->tuplehash[dir].tuple.dst.u3.ip;
275 + port = get_dst_port(&ct->tuplehash[dir].tuple);
279 + /* The packet is marked, it's going out */
280 + ct->xid[0] = skb->mark;
282 + if (ct->xid[0] > 0)
285 + else if (proto == 17) {
288 + sk = __udp4_lib_lookup(src_ip, src_port,
289 + ip, port, dif, udp_hash);
291 + if (sk && hooknum == NF_INET_LOCAL_IN)
297 + else if (skb->mark > 0)
298 + /* The packet is marked, it's going out */
299 + ct->xid[0] = skb->mark;
301 + else if (proto == 6) /* TCP */{
302 + int sockettype = 0; /* Established socket */
303 + struct net *net = &init_net;
305 + /* Looks for an established socket or a listening
306 + socket corresponding to the 4-tuple, in that order.
307 + The order is important for Codemux connections
308 + to be handled properly */
310 + connection_sk = inet_lookup_established(net,
311 + &tcp_hashinfo, src_ip, src_port, ip, port, dif);
313 + if (!connection_sk) {
314 + connection_sk = inet_lookup_listener(net,
315 + &tcp_hashinfo, ip, port, dif);
316 + sockettype = 1; /* Listening socket */
319 + if (connection_sk) {
320 + /* The peercred is not set. We set it if the other side has an xid. */
321 + if (!PEERCRED_SET(connection_sk->sk_peercred.uid)
322 + && ct->xid[!dir] > 0 && (sockettype == 0)) {
323 + connection_sk->sk_peercred.gid =
324 + connection_sk->sk_peercred.uid = ct->xid[!dir];
327 + /* The peercred is set, and is not equal to the XID of 'the other side' */
328 + else if (PEERCRED_SET(connection_sk->sk_peercred.uid) &&
329 + (connection_sk->sk_peercred.uid != ct->xid[!dir]) &&
330 + (sockettype == 0)) {
331 + mark = connection_sk->sk_peercred.uid;
334 + /* Has this connection already been tagged? */
335 + if (ct->xid[dir] < 1) {
336 + /* No - let's tag it */
337 + ct->xid[dir]=connection_sk->sk_nid;
340 + if (mark == -1 && (ct->xid[dir] != 0))
341 + mark = ct->xid[dir];
343 + if (connection_sk->sk_state == TCP_TIME_WAIT) {
344 + inet_twsk_put(inet_twsk(connection_sk));
345 + goto out_mark_finish;
347 + sock_put(connection_sk);
350 + /* All else failed. Is this a connection over raw sockets?
351 + That explains why we couldn't get anything out of skb->sk,
352 + or look up a "real" connection. */
353 + if (ct->xid[dir] < 1) {
355 + ct->xid[dir] = skb->skb_tag;
358 + /* Covers CoDemux case */
359 + if (mark < 1 && (ct->xid[dir] > 0))
360 + mark = ct->xid[dir];
362 + if (mark < 1 && (ct->xid[!dir] > 0))
363 + mark = ct->xid[!dir];
364 + goto out_mark_finish;
368 + mark = (skb->mark & ~info->mask) ^ info->mark;
374 + curtag = &__get_cpu_var(sknid_elevator);
375 + if (mark > 0 && *curtag == -2 && hooknum == NF_INET_LOCAL_IN)
378 - skb->mark = (skb->mark & ~info->mask) ^ info->mark;
382 diff -Nurb linux-2.6.27-521/net/netfilter/xt_SETXID.c linux-2.6.27-522-ol/net/netfilter/xt_SETXID.c
383 --- linux-2.6.27-521/net/netfilter/xt_SETXID.c 1969-12-31 19:00:00.000000000 -0500
384 +++ linux-2.6.27-522-ol/net/netfilter/xt_SETXID.c 2009-06-02 10:02:16.000000000 -0400
386 +#include <linux/module.h>
387 +#include <linux/skbuff.h>
388 +#include <linux/ip.h>
389 +#include <net/checksum.h>
390 +#include <linux/vs_network.h>
392 +#include <linux/netfilter/x_tables.h>
393 +#include <linux/netfilter/xt_SETXID.h>
395 +MODULE_LICENSE("GPL");
397 +MODULE_DESCRIPTION("");
398 +MODULE_ALIAS("ipt_SETXID");
401 +target_v1(struct sk_buff **pskb,
402 + const struct net_device *in,
403 + const struct net_device *out,
404 + unsigned int hooknum,
405 + const struct xt_target *target,
406 + const void *targinfo)
408 + const struct xt_setxid_target_info_v1 *setxidinfo = targinfo;
410 + switch (setxidinfo->mode) {
411 + case XT_SET_PACKET_XID:
412 + (*pskb)->skb_tag = setxidinfo->mark;
415 + return XT_CONTINUE;
420 +checkentry_v1(const char *tablename,
422 + const struct xt_target *target,
424 + unsigned int hook_mask)
426 + struct xt_setxid_target_info_v1 *setxidinfo = targinfo;
428 + if (setxidinfo->mode != XT_SET_PACKET_XID) {
429 + printk(KERN_WARNING "SETXID: unknown mode %u\n",
437 +static struct xt_target xt_setxid_target[] = {
442 + .checkentry = checkentry_v1,
443 + .target = target_v1,
444 + .targetsize = sizeof(struct xt_setxid_target_info_v1),
450 +static int __init init(void)
454 + err = xt_register_targets(xt_setxid_target, ARRAY_SIZE(xt_setxid_target));
458 +static void __exit fini(void)
460 + xt_unregister_targets(xt_setxid_target, ARRAY_SIZE(xt_setxid_target));