linux-2.6-522-iptables-connection-tagging.patch

   1 diff -Nurb linux-2.6.27-521/net/netfilter/xt_MARK.c linux-2.6.27-522/net/netfilter/xt_MARK.c
   2 --- linux-2.6.27-521/net/netfilter/xt_MARK.c    2008-10-09 18:13:53.000000000 -0400
   3 +++ linux-2.6.27-522/net/netfilter/xt_MARK.c    2009-06-02 11:12:59.000000000 -0400
   4 @@ -13,7 +13,13 @@
   5  #include <linux/module.h>
   6  #include <linux/skbuff.h>
   7  #include <linux/ip.h>
   8 +#include <net/udp.h>
   9  #include <net/checksum.h>
  10 +#include <net/route.h>
  11 +#include <net/inet_hashtables.h>
  12 +#include <net/net_namespace.h>
  13 +
  14 +#include <net/netfilter/nf_conntrack.h>
  15
  16  #include <linux/netfilter/x_tables.h>
  17  #include <linux/netfilter/xt_MARK.h>
  18 @@ -24,6 +30,8 @@
  19  MODULE_ALIAS("ipt_MARK");
  20  MODULE_ALIAS("ip6t_MARK");
  21
  22 +extern DEFINE_PER_CPU(int, sknid_elevator);
  23 +
  24  static unsigned int
  25  mark_tg_v0(struct sk_buff *skb, const struct net_device *in,
  26             const struct net_device *out, unsigned int hooknum,
  27 @@ -61,14 +69,242 @@
  28         return XT_CONTINUE;
  29  }
  30
  31 +#define PEERCRED_SET(x) ((x!=0) && (x!=(unsigned int)-1))
  32 +
  33 +
  34 +static inline u_int16_t
  35 +get_dst_port(struct nf_conntrack_tuple *tuple)
  36 +{
  37 +       switch (tuple->dst.protonum) {
  38 +       case IPPROTO_GRE:
  39 +               /* XXX Truncate 32-bit GRE key to 16 bits */
  40 +               return tuple->dst.u.gre.key;
  41 +       case IPPROTO_ICMP:
  42 +               /* Bind on ICMP echo ID */
  43 +               return tuple->src.u.icmp.id;
  44 +       case IPPROTO_TCP:
  45 +               return tuple->dst.u.tcp.port;
  46 +       case IPPROTO_UDP:
  47 +               return tuple->dst.u.udp.port;
  48 +       default:
  49 +               return tuple->dst.u.all;
  50 +       }
  51 +}
  52 +
  53 +static inline u_int16_t
  54 +get_src_port(struct nf_conntrack_tuple *tuple)
  55 +{
  56 +       switch (tuple->dst.protonum) {
  57 +       case IPPROTO_GRE:
  58 +               /* XXX Truncate 32-bit GRE key to 16 bits */
  59 +               return htons(ntohl(tuple->src.u.gre.key));
  60 +       case IPPROTO_ICMP:
  61 +               /* Bind on ICMP echo ID */
  62 +               return tuple->src.u.icmp.id;
  63 +       case IPPROTO_TCP:
  64 +               return tuple->src.u.tcp.port;
  65 +       case IPPROTO_UDP:
  66 +               return tuple->src.u.udp.port;
  67 +       default:
  68 +               return tuple->src.u.all;
  69 +       }
  70 +}
  71 +
  72 +static struct sock *__udp4_lib_lookup(__be32 saddr, __be16 sport,
  73 +                      __be32 daddr, __be16 dport,
  74 +                      int dif, struct hlist_head udptable[])
  75 +{
  76 +    struct sock *sk, *result = NULL;
  77 +    struct hlist_node *node;
  78 +    unsigned short hnum = ntohs(dport);
  79 +    int badness = -1;
  80 +
  81 +    read_lock(&udp_hash_lock);
  82 +
  83 +    sk_for_each(sk, node, &udptable[hnum & (UDP_HTABLE_SIZE - 1)]) {
  84 +        struct inet_sock *inet = inet_sk(sk);
  85 +
  86 +        if (sk->sk_hash == hnum && !ipv6_only_sock(sk)) {
  87 +            int score = (sk->sk_family == PF_INET ? 1 : 0);
  88 +
  89 +            if (inet->rcv_saddr) {
  90 +                if (inet->rcv_saddr != daddr)
  91 +                    continue;
  92 +                score+=2;
  93 +            } else {
  94 +                /* block non nx_info ips */
  95 +                if (!v4_addr_in_nx_info(sk->sk_nx_info,
  96 +                    daddr, NXA_MASK_BIND))
  97 +                    continue;
  98 +            }
  99 +            if (inet->daddr) {
 100 +                if (inet->daddr != saddr)
 101 +                    continue;
 102 +                score+=2;
 103 +            }
 104 +            if (inet->dport) {
 105 +                if (inet->dport != sport)
 106 +                    continue;
 107 +                score+=2;
 108 +            }
 109 +            if (sk->sk_bound_dev_if) {
 110 +                if (sk->sk_bound_dev_if != dif)
 111 +                    continue;
 112 +                score+=2;
 113 +            }
 114 +            if (score == 9) {
 115 +                result = sk;
 116 +                break;
 117 +            } else if (score > badness) {
 118 +                result = sk;
 119 +                badness = score;
 120 +            }
 121 +        }
 122 +    }
 123 +
 124 +    if (result)
 125 +        sock_hold(result);
 126 +    read_unlock(&udp_hash_lock);
 127 +    return result;
 128 +}
 129  static unsigned int
 130  mark_tg(struct sk_buff *skb, const struct net_device *in,
 131          const struct net_device *out, unsigned int hooknum,
 132          const struct xt_target *target, const void *targinfo)
 133  {
 134         const struct xt_mark_tginfo2 *info = targinfo;
 135 +    long mark = -1;
 136 +    enum ip_conntrack_info ctinfo;
 137 +    struct sock *connection_sk;
 138 +    int dif;
 139 +    struct nf_conn *ct;
 140 +    extern struct inet_hashinfo tcp_hashinfo;
 141 +    enum ip_conntrack_dir dir;
 142 +    int *curtag;
 143 +    u_int32_t src_ip;
 144 +    u_int32_t dst_ip;
 145 +    u_int16_t proto, src_port;
 146 +    u_int32_t ip;
 147 +    u_int16_t port;
 148 +
 149 +    if (info->mark == ~0U) {
 150 +        /* copy-xid */
 151 +        dif = ((struct rtable *)(skb->dst))->rt_iif;
 152 +
 153 +        ct = nf_ct_get(skb, &ctinfo);
 154 +        if (!ct)
 155 +            goto out_mark_finish;
 156 +
 157 +        dir = CTINFO2DIR(ctinfo);
 158 +        src_ip = ct->tuplehash[dir].tuple.src.u3.ip;
 159 +        dst_ip = ct->tuplehash[dir].tuple.dst.u3.ip;
 160 +        src_port = get_src_port(&ct->tuplehash[dir].tuple);
 161 +        proto = ct->tuplehash[dir].tuple.dst.protonum;
 162 +
 163 +        ip = ct->tuplehash[dir].tuple.dst.u3.ip;
 164 +        port = get_dst_port(&ct->tuplehash[dir].tuple);
 165 +
 166 +        if (proto == 1) {
 167 +            if (skb->mark > 0)
 168 +                /* The packet is marked, it's going out */
 169 +                ct->xid[0] = skb->mark;
 170 +
 171 +            if (ct->xid[0] > 0)
 172 +                mark = ct->xid[0];
 173 +        }
 174 +        else if (proto == 17) {
 175 +            struct sock *sk;
 176 +            if (!skb->mark) {
 177 +                sk = __udp4_lib_lookup(src_ip, src_port,
 178 +                        ip, port, dif, udp_hash);
 179 +
 180 +                if (sk && hooknum == NF_INET_LOCAL_IN)
 181 +                    mark = sk->sk_nid;
 182 +
 183 +                if (sk)
 184 +                    sock_put(sk);
 185 +            }
 186 +            else if (skb->mark > 0)
 187 +                /* The packet is marked, it's going out */
 188 +                ct->xid[0] = skb->mark;
 189 +        }
 190 +        else if (proto == 6) /* TCP */{
 191 +            int sockettype = 0; /* Established socket */
 192 +            struct net *net = &init_net;
 193 +
 194 +            /* Looks for an established socket or a listening
 195 +               socket corresponding to the 4-tuple, in that order.
 196 +               The order is important for Codemux connections
 197 +               to be handled properly */
 198 +
 199 +            connection_sk = inet_lookup_established(net,
 200 +                    &tcp_hashinfo, src_ip, src_port, ip, port, dif);
 201 +
 202 +            if (!connection_sk) {
 203 +                connection_sk = inet_lookup_listener(net,
 204 +                        &tcp_hashinfo, ip, port, dif);
 205 +                sockettype = 1; /* Listening socket */
 206 +            }
 207 +
 208 +            if (connection_sk) {
 209 +                /* The peercred is not set. We set it if the other side has an xid. */
 210 +                if (!PEERCRED_SET(connection_sk->sk_peercred.uid)
 211 +                        && ct->xid[!dir] > 0 && (sockettype == 0)) {
 212 +                    connection_sk->sk_peercred.gid =
 213 +                        connection_sk->sk_peercred.uid = ct->xid[!dir];
 214 +                }
 215 +
 216 +                /* The peercred is set, and is not equal to the XID of 'the other side' */
 217 +                else if (PEERCRED_SET(connection_sk->sk_peercred.uid) &&
 218 +                        (connection_sk->sk_peercred.uid != ct->xid[!dir]) &&
 219 +                        (sockettype == 0)) {
 220 +                    mark = connection_sk->sk_peercred.uid;
 221 +                }
 222 +
 223 +                /* Has this connection already been tagged? */
 224 +                if (ct->xid[dir] < 1) {
 225 +                    /* No - let's tag it */
 226 +                    ct->xid[dir]=connection_sk->sk_nid;
 227 +                }
 228 +
 229 +                if (mark == -1 && (ct->xid[dir] != 0))
 230 +                    mark = ct->xid[dir];
 231 +
 232 +                if (connection_sk->sk_state == TCP_TIME_WAIT) {
 233 +                    inet_twsk_put(inet_twsk(connection_sk));
 234 +                    goto out_mark_finish;
 235 +                } else
 236 +                    sock_put(connection_sk);
 237 +            }
 238 +
 239 +            /* All else failed. Is this a connection over raw sockets?
 240 +               That explains why we couldn't get anything out of skb->sk,
 241 +               or look up a "real" connection. */
 242 +            if (ct->xid[dir] < 1) {
 243 +                if (skb->skb_tag)
 244 +                    ct->xid[dir] = skb->skb_tag;
 245 +            }
 246 +
 247 +            /* Covers CoDemux case */
 248 +            if (mark < 1 && (ct->xid[dir] > 0))
 249 +                mark = ct->xid[dir];
 250 +
 251 +            if (mark < 1 && (ct->xid[!dir] > 0))
 252 +                mark = ct->xid[!dir];
 253 +            goto out_mark_finish;
 254 +        }
 255 +    }
 256 +    else
 257 +        mark = (skb->mark & ~info->mask) ^ info->mark;
 258 +
 259 +out_mark_finish:
 260 +    if (mark != -1)
 261 +        skb->mark = mark;
 262 +
 263 +    curtag = &__get_cpu_var(sknid_elevator);
 264 +    if (mark > 0 && *curtag == -2 && hooknum == NF_INET_LOCAL_IN)
 265 +        *curtag = mark;
 266
 267 -       skb->mark = (skb->mark & ~info->mask) ^ info->mark;
 268         return XT_CONTINUE;
 269  }
 270
 271 diff -Nurb linux-2.6.27-521/net/netfilter/xt_MARK.c.orig linux-2.6.27-522/net/netfilter/xt_MARK.c.orig
 272 --- linux-2.6.27-521/net/netfilter/xt_MARK.c.orig       1969-12-31 19:00:00.000000000 -0500
 273 +++ linux-2.6.27-522/net/netfilter/xt_MARK.c.orig       2009-06-02 10:14:55.000000000 -0400
 274 @@ -0,0 +1,381 @@
 275 +/*
 276 + *     xt_MARK - Netfilter module to modify the NFMARK field of an skb
 277 + *
 278 + *     (C) 1999-2001 Marc Boucher <marc@mbsi.ca>
 279 + *     Copyright © CC Computer Consultants GmbH, 2007 - 2008
 280 + *     Jan Engelhardt <jengelh@computergmbh.de>
 281 + *
 282 + *     This program is free software; you can redistribute it and/or modify
 283 + *     it under the terms of the GNU General Public License version 2 as
 284 + *     published by the Free Software Foundation.
 285 + */
 286 +
 287 +#include <linux/module.h>
 288 +#include <linux/skbuff.h>
 289 +#include <linux/ip.h>
 290 +#include <net/checksum.h>
 291 +
 292 +#include <linux/netfilter/x_tables.h>
 293 +#include <linux/netfilter/xt_MARK.h>
 294 +
 295 +MODULE_LICENSE("GPL");
 296 +MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
 297 +MODULE_DESCRIPTION("Xtables: packet mark modification");
 298 +MODULE_ALIAS("ipt_MARK");
 299 +MODULE_ALIAS("ip6t_MARK");
 300 +
 301 +static unsigned int
 302 +mark_tg_v0(struct sk_buff *skb, const struct net_device *in,
 303 +           const struct net_device *out, unsigned int hooknum,
 304 +           const struct xt_target *target, const void *targinfo)
 305 +{
 306 +       const struct xt_mark_target_info *markinfo = targinfo;
 307 +
 308 +       skb->mark = markinfo->mark;
 309 +       return XT_CONTINUE;
 310 +}
 311 +
 312 +static unsigned int
 313 +mark_tg_v1(struct sk_buff *skb, const struct net_device *in,
 314 +           const struct net_device *out, unsigned int hooknum,
 315 +           const struct xt_target *target, const void *targinfo)
 316 +{
 317 +       const struct xt_mark_target_info_v1 *markinfo = targinfo;
 318 +       int mark = 0;
 319 +
 320 +       switch (markinfo->mode) {
 321 +       case XT_MARK_SET:
 322 +               mark = markinfo->mark;
 323 +               break;
 324 +
 325 +       case XT_MARK_AND:
 326 +               mark = skb->mark & markinfo->mark;
 327 +               break;
 328 +
 329 +       case XT_MARK_OR:
 330 +               mark = skb->mark | markinfo->mark;
 331 +               break;
 332 +       }
 333 +
 334 +       skb->mark = mark;
 335 +       return XT_CONTINUE;
 336 +}
 337 +
 338 +static unsigned int
 339 +mark_tg(struct sk_buff *skb, const struct net_device *in,
 340 +        const struct net_device *out, unsigned int hooknum,
 341 +        const struct xt_target *target, const void *targinfo)
 342 +{
 343 +       const struct xt_mark_tginfo2 *info = targinfo;
 344 +    long mark = -1;
 345 +
 346 +    if (info->mark == ~0U) {
 347 +        /* copy-xid */
 348 +        enum ip_conntrack_info ctinfo;
 349 +        struct sock *connection_sk;
 350 +        int dif;
 351 +        struct nf_conn *ct;
 352 +        extern struct inet_hashinfo tcp_hashinfo;
 353 +        enum ip_conntrack_dir dir;
 354 +        int *curtag;
 355 +        u_int32_t src_ip;
 356 +        u_int32_t dst_ip;
 357 +        u_int16_t proto, src_port;
 358 +        u_int32_t ip;
 359 +        u_int16_t port;
 360 +
 361 +        dif = ((struct rtable *)(skb->dst))->rt_iif;
 362 +
 363 +        ct = nf_ct_get(skb, &ctinfo);
 364 +        if (!ct)
 365 +            break;
 366 +
 367 +        dir = CTINFO2DIR(ctinfo);
 368 +        src_ip = ct->tuplehash[dir].tuple.src.u3.ip;
 369 +        dst_ip = ct->tuplehash[dir].tuple.dst.u3.ip;
 370 +        src_port = get_src_port(&ct->tuplehash[dir].tuple);
 371 +        proto = ct->tuplehash[dir].tuple.dst.protonum;
 372 +
 373 +        ip = ct->tuplehash[dir].tuple.dst.u3.ip;
 374 +        port = get_dst_port(&ct->tuplehash[dir].tuple);
 375 +
 376 +        if (proto == 1) {
 377 +            if (skb->mark > 0)
 378 +                /* The packet is marked, it's going out */
 379 +                ct->xid[0] = skb->mark;
 380 +
 381 +            if (ct->xid[0] > 0)
 382 +                mark = ct->xid[0];
 383 +        }
 384 +        else if (proto == 17) {
 385 +            struct sock *sk;
 386 +            if (!skb->mark) {
 387 +                sk = __udp4_lib_lookup(src_ip, src_port,
 388 +                        ip, port, dif, udp_hash);
 389 +
 390 +                if (sk && hooknum == NF_INET_LOCAL_IN)
 391 +                    mark = sk->sk_nid;
 392 +
 393 +                if (sk)
 394 +                    sock_put(sk);
 395 +            }
 396 +            else if (skb->mark > 0)
 397 +                /* The packet is marked, it's going out */
 398 +                ct->xid[0] = skb->mark;
 399 +        }
 400 +        else if (proto == 6) /* TCP */{
 401 +            int sockettype = 0; /* Established socket */
 402 +            struct net *net = &init_net;
 403 +
 404 +            /* Looks for an established socket or a listening
 405 +               socket corresponding to the 4-tuple, in that order.
 406 +               The order is important for Codemux connections
 407 +               to be handled properly */
 408 +
 409 +            connection_sk = inet_lookup_established(net,
 410 +                    &tcp_hashinfo, src_ip, src_port, ip, port, dif);
 411 +
 412 +            if (!connection_sk) {
 413 +                connection_sk = inet_lookup_listener(net,
 414 +                        &tcp_hashinfo, ip, port, dif);
 415 +                sockettype = 1; /* Listening socket */
 416 +            }
 417 +
 418 +            if (connection_sk) {
 419 +                /* The peercred is not set. We set it if the other side has an xid. */
 420 +                if (!PEERCRED_SET(connection_sk->sk_peercred.uid)
 421 +                        && ct->xid[!dir] > 0 && (sockettype == 0)) {
 422 +                    connection_sk->sk_peercred.gid =
 423 +                        connection_sk->sk_peercred.uid = ct->xid[!dir];
 424 +                }
 425 +
 426 +                /* The peercred is set, and is not equal to the XID of 'the other side' */
 427 +                else if (PEERCRED_SET(connection_sk->sk_peercred.uid) &&
 428 +                        (connection_sk->sk_peercred.uid != ct->xid[!dir]) &&
 429 +                        (sockettype == 0)) {
 430 +                    mark = connection_sk->sk_peercred.uid;
 431 +                }
 432 +
 433 +                /* Has this connection already been tagged? */
 434 +                if (ct->xid[dir] < 1) {
 435 +                    /* No - let's tag it */
 436 +                    ct->xid[dir]=connection_sk->sk_nid;
 437 +                }
 438 +
 439 +                if (mark == -1 && (ct->xid[dir] != 0))
 440 +                    mark = ct->xid[dir];
 441 +
 442 +                if (connection_sk->sk_state == TCP_TIME_WAIT) {
 443 +                    inet_twsk_put(inet_twsk(connection_sk));
 444 +                    break;
 445 +                } else
 446 +                    sock_put(connection_sk);
 447 +            }
 448 +
 449 +            /* All else failed. Is this a connection over raw sockets?
 450 +               That explains why we couldn't get anything out of skb->sk,
 451 +               or look up a "real" connection. */
 452 +            if (ct->xid[dir] < 1) {
 453 +                if (skb->skb_tag)
 454 +                    ct->xid[dir] = skb->skb_tag;
 455 +            }
 456 +
 457 +            /* Covers CoDemux case */
 458 +            if (mark < 1 && (ct->xid[dir] > 0))
 459 +                mark = ct->xid[dir];
 460 +
 461 +            if (mark < 1 && (ct->xid[!dir] > 0))
 462 +                mark = ct->xid[!dir];
 463 +            break;
 464 +        }
 465 +    }
 466 +    else
 467 +           mark = (skb->mark & ~info->mask) ^ info->mark;
 468 +
 469 +    if (mark != -1)
 470 +               skb->mark = mark;
 471 +
 472 +       curtag = &__get_cpu_var(sknid_elevator);
 473 +       if (mark > 0 && *curtag == -2 && hooknum == NF_INET_LOCAL_IN)
 474 +               *curtag = mark;
 475 +
 476 +       return XT_CONTINUE;
 477 +}
 478 +
 479 +static bool
 480 +mark_tg_check_v0(const char *tablename, const void *entry,
 481 +                 const struct xt_target *target, void *targinfo,
 482 +                 unsigned int hook_mask)
 483 +{
 484 +       const struct xt_mark_target_info *markinfo = targinfo;
 485 +
 486 +       if (markinfo->mark > 0xffffffff) {
 487 +               printk(KERN_WARNING "MARK: Only supports 32bit wide mark\n");
 488 +               return false;
 489 +       }
 490 +       return true;
 491 +}
 492 +
 493 +static bool
 494 +mark_tg_check_v1(const char *tablename, const void *entry,
 495 +                 const struct xt_target *target, void *targinfo,
 496 +                 unsigned int hook_mask)
 497 +{
 498 +       const struct xt_mark_target_info_v1 *markinfo = targinfo;
 499 +
 500 +       if (markinfo->mode != XT_MARK_SET
 501 +           && markinfo->mode != XT_MARK_AND
 502 +           && markinfo->mode != XT_MARK_OR) {
 503 +               printk(KERN_WARNING "MARK: unknown mode %u\n",
 504 +                      markinfo->mode);
 505 +               return false;
 506 +       }
 507 +       if (markinfo->mark > 0xffffffff) {
 508 +               printk(KERN_WARNING "MARK: Only supports 32bit wide mark\n");
 509 +               return false;
 510 +       }
 511 +       return true;
 512 +}
 513 +
 514 +#ifdef CONFIG_COMPAT
 515 +struct compat_xt_mark_target_info {
 516 +       compat_ulong_t  mark;
 517 +};
 518 +
 519 +static void mark_tg_compat_from_user_v0(void *dst, void *src)
 520 +{
 521 +       const struct compat_xt_mark_target_info *cm = src;
 522 +       struct xt_mark_target_info m = {
 523 +               .mark   = cm->mark,
 524 +       };
 525 +       memcpy(dst, &m, sizeof(m));
 526 +}
 527 +
 528 +static int mark_tg_compat_to_user_v0(void __user *dst, void *src)
 529 +{
 530 +       const struct xt_mark_target_info *m = src;
 531 +       struct compat_xt_mark_target_info cm = {
 532 +               .mark   = m->mark,
 533 +       };
 534 +       return copy_to_user(dst, &cm, sizeof(cm)) ? -EFAULT : 0;
 535 +}
 536 +
 537 +struct compat_xt_mark_target_info_v1 {
 538 +       compat_ulong_t  mark;
 539 +       u_int8_t        mode;
 540 +       u_int8_t        __pad1;
 541 +       u_int16_t       __pad2;
 542 +};
 543 +
 544 +static void mark_tg_compat_from_user_v1(void *dst, void *src)
 545 +{
 546 +       const struct compat_xt_mark_target_info_v1 *cm = src;
 547 +       struct xt_mark_target_info_v1 m = {
 548 +               .mark   = cm->mark,
 549 +               .mode   = cm->mode,
 550 +       };
 551 +       memcpy(dst, &m, sizeof(m));
 552 +}
 553 +
 554 +static int mark_tg_compat_to_user_v1(void __user *dst, void *src)
 555 +{
 556 +       const struct xt_mark_target_info_v1 *m = src;
 557 +       struct compat_xt_mark_target_info_v1 cm = {
 558 +               .mark   = m->mark,
 559 +               .mode   = m->mode,
 560 +       };
 561 +       return copy_to_user(dst, &cm, sizeof(cm)) ? -EFAULT : 0;
 562 +}
 563 +#endif /* CONFIG_COMPAT */
 564 +
 565 +static struct xt_target mark_tg_reg[] __read_mostly = {
 566 +       {
 567 +               .name           = "MARK",
 568 +               .family         = AF_INET,
 569 +               .revision       = 0,
 570 +               .checkentry     = mark_tg_check_v0,
 571 +               .target         = mark_tg_v0,
 572 +               .targetsize     = sizeof(struct xt_mark_target_info),
 573 +#ifdef CONFIG_COMPAT
 574 +               .compatsize     = sizeof(struct compat_xt_mark_target_info),
 575 +               .compat_from_user = mark_tg_compat_from_user_v0,
 576 +               .compat_to_user = mark_tg_compat_to_user_v0,
 577 +#endif
 578 +               .table          = "mangle",
 579 +               .me             = THIS_MODULE,
 580 +       },
 581 +       {
 582 +               .name           = "MARK",
 583 +               .family         = AF_INET,
 584 +               .revision       = 1,
 585 +               .checkentry     = mark_tg_check_v1,
 586 +               .target         = mark_tg_v1,
 587 +               .targetsize     = sizeof(struct xt_mark_target_info_v1),
 588 +#ifdef CONFIG_COMPAT
 589 +               .compatsize     = sizeof(struct compat_xt_mark_target_info_v1),
 590 +               .compat_from_user = mark_tg_compat_from_user_v1,
 591 +               .compat_to_user = mark_tg_compat_to_user_v1,
 592 +#endif
 593 +               .table          = "mangle",
 594 +               .me             = THIS_MODULE,
 595 +       },
 596 +       {
 597 +               .name           = "MARK",
 598 +               .family         = AF_INET6,
 599 +               .revision       = 0,
 600 +               .checkentry     = mark_tg_check_v0,
 601 +               .target         = mark_tg_v0,
 602 +               .targetsize     = sizeof(struct xt_mark_target_info),
 603 +#ifdef CONFIG_COMPAT
 604 +               .compatsize     = sizeof(struct compat_xt_mark_target_info),
 605 +               .compat_from_user = mark_tg_compat_from_user_v0,
 606 +               .compat_to_user = mark_tg_compat_to_user_v0,
 607 +#endif
 608 +               .table          = "mangle",
 609 +               .me             = THIS_MODULE,
 610 +       },
 611 +       {
 612 +               .name           = "MARK",
 613 +               .family         = AF_INET6,
 614 +               .revision       = 1,
 615 +               .checkentry     = mark_tg_check_v1,
 616 +               .target         = mark_tg_v1,
 617 +               .targetsize     = sizeof(struct xt_mark_target_info_v1),
 618 +#ifdef CONFIG_COMPAT
 619 +               .compatsize     = sizeof(struct compat_xt_mark_target_info_v1),
 620 +               .compat_from_user = mark_tg_compat_from_user_v1,
 621 +               .compat_to_user = mark_tg_compat_to_user_v1,
 622 +#endif
 623 +               .table          = "mangle",
 624 +               .me             = THIS_MODULE,
 625 +       },
 626 +       {
 627 +               .name           = "MARK",
 628 +               .revision       = 2,
 629 +               .family         = AF_INET,
 630 +               .target         = mark_tg,
 631 +               .targetsize     = sizeof(struct xt_mark_tginfo2),
 632 +               .me             = THIS_MODULE,
 633 +       },
 634 +       {
 635 +               .name           = "MARK",
 636 +               .revision       = 2,
 637 +               .family         = AF_INET6,
 638 +               .target         = mark_tg,
 639 +               .targetsize     = sizeof(struct xt_mark_tginfo2),
 640 +               .me             = THIS_MODULE,
 641 +       },
 642 +};
 643 +
 644 +static int __init mark_tg_init(void)
 645 +{
 646 +       return xt_register_targets(mark_tg_reg, ARRAY_SIZE(mark_tg_reg));
 647 +}
 648 +
 649 +static void __exit mark_tg_exit(void)
 650 +{
 651 +       xt_unregister_targets(mark_tg_reg, ARRAY_SIZE(mark_tg_reg));
 652 +}
 653 +
 654 +module_init(mark_tg_init);
 655 +module_exit(mark_tg_exit);
 656 diff -Nurb linux-2.6.27-521/scripts/basic/.docproc.cmd linux-2.6.27-522/scripts/basic/.docproc.cmd
 657 --- linux-2.6.27-521/scripts/basic/.docproc.cmd 1969-12-31 19:00:00.000000000 -0500
 658 +++ linux-2.6.27-522/scripts/basic/.docproc.cmd 2009-06-02 10:59:54.000000000 -0400
 659 @@ -0,0 +1,68 @@
 660 +cmd_scripts/basic/docproc := gcc -Wp,-MD,scripts/basic/.docproc.d -Wall -Wstrict-prototypes -O2 -fomit-frame-pointer     -o scripts/basic/docproc scripts/basic/docproc.c
 661 +
 662 +deps_scripts/basic/docproc := \
 663 +  scripts/basic/docproc.c \
 664 +  /usr/include/stdio.h \
 665 +  /usr/include/features.h \
 666 +  /usr/include/sys/cdefs.h \
 667 +  /usr/include/bits/wordsize.h \
 668 +  /usr/include/gnu/stubs.h \
 669 +  /usr/include/gnu/stubs-32.h \
 670 +  /usr/lib/gcc/i686-pc-linux-gnu/4.1.1/include/stddef.h \
 671 +  /usr/include/bits/types.h \
 672 +  /usr/include/bits/typesizes.h \
 673 +  /usr/include/libio.h \
 674 +  /usr/include/_G_config.h \
 675 +  /usr/include/wchar.h \
 676 +  /usr/include/bits/wchar.h \
 677 +  /usr/include/gconv.h \
 678 +  /usr/lib/gcc/i686-pc-linux-gnu/4.1.1/include/stdarg.h \
 679 +  /usr/include/bits/stdio_lim.h \
 680 +  /usr/include/bits/sys_errlist.h \
 681 +  /usr/include/bits/stdio.h \
 682 +  /usr/include/stdlib.h \
 683 +  /usr/include/sys/types.h \
 684 +  /usr/include/time.h \
 685 +  /usr/include/endian.h \
 686 +  /usr/include/bits/endian.h \
 687 +  /usr/include/sys/select.h \
 688 +  /usr/include/bits/select.h \
 689 +  /usr/include/bits/sigset.h \
 690 +  /usr/include/bits/time.h \
 691 +  /usr/include/sys/sysmacros.h \
 692 +  /usr/include/bits/pthreadtypes.h \
 693 +  /usr/include/alloca.h \
 694 +  /usr/include/string.h \
 695 +  /usr/include/bits/string.h \
 696 +  /usr/include/bits/string2.h \
 697 +  /usr/include/ctype.h \
 698 +  /usr/include/unistd.h \
 699 +  /usr/include/bits/posix_opt.h \
 700 +  /usr/include/bits/confname.h \
 701 +  /usr/include/getopt.h \
 702 +  /usr/lib/gcc/i686-pc-linux-gnu/4.1.1/include/limits.h \
 703 +  /usr/lib/gcc/i686-pc-linux-gnu/4.1.1/include/syslimits.h \
 704 +  /usr/include/limits.h \
 705 +  /usr/include/bits/posix1_lim.h \
 706 +  /usr/include/bits/local_lim.h \
 707 +  /usr/include/linux/limits.h \
 708 +  /usr/include/bits/posix2_lim.h \
 709 +  /usr/include/sys/wait.h \
 710 +  /usr/include/signal.h \
 711 +  /usr/include/bits/signum.h \
 712 +  /usr/include/bits/siginfo.h \
 713 +  /usr/include/bits/sigaction.h \
 714 +  /usr/include/bits/sigcontext.h \
 715 +  /usr/include/asm/sigcontext.h \
 716 +  /usr/include/asm/types.h \
 717 +  /usr/include/asm-generic/int-ll64.h \
 718 +  /usr/include/bits/sigstack.h \
 719 +  /usr/include/bits/sigthread.h \
 720 +  /usr/include/sys/resource.h \
 721 +  /usr/include/bits/resource.h \
 722 +  /usr/include/bits/waitflags.h \
 723 +  /usr/include/bits/waitstatus.h \
 724 +
 725 +scripts/basic/docproc: $(deps_scripts/basic/docproc)
 726 +
 727 +$(deps_scripts/basic/docproc):
 728 diff -Nurb linux-2.6.27-521/scripts/basic/.fixdep.cmd linux-2.6.27-522/scripts/basic/.fixdep.cmd
 729 --- linux-2.6.27-521/scripts/basic/.fixdep.cmd  1969-12-31 19:00:00.000000000 -0500
 730 +++ linux-2.6.27-522/scripts/basic/.fixdep.cmd  2009-06-02 10:59:54.000000000 -0400
 731 @@ -0,0 +1,76 @@
 732 +cmd_scripts/basic/fixdep := gcc -Wp,-MD,scripts/basic/.fixdep.d -Wall -Wstrict-prototypes -O2 -fomit-frame-pointer     -o scripts/basic/fixdep scripts/basic/fixdep.c
 733 +
 734 +deps_scripts/basic/fixdep := \
 735 +  scripts/basic/fixdep.c \
 736 +    $(wildcard include/config/his/driver.h) \
 737 +    $(wildcard include/config/my/option.h) \
 738 +    $(wildcard include/config/.h) \
 739 +    $(wildcard include/config/foo.h) \
 740 +    $(wildcard include/config/boom.h) \
 741 +  /usr/include/sys/types.h \
 742 +  /usr/include/features.h \
 743 +  /usr/include/sys/cdefs.h \
 744 +  /usr/include/bits/wordsize.h \
 745 +  /usr/include/gnu/stubs.h \
 746 +  /usr/include/gnu/stubs-32.h \
 747 +  /usr/include/bits/types.h \
 748 +  /usr/lib/gcc/i686-pc-linux-gnu/4.1.1/include/stddef.h \
 749 +  /usr/include/bits/typesizes.h \
 750 +  /usr/include/time.h \
 751 +  /usr/include/endian.h \
 752 +  /usr/include/bits/endian.h \
 753 +  /usr/include/sys/select.h \
 754 +  /usr/include/bits/select.h \
 755 +  /usr/include/bits/sigset.h \
 756 +  /usr/include/bits/time.h \
 757 +  /usr/include/sys/sysmacros.h \
 758 +  /usr/include/bits/pthreadtypes.h \
 759 +  /usr/include/sys/stat.h \
 760 +  /usr/include/bits/stat.h \
 761 +  /usr/include/sys/mman.h \
 762 +  /usr/include/bits/mman.h \
 763 +  /usr/include/unistd.h \
 764 +  /usr/include/bits/posix_opt.h \
 765 +  /usr/include/bits/confname.h \
 766 +  /usr/include/getopt.h \
 767 +  /usr/include/fcntl.h \
 768 +  /usr/include/bits/fcntl.h \
 769 +  /usr/include/string.h \
 770 +  /usr/include/bits/string.h \
 771 +  /usr/include/bits/string2.h \
 772 +  /usr/include/stdlib.h \
 773 +  /usr/include/alloca.h \
 774 +  /usr/include/stdio.h \
 775 +  /usr/include/libio.h \
 776 +  /usr/include/_G_config.h \
 777 +  /usr/include/wchar.h \
 778 +  /usr/include/bits/wchar.h \
 779 +  /usr/include/gconv.h \
 780 +  /usr/lib/gcc/i686-pc-linux-gnu/4.1.1/include/stdarg.h \
 781 +  /usr/include/bits/stdio_lim.h \
 782 +  /usr/include/bits/sys_errlist.h \
 783 +  /usr/include/bits/stdio.h \
 784 +  /usr/lib/gcc/i686-pc-linux-gnu/4.1.1/include/limits.h \
 785 +  /usr/lib/gcc/i686-pc-linux-gnu/4.1.1/include/syslimits.h \
 786 +  /usr/include/limits.h \
 787 +  /usr/include/bits/posix1_lim.h \
 788 +  /usr/include/bits/local_lim.h \
 789 +  /usr/include/linux/limits.h \
 790 +  /usr/include/bits/posix2_lim.h \
 791 +  /usr/include/ctype.h \
 792 +  /usr/include/arpa/inet.h \
 793 +  /usr/include/netinet/in.h \
 794 +  /usr/include/stdint.h \
 795 +  /usr/include/sys/socket.h \
 796 +  /usr/include/sys/uio.h \
 797 +  /usr/include/bits/uio.h \
 798 +  /usr/include/bits/socket.h \
 799 +  /usr/include/bits/sockaddr.h \
 800 +  /usr/include/asm/socket.h \
 801 +  /usr/include/asm/sockios.h \
 802 +  /usr/include/bits/in.h \
 803 +  /usr/include/bits/byteswap.h \
 804 +
 805 +scripts/basic/fixdep: $(deps_scripts/basic/fixdep)
 806 +
 807 +$(deps_scripts/basic/fixdep):
 808 Files linux-2.6.27-521/scripts/basic/docproc and linux-2.6.27-522/scripts/basic/docproc differ
 809 Files linux-2.6.27-521/scripts/basic/fixdep and linux-2.6.27-522/scripts/basic/fixdep differ