IPFire-SCM March 2012

ipfire-scm@lists.ipfire.org

1 participants
62 discussions

[IPFire-SCM] [git.ipfire.org] IPFire 3.x development tree branch, master, updated. 39c41124bb27cfd0909788d2cfc92a84cb686e4d
by git＠ipfire.org 31 Mar '12

31 Mar '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree". The branch, master has been updated via 39c41124bb27cfd0909788d2cfc92a84cb686e4d (commit) via 76dd5f8a5ee889f3f9577d1ad24f87a5830d8ad2 (commit) from 5e38e9bb4616d3f03f36a08979da34d370edd696 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 39c41124bb27cfd0909788d2cfc92a84cb686e4d Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Mar 31 21:31:39 2012 +0200 gawk: Update to 4.0.1. This is just a bugfix release. commit 76dd5f8a5ee889f3f9577d1ad24f87a5830d8ad2 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Mar 31 21:31:17 2012 +0200 apr-util: Fix typo in URL. ----------------------------------------------------------------------- Summary of changes: apr-util/apr-util.nm | 4 ++-- gawk/gawk.nm | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) Difference in files: diff --git a/apr-util/apr-util.nm b/apr-util/apr-util.nm index 3dc8a6b..a4632da 100644 --- a/apr-util/apr-util.nm +++ b/apr-util/apr-util.nm @@ -5,10 +5,10 @@ name = apr-util version = 1.4.1 -release = 1 +release = 2 groups = System/Libraries -url = ttp://apr.apache.org/ +url = http://apr.apache.org/ license = ASL 2.0 summary = Apache Portable Runtime library. diff --git a/gawk/gawk.nm b/gawk/gawk.nm index 1592522..3cd81fa 100644 --- a/gawk/gawk.nm +++ b/gawk/gawk.nm @@ -4,8 +4,8 @@ ############################################################################### name = gawk -version = 4.0.0 -release = 3 +version = 4.0.1 +release = 1 groups = System/Tools url = http://www.gnu.org/software/gawk/gawk.html @@ -19,7 +19,7 @@ description end # Needed for testsuite. -source_dl = +source_dl = http://ftp.gnu.org/gnu/gawk/ sources = %{thisapp}.tar.xz build hooks/post-receive -- IPFire 3.x development tree

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 3.x development tree branch, master, updated. 5e38e9bb4616d3f03f36a08979da34d370edd696
by git＠ipfire.org 31 Mar '12

31 Mar '12

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 2.x development tree branch, kernel-update, updated. f3d2db8c749d0803a919f92e767f1bfd6aea2f95
by git＠ipfire.org 31 Mar '12

31 Mar '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, kernel-update has been updated via f3d2db8c749d0803a919f92e767f1bfd6aea2f95 (commit) from 10e5b8609463e4957cb58b7ad5de7550ade24c84 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f3d2db8c749d0803a919f92e767f1bfd6aea2f95 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Mar 31 16:08:09 2012 +0200 kernel: rootfile update. ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/i586/linux | 2 ++ config/rootfiles/packages/linux-pae | 2 ++ config/rootfiles/packages/linux-xen | 2 ++ 3 files changed, 6 insertions(+), 0 deletions(-) Difference in files: diff --git a/config/rootfiles/common/i586/linux b/config/rootfiles/common/i586/linux index 7b9fce4..9d3c6b4 100644 --- a/config/rootfiles/common/i586/linux +++ b/config/rootfiles/common/i586/linux @@ -1555,6 +1555,8 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/fs/smbfs/smbfs.ko #lib/modules/KVER-ipfire/kernel/fs/udf #lib/modules/KVER-ipfire/kernel/fs/udf/udf.ko +#lib/modules/KVER-ipfire/kernel/fs/ufs +#lib/modules/KVER-ipfire/kernel/fs/ufs/xfs.ko #lib/modules/KVER-ipfire/kernel/fs/xfs #lib/modules/KVER-ipfire/kernel/fs/xfs/xfs.ko #lib/modules/KVER-ipfire/kernel/lib diff --git a/config/rootfiles/packages/linux-pae b/config/rootfiles/packages/linux-pae index c4899a4..9ff6677 100644 --- a/config/rootfiles/packages/linux-pae +++ b/config/rootfiles/packages/linux-pae @@ -1558,6 +1558,8 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/fs/smbfs/smbfs.ko #lib/modules/KVER-ipfire-pae/kernel/fs/udf #lib/modules/KVER-ipfire-pae/kernel/fs/udf/udf.ko +#lib/modules/KVER-ipfire-pae/kernel/fs/ufs +#lib/modules/KVER-ipfire-pae/kernel/fs/ufs/xfs.ko #lib/modules/KVER-ipfire-pae/kernel/fs/xfs #lib/modules/KVER-ipfire-pae/kernel/fs/xfs/xfs.ko #lib/modules/KVER-ipfire-pae/kernel/lib diff --git a/config/rootfiles/packages/linux-xen b/config/rootfiles/packages/linux-xen index 7a3bc21..e9a6656 100644 --- a/config/rootfiles/packages/linux-xen +++ b/config/rootfiles/packages/linux-xen @@ -1405,6 +1405,8 @@ lib/modules/KVER-ipfire-xen #lib/modules/KVER-ipfire-xen/kernel/fs/smbfs/smbfs.ko #lib/modules/KVER-ipfire-xen/kernel/fs/udf #lib/modules/KVER-ipfire-xen/kernel/fs/udf/udf.ko +#lib/modules/KVER-ipfire-xen/kernel/fs/ufs +#lib/modules/KVER-ipfire-xen/kernel/fs/ufs/xfs.ko #lib/modules/KVER-ipfire-xen/kernel/fs/xfs #lib/modules/KVER-ipfire-xen/kernel/fs/xfs/xfs.ko #lib/modules/KVER-ipfire-xen/kernel/lib hooks/post-receive -- IPFire 2.x development tree

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 2.x development tree branch, kernel-update, updated. 10e5b8609463e4957cb58b7ad5de7550ade24c84
by git＠ipfire.org 31 Mar '12

31 Mar '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, kernel-update has been updated via 10e5b8609463e4957cb58b7ad5de7550ade24c84 (commit) via 4b80e9c54258a573e954a67cfd7635732f7af78d (commit) via 6d1f929a060201df18cac385477610f472a732a8 (commit) via 16e54df92eb2bd7ce7dbcd2989a69ff5fde068ac (commit) via 903d87f49166de7dd0b085fb98282b813203f302 (commit) via cd7507011b3cd82b03768e3a12550029068fc736 (commit) via e715467b498e7d85b2dcb6d4eb40e98597bd053e (commit) from 13c69eff1c58b28076962bb7ecad280eb57a8d18 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 10e5b8609463e4957cb58b7ad5de7550ade24c84 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Mar 31 11:22:20 2012 +0200 pciutils: fix database location on arm. commit 4b80e9c54258a573e954a67cfd7635732f7af78d Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Mar 31 11:21:15 2012 +0200 cryptodev: update to 1.4. commit 6d1f929a060201df18cac385477610f472a732a8 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Mar 31 11:20:27 2012 +0200 openssl: fix aes accleration via cryptodev. commit 16e54df92eb2bd7ce7dbcd2989a69ff5fde068ac Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Mar 31 11:17:17 2012 +0200 kernel: kirkwood cfg - compile rtc into kernel commit 903d87f49166de7dd0b085fb98282b813203f302 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Mar 31 11:14:08 2012 +0200 kernel: update to 2.6.32.59. also add mv_cesa cryptochip patches for kirkwood soc. commit cd7507011b3cd82b03768e3a12550029068fc736 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Wed Mar 21 00:12:47 2012 +0100 kernel: omap - add reboot and rtc-irq patch. commit e715467b498e7d85b2dcb6d4eb40e98597bd053e Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Tue Mar 20 14:55:19 2012 +0100 kernel: omap add ipp2p patch for kernel3.0. ----------------------------------------------------------------------- Summary of changes: .../kernel/kernel.config.armv5tel-ipfire-kirkwood | 77 +- config/kernel/kernel.config.armv5tel-ipfire-omap | 1 + lfs/cryptodev | 12 +- lfs/linux | 9 +- lfs/linux3 | 6 +- lfs/openssl | 7 +- lfs/pciutils | 12 +- src/patches/linux-2.6.32-crypto-mv_cesa.patch | 647 ++++++++++++++ src/patches/linux-2.6.40-pandaboard-reboot.patch | 29 + .../linux-2.6.40-pandaboard-rtc-twl-irq.patch | 27 + ...ng.patch => linux-3.0-ipp2p-0.8.2-ipfire.patch} | 68 +- src/patches/openssl-0.9.8u-cryptodev.patch | 882 ++++++++++++++++++++ 12 files changed, 1682 insertions(+), 95 deletions(-) create mode 100644 src/patches/linux-2.6.32-crypto-mv_cesa.patch create mode 100644 src/patches/linux-2.6.40-pandaboard-reboot.patch create mode 100644 src/patches/linux-2.6.40-pandaboard-rtc-twl-irq.patch copy src/patches/{linux-2.6.32.8-ipp2p-0.8.2-pomng.patch => linux-3.0-ipp2p-0.8.2-ipfire.patch} (93%) create mode 100644 src/patches/openssl-0.9.8u-cryptodev.patch Difference in files: diff --git a/config/kernel/kernel.config.armv5tel-ipfire-kirkwood b/config/kernel/kernel.config.armv5tel-ipfire-kirkwood index dace245..f309e7c 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-kirkwood +++ b/config/kernel/kernel.config.armv5tel-ipfire-kirkwood @@ -1,7 +1,7 @@ # # Automatically generated make config: don't edit -# Linux kernel version: 2.6.32.57 -# Fri Mar 2 20:47:53 2012 +# Linux kernel version: 2.6.32.59-ipfire-kirkwood +# Sat Mar 31 11:04:12 2012 # CONFIG_ARM=y CONFIG_SYS_SUPPORTS_APM_EMULATION=y @@ -1799,7 +1799,6 @@ CONFIG_IPMI_WATCHDOG=m CONFIG_IPMI_POWEROFF=m CONFIG_HW_RANDOM=m CONFIG_HW_RANDOM_TIMERIOMEM=m -CONFIG_NVRAM=m # CONFIG_R3964 is not set # CONFIG_APPLICOM is not set @@ -2884,7 +2883,10 @@ CONFIG_LEDS_TRIGGER_NETDEV=m # CONFIG_ACCESSIBILITY is not set # CONFIG_INFINIBAND is not set CONFIG_RTC_LIB=y -CONFIG_RTC_CLASS=m +CONFIG_RTC_CLASS=y +CONFIG_RTC_HCTOSYS=y +CONFIG_RTC_HCTOSYS_DEVICE="rtc0" +# CONFIG_RTC_DEBUG is not set # # RTC interfaces @@ -2893,26 +2895,25 @@ CONFIG_RTC_INTF_SYSFS=y CONFIG_RTC_INTF_PROC=y CONFIG_RTC_INTF_DEV=y # CONFIG_RTC_INTF_DEV_UIE_EMUL is not set -CONFIG_RTC_DRV_TEST=m +# CONFIG_RTC_DRV_TEST is not set # # I2C RTC drivers # -CONFIG_RTC_DRV_DS1307=m -CONFIG_RTC_DRV_DS1374=m -CONFIG_RTC_DRV_DS1672=m -CONFIG_RTC_DRV_MAX6900=m -CONFIG_RTC_DRV_RS5C372=m -CONFIG_RTC_DRV_ISL1208=m -CONFIG_RTC_DRV_X1205=m -CONFIG_RTC_DRV_PCF8563=m -CONFIG_RTC_DRV_PCF8583=m -CONFIG_RTC_DRV_M41T80=m -# CONFIG_RTC_DRV_M41T80_WDT is not set -CONFIG_RTC_DRV_S35390A=m -CONFIG_RTC_DRV_FM3130=m -CONFIG_RTC_DRV_RX8581=m -CONFIG_RTC_DRV_RX8025=m +# CONFIG_RTC_DRV_DS1307 is not set +# CONFIG_RTC_DRV_DS1374 is not set +# CONFIG_RTC_DRV_DS1672 is not set +# CONFIG_RTC_DRV_MAX6900 is not set +# CONFIG_RTC_DRV_RS5C372 is not set +# CONFIG_RTC_DRV_ISL1208 is not set +# CONFIG_RTC_DRV_X1205 is not set +# CONFIG_RTC_DRV_PCF8563 is not set +# CONFIG_RTC_DRV_PCF8583 is not set +# CONFIG_RTC_DRV_M41T80 is not set +# CONFIG_RTC_DRV_S35390A is not set +# CONFIG_RTC_DRV_FM3130 is not set +# CONFIG_RTC_DRV_RX8581 is not set +# CONFIG_RTC_DRV_RX8025 is not set # # SPI RTC drivers @@ -2921,26 +2922,26 @@ CONFIG_RTC_DRV_RX8025=m # # Platform RTC drivers # -CONFIG_RTC_DRV_CMOS=m -CONFIG_RTC_DRV_DS1286=m -CONFIG_RTC_DRV_DS1511=m -CONFIG_RTC_DRV_DS1553=m -CONFIG_RTC_DRV_DS1742=m -CONFIG_RTC_DRV_STK17TA8=m -CONFIG_RTC_DRV_M48T86=m -CONFIG_RTC_DRV_M48T35=m -CONFIG_RTC_DRV_M48T59=m -CONFIG_RTC_DRV_BQ4802=m -CONFIG_RTC_DRV_V3020=m -CONFIG_RTC_DRV_WM831X=m -CONFIG_RTC_DRV_WM8350=m -CONFIG_RTC_DRV_PCF50633=m -CONFIG_RTC_DRV_AB3100=m +# CONFIG_RTC_DRV_CMOS is not set +# CONFIG_RTC_DRV_DS1286 is not set +# CONFIG_RTC_DRV_DS1511 is not set +# CONFIG_RTC_DRV_DS1553 is not set +# CONFIG_RTC_DRV_DS1742 is not set +# CONFIG_RTC_DRV_STK17TA8 is not set +# CONFIG_RTC_DRV_M48T86 is not set +# CONFIG_RTC_DRV_M48T35 is not set +# CONFIG_RTC_DRV_M48T59 is not set +# CONFIG_RTC_DRV_BQ4802 is not set +# CONFIG_RTC_DRV_V3020 is not set +# CONFIG_RTC_DRV_WM831X is not set +# CONFIG_RTC_DRV_WM8350 is not set +# CONFIG_RTC_DRV_PCF50633 is not set +# CONFIG_RTC_DRV_AB3100 is not set # # on-CPU RTC drivers # -CONFIG_RTC_DRV_MV=m +CONFIG_RTC_DRV_MV=y CONFIG_DMADEVICES=y # @@ -2953,7 +2954,7 @@ CONFIG_DMA_ENGINE=y # DMA Clients # # CONFIG_NET_DMA is not set -# CONFIG_ASYNC_TX_DMA is not set +CONFIG_ASYNC_TX_DMA=y CONFIG_DMATEST=m # CONFIG_AUXDISPLAY is not set CONFIG_UIO=m @@ -3447,7 +3448,7 @@ CONFIG_CRYPTO_LZO=m # CONFIG_CRYPTO_ANSI_CPRNG=m CONFIG_CRYPTO_HW=y -# CONFIG_CRYPTO_DEV_MV_CESA is not set +CONFIG_CRYPTO_DEV_MV_CESA=m CONFIG_CRYPTO_DEV_HIFN_795X=m CONFIG_CRYPTO_DEV_HIFN_795X_RNG=y # CONFIG_BINARY_PRINTF is not set diff --git a/config/kernel/kernel.config.armv5tel-ipfire-omap b/config/kernel/kernel.config.armv5tel-ipfire-omap index 542aac8..628d0db 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-omap +++ b/config/kernel/kernel.config.armv5tel-ipfire-omap @@ -800,6 +800,7 @@ CONFIG_IP_NF_RAW=m CONFIG_IP_NF_ARPTABLES=m CONFIG_IP_NF_ARPFILTER=m CONFIG_IP_NF_ARP_MANGLE=m +CONFIG_IP_NF_MATCH_IPP2P=m # # IPv6: Netfilter Configuration diff --git a/lfs/cryptodev b/lfs/cryptodev index 17a10c7..0c2f486 100644 --- a/lfs/cryptodev +++ b/lfs/cryptodev @@ -26,10 +26,10 @@ include Config VERSUFIX=ipfire$(KCFG) -VER = 20091126 +VER = 1.4 -THISAPP = cryptodev-$(VER) -DL_FILE = $(THISAPP).tar.bz2 +THISAPP = cryptodev-linux-$(VER) +DL_FILE = $(THISAPP).tar.gz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP)-kmod-$(KVER)-$(VERSUFIX) @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 26ffa32ef75bea7e980ab66166616e95 +$(DL_FILE)_MD5 = 7b0ac1c0a88d8fbe7316db02f21666e6 install : $(TARGET) @@ -74,13 +74,13 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) - @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && make build \ KERNEL_DIR=/lib/modules/$(KVER)-$(VERSUFIX)/build -mkdir -pv /usr/include/crypto cd $(DIR_APP) && make install \ KERNEL_DIR=/lib/modules/$(KVER)-$(VERSUFIX)/build - ln -svf ../crypto/cryptodev.h /usr/include/linux/cryptodev.h +# ln -svf ../crypto/cryptodev.h /usr/include/linux/cryptodev.h @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/lfs/linux b/lfs/linux index 042d096..fc60de2 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,8 +24,8 @@ include Config -PATCHLEVEL = .58 -VER = 2.6.32.58 +PATCHLEVEL = .59 +VER = 2.6.32.59 THISAPP = linux-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -82,7 +82,7 @@ patch-2.6.16-nath323-1.3.bz2 = $(URL_IPFIRE)/patch-2.6.16-nath323-1.3.bz2 reiser4-for-2.6.32.patch.bz2 = $(URL_IPFIRE)/reiser4-for-2.6.32.patch.bz2 xen-patches-2.6.32-2f.tar.bz2 = $(URL_IPFIRE)/xen-patches-2.6.32-2f.tar.bz2 -$(DL_FILE)_MD5 = 13fd1dec69337dd47eef3a1870c20314 +$(DL_FILE)_MD5 = 69c68c4a8eb0f04b051a7dbcff16f6d0 netfilter-layer7-v2.22.tar.gz_MD5 = 98dff8a3d5a31885b73341633f69501f patch-2.6.16-nath323-1.3.bz2_MD5 = f926409ff703a307baf54b57ab75d138 reiser4-for-2.6.32.patch.bz2_MD5 = 3246397973d9271eb8e6d7c97c5d2d91 @@ -163,6 +163,9 @@ endif cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.32.27_ipg-fix-driver-name.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.32.27_mcs7830-fix-driver-name.patch + # Fix mv_cesa + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.32-crypto-mv_cesa.patch + ifeq "$(KCFG)" "-kirkwood" # Add dreamplug,guruplug and icy 62x0 support on ARM-kirkwood cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.32.57-arm_kirkwood_setups.patch diff --git a/lfs/linux3 b/lfs/linux3 index 7680546..e4a4cc7 100644 --- a/lfs/linux3 +++ b/lfs/linux3 @@ -155,8 +155,8 @@ endif # Reiser4 (don't check if fail (some patches are already in xen patchset) # -cd $(DIR_APP) && bzcat $(DIR_DL)/reiser4-for-2.6.32.patch.bz2 | patch -Np1 - # ipp2p 0.8.2-pomng -# cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.32.8-ipp2p-0.8.2-pomng.patch + # ipp2p 0.8.2-ipfire + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.0-ipp2p-0.8.2-ipfire.patch # Layer7-patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/netfilter_layer7_2.22_kernel3.0.patch @@ -187,6 +187,8 @@ ifeq "$(KCFG)" "-omap" cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.40-pandaboard-wlan-fix.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.40-pandaboard-dvi720p.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.40-pandaboard-i2c-fix.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.40-pandaboard-reboot.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.40-pandaboard-rtc-twl-irq.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.x-smsc95xx-add_mac_addr_param.patch endif diff --git a/lfs/openssl b/lfs/openssl index 3336cfb..9d559e1 100644 --- a/lfs/openssl +++ b/lfs/openssl @@ -70,15 +70,12 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-0.9.8n-cryptodev.diff -ifeq "$(PADLOCK)" "1" - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-0.9.8g-engine-padlock.patch -endif + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-0.9.8u-cryptodev.patch @rm -rf /etc/ssl cd $(DIR_APP) && sed -i -e 's/mcpu/march/' config cd $(DIR_APP) && sed -i -e 's/-O3/-O2/' -e 's/-march=i486/-march=i586/' Configure cd $(DIR_APP) && ./Configure --openssldir=/etc/ssl --prefix=/usr shared linux-elf \ - zlib-dynamic no-asm 386 + zlib-dynamic no-asm 386 -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGEST cd $(DIR_APP) && make MANDIR=/usr/share/man cd $(DIR_APP) && make MANDIR=/usr/share/man install rm -rf /etc/ssl/lib diff --git a/lfs/pciutils b/lfs/pciutils index ce604c1..a17b692 100644 --- a/lfs/pciutils +++ b/lfs/pciutils @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007 Michael Tremer & Christian Schmidt # +# Copyright (C) 2012 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -83,15 +83,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/pciutils-2.1.99-gcc4.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/pciutils-2.2.3-multilib.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/pciutils-2.2.3-sata.patch -ifeq "$(LFS_PASS)" "install" - cd $(DIR_APP)/lib && CFLAGS="-Os -fomit-frame-pointer" ./configure - cd $(DIR_APP)/lib && CFLAGS="-Os -fomit-frame-pointer" make $(MAKETUNING) - -mkdir -p /opt/$(MACHINE)-uClibc/include/pci - cd $(DIR_APP) && install -m 0644 lib/libpci.a /opt/$(MACHINE)-uClibc/lib - cd $(DIR_APP) && install -m 0644 lib/*.h /opt/$(MACHINE)-uClibc/include/pci -else ifeq "$(MACHINE_TYPE)" "arm" - cd $(DIR_APP)/lib && ./configure + cd $(DIR_APP)/lib && ./configure /usr/share/hwdata $(VER) cd $(DIR_APP)/lib && sed -e "s/^#error.*$$/#define CPU_ARCH_ARM/" -i config.h endif cd $(DIR_APP) && make PREFIX=/usr $(MAKETUNING) @@ -99,6 +92,5 @@ endif cd $(DIR_APP) && install -v -m 755 -d /usr/include/pci cd $(DIR_APP) && install -v -m 644 lib/libpci.a /usr/lib cd $(DIR_APP) && install -v -m 644 lib/*.h /usr/include/pci -endif @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/src/patches/linux-2.6.32-crypto-mv_cesa.patch b/src/patches/linux-2.6.32-crypto-mv_cesa.patch new file mode 100644 index 0000000..cc85d52 --- /dev/null +++ b/src/patches/linux-2.6.32-crypto-mv_cesa.patch @@ -0,0 +1,647 @@ +From 0328ac267564089d9cedfb568f936d30a6debd21 Mon Sep 17 00:00:00 2001 +From: Uri Simchoni <uri(a)jdland.co.il> +Date: Thu, 8 Apr 2010 19:25:37 +0300 +Subject: [PATCH] crypto: mv_cesa - Invoke the user callback from a softirq + context + +Invoke the user callback from a softirq context + +Signed-off-by: Uri Simchoni <uri(a)jdland.co.il> +Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> +--- + drivers/crypto/mv_cesa.c | 2 ++ + 1 files changed, 2 insertions(+), 0 deletions(-) + +diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c +index b21ef63..3e60ba9 100644 +--- a/drivers/crypto/mv_cesa.c ++++ b/drivers/crypto/mv_cesa.c +@@ -275,7 +275,9 @@ static void dequeue_complete_req(void) + sg_miter_stop(&cpg->p.dst_sg_it); + mv_crypto_algo_completion(); + cpg->eng_st = ENGINE_IDLE; ++ local_bh_disable(); + req->base.complete(&req->base, 0); ++ local_bh_enable(); + } + } + +-- +1.7.6.5 +From 6bc6fcd609080461682c5cc0a1e3bf4345d6419d Mon Sep 17 00:00:00 2001 +From: Uri Simchoni <uri(a)jdland.co.il> +Date: Thu, 8 Apr 2010 19:25:56 +0300 +Subject: [PATCH] crypto: mv_cesa - Remove compiler warning in mv_cesa driver + +Remove compiler warning + +Signed-off-by: Uri Simchoni <uri(a)jdland.co.il> +Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> +--- + drivers/crypto/mv_cesa.c | 1 + + 1 files changed, 1 insertions(+), 0 deletions(-) + +diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c +index 3e60ba9..37d9f06 100644 +--- a/drivers/crypto/mv_cesa.c ++++ b/drivers/crypto/mv_cesa.c +@@ -178,6 +178,7 @@ static void mv_process_current_q(int first_block) + op.config = CFG_OP_CRYPT_ONLY | CFG_ENCM_AES | CFG_ENC_MODE_ECB; + break; + case COP_AES_CBC: ++ default: + op.config = CFG_OP_CRYPT_ONLY | CFG_ENCM_AES | CFG_ENC_MODE_CBC; + op.enc_iv = ENC_IV_POINT(SRAM_DATA_IV) | + ENC_IV_BUF_POINT(SRAM_DATA_IV_BUF); +-- +1.7.6.5 +X-Git-Url: http://git.kernelconcepts.de/?p=mv-sheeva.git;a=blobdiff_plain;f=drivers%2F… + +diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c +index 37d9f06..018a95c 100644 +--- a/drivers/crypto/mv_cesa.c ++++ b/drivers/crypto/mv_cesa.c +@@ -242,6 +242,8 @@ static void dequeue_complete_req(void) + struct ablkcipher_request *req = cpg->cur_req; + void *buf; + int ret; ++ int need_copy_len = cpg->p.crypt_len; ++ int sram_offset = 0; + + cpg->p.total_req_bytes += cpg->p.crypt_len; + do { +@@ -257,14 +259,16 @@ static void dequeue_complete_req(void) + buf = cpg->p.dst_sg_it.addr; + buf += cpg->p.dst_start; + +- dst_copy = min(cpg->p.crypt_len, cpg->p.sg_dst_left); +- +- memcpy(buf, cpg->sram + SRAM_DATA_OUT_START, dst_copy); ++ dst_copy = min(need_copy_len, cpg->p.sg_dst_left); + ++ memcpy(buf, ++ cpg->sram + SRAM_DATA_OUT_START + sram_offset, ++ dst_copy); ++ sram_offset += dst_copy; + cpg->p.sg_dst_left -= dst_copy; +- cpg->p.crypt_len -= dst_copy; ++ need_copy_len -= dst_copy; + cpg->p.dst_start += dst_copy; +- } while (cpg->p.crypt_len > 0); ++ } while (need_copy_len > 0); + + BUG_ON(cpg->eng_st != ENGINE_W_DEQUEUE); + if (cpg->p.total_req_bytes < req->nbytes) { +From 15d4dd3594221f11a7730fcf2d5f9942b96cdd7e Mon Sep 17 00:00:00 2001 +From: Uri Simchoni <uri(a)jdland.co.il> +Date: Thu, 8 Apr 2010 19:27:02 +0300 +Subject: [PATCH] crypto: mv_cesa - Fix situations where the src sglist spans + more data than the request asks for + +Fix for situations where the source scatterlist spans more data than the +request nbytes + +Signed-off-by: Uri Simchoni <uri(a)jdland.co.il> +Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> +--- + drivers/crypto/mv_cesa.c | 66 ++++++++++++++++++++++++++++++--------------- + 1 files changed, 44 insertions(+), 22 deletions(-) + +diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c +index 018a95c..096f9ff 100644 +--- a/drivers/crypto/mv_cesa.c ++++ b/drivers/crypto/mv_cesa.c +@@ -143,27 +143,45 @@ static int mv_setkey_aes(struct crypto_ablkcipher *cipher, const u8 *key, + return 0; + } + +-static void setup_data_in(struct ablkcipher_request *req) ++static void copy_src_to_buf(struct req_progress *p, char *dbuf, int len) + { + int ret; +- void *buf; +- +- if (!cpg->p.sg_src_left) { +- ret = sg_miter_next(&cpg->p.src_sg_it); +- BUG_ON(!ret); +- cpg->p.sg_src_left = cpg->p.src_sg_it.length; +- cpg->p.src_start = 0; +- } ++ void *sbuf; ++ int copied = 0; + +- cpg->p.crypt_len = min(cpg->p.sg_src_left, cpg->max_req_size); +- +- buf = cpg->p.src_sg_it.addr; +- buf += cpg->p.src_start; ++ while (1) { ++ if (!p->sg_src_left) { ++ ret = sg_miter_next(&p->src_sg_it); ++ BUG_ON(!ret); ++ p->sg_src_left = p->src_sg_it.length; ++ p->src_start = 0; ++ } + +- memcpy(cpg->sram + SRAM_DATA_IN_START, buf, cpg->p.crypt_len); ++ sbuf = p->src_sg_it.addr + p->src_start; ++ ++ if (p->sg_src_left <= len - copied) { ++ memcpy(dbuf + copied, sbuf, p->sg_src_left); ++ copied += p->sg_src_left; ++ p->sg_src_left = 0; ++ if (copied >= len) ++ break; ++ } else { ++ int copy_len = len - copied; ++ memcpy(dbuf + copied, sbuf, copy_len); ++ p->src_start += copy_len; ++ p->sg_src_left -= copy_len; ++ break; ++ } ++ } ++} + +- cpg->p.sg_src_left -= cpg->p.crypt_len; +- cpg->p.src_start += cpg->p.crypt_len; ++static void setup_data_in(struct ablkcipher_request *req) ++{ ++ struct req_progress *p = &cpg->p; ++ p->crypt_len = ++ min((int)req->nbytes - p->total_req_bytes, cpg->max_req_size); ++ copy_src_to_buf(p, cpg->sram + SRAM_DATA_IN_START, ++ p->crypt_len); + } + + static void mv_process_current_q(int first_block) +@@ -289,12 +307,16 @@ static void dequeue_complete_req(void) + static int count_sgs(struct scatterlist *sl, unsigned int total_bytes) + { + int i = 0; +- +- do { +- total_bytes -= sl[i].length; +- i++; +- +- } while (total_bytes > 0); ++ size_t cur_len; ++ ++ while (1) { ++ cur_len = sl[i].length; ++ ++i; ++ if (total_bytes > cur_len) ++ total_bytes -= cur_len; ++ else ++ break; ++ } + + return i; + } +-- +1.7.6.5 +From 3b61a90502481045f56c1c41a2af35ee48ca8b80 Mon Sep 17 00:00:00 2001 +From: Uri Simchoni <uri(a)jdland.co.il> +Date: Thu, 8 Apr 2010 19:27:33 +0300 +Subject: [PATCH] crypto: mv_cesa - Enqueue generic async requests + +Enqueue generic async requests rather than ablkcipher requests +in the driver's queue + +Signed-off-by: Uri Simchoni <uri(a)jdland.co.il> +Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> +--- + drivers/crypto/mv_cesa.c | 43 ++++++++++++++++++++++++------------------- + 1 files changed, 24 insertions(+), 19 deletions(-) + +diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c +index 096f9ff..8891e2e 100644 +--- a/drivers/crypto/mv_cesa.c ++++ b/drivers/crypto/mv_cesa.c +@@ -39,6 +39,7 @@ enum engine_status { + * @sg_src_left: bytes left in src to process (scatter list) + * @src_start: offset to add to src start position (scatter list) + * @crypt_len: length of current crypt process ++ * @hw_nbytes: total bytes to process in hw for this request + * @sg_dst_left: bytes left dst to process in this scatter list + * @dst_start: offset to add to dst start position (scatter list) + * @total_req_bytes: total number of bytes processed (request). +@@ -55,6 +56,7 @@ struct req_progress { + int sg_src_left; + int src_start; + int crypt_len; ++ int hw_nbytes; + /* dst mostly */ + int sg_dst_left; + int dst_start; +@@ -71,7 +73,7 @@ struct crypto_priv { + spinlock_t lock; + struct crypto_queue queue; + enum engine_status eng_st; +- struct ablkcipher_request *cur_req; ++ struct crypto_async_request *cur_req; + struct req_progress p; + int max_req_size; + int sram_size; +@@ -175,18 +177,18 @@ static void copy_src_to_buf(struct req_progress *p, char *dbuf, int len) + } + } + +-static void setup_data_in(struct ablkcipher_request *req) ++static void setup_data_in(void) + { + struct req_progress *p = &cpg->p; + p->crypt_len = +- min((int)req->nbytes - p->total_req_bytes, cpg->max_req_size); ++ min(p->hw_nbytes - p->total_req_bytes, cpg->max_req_size); + copy_src_to_buf(p, cpg->sram + SRAM_DATA_IN_START, + p->crypt_len); + } + + static void mv_process_current_q(int first_block) + { +- struct ablkcipher_request *req = cpg->cur_req; ++ struct ablkcipher_request *req = ablkcipher_request_cast(cpg->cur_req); + struct mv_ctx *ctx = crypto_tfm_ctx(req->base.tfm); + struct mv_req_ctx *req_ctx = ablkcipher_request_ctx(req); + struct sec_accel_config op; +@@ -229,7 +231,7 @@ static void mv_process_current_q(int first_block) + ENC_P_DST(SRAM_DATA_OUT_START); + op.enc_key_p = SRAM_DATA_KEY_P; + +- setup_data_in(req); ++ setup_data_in(); + op.enc_len = cpg->p.crypt_len; + memcpy(cpg->sram + SRAM_CONFIG, &op, + sizeof(struct sec_accel_config)); +@@ -246,7 +248,7 @@ static void mv_process_current_q(int first_block) + + static void mv_crypto_algo_completion(void) + { +- struct ablkcipher_request *req = cpg->cur_req; ++ struct ablkcipher_request *req = ablkcipher_request_cast(cpg->cur_req); + struct mv_req_ctx *req_ctx = ablkcipher_request_ctx(req); + + if (req_ctx->op != COP_AES_CBC) +@@ -257,7 +259,7 @@ static void mv_crypto_algo_completion(void) + + static void dequeue_complete_req(void) + { +- struct ablkcipher_request *req = cpg->cur_req; ++ struct crypto_async_request *req = cpg->cur_req; + void *buf; + int ret; + int need_copy_len = cpg->p.crypt_len; +@@ -289,7 +291,7 @@ static void dequeue_complete_req(void) + } while (need_copy_len > 0); + + BUG_ON(cpg->eng_st != ENGINE_W_DEQUEUE); +- if (cpg->p.total_req_bytes < req->nbytes) { ++ if (cpg->p.total_req_bytes < cpg->p.hw_nbytes) { + /* process next scatter list entry */ + cpg->eng_st = ENGINE_BUSY; + mv_process_current_q(0); +@@ -299,7 +301,7 @@ static void dequeue_complete_req(void) + mv_crypto_algo_completion(); + cpg->eng_st = ENGINE_IDLE; + local_bh_disable(); +- req->base.complete(&req->base, 0); ++ req->complete(req, 0); + local_bh_enable(); + } + } +@@ -323,16 +325,19 @@ static int count_sgs(struct scatterlist *sl, unsigned int total_bytes) + + static void mv_enqueue_new_req(struct ablkcipher_request *req) + { ++ struct req_progress *p = &cpg->p; + int num_sgs; + +- cpg->cur_req = req; +- memset(&cpg->p, 0, sizeof(struct req_progress)); ++ cpg->cur_req = &req->base; ++ memset(p, 0, sizeof(struct req_progress)); ++ p->hw_nbytes = req->nbytes; + + num_sgs = count_sgs(req->src, req->nbytes); +- sg_miter_start(&cpg->p.src_sg_it, req->src, num_sgs, SG_MITER_FROM_SG); ++ sg_miter_start(&p->src_sg_it, req->src, num_sgs, SG_MITER_FROM_SG); + + num_sgs = count_sgs(req->dst, req->nbytes); +- sg_miter_start(&cpg->p.dst_sg_it, req->dst, num_sgs, SG_MITER_TO_SG); ++ sg_miter_start(&p->dst_sg_it, req->dst, num_sgs, SG_MITER_TO_SG); ++ + mv_process_current_q(1); + } + +@@ -378,13 +383,13 @@ static int queue_manag(void *data) + return 0; + } + +-static int mv_handle_req(struct ablkcipher_request *req) ++static int mv_handle_req(struct crypto_async_request *req) + { + unsigned long flags; + int ret; + + spin_lock_irqsave(&cpg->lock, flags); +- ret = ablkcipher_enqueue_request(&cpg->queue, req); ++ ret = crypto_enqueue_request(&cpg->queue, req); + spin_unlock_irqrestore(&cpg->lock, flags); + wake_up_process(cpg->queue_th); + return ret; +@@ -397,7 +402,7 @@ static int mv_enc_aes_ecb(struct ablkcipher_request *req) + req_ctx->op = COP_AES_ECB; + req_ctx->decrypt = 0; + +- return mv_handle_req(req); ++ return mv_handle_req(&req->base); + } + + static int mv_dec_aes_ecb(struct ablkcipher_request *req) +@@ -409,7 +414,7 @@ static int mv_dec_aes_ecb(struct ablkcipher_request *req) + req_ctx->decrypt = 1; + + compute_aes_dec_key(ctx); +- return mv_handle_req(req); ++ return mv_handle_req(&req->base); + } + + static int mv_enc_aes_cbc(struct ablkcipher_request *req) +@@ -419,7 +424,7 @@ static int mv_enc_aes_cbc(struct ablkcipher_request *req) + req_ctx->op = COP_AES_CBC; + req_ctx->decrypt = 0; + +- return mv_handle_req(req); ++ return mv_handle_req(&req->base); + } + + static int mv_dec_aes_cbc(struct ablkcipher_request *req) +@@ -431,7 +436,7 @@ static int mv_dec_aes_cbc(struct ablkcipher_request *req) + req_ctx->decrypt = 1; + + compute_aes_dec_key(ctx); +- return mv_handle_req(req); ++ return mv_handle_req(&req->base); + } + + static int mv_cra_init(struct crypto_tfm *tfm) +-- +1.7.6.5 +From 7a5f691ef03f4c01d2703b5ec4ddd4c17e645dec Mon Sep 17 00:00:00 2001 +From: Uri Simchoni <uri(a)jdland.co.il> +Date: Thu, 8 Apr 2010 19:29:16 +0300 +Subject: [PATCH] crypto: mv_cesa - Rename a variable to a more suitable name + +Rename a variable to a more suitable name + +Signed-off-by: Uri Simchoni <uri(a)jdland.co.il> +Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> +--- + drivers/crypto/mv_cesa.c | 10 +++++----- + 1 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c +index 8891e2e..4262932 100644 +--- a/drivers/crypto/mv_cesa.c ++++ b/drivers/crypto/mv_cesa.c +@@ -42,7 +42,7 @@ enum engine_status { + * @hw_nbytes: total bytes to process in hw for this request + * @sg_dst_left: bytes left dst to process in this scatter list + * @dst_start: offset to add to dst start position (scatter list) +- * @total_req_bytes: total number of bytes processed (request). ++ * @hw_processed_bytes: number of bytes processed by hw (request). + * + * sg helper are used to iterate over the scatterlist. Since the size of the + * SRAM may be less than the scatter size, this struct struct is used to keep +@@ -60,7 +60,7 @@ struct req_progress { + /* dst mostly */ + int sg_dst_left; + int dst_start; +- int total_req_bytes; ++ int hw_processed_bytes; + }; + + struct crypto_priv { +@@ -181,7 +181,7 @@ static void setup_data_in(void) + { + struct req_progress *p = &cpg->p; + p->crypt_len = +- min(p->hw_nbytes - p->total_req_bytes, cpg->max_req_size); ++ min(p->hw_nbytes - p->hw_processed_bytes, cpg->max_req_size); + copy_src_to_buf(p, cpg->sram + SRAM_DATA_IN_START, + p->crypt_len); + } +@@ -265,7 +265,7 @@ static void dequeue_complete_req(void) + int need_copy_len = cpg->p.crypt_len; + int sram_offset = 0; + +- cpg->p.total_req_bytes += cpg->p.crypt_len; ++ cpg->p.hw_processed_bytes += cpg->p.crypt_len; + do { + int dst_copy; + +@@ -291,7 +291,7 @@ static void dequeue_complete_req(void) + } while (need_copy_len > 0); + + BUG_ON(cpg->eng_st != ENGINE_W_DEQUEUE); +- if (cpg->p.total_req_bytes < cpg->p.hw_nbytes) { ++ if (cpg->p.hw_processed_bytes < cpg->p.hw_nbytes) { + /* process next scatter list entry */ + cpg->eng_st = ENGINE_BUSY; + mv_process_current_q(0); +-- +1.6.5.GIT +From a58094ac5f95d6969e5c52ff096d2fd2864542af Mon Sep 17 00:00:00 2001 +From: Uri Simchoni <uri(a)jdland.co.il> +Date: Thu, 8 Apr 2010 19:30:19 +0300 +Subject: [PATCH] crypto: mv_cesa - Execute some code via function pointers + rathr than direct calls + +Execute some code via function pointers rathr than direct calls +(to allow customization in the hashing request) + +Signed-off-by: Uri Simchoni <uri(a)jdland.co.il> +Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> +--- + drivers/crypto/mv_cesa.c | 13 +++++++++---- + 1 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c +index 4262932..2b4f07a 100644 +--- a/drivers/crypto/mv_cesa.c ++++ b/drivers/crypto/mv_cesa.c +@@ -51,6 +51,8 @@ enum engine_status { + struct req_progress { + struct sg_mapping_iter src_sg_it; + struct sg_mapping_iter dst_sg_it; ++ void (*complete) (void); ++ void (*process) (int is_first); + + /* src mostly */ + int sg_src_left; +@@ -251,6 +253,9 @@ static void mv_crypto_algo_completion(void) + struct ablkcipher_request *req = ablkcipher_request_cast(cpg->cur_req); + struct mv_req_ctx *req_ctx = ablkcipher_request_ctx(req); + ++ sg_miter_stop(&cpg->p.src_sg_it); ++ sg_miter_stop(&cpg->p.dst_sg_it); ++ + if (req_ctx->op != COP_AES_CBC) + return ; + +@@ -294,11 +299,9 @@ static void dequeue_complete_req(void) + if (cpg->p.hw_processed_bytes < cpg->p.hw_nbytes) { + /* process next scatter list entry */ + cpg->eng_st = ENGINE_BUSY; +- mv_process_current_q(0); ++ cpg->p.process(0); + } else { +- sg_miter_stop(&cpg->p.src_sg_it); +- sg_miter_stop(&cpg->p.dst_sg_it); +- mv_crypto_algo_completion(); ++ cpg->p.complete(); + cpg->eng_st = ENGINE_IDLE; + local_bh_disable(); + req->complete(req, 0); +@@ -331,6 +334,8 @@ static void mv_enqueue_new_req(struct ablkcipher_request *req) + cpg->cur_req = &req->base; + memset(p, 0, sizeof(struct req_progress)); + p->hw_nbytes = req->nbytes; ++ p->complete = mv_crypto_algo_completion; ++ p->process = mv_process_current_q; + + num_sgs = count_sgs(req->src, req->nbytes); + sg_miter_start(&p->src_sg_it, req->src, num_sgs, SG_MITER_FROM_SG); +-- +1.7.6.5 +X-Git-Url: http://git.kernelconcepts.de/?p=mv-sheeva.git;a=blobdiff_plain;f=drivers%2F… + +diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c +index 2b4f07a..49a2206 100644 +--- a/drivers/crypto/mv_cesa.c ++++ b/drivers/crypto/mv_cesa.c +@@ -40,6 +40,7 @@ enum engine_status { + * @src_start: offset to add to src start position (scatter list) + * @crypt_len: length of current crypt process + * @hw_nbytes: total bytes to process in hw for this request ++ * @copy_back: whether to copy data back (crypt) or not (hash) + * @sg_dst_left: bytes left dst to process in this scatter list + * @dst_start: offset to add to dst start position (scatter list) + * @hw_processed_bytes: number of bytes processed by hw (request). +@@ -60,6 +61,7 @@ struct req_progress { + int crypt_len; + int hw_nbytes; + /* dst mostly */ ++ int copy_back; + int sg_dst_left; + int dst_start; + int hw_processed_bytes; +@@ -267,33 +269,35 @@ static void dequeue_complete_req(void) + struct crypto_async_request *req = cpg->cur_req; + void *buf; + int ret; +- int need_copy_len = cpg->p.crypt_len; +- int sram_offset = 0; +- + cpg->p.hw_processed_bytes += cpg->p.crypt_len; +- do { +- int dst_copy; ++ if (cpg->p.copy_back) { ++ int need_copy_len = cpg->p.crypt_len; ++ int sram_offset = 0; ++ do { ++ int dst_copy; ++ ++ if (!cpg->p.sg_dst_left) { ++ ret = sg_miter_next(&cpg->p.dst_sg_it); ++ BUG_ON(!ret); ++ cpg->p.sg_dst_left = cpg->p.dst_sg_it.length; ++ cpg->p.dst_start = 0; ++ } + +- if (!cpg->p.sg_dst_left) { +- ret = sg_miter_next(&cpg->p.dst_sg_it); +- BUG_ON(!ret); +- cpg->p.sg_dst_left = cpg->p.dst_sg_it.length; +- cpg->p.dst_start = 0; +- } ++ buf = cpg->p.dst_sg_it.addr; ++ buf += cpg->p.dst_start; + +- buf = cpg->p.dst_sg_it.addr; +- buf += cpg->p.dst_start; ++ dst_copy = min(need_copy_len, cpg->p.sg_dst_left); + +- dst_copy = min(need_copy_len, cpg->p.sg_dst_left); ++ memcpy(buf, ++ cpg->sram + SRAM_DATA_OUT_START + sram_offset, ++ dst_copy); ++ sram_offset += dst_copy; ++ cpg->p.sg_dst_left -= dst_copy; ++ need_copy_len -= dst_copy; ++ cpg->p.dst_start += dst_copy; ++ } while (need_copy_len > 0); ++ } + +- memcpy(buf, +- cpg->sram + SRAM_DATA_OUT_START + sram_offset, +- dst_copy); +- sram_offset += dst_copy; +- cpg->p.sg_dst_left -= dst_copy; +- need_copy_len -= dst_copy; +- cpg->p.dst_start += dst_copy; +- } while (need_copy_len > 0); + + BUG_ON(cpg->eng_st != ENGINE_W_DEQUEUE); + if (cpg->p.hw_processed_bytes < cpg->p.hw_nbytes) { +@@ -336,6 +340,7 @@ static void mv_enqueue_new_req(struct ablkcipher_request *req) + p->hw_nbytes = req->nbytes; + p->complete = mv_crypto_algo_completion; + p->process = mv_process_current_q; ++ p->copy_back = 1; + + num_sgs = count_sgs(req->src, req->nbytes); + sg_miter_start(&p->src_sg_it, req->src, num_sgs, SG_MITER_FROM_SG); +From 0c5c6c4bae8fe9ae3d86b44c332eb1267df1ec99 Mon Sep 17 00:00:00 2001 +From: Uri Simchoni <uri(a)jdland.co.il> +Date: Thu, 8 Apr 2010 19:33:26 +0300 +Subject: [PATCH] crypto: mv_cesa - Support processing of data from previous + requests + +Support processing of data from previous requests (as in hashing +update/final requests). + +Signed-off-by: Uri Simchoni <uri(a)jdland.co.il> +Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> +--- + drivers/crypto/mv_cesa.c | 8 +++++--- + 1 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c +index 49a2206..d0fb10e 100644 +--- a/drivers/crypto/mv_cesa.c ++++ b/drivers/crypto/mv_cesa.c +@@ -184,10 +184,11 @@ static void copy_src_to_buf(struct req_progress *p, char *dbuf, int len) + static void setup_data_in(void) + { + struct req_progress *p = &cpg->p; +- p->crypt_len = ++ int data_in_sram = + min(p->hw_nbytes - p->hw_processed_bytes, cpg->max_req_size); +- copy_src_to_buf(p, cpg->sram + SRAM_DATA_IN_START, +- p->crypt_len); ++ copy_src_to_buf(p, cpg->sram + SRAM_DATA_IN_START + p->crypt_len, ++ data_in_sram - p->crypt_len); ++ p->crypt_len = data_in_sram; + } + + static void mv_process_current_q(int first_block) +@@ -298,6 +299,7 @@ static void dequeue_complete_req(void) + } while (need_copy_len > 0); + } + ++ cpg->p.crypt_len = 0; + + BUG_ON(cpg->eng_st != ENGINE_W_DEQUEUE); + if (cpg->p.hw_processed_bytes < cpg->p.hw_nbytes) { +-- +1.7.6.5 diff --git a/src/patches/linux-2.6.40-pandaboard-reboot.patch b/src/patches/linux-2.6.40-pandaboard-reboot.patch new file mode 100644 index 0000000..8e37837 --- /dev/null +++ b/src/patches/linux-2.6.40-pandaboard-reboot.patch @@ -0,0 +1,29 @@ +With commit 3d3f78d752bf, reboot seems to broken on ARM +machines. CPU dies while doing flush_pmd_entry() as part of +setup_mm_for_reboot() + +I know this is not the fix but intention is to report the +issue and also provide temporary fix till it get fixed correctly + +Signed-off-by: Santosh Shilimkar <santosh.shilimkar@xxxxxx> +Reported-by: Anand Gadiyar <gadiyar@xxxxxx> +--- +Tested with OMAP4 device. + + arch/arm/kernel/process.c | 1 - + 1 files changed, 0 insertions(+), 1 deletions(-) + +diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c +index e76fcaa..ac370b2 100644 +--- a/arch/arm/kernel/process.c ++++ b/arch/arm/kernel/process.c +@@ -247,7 +247,6 @@ void machine_power_off(void) + + void machine_restart(char *cmd) + { +- machine_shutdown(); + arm_pm_restart(reboot_mode, cmd); + } + +-- +1.6.0.4 diff --git a/src/patches/linux-2.6.40-pandaboard-rtc-twl-irq.patch b/src/patches/linux-2.6.40-pandaboard-rtc-twl-irq.patch new file mode 100644 index 0000000..dc1182d --- /dev/null +++ b/src/patches/linux-2.6.40-pandaboard-rtc-twl-irq.patch @@ -0,0 +1,27 @@ +diff -Naur linux-3.0.24.org/drivers/rtc/rtc-twl.c linux-3.0.24/drivers/rtc/rtc-twl.c +--- linux-3.0.24.org/drivers/rtc/rtc-twl.c 2012-03-12 18:58:19.000000000 +0100 ++++ linux-3.0.24/drivers/rtc/rtc-twl.c 2012-03-20 23:24:52.213578926 +0100 +@@ -362,14 +362,6 @@ + int res; + u8 rd_reg; + +-#ifdef CONFIG_LOCKDEP +- /* WORKAROUND for lockdep forcing IRQF_DISABLED on us, which +- * we don't want and can't tolerate. Although it might be +- * friendlier not to borrow this thread context... +- */ +- local_irq_enable(); +-#endif +- + res = twl_rtc_read_u8(&rd_reg, REG_RTC_STATUS_REG); + if (res) + goto out; +@@ -462,7 +454,7 @@ + if (ret < 0) + goto out1; + +- ret = request_irq(irq, twl_rtc_interrupt, ++ ret = request_threaded_irq(irq, NULL, twl_rtc_interrupt, + IRQF_TRIGGER_RISING, + dev_name(&rtc->dev), rtc); + if (ret < 0) { diff --git a/src/patches/linux-3.0-ipp2p-0.8.2-ipfire.patch b/src/patches/linux-3.0-ipp2p-0.8.2-ipfire.patch new file mode 100644 index 0000000..34cba84 --- /dev/null +++ b/src/patches/linux-3.0-ipp2p-0.8.2-ipfire.patch @@ -0,0 +1,1039 @@ +diff -Naur linux-3.0.24.org/include/linux/netfilter_ipv4/ipt_ipp2p.h linux-3.0.24/include/linux/netfilter_ipv4/ipt_ipp2p.h +--- linux-3.0.24.org/include/linux/netfilter_ipv4/ipt_ipp2p.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-3.0.24/include/linux/netfilter_ipv4/ipt_ipp2p.h 2012-03-20 09:29:20.616541362 +0100 +@@ -0,0 +1,31 @@ ++#ifndef __IPT_IPP2P_H ++#define __IPT_IPP2P_H ++#define IPP2P_VERSION "0.8.2-ipfire" ++ ++struct ipt_p2p_info { ++ int cmd; ++ int debug; ++}; ++ ++#endif //__IPT_IPP2P_H ++ ++#define SHORT_HAND_IPP2P 1 /* --ipp2p switch*/ ++//#define SHORT_HAND_DATA 4 /* --ipp2p-data switch*/ ++#define SHORT_HAND_NONE 5 /* no short hand*/ ++ ++#define IPP2P_EDK (1 << 1) ++#define IPP2P_DATA_KAZAA (1 << 2) ++#define IPP2P_DATA_EDK (1 << 3) ++#define IPP2P_DATA_DC (1 << 4) ++#define IPP2P_DC (1 << 5) ++#define IPP2P_DATA_GNU (1 << 6) ++#define IPP2P_GNU (1 << 7) ++#define IPP2P_KAZAA (1 << 8) ++#define IPP2P_BIT (1 << 9) ++#define IPP2P_APPLE (1 << 10) ++#define IPP2P_SOUL (1 << 11) ++#define IPP2P_WINMX (1 << 12) ++#define IPP2P_ARES (1 << 13) ++#define IPP2P_MUTE (1 << 14) ++#define IPP2P_WASTE (1 << 15) ++#define IPP2P_XDCC (1 << 16) +diff -Naur linux-3.0.24.org/net/ipv4/netfilter/ipt_ipp2p.c linux-3.0.24/net/ipv4/netfilter/ipt_ipp2p.c +--- linux-3.0.24.org/net/ipv4/netfilter/ipt_ipp2p.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-3.0.24/net/ipv4/netfilter/ipt_ipp2p.c 2012-03-20 11:26:38.593101443 +0100 +@@ -0,0 +1,970 @@ ++#if defined(MODVERSIONS) ++#include <linux/modversions.h> ++#endif ++#include <linux/module.h> ++#include <linux/version.h> ++#include <linux/netfilter_ipv4/ip_tables.h> ++#include <linux/netfilter_ipv4/ipt_ipp2p.h> ++#include <net/tcp.h> ++#include <net/udp.h> ++ ++#define get_u8(X,O) (*(__u8 *)(X + O)) ++#define get_u16(X,O) (*(__u16 *)(X + O)) ++#define get_u32(X,O) (*(__u32 *)(X + O)) ++ ++MODULE_AUTHOR("Eicke Friedrich/Klaus Degner <ipp2p(a)ipp2p.org>"); ++MODULE_DESCRIPTION("An extension to iptables to identify P2P traffic."); ++MODULE_LICENSE("GPL"); ++ ++ ++/*Search for UDP eDonkey/eMule/Kad commands*/ ++int ++udp_search_edk (unsigned char *haystack, int packet_len) ++{ ++ unsigned char *t = haystack; ++ t += 8; ++ ++ switch (t[0]) { ++ case 0xe3: ++ { /*edonkey*/ ++ switch (t[1]) ++ { ++ /* client -> server status request */ ++ case 0x96: ++ if (packet_len == 14) return ((IPP2P_EDK * 100) + 50); ++ break; ++ /* server -> client status request */ ++ case 0x97: if (packet_len == 42) return ((IPP2P_EDK * 100) + 51); ++ break; ++ /* server description request */ ++ /* e3 2a ff f0 .. | size == 6 */ ++ case 0xa2: if ( (packet_len == 14) && ( get_u16(t,2) == __constant_htons(0xfff0) ) ) return ((IPP2P_EDK * 100) + 52); ++ break; ++ /* server description response */ ++ /* e3 a3 ff f0 .. | size > 40 && size < 200 */ ++ //case 0xa3: return ((IPP2P_EDK * 100) + 53); ++ // break; ++ case 0x9a: if (packet_len==26) return ((IPP2P_EDK * 100) + 54); ++ break; ++ ++ case 0x92: if (packet_len==18) return ((IPP2P_EDK * 100) + 55); ++ break; ++ } ++ break; ++ } ++ case 0xe4: ++ { ++ switch (t[1]) ++ { ++ /* e4 20 .. | size == 43 */ ++ case 0x20: if ((packet_len == 43) && (t[2] != 0x00) && (t[34] != 0x00)) return ((IPP2P_EDK * 100) + 60); ++ break; ++ /* e4 00 .. 00 | size == 35 ? */ ++ case 0x00: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 61); ++ break; ++ /* e4 10 .. 00 | size == 35 ? */ ++ case 0x10: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 62); ++ break; ++ /* e4 18 .. 00 | size == 35 ? */ ++ case 0x18: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 63); ++ break; ++ /* e4 52 .. | size = 44 */ ++ case 0x52: if (packet_len == 44 ) return ((IPP2P_EDK * 100) + 64); ++ break; ++ /* e4 58 .. | size == 6 */ ++ case 0x58: if (packet_len == 14 ) return ((IPP2P_EDK * 100) + 65); ++ break; ++ /* e4 59 .. | size == 2 */ ++ case 0x59: if (packet_len == 10 )return ((IPP2P_EDK * 100) + 66); ++ break; ++ /* e4 28 .. | packet_len == 52,77,102,127... */ ++ case 0x28: if (((packet_len-52) % 25) == 0) return ((IPP2P_EDK * 100) + 67); ++ break; ++ /* e4 50 xx xx | size == 4 */ ++ case 0x50: if (packet_len == 12) return ((IPP2P_EDK * 100) + 68); ++ break; ++ /* e4 40 xx xx | size == 48 */ ++ case 0x40: if (packet_len == 56) return ((IPP2P_EDK * 100) + 69); ++ break; ++ } ++ break; ++ } ++ } /* end of switch (t[0]) */ ++ return 0; ++}/*udp_search_edk*/ ++ ++ ++/*Search for UDP Gnutella commands*/ ++int ++udp_search_gnu (unsigned char *haystack, int packet_len) ++{ ++ unsigned char *t = haystack; ++ t += 8; ++ ++ if (memcmp(t, "GND", 3) == 0) return ((IPP2P_GNU * 100) + 51); ++ if (memcmp(t, "GNUTELLA ", 9) == 0) return ((IPP2P_GNU * 100) + 52); ++ return 0; ++}/*udp_search_gnu*/ ++ ++ ++/*Search for UDP KaZaA commands*/ ++int ++udp_search_kazaa (unsigned char *haystack, int packet_len) ++{ ++ unsigned char *t = haystack; ++ ++ if (t[packet_len-1] == 0x00){ ++ t += (packet_len - 6); ++ if (memcmp(t, "KaZaA", 5) == 0) return (IPP2P_KAZAA * 100 +50); ++ } ++ ++ return 0; ++}/*udp_search_kazaa*/ ++ ++/*Search for UDP DirectConnect commands*/ ++int ++udp_search_directconnect (unsigned char *haystack, int packet_len) ++{ ++ unsigned char *t = haystack; ++ if ((*(t + 8) == 0x24) && (*(t + packet_len - 1) == 0x7c)) { ++ t+=8; ++ if (memcmp(t, "SR ", 3) == 0) return ((IPP2P_DC * 100) + 60); ++ if (memcmp(t, "Ping ", 5) == 0) return ((IPP2P_DC * 100) + 61); ++ } ++ return 0; ++}/*udp_search_directconnect*/ ++ ++ ++ ++/*Search for UDP BitTorrent commands*/ ++int ++udp_search_bit (unsigned char *haystack, int packet_len) ++{ ++ switch(packet_len) ++ { ++ case 24: ++ /* ^ 00 00 04 17 27 10 19 80 */ ++ if ((ntohl(get_u32(haystack, 8)) == 0x00000417) && (ntohl(get_u32(haystack, 12)) == 0x27101980)) ++ return (IPP2P_BIT * 100 + 50); ++ break; ++ case 44: ++ if (get_u32(haystack, 16) == __constant_htonl(0x00000400) && get_u32(haystack, 36) == __constant_htonl(0x00000104)) ++ return (IPP2P_BIT * 100 + 51); ++ if (get_u32(haystack, 16) == __constant_htonl(0x00000400)) ++ return (IPP2P_BIT * 100 + 61); ++ break; ++ case 65: ++ if (get_u32(haystack, 16) == __constant_htonl(0x00000404) && get_u32(haystack, 36) == __constant_htonl(0x00000104)) ++ return (IPP2P_BIT * 100 + 52); ++ if (get_u32(haystack, 16) == __constant_htonl(0x00000404)) ++ return (IPP2P_BIT * 100 + 62); ++ break; ++ case 67: ++ if (get_u32(haystack, 16) == __constant_htonl(0x00000406) && get_u32(haystack, 36) == __constant_htonl(0x00000104)) ++ return (IPP2P_BIT * 100 + 53); ++ if (get_u32(haystack, 16) == __constant_htonl(0x00000406)) ++ return (IPP2P_BIT * 100 + 63); ++ break; ++ case 211: ++ if (get_u32(haystack, 8) == __constant_htonl(0x00000405)) ++ return (IPP2P_BIT * 100 + 54); ++ break; ++ case 29: ++ if ((get_u32(haystack, 8) == __constant_htonl(0x00000401))) ++ return (IPP2P_BIT * 100 + 55); ++ break; ++ case 52: ++ if (get_u32(haystack,8) == __constant_htonl(0x00000827) && ++ get_u32(haystack,12) == __constant_htonl(0x37502950)) ++ return (IPP2P_BIT * 100 + 80); ++ break; ++ default: ++ /* this packet does not have a constant size */ ++ if (packet_len >= 40 && get_u32(haystack, 16) == __constant_htonl(0x00000402) && get_u32(haystack, 36) == __constant_htonl(0x00000104)) ++ return (IPP2P_BIT * 100 + 56); ++ break; ++ } ++ ++ /* some extra-bitcomet rules: ++ * "d1:" [a|r] "d2:id20:" ++ */ ++ if (packet_len > 30 && get_u8(haystack, 8) == 'd' && get_u8(haystack, 9) == '1' && get_u8(haystack, 10) == ':' ) ++ { ++ if (get_u8(haystack, 11) == 'a' || get_u8(haystack, 11) == 'r') ++ { ++ if (memcmp(haystack+12,"d2:id20:",8)==0) ++ return (IPP2P_BIT * 100 + 57); ++ } ++ } ++ ++#if 0 ++ /* bitlord rules */ ++ /* packetlen must be bigger than 40 */ ++ /* first 4 bytes are zero */ ++ if (packet_len > 40 && get_u32(haystack, 8) == 0x00000000) ++ { ++ /* first rule: 00 00 00 00 01 00 00 xx xx xx xx 00 00 00 00*/ ++ if (get_u32(haystack, 12) == 0x00000000 && ++ get_u32(haystack, 16) == 0x00010000 && ++ get_u32(haystack, 24) == 0x00000000 ) ++ return (IPP2P_BIT * 100 + 71); ++ ++ /* 00 01 00 00 0d 00 00 xx xx xx xx 00 00 00 00*/ ++ if (get_u32(haystack, 12) == 0x00000001 && ++ get_u32(haystack, 16) == 0x000d0000 && ++ get_u32(haystack, 24) == 0x00000000 ) ++ return (IPP2P_BIT * 100 + 71); ++ ++ ++ } ++#endif ++ ++ return 0; ++}/*udp_search_bit*/ ++ ++ ++ ++/*Search for Ares commands*/ ++//#define IPP2P_DEBUG_ARES ++int ++search_ares (const unsigned char *payload, const u16 plen) ++//int search_ares (unsigned char *haystack, int packet_len, int head_len) ++{ ++// const unsigned char *t = haystack + head_len; ++ ++ /* all ares packets start with */ ++ if (payload[1] == 0 && (plen - payload[0]) == 3) ++ { ++ switch (payload[2]) ++ { ++ case 0x5a: ++ /* ares connect */ ++ if ( plen == 6 && payload[5] == 0x05 ) return ((IPP2P_ARES * 100) + 1); ++ break; ++ case 0x09: ++ /* ares search, min 3 chars --> 14 bytes ++ * lets define a search can be up to 30 chars --> max 34 bytes ++ */ ++ if ( plen >= 14 && plen <= 34 ) return ((IPP2P_ARES * 100) + 1); ++ break; ++#ifdef IPP2P_DEBUG_ARES ++ default: ++ printk(KERN_DEBUG "Unknown Ares command %x recognized, len: %u \n", (unsigned int) payload[2],plen); ++#endif /* IPP2P_DEBUG_ARES */ ++ } ++ } ++ ++#if 0 ++ /* found connect packet: 03 00 5a 04 03 05 */ ++ /* new version ares 1.8: 03 00 5a xx xx 05 */ ++ if ((plen) == 6){ /* possible connect command*/ ++ if ((payload[0] == 0x03) && (payload[1] == 0x00) && (payload[2] == 0x5a) && (payload[5] == 0x05)) ++ return ((IPP2P_ARES * 100) + 1); ++ } ++ if ((plen) == 60){ /* possible download command*/ ++ if ((payload[59] == 0x0a) && (payload[58] == 0x0a)){ ++ if (memcmp(t, "PUSH SHA1:", 10) == 0) /* found download command */ ++ return ((IPP2P_ARES * 100) + 2); ++ } ++ } ++#endif ++ ++ return 0; ++} /*search_ares*/ ++ ++/*Search for SoulSeek commands*/ ++int ++search_soul (const unsigned char *payload, const u16 plen) ++{ ++//#define IPP2P_DEBUG_SOUL ++ /* match: xx xx xx xx | xx = sizeof(payload) - 4 */ ++ if (get_u32(payload, 0) == (plen - 4)){ ++ const __u32 m=get_u32(payload, 4); ++ /* match 00 yy yy 00, yy can be everything */ ++ if ( get_u8(payload, 4) == 0x00 && get_u8(payload, 7) == 0x00 ) ++ { ++#ifdef IPP2P_DEBUG_SOUL ++ printk(KERN_DEBUG "0: Soulseek command 0x%x recognized\n",get_u32(payload, 4)); ++#endif /* IPP2P_DEBUG_SOUL */ ++ return ((IPP2P_SOUL * 100) + 1); ++ } ++ ++ /* next match: 01 yy 00 00 | yy can be everything */ ++ if ( get_u8(payload, 4) == 0x01 && get_u16(payload, 6) == 0x0000 ) ++ { ++#ifdef IPP2P_DEBUG_SOUL ++ printk(KERN_DEBUG "1: Soulseek command 0x%x recognized\n",get_u16(payload, 4)); ++#endif /* IPP2P_DEBUG_SOUL */ ++ return ((IPP2P_SOUL * 100) + 2); ++ } ++ ++ /* other soulseek commandos are: 1-5,7,9,13-18,22,23,26,28,35-37,40-46,50,51,60,62-69,91,92,1001 */ ++ /* try to do this in an intelligent way */ ++ /* get all small commandos */ ++ switch(m) ++ { ++ case 7: ++ case 9: ++ case 22: ++ case 23: ++ case 26: ++ case 28: ++ case 50: ++ case 51: ++ case 60: ++ case 91: ++ case 92: ++ case 1001: ++#ifdef IPP2P_DEBUG_SOUL ++ printk(KERN_DEBUG "2: Soulseek command 0x%x recognized\n",get_u16(payload, 4)); ++#endif /* IPP2P_DEBUG_SOUL */ ++ return ((IPP2P_SOUL * 100) + 3); ++ } ++ ++ if (m > 0 && m < 6 ) ++ { ++#ifdef IPP2P_DEBUG_SOUL ++ printk(KERN_DEBUG "3: Soulseek command 0x%x recognized\n",get_u16(payload, 4)); ++#endif /* IPP2P_DEBUG_SOUL */ ++ return ((IPP2P_SOUL * 100) + 4); ++ } ++ if (m > 12 && m < 19 ) ++ { ++#ifdef IPP2P_DEBUG_SOUL ++ printk(KERN_DEBUG "4: Soulseek command 0x%x recognized\n",get_u16(payload, 4)); ++#endif /* IPP2P_DEBUG_SOUL */ ++ return ((IPP2P_SOUL * 100) + 5); ++ } ++ ++ if (m > 34 && m < 38 ) ++ { ++#ifdef IPP2P_DEBUG_SOUL ++ printk(KERN_DEBUG "5: Soulseek command 0x%x recognized\n",get_u16(payload, 4)); ++#endif /* IPP2P_DEBUG_SOUL */ ++ return ((IPP2P_SOUL * 100) + 6); ++ } ++ ++ if (m > 39 && m < 47 ) ++ { ++#ifdef IPP2P_DEBUG_SOUL ++ printk(KERN_DEBUG "6: Soulseek command 0x%x recognized\n",get_u16(payload, 4)); ++#endif /* IPP2P_DEBUG_SOUL */ ++ return ((IPP2P_SOUL * 100) + 7); ++ } ++ ++ if (m > 61 && m < 70 ) ++ { ++#ifdef IPP2P_DEBUG_SOUL ++ printk(KERN_DEBUG "7: Soulseek command 0x%x recognized\n",get_u16(payload, 4)); ++#endif /* IPP2P_DEBUG_SOUL */ ++ return ((IPP2P_SOUL * 100) + 8); ++ } ++ ++#ifdef IPP2P_DEBUG_SOUL ++ printk(KERN_DEBUG "unknown SOULSEEK command: 0x%x, first 16 bit: 0x%x, first 8 bit: 0x%x ,soulseek ???\n",get_u32(payload, 4),get_u16(payload, 4) >> 16,get_u8(payload, 4) >> 24); ++#endif /* IPP2P_DEBUG_SOUL */ ++ } ++ ++ /* match 14 00 00 00 01 yy 00 00 00 STRING(YY) 01 00 00 00 00 46|50 00 00 00 00 */ ++ /* without size at the beginning !!! */ ++ if ( get_u32(payload, 0) == 0x14 && get_u8(payload, 4) == 0x01 ) ++ { ++ __u32 y=get_u32(payload, 5); ++ /* we need 19 chars + string */ ++ if ( (y + 19) <= (plen) ) ++ { ++ const unsigned char *w=payload+9+y; ++ if (get_u32(w, 0) == 0x01 && ( get_u16(w, 4) == 0x4600 || get_u16(w, 4) == 0x5000) && get_u32(w, 6) == 0x00); ++#ifdef IPP2P_DEBUG_SOUL ++ printk(KERN_DEBUG "Soulssek special client command recognized\n"); ++#endif /* IPP2P_DEBUG_SOUL */ ++ return ((IPP2P_SOUL * 100) + 9); ++ } ++ } ++ return 0; ++} ++ ++ ++/*Search for WinMX commands*/ ++int ++search_winmx (const unsigned char *payload, const u16 plen) ++{ ++//#define IPP2P_DEBUG_WINMX ++ if (((plen) == 4) && (memcmp(payload, "SEND", 4) == 0)) return ((IPP2P_WINMX * 100) + 1); ++ if (((plen) == 3) && (memcmp(payload, "GET", 3) == 0)) return ((IPP2P_WINMX * 100) + 2); ++ //if (packet_len < (head_len + 10)) return 0; ++ if (plen < 10) return 0; ++ ++ if ((memcmp(payload, "SEND", 4) == 0) || (memcmp(payload, "GET", 3) == 0)){ ++ u16 c=4; ++ const u16 end=plen-2; ++ u8 count=0; ++ while (c < end) ++ { ++ if (payload[c]== 0x20 && payload[c+1] == 0x22) ++ { ++ c++; ++ count++; ++ if (count>=2) return ((IPP2P_WINMX * 100) + 3); ++ } ++ c++; ++ } ++ } ++ ++ if ( plen == 149 && payload[0] == '8' ) ++ { ++#ifdef IPP2P_DEBUG_WINMX ++ printk(KERN_INFO "maybe WinMX\n"); ++#endif ++ if (get_u32(payload,17) == 0 && get_u32(payload,21) == 0 && get_u32(payload,25) == 0 && ++// get_u32(payload,33) == __constant_htonl(0x71182b1a) && get_u32(payload,37) == __constant_htonl(0x05050000) && ++// get_u32(payload,133) == __constant_htonl(0x31097edf) && get_u32(payload,145) == __constant_htonl(0xdcb8f792)) ++ get_u16(payload,39) == 0 && get_u16(payload,135) == __constant_htons(0x7edf) && get_u16(payload,147) == __constant_htons(0xf792)) ++ ++ { ++#ifdef IPP2P_DEBUG_WINMX ++ printk(KERN_INFO "got WinMX\n"); ++#endif ++ return ((IPP2P_WINMX * 100) + 4); ++ } ++ } ++ return 0; ++} /*search_winmx*/ ++ ++ ++/*Search for appleJuice commands*/ ++int ++search_apple (const unsigned char *payload, const u16 plen) ++{ ++ if ( (plen > 7) && (payload[6] == 0x0d) && (payload[7] == 0x0a) && (memcmp(payload, "ajprot", 6) == 0)) return (IPP2P_APPLE * 100); ++ ++ return 0; ++} ++ ++ ++/*Search for BitTorrent commands*/ ++int ++search_bittorrent (const unsigned char *payload, const u16 plen) ++{ ++ if (plen > 20) ++ { ++ /* test for match 0x13+"BitTorrent protocol" */ ++ if (payload[0] == 0x13) ++ { ++ if (memcmp(payload+1, "BitTorrent protocol", 19) == 0) return (IPP2P_BIT * 100); ++ } ++ ++ /* get tracker commandos, all starts with GET / ++ * then it can follow: scrape| announce ++ * and then ?hash_info= ++ */ ++ if (memcmp(payload,"GET /",5) == 0) ++ { ++ /* message scrape */ ++ if ( memcmp(payload+5,"scrape?info_hash=",17)==0 ) return (IPP2P_BIT * 100 + 1); ++ /* message announce */ ++ if ( memcmp(payload+5,"announce?info_hash=",19)==0 ) return (IPP2P_BIT * 100 + 2); ++ } ++ } ++ else ++ { ++ /* bitcomet encryptes the first packet, so we have to detect another ++ * one later in the flow */ ++ /* first try failed, too many missdetections */ ++ //if ( size == 5 && get_u32(t,0) == __constant_htonl(1) && t[4] < 3) return (IPP2P_BIT * 100 + 3); ++ ++ /* second try: block request packets */ ++ if ( plen == 17 && get_u32(payload,0) == __constant_htonl(0x0d) && payload[4] == 0x06 && get_u32(payload,13) == __constant_htonl(0x4000) ) return (IPP2P_BIT * 100 + 3); ++ } ++ ++ return 0; ++} ++ ++ ++ ++/*check for Kazaa get command*/ ++int ++search_kazaa (const unsigned char *payload, const u16 plen) ++ ++{ ++ if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a) && memcmp(payload, "GET /.hash=", 11) == 0) ++ return (IPP2P_DATA_KAZAA * 100); ++ ++ return 0; ++} ++ ++ ++/*check for gnutella get command*/ ++int ++search_gnu (const unsigned char *payload, const u16 plen) ++{ ++ if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a)) ++ { ++ if (memcmp(payload, "GET /get/", 9) == 0) return ((IPP2P_DATA_GNU * 100) + 1); ++ if (memcmp(payload, "GET /uri-res/", 13) == 0) return ((IPP2P_DATA_GNU * 100) + 2); ++ } ++ return 0; ++} ++ ++ ++/*check for gnutella get commands and other typical data*/ ++int ++search_all_gnu (const unsigned char *payload, const u16 plen) ++{ ++ ++ if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a)) ++ { ++ ++ if (memcmp(payload, "GNUTELLA CONNECT/", 17) == 0) return ((IPP2P_GNU * 100) + 1); ++ if (memcmp(payload, "GNUTELLA/", 9) == 0) return ((IPP2P_GNU * 100) + 2); ++ ++ ++ if ((memcmp(payload, "GET /get/", 9) == 0) || (memcmp(payload, "GET /uri-res/", 13) == 0)) ++ { ++ u16 c=8; ++ const u16 end=plen-22; ++ while (c < end) { ++ if ( payload[c] == 0x0a && payload[c+1] == 0x0d && ((memcmp(&payload[c+2], "X-Gnutella-", 11) == 0) || (memcmp(&payload[c+2], "X-Queue:", 8) == 0))) ++ return ((IPP2P_GNU * 100) + 3); ++ c++; ++ } ++ } ++ } ++ return 0; ++} ++ ++ ++/*check for KaZaA download commands and other typical data*/ ++int ++search_all_kazaa (const unsigned char *payload, const u16 plen) ++{ ++ if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a)) ++ { ++ ++ if (memcmp(payload, "GIVE ", 5) == 0) return ((IPP2P_KAZAA * 100) + 1); ++ ++ if (memcmp(payload, "GET /", 5) == 0) { ++ u16 c = 8; ++ const u16 end=plen-22; ++ while (c < end) { ++ if ( payload[c] == 0x0a && payload[c+1] == 0x0d && ((memcmp(&payload[c+2], "X-Kazaa-Username: ", 18) == 0) || (memcmp(&payload[c+2], "User-Agent: PeerEnabler/", 24) == 0))) ++ return ((IPP2P_KAZAA * 100) + 2); ++ c++; ++ } ++ } ++ } ++ return 0; ++} ++ ++/*fast check for edonkey file segment transfer command*/ ++int ++search_edk (const unsigned char *payload, const u16 plen) ++{ ++ if (payload[0] != 0xe3) ++ return 0; ++ else { ++ if (payload[5] == 0x47) ++ return (IPP2P_DATA_EDK * 100); ++ else ++ return 0; ++ } ++} ++ ++ ++ ++/*intensive but slower search for some edonkey packets including size-check*/ ++int ++search_all_edk (const unsigned char *payload, const u16 plen) ++{ ++ if (payload[0] != 0xe3) ++ return 0; ++ else { ++ //t += head_len; ++ const u16 cmd = get_u16(payload, 1); ++ if (cmd == (plen - 5)) { ++ switch (payload[5]) { ++ case 0x01: return ((IPP2P_EDK * 100) + 1); /*Client: hello or Server:hello*/ ++ case 0x4c: return ((IPP2P_EDK * 100) + 9); /*Client: Hello-Answer*/ ++ } ++ } ++ return 0; ++ } ++} ++ ++ ++/*fast check for Direct Connect send command*/ ++int ++search_dc (const unsigned char *payload, const u16 plen) ++{ ++ ++ if (payload[0] != 0x24 ) ++ return 0; ++ else { ++ if (memcmp(&payload[1], "Send|", 5) == 0) ++ return (IPP2P_DATA_DC * 100); ++ else ++ return 0; ++ } ++ ++} ++ ++ ++/*intensive but slower check for all direct connect packets*/ ++int ++search_all_dc (const unsigned char *payload, const u16 plen) ++{ ++// unsigned char *t = haystack; ++ ++ if (payload[0] == 0x24 && payload[plen-1] == 0x7c) ++ { ++ const unsigned char *t=&payload[1]; ++ /* Client-Hub-Protocol */ ++ if (memcmp(t, "Lock ", 5) == 0) return ((IPP2P_DC * 100) + 1); ++ /* Client-Client-Protocol, some are already recognized by client-hub (like lock) */ ++ if (memcmp(t, "MyNick ", 7) == 0) return ((IPP2P_DC * 100) + 38); ++ } ++ return 0; ++} ++ ++/*check for mute*/ ++int ++search_mute (const unsigned char *payload, const u16 plen) ++{ ++ if ( plen == 209 || plen == 345 || plen == 473 || plen == 609 || plen == 1121 ) ++ { ++ //printk(KERN_DEBUG "size hit: %u",size); ++ if (memcmp(payload,"PublicKey: ",11) == 0 ) ++ { ++ return ((IPP2P_MUTE * 100) + 0); ++ ++/* if (memcmp(t+size-14,"\x0aEndPublicKey\x0a",14) == 0) ++ { ++ printk(KERN_DEBUG "end pubic key hit: %u",size); ++ ++ }*/ ++ } ++ } ++ return 0; ++} ++ ++ ++/* check for xdcc */ ++int ++search_xdcc (const unsigned char *payload, const u16 plen) ++{ ++ /* search in small packets only */ ++ if (plen > 20 && plen < 200 && payload[plen-1] == 0x0a && payload[plen-2] == 0x0d && memcmp(payload,"PRIVMSG ",8) == 0) ++ { ++ ++ u16 x=10; ++ const u16 end=plen - 13; ++ ++ /* is seems to be a irc private massage, chedck for xdcc command */ ++ while (x < end) ++ { ++ if (payload[x] == ':') ++ { ++ if ( memcmp(&payload[x+1],"xdcc send #",11) == 0 ) ++ return ((IPP2P_XDCC * 100) + 0); ++ } ++ x++; ++ } ++ } ++ return 0; ++} ++ ++/* search for waste */ ++int search_waste(const unsigned char *payload, const u16 plen) ++{ ++ if ( plen >= 8 && memcmp(payload,"GET.sha1:",9) == 0) ++ return ((IPP2P_WASTE * 100) + 0); ++ ++ return 0; ++} ++ ++ ++static struct { ++ int command; ++ __u8 short_hand; /*for fucntions included in short hands*/ ++ int packet_len; ++ int (*function_name) (const unsigned char *, const u16); ++} matchlist[] = { ++ {IPP2P_EDK,SHORT_HAND_IPP2P,20, &search_all_edk}, ++// {IPP2P_DATA_KAZAA,SHORT_HAND_DATA,200, &search_kazaa}, ++// {IPP2P_DATA_EDK,SHORT_HAND_DATA,60, &search_edk}, ++// {IPP2P_DATA_DC,SHORT_HAND_DATA,26, &search_dc}, ++ {IPP2P_DC,SHORT_HAND_IPP2P,5, search_all_dc}, ++// {IPP2P_DATA_GNU,SHORT_HAND_DATA,40, &search_gnu}, ++ {IPP2P_GNU,SHORT_HAND_IPP2P,5, &search_all_gnu}, ++ {IPP2P_KAZAA,SHORT_HAND_IPP2P,5, &search_all_kazaa}, ++ {IPP2P_BIT,SHORT_HAND_IPP2P,20, &search_bittorrent}, ++ {IPP2P_APPLE,SHORT_HAND_IPP2P,5, &search_apple}, ++ {IPP2P_SOUL,SHORT_HAND_IPP2P,5, &search_soul}, ++ {IPP2P_WINMX,SHORT_HAND_IPP2P,2, &search_winmx}, ++ {IPP2P_ARES,SHORT_HAND_IPP2P,5, &search_ares}, ++ {IPP2P_MUTE,SHORT_HAND_NONE,200, &search_mute}, ++ {IPP2P_WASTE,SHORT_HAND_NONE,5, &search_waste}, ++ {IPP2P_XDCC,SHORT_HAND_NONE,5, &search_xdcc}, ++ {0,0,0,NULL} ++}; ++ ++ ++static struct { ++ int command; ++ __u8 short_hand; /*for fucntions included in short hands*/ ++ int packet_len; ++ int (*function_name) (unsigned char *, int); ++} udp_list[] = { ++ { IPP2P_KAZAA, SHORT_HAND_IPP2P, 14, &udp_search_kazaa}, ++ { IPP2P_BIT, SHORT_HAND_IPP2P, 23, &udp_search_bit}, ++ { IPP2P_GNU, SHORT_HAND_IPP2P, 11, &udp_search_gnu}, ++ { IPP2P_EDK, SHORT_HAND_IPP2P, 9, &udp_search_edk}, ++ { IPP2P_DC, SHORT_HAND_IPP2P, 12, &udp_search_directconnect}, ++ { 0, 0, 0, NULL } ++}; ++ ++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) ++static int ++match(const struct sk_buff *skb, ++ const struct net_device *in, ++ const struct net_device *out, ++ const void *matchinfo, ++ int offset, ++ const void *hdr, ++ u_int16_t datalen, ++ int *hotdrop) ++#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16) ++static int ++match(const struct sk_buff *skb, ++ const struct net_device *in, ++ const struct net_device *out, ++ const void *matchinfo, ++ int offset, ++ int *hotdrop) ++#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17) ++static int ++match(const struct sk_buff *skb, ++ const struct net_device *in, ++ const struct net_device *out, ++ const void *matchinfo, ++ int offset, ++ unsigned int protoff, ++ int *hotdrop) ++#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,23) ++static int ++match(const struct sk_buff *skb, ++ const struct net_device *in, ++ const struct net_device *out, ++ const struct xt_match *match, ++ const void *matchinfo, ++ int offset, ++ unsigned int protoff, ++ int *hotdrop) ++#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28) ++static bool ++match(const struct sk_buff *skb, ++ const struct net_device *in, ++ const struct net_device *out, ++ const struct xt_match *match, ++ const void *matchinfo, ++ int offset, ++ unsigned int protoff, ++ bool *hotdrop) ++#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35) ++static bool ++match(const struct sk_buff *skb, ++ const struct xt_match_param *par) ++#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35) */ ++static int ++match(const struct sk_buff *skb, ++ struct xt_action_param *par) ++#endif ++{ ++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28) ++ const struct ipt_p2p_info *info = matchinfo; ++#else ++ const struct ipt_p2p_info *info = par->matchinfo; ++ const int offset = par->fragoff; ++#endif ++ unsigned char *haystack; ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22) ++ struct iphdr *ip = ip_hdr(skb); ++#else ++ struct iphdr *ip = skb->nh.iph; ++#endif ++ int p2p_result = 0, i = 0; ++// int head_len; ++ int hlen = ntohs(ip->tot_len)-(ip->ihl*4); /*hlen = packet-data length*/ ++ ++ /*must not be a fragment*/ ++ if (offset) { ++ if (info->debug) printk("IPP2P.match: offset found %i \n",offset); ++ return 0; ++ } ++ ++ /*make sure that skb is linear*/ ++ if(skb_is_nonlinear(skb)){ ++ if (info->debug) printk("IPP2P.match: nonlinear skb found\n"); ++ return 0; ++ } ++ ++ ++ haystack=(char *)ip+(ip->ihl*4); /*haystack = packet data*/ ++ ++ switch (ip->protocol){ ++ case IPPROTO_TCP: /*what to do with a TCP packet*/ ++ { ++ struct tcphdr *tcph = (void *) ip + ip->ihl * 4; ++ ++ if (tcph->fin) return 0; /*if FIN bit is set bail out*/ ++ if (tcph->syn) return 0; /*if SYN bit is set bail out*/ ++ if (tcph->rst) return 0; /*if RST bit is set bail out*/ ++ ++ haystack += tcph->doff * 4; /*get TCP-Header-Size*/ ++ hlen -= tcph->doff * 4; ++ while (matchlist[i].command) { ++ if ((((info->cmd & matchlist[i].command) == matchlist[i].command) || ++ ((info->cmd & matchlist[i].short_hand) == matchlist[i].short_hand)) && ++ (hlen > matchlist[i].packet_len)) { ++ p2p_result = matchlist[i].function_name(haystack, hlen); ++ if (p2p_result) ++ { ++ if (info->debug) printk("IPP2P.debug:TCP-match: %i from: %pl4:%i to: %pl4:%i Length: %i\n", ++ p2p_result, &ip->saddr,ntohs(tcph->source), &ip->daddr,ntohs(tcph->dest),hlen); ++ return p2p_result; ++ } ++ } ++ i++; ++ } ++ return p2p_result; ++ } ++ ++ case IPPROTO_UDP: /*what to do with an UDP packet*/ ++ { ++ struct udphdr *udph = (void *) ip + ip->ihl * 4; ++ ++ while (udp_list[i].command){ ++ if ((((info->cmd & udp_list[i].command) == udp_list[i].command) || ++ ((info->cmd & udp_list[i].short_hand) == udp_list[i].short_hand)) && ++ (hlen > udp_list[i].packet_len)) { ++ p2p_result = udp_list[i].function_name(haystack, hlen); ++ if (p2p_result){ ++ if (info->debug) printk("IPP2P.debug:UDP-match: %i from: %pl4:%i to: %pl4:%i Length: %i\n", ++ p2p_result, &ip->saddr,ntohs(udph->source), &ip->daddr,ntohs(udph->dest),hlen); ++ return p2p_result; ++ } ++ } ++ i++; ++ } ++ return p2p_result; ++ } ++ ++ default: return 0; ++ } ++} ++ ++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16) ++static int ++checkentry(const char *tablename, ++ const struct ipt_ip *ip, ++ void *matchinfo, ++ unsigned int matchsize, ++ unsigned int hook_mask) ++#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17) ++static int ++checkentry(const char *tablename, ++ const void *inf, ++ void *matchinfo, ++ unsigned int matchsize, ++ unsigned int hook_mask) ++#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19) ++static int ++checkentry(const char *tablename, ++ const void *inf, ++ const struct xt_match *match, ++ void *matchinfo, ++ unsigned int matchsize, ++ unsigned int hook_mask) ++#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,23) ++static int ++checkentry(const char *tablename, ++ const void *inf, ++ const struct xt_match *match, ++ void *matchinfo, ++ unsigned int hook_mask) ++#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28) ++static bool ++checkentry(const char *tablename, ++ const void *inf, ++ const struct xt_match *match, ++ void *matchinfo, ++ unsigned int hook_mask) ++#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35) ++static bool ++checkentry(const struct xt_mtchk_param *par) ++#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35) */ ++static int ++checkentry(const struct xt_mtchk_param *par) ++#endif ++{ ++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35) ++ return 1; ++#else ++ return 0; ++#endif ++} ++ ++ ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21) ++static struct xt_match ipp2p_match = { ++#else ++static struct ipt_match ipp2p_match = { ++#endif ++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) ++ { NULL, NULL }, ++ "ipp2p", ++ &ipp2p_match, ++ &ipp2p_checkentry, ++ NULL, ++ THIS_MODULE ++#endif ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0) ++ .name = "ipp2p", ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21) ++ .family = AF_INET, ++#endif ++ .match = &match, ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17) ++ .matchsize = sizeof(struct ipt_p2p_info), ++#endif ++ .checkentry = &checkentry, ++ .me = THIS_MODULE, ++#endif ++}; ++ ++ ++static int __init init(void) ++{ ++ printk(KERN_INFO "IPP2P v%s loading\n", IPP2P_VERSION); ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21) ++ return xt_register_match(&ipp2p_match); ++#else ++ return ipt_register_match(&ipp2p_match); ++#endif ++} ++ ++static void __exit fini(void) ++{ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21) ++ xt_unregister_match(&ipp2p_match); ++#else ++ ipt_unregister_match(&ipp2p_match); ++#endif ++ printk(KERN_INFO "IPP2P v%s unloaded\n", IPP2P_VERSION); ++} ++ ++module_init(init); ++module_exit(fini); ++ ++ +diff -Naur linux-3.0.24.org/net/ipv4/netfilter/Kconfig linux-3.0.24/net/ipv4/netfilter/Kconfig +--- linux-3.0.24.org/net/ipv4/netfilter/Kconfig 2012-03-12 18:58:19.000000000 +0100 ++++ linux-3.0.24/net/ipv4/netfilter/Kconfig 2012-03-20 09:05:15.827477622 +0100 +@@ -379,5 +379,15 @@ + + endif # IP_NF_ARPTABLES + ++config IP_NF_MATCH_IPP2P ++ tristate 'IPP2P match support' ++ depends on IP_NF_IPTABLES ++ help ++ This option makes possible to match some P2P packets ++ therefore helps controlling such traffic. ++ ++ If you want to compile it as a module, say M here and read ++ <file:Documentation/modules.txt>. If unsure, say `N'. ++ + endmenu + +diff -Naur linux-3.0.24.org/net/ipv4/netfilter/Makefile linux-3.0.24/net/ipv4/netfilter/Makefile +--- linux-3.0.24.org/net/ipv4/netfilter/Makefile 2012-03-12 18:58:19.000000000 +0100 ++++ linux-3.0.24/net/ipv4/netfilter/Makefile 2012-03-20 09:13:38.960288878 +0100 +@@ -50,6 +50,7 @@ + # matches + obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o + obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o ++obj-$(CONFIG_IP_NF_MATCH_IPP2P) += ipt_ipp2p.o + + # targets + obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o diff --git a/src/patches/openssl-0.9.8u-cryptodev.patch b/src/patches/openssl-0.9.8u-cryptodev.patch new file mode 100644 index 0000000..920648d --- /dev/null +++ b/src/patches/openssl-0.9.8u-cryptodev.patch @@ -0,0 +1,882 @@ +diff -Naur openssl-0.9.8u.org/crypto/engine/eng_all.c openssl-0.9.8u/crypto/engine/eng_all.c +--- openssl-0.9.8u.org/crypto/engine/eng_all.c 2010-03-01 01:30:11.000000000 +0100 ++++ openssl-0.9.8u/crypto/engine/eng_all.c 2012-03-27 14:07:11.000000000 +0200 +@@ -113,7 +113,6 @@ + #endif + } + +-#if defined(__OpenBSD__) || defined(__FreeBSD__) + void ENGINE_setup_bsd_cryptodev(void) { + static int bsd_cryptodev_default_loaded = 0; + if (!bsd_cryptodev_default_loaded) { +@@ -122,4 +121,3 @@ + } + bsd_cryptodev_default_loaded=1; + } +-#endif +diff -Naur openssl-0.9.8u.org/crypto/engine/eng_cryptodev.c openssl-0.9.8u/crypto/engine/eng_cryptodev.c +--- openssl-0.9.8u.org/crypto/engine/eng_cryptodev.c 2012-03-06 14:22:32.000000000 +0100 ++++ openssl-0.9.8u/crypto/engine/eng_cryptodev.c 2012-03-27 14:02:59.000000000 +0200 +@@ -2,6 +2,7 @@ + * Copyright (c) 2002 Bob Beck <beck(a)openbsd.org> + * Copyright (c) 2002 Theo de Raadt + * Copyright (c) 2002 Markus Friedl ++ * Copyright (c) 2012 Nikos Mavrogiannopoulos + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -30,10 +31,6 @@ + #include <openssl/engine.h> + #include <openssl/evp.h> + #include <openssl/bn.h> +-#include <openssl/dsa.h> +-#include <openssl/rsa.h> +-#include <openssl/dh.h> +-#include <openssl/err.h> + + #if (defined(__unix__) || defined(unix)) && !defined(USG) && \ + (defined(OpenBSD) || defined(__FreeBSD__)) +@@ -59,6 +56,10 @@ + + #include <sys/types.h> + #include <crypto/cryptodev.h> ++#include <crypto/dh/dh.h> ++#include <crypto/dsa/dsa.h> ++#include <crypto/err/err.h> ++#include <crypto/rsa/rsa.h> + #include <sys/ioctl.h> + #include <errno.h> + #include <stdio.h> +@@ -72,6 +73,12 @@ + struct dev_crypto_state { + struct session_op d_sess; + int d_fd; ++ ++#ifdef USE_CRYPTODEV_DIGESTS ++ unsigned char digest_res[HASH_MAX_LEN]; ++ char *mac_data; ++ int mac_len; ++#endif + }; + + static u_int32_t cryptodev_asymfeat = 0; +@@ -79,15 +86,14 @@ + static int get_asym_dev_crypto(void); + static int open_dev_crypto(void); + static int get_dev_crypto(void); +-static int cryptodev_max_iv(int cipher); +-static int cryptodev_key_length_valid(int cipher, int len); +-static int cipher_nid_to_cryptodev(int nid); + static int get_cryptodev_ciphers(const int **cnids); +-/*static int get_cryptodev_digests(const int **cnids);*/ ++#ifdef USE_CRYPTODEV_DIGESTS ++static int get_cryptodev_digests(const int **cnids); ++#endif + static int cryptodev_usable_ciphers(const int **nids); + static int cryptodev_usable_digests(const int **nids); + static int cryptodev_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, +- const unsigned char *in, unsigned int inl); ++ const unsigned char *in, size_t inl); + static int cryptodev_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, + const unsigned char *iv, int enc); + static int cryptodev_cleanup(EVP_CIPHER_CTX *ctx); +@@ -121,7 +127,7 @@ + static int cryptodev_dh_compute_key(unsigned char *key, + const BIGNUM *pub_key, DH *dh); + static int cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p, +- void (*f)()); ++ void (*f)(void)); + void ENGINE_load_cryptodev(void); + + static const ENGINE_CMD_DEFN cryptodev_defns[] = { +@@ -134,27 +140,38 @@ + int ivmax; + int keylen; + } ciphers[] = { ++ { CRYPTO_ARC4, NID_rc4, 0, 16, }, + { CRYPTO_DES_CBC, NID_des_cbc, 8, 8, }, + { CRYPTO_3DES_CBC, NID_des_ede3_cbc, 8, 24, }, + { CRYPTO_AES_CBC, NID_aes_128_cbc, 16, 16, }, ++ { CRYPTO_AES_CBC, NID_aes_192_cbc, 16, 24, }, ++ { CRYPTO_AES_CBC, NID_aes_256_cbc, 16, 32, }, + { CRYPTO_BLF_CBC, NID_bf_cbc, 8, 16, }, + { CRYPTO_CAST_CBC, NID_cast5_cbc, 8, 16, }, + { CRYPTO_SKIPJACK_CBC, NID_undef, 0, 0, }, + { 0, NID_undef, 0, 0, }, + }; + +-#if 0 ++#ifdef USE_CRYPTODEV_DIGESTS + static struct { + int id; + int nid; ++ int digestlen; + } digests[] = { +- { CRYPTO_SHA1_HMAC, NID_hmacWithSHA1, }, +- { CRYPTO_RIPEMD160_HMAC, NID_ripemd160, }, +- { CRYPTO_MD5_KPDK, NID_undef, }, +- { CRYPTO_SHA1_KPDK, NID_undef, }, +- { CRYPTO_MD5, NID_md5, }, +- { CRYPTO_SHA1, NID_undef, }, +- { 0, NID_undef, }, ++#if 0 ++ /* HMAC is not supported */ ++ { CRYPTO_MD5_HMAC, NID_hmacWithMD5, 16}, ++ { CRYPTO_SHA1_HMAC, NID_hmacWithSHA1, 20}, ++ { CRYPTO_SHA2_256_HMAC, NID_hmacWithSHA256, 32}, ++ { CRYPTO_SHA2_384_HMAC, NID_hmacWithSHA384, 48}, ++ { CRYPTO_SHA2_512_HMAC, NID_hmacWithSHA512, 64}, ++#endif ++ { CRYPTO_MD5, NID_md5, 16}, ++ { CRYPTO_SHA1, NID_sha1, 20}, ++ { CRYPTO_SHA2_256, NID_sha256, 32}, ++ { CRYPTO_SHA2_384, NID_sha384, 48}, ++ { CRYPTO_SHA2_512, NID_sha512, 64}, ++ { 0, NID_undef, 0}, + }; + #endif + +@@ -186,6 +203,7 @@ + + if ((fd = open_dev_crypto()) == -1) + return (-1); ++#ifndef CRIOGET_NOT_NEEDED + if (ioctl(fd, CRIOGET, &retfd) == -1) + return (-1); + +@@ -194,9 +212,19 @@ + close(retfd); + return (-1); + } ++#else ++ retfd = fd; ++#endif + return (retfd); + } + ++static void put_dev_crypto(int fd) ++{ ++#ifndef CRIOGET_NOT_NEEDED ++ close(fd); ++#endif ++} ++ + /* Caching version for asym operations */ + static int + get_asym_dev_crypto(void) +@@ -209,50 +237,6 @@ + } + + /* +- * XXXX this needs to be set for each alg - and determined from +- * a running card. +- */ +-static int +-cryptodev_max_iv(int cipher) +-{ +- int i; +- +- for (i = 0; ciphers[i].id; i++) +- if (ciphers[i].id == cipher) +- return (ciphers[i].ivmax); +- return (0); +-} +- +-/* +- * XXXX this needs to be set for each alg - and determined from +- * a running card. For now, fake it out - but most of these +- * for real devices should return 1 for the supported key +- * sizes the device can handle. +- */ +-static int +-cryptodev_key_length_valid(int cipher, int len) +-{ +- int i; +- +- for (i = 0; ciphers[i].id; i++) +- if (ciphers[i].id == cipher) +- return (ciphers[i].keylen == len); +- return (0); +-} +- +-/* convert libcrypto nids to cryptodev */ +-static int +-cipher_nid_to_cryptodev(int nid) +-{ +- int i; +- +- for (i = 0; ciphers[i].id; i++) +- if (ciphers[i].nid == nid) +- return (ciphers[i].id); +- return (0); +-} +- +-/* + * Find out what ciphers /dev/crypto will let us have a session for. + * XXX note, that some of these openssl doesn't deal with yet! + * returning them here is harmless, as long as we return NULL +@@ -264,13 +248,14 @@ + static int nids[CRYPTO_ALGORITHM_MAX]; + struct session_op sess; + int fd, i, count = 0; ++ unsigned char fake_key[CRYPTO_CIPHER_MAX_KEY_LEN]; + + if ((fd = get_dev_crypto()) < 0) { + *cnids = NULL; + return (0); + } + memset(&sess, 0, sizeof(sess)); +- sess.key = (caddr_t)"123456781234567812345678"; ++ sess.key = (void*)fake_key; + + for (i = 0; ciphers[i].id && count < CRYPTO_ALGORITHM_MAX; i++) { + if (ciphers[i].nid == NID_undef) +@@ -282,7 +267,7 @@ + ioctl(fd, CIOCFSESSION, &sess.ses) != -1) + nids[count++] = ciphers[i].nid; + } +- close(fd); ++ put_dev_crypto(fd); + + if (count > 0) + *cnids = nids; +@@ -291,7 +276,7 @@ + return (count); + } + +-#if 0 /* unused */ ++#ifdef USE_CRYPTODEV_DIGESTS + /* + * Find out what digests /dev/crypto will let us have a session for. + * XXX note, that some of these openssl doesn't deal with yet! +@@ -302,6 +287,7 @@ + get_cryptodev_digests(const int **cnids) + { + static int nids[CRYPTO_ALGORITHM_MAX]; ++ unsigned char fake_key[CRYPTO_CIPHER_MAX_KEY_LEN]; + struct session_op sess; + int fd, i, count = 0; + +@@ -310,16 +296,18 @@ + return (0); + } + memset(&sess, 0, sizeof(sess)); ++ sess.mackey = fake_key; + for (i = 0; digests[i].id && count < CRYPTO_ALGORITHM_MAX; i++) { + if (digests[i].nid == NID_undef) + continue; + sess.mac = digests[i].id; ++ sess.mackeylen = 8; + sess.cipher = 0; + if (ioctl(fd, CIOCGSESSION, &sess) != -1 && + ioctl(fd, CIOCFSESSION, &sess.ses) != -1) + nids[count++] = digests[i].nid; + } +- close(fd); ++ put_dev_crypto(fd); + + if (count > 0) + *cnids = nids; +@@ -327,8 +315,7 @@ + *cnids = NULL; + return (count); + } +- +-#endif ++#endif /* 0 */ + + /* + * Find the useable ciphers|digests from dev/crypto - this is the first +@@ -360,6 +347,9 @@ + static int + cryptodev_usable_digests(const int **nids) + { ++#ifdef USE_CRYPTODEV_DIGESTS ++ return (get_cryptodev_digests(nids)); ++#else + /* + * XXXX just disable all digests for now, because it sucks. + * we need a better way to decide this - i.e. I may not +@@ -374,11 +364,12 @@ + */ + *nids = NULL; + return (0); ++#endif + } + + static int + cryptodev_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, +- const unsigned char *in, unsigned int inl) ++ const unsigned char *in, size_t inl) + { + struct crypt_op cryp; + struct dev_crypto_state *state = ctx->cipher_data; +@@ -398,14 +389,14 @@ + cryp.ses = sess->ses; + cryp.flags = 0; + cryp.len = inl; +- cryp.src = (caddr_t) in; +- cryp.dst = (caddr_t) out; ++ cryp.src = (void*) in; ++ cryp.dst = (void*) out; + cryp.mac = 0; + + cryp.op = ctx->encrypt ? COP_ENCRYPT : COP_DECRYPT; + + if (ctx->cipher->iv_len) { +- cryp.iv = (caddr_t) ctx->iv; ++ cryp.iv = (void*) ctx->iv; + if (!ctx->encrypt) { + iiv = in + inl - ctx->cipher->iv_len; + memcpy(save_iv, iiv, ctx->cipher->iv_len); +@@ -436,28 +427,32 @@ + { + struct dev_crypto_state *state = ctx->cipher_data; + struct session_op *sess = &state->d_sess; +- int cipher; ++ int cipher = -1, i; + +- if ((cipher = cipher_nid_to_cryptodev(ctx->cipher->nid)) == NID_undef) +- return (0); +- +- if (ctx->cipher->iv_len > cryptodev_max_iv(cipher)) +- return (0); ++ for (i = 0; ciphers[i].id; i++) ++ if (ctx->cipher->nid == ciphers[i].nid && ++ ctx->cipher->iv_len <= ciphers[i].ivmax && ++ ctx->key_len == ciphers[i].keylen) { ++ cipher = ciphers[i].id; ++ break; ++ } + +- if (!cryptodev_key_length_valid(cipher, ctx->key_len)) ++ if (!ciphers[i].id) { ++ state->d_fd = -1; + return (0); ++ } + + memset(sess, 0, sizeof(struct session_op)); + + if ((state->d_fd = get_dev_crypto()) < 0) + return (0); + +- sess->key = (char *)key; ++ sess->key = (void*)key; + sess->keylen = ctx->key_len; + sess->cipher = cipher; + + if (ioctl(state->d_fd, CIOCGSESSION, sess) == -1) { +- close(state->d_fd); ++ put_dev_crypto(state->d_fd); + state->d_fd = -1; + return (0); + } +@@ -494,7 +489,7 @@ + } else { + ret = 1; + } +- close(state->d_fd); ++ put_dev_crypto(state->d_fd); + state->d_fd = -1; + + return (ret); +@@ -505,6 +500,20 @@ + * gets called when libcrypto requests a cipher NID. + */ + ++/* RC4 */ ++const EVP_CIPHER cryptodev_rc4 = { ++ NID_rc4, ++ 1, 16, 0, ++ EVP_CIPH_VARIABLE_LENGTH, ++ cryptodev_init_key, ++ cryptodev_cipher, ++ cryptodev_cleanup, ++ sizeof(struct dev_crypto_state), ++ NULL, ++ NULL, ++ NULL ++}; ++ + /* DES CBC EVP */ + const EVP_CIPHER cryptodev_des_cbc = { + NID_des_cbc, +@@ -572,6 +581,32 @@ + NULL + }; + ++const EVP_CIPHER cryptodev_aes_192_cbc = { ++ NID_aes_192_cbc, ++ 16, 24, 16, ++ EVP_CIPH_CBC_MODE, ++ cryptodev_init_key, ++ cryptodev_cipher, ++ cryptodev_cleanup, ++ sizeof(struct dev_crypto_state), ++ EVP_CIPHER_set_asn1_iv, ++ EVP_CIPHER_get_asn1_iv, ++ NULL ++}; ++ ++const EVP_CIPHER cryptodev_aes_256_cbc = { ++ NID_aes_256_cbc, ++ 16, 32, 16, ++ EVP_CIPH_CBC_MODE, ++ cryptodev_init_key, ++ cryptodev_cipher, ++ cryptodev_cleanup, ++ sizeof(struct dev_crypto_state), ++ EVP_CIPHER_set_asn1_iv, ++ EVP_CIPHER_get_asn1_iv, ++ NULL ++}; ++ + /* + * Registered by the ENGINE when used to find out how to deal with + * a particular NID in the ENGINE. this says what we'll do at the +@@ -585,6 +620,9 @@ + return (cryptodev_usable_ciphers(nids)); + + switch (nid) { ++ case NID_rc4: ++ *cipher = &cryptodev_rc4; ++ break; + case NID_des_ede3_cbc: + *cipher = &cryptodev_3des_cbc; + break; +@@ -600,6 +638,12 @@ + case NID_aes_128_cbc: + *cipher = &cryptodev_aes_cbc; + break; ++ case NID_aes_192_cbc: ++ *cipher = &cryptodev_aes_192_cbc; ++ break; ++ case NID_aes_256_cbc: ++ *cipher = &cryptodev_aes_256_cbc; ++ break; + default: + *cipher = NULL; + break; +@@ -607,6 +651,286 @@ + return (*cipher != NULL); + } + ++ ++#ifdef USE_CRYPTODEV_DIGESTS ++ ++/* convert digest type to cryptodev */ ++static int ++digest_nid_to_cryptodev(int nid) ++{ ++ int i; ++ ++ for (i = 0; digests[i].id; i++) ++ if (digests[i].nid == nid) ++ return (digests[i].id); ++ return (0); ++} ++ ++ ++static int cryptodev_digest_init(EVP_MD_CTX *ctx) ++{ ++ struct dev_crypto_state *state = ctx->md_data; ++ struct session_op *sess = &state->d_sess; ++ int digest; ++ ++ if ((digest = digest_nid_to_cryptodev(ctx->digest->type)) == NID_undef){ ++ printf("cryptodev_digest_init: Can't get digest \n"); ++ return (0); ++ } ++ memset(state, 0, sizeof(struct dev_crypto_state)); ++ ++ if ((state->d_fd = get_dev_crypto()) < 0) { ++ printf("cryptodev_digest_init: Can't get Dev \n"); ++ return (0); ++ } ++ ++ sess->mackey = NULL; ++ sess->mackeylen = 0; ++ sess->mac = digest; ++ ++ if (ioctl(state->d_fd, CIOCGSESSION, sess) < 0) { ++ put_dev_crypto(state->d_fd); ++ state->d_fd = -1; ++ printf("cryptodev_digest_init: Open session failed\n"); ++ return (0); ++ } ++ ++ return (1); ++} ++ ++static int cryptodev_digest_update(EVP_MD_CTX *ctx, const void *data, ++ size_t count) ++{ ++ struct dev_crypto_state *state = ctx->md_data; ++ struct crypt_op cryp; ++ struct session_op *sess = &state->d_sess; ++ ++ if (!data || state->d_fd < 0) { ++ printf("cryptodev_digest_update: illegal inputs \n"); ++ return (0); ++ } ++ ++ if (!count) { ++ return (1); ++ } ++ ++ if (!(ctx->flags & EVP_MD_CTX_FLAG_ONESHOT)) { ++ /* if application doesn't support one buffer */ ++ state->mac_data = OPENSSL_realloc(state->mac_data, state->mac_len + count); ++ ++ if (!state->mac_data) { ++ printf("cryptodev_digest_update: realloc failed\n"); ++ return (0); ++ } ++ ++ memcpy(state->mac_data + state->mac_len, data, count); ++ state->mac_len += count; ++ ++ return (1); ++ } ++ ++ memset(&cryp, 0, sizeof(cryp)); ++ ++ cryp.ses = sess->ses; ++ cryp.flags = 0; ++ cryp.len = count; ++ cryp.src = (void*) data; ++ cryp.dst = NULL; ++ cryp.mac = (void*) state->digest_res; ++ if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) { ++ printf("cryptodev_digest_update: digest failed\n"); ++ return (0); ++ } ++ return (1); ++} ++ ++ ++static int cryptodev_digest_final(EVP_MD_CTX *ctx, unsigned char *md) ++{ ++ struct crypt_op cryp; ++ struct dev_crypto_state *state = ctx->md_data; ++ struct session_op *sess = &state->d_sess; ++ ++ if (!md || state->d_fd < 0) { ++ printf("cryptodev_digest_final: illegal input\n"); ++ return(0); ++ } ++ ++ if (! (ctx->flags & EVP_MD_CTX_FLAG_ONESHOT) ) { ++ /* if application doesn't support one buffer */ ++ memset(&cryp, 0, sizeof(cryp)); ++ cryp.ses = sess->ses; ++ cryp.flags = 0; ++ cryp.len = state->mac_len; ++ cryp.src = state->mac_data; ++ cryp.dst = NULL; ++ cryp.mac = (void*)md; ++ if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) { ++ printf("cryptodev_digest_final: digest failed\n"); ++ return (0); ++ } ++ ++ return 1; ++ } ++ ++ memcpy(md, state->digest_res, ctx->digest->md_size); ++ ++ return 1; ++} ++ ++ ++static int cryptodev_digest_cleanup(EVP_MD_CTX *ctx) ++{ ++ int ret = 1; ++ struct dev_crypto_state *state = ctx->md_data; ++ struct session_op *sess = &state->d_sess; ++ ++ if (state == NULL) ++ return 0; ++ ++ if (state->d_fd < 0) { ++ printf("cryptodev_digest_cleanup: illegal input\n"); ++ return (0); ++ } ++ ++ if (state->mac_data) { ++ OPENSSL_free(state->mac_data); ++ state->mac_data = NULL; ++ state->mac_len = 0; ++ } ++ ++ if (ioctl(state->d_fd, CIOCFSESSION, &sess->ses) < 0) { ++ printf("cryptodev_digest_cleanup: failed to close session\n"); ++ ret = 0; ++ } else { ++ ret = 1; ++ } ++ put_dev_crypto(state->d_fd); ++ state->d_fd = -1; ++ ++ return (ret); ++} ++ ++static int cryptodev_digest_copy(EVP_MD_CTX *to,const EVP_MD_CTX *from) ++{ ++ struct dev_crypto_state *fstate = from->md_data; ++ struct dev_crypto_state *dstate = to->md_data; ++ struct session_op *sess; ++ int digest; ++ ++ if (dstate == NULL || fstate == NULL) ++ return 1; ++ ++ memcpy(dstate, fstate, sizeof(struct dev_crypto_state)); ++ ++ sess = &dstate->d_sess; ++ ++ digest = digest_nid_to_cryptodev(to->digest->type); ++ ++ sess->mackey = NULL; ++ sess->mackeylen = 0; ++ sess->mac = digest; ++ ++ dstate->d_fd = get_dev_crypto(); ++ ++ if (ioctl(dstate->d_fd, CIOCGSESSION, sess) < 0) { ++ put_dev_crypto(dstate->d_fd); ++ dstate->d_fd = -1; ++ printf("cryptodev_digest_init: Open session failed\n"); ++ return (0); ++ } ++ ++ if (fstate->mac_len != 0) { ++ if (fstate->mac_data != NULL) ++ { ++ dstate->mac_data = OPENSSL_malloc(fstate->mac_len); ++ memcpy(dstate->mac_data, fstate->mac_data, fstate->mac_len); ++ dstate->mac_len = fstate->mac_len; ++ } ++ } ++ ++ return 1; ++} ++ ++ ++static const EVP_MD cryptodev_sha1 = { ++ NID_sha1, ++ NID_sha1WithRSAEncryption, ++ SHA_DIGEST_LENGTH, ++ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT, ++ cryptodev_digest_init, ++ cryptodev_digest_update, ++ cryptodev_digest_final, ++ cryptodev_digest_copy, ++ cryptodev_digest_cleanup, ++ EVP_PKEY_RSA_method, ++ SHA_CBLOCK, ++ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state), ++}; ++ ++static const EVP_MD cryptodev_sha256 = { ++ NID_sha256, ++ NID_sha256WithRSAEncryption, ++ SHA256_DIGEST_LENGTH, ++ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT, ++ cryptodev_digest_init, ++ cryptodev_digest_update, ++ cryptodev_digest_final, ++ cryptodev_digest_copy, ++ cryptodev_digest_cleanup, ++ EVP_PKEY_RSA_method, ++ SHA256_CBLOCK, ++ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state), ++}; ++ ++static const EVP_MD cryptodev_sha384 = { ++ NID_sha384, ++ NID_sha384WithRSAEncryption, ++ SHA384_DIGEST_LENGTH, ++ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT, ++ cryptodev_digest_init, ++ cryptodev_digest_update, ++ cryptodev_digest_final, ++ cryptodev_digest_copy, ++ cryptodev_digest_cleanup, ++ EVP_PKEY_RSA_method, ++ SHA512_CBLOCK, ++ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state), ++}; ++ ++static const EVP_MD cryptodev_sha512 = { ++ NID_sha512, ++ NID_sha512WithRSAEncryption, ++ SHA512_DIGEST_LENGTH, ++ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT, ++ cryptodev_digest_init, ++ cryptodev_digest_update, ++ cryptodev_digest_final, ++ cryptodev_digest_copy, ++ cryptodev_digest_cleanup, ++ EVP_PKEY_RSA_method, ++ SHA512_CBLOCK, ++ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state), ++}; ++ ++static const EVP_MD cryptodev_md5 = { ++ NID_md5, ++ NID_md5WithRSAEncryption, ++ 16 /* MD5_DIGEST_LENGTH */, ++ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT, ++ cryptodev_digest_init, ++ cryptodev_digest_update, ++ cryptodev_digest_final, ++ cryptodev_digest_copy, ++ cryptodev_digest_cleanup, ++ EVP_PKEY_RSA_method, ++ 64 /* MD5_CBLOCK */, ++ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state), ++}; ++ ++#endif /* USE_CRYPTODEV_DIGESTS */ ++ ++ + static int + cryptodev_engine_digests(ENGINE *e, const EVP_MD **digest, + const int **nids, int nid) +@@ -615,10 +939,24 @@ + return (cryptodev_usable_digests(nids)); + + switch (nid) { ++#ifdef USE_CRYPTODEV_DIGESTS + case NID_md5: +- *digest = NULL; /* need to make a clean md5 critter */ ++ *digest = &cryptodev_md5; + break; ++ case NID_sha1: ++ *digest = &cryptodev_sha1; ++ break; ++ case NID_sha256: ++ *digest = &cryptodev_sha256; ++ break; ++ case NID_sha384: ++ *digest = &cryptodev_sha384; ++ break; ++ case NID_sha512: ++ *digest = &cryptodev_sha512; ++ break; + default: ++#endif /* USE_CRYPTODEV_DIGESTS */ + *digest = NULL; + break; + } +@@ -646,8 +984,9 @@ + b = malloc(bytes); + if (b == NULL) + return (1); ++ memset(b, 0, bytes); + +- crp->crp_p = (char *)b; ++ crp->crp_p = (void*) b; + crp->crp_nbits = bits; + + for (i = 0, j = 0; i < a->top; i++) { +@@ -690,7 +1029,7 @@ + { + int i; + +- for (i = 0; i <= kop->crk_iparams + kop->crk_oparams; i++) { ++ for (i = 0; i < kop->crk_iparams + kop->crk_oparams; i++) { + if (kop->crk_param[i].crp_p) + free(kop->crk_param[i].crp_p); + kop->crk_param[i].crp_p = NULL; +@@ -776,8 +1115,9 @@ + cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) + { + int r; +- ++ ctx = BN_CTX_new(); + r = cryptodev_bn_mod_exp(r0, I, rsa->d, rsa->n, ctx, NULL); ++ BN_CTX_free(ctx); + return (r); + } + +@@ -899,7 +1239,7 @@ + kop.crk_op = CRK_DSA_SIGN; + + /* inputs: dgst dsa->p dsa->q dsa->g dsa->priv_key */ +- kop.crk_param[0].crp_p = (caddr_t)dgst; ++ kop.crk_param[0].crp_p = (void*)dgst; + kop.crk_param[0].crp_nbits = dlen * 8; + if (bn2crparam(dsa->p, &kop.crk_param[1])) + goto err; +@@ -939,7 +1279,7 @@ + kop.crk_op = CRK_DSA_VERIFY; + + /* inputs: dgst dsa->p dsa->q dsa->g dsa->pub_key sig->r sig->s */ +- kop.crk_param[0].crp_p = (caddr_t)dgst; ++ kop.crk_param[0].crp_p = (void*)dgst; + kop.crk_param[0].crp_nbits = dlen * 8; + if (bn2crparam(dsa->p, &kop.crk_param[1])) + goto err; +@@ -1017,7 +1357,7 @@ + goto err; + kop.crk_iparams = 3; + +- kop.crk_param[3].crp_p = (char *)key; ++ kop.crk_param[3].crp_p = (void*) key; + kop.crk_param[3].crp_nbits = keylen * 8; + kop.crk_oparams = 1; + +@@ -1048,7 +1388,7 @@ + * but I expect we'll want some options soon. + */ + static int +-cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)()) ++cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void)) + { + #ifdef HAVE_SYSLOG_R + struct syslog_data sd = SYSLOG_DATA_INIT; +@@ -1084,14 +1424,14 @@ + * find out what asymmetric crypto algorithms we support + */ + if (ioctl(fd, CIOCASYMFEAT, &cryptodev_asymfeat) == -1) { +- close(fd); ++ put_dev_crypto(fd); + ENGINE_free(engine); + return; + } +- close(fd); ++ put_dev_crypto(fd); + + if (!ENGINE_set_id(engine, "cryptodev") || +- !ENGINE_set_name(engine, "BSD cryptodev engine") || ++ !ENGINE_set_name(engine, "cryptodev engine") || + !ENGINE_set_ciphers(engine, cryptodev_engine_ciphers) || + !ENGINE_set_digests(engine, cryptodev_engine_digests) || + !ENGINE_set_ctrl_function(engine, cryptodev_ctrl) || +diff -Naur openssl-0.9.8u.org/crypto/engine/engine.h openssl-0.9.8u/crypto/engine/engine.h +--- openssl-0.9.8u.org/crypto/engine/engine.h 2010-02-09 15:18:15.000000000 +0100 ++++ openssl-0.9.8u/crypto/engine/engine.h 2012-03-27 14:05:15.000000000 +0200 +@@ -705,9 +705,7 @@ + * values. */ + void *ENGINE_get_static_state(void); + +-#if defined(__OpenBSD__) || defined(__FreeBSD__) + void ENGINE_setup_bsd_cryptodev(void); +-#endif + + /* BEGIN ERROR CODES */ + /* The following lines are auto generated by the script mkerr.pl. Any changes +diff -Naur openssl-0.9.8u.org/crypto/evp/c_all.c openssl-0.9.8u/crypto/evp/c_all.c +--- openssl-0.9.8u.org/crypto/evp/c_all.c 2004-08-29 18:36:04.000000000 +0200 ++++ openssl-0.9.8u/crypto/evp/c_all.c 2012-03-27 14:05:15.000000000 +0200 +@@ -83,8 +83,6 @@ + OpenSSL_add_all_ciphers(); + OpenSSL_add_all_digests(); + #ifndef OPENSSL_NO_ENGINE +-# if defined(__OpenBSD__) || defined(__FreeBSD__) + ENGINE_setup_bsd_cryptodev(); +-# endif + #endif + } hooks/post-receive -- IPFire 2.x development tree

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 3.x development tree branch, master, updated. 7fbbee2a91ec58408251cbba650ac2cf41f8cbe0
by git＠ipfire.org 23 Mar '12

23 Mar '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree". The branch, master has been updated via 7fbbee2a91ec58408251cbba650ac2cf41f8cbe0 (commit) via 355df181b402058e1200097fe8539d3ab4f3dfaa (commit) from 3bbe332e0b61b9a4ef97de5cfeb3fbf6cbfa08ae (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 7fbbee2a91ec58408251cbba650ac2cf41f8cbe0 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Mar 23 13:53:22 2012 +0100 pygpgme: New package. This is a python module which makes libgpgme usable with python. commit 355df181b402058e1200097fe8539d3ab4f3dfaa Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Mar 23 13:52:24 2012 +0100 gpgme: New package. This is a high-level crypto library which provides and easy to use interface to deal with PGP messages. ----------------------------------------------------------------------- Summary of changes: gpgme/gpgme.nm | 63 +++++++++++++++++ gpgme/patches/gpgme-1.2.0-largefile.patch | 24 +++++++ gpgme/patches/gpgme-1.3.0-ImplicitDSOLinking.patch | 72 ++++++++++++++++++++ gpgme/patches/gpgme-1.3.0-config_extras.patch | 36 ++++++++++ .../python-pyaspects.nm => pygpgme/pygpgme.nm | 21 +++--- 5 files changed, 206 insertions(+), 10 deletions(-) create mode 100644 gpgme/gpgme.nm create mode 100644 gpgme/patches/gpgme-1.2.0-largefile.patch create mode 100644 gpgme/patches/gpgme-1.3.0-ImplicitDSOLinking.patch create mode 100644 gpgme/patches/gpgme-1.3.0-config_extras.patch copy python-pyaspects/python-pyaspects.nm => pygpgme/pygpgme.nm (53%) Difference in files: diff --git a/gpgme/gpgme.nm b/gpgme/gpgme.nm new file mode 100644 index 0000000..317a046 --- /dev/null +++ b/gpgme/gpgme.nm @@ -0,0 +1,63 @@ +############################################################################### +# IPFire.org - An Open Source Firewall Solution # +# Copyright (C) - IPFire Development Team <info(a)ipfire.org> # +############################################################################### + +name = gpgme +version = 1.3.0 +release = 1 + +groups = Applications/System +url = http://www.gnupg.org/related_software/gpgme/ +license = LGPLv2+ +summary = GnuPG Made Easy - high level crypto API. + +description + GnuPG Made Easy (GPGME) is a library designed to make access to GnuPG + easier for applications. It provides a high-level crypto API for + encryption, decryption, signing, signature verification and key + management. +end + +source_dl = ftp://ftp.gnupg.org/gcrypt/gpgme/ +sources = %{thisapp}.tar.bz2 + +build + requires + gawk + gnupg2 + libassuan-devel + libgpg-error-devel + pth-devel + which + end + + configure_options += \ + --with-gpg=%{bindir}/gpg2 \ + --disable-gpg-test + + test + make -C tests check + end + + install_cmds + # Remove LISP examples. + rm -rfv %{BUILDROOT}%{datadir}/common-lisp/ + end +end + +packages + package %{name} + requires = gnupg2 + end + + package %{name}-devel + template DEVEL + + requires += libgpg-error-devel + end + + package %{name}-debuginfo + template DEBUGINFO + end +end diff --git a/gpgme/patches/gpgme-1.2.0-largefile.patch b/gpgme/patches/gpgme-1.2.0-largefile.patch new file mode 100644 index 0000000..98f9039 --- /dev/null +++ b/gpgme/patches/gpgme-1.2.0-largefile.patch @@ -0,0 +1,24 @@ +diff -up gpgme-1.2.0/src/gpgme-config.in.largefile gpgme-1.2.0/src/gpgme-config.in +--- gpgme-1.2.0/src/gpgme-config.in.largefile 2010-08-11 20:11:49.000000000 +0200 ++++ gpgme-1.2.0/src/gpgme-config.in 2010-08-11 20:23:45.000000000 +0200 +@@ -42,6 +42,10 @@ cflags_pthread="" + cflags_glib="@GLIB_CFLAGS@" + with_glib= + ++if test "0@NEED__FILE_OFFSET_BITS@" -gt "0" ; then ++ cflags_lfs="-D_FILE_OFFSET_BITS=@NEED__FILE_OFFSET_BITS@" ++fi ++ + output="" + + usage() +@@ -101,6 +105,9 @@ while test $# -gt 0; do + exit 0 + ;; + --cflags) ++ if test "x$cflags_lfs" != "x"; then ++ output="$output $cflags_lfs" ++ fi + if test "x$includedir" != "x/usr/include" -a "x$includedir" != "x/include"; then + output="$output -I$includedir" + fi diff --git a/gpgme/patches/gpgme-1.3.0-ImplicitDSOLinking.patch b/gpgme/patches/gpgme-1.3.0-ImplicitDSOLinking.patch new file mode 100644 index 0000000..cd2f7a5 --- /dev/null +++ b/gpgme/patches/gpgme-1.3.0-ImplicitDSOLinking.patch @@ -0,0 +1,72 @@ +diff -up gpgme-1.3.0/src/Makefile.am.ImplicitDSOLinking gpgme-1.3.0/src/Makefile.am +--- gpgme-1.3.0/src/Makefile.am.ImplicitDSOLinking 2010-01-06 04:02:19.000000000 +0100 ++++ gpgme-1.3.0/src/Makefile.am 2011-02-11 18:14:54.000000000 +0100 +@@ -232,7 +232,7 @@ libgpgme_qt_la_LIBADD = $(gpgme_res) @LI + endif + + noinst_PROGRAMS = gpgme-tool +-gpgme_tool_LDADD = libgpgme.la ++gpgme_tool_LDADD = libgpgme.la @LIBASSUAN_LIBS@ @GPG_ERROR_LIBS@ + + status-table.h : gpgme.h + $(srcdir)/mkstatus < $(builddir)/gpgme.h > status-table.h +diff -up gpgme-1.3.0/src/Makefile.in.ImplicitDSOLinking gpgme-1.3.0/src/Makefile.in +--- gpgme-1.3.0/src/Makefile.in.ImplicitDSOLinking 2010-01-11 12:06:54.000000000 +0100 ++++ gpgme-1.3.0/src/Makefile.in 2011-02-11 18:17:10.000000000 +0100 +@@ -572,7 +572,7 @@ libgpgme_pth_la_LIBADD = $(gpgme_res) @L + @BUILD_W32_QT_TRUE@libgpgme_qt_la_LIBADD = $(gpgme_res) @LIBASSUAN_LIBS@ @LTLIBOBJS@ \ + @BUILD_W32_QT_TRUE@ @GPG_ERROR_LIBS@ @QT4_CORE_LIBS@ + +-gpgme_tool_LDADD = libgpgme.la ++gpgme_tool_LDADD = libgpgme.la @LIBASSUAN_LIBS@ @GPG_ERROR_LIBS@ + all: $(BUILT_SOURCES) + $(MAKE) $(AM_MAKEFLAGS) all-am + +diff -up gpgme-1.3.0/tests/gpgsm/Makefile.am.ImplicitDSOLinking gpgme-1.3.0/tests/gpgsm/Makefile.am +--- gpgme-1.3.0/tests/gpgsm/Makefile.am.ImplicitDSOLinking 2008-12-03 14:39:48.000000000 +0100 ++++ gpgme-1.3.0/tests/gpgsm/Makefile.am 2011-02-11 17:36:32.000000000 +0100 +@@ -32,7 +32,7 @@ EXTRA_DIST = cert_dfn_pca01.der cert_dfn + INCLUDES = -I$(top_builddir)/src + + AM_CPPFLAGS = @GPG_ERROR_CFLAGS@ +-LDADD = ../../src/libgpgme.la ++LDADD = ../../src/libgpgme.la @GPG_ERROR_LIBS@ + + # We don't run t-genkey in the test suite, because it takes too long + # and needs a working pinentry. +diff -up gpgme-1.3.0/tests/gpgsm/Makefile.in.ImplicitDSOLinking gpgme-1.3.0/tests/gpgsm/Makefile.in +--- gpgme-1.3.0/tests/gpgsm/Makefile.in.ImplicitDSOLinking 2010-01-11 12:06:54.000000000 +0100 ++++ gpgme-1.3.0/tests/gpgsm/Makefile.in 2011-02-11 17:36:32.000000000 +0100 +@@ -307,7 +307,7 @@ EXTRA_DIST = cert_dfn_pca01.der cert_dfn + + INCLUDES = -I$(top_builddir)/src + AM_CPPFLAGS = @GPG_ERROR_CFLAGS@ +-LDADD = ../../src/libgpgme.la ++LDADD = ../../src/libgpgme.la @GPG_ERROR_LIBS@ + key_id = 32100C27173EF6E9C4E9A25D3D69F86D37A4F939 + DISTCLEANFILES = pubring.kbx pubring.kbx~ gpgsm.conf trustlist.txt \ + private-keys-v1.d/$(key_id).key random_seed +diff -up gpgme-1.3.0/tests/opassuan/Makefile.am.ImplicitDSOLinking gpgme-1.3.0/tests/opassuan/Makefile.am +--- gpgme-1.3.0/tests/opassuan/Makefile.am.ImplicitDSOLinking 2009-01-26 15:15:26.000000000 +0100 ++++ gpgme-1.3.0/tests/opassuan/Makefile.am 2011-02-11 17:36:32.000000000 +0100 +@@ -27,7 +27,7 @@ EXTRA_DIST = + INCLUDES = -I$(top_builddir)/src + + AM_CPPFLAGS = @GPG_ERROR_CFLAGS@ +-LDADD = ../../src/libgpgme.la ++LDADD = ../../src/libgpgme.la @GPG_ERROR_LIBS@ + + noinst_PROGRAMS = $(TESTS) t-command + +diff -up gpgme-1.3.0/tests/opassuan/Makefile.in.ImplicitDSOLinking gpgme-1.3.0/tests/opassuan/Makefile.in +--- gpgme-1.3.0/tests/opassuan/Makefile.in.ImplicitDSOLinking 2010-01-11 12:06:54.000000000 +0100 ++++ gpgme-1.3.0/tests/opassuan/Makefile.in 2011-02-11 17:36:32.000000000 +0100 +@@ -258,7 +258,7 @@ noinst_HEADERS = + EXTRA_DIST = + INCLUDES = -I$(top_builddir)/src + AM_CPPFLAGS = @GPG_ERROR_CFLAGS@ +-LDADD = ../../src/libgpgme.la ++LDADD = ../../src/libgpgme.la @GPG_ERROR_LIBS@ + DISTCLEANFILES = + all: all-am + diff --git a/gpgme/patches/gpgme-1.3.0-config_extras.patch b/gpgme/patches/gpgme-1.3.0-config_extras.patch new file mode 100644 index 0000000..7b9a643 --- /dev/null +++ b/gpgme/patches/gpgme-1.3.0-config_extras.patch @@ -0,0 +1,36 @@ +diff -up gpgme-1.3.0/src/gpgme-config.in.config_extras gpgme-1.3.0/src/gpgme-config.in +--- gpgme-1.3.0/src/gpgme-config.in.config_extras 2009-10-23 08:44:56.000000000 -0500 ++++ gpgme-1.3.0/src/gpgme-config.in 2011-03-17 13:15:12.511565537 -0500 +@@ -20,26 +20,26 @@ LC_ALL=C + LANG=C + + # Network libraries. +-assuan_cflags="@LIBASSUAN_CFLAGS@" +-assuan_libs="@LIBASSUAN_LIBS@" ++#assuan_cflags="@LIBASSUAN_CFLAGS@" ++#assuan_libs="@LIBASSUAN_LIBS@" + + # Configure libgpg-error. + gpg_error_cflags="@GPG_ERROR_CFLAGS@" +-gpg_error_libs="@GPG_ERROR_LIBS@" ++#gpg_error_libs="@GPG_ERROR_LIBS@" + + # Configure thread packages. + thread_modules="" + + @HAVE_PTH_TRUE@thread_modules="$thread_modules pth" +-libs_pth="@PTH_LDFLAGS@ @PTH_LIBS@" ++#libs_pth="@PTH_LDFLAGS@ @PTH_LIBS@" + cflags_pth="@PTH_CFLAGS@" + + @HAVE_PTHREAD_TRUE@thread_modules="$thread_modules pthread" +-libs_pthread="-lpthread" ++#libs_pthread="-lpthread" + cflags_pthread="" + + # Configure glib. +-libs_glib="@GLIB_LIBS@" ++#libs_glib="@GLIB_LIBS@" + cflags_glib="@GLIB_CFLAGS@" + with_glib= + diff --git a/pygpgme/pygpgme.nm b/pygpgme/pygpgme.nm new file mode 100644 index 0000000..f3facd7 --- /dev/null +++ b/pygpgme/pygpgme.nm @@ -0,0 +1,44 @@ +############################################################################### +# IPFire.org - An Open Source Firewall Solution # +# Copyright (C) - IPFire Development Team <info(a)ipfire.org> # +############################################################################### + +name = pygpgme +version = 0.3 +release = 1 + +groups = Development/Languages +url = http://cheeseshop.python.org/pypi/pygpgme +license = LGPLv2+ +summary = Python module for working with OpenPGP messages. + +description + PyGPGME is a Python module that lets you sign, verify, encrypt and decrypt + files using the OpenPGP format. It is built on top of GNU Privacy Guard and + the GPGME library. +end + +source_dl = http://cheeseshop.python.org/packages/source/p/%{name}/ + +build + requires + gpgme-devel + python-devel + end + + build + python setup.py build + end + + install + python setup.py install --skip-build --root %{BUILDROOT} + end +end + +packages + package %{name} + + package %{name}-debuginfo + template DEBUGINFO + end +end hooks/post-receive -- IPFire 3.x development tree

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 3.x development tree branch, master, updated. 3bbe332e0b61b9a4ef97de5cfeb3fbf6cbfa08ae
by git＠ipfire.org 23 Mar '12

23 Mar '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree". The branch, master has been updated via 3bbe332e0b61b9a4ef97de5cfeb3fbf6cbfa08ae (commit) from 270879eca1d99cc0b14735588ff188e7479b833e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 3bbe332e0b61b9a4ef97de5cfeb3fbf6cbfa08ae Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Mar 23 13:20:17 2012 +0100 pakfire: Update to 0.9.21. ----------------------------------------------------------------------- Summary of changes: pakfire/pakfire.nm | 4 +- ...ange-default-hub-to-pakfirehub.ipfire.org.patch | 91 -------------------- ...pakfire-0.9.20-check-for-nested-BUILDROOT.patch | 25 ------ .../pakfire-0.9.20-dont-download-mirrorlists.patch | 53 ----------- .../patches/pakfire-0.9.20-fix-library-check.patch | 36 -------- .../pakfire-0.9.20-fix-ls-dir-listing.patch | 25 ------ .../pakfire-0.9.20-fix-searching-too-deep.patch | 19 ---- .../patches/pakfire-0.9.20-pkgconfig-deps.patch | 37 -------- .../pakfire-0.9.20-python-abi-find-requires.patch | 29 ------ ...akfire-0.9.20-revert-libs-location-in-usr.patch | 22 ----- .../patches/pakfire-0.9.20-sharedstatedir.patch | 25 ------ ...positories-only-when-are-actually-enabled.patch | 63 -------------- 12 files changed, 2 insertions(+), 427 deletions(-) delete mode 100644 pakfire/patches/pakfire-0.9.20-change-default-hub-to-pakfirehub.ipfire.org.patch delete mode 100644 pakfire/patches/pakfire-0.9.20-check-for-nested-BUILDROOT.patch delete mode 100644 pakfire/patches/pakfire-0.9.20-dont-download-mirrorlists.patch delete mode 100644 pakfire/patches/pakfire-0.9.20-fix-library-check.patch delete mode 100644 pakfire/patches/pakfire-0.9.20-fix-ls-dir-listing.patch delete mode 100644 pakfire/patches/pakfire-0.9.20-fix-searching-too-deep.patch delete mode 100644 pakfire/patches/pakfire-0.9.20-pkgconfig-deps.patch delete mode 100644 pakfire/patches/pakfire-0.9.20-python-abi-find-requires.patch delete mode 100644 pakfire/patches/pakfire-0.9.20-revert-libs-location-in-usr.patch delete mode 100644 pakfire/patches/pakfire-0.9.20-sharedstatedir.patch delete mode 100644 pakfire/patches/pakfire-0.9.20-update-repositories-only-when-are-actually-enabled.patch Difference in files: diff --git a/pakfire/pakfire.nm b/pakfire/pakfire.nm index f615de8..3a418a6 100644 --- a/pakfire/pakfire.nm +++ b/pakfire/pakfire.nm @@ -4,8 +4,8 @@ ############################################################################### name = pakfire -version = 0.9.20 -release = 7 +version = 0.9.21 +release = 1 maintainer = Michael Tremer <michael.tremer(a)ipfire.org> groups = System/Packaging diff --git a/pakfire/patches/pakfire-0.9.20-change-default-hub-to-pakfirehub.ipfire.org.patch b/pakfire/patches/pakfire-0.9.20-change-default-hub-to-pakfirehub.ipfire.org.patch deleted file mode 100644 index dce9bfd..0000000 --- a/pakfire/patches/pakfire-0.9.20-change-default-hub-to-pakfirehub.ipfire.org.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 0f8823593c2c815b3dc2c7c9cb74b4d7a6b218de Mon Sep 17 00:00:00 2001 -From: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Wed, 29 Feb 2012 12:29:07 +0100 -Subject: [PATCH] Change default hub to pakfirehub.ipfire.org. - ---- - examples/client.conf | 2 +- - examples/daemon.conf | 2 +- - python/pakfire/client/base.py | 2 +- - python/pakfire/config.py | 4 ++-- - python/pakfire/constants.py | 3 +++ - 5 files changed, 8 insertions(+), 5 deletions(-) - -diff --git a/examples/client.conf b/examples/client.conf -index da57d03..6c59de9 100644 ---- a/examples/client.conf -+++ b/examples/client.conf -@@ -3,7 +3,7 @@ - [client] - - # The URL of the server to connect to. --# server = https://pakfire.ipfire.org/ -+# server = https://pakfirehub.ipfire.org/ - - # Your credentials to log in on the hub. - # username = ipfire -diff --git a/examples/daemon.conf b/examples/daemon.conf -index 525cc1f..143a7f6 100644 ---- a/examples/daemon.conf -+++ b/examples/daemon.conf -@@ -3,7 +3,7 @@ - [daemon] - - # The URL of the server to connect to. --# server = https://pakfire.ipfire.org/ -+# server = https://pakfirehub.ipfire.org/ - - # The hostname of this machine. - # hostname = <automatically detected> -diff --git a/python/pakfire/client/base.py b/python/pakfire/client/base.py -index 1886e2b..3ac4bef 100644 ---- a/python/pakfire/client/base.py -+++ b/python/pakfire/client/base.py -@@ -51,7 +51,7 @@ class PakfireClient(object): - ret += "%s:%s@" % (username, password) - - # Add host and path components. -- ret += "%s/pakfirehub/%s" % (url.netloc, self.type) -+ ret += "/".join((url.netloc, self.type)) - - return ret - -diff --git a/python/pakfire/config.py b/python/pakfire/config.py -index c7ab143..0d32784 100644 ---- a/python/pakfire/config.py -+++ b/python/pakfire/config.py -@@ -237,7 +237,7 @@ class ConfigClient(_Config): - "client" : { - # The default server is the official Pakfire - # server. -- "server" : "https://pakfire.ipfire.org", -+ "server" : PAKFIRE_HUB, - }, - } - -@@ -249,7 +249,7 @@ class ConfigDaemon(_Config): - "daemon" : { - # The default server is the official Pakfire - # server. -- "server" : "https://pakfire.ipfire.org", -+ "server" : PAKFIRE_HUB, - - # The default hostname is the host name of this - # machine. -diff --git a/python/pakfire/constants.py b/python/pakfire/constants.py -index 2998ab7..2c091e4 100644 ---- a/python/pakfire/constants.py -+++ b/python/pakfire/constants.py -@@ -27,6 +27,9 @@ from __version__ import PAKFIRE_VERSION - - PAKFIRE_LEAST_COMPATIBLE_VERSION = PAKFIRE_VERSION - -+# The default hub to connect to. -+PAKFIRE_HUB = "https://pakfirehub.ipfire.org/" -+ - SYSCONFDIR = "/etc" - SCRIPT_DIR = "/usr/lib/pakfire" - --- -1.7.3.4 - diff --git a/pakfire/patches/pakfire-0.9.20-check-for-nested-BUILDROOT.patch b/pakfire/patches/pakfire-0.9.20-check-for-nested-BUILDROOT.patch deleted file mode 100644 index cadeaa6..0000000 --- a/pakfire/patches/pakfire-0.9.20-check-for-nested-BUILDROOT.patch +++ /dev/null @@ -1,25 +0,0 @@ -From cd37f1637dc038f2ebdfc514882e4b600d85a606 Mon Sep 17 00:00:00 2001 -From: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Sat, 10 Mar 2012 13:25:41 +0100 -Subject: [PATCH] QA: Check for nested $BUILDROOT. - ---- - tools/quality-agent.d/095-directory-layout | 2 +- - 1 files changed, 1 insertions(+), 1 deletions(-) - -diff --git a/tools/quality-agent.d/095-directory-layout b/tools/quality-agent.d/095-directory-layout -index 3f946a1..d605fe9 100755 ---- a/tools/quality-agent.d/095-directory-layout -+++ b/tools/quality-agent.d/095-directory-layout -@@ -4,7 +4,7 @@ - - DESC="The filelayout should comply to the FHS." - --DIRS="/etc/init.d /etc/rc.d /lib/pkgconfig /usr/etc /usr/libexec /usr/local /usr/man /usr/usr /usr/var" -+DIRS="/etc/init.d /etc/rc.d /lib/pkgconfig /usr/etc /usr/libexec /usr/local /usr/man /usr/usr /usr/var ${BUILDROOT}" - - function check() { - # Do nothing, if directory check was disabled. --- -1.7.3.4 - diff --git a/pakfire/patches/pakfire-0.9.20-dont-download-mirrorlists.patch b/pakfire/patches/pakfire-0.9.20-dont-download-mirrorlists.patch deleted file mode 100644 index c8cafc6..0000000 --- a/pakfire/patches/pakfire-0.9.20-dont-download-mirrorlists.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 90919c62214dd821048027cce5752a8d7f64d437 Mon Sep 17 00:00:00 2001 -From: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Wed, 29 Feb 2012 18:37:50 +0100 -Subject: [PATCH] Don't download mirrorlist at repository initialization. - ---- - python/pakfire/downloader.py | 9 +++++++-- - 1 files changed, 7 insertions(+), 2 deletions(-) - -diff --git a/python/pakfire/downloader.py b/python/pakfire/downloader.py -index 3bfbff2..f89681f 100644 ---- a/python/pakfire/downloader.py -+++ b/python/pakfire/downloader.py -@@ -190,8 +190,6 @@ class MirrorList(object): - # Save URL to more mirrors. - self.mirrorlist = repo._mirrors - -- self.update(force=False) -- - @property - def distro(self): - return self.repo.distro -@@ -245,6 +243,7 @@ class MirrorList(object): - f.close() - - # Read mirrorlist from cache and parse it. -+ self.forget_mirrors() - with self.cache.open(cache_filename) as f: - self.parse_mirrordata(f.read()) - -@@ -259,6 +258,9 @@ class MirrorList(object): - - self.__mirrors.append(mirror) - -+ def forget_mirrors(self): -+ self.__mirrors = [] -+ - @property - def preferred(self): - """ -@@ -289,6 +291,9 @@ class MirrorList(object): - """ - Return a MirrorGroup object for the given grabber. - """ -+ # Make sure the mirrorlist is up to date. -+ self.update() -+ - # A list of mirrors that is passed to MirrorGroup. - mirrors = [] - --- -1.7.3.4 - diff --git a/pakfire/patches/pakfire-0.9.20-fix-library-check.patch b/pakfire/patches/pakfire-0.9.20-fix-library-check.patch deleted file mode 100644 index 8bde631..0000000 --- a/pakfire/patches/pakfire-0.9.20-fix-library-check.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 1f2968430df446dcbf0e27ff870ac7aa6e8113cd Mon Sep 17 00:00:00 2001 -From: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Tue, 6 Mar 2012 16:11:01 +0100 -Subject: [PATCH] Fix library check when updating GCC. - -As it only happens on ARM, the new GCC libdir is not found. ---- - tools/quality-agent.d/003-libs-location | 7 +++++-- - 1 files changed, 5 insertions(+), 2 deletions(-) - -diff --git a/tools/quality-agent.d/003-libs-location b/tools/quality-agent.d/003-libs-location -index 48b2521..ce5ba72 100755 ---- a/tools/quality-agent.d/003-libs-location -+++ b/tools/quality-agent.d/003-libs-location -@@ -16,13 +16,16 @@ esac - - # Find gcc libdir. - gcc_libdir=$(gcc -print-libgcc-file-name) --gcc_libdir=$(dirname ${gcc_libdir}) -+for i in 1 2; do -+ gcc_libdir=$(dirname ${gcc_libdir}) -+done -+gcc_libdir=$(ls ${BUILDROOT}${gcc_libdir}/* 2>/dev/null | tail -n1) - - function check() { - local failed=0 - local found - -- for lib in $(find ${BUILDROOT}/${libdir} -type f -name "lib*.so.*" 2>/dev/null); do -+ for lib in $(find ${BUILDROOT}/{,usr/}${libdir} -type f -name "lib*.so.*" 2>/dev/null); do - lib=${lib##*/} - lib=${lib%%.so*} - --- -1.7.3.4 - diff --git a/pakfire/patches/pakfire-0.9.20-fix-ls-dir-listing.patch b/pakfire/patches/pakfire-0.9.20-fix-ls-dir-listing.patch deleted file mode 100644 index 506778a..0000000 --- a/pakfire/patches/pakfire-0.9.20-fix-ls-dir-listing.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 123f594fe738d6eb0a9238d094bbfbce7d4355b3 Mon Sep 17 00:00:00 2001 -From: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Sat, 10 Mar 2012 11:45:20 +0100 -Subject: [PATCH] QA: Don't use ls to list all directories in libs-location check. - ---- - tools/quality-agent.d/003-libs-location | 2 +- - 1 files changed, 1 insertions(+), 1 deletions(-) - -diff --git a/tools/quality-agent.d/003-libs-location b/tools/quality-agent.d/003-libs-location -index ce5ba72..4c2e8ba 100755 ---- a/tools/quality-agent.d/003-libs-location -+++ b/tools/quality-agent.d/003-libs-location -@@ -19,7 +19,7 @@ gcc_libdir=$(gcc -print-libgcc-file-name) - for i in 1 2; do - gcc_libdir=$(dirname ${gcc_libdir}) - done --gcc_libdir=$(ls ${BUILDROOT}${gcc_libdir}/* 2>/dev/null | tail -n1) -+gcc_libdir=$(find ${BUILDROOT}${gcc_libdir}/* -type d -maxdepth 1 2>/dev/null | sort | head -n1) - - function check() { - local failed=0 --- -1.7.3.4 - diff --git a/pakfire/patches/pakfire-0.9.20-fix-searching-too-deep.patch b/pakfire/patches/pakfire-0.9.20-fix-searching-too-deep.patch deleted file mode 100644 index 0f6f328..0000000 --- a/pakfire/patches/pakfire-0.9.20-fix-searching-too-deep.patch +++ /dev/null @@ -1,19 +0,0 @@ -commit da1de278eca7d6663cce89f7c1ad2a312fda8abb -Author: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Sun Mar 11 15:03:21 2012 +0100 - - QA: libs-location: Don't search in the deep. - -diff --git a/tools/quality-agent.d/003-libs-location b/tools/quality-agent.d/003-libs-location -index 4c2e8ba..479f170 100755 ---- a/tools/quality-agent.d/003-libs-location -+++ b/tools/quality-agent.d/003-libs-location -@@ -25,7 +25,7 @@ function check() { - local failed=0 - local found - -- for lib in $(find ${BUILDROOT}/{,usr/}${libdir} -type f -name "lib*.so.*" 2>/dev/null); do -+ for lib in $(find ${BUILDROOT}/{,usr/}${libdir} -maxdepth 1 -type f -name "lib*.so.*" 2>/dev/null); do - lib=${lib##*/} - lib=${lib%%.so*} - diff --git a/pakfire/patches/pakfire-0.9.20-pkgconfig-deps.patch b/pakfire/patches/pakfire-0.9.20-pkgconfig-deps.patch deleted file mode 100644 index 1304cb9..0000000 --- a/pakfire/patches/pakfire-0.9.20-pkgconfig-deps.patch +++ /dev/null @@ -1,37 +0,0 @@ -commit 6230230c96c4961d6e5e7aed176d4859dd744b03 -Author: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Sat Mar 17 13:12:57 2012 +0100 - - Fix automatic pkgconfig dependencies. - - The pkgconfig package was added as "provides" instead of a - dependency when .pc files were in a package. - -diff --git a/tools/find-provides b/tools/find-provides -index 8a3e3cb..0be2de7 100755 ---- a/tools/find-provides -+++ b/tools/find-provides -@@ -81,9 +81,6 @@ if [ -n "${pkgconfig}" -a -x "${pkgconfig}" ]; then - # We have a dependency. Make a note that we need the pkgconfig - # tool for this package. - echo "pkgconfig(${n}) ${r} ${v}" -- -- # The dependency on the pkgconfig package itself. -- echo "pkgconfig" - done - done | sort -u - fi -diff --git a/tools/find-requires b/tools/find-requires -index 044c59f..9a98c32 100755 ---- a/tools/find-requires -+++ b/tools/find-requires -@@ -142,6 +142,9 @@ fi - pkgconfig=$(which pkg-config) - if [ -n "${pkgconfig}" -a -x "${pkgconfig}" ]; then - for file in ${pkgconfig_files}; do -+ # The dependency for the pkgconfig package itself. -+ echo "pkgconfig" -+ - ${pkgconfig} --print-requires --print-requires-private "${file}" 2> /dev/null | while read n r v ; do - echo "pkgconfig(${n})" "${r}" "${v}" - done diff --git a/pakfire/patches/pakfire-0.9.20-python-abi-find-requires.patch b/pakfire/patches/pakfire-0.9.20-python-abi-find-requires.patch deleted file mode 100644 index 512d454..0000000 --- a/pakfire/patches/pakfire-0.9.20-python-abi-find-requires.patch +++ /dev/null @@ -1,29 +0,0 @@ -commit d16c15690f94589c2667a5096c21cec16daee7b7 -Author: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Sun Mar 11 19:53:10 2012 +0100 - - find-requires: Filter false positives for python abi. - -diff --git a/tools/find-requires b/tools/find-requires -index 52b6651..044c59f 100755 ---- a/tools/find-requires -+++ b/tools/find-requires -@@ -43,14 +43,16 @@ while read file; do - */usr/lib*/python*/*) - # Sort out all python files. - ;; -- */usr/lib*/python*) -+ */usr/lib/python*|*/usr/lib64/python*) - # This will only get the python directory. - file=$(basename ${file}) - - # Strip the python version from the string. - python_version="${file#python}" - -- echo "python-abi = ${python_version}" -+ if [ -n "${python_version}" ]; then -+ echo "python-abi = ${python_version}" -+ fi - continue - ;; - esac diff --git a/pakfire/patches/pakfire-0.9.20-revert-libs-location-in-usr.patch b/pakfire/patches/pakfire-0.9.20-revert-libs-location-in-usr.patch deleted file mode 100644 index f5b6dda..0000000 --- a/pakfire/patches/pakfire-0.9.20-revert-libs-location-in-usr.patch +++ /dev/null @@ -1,22 +0,0 @@ -commit 882bb1851ab12ee3ba1561552faf90850e212052 -Author: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Sun Mar 11 17:59:34 2012 +0100 - - QA: libs-location: Revert checking in /usr/lib(64). - - That was not such a good idea because upstream is messing - too much with library names. - -diff --git a/tools/quality-agent.d/003-libs-location b/tools/quality-agent.d/003-libs-location -index 479f170..0ee8237 100755 ---- a/tools/quality-agent.d/003-libs-location -+++ b/tools/quality-agent.d/003-libs-location -@@ -25,7 +25,7 @@ function check() { - local failed=0 - local found - -- for lib in $(find ${BUILDROOT}/{,usr/}${libdir} -maxdepth 1 -type f -name "lib*.so.*" 2>/dev/null); do -+ for lib in $(find ${BUILDROOT}/${libdir} -maxdepth 1 -type f -name "lib*.so.*" 2>/dev/null); do - lib=${lib##*/} - lib=${lib%%.so*} - diff --git a/pakfire/patches/pakfire-0.9.20-sharedstatedir.patch b/pakfire/patches/pakfire-0.9.20-sharedstatedir.patch deleted file mode 100644 index 8c582bd..0000000 --- a/pakfire/patches/pakfire-0.9.20-sharedstatedir.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 7cefdc0a2cb917e16c95d522fb1e3d4ed600faca Mon Sep 17 00:00:00 2001 -From: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Wed, 7 Mar 2012 17:11:37 +0100 -Subject: [PATCH] Fix definition of sharedstatedir. - ---- - macros/arch.macro | 2 +- - 1 files changed, 1 insertions(+), 1 deletions(-) - -diff --git a/macros/arch.macro b/macros/arch.macro -index e756b8e..536e9d2 100644 ---- a/macros/arch.macro -+++ b/macros/arch.macro -@@ -8,7 +8,7 @@ sbindir = %{exec_prefix}/sbin - libexecdir = %{exec_prefix}/lib - datadir = %{prefix}/share - sysconfdir = /etc --sharedstatedir = %{prefix}/com -+sharedstatedir = %{localstatedir}/lib - localstatedir = /var - lib = lib - libdir = %{exec_prefix}/%{lib} --- -1.7.3.4 - diff --git a/pakfire/patches/pakfire-0.9.20-update-repositories-only-when-are-actually-enabled.patch b/pakfire/patches/pakfire-0.9.20-update-repositories-only-when-are-actually-enabled.patch deleted file mode 100644 index e8f4132..0000000 --- a/pakfire/patches/pakfire-0.9.20-update-repositories-only-when-are-actually-enabled.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 8fe602a7c5b3de4c4531d05c0dc1cf4d6bb9fb06 Mon Sep 17 00:00:00 2001 -From: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Wed, 29 Feb 2012 11:10:33 +0100 -Subject: [PATCH] Update repositories only when they are actually enabled. - ---- - python/pakfire/cli.py | 8 +++++++- - python/pakfire/repository/__init__.py | 4 ++++ - python/pakfire/repository/base.py | 3 ++- - 3 files changed, 13 insertions(+), 2 deletions(-) - -diff --git a/python/pakfire/cli.py b/python/pakfire/cli.py -index 8bab886..7a94900 100644 ---- a/python/pakfire/cli.py -+++ b/python/pakfire/cli.py -@@ -768,8 +768,14 @@ class CliBuilderIntern(Cli): - - conf = config.ConfigBuilder() - -+ if self.args.nodeps: -+ disable_repos = ["*"] -+ else: -+ disable_repos = None -+ - pakfire._build(pkg, builder_mode=self.args.mode, config=conf, -- arch=self.args.arch, resultdir=self.args.resultdir) -+ disable_repos=disable_repos, arch=self.args.arch, -+ resultdir=self.args.resultdir) - - - class CliClient(Cli): -diff --git a/python/pakfire/repository/__init__.py b/python/pakfire/repository/__init__.py -index f6b2f6e..39872da 100644 ---- a/python/pakfire/repository/__init__.py -+++ b/python/pakfire/repository/__init__.py -@@ -68,6 +68,10 @@ class Repositories(object): - - # Disable all repositories here as demanded on commandline - if disable_repos: -+ # * is magic to disable all repositories. -+ if "*" in disable_repos: -+ disable_repos = [r.name for r in self] -+ - for repo in disable_repos: - self.disable_repo(repo) - -diff --git a/python/pakfire/repository/base.py b/python/pakfire/repository/base.py -index 7fb8362..59d8615 100644 ---- a/python/pakfire/repository/base.py -+++ b/python/pakfire/repository/base.py -@@ -115,7 +115,8 @@ class RepositoryFactory(object): - """ - assert self.index - -- self.index.update(force, offline=offline) -+ if force or self.enabled: -+ self.index.update(force, offline=offline) - - def clean(self): - """ --- -1.7.3.4 - hooks/post-receive -- IPFire 3.x development tree

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 3.x development tree branch, master, updated. 270879eca1d99cc0b14735588ff188e7479b833e
by git＠ipfire.org 23 Mar '12

23 Mar '12

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 3.x development tree branch, master, updated. 0302fa63709ea9e906a0cada4c2b1cd5ebbbc2d7
by git＠ipfire.org 22 Mar '12

22 Mar '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree". The branch, master has been updated via 0302fa63709ea9e906a0cada4c2b1cd5ebbbc2d7 (commit) via 2b715a47b3e6035e872db81067406e829358ce8d (commit) via c2a35394ba71c9420446fa5ba0b880713389b2b6 (commit) via db92b05e823baafc39ba67073b2ca127160d4272 (commit) from 347a982fccd536e8d0ec78f6a9e312eee56a8ec4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0302fa63709ea9e906a0cada4c2b1cd5ebbbc2d7 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Mar 22 12:11:28 2012 +0100 gcc: Move libgcc_s* to /usr/lib. commit 2b715a47b3e6035e872db81067406e829358ce8d Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Mar 22 00:05:52 2012 +0100 udev: Update to version 182. commit c2a35394ba71c9420446fa5ba0b880713389b2b6 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Mar 22 00:03:20 2012 +0100 kmod: Update to version 7. Comes with minor bugfixes and improvements on the build system. commit db92b05e823baafc39ba67073b2ca127160d4272 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Mar 18 22:55:33 2012 +0100 dracut: Update to 017. ----------------------------------------------------------------------- Summary of changes: dracut/dracut.nm | 2 +- gcc/gcc.nm | 50 ++++++++++++++++++++++++-------------------------- kmod/kmod.nm | 2 +- udev/udev.nm | 4 ++-- 4 files changed, 28 insertions(+), 30 deletions(-) Difference in files: diff --git a/dracut/dracut.nm b/dracut/dracut.nm index 792d155..8c0f9c7 100644 --- a/dracut/dracut.nm +++ b/dracut/dracut.nm @@ -4,7 +4,7 @@ ############################################################################### name = dracut -version = 016 +version = 017 release = 1 arch = noarch diff --git a/gcc/gcc.nm b/gcc/gcc.nm index e25258c..bfe183f 100644 --- a/gcc/gcc.nm +++ b/gcc/gcc.nm @@ -8,7 +8,7 @@ build_cloog_ppl = 1 name = gcc version = 4.6.3 -release = 1 +release = 2 maintainer = Michael Tremer <michael.tremer(a)ipfire.org> groups = Development/Compilers @@ -226,10 +226,8 @@ build ln -sfv ../usr/bin/cpp %{BUILDROOT}/lib/cpp ln -sfv gcc %{BUILDROOT}/usr/bin/cc - # Move libgcc_s to /lib + # Fix libgcc_s symlinks. rm -f ${FULLPATH}/libgcc_s.so %{BUILDROOT}%{libdir}/libgcc_s.so - mkdir -pv %{BUILDROOT}/%{lib} - mv -vf %{BUILDROOT}%{libdir}/libgcc_s.so.1 %{BUILDROOT}/%{lib}/ case "%{DISTRO_ARCH}" in arm*) cat <<EOF >${FULLPATH}/libgcc_s.so @@ -237,11 +235,11 @@ build Use the shared library, but some functions are only in the static library, so try that secondarily. */ OUTPUT_FORMAT(elf32-littlearm) - GROUP ( /%{lib}/libgcc_s.so.1 libgcc.a ) + GROUP ( %{libdir}/libgcc_s.so.1 libgcc.a ) EOF ;; *) - ln -svf ../../../../../%{lib}/libgcc_s.so.1 ${FULLPATH}/libgcc_s.so + ln -svf ../../../../../%{libdir}/libgcc_s.so.1 ${FULLPATH}/libgcc_s.so ;; esac @@ -289,20 +287,20 @@ packages groups += Build requires - binutils>=%{required_binutils_version} + binutils >= %{required_binutils_version} glibc-devel gmp-devel - cpp=%{thisver} - libgcc=%{thisver} - libgomp=%{thisver} + cpp = %{thisver} + libgcc = %{thisver} + libgomp = %{thisver} end # We do not ship libgcc-devel anymore. - provides += libgcc-devel=%{thisver} - obsoletes += libgcc-devel<%{thisver} + provides += libgcc-devel = %{thisver} + obsoletes += libgcc-devel < %{thisver} if "%{build_cloog_ppl}" == "1" - requires += cloog-ppl>=0.15 + requires += cloog-ppl >= 0.15 end end @@ -315,9 +313,9 @@ packages end requires - gcc=%{thisver} - libstdc++=%{thisver} - libstdc++-devel=%{thisver} + gcc = %{thisver} + libstdc++ = %{thisver} + libstdc++-devel = %{thisver} end files @@ -354,7 +352,7 @@ packages group = Development/Languages files - /%{lib}/cpp + /lib/cpp /usr/bin/cpp /usr/share/man/man1/cpp.1* %{libdir}/gcc/%{DISTRO_BUILDTARGET}/%{version}/cc1 @@ -369,7 +367,7 @@ packages end files - /%{lib}/libgcc*.so.* + %{libdir}/libgcc*.so.* end end @@ -394,7 +392,7 @@ packages end requires - libstdc++=%{thisver} + libstdc++ = %{thisver} end files @@ -438,7 +436,7 @@ packages end requires - libmudflap=%{thisver} + libmudflap = %{thisver} end files @@ -469,8 +467,8 @@ packages end requires - gcc=%{thisver} - libquadmath=%{thisver} + gcc = %{thisver} + libquadmath = %{thisver} end files @@ -490,10 +488,10 @@ packages end requires - gcc=%{thisver} - gmp-devel>=4.1.2-8 - mpfr-devel>=2.2.1 - libmpc-devel>=0.8.1 + gcc = %{thisver} + gmp-devel >= 4.1.2-8 + mpfr-devel >= 2.2.1 + libmpc-devel >= 0.8.1 end files diff --git a/kmod/kmod.nm b/kmod/kmod.nm index 00233cf..1801775 100644 --- a/kmod/kmod.nm +++ b/kmod/kmod.nm @@ -4,7 +4,7 @@ ############################################################################### name = kmod -version = 6 +version = 7 release = 1 maintainer = Michael Tremer <michael.tremer(a)ipfire.org> diff --git a/udev/udev.nm b/udev/udev.nm index 8552dfe..5ca210e 100644 --- a/udev/udev.nm +++ b/udev/udev.nm @@ -4,8 +4,8 @@ ############################################################################### name = udev -version = 181 -release = 2 +version = 182 +release = 1 groups = System/Base url = ftp://ftp.kernel.org/pub/linux/utils/kernel/hotplug/ hooks/post-receive -- IPFire 3.x development tree

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 2.x development tree branch, kernel-update, updated. 13c69eff1c58b28076962bb7ecad280eb57a8d18
by git＠ipfire.org 20 Mar '12

20 Mar '12

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 2.x development tree branch, kernel-update, updated. 71fe6ae59fab69c5bf4a12d9a69ad3ad5d7195ef
by git＠ipfire.org 20 Mar '12

20 Mar '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, kernel-update has been updated via 71fe6ae59fab69c5bf4a12d9a69ad3ad5d7195ef (commit) via 3a082a7c88143b2495a9d2339cfda809bd7bf5fb (commit) via da43373bdbe9a2fd91a8a08b78b3a87f707a2f45 (commit) from 9831c245f0955f9b5bdbd46777c5fed427a7f540 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 71fe6ae59fab69c5bf4a12d9a69ad3ad5d7195ef Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Tue Mar 20 07:00:18 2012 +0100 kernel: omap - add imq and layer7 patches for kernel3.0. commit 3a082a7c88143b2495a9d2339cfda809bd7bf5fb Merge: 9831c24 da43373 Author: root <root(a)iConnect.warriors.homedns.org> Date: Sun Mar 18 15:58:21 2012 +0100 Merge commit 'origin/next' into kernel-update ----------------------------------------------------------------------- Summary of changes: config/rootfiles/packages/clamav | 6 +- lfs/clamav | 6 +- lfs/linux3 | 9 +- ...-2.6.32-imq-test2.patch => linux-3.1-imq.patch} | 1145 ++++++----- src/patches/netfilter_layer7_2.22_kernel3.0.patch | 2160 ++++++++++++++++++++ 5 files changed, 2811 insertions(+), 515 deletions(-) copy src/patches/{linux-2.6.32-imq-test2.patch => linux-3.1-imq.patch} (53%) create mode 100644 src/patches/netfilter_layer7_2.22_kernel3.0.patch Difference in files: diff --git a/config/rootfiles/packages/clamav b/config/rootfiles/packages/clamav index 7244dbb..4029074 100644 --- a/config/rootfiles/packages/clamav +++ b/config/rootfiles/packages/clamav @@ -10,15 +10,15 @@ usr/bin/sigtool #usr/lib/libclamav.la usr/lib/libclamav.so usr/lib/libclamav.so.6 -usr/lib/libclamav.so.6.1.12 +usr/lib/libclamav.so.6.1.13 #usr/lib/libclamunrar.la usr/lib/libclamunrar.so usr/lib/libclamunrar.so.6 -usr/lib/libclamunrar.so.6.1.12 +usr/lib/libclamunrar.so.6.1.13 #usr/lib/libclamunrar_iface.la usr/lib/libclamunrar_iface.so usr/lib/libclamunrar_iface.so.6 -usr/lib/libclamunrar_iface.so.6.1.12 +usr/lib/libclamunrar_iface.so.6.1.13 #usr/lib/pkgconfig/libclamav.pc usr/sbin/clamd usr/share/clamav diff --git a/lfs/clamav b/lfs/clamav index 5b97cfe..fe26aa2 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -24,7 +24,7 @@ include Config -VER = 0.97.3 +VER = 0.97.4 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 18 +PAK_VER = 19 DEPS = "" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 5cf25ed7778fa0cb6b140ad8f009befb +$(DL_FILE)_MD5 = dc1e5abc093b11f120e4eac94a7f78aa install : $(TARGET) diff --git a/lfs/linux3 b/lfs/linux3 index b72b78c..7680546 100644 --- a/lfs/linux3 +++ b/lfs/linux3 @@ -77,19 +77,16 @@ endif # Top-level Rules ############################################################################### objects =$(DL_FILE) \ - netfilter-layer7-v2.22.tar.gz \ patch-2.6.16-nath323-1.3.bz2 \ reiser4-for-2.6.32.patch.bz2 \ xen-patches-2.6.32-2f.tar.bz2 $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) -netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.22.tar.gz patch-2.6.16-nath323-1.3.bz2 = $(URL_IPFIRE)/patch-2.6.16-nath323-1.3.bz2 reiser4-for-2.6.32.patch.bz2 = $(URL_IPFIRE)/reiser4-for-2.6.32.patch.bz2 xen-patches-2.6.32-2f.tar.bz2 = $(URL_IPFIRE)/xen-patches-2.6.32-2f.tar.bz2 $(DL_FILE)_MD5 = 3bebfdf614f3139202c5497b40953920 -netfilter-layer7-v2.22.tar.gz_MD5 = 98dff8a3d5a31885b73341633f69501f patch-2.6.16-nath323-1.3.bz2_MD5 = f926409ff703a307baf54b57ab75d138 reiser4-for-2.6.32.patch.bz2_MD5 = 3246397973d9271eb8e6d7c97c5d2d91 xen-patches-2.6.32-2f.tar.bz2_MD5 = b59d6f89e11accb9d40354418e13f31b @@ -149,7 +146,7 @@ ifeq "$(KCFG)" "-xen" cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.32.8-xen-imq-test2.patch else # Linux Intermediate Queueing Device -# cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.32-imq-test2.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.1-imq.patch endif # Not report deprecated syscall 1.23 (for kudzu) @@ -162,9 +159,7 @@ endif # cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.32.8-ipp2p-0.8.2-pomng.patch # Layer7-patch -# cd $(DIR_SRC) && rm -rf $(DIR_SRC)/netfilter-layer7-v2.22 -# cd $(DIR_SRC) && tar xzf $(DIR_DL)/netfilter-layer7-v2.22.tar.gz -# cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/netfilter-layer7-v2.22/kernel-2.6.25-2.6.28-layer7-2.22.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/netfilter_layer7_2.22_kernel3.0.patch # Add some more LED triggers # cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.32.11-netdev-1.patch diff --git a/src/patches/linux-3.1-imq.patch b/src/patches/linux-3.1-imq.patch new file mode 100644 index 0000000..6e97f1c --- /dev/null +++ b/src/patches/linux-3.1-imq.patch @@ -0,0 +1,1603 @@ +diff -uNr linux-3.1/drivers/net/imq.c linux-3.1-imq/drivers/net/imq.c +--- linux-3.1/drivers/net/imq.c 1970-01-01 02:00:00.000000000 +0200 ++++ linux-3.1-imq/drivers/net/imq.c 2011-11-04 12:16:10.454992642 +0200 +@@ -0,0 +1,850 @@ ++/* ++ * Pseudo-driver for the intermediate queue device. ++ * ++ * This program is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU General Public License ++ * as published by the Free Software Foundation; either version ++ * 2 of the License, or (at your option) any later version. ++ * ++ * Authors: Patrick McHardy, <kaber(a)trash.net> ++ * ++ * The first version was written by Martin Devera, <devik(a)cdi.cz> ++ * ++ * Credits: Jan Rafaj <imq2t(a)cedric.vabo.cz> ++ * - Update patch to 2.4.21 ++ * Sebastian Strollo <sstrollo(a)nortelnetworks.com> ++ * - Fix "Dead-loop on netdevice imq"-issue ++ * Marcel Sebek <sebek64(a)post.cz> ++ * - Update to 2.6.2-rc1 ++ * ++ * After some time of inactivity there is a group taking care ++ * of IMQ again: http://www.linuximq.net ++ * ++ * ++ * 2004/06/30 - New version of IMQ patch to kernels <=2.6.7 ++ * including the following changes: ++ * ++ * - Correction of ipv6 support "+"s issue (Hasso Tepper) ++ * - Correction of imq_init_devs() issue that resulted in ++ * kernel OOPS unloading IMQ as module (Norbert Buchmuller) ++ * - Addition of functionality to choose number of IMQ devices ++ * during kernel config (Andre Correa) ++ * - Addition of functionality to choose how IMQ hooks on ++ * PRE and POSTROUTING (after or before NAT) (Andre Correa) ++ * - Cosmetic corrections (Norbert Buchmuller) (Andre Correa) ++ * ++ * ++ * 2005/12/16 - IMQ versions between 2.6.7 and 2.6.13 were ++ * released with almost no problems. 2.6.14-x was released ++ * with some important changes: nfcache was removed; After ++ * some weeks of trouble we figured out that some IMQ fields ++ * in skb were missing in skbuff.c - skb_clone and copy_skb_header. ++ * These functions are correctly patched by this new patch version. ++ * ++ * Thanks for all who helped to figure out all the problems with ++ * 2.6.14.x: Patrick McHardy, Rune Kock, VeNoMouS, Max CtRiX, ++ * Kevin Shanahan, Richard Lucassen, Valery Dachev (hopefully ++ * I didn't forget anybody). I apologize again for my lack of time. ++ * ++ * ++ * 2008/06/17 - 2.6.25 - Changed imq.c to use qdisc_run() instead ++ * of qdisc_restart() and moved qdisc_run() to tasklet to avoid ++ * recursive locking. New initialization routines to fix 'rmmod' not ++ * working anymore. Used code from ifb.c. (Jussi Kivilinna) ++ * ++ * 2008/08/06 - 2.6.26 - (JK) ++ * - Replaced tasklet with 'netif_schedule()'. ++ * - Cleaned up and added comments for imq_nf_queue(). ++ * ++ * 2009/04/12 ++ * - Add skb_save_cb/skb_restore_cb helper functions for backuping ++ * control buffer. This is needed because qdisc-layer on kernels ++ * 2.6.27 and newer overwrite control buffer. (Jussi Kivilinna) ++ * - Add better locking for IMQ device. Hopefully this will solve ++ * SMP issues. (Jussi Kivilinna) ++ * - Port to 2.6.27 ++ * - Port to 2.6.28 ++ * - Port to 2.6.29 + fix rmmod not working ++ * ++ * 2009/04/20 - (Jussi Kivilinna) ++ * - Use netdevice feature flags to avoid extra packet handling ++ * by core networking layer and possibly increase performance. ++ * ++ * 2009/09/26 - (Jussi Kivilinna) ++ * - Add imq_nf_reinject_lockless to fix deadlock with ++ * imq_nf_queue/imq_nf_reinject. ++ * ++ * 2009/12/08 - (Jussi Kivilinna) ++ * - Port to 2.6.32 ++ * - Add check for skb->nf_queue_entry==NULL in imq_dev_xmit() ++ * - Also add better error checking for skb->nf_queue_entry usage ++ * ++ * 2010/02/25 - (Jussi Kivilinna) ++ * - Port to 2.6.33 ++ * ++ * 2010/08/15 - (Jussi Kivilinna) ++ * - Port to 2.6.35 ++ * - Simplify hook registration by using nf_register_hooks. ++ * - nf_reinject doesn't need spinlock around it, therefore remove ++ * imq_nf_reinject function. Other nf_reinject users protect ++ * their own data with spinlock. With IMQ however all data is ++ * needed is stored per skbuff, so no locking is needed. ++ * - Changed IMQ to use 'separate' NF_IMQ_QUEUE instead of ++ * NF_QUEUE, this allows working coexistance of IMQ and other ++ * NF_QUEUE users. ++ * - Make IMQ multi-queue. Number of IMQ device queues can be ++ * increased with 'numqueues' module parameters. Default number ++ * of queues is 1, in other words by default IMQ works as ++ * single-queue device. Multi-queue selection is based on ++ * IFB multi-queue patch by Changli Gao <xiaosuo(a)gmail.com>. ++ * ++ * 2011/03/18 - (Jussi Kivilinna) ++ * - Port to 2.6.38 ++ * ++ * 2011/07/12 - (syoder89(a)gmail.com) ++ * - Crash fix that happens when the receiving interface has more ++ * than one queue (add missing skb_set_queue_mapping in ++ * imq_select_queue). ++ * ++ * 2011/07/26 - (Jussi Kivilinna) ++ * - Add queue mapping checks for packets exiting IMQ. ++ * - Port to 3.0 ++ * ++ * 2011/08/16 - (Jussi Kivilinna) ++ * - Clear IFF_TX_SKB_SHARING flag that was added for linux 3.0.2 ++ * ++ * 2011/11/03 - Germano Michel <germanomichel(a)gmail.com> ++ * - Fix IMQ for net namespaces ++ * ++ * 2011/11/04 - Jussi Kivilinna <jussi.kivilinna(a)mbnet.fi> ++ * - Port to 3.1 ++ * - Clean-up, move 'get imq device pointer by imqX name' to ++ * separate function from imq_nf_queue(). ++ * ++ * Also, many thanks to pablo Sebastian Greco for making the initial ++ * patch and to those who helped the testing. ++ * ++ * More info at: http://www.linuximq.net/ (Andre Correa) ++ */ ++ ++#include <linux/module.h> ++#include <linux/kernel.h> ++#include <linux/moduleparam.h> ++#include <linux/list.h> ++#include <linux/skbuff.h> ++#include <linux/netdevice.h> ++#include <linux/etherdevice.h> ++#include <linux/rtnetlink.h> ++#include <linux/if_arp.h> ++#include <linux/netfilter.h> ++#include <linux/netfilter_ipv4.h> ++#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) ++ #include <linux/netfilter_ipv6.h> ++#endif ++#include <linux/imq.h> ++#include <net/pkt_sched.h> ++#include <net/netfilter/nf_queue.h> ++#include <net/sock.h> ++#include <linux/ip.h> ++#include <linux/ipv6.h> ++#include <linux/if_vlan.h> ++#include <linux/if_pppox.h> ++#include <net/ip.h> ++#include <net/ipv6.h> ++ ++static int imq_nf_queue(struct nf_queue_entry *entry, unsigned queue_num); ++ ++static nf_hookfn imq_nf_hook; ++ ++static struct nf_hook_ops imq_ops[] = { ++ { ++ /* imq_ingress_ipv4 */ ++ .hook = imq_nf_hook, ++ .owner = THIS_MODULE, ++ .pf = PF_INET, ++ .hooknum = NF_INET_PRE_ROUTING, ++#if defined(CONFIG_IMQ_BEHAVIOR_BA) || defined(CONFIG_IMQ_BEHAVIOR_BB) ++ .priority = NF_IP_PRI_MANGLE + 1, ++#else ++ .priority = NF_IP_PRI_NAT_DST + 1, ++#endif ++ }, ++ { ++ /* imq_egress_ipv4 */ ++ .hook = imq_nf_hook, ++ .owner = THIS_MODULE, ++ .pf = PF_INET, ++ .hooknum = NF_INET_POST_ROUTING, ++#if defined(CONFIG_IMQ_BEHAVIOR_AA) || defined(CONFIG_IMQ_BEHAVIOR_BA) ++ .priority = NF_IP_PRI_LAST, ++#else ++ .priority = NF_IP_PRI_NAT_SRC - 1, ++#endif ++ }, ++#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) ++ { ++ /* imq_ingress_ipv6 */ ++ .hook = imq_nf_hook, ++ .owner = THIS_MODULE, ++ .pf = PF_INET6, ++ .hooknum = NF_INET_PRE_ROUTING, ++#if defined(CONFIG_IMQ_BEHAVIOR_BA) || defined(CONFIG_IMQ_BEHAVIOR_BB) ++ .priority = NF_IP6_PRI_MANGLE + 1, ++#else ++ .priority = NF_IP6_PRI_NAT_DST + 1, ++#endif ++ }, ++ { ++ /* imq_egress_ipv6 */ ++ .hook = imq_nf_hook, ++ .owner = THIS_MODULE, ++ .pf = PF_INET6, ++ .hooknum = NF_INET_POST_ROUTING, ++#if defined(CONFIG_IMQ_BEHAVIOR_AA) || defined(CONFIG_IMQ_BEHAVIOR_BA) ++ .priority = NF_IP6_PRI_LAST, ++#else ++ .priority = NF_IP6_PRI_NAT_SRC - 1, ++#endif ++ }, ++#endif ++}; ++ ++#if defined(CONFIG_IMQ_NUM_DEVS) ++static int numdevs = CONFIG_IMQ_NUM_DEVS; ++#else ++static int numdevs = IMQ_MAX_DEVS; ++#endif ++ ++static struct net_device *imq_devs_cache[IMQ_MAX_DEVS]; ++ ++#define IMQ_MAX_QUEUES 32 ++static int numqueues = 1; ++static u32 imq_hashrnd; ++ ++static inline __be16 pppoe_proto(const struct sk_buff *skb) ++{ ++ return *((__be16 *)(skb_mac_header(skb) + ETH_HLEN + ++ sizeof(struct pppoe_hdr))); ++} ++ ++static u16 imq_hash(struct net_device *dev, struct sk_buff *skb) ++{ ++ unsigned int pull_len; ++ u16 protocol = skb->protocol; ++ u32 addr1, addr2; ++ u32 hash, ihl = 0; ++ union { ++ u16 in16[2]; ++ u32 in32; ++ } ports; ++ u8 ip_proto; ++ ++ pull_len = 0; ++ ++recheck: ++ switch (protocol) { ++ case htons(ETH_P_8021Q): { ++ if (unlikely(skb_pull(skb, VLAN_HLEN) == NULL)) ++ goto other; ++ ++ pull_len += VLAN_HLEN; ++ skb->network_header += VLAN_HLEN; ++ ++ protocol = vlan_eth_hdr(skb)->h_vlan_encapsulated_proto; ++ goto recheck; ++ } ++ ++ case htons(ETH_P_PPP_SES): { ++ if (unlikely(skb_pull(skb, PPPOE_SES_HLEN) == NULL)) ++ goto other; ++ ++ pull_len += PPPOE_SES_HLEN; ++ skb->network_header += PPPOE_SES_HLEN; ++ ++ protocol = pppoe_proto(skb); ++ goto recheck; ++ } ++ ++ case htons(ETH_P_IP): { ++ const struct iphdr *iph = ip_hdr(skb); ++ ++ if (unlikely(!pskb_may_pull(skb, sizeof(struct iphdr)))) ++ goto other; ++ ++ addr1 = iph->daddr; ++ addr2 = iph->saddr; ++ ++ ip_proto = !(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) ? ++ iph->protocol : 0; ++ ihl = ip_hdrlen(skb); ++ ++ break; ++ } ++#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) ++ case htons(ETH_P_IPV6): { ++ const struct ipv6hdr *iph = ipv6_hdr(skb); ++ ++ if (unlikely(!pskb_may_pull(skb, sizeof(struct ipv6hdr)))) ++ goto other; ++ ++ addr1 = iph->daddr.s6_addr32[3]; ++ addr2 = iph->saddr.s6_addr32[3]; ++ ihl = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &ip_proto); ++ if (unlikely(ihl < 0)) ++ goto other; ++ ++ break; ++ } ++#endif ++ default: ++other: ++ if (pull_len != 0) { ++ skb_push(skb, pull_len); ++ skb->network_header -= pull_len; ++ } ++ ++ return (u16)(ntohs(protocol) % dev->real_num_tx_queues); ++ } ++ ++ if (addr1 > addr2) ++ swap(addr1, addr2); ++ ++ switch (ip_proto) { ++ case IPPROTO_TCP: ++ case IPPROTO_UDP: ++ case IPPROTO_DCCP: ++ case IPPROTO_ESP: ++ case IPPROTO_AH: ++ case IPPROTO_SCTP: ++ case IPPROTO_UDPLITE: { ++ if (likely(skb_copy_bits(skb, ihl, &ports.in32, 4) >= 0)) { ++ if (ports.in16[0] > ports.in16[1]) ++ swap(ports.in16[0], ports.in16[1]); ++ break; ++ } ++ /* fall-through */ ++ } ++ default: ++ ports.in32 = 0; ++ break; ++ } ++ ++ if (pull_len != 0) { ++ skb_push(skb, pull_len); ++ skb->network_header -= pull_len; ++ } ++ ++ hash = jhash_3words(addr1, addr2, ports.in32, imq_hashrnd ^ ip_proto); ++ ++ return (u16)(((u64)hash * dev->real_num_tx_queues) >> 32); ++} ++ ++static inline bool sk_tx_queue_recorded(struct sock *sk) ++{ ++ return (sk_tx_queue_get(sk) >= 0); ++} ++ ++static struct netdev_queue *imq_select_queue(struct net_device *dev, ++ struct sk_buff *skb) ++{ ++ u16 queue_index = 0; ++ u32 hash; ++ ++ if (likely(dev->real_num_tx_queues == 1)) ++ goto out; ++ ++ /* IMQ can be receiving ingress or engress packets. */ ++ ++ /* Check first for if rx_queue is set */ ++ if (skb_rx_queue_recorded(skb)) { ++ queue_index = skb_get_rx_queue(skb); ++ goto out; ++ } ++ ++ /* Check if socket has tx_queue set */ ++ if (sk_tx_queue_recorded(skb->sk)) { ++ queue_index = sk_tx_queue_get(skb->sk); ++ goto out; ++ } ++ ++ /* Try use socket hash */ ++ if (skb->sk && skb->sk->sk_hash) { ++ hash = skb->sk->sk_hash; ++ queue_index = ++ (u16)(((u64)hash * dev->real_num_tx_queues) >> 32); ++ goto out; ++ } ++ ++ /* Generate hash from packet data */ ++ queue_index = imq_hash(dev, skb); ++ ++out: ++ if (unlikely(queue_index >= dev->real_num_tx_queues)) ++ queue_index = (u16)((u32)queue_index % dev->real_num_tx_queues); ++ ++ skb_set_queue_mapping(skb, queue_index); ++ return netdev_get_tx_queue(dev, queue_index); ++} ++ ++static struct net_device_stats *imq_get_stats(struct net_device *dev) ++{ ++ return &dev->stats; ++} ++ ++/* called for packets kfree'd in qdiscs at places other than enqueue */ ++static void imq_skb_destructor(struct sk_buff *skb) ++{ ++ struct nf_queue_entry *entry = skb->nf_queue_entry; ++ ++ skb->nf_queue_entry = NULL; ++ ++ if (entry) { ++ nf_queue_entry_release_refs(entry); ++ kfree(entry); ++ } ++ ++ skb_restore_cb(skb); /* kfree backup */ ++} ++ ++static void imq_done_check_queue_mapping(struct sk_buff *skb, ++ struct net_device *dev) ++{ ++ unsigned int queue_index; ++ ++ /* Don't let queue_mapping be left too large after exiting IMQ */ ++ if (likely(skb->dev != dev && skb->dev != NULL)) { ++ queue_index = skb_get_queue_mapping(skb); ++ if (unlikely(queue_index >= skb->dev->real_num_tx_queues)) { ++ queue_index = (u16)((u32)queue_index % ++ skb->dev->real_num_tx_queues); ++ skb_set_queue_mapping(skb, queue_index); ++ } ++ } else { ++ /* skb->dev was IMQ device itself or NULL, be on safe side and ++ * just clear queue mapping. ++ */ ++ skb_set_queue_mapping(skb, 0); ++ } ++} ++ ++static netdev_tx_t imq_dev_xmit(struct sk_buff *skb, struct net_device *dev) ++{ ++ struct nf_queue_entry *entry = skb->nf_queue_entry; ++ ++ skb->nf_queue_entry = NULL; ++ dev->trans_start = jiffies; ++ ++ dev->stats.tx_bytes += skb->len; ++ dev->stats.tx_packets++; ++ ++ if (unlikely(entry == NULL)) { ++ /* We don't know what is going on here.. packet is queued for ++ * imq device, but (probably) not by us. ++ * ++ * If this packet was not send here by imq_nf_queue(), then ++ * skb_save_cb() was not used and skb_free() should not show: ++ * WARNING: IMQ: kfree_skb: skb->cb_next:.. ++ * and/or ++ * WARNING: IMQ: kfree_skb: skb->nf_queue_entry... ++ * ++ * However if this message is shown, then IMQ is somehow broken ++ * and you should report this to linuximq.net. ++ */ ++ ++ /* imq_dev_xmit is black hole that eats all packets, report that ++ * we eat this packet happily and increase dropped counters. ++ */ ++ ++ dev->stats.tx_dropped++; ++ dev_kfree_skb(skb); ++ ++ return NETDEV_TX_OK; ++ } ++ ++ skb_restore_cb(skb); /* restore skb->cb */ ++ ++ skb->imq_flags = 0; ++ skb->destructor = NULL; ++ ++ imq_done_check_queue_mapping(skb, dev); ++ ++ nf_reinject(entry, NF_ACCEPT); ++ ++ return NETDEV_TX_OK; ++} ++ ++static struct net_device *get_imq_device_by_index(int index) ++{ ++ struct net_device *dev = NULL; ++ struct net *net; ++ char buf[8]; ++ ++ /* get device by name and cache result */ ++ snprintf(buf, sizeof(buf), "imq%d", index); ++ ++ /* Search device from all namespaces. */ ++ for_each_net(net) { ++ dev = dev_get_by_name(net, buf); ++ if (dev) ++ break; ++ } ++ ++ if (WARN_ON_ONCE(dev == NULL)) { ++ /* IMQ device not found. Exotic config? */ ++ return ERR_PTR(-ENODEV); ++ } ++ ++ imq_devs_cache[index] = dev; ++ dev_put(dev); ++ ++ return dev; ++} ++ ++static int imq_nf_queue(struct nf_queue_entry *entry, unsigned queue_num) ++{ ++ struct net_device *dev; ++ struct sk_buff *skb_orig, *skb, *skb_shared; ++ struct Qdisc *q; ++ struct netdev_queue *txq; ++ spinlock_t *root_lock; ++ int users, index; ++ int retval = -EINVAL; ++ unsigned int orig_queue_index; ++ ++ index = entry->skb->imq_flags & IMQ_F_IFMASK; ++ if (unlikely(index > numdevs - 1)) { ++ if (net_ratelimit()) ++ printk(KERN_WARNING ++ "IMQ: invalid device specified, highest is %u\n", ++ numdevs - 1); ++ retval = -EINVAL; ++ goto out; ++ } ++ ++ /* check for imq device by index from cache */ ++ dev = imq_devs_cache[index]; ++ if (unlikely(!dev)) { ++ dev = get_imq_device_by_index(index); ++ if (IS_ERR(dev)) { ++ retval = PTR_ERR(dev); ++ goto out; ++ } ++ } ++ ++ if (unlikely(!(dev->flags & IFF_UP))) { ++ entry->skb->imq_flags = 0; ++ nf_reinject(entry, NF_ACCEPT); ++ retval = 0; ++ goto out; ++ } ++ dev->last_rx = jiffies; ++ ++ skb = entry->skb; ++ skb_orig = NULL; ++ ++ /* skb has owner? => make clone */ ++ if (unlikely(skb->destructor)) { ++ skb_orig = skb; ++ skb = skb_clone(skb, GFP_ATOMIC); ++ if (unlikely(!skb)) { ++ retval = -ENOMEM; ++ goto out; ++ } ++ entry->skb = skb; ++ } ++ ++ skb->nf_queue_entry = entry; ++ ++ dev->stats.rx_bytes += skb->len; ++ dev->stats.rx_packets++; ++ ++ if (!skb->dev) { ++ /* skb->dev == NULL causes problems, try the find cause. */ ++ if (net_ratelimit()) { ++ dev_warn(&dev->dev, ++ "received packet with skb->dev == NULL\n"); ++ dump_stack(); ++ } ++ ++ skb->dev = dev; ++ } ++ ++ /* Disables softirqs for lock below */ ++ rcu_read_lock_bh(); ++ ++ /* Multi-queue selection */ ++ orig_queue_index = skb_get_queue_mapping(skb); ++ txq = imq_select_queue(dev, skb); ++ ++ q = rcu_dereference(txq->qdisc); ++ if (unlikely(!q->enqueue)) ++ goto packet_not_eaten_by_imq_dev; ++ ++ root_lock = qdisc_lock(q); ++ spin_lock(root_lock); ++ ++ users = atomic_read(&skb->users); ++ ++ skb_shared = skb_get(skb); /* increase reference count by one */ ++ skb_save_cb(skb_shared); /* backup skb->cb, as qdisc layer will ++ overwrite it */ ++ qdisc_enqueue_root(skb_shared, q); /* might kfree_skb */ ++ ++ if (likely(atomic_read(&skb_shared->users) == users + 1)) { ++ kfree_skb(skb_shared); /* decrease reference count by one */ ++ ++ skb->destructor = &imq_skb_destructor; ++ ++ /* cloned? */ ++ if (unlikely(skb_orig)) ++ kfree_skb(skb_orig); /* free original */ ++ ++ spin_unlock(root_lock); ++ rcu_read_unlock_bh(); ++ ++ /* schedule qdisc dequeue */ ++ __netif_schedule(q); ++ ++ retval = 0; ++ goto out; ++ } else { ++ skb_restore_cb(skb_shared); /* restore skb->cb */ ++ skb->nf_queue_entry = NULL; ++ /* qdisc dropped packet and decreased skb reference count of ++ * skb, so we don't really want to and try refree as that would ++ * actually destroy the skb. */ ++ spin_unlock(root_lock); ++ goto packet_not_eaten_by_imq_dev; ++ } ++ ++packet_not_eaten_by_imq_dev: ++ skb_set_queue_mapping(skb, orig_queue_index); ++ rcu_read_unlock_bh(); ++ ++ /* cloned? restore original */ ++ if (unlikely(skb_orig)) { ++ kfree_skb(skb); ++ entry->skb = skb_orig; ++ } ++ retval = -1; ++out: ++ return retval; ++} ++ ++static unsigned int imq_nf_hook(unsigned int hook, struct sk_buff *pskb, ++ const struct net_device *indev, ++ const struct net_device *outdev, ++ int (*okfn)(struct sk_buff *)) ++{ ++ return (pskb->imq_flags & IMQ_F_ENQUEUE) ? NF_IMQ_QUEUE : NF_ACCEPT; ++} ++ ++static int imq_close(struct net_device *dev) ++{ ++ netif_stop_queue(dev); ++ return 0; ++} ++ ++static int imq_open(struct net_device *dev) ++{ ++ netif_start_queue(dev); ++ return 0; ++} ++ ++static const struct net_device_ops imq_netdev_ops = { ++ .ndo_open = imq_open, ++ .ndo_stop = imq_close, ++ .ndo_start_xmit = imq_dev_xmit, ++ .ndo_get_stats = imq_get_stats, ++}; ++ ++static void imq_setup(struct net_device *dev) ++{ ++ dev->netdev_ops = &imq_netdev_ops; ++ dev->type = ARPHRD_VOID; ++ dev->mtu = 16000; /* too small? */ ++ dev->tx_queue_len = 11000; /* too big? */ ++ dev->flags = IFF_NOARP; ++ dev->features = NETIF_F_SG | NETIF_F_FRAGLIST | ++ NETIF_F_GSO | NETIF_F_HW_CSUM | ++ NETIF_F_HIGHDMA; ++ dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | ++ IFF_TX_SKB_SHARING); ++} ++ ++static int imq_validate(struct nlattr *tb[], struct nlattr *data[]) ++{ ++ int ret = 0; ++ ++ if (tb[IFLA_ADDRESS]) { ++ if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN) { ++ ret = -EINVAL; ++ goto end; ++ } ++ if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS]))) { ++ ret = -EADDRNOTAVAIL; ++ goto end; ++ } ++ } ++ return 0; ++end: ++ printk(KERN_WARNING "IMQ: imq_validate failed (%d)\n", ret); ++ return ret; ++} ++ ++static struct rtnl_link_ops imq_link_ops __read_mostly = { ++ .kind = "imq", ++ .priv_size = 0, ++ .setup = imq_setup, ++ .validate = imq_validate, ++}; ++ ++static const struct nf_queue_handler imq_nfqh = { ++ .name = "imq", ++ .outfn = imq_nf_queue, ++}; ++ ++static int __init imq_init_hooks(void) ++{ ++ int ret; ++ ++ nf_register_queue_imq_handler(&imq_nfqh); ++ ++ ret = nf_register_hooks(imq_ops, ARRAY_SIZE(imq_ops)); ++ if (ret < 0) ++ nf_unregister_queue_imq_handler(); ++ ++ return ret; ++} ++ ++static int __init imq_init_one(int index) ++{ ++ struct net_device *dev; ++ int ret; ++ ++ dev = alloc_netdev_mq(0, "imq%d", imq_setup, numqueues); ++ if (!dev) ++ return -ENOMEM; ++ ++ ret = dev_alloc_name(dev, dev->name); ++ if (ret < 0) ++ goto fail; ++ ++ dev->rtnl_link_ops = &imq_link_ops; ++ ret = register_netdevice(dev); ++ if (ret < 0) ++ goto fail; ++ ++ return 0; ++fail: ++ free_netdev(dev); ++ return ret; ++} ++ ++static int __init imq_init_devs(void) ++{ ++ int err, i; ++ ++ if (numdevs < 1 || numdevs > IMQ_MAX_DEVS) { ++ printk(KERN_ERR "IMQ: numdevs has to be betweed 1 and %u\n", ++ IMQ_MAX_DEVS); ++ return -EINVAL; ++ } ++ ++ if (numqueues < 1 || numqueues > IMQ_MAX_QUEUES) { ++ printk(KERN_ERR "IMQ: numqueues has to be betweed 1 and %u\n", ++ IMQ_MAX_QUEUES); ++ return -EINVAL; ++ } ++ ++ get_random_bytes(&imq_hashrnd, sizeof(imq_hashrnd)); ++ ++ rtnl_lock(); ++ err = __rtnl_link_register(&imq_link_ops); ++ ++ for (i = 0; i < numdevs && !err; i++) ++ err = imq_init_one(i); ++ ++ if (err) { ++ __rtnl_link_unregister(&imq_link_ops); ++ memset(imq_devs_cache, 0, sizeof(imq_devs_cache)); ++ } ++ rtnl_unlock(); ++ ++ return err; ++} ++ ++static int __init imq_init_module(void) ++{ ++ int err; ++ ++#if defined(CONFIG_IMQ_NUM_DEVS) ++ BUILD_BUG_ON(CONFIG_IMQ_NUM_DEVS > 16); ++ BUILD_BUG_ON(CONFIG_IMQ_NUM_DEVS < 2); ++ BUILD_BUG_ON(CONFIG_IMQ_NUM_DEVS - 1 > IMQ_F_IFMASK); ++#endif ++ ++ err = imq_init_devs(); ++ if (err) { ++ printk(KERN_ERR "IMQ: Error trying imq_init_devs(net)\n"); ++ return err; ++ } ++ ++ err = imq_init_hooks(); ++ if (err) { ++ printk(KERN_ERR "IMQ: Error trying imq_init_hooks()\n"); ++ rtnl_link_unregister(&imq_link_ops); ++ memset(imq_devs_cache, 0, sizeof(imq_devs_cache)); ++ return err; ++ } ++ ++ printk(KERN_INFO "IMQ driver loaded successfully. " ++ "(numdevs = %d, numqueues = %d)\n", numdevs, numqueues); ++ ++#if defined(CONFIG_IMQ_BEHAVIOR_BA) || defined(CONFIG_IMQ_BEHAVIOR_BB) ++ printk(KERN_INFO "\tHooking IMQ before NAT on PREROUTING.\n"); ++#else ++ printk(KERN_INFO "\tHooking IMQ after NAT on PREROUTING.\n"); ++#endif ++#if defined(CONFIG_IMQ_BEHAVIOR_AB) || defined(CONFIG_IMQ_BEHAVIOR_BB) ++ printk(KERN_INFO "\tHooking IMQ before NAT on POSTROUTING.\n"); ++#else ++ printk(KERN_INFO "\tHooking IMQ after NAT on POSTROUTING.\n"); ++#endif ++ ++ return 0; ++} ++ ++static void __exit imq_unhook(void) ++{ ++ nf_unregister_hooks(imq_ops, ARRAY_SIZE(imq_ops)); ++ nf_unregister_queue_imq_handler(); ++} ++ ++static void __exit imq_cleanup_devs(void) ++{ ++ rtnl_link_unregister(&imq_link_ops); ++ memset(imq_devs_cache, 0, sizeof(imq_devs_cache)); ++} ++ ++static void __exit imq_exit_module(void) ++{ ++ imq_unhook(); ++ imq_cleanup_devs(); ++ printk(KERN_INFO "IMQ driver unloaded successfully.\n"); ++} ++ ++module_init(imq_init_module); ++module_exit(imq_exit_module); ++ ++module_param(numdevs, int, 0); ++module_param(numqueues, int, 0); ++MODULE_PARM_DESC(numdevs, "number of IMQ devices (how many imq* devices will " ++ "be created)"); ++MODULE_PARM_DESC(numqueues, "number of queues per IMQ device"); ++MODULE_AUTHOR("http://www.linuximq.net"); ++MODULE_DESCRIPTION("Pseudo-driver for the intermediate queue device. See " ++ "http://www.linuximq.net/ for more information."); ++MODULE_LICENSE("GPL"); ++MODULE_ALIAS_RTNL_LINK("imq"); ++ +diff -uNr linux-3.1/drivers/net/Kconfig linux-3.1-imq/drivers/net/Kconfig +--- linux-3.1/drivers/net/Kconfig 2011-10-24 10:10:05.000000000 +0300 ++++ linux-3.1-imq/drivers/net/Kconfig 2011-11-04 11:12:52.106390309 +0200 +@@ -124,6 +124,125 @@ + To compile this driver as a module, choose M here: the module + will be called eql. If unsure, say N. + ++config IMQ ++ tristate "IMQ (intermediate queueing device) support" ++ depends on NETDEVICES && NETFILTER ++ ---help--- ++ The IMQ device(s) is used as placeholder for QoS queueing ++ disciplines. Every packet entering/leaving the IP stack can be ++ directed through the IMQ device where it's enqueued/dequeued to the ++ attached qdisc. This allows you to treat network devices as classes ++ and distribute bandwidth among them. Iptables is used to specify ++ through which IMQ device, if any, packets travel. ++ ++ More information at: http://www.linuximq.net/ ++ ++ To compile this driver as a module, choose M here: the module ++ will be called imq. If unsure, say N. ++ ++choice ++ prompt "IMQ behavior (PRE/POSTROUTING)" ++ depends on IMQ ++ default IMQ_BEHAVIOR_AB ++ help ++ This setting defines how IMQ behaves in respect to its ++ hooking in PREROUTING and POSTROUTING. ++ ++ IMQ can work in any of the following ways: ++ ++ PREROUTING | POSTROUTING ++ -----------------|------------------- ++ #1 After NAT | After NAT ++ #2 After NAT | Before NAT ++ #3 Before NAT | After NAT ++ #4 Before NAT | Before NAT ++ ++ The default behavior is to hook before NAT on PREROUTING ++ and after NAT on POSTROUTING (#3). ++ ++ This settings are specially usefull when trying to use IMQ ++ to shape NATed clients. ++ ++ More information can be found at: www.linuximq.net ++ ++ If not sure leave the default settings alone. ++ ++config IMQ_BEHAVIOR_AA ++ bool "IMQ AA" ++ help ++ This setting defines how IMQ behaves in respect to its ++ hooking in PREROUTING and POSTROUTING. ++ ++ Choosing this option will make IMQ hook like this: ++ ++ PREROUTING: After NAT ++ POSTROUTING: After NAT ++ ++ More information can be found at: www.linuximq.net ++ ++ If not sure leave the default settings alone. ++ ++config IMQ_BEHAVIOR_AB ++ bool "IMQ AB" ++ help ++ This setting defines how IMQ behaves in respect to its ++ hooking in PREROUTING and POSTROUTING. ++ ++ Choosing this option will make IMQ hook like this: ++ ++ PREROUTING: After NAT ++ POSTROUTING: Before NAT ++ ++ More information can be found at: www.linuximq.net ++ ++ If not sure leave the default settings alone. ++ ++config IMQ_BEHAVIOR_BA ++ bool "IMQ BA" ++ help ++ This setting defines how IMQ behaves in respect to its ++ hooking in PREROUTING and POSTROUTING. ++ ++ Choosing this option will make IMQ hook like this: ++ ++ PREROUTING: Before NAT ++ POSTROUTING: After NAT ++ ++ More information can be found at: www.linuximq.net ++ ++ If not sure leave the default settings alone. ++ ++config IMQ_BEHAVIOR_BB ++ bool "IMQ BB" ++ help ++ This setting defines how IMQ behaves in respect to its ++ hooking in PREROUTING and POSTROUTING. ++ ++ Choosing this option will make IMQ hook like this: ++ ++ PREROUTING: Before NAT ++ POSTROUTING: Before NAT ++ ++ More information can be found at: www.linuximq.net ++ ++ If not sure leave the default settings alone. ++ ++endchoice ++ ++config IMQ_NUM_DEVS ++ int "Number of IMQ devices" ++ range 2 16 ++ depends on IMQ ++ default "16" ++ help ++ This setting defines how many IMQ devices will be created. ++ ++ The default value is 16. ++ ++ More information can be found at: www.linuximq.net ++ ++ If not sure leave the default settings alone. ++ + config TUN + tristate "Universal TUN/TAP device driver support" + select CRC32 +diff -uNr linux-3.1/drivers/net/Makefile linux-3.1-imq/drivers/net/Makefile +--- linux-3.1/drivers/net/Makefile 2011-10-24 10:10:05.000000000 +0300 ++++ linux-3.1-imq/drivers/net/Makefile 2011-11-04 11:12:52.106390309 +0200 +@@ -175,6 +175,7 @@ + obj-$(CONFIG_XEN_NETDEV_BACKEND) += xen-netback/ + + obj-$(CONFIG_DUMMY) += dummy.o ++obj-$(CONFIG_IMQ) += imq.o + obj-$(CONFIG_IFB) += ifb.o + obj-$(CONFIG_MACVLAN) += macvlan.o + obj-$(CONFIG_MACVTAP) += macvtap.o +diff -uNr linux-3.1/include/linux/imq.h linux-3.1-imq/include/linux/imq.h +--- linux-3.1/include/linux/imq.h 1970-01-01 02:00:00.000000000 +0200 ++++ linux-3.1-imq/include/linux/imq.h 2011-11-04 11:12:52.109723710 +0200 +@@ -0,0 +1,13 @@ ++#ifndef _IMQ_H ++#define _IMQ_H ++ ++/* IFMASK (16 device indexes, 0 to 15) and flag(s) fit in 5 bits */ ++#define IMQ_F_BITS 5 ++ ++#define IMQ_F_IFMASK 0x0f ++#define IMQ_F_ENQUEUE 0x10 ++ ++#define IMQ_MAX_DEVS (IMQ_F_IFMASK + 1) ++ ++#endif /* _IMQ_H */ ++ +diff -uNr linux-3.1/include/linux/netfilter/xt_IMQ.h linux-3.1-imq/include/linux/netfilter/xt_IMQ.h +--- linux-3.1/include/linux/netfilter/xt_IMQ.h 1970-01-01 02:00:00.000000000 +0200 ++++ linux-3.1-imq/include/linux/netfilter/xt_IMQ.h 2011-11-04 11:12:52.109723710 +0200 +@@ -0,0 +1,9 @@ ++#ifndef _XT_IMQ_H ++#define _XT_IMQ_H ++ ++struct xt_imq_info { ++ unsigned int todev; /* target imq device */ ++}; ++ ++#endif /* _XT_IMQ_H */ ++ +diff -uNr linux-3.1/include/linux/netfilter.h linux-3.1-imq/include/linux/netfilter.h +--- linux-3.1/include/linux/netfilter.h 2011-10-24 10:10:05.000000000 +0300 ++++ linux-3.1-imq/include/linux/netfilter.h 2011-11-04 11:12:52.109723710 +0200 +@@ -22,7 +22,8 @@ + #define NF_QUEUE 3 + #define NF_REPEAT 4 + #define NF_STOP 5 +-#define NF_MAX_VERDICT NF_STOP ++#define NF_IMQ_QUEUE 6 ++#define NF_MAX_VERDICT NF_IMQ_QUEUE + + /* we overload the higher bits for encoding auxiliary data such as the queue + * number or errno values. Not nice, but better than additional function +diff -uNr linux-3.1/include/linux/netfilter_ipv4/ipt_IMQ.h linux-3.1-imq/include/linux/netfilter_ipv4/ipt_IMQ.h +--- linux-3.1/include/linux/netfilter_ipv4/ipt_IMQ.h 1970-01-01 02:00:00.000000000 +0200 ++++ linux-3.1-imq/include/linux/netfilter_ipv4/ipt_IMQ.h 2011-11-04 11:12:52.109723710 +0200 +@@ -0,0 +1,10 @@ ++#ifndef _IPT_IMQ_H ++#define _IPT_IMQ_H ++ ++/* Backwards compatibility for old userspace */ ++#include <linux/netfilter/xt_IMQ.h> ++ ++#define ipt_imq_info xt_imq_info ++ ++#endif /* _IPT_IMQ_H */ ++ +diff -uNr linux-3.1/include/linux/netfilter_ipv6/ip6t_IMQ.h linux-3.1-imq/include/linux/netfilter_ipv6/ip6t_IMQ.h +--- linux-3.1/include/linux/netfilter_ipv6/ip6t_IMQ.h 1970-01-01 02:00:00.000000000 +0200 ++++ linux-3.1-imq/include/linux/netfilter_ipv6/ip6t_IMQ.h 2011-11-04 11:12:52.113057113 +0200 +@@ -0,0 +1,10 @@ ++#ifndef _IP6T_IMQ_H ++#define _IP6T_IMQ_H ++ ++/* Backwards compatibility for old userspace */ ++#include <linux/netfilter/xt_IMQ.h> ++ ++#define ip6t_imq_info xt_imq_info ++ ++#endif /* _IP6T_IMQ_H */ ++ +diff -uNr linux-3.1/include/linux/skbuff.h linux-3.1-imq/include/linux/skbuff.h +--- linux-3.1/include/linux/skbuff.h 2011-10-24 10:10:05.000000000 +0300 ++++ linux-3.1-imq/include/linux/skbuff.h 2011-11-04 11:12:52.116390515 +0200 +@@ -29,6 +29,9 @@ + #include <linux/rcupdate.h> + #include <linux/dmaengine.h> + #include <linux/hrtimer.h> ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++#include <linux/imq.h> ++#endif + + /* Don't change this without changing skb_csum_unnecessary! */ + #define CHECKSUM_NONE 0 +@@ -356,6 +359,9 @@ + * first. This is owned by whoever has the skb queued ATM. + */ + char cb[48] __aligned(8); ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++ void *cb_next; ++#endif + + unsigned long _skb_refdst; + #ifdef CONFIG_XFRM +@@ -394,6 +400,9 @@ + #ifdef NET_SKBUFF_NF_DEFRAG_NEEDED + struct sk_buff *nfct_reasm; + #endif ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++ struct nf_queue_entry *nf_queue_entry; ++#endif + #ifdef CONFIG_BRIDGE_NETFILTER + struct nf_bridge_info *nf_bridge; + #endif +@@ -418,6 +427,10 @@ + + /* 0/13 bit hole */ + ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++ __u8 imq_flags:IMQ_F_BITS; ++#endif ++ + #ifdef CONFIG_NET_DMA + dma_cookie_t dma_cookie; + #endif +@@ -504,6 +517,12 @@ + return (struct rtable *)skb_dst(skb); + } + ++ ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++extern int skb_save_cb(struct sk_buff *skb); ++extern int skb_restore_cb(struct sk_buff *skb); ++#endif ++ + extern void kfree_skb(struct sk_buff *skb); + extern void consume_skb(struct sk_buff *skb); + extern void __kfree_skb(struct sk_buff *skb); +@@ -2157,6 +2176,10 @@ + dst->nfct_reasm = src->nfct_reasm; + nf_conntrack_get_reasm(src->nfct_reasm); + #endif ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++ dst->imq_flags = src->imq_flags; ++ dst->nf_queue_entry = src->nf_queue_entry; ++#endif + #ifdef CONFIG_BRIDGE_NETFILTER + dst->nf_bridge = src->nf_bridge; + nf_bridge_get(src->nf_bridge); +diff -uNr linux-3.1/include/net/netfilter/nf_queue.h linux-3.1-imq/include/net/netfilter/nf_queue.h +--- linux-3.1/include/net/netfilter/nf_queue.h 2011-10-24 10:10:05.000000000 +0300 ++++ linux-3.1-imq/include/net/netfilter/nf_queue.h 2011-11-04 11:12:52.116390515 +0200 +@@ -30,5 +30,11 @@ + const struct nf_queue_handler *qh); + extern void nf_unregister_queue_handlers(const struct nf_queue_handler *qh); + extern void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict); ++extern void nf_queue_entry_release_refs(struct nf_queue_entry *entry); ++ ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++extern void nf_register_queue_imq_handler(const struct nf_queue_handler *qh); ++extern void nf_unregister_queue_imq_handler(void); ++#endif + + #endif /* _NF_QUEUE_H */ +diff -uNr linux-3.1/net/core/dev.c linux-3.1-imq/net/core/dev.c +--- linux-3.1/net/core/dev.c 2011-10-24 10:10:05.000000000 +0300 ++++ linux-3.1-imq/net/core/dev.c 2011-11-04 11:12:52.119723915 +0200 +@@ -98,6 +98,9 @@ + #include <net/net_namespace.h> + #include <net/sock.h> + #include <linux/rtnetlink.h> ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++#include <linux/imq.h> ++#endif + #include <linux/proc_fs.h> + #include <linux/seq_file.h> + #include <linux/stat.h> +@@ -2126,7 +2129,12 @@ + if (dev->priv_flags & IFF_XMIT_DST_RELEASE) + skb_dst_drop(skb); + ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++ if (!list_empty(&ptype_all) && ++ !(skb->imq_flags & IMQ_F_ENQUEUE)) ++#else + if (!list_empty(&ptype_all)) ++#endif + dev_queue_xmit_nit(skb, dev); + + skb_orphan_try(skb); +diff -uNr linux-3.1/net/core/skbuff.c linux-3.1-imq/net/core/skbuff.c +--- linux-3.1/net/core/skbuff.c 2011-10-24 10:10:05.000000000 +0300 ++++ linux-3.1-imq/net/core/skbuff.c 2011-11-04 11:12:52.123057315 +0200 +@@ -73,6 +73,9 @@ + + static struct kmem_cache *skbuff_head_cache __read_mostly; + static struct kmem_cache *skbuff_fclone_cache __read_mostly; ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++static struct kmem_cache *skbuff_cb_store_cache __read_mostly; ++#endif + + static void sock_pipe_buf_release(struct pipe_inode_info *pipe, + struct pipe_buffer *buf) +@@ -92,6 +95,82 @@ + return 1; + } + ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++/* Control buffer save/restore for IMQ devices */ ++struct skb_cb_table { ++ char cb[48] __aligned(8); ++ void *cb_next; ++ atomic_t refcnt; ++}; ++ ++static DEFINE_SPINLOCK(skb_cb_store_lock); ++ ++int skb_save_cb(struct sk_buff *skb) ++{ ++ struct skb_cb_table *next; ++ ++ next = kmem_cache_alloc(skbuff_cb_store_cache, GFP_ATOMIC); ++ if (!next) ++ return -ENOMEM; ++ ++ BUILD_BUG_ON(sizeof(skb->cb) != sizeof(next->cb)); ++ ++ memcpy(next->cb, skb->cb, sizeof(skb->cb)); ++ next->cb_next = skb->cb_next; ++ ++ atomic_set(&next->refcnt, 1); ++ ++ skb->cb_next = next; ++ return 0; ++} ++EXPORT_SYMBOL(skb_save_cb); ++ ++int skb_restore_cb(struct sk_buff *skb) ++{ ++ struct skb_cb_table *next; ++ ++ if (!skb->cb_next) ++ return 0; ++ ++ next = skb->cb_next; ++ ++ BUILD_BUG_ON(sizeof(skb->cb) != sizeof(next->cb)); ++ ++ memcpy(skb->cb, next->cb, sizeof(skb->cb)); ++ skb->cb_next = next->cb_next; ++ ++ spin_lock(&skb_cb_store_lock); ++ ++ if (atomic_dec_and_test(&next->refcnt)) ++ kmem_cache_free(skbuff_cb_store_cache, next); ++ ++ spin_unlock(&skb_cb_store_lock); ++ ++ return 0; ++} ++EXPORT_SYMBOL(skb_restore_cb); ++ ++static void skb_copy_stored_cb(struct sk_buff *new, const struct sk_buff *__old) ++{ ++ struct skb_cb_table *next; ++ struct sk_buff *old; ++ ++ if (!__old->cb_next) { ++ new->cb_next = NULL; ++ return; ++ } ++ ++ spin_lock(&skb_cb_store_lock); ++ ++ old = (struct sk_buff *)__old; ++ ++ next = old->cb_next; ++ atomic_inc(&next->refcnt); ++ new->cb_next = next; ++ ++ spin_unlock(&skb_cb_store_lock); ++} ++#endif + + /* Pipe buffer operations for a socket. */ + static const struct pipe_buf_operations sock_pipe_buf_ops = { +@@ -392,6 +471,26 @@ + WARN_ON(in_irq()); + skb->destructor(skb); + } ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++ /* This should not happen. When it does, avoid memleak by restoring ++ the chain of cb-backups. */ ++ while (skb->cb_next != NULL) { ++ if (net_ratelimit()) ++ printk(KERN_WARNING "IMQ: kfree_skb: skb->cb_next: " ++ "%08x\n", (unsigned int)skb->cb_next); ++ ++ skb_restore_cb(skb); ++ } ++ /* This should not happen either, nf_queue_entry is nullified in ++ * imq_dev_xmit(). If we have non-NULL nf_queue_entry then we are ++ * leaking entry pointers, maybe memory. We don't know if this is ++ * pointer to already freed memory, or should this be freed. ++ * If this happens we need to add refcounting, etc for nf_queue_entry. ++ */ ++ if (skb->nf_queue_entry && net_ratelimit()) ++ printk(KERN_WARNING ++ "IMQ: kfree_skb: skb->nf_queue_entry != NULL"); ++#endif + #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) + nf_conntrack_put(skb->nfct); + #endif +@@ -533,6 +632,9 @@ + new->sp = secpath_get(old->sp); + #endif + memcpy(new->cb, old->cb, sizeof(old->cb)); ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++ skb_copy_stored_cb(new, old); ++#endif + new->csum = old->csum; + new->local_df = old->local_df; + new->pkt_type = old->pkt_type; +@@ -2888,6 +2990,13 @@ + 0, + SLAB_HWCACHE_ALIGN|SLAB_PANIC, + NULL); ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++ skbuff_cb_store_cache = kmem_cache_create("skbuff_cb_store_cache", ++ sizeof(struct skb_cb_table), ++ 0, ++ SLAB_HWCACHE_ALIGN|SLAB_PANIC, ++ NULL); ++#endif + } + + /** +diff -uNr linux-3.1/net/ipv6/ip6_output.c linux-3.1-imq/net/ipv6/ip6_output.c +--- linux-3.1/net/ipv6/ip6_output.c 2011-10-24 10:10:05.000000000 +0300 ++++ linux-3.1-imq/net/ipv6/ip6_output.c 2011-11-04 11:12:52.123057315 +0200 +@@ -102,9 +102,6 @@ + struct net_device *dev = dst->dev; + struct neighbour *neigh; + +- skb->protocol = htons(ETH_P_IPV6); +- skb->dev = dev; +- + if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) { + struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb)); + +@@ -170,6 +167,11 @@ + return 0; + } + ++ /* IMQ-patch: moved setting skb->dev and skb->protocol from ++ * ip6_finish_output2 to fix crashing at netif_skb_features(). */ ++ skb->protocol = htons(ETH_P_IPV6); ++ skb->dev = dev; ++ + return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev, + ip6_finish_output, + !(IP6CB(skb)->flags & IP6SKB_REROUTED)); +diff -uNr linux-3.1/net/netfilter/core.c linux-3.1-imq/net/netfilter/core.c +--- linux-3.1/net/netfilter/core.c 2011-10-24 10:10:05.000000000 +0300 ++++ linux-3.1-imq/net/netfilter/core.c 2011-11-04 11:12:52.123057315 +0200 +@@ -179,9 +179,11 @@ + ret = NF_DROP_GETERR(verdict); + if (ret == 0) + ret = -EPERM; +- } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) { ++ } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE || ++ (verdict & NF_VERDICT_MASK) == NF_IMQ_QUEUE) { + ret = nf_queue(skb, elem, pf, hook, indev, outdev, okfn, +- verdict >> NF_VERDICT_QBITS); ++ verdict >> NF_VERDICT_QBITS, ++ verdict & NF_VERDICT_MASK); + if (ret < 0) { + if (ret == -ECANCELED) + goto next_hook; +diff -uNr linux-3.1/net/netfilter/Kconfig linux-3.1-imq/net/netfilter/Kconfig +--- linux-3.1/net/netfilter/Kconfig 2011-10-24 10:10:05.000000000 +0300 ++++ linux-3.1-imq/net/netfilter/Kconfig 2011-11-04 11:12:52.123057315 +0200 +@@ -507,6 +507,18 @@ + For more information on the LEDs available on your system, see + Documentation/leds-class.txt + ++config NETFILTER_XT_TARGET_IMQ ++ tristate '"IMQ" target support' ++ depends on NETFILTER_XTABLES ++ depends on IP_NF_MANGLE || IP6_NF_MANGLE ++ select IMQ ++ default m if NETFILTER_ADVANCED=n ++ help ++ This option adds a `IMQ' target which is used to specify if and ++ to which imq device packets should get enqueued/dequeued. ++ ++ To compile it as a module, choose M here. If unsure, say N. ++ + config NETFILTER_XT_TARGET_MARK + tristate '"MARK" target support' + depends on NETFILTER_ADVANCED +diff -uNr linux-3.1/net/netfilter/Makefile linux-3.1-imq/net/netfilter/Makefile +--- linux-3.1/net/netfilter/Makefile 2011-10-24 10:10:05.000000000 +0300 ++++ linux-3.1-imq/net/netfilter/Makefile 2011-11-04 11:12:52.123057315 +0200 +@@ -56,6 +56,7 @@ + obj-$(CONFIG_NETFILTER_XT_TARGET_CT) += xt_CT.o + obj-$(CONFIG_NETFILTER_XT_TARGET_DSCP) += xt_DSCP.o + obj-$(CONFIG_NETFILTER_XT_TARGET_HL) += xt_HL.o ++obj-$(CONFIG_NETFILTER_XT_TARGET_IMQ) += xt_IMQ.o + obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o + obj-$(CONFIG_NETFILTER_XT_TARGET_NFLOG) += xt_NFLOG.o + obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE) += xt_NFQUEUE.o +diff -uNr linux-3.1/net/netfilter/nf_internals.h linux-3.1-imq/net/netfilter/nf_internals.h +--- linux-3.1/net/netfilter/nf_internals.h 2011-10-24 10:10:05.000000000 +0300 ++++ linux-3.1-imq/net/netfilter/nf_internals.h 2011-11-04 11:12:52.123057315 +0200 +@@ -29,7 +29,7 @@ + struct net_device *indev, + struct net_device *outdev, + int (*okfn)(struct sk_buff *), +- unsigned int queuenum); ++ unsigned int queuenum, unsigned int queuetype); + extern int __init netfilter_queue_init(void); + + /* nf_log.c */ +diff -uNr linux-3.1/net/netfilter/nf_queue.c linux-3.1-imq/net/netfilter/nf_queue.c +--- linux-3.1/net/netfilter/nf_queue.c 2011-10-24 10:10:05.000000000 +0300 ++++ linux-3.1-imq/net/netfilter/nf_queue.c 2011-11-04 11:12:52.123057315 +0200 +@@ -22,6 +22,26 @@ + + static DEFINE_MUTEX(queue_handler_mutex); + ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++static const struct nf_queue_handler *queue_imq_handler; ++ ++void nf_register_queue_imq_handler(const struct nf_queue_handler *qh) ++{ ++ mutex_lock(&queue_handler_mutex); ++ rcu_assign_pointer(queue_imq_handler, qh); ++ mutex_unlock(&queue_handler_mutex); ++} ++EXPORT_SYMBOL_GPL(nf_register_queue_imq_handler); ++ ++void nf_unregister_queue_imq_handler(void) ++{ ++ mutex_lock(&queue_handler_mutex); ++ rcu_assign_pointer(queue_imq_handler, NULL); ++ mutex_unlock(&queue_handler_mutex); ++} ++EXPORT_SYMBOL_GPL(nf_unregister_queue_imq_handler); ++#endif ++ + /* return EBUSY when somebody else is registered, return EEXIST if the + * same handler is registered, return 0 in case of success. */ + int nf_register_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh) +@@ -92,7 +112,7 @@ + } + EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers); + +-static void nf_queue_entry_release_refs(struct nf_queue_entry *entry) ++void nf_queue_entry_release_refs(struct nf_queue_entry *entry) + { + /* Release those devices we held, or Alexey will kill me. */ + if (entry->indev) +@@ -112,6 +132,7 @@ + /* Drop reference to owner of hook which queued us. */ + module_put(entry->elem->owner); + } ++EXPORT_SYMBOL_GPL(nf_queue_entry_release_refs); + + /* + * Any packet that leaves via this function must come back +@@ -123,7 +144,8 @@ + struct net_device *indev, + struct net_device *outdev, + int (*okfn)(struct sk_buff *), +- unsigned int queuenum) ++ unsigned int queuenum, ++ unsigned int queuetype) + { + int status = -ENOENT; + struct nf_queue_entry *entry = NULL; +@@ -137,7 +159,17 @@ + /* QUEUE == DROP if no one is waiting, to be safe. */ + rcu_read_lock(); + +- qh = rcu_dereference(queue_handler[pf]); ++ if (queuetype == NF_IMQ_QUEUE) { ++#if defined(CONFIG_IMQ) || defined(CONFIG_IMQ_MODULE) ++ qh = rcu_dereference(queue_imq_handler); ++#else ++ BUG(); ++ goto err_unlock; ++#endif ++ } else { ++ qh = rcu_dereference(queue_handler[pf]); ++ } ++ + if (!qh) { + status = -ESRCH; + goto err_unlock; +@@ -209,7 +241,8 @@ + struct net_device *indev, + struct net_device *outdev, + int (*okfn)(struct sk_buff *), +- unsigned int queuenum) ++ unsigned int queuenum, ++ unsigned int queuetype) + { + struct sk_buff *segs; + int err; +@@ -217,7 +250,7 @@ + + if (!skb_is_gso(skb)) + return __nf_queue(skb, elem, pf, hook, indev, outdev, okfn, +- queuenum); ++ queuenum, queuetype); + + switch (pf) { + case NFPROTO_IPV4: +@@ -244,7 +277,7 @@ + segs->next = NULL; + if (err == 0) + err = __nf_queue(segs, elem, pf, hook, indev, +- outdev, okfn, queuenum); ++ outdev, okfn, queuenum, queuetype); + if (err == 0) + queued++; + else +@@ -299,9 +332,11 @@ + local_bh_enable(); + break; + case NF_QUEUE: ++ case NF_IMQ_QUEUE: + err = __nf_queue(skb, elem, entry->pf, entry->hook, + entry->indev, entry->outdev, entry->okfn, +- verdict >> NF_VERDICT_QBITS); ++ verdict >> NF_VERDICT_QBITS, ++ verdict & NF_VERDICT_MASK); + if (err < 0) { + if (err == -ECANCELED) + goto next_hook; +diff -uNr linux-3.1/net/netfilter/xt_IMQ.c linux-3.1-imq/net/netfilter/xt_IMQ.c +--- linux-3.1/net/netfilter/xt_IMQ.c 1970-01-01 02:00:00.000000000 +0200 ++++ linux-3.1-imq/net/netfilter/xt_IMQ.c 2011-11-04 11:12:52.123057315 +0200 +@@ -0,0 +1,74 @@ ++/* ++ * This target marks packets to be enqueued to an imq device ++ */ ++#include <linux/module.h> ++#include <linux/skbuff.h> ++#include <linux/netfilter/x_tables.h> ++#include <linux/netfilter/xt_IMQ.h> ++#include <linux/imq.h> ++ ++static unsigned int imq_target(struct sk_buff *pskb, ++ const struct xt_action_param *par) ++{ ++ const struct xt_imq_info *mr = par->targinfo; ++ ++ pskb->imq_flags = (mr->todev & IMQ_F_IFMASK) | IMQ_F_ENQUEUE; ++ ++ return XT_CONTINUE; ++} ++ ++static int imq_checkentry(const struct xt_tgchk_param *par) ++{ ++ struct xt_imq_info *mr = par->targinfo; ++ ++ if (mr->todev > IMQ_MAX_DEVS - 1) { ++ printk(KERN_WARNING ++ "IMQ: invalid device specified, highest is %u\n", ++ IMQ_MAX_DEVS - 1); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ ++static struct xt_target xt_imq_reg[] __read_mostly = { ++ { ++ .name = "IMQ", ++ .family = AF_INET, ++ .checkentry = imq_checkentry, ++ .target = imq_target, ++ .targetsize = sizeof(struct xt_imq_info), ++ .table = "mangle", ++ .me = THIS_MODULE ++ }, ++ { ++ .name = "IMQ", ++ .family = AF_INET6, ++ .checkentry = imq_checkentry, ++ .target = imq_target, ++ .targetsize = sizeof(struct xt_imq_info), ++ .table = "mangle", ++ .me = THIS_MODULE ++ }, ++}; ++ ++static int __init imq_init(void) ++{ ++ return xt_register_targets(xt_imq_reg, ARRAY_SIZE(xt_imq_reg)); ++} ++ ++static void __exit imq_fini(void) ++{ ++ xt_unregister_targets(xt_imq_reg, ARRAY_SIZE(xt_imq_reg)); ++} ++ ++module_init(imq_init); ++module_exit(imq_fini); ++ ++MODULE_AUTHOR("http://www.linuximq.net"); ++MODULE_DESCRIPTION("Pseudo-driver for the intermediate queue device. " ++ "See http://www.linuximq.net/ for more information."); ++MODULE_LICENSE("GPL"); ++MODULE_ALIAS("ipt_IMQ"); ++MODULE_ALIAS("ip6t_IMQ"); ++ diff --git a/src/patches/netfilter_layer7_2.22_kernel3.0.patch b/src/patches/netfilter_layer7_2.22_kernel3.0.patch new file mode 100644 index 0000000..82d8509 --- /dev/null +++ b/src/patches/netfilter_layer7_2.22_kernel3.0.patch @@ -0,0 +1,2160 @@ +diff -Naur linux-3.0.24.org/include/linux/netfilter/xt_layer7.h linux-3.0.24/include/linux/netfilter/xt_layer7.h +--- linux-3.0.24.org/include/linux/netfilter/xt_layer7.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-3.0.24/include/linux/netfilter/xt_layer7.h 2012-03-15 20:08:48.976050501 +0100 +@@ -0,0 +1,13 @@ ++#ifndef _XT_LAYER7_H ++#define _XT_LAYER7_H ++ ++#define MAX_PATTERN_LEN 8192 ++#define MAX_PROTOCOL_LEN 256 ++ ++struct xt_layer7_info { ++ char protocol[MAX_PROTOCOL_LEN]; ++ char pattern[MAX_PATTERN_LEN]; ++ u_int8_t invert; ++}; ++ ++#endif /* _XT_LAYER7_H */ +diff -Naur linux-3.0.24.org/include/net/netfilter/nf_conntrack.h linux-3.0.24/include/net/netfilter/nf_conntrack.h +--- linux-3.0.24.org/include/net/netfilter/nf_conntrack.h 2012-03-12 18:58:19.000000000 +0100 ++++ linux-3.0.24/include/net/netfilter/nf_conntrack.h 2012-03-15 20:11:43.806042495 +0100 +@@ -134,6 +134,22 @@ + struct net *ct_net; + #endif + ++#if defined(CONFIG_NETFILTER_XT_MATCH_LAYER7) || \ ++ defined(CONFIG_NETFILTER_XT_MATCH_LAYER7_MODULE) ++ struct { ++ /* ++ * e.g. "http". NULL before decision. "unknown" after decision ++ * if no match. ++ */ ++ char *app_proto; ++ /* ++ * application layer data so far. NULL after match decision. ++ */ ++ char *app_data; ++ unsigned int app_data_len; ++ } layer7; ++#endif ++ + /* Storage reserved for other modules, must be the last member */ + union nf_conntrack_proto proto; + }; +diff -Naur linux-3.0.24.org/net/netfilter/Kconfig linux-3.0.24/net/netfilter/Kconfig +--- linux-3.0.24.org/net/netfilter/Kconfig 2012-03-12 18:58:19.000000000 +0100 ++++ linux-3.0.24/net/netfilter/Kconfig 2012-03-15 20:46:12.046043918 +0100 +@@ -1020,6 +1020,26 @@ + + To compile it as a module, choose M here. If unsure, say N. + ++config NETFILTER_XT_MATCH_LAYER7 ++ tristate '"layer7" match support' ++ depends on NETFILTER_XTABLES ++ depends on EXPERIMENTAL && (IP_NF_CONNTRACK || NF_CONNTRACK) ++ help ++ Say Y if you want to be able to classify connections (and their ++ packets) based on regular expression matching of their application ++ layer data. This is one way to classify applications such as ++ peer-to-peer filesharing systems that do not always use the same ++ port. ++ ++ To compile it as a module, choose M here. If unsure, say N. ++ ++config NETFILTER_XT_MATCH_LAYER7_DEBUG ++ bool 'Layer 7 debugging output' ++ depends on NETFILTER_XT_MATCH_LAYER7 ++ help ++ Say Y to get lots of debugging output. ++ ++ + config NETFILTER_XT_MATCH_STATISTIC + tristate '"statistic" match support' + depends on NETFILTER_ADVANCED +diff -Naur linux-3.0.24.org/net/netfilter/Makefile linux-3.0.24/net/netfilter/Makefile +--- linux-3.0.24.org/net/netfilter/Makefile 2012-03-12 18:58:19.000000000 +0100 ++++ linux-3.0.24/net/netfilter/Makefile 2012-03-15 20:08:49.016044445 +0100 +@@ -102,6 +102,7 @@ + obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o + obj-$(CONFIG_NETFILTER_XT_MATCH_SOCKET) += xt_socket.o + obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o ++obj-$(CONFIG_NETFILTER_XT_MATCH_LAYER7) += xt_layer7.o + obj-$(CONFIG_NETFILTER_XT_MATCH_STATISTIC) += xt_statistic.o + obj-$(CONFIG_NETFILTER_XT_MATCH_STRING) += xt_string.o + obj-$(CONFIG_NETFILTER_XT_MATCH_TCPMSS) += xt_tcpmss.o +diff -Naur linux-3.0.24.org/net/netfilter/nf_conntrack_core.c linux-3.0.24/net/netfilter/nf_conntrack_core.c +--- linux-3.0.24.org/net/netfilter/nf_conntrack_core.c 2012-03-12 18:58:19.000000000 +0100 ++++ linux-3.0.24/net/netfilter/nf_conntrack_core.c 2012-03-15 20:08:49.026044761 +0100 +@@ -213,6 +213,14 @@ + * too. */ + nf_ct_remove_expectations(ct); + ++ #if defined(CONFIG_NETFILTER_XT_MATCH_LAYER7) || defined(CONFIG_NETFILTER_XT_MATCH_LAYER7_MODULE) ++ if(ct->layer7.app_proto) ++ kfree(ct->layer7.app_proto); ++ if(ct->layer7.app_data) ++ kfree(ct->layer7.app_data); ++ #endif ++ ++ + /* We overload first tuple to link into unconfirmed list. */ + if (!nf_ct_is_confirmed(ct)) { + BUG_ON(hlist_nulls_unhashed(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode)); +diff -Naur linux-3.0.24.org/net/netfilter/nf_conntrack_standalone.c linux-3.0.24/net/netfilter/nf_conntrack_standalone.c +--- linux-3.0.24.org/net/netfilter/nf_conntrack_standalone.c 2012-03-12 18:58:19.000000000 +0100 ++++ linux-3.0.24/net/netfilter/nf_conntrack_standalone.c 2012-03-15 20:08:49.036047262 +0100 +@@ -239,6 +239,12 @@ + if (ct_show_delta_time(s, ct)) + goto release; + ++#if defined(CONFIG_NETFILTER_XT_MATCH_LAYER7) || defined(CONFIG_NETFILTER_XT_MATCH_LAYER7_MODULE) ++ if(ct->layer7.app_proto && ++ seq_printf(s, "l7proto=%s ", ct->layer7.app_proto)) ++ return -ENOSPC; ++#endif ++ + if (seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use))) + goto release; + +diff -Naur linux-3.0.24.org/net/netfilter/regexp/regexp.c linux-3.0.24/net/netfilter/regexp/regexp.c +--- linux-3.0.24.org/net/netfilter/regexp/regexp.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-3.0.24/net/netfilter/regexp/regexp.c 2012-03-15 20:08:49.066043520 +0100 +@@ -0,0 +1,1197 @@ ++/* ++ * regcomp and regexec -- regsub and regerror are elsewhere ++ * @(#)regexp.c 1.3 of 18 April 87 ++ * ++ * Copyright (c) 1986 by University of Toronto. ++ * Written by Henry Spencer. Not derived from licensed software. ++ * ++ * Permission is granted to anyone to use this software for any ++ * purpose on any computer system, and to redistribute it freely, ++ * subject to the following restrictions: ++ * ++ * 1. The author is not responsible for the consequences of use of ++ * this software, no matter how awful, even if they arise ++ * from defects in it. ++ * ++ * 2. The origin of this software must not be misrepresented, either ++ * by explicit claim or by omission. ++ * ++ * 3. Altered versions must be plainly marked as such, and must not ++ * be misrepresented as being the original software. ++ * ++ * Beware that some of this code is subtly aware of the way operator ++ * precedence is structured in regular expressions. Serious changes in ++ * regular-expression syntax might require a total rethink. ++ * ++ * This code was modified by Ethan Sommer to work within the kernel ++ * (it now uses kmalloc etc..) ++ * ++ * Modified slightly by Matthew Strait to use more modern C. ++ */ ++ ++#include "regexp.h" ++#include "regmagic.h" ++ ++/* added by ethan and matt. Lets it work in both kernel and user space. ++(So iptables can use it, for instance.) Yea, it goes both ways... */ ++#if __KERNEL__ ++ #define malloc(foo) kmalloc(foo,GFP_ATOMIC) ++#else ++ #define printk(format,args...) printf(format,##args) ++#endif ++ ++void regerror(char * s) ++{ ++ printk("<3>Regexp: %s\n", s); ++ /* NOTREACHED */ ++} ++ ++/* ++ * The "internal use only" fields in regexp.h are present to pass info from ++ * compile to execute that permits the execute phase to run lots faster on ++ * simple cases. They are: ++ * ++ * regstart char that must begin a match; '\0' if none obvious ++ * reganch is the match anchored (at beginning-of-line only)? ++ * regmust string (pointer into program) that match must include, or NULL ++ * regmlen length of regmust string ++ * ++ * Regstart and reganch permit very fast decisions on suitable starting points ++ * for a match, cutting down the work a lot. Regmust permits fast rejection ++ * of lines that cannot possibly match. The regmust tests are costly enough ++ * that regcomp() supplies a regmust only if the r.e. contains something ++ * potentially expensive (at present, the only such thing detected is * or + ++ * at the start of the r.e., which can involve a lot of backup). Regmlen is ++ * supplied because the test in regexec() needs it and regcomp() is computing ++ * it anyway. ++ */ ++ ++/* ++ * Structure for regexp "program". This is essentially a linear encoding ++ * of a nondeterministic finite-state machine (aka syntax charts or ++ * "railroad normal form" in parsing technology). Each node is an opcode ++ * plus a "next" pointer, possibly plus an operand. "Next" pointers of ++ * all nodes except BRANCH implement concatenation; a "next" pointer with ++ * a BRANCH on both ends of it is connecting two alternatives. (Here we ++ * have one of the subtle syntax dependencies: an individual BRANCH (as ++ * opposed to a collection of them) is never concatenated with anything ++ * because of operator precedence.) The operand of some types of node is ++ * a literal string; for others, it is a node leading into a sub-FSM. In ++ * particular, the operand of a BRANCH node is the first node of the branch. ++ * (NB this is *not* a tree structure: the tail of the branch connects ++ * to the thing following the set of BRANCHes.) The opcodes are: ++ */ ++ ++/* definition number opnd? meaning */ ++#define END 0 /* no End of program. */ ++#define BOL 1 /* no Match "" at beginning of line. */ ++#define EOL 2 /* no Match "" at end of line. */ ++#define ANY 3 /* no Match any one character. */ ++#define ANYOF 4 /* str Match any character in this string. */ ++#define ANYBUT 5 /* str Match any character not in this string. */ ++#define BRANCH 6 /* node Match this alternative, or the next... */ ++#define BACK 7 /* no Match "", "next" ptr points backward. */ ++#define EXACTLY 8 /* str Match this string. */ ++#define NOTHING 9 /* no Match empty string. */ ++#define STAR 10 /* node Match this (simple) thing 0 or more times. */ ++#define PLUS 11 /* node Match this (simple) thing 1 or more times. */ ++#define OPEN 20 /* no Mark this point in input as start of #n. */ ++ /* OPEN+1 is number 1, etc. */ ++#define CLOSE 30 /* no Analogous to OPEN. */ ++ ++/* ++ * Opcode notes: ++ * ++ * BRANCH The set of branches constituting a single choice are hooked ++ * together with their "next" pointers, since precedence prevents ++ * anything being concatenated to any individual branch. The ++ * "next" pointer of the last BRANCH in a choice points to the ++ * thing following the whole choice. This is also where the ++ * final "next" pointer of each individual branch points; each ++ * branch starts with the operand node of a BRANCH node. ++ * ++ * BACK Normal "next" pointers all implicitly point forward; BACK ++ * exists to make loop structures possible. ++ * ++ * STAR,PLUS '?', and complex '*' and '+', are implemented as circular ++ * BRANCH structures using BACK. Simple cases (one character ++ * per match) are implemented with STAR and PLUS for speed ++ * and to minimize recursive plunges. ++ * ++ * OPEN,CLOSE ...are numbered at compile time. ++ */ ++ ++/* ++ * A node is one char of opcode followed by two chars of "next" pointer. ++ * "Next" pointers are stored as two 8-bit pieces, high order first. The ++ * value is a positive offset from the opcode of the node containing it. ++ * An operand, if any, simply follows the node. (Note that much of the ++ * code generation knows about this implicit relationship.) ++ * ++ * Using two bytes for the "next" pointer is vast overkill for most things, ++ * but allows patterns to get big without disasters. ++ */ ++#define OP(p) (*(p)) ++#define NEXT(p) (((*((p)+1)&0377)<<8) + (*((p)+2)&0377)) ++#define OPERAND(p) ((p) + 3) ++ ++/* ++ * See regmagic.h for one further detail of program structure. ++ */ ++ ++ ++/* ++ * Utility definitions. ++ */ ++#ifndef CHARBITS ++#define UCHARAT(p) ((int)*(unsigned char *)(p)) ++#else ++#define UCHARAT(p) ((int)*(p)&CHARBITS) ++#endif ++ ++#define FAIL(m) { regerror(m); return(NULL); } ++#define ISMULT(c) ((c) == '*' || (c) == '+' || (c) == '?') ++#define META "^$.[()|?+*\\" ++ ++/* ++ * Flags to be passed up and down. ++ */ ++#define HASWIDTH 01 /* Known never to match null string. */ ++#define SIMPLE 02 /* Simple enough to be STAR/PLUS operand. */ ++#define SPSTART 04 /* Starts with * or +. */ ++#define WORST 0 /* Worst case. */ ++ ++/* ++ * Global work variables for regcomp(). ++ */ ++struct match_globals { ++char *reginput; /* String-input pointer. */ ++char *regbol; /* Beginning of input, for ^ check. */ ++char **regstartp; /* Pointer to startp array. */ ++char **regendp; /* Ditto for endp. */ ++char *regparse; /* Input-scan pointer. */ ++int regnpar; /* () count. */ ++char regdummy; ++char *regcode; /* Code-emit pointer; &regdummy = don't. */ ++long regsize; /* Code size. */ ++}; ++ ++/* ++ * Forward declarations for regcomp()'s friends. ++ */ ++#ifndef STATIC ++#define STATIC static ++#endif ++STATIC char *reg(struct match_globals *g, int paren,int *flagp); ++STATIC char *regbranch(struct match_globals *g, int *flagp); ++STATIC char *regpiece(struct match_globals *g, int *flagp); ++STATIC char *regatom(struct match_globals *g, int *flagp); ++STATIC char *regnode(struct match_globals *g, char op); ++STATIC char *regnext(struct match_globals *g, char *p); ++STATIC void regc(struct match_globals *g, char b); ++STATIC void reginsert(struct match_globals *g, char op, char *opnd); ++STATIC void regtail(struct match_globals *g, char *p, char *val); ++STATIC void regoptail(struct match_globals *g, char *p, char *val); ++ ++ ++__kernel_size_t my_strcspn(const char *s1,const char *s2) ++{ ++ char *scan1; ++ char *scan2; ++ int count; ++ ++ count = 0; ++ for (scan1 = (char *)s1; *scan1 != '\0'; scan1++) { ++ for (scan2 = (char *)s2; *scan2 != '\0';) /* ++ moved down. */ ++ if (*scan1 == *scan2++) ++ return(count); ++ count++; ++ } ++ return(count); ++} ++ ++/* ++ - regcomp - compile a regular expression into internal code ++ * ++ * We can't allocate space until we know how big the compiled form will be, ++ * but we can't compile it (and thus know how big it is) until we've got a ++ * place to put the code. So we cheat: we compile it twice, once with code ++ * generation turned off and size counting turned on, and once "for real". ++ * This also means that we don't allocate space until we are sure that the ++ * thing really will compile successfully, and we never have to move the ++ * code and thus invalidate pointers into it. (Note that it has to be in ++ * one piece because free() must be able to free it all.) ++ * ++ * Beware that the optimization-preparation code in here knows about some ++ * of the structure of the compiled regexp. ++ */ ++regexp * ++regcomp(char *exp,int *patternsize) ++{ ++ register regexp *r; ++ register char *scan; ++ register char *longest; ++ register int len; ++ int flags; ++ struct match_globals g; ++ ++ /* commented out by ethan ++ extern char *malloc(); ++ */ ++ ++ if (exp == NULL) ++ FAIL("NULL argument"); ++ ++ /* First pass: determine size, legality. */ ++ g.regparse = exp; ++ g.regnpar = 1; ++ g.regsize = 0L; ++ g.regcode = &g.regdummy; ++ regc(&g, MAGIC); ++ if (reg(&g, 0, &flags) == NULL) ++ return(NULL); ++ ++ /* Small enough for pointer-storage convention? */ ++ if (g.regsize >= 32767L) /* Probably could be 65535L. */ ++ FAIL("regexp too big"); ++ ++ /* Allocate space. */ ++ *patternsize=sizeof(regexp) + (unsigned)g.regsize; ++ r = (regexp *)malloc(sizeof(regexp) + (unsigned)g.regsize); ++ if (r == NULL) ++ FAIL("out of space"); ++ ++ /* Second pass: emit code. */ ++ g.regparse = exp; ++ g.regnpar = 1; ++ g.regcode = r->program; ++ regc(&g, MAGIC); ++ if (reg(&g, 0, &flags) == NULL) ++ return(NULL); ++ ++ /* Dig out information for optimizations. */ ++ r->regstart = '\0'; /* Worst-case defaults. */ ++ r->reganch = 0; ++ r->regmust = NULL; ++ r->regmlen = 0; ++ scan = r->program+1; /* First BRANCH. */ ++ if (OP(regnext(&g, scan)) == END) { /* Only one top-level choice. */ ++ scan = OPERAND(scan); ++ ++ /* Starting-point info. */ ++ if (OP(scan) == EXACTLY) ++ r->regstart = *OPERAND(scan); ++ else if (OP(scan) == BOL) ++ r->reganch++; ++ ++ /* ++ * If there's something expensive in the r.e., find the ++ * longest literal string that must appear and make it the ++ * regmust. Resolve ties in favor of later strings, since ++ * the regstart check works with the beginning of the r.e. ++ * and avoiding duplication strengthens checking. Not a ++ * strong reason, but sufficient in the absence of others. ++ */ ++ if (flags&SPSTART) { ++ longest = NULL; ++ len = 0; ++ for (; scan != NULL; scan = regnext(&g, scan)) ++ if (OP(scan) == EXACTLY && strlen(OPERAND(scan)) >= len) { ++ longest = OPERAND(scan); ++ len = strlen(OPERAND(scan)); ++ } ++ r->regmust = longest; ++ r->regmlen = len; ++ } ++ } ++ ++ return(r); ++} ++ ++/* ++ - reg - regular expression, i.e. main body or parenthesized thing ++ * ++ * Caller must absorb opening parenthesis. ++ * ++ * Combining parenthesis handling with the base level of regular expression ++ * is a trifle forced, but the need to tie the tails of the branches to what ++ * follows makes it hard to avoid. ++ */ ++static char * ++reg(struct match_globals *g, int paren, int *flagp /* Parenthesized? */ ) ++{ ++ register char *ret; ++ register char *br; ++ register char *ender; ++ register int parno = 0; /* 0 makes gcc happy */ ++ int flags; ++ ++ *flagp = HASWIDTH; /* Tentatively. */ ++ ++ /* Make an OPEN node, if parenthesized. */ ++ if (paren) { ++ if (g->regnpar >= NSUBEXP) ++ FAIL("too many ()"); ++ parno = g->regnpar; ++ g->regnpar++; ++ ret = regnode(g, OPEN+parno); ++ } else ++ ret = NULL; ++ ++ /* Pick up the branches, linking them together. */ ++ br = regbranch(g, &flags); ++ if (br == NULL) ++ return(NULL); ++ if (ret != NULL) ++ regtail(g, ret, br); /* OPEN -> first. */ ++ else ++ ret = br; ++ if (!(flags&HASWIDTH)) ++ *flagp &= ~HASWIDTH; ++ *flagp |= flags&SPSTART; ++ while (*g->regparse == '|') { ++ g->regparse++; ++ br = regbranch(g, &flags); ++ if (br == NULL) ++ return(NULL); ++ regtail(g, ret, br); /* BRANCH -> BRANCH. */ ++ if (!(flags&HASWIDTH)) ++ *flagp &= ~HASWIDTH; ++ *flagp |= flags&SPSTART; ++ } ++ ++ /* Make a closing node, and hook it on the end. */ ++ ender = regnode(g, (paren) ? CLOSE+parno : END); ++ regtail(g, ret, ender); ++ ++ /* Hook the tails of the branches to the closing node. */ ++ for (br = ret; br != NULL; br = regnext(g, br)) ++ regoptail(g, br, ender); ++ ++ /* Check for proper termination. */ ++ if (paren && *g->regparse++ != ')') { ++ FAIL("unmatched ()"); ++ } else if (!paren && *g->regparse != '\0') { ++ if (*g->regparse == ')') { ++ FAIL("unmatched ()"); ++ } else ++ FAIL("junk on end"); /* "Can't happen". */ ++ /* NOTREACHED */ ++ } ++ ++ return(ret); ++} ++ ++/* ++ - regbranch - one alternative of an | operator ++ * ++ * Implements the concatenation operator. ++ */ ++static char * ++regbranch(struct match_globals *g, int *flagp) ++{ ++ register char *ret; ++ register char *chain; ++ register char *latest; ++ int flags; ++ ++ *flagp = WORST; /* Tentatively. */ ++ ++ ret = regnode(g, BRANCH); ++ chain = NULL; ++ while (*g->regparse != '\0' && *g->regparse != '|' && *g->regparse != ')') { ++ latest = regpiece(g, &flags); ++ if (latest == NULL) ++ return(NULL); ++ *flagp |= flags&HASWIDTH; ++ if (chain == NULL) /* First piece. */ ++ *flagp |= flags&SPSTART; ++ else ++ regtail(g, chain, latest); ++ chain = latest; ++ } ++ if (chain == NULL) /* Loop ran zero times. */ ++ (void) regnode(g, NOTHING); ++ ++ return(ret); ++} ++ ++/* ++ - regpiece - something followed by possible [*+?] ++ * ++ * Note that the branching code sequences used for ? and the general cases ++ * of * and + are somewhat optimized: they use the same NOTHING node as ++ * both the endmarker for their branch list and the body of the last branch. ++ * It might seem that this node could be dispensed with entirely, but the ++ * endmarker role is not redundant. ++ */ ++static char * ++regpiece(struct match_globals *g, int *flagp) ++{ ++ register char *ret; ++ register char op; ++ register char *next; ++ int flags; ++ ++ ret = regatom(g, &flags); ++ if (ret == NULL) ++ return(NULL); ++ ++ op = *g->regparse; ++ if (!ISMULT(op)) { ++ *flagp = flags; ++ return(ret); ++ } ++ ++ if (!(flags&HASWIDTH) && op != '?') ++ FAIL("*+ operand could be empty"); ++ *flagp = (op != '+') ? (WORST|SPSTART) : (WORST|HASWIDTH); ++ ++ if (op == '*' && (flags&SIMPLE)) ++ reginsert(g, STAR, ret); ++ else if (op == '*') { ++ /* Emit x* as (x&|), where & means "self". */ ++ reginsert(g, BRANCH, ret); /* Either x */ ++ regoptail(g, ret, regnode(g, BACK)); /* and loop */ ++ regoptail(g, ret, ret); /* back */ ++ regtail(g, ret, regnode(g, BRANCH)); /* or */ ++ regtail(g, ret, regnode(g, NOTHING)); /* null. */ ++ } else if (op == '+' && (flags&SIMPLE)) ++ reginsert(g, PLUS, ret); ++ else if (op == '+') { ++ /* Emit x+ as x(&|), where & means "self". */ ++ next = regnode(g, BRANCH); /* Either */ ++ regtail(g, ret, next); ++ regtail(g, regnode(g, BACK), ret); /* loop back */ ++ regtail(g, next, regnode(g, BRANCH)); /* or */ ++ regtail(g, ret, regnode(g, NOTHING)); /* null. */ ++ } else if (op == '?') { ++ /* Emit x? as (x|) */ ++ reginsert(g, BRANCH, ret); /* Either x */ ++ regtail(g, ret, regnode(g, BRANCH)); /* or */ ++ next = regnode(g, NOTHING); /* null. */ ++ regtail(g, ret, next); ++ regoptail(g, ret, next); ++ } ++ g->regparse++; ++ if (ISMULT(*g->regparse)) ++ FAIL("nested *?+"); ++ ++ return(ret); ++} ++ ++/* ++ - regatom - the lowest level ++ * ++ * Optimization: gobbles an entire sequence of ordinary characters so that ++ * it can turn them into a single node, which is smaller to store and ++ * faster to run. Backslashed characters are exceptions, each becoming a ++ * separate node; the code is simpler that way and it's not worth fixing. ++ */ ++static char * ++regatom(struct match_globals *g, int *flagp) ++{ ++ register char *ret; ++ int flags; ++ ++ *flagp = WORST; /* Tentatively. */ ++ ++ switch (*g->regparse++) { ++ case '^': ++ ret = regnode(g, BOL); ++ break; ++ case '$': ++ ret = regnode(g, EOL); ++ break; ++ case '.': ++ ret = regnode(g, ANY); ++ *flagp |= HASWIDTH|SIMPLE; ++ break; ++ case '[': { ++ register int class; ++ register int classend; ++ ++ if (*g->regparse == '^') { /* Complement of range. */ ++ ret = regnode(g, ANYBUT); ++ g->regparse++; ++ } else ++ ret = regnode(g, ANYOF); ++ if (*g->regparse == ']' || *g->regparse == '-') ++ regc(g, *g->regparse++); ++ while (*g->regparse != '\0' && *g->regparse != ']') { ++ if (*g->regparse == '-') { ++ g->regparse++; ++ if (*g->regparse == ']' || *g->regparse == '\0') ++ regc(g, '-'); ++ else { ++ class = UCHARAT(g->regparse-2)+1; ++ classend = UCHARAT(g->regparse); ++ if (class > classend+1) ++ FAIL("invalid [] range"); ++ for (; class <= classend; class++) ++ regc(g, class); ++ g->regparse++; ++ } ++ } else ++ regc(g, *g->regparse++); ++ } ++ regc(g, '\0'); ++ if (*g->regparse != ']') ++ FAIL("unmatched []"); ++ g->regparse++; ++ *flagp |= HASWIDTH|SIMPLE; ++ } ++ break; ++ case '(': ++ ret = reg(g, 1, &flags); ++ if (ret == NULL) ++ return(NULL); ++ *flagp |= flags&(HASWIDTH|SPSTART); ++ break; ++ case '\0': ++ case '|': ++ case ')': ++ FAIL("internal urp"); /* Supposed to be caught earlier. */ ++ break; ++ case '?': ++ case '+': ++ case '*': ++ FAIL("?+* follows nothing"); ++ break; ++ case '\\': ++ if (*g->regparse == '\0') ++ FAIL("trailing \\"); ++ ret = regnode(g, EXACTLY); ++ regc(g, *g->regparse++); ++ regc(g, '\0'); ++ *flagp |= HASWIDTH|SIMPLE; ++ break; ++ default: { ++ register int len; ++ register char ender; ++ ++ g->regparse--; ++ len = my_strcspn((const char *)g->regparse, (const char *)META); ++ if (len <= 0) ++ FAIL("internal disaster"); ++ ender = *(g->regparse+len); ++ if (len > 1 && ISMULT(ender)) ++ len--; /* Back off clear of ?+* operand. */ ++ *flagp |= HASWIDTH; ++ if (len == 1) ++ *flagp |= SIMPLE; ++ ret = regnode(g, EXACTLY); ++ while (len > 0) { ++ regc(g, *g->regparse++); ++ len--; ++ } ++ regc(g, '\0'); ++ } ++ break; ++ } ++ ++ return(ret); ++} ++ ++/* ++ - regnode - emit a node ++ */ ++static char * /* Location. */ ++regnode(struct match_globals *g, char op) ++{ ++ register char *ret; ++ register char *ptr; ++ ++ ret = g->regcode; ++ if (ret == &g->regdummy) { ++ g->regsize += 3; ++ return(ret); ++ } ++ ++ ptr = ret; ++ *ptr++ = op; ++ *ptr++ = '\0'; /* Null "next" pointer. */ ++ *ptr++ = '\0'; ++ g->regcode = ptr; ++ ++ return(ret); ++} ++ ++/* ++ - regc - emit (if appropriate) a byte of code ++ */ ++static void ++regc(struct match_globals *g, char b) ++{ ++ if (g->regcode != &g->regdummy) ++ *g->regcode++ = b; ++ else ++ g->regsize++; ++} ++ ++/* ++ - reginsert - insert an operator in front of already-emitted operand ++ * ++ * Means relocating the operand. ++ */ ++static void ++reginsert(struct match_globals *g, char op, char* opnd) ++{ ++ register char *src; ++ register char *dst; ++ register char *place; ++ ++ if (g->regcode == &g->regdummy) { ++ g->regsize += 3; ++ return; ++ } ++ ++ src = g->regcode; ++ g->regcode += 3; ++ dst = g->regcode; ++ while (src > opnd) ++ *--dst = *--src; ++ ++ place = opnd; /* Op node, where operand used to be. */ ++ *place++ = op; ++ *place++ = '\0'; ++ *place++ = '\0'; ++} ++ ++/* ++ - regtail - set the next-pointer at the end of a node chain ++ */ ++static void ++regtail(struct match_globals *g, char *p, char *val) ++{ ++ register char *scan; ++ register char *temp; ++ register int offset; ++ ++ if (p == &g->regdummy) ++ return; ++ ++ /* Find last node. */ ++ scan = p; ++ for (;;) { ++ temp = regnext(g, scan); ++ if (temp == NULL) ++ break; ++ scan = temp; ++ } ++ ++ if (OP(scan) == BACK) ++ offset = scan - val; ++ else ++ offset = val - scan; ++ *(scan+1) = (offset>>8)&0377; ++ *(scan+2) = offset&0377; ++} ++ ++/* ++ - regoptail - regtail on operand of first argument; nop if operandless ++ */ ++static void ++regoptail(struct match_globals *g, char *p, char *val) ++{ ++ /* "Operandless" and "op != BRANCH" are synonymous in practice. */ ++ if (p == NULL || p == &g->regdummy || OP(p) != BRANCH) ++ return; ++ regtail(g, OPERAND(p), val); ++} ++ ++/* ++ * regexec and friends ++ */ ++ ++ ++/* ++ * Forwards. ++ */ ++STATIC int regtry(struct match_globals *g, regexp *prog, char *string); ++STATIC int regmatch(struct match_globals *g, char *prog); ++STATIC int regrepeat(struct match_globals *g, char *p); ++ ++#ifdef DEBUG ++int regnarrate = 0; ++void regdump(); ++STATIC char *regprop(char *op); ++#endif ++ ++/* ++ - regexec - match a regexp against a string ++ */ ++int ++regexec(regexp *prog, char *string) ++{ ++ register char *s; ++ struct match_globals g; ++ ++ /* Be paranoid... */ ++ if (prog == NULL || string == NULL) { ++ printk("<3>Regexp: NULL parameter\n"); ++ return(0); ++ } ++ ++ /* Check validity of program. */ ++ if (UCHARAT(prog->program) != MAGIC) { ++ printk("<3>Regexp: corrupted program\n"); ++ return(0); ++ } ++ ++ /* If there is a "must appear" string, look for it. */ ++ if (prog->regmust != NULL) { ++ s = string; ++ while ((s = strchr(s, prog->regmust[0])) != NULL) { ++ if (strncmp(s, prog->regmust, prog->regmlen) == 0) ++ break; /* Found it. */ ++ s++; ++ } ++ if (s == NULL) /* Not present. */ ++ return(0); ++ } ++ ++ /* Mark beginning of line for ^ . */ ++ g.regbol = string; ++ ++ /* Simplest case: anchored match need be tried only once. */ ++ if (prog->reganch) ++ return(regtry(&g, prog, string)); ++ ++ /* Messy cases: unanchored match. */ ++ s = string; ++ if (prog->regstart != '\0') ++ /* We know what char it must start with. */ ++ while ((s = strchr(s, prog->regstart)) != NULL) { ++ if (regtry(&g, prog, s)) ++ return(1); ++ s++; ++ } ++ else ++ /* We don't -- general case. */ ++ do { ++ if (regtry(&g, prog, s)) ++ return(1); ++ } while (*s++ != '\0'); ++ ++ /* Failure. */ ++ return(0); ++} ++ ++/* ++ - regtry - try match at specific point ++ */ ++static int /* 0 failure, 1 success */ ++regtry(struct match_globals *g, regexp *prog, char *string) ++{ ++ register int i; ++ register char **sp; ++ register char **ep; ++ ++ g->reginput = string; ++ g->regstartp = prog->startp; ++ g->regendp = prog->endp; ++ ++ sp = prog->startp; ++ ep = prog->endp; ++ for (i = NSUBEXP; i > 0; i--) { ++ *sp++ = NULL; ++ *ep++ = NULL; ++ } ++ if (regmatch(g, prog->program + 1)) { ++ prog->startp[0] = string; ++ prog->endp[0] = g->reginput; ++ return(1); ++ } else ++ return(0); ++} ++ ++/* ++ - regmatch - main matching routine ++ * ++ * Conceptually the strategy is simple: check to see whether the current ++ * node matches, call self recursively to see whether the rest matches, ++ * and then act accordingly. In practice we make some effort to avoid ++ * recursion, in particular by going through "ordinary" nodes (that don't ++ * need to know whether the rest of the match failed) by a loop instead of ++ * by recursion. ++ */ ++static int /* 0 failure, 1 success */ ++regmatch(struct match_globals *g, char *prog) ++{ ++ register char *scan = prog; /* Current node. */ ++ char *next; /* Next node. */ ++ ++#ifdef DEBUG ++ if (scan != NULL && regnarrate) ++ fprintf(stderr, "%s(\n", regprop(scan)); ++#endif ++ while (scan != NULL) { ++#ifdef DEBUG ++ if (regnarrate) ++ fprintf(stderr, "%s...\n", regprop(scan)); ++#endif ++ next = regnext(g, scan); ++ ++ switch (OP(scan)) { ++ case BOL: ++ if (g->reginput != g->regbol) ++ return(0); ++ break; ++ case EOL: ++ if (*g->reginput != '\0') ++ return(0); ++ break; ++ case ANY: ++ if (*g->reginput == '\0') ++ return(0); ++ g->reginput++; ++ break; ++ case EXACTLY: { ++ register int len; ++ register char *opnd; ++ ++ opnd = OPERAND(scan); ++ /* Inline the first character, for speed. */ ++ if (*opnd != *g->reginput) ++ return(0); ++ len = strlen(opnd); ++ if (len > 1 && strncmp(opnd, g->reginput, len) != 0) ++ return(0); ++ g->reginput += len; ++ } ++ break; ++ case ANYOF: ++ if (*g->reginput == '\0' || strchr(OPERAND(scan), *g->reginput) == NULL) ++ return(0); ++ g->reginput++; ++ break; ++ case ANYBUT: ++ if (*g->reginput == '\0' || strchr(OPERAND(scan), *g->reginput) != NULL) ++ return(0); ++ g->reginput++; ++ break; ++ case NOTHING: ++ case BACK: ++ break; ++ case OPEN+1: ++ case OPEN+2: ++ case OPEN+3: ++ case OPEN+4: ++ case OPEN+5: ++ case OPEN+6: ++ case OPEN+7: ++ case OPEN+8: ++ case OPEN+9: { ++ register int no; ++ register char *save; ++ ++ no = OP(scan) - OPEN; ++ save = g->reginput; ++ ++ if (regmatch(g, next)) { ++ /* ++ * Don't set startp if some later ++ * invocation of the same parentheses ++ * already has. ++ */ ++ if (g->regstartp[no] == NULL) ++ g->regstartp[no] = save; ++ return(1); ++ } else ++ return(0); ++ } ++ break; ++ case CLOSE+1: ++ case CLOSE+2: ++ case CLOSE+3: ++ case CLOSE+4: ++ case CLOSE+5: ++ case CLOSE+6: ++ case CLOSE+7: ++ case CLOSE+8: ++ case CLOSE+9: ++ { ++ register int no; ++ register char *save; ++ ++ no = OP(scan) - CLOSE; ++ save = g->reginput; ++ ++ if (regmatch(g, next)) { ++ /* ++ * Don't set endp if some later ++ * invocation of the same parentheses ++ * already has. ++ */ ++ if (g->regendp[no] == NULL) ++ g->regendp[no] = save; ++ return(1); ++ } else ++ return(0); ++ } ++ break; ++ case BRANCH: { ++ register char *save; ++ ++ if (OP(next) != BRANCH) /* No choice. */ ++ next = OPERAND(scan); /* Avoid recursion. */ ++ else { ++ do { ++ save = g->reginput; ++ if (regmatch(g, OPERAND(scan))) ++ return(1); ++ g->reginput = save; ++ scan = regnext(g, scan); ++ } while (scan != NULL && OP(scan) == BRANCH); ++ return(0); ++ /* NOTREACHED */ ++ } ++ } ++ break; ++ case STAR: ++ case PLUS: { ++ register char nextch; ++ register int no; ++ register char *save; ++ register int min; ++ ++ /* ++ * Lookahead to avoid useless match attempts ++ * when we know what character comes next. ++ */ ++ nextch = '\0'; ++ if (OP(next) == EXACTLY) ++ nextch = *OPERAND(next); ++ min = (OP(scan) == STAR) ? 0 : 1; ++ save = g->reginput; ++ no = regrepeat(g, OPERAND(scan)); ++ while (no >= min) { ++ /* If it could work, try it. */ ++ if (nextch == '\0' || *g->reginput == nextch) ++ if (regmatch(g, next)) ++ return(1); ++ /* Couldn't or didn't -- back up. */ ++ no--; ++ g->reginput = save + no; ++ } ++ return(0); ++ } ++ break; ++ case END: ++ return(1); /* Success! */ ++ break; ++ default: ++ printk("<3>Regexp: memory corruption\n"); ++ return(0); ++ break; ++ } ++ ++ scan = next; ++ } ++ ++ /* ++ * We get here only if there's trouble -- normally "case END" is ++ * the terminating point. ++ */ ++ printk("<3>Regexp: corrupted pointers\n"); ++ return(0); ++} ++ ++/* ++ - regrepeat - repeatedly match something simple, report how many ++ */ ++static int ++regrepeat(struct match_globals *g, char *p) ++{ ++ register int count = 0; ++ register char *scan; ++ register char *opnd; ++ ++ scan = g->reginput; ++ opnd = OPERAND(p); ++ switch (OP(p)) { ++ case ANY: ++ count = strlen(scan); ++ scan += count; ++ break; ++ case EXACTLY: ++ while (*opnd == *scan) { ++ count++; ++ scan++; ++ } ++ break; ++ case ANYOF: ++ while (*scan != '\0' && strchr(opnd, *scan) != NULL) { ++ count++; ++ scan++; ++ } ++ break; ++ case ANYBUT: ++ while (*scan != '\0' && strchr(opnd, *scan) == NULL) { ++ count++; ++ scan++; ++ } ++ break; ++ default: /* Oh dear. Called inappropriately. */ ++ printk("<3>Regexp: internal foulup\n"); ++ count = 0; /* Best compromise. */ ++ break; ++ } ++ g->reginput = scan; ++ ++ return(count); ++} ++ ++/* ++ - regnext - dig the "next" pointer out of a node ++ */ ++static char* ++regnext(struct match_globals *g, char *p) ++{ ++ register int offset; ++ ++ if (p == &g->regdummy) ++ return(NULL); ++ ++ offset = NEXT(p); ++ if (offset == 0) ++ return(NULL); ++ ++ if (OP(p) == BACK) ++ return(p-offset); ++ else ++ return(p+offset); ++} ++ ++#ifdef DEBUG ++ ++STATIC char *regprop(); ++ ++/* ++ - regdump - dump a regexp onto stdout in vaguely comprehensible form ++ */ ++void ++regdump(regexp *r) ++{ ++ register char *s; ++ register char op = EXACTLY; /* Arbitrary non-END op. */ ++ register char *next; ++ /* extern char *strchr(); */ ++ ++ ++ s = r->program + 1; ++ while (op != END) { /* While that wasn't END last time... */ ++ op = OP(s); ++ printf("%2d%s", s-r->program, regprop(s)); /* Where, what. */ ++ next = regnext(s); ++ if (next == NULL) /* Next ptr. */ ++ printf("(0)"); ++ else ++ printf("(%d)", (s-r->program)+(next-s)); ++ s += 3; ++ if (op == ANYOF || op == ANYBUT || op == EXACTLY) { ++ /* Literal string, where present. */ ++ while (*s != '\0') { ++ putchar(*s); ++ s++; ++ } ++ s++; ++ } ++ putchar('\n'); ++ } ++ ++ /* Header fields of interest. */ ++ if (r->regstart != '\0') ++ printf("start `%c' ", r->regstart); ++ if (r->reganch) ++ printf("anchored "); ++ if (r->regmust != NULL) ++ printf("must have \"%s\"", r->regmust); ++ printf("\n"); ++} ++ ++/* ++ - regprop - printable representation of opcode ++ */ ++static char * ++regprop(char *op) ++{ ++#define BUFLEN 50 ++ register char *p; ++ static char buf[BUFLEN]; ++ ++ strcpy(buf, ":"); ++ ++ switch (OP(op)) { ++ case BOL: ++ p = "BOL"; ++ break; ++ case EOL: ++ p = "EOL"; ++ break; ++ case ANY: ++ p = "ANY"; ++ break; ++ case ANYOF: ++ p = "ANYOF"; ++ break; ++ case ANYBUT: ++ p = "ANYBUT"; ++ break; ++ case BRANCH: ++ p = "BRANCH"; ++ break; ++ case EXACTLY: ++ p = "EXACTLY"; ++ break; ++ case NOTHING: ++ p = "NOTHING"; ++ break; ++ case BACK: ++ p = "BACK"; ++ break; ++ case END: ++ p = "END"; ++ break; ++ case OPEN+1: ++ case OPEN+2: ++ case OPEN+3: ++ case OPEN+4: ++ case OPEN+5: ++ case OPEN+6: ++ case OPEN+7: ++ case OPEN+8: ++ case OPEN+9: ++ snprintf(buf+strlen(buf),BUFLEN-strlen(buf), "OPEN%d", OP(op)-OPEN); ++ p = NULL; ++ break; ++ case CLOSE+1: ++ case CLOSE+2: ++ case CLOSE+3: ++ case CLOSE+4: ++ case CLOSE+5: ++ case CLOSE+6: ++ case CLOSE+7: ++ case CLOSE+8: ++ case CLOSE+9: ++ snprintf(buf+strlen(buf),BUFLEN-strlen(buf), "CLOSE%d", OP(op)-CLOSE); ++ p = NULL; ++ break; ++ case STAR: ++ p = "STAR"; ++ break; ++ case PLUS: ++ p = "PLUS"; ++ break; ++ default: ++ printk("<3>Regexp: corrupted opcode\n"); ++ break; ++ } ++ if (p != NULL) ++ strncat(buf, p, BUFLEN-strlen(buf)); ++ return(buf); ++} ++#endif ++ ++ +diff -Naur linux-3.0.24.org/net/netfilter/regexp/regexp.h linux-3.0.24/net/netfilter/regexp/regexp.h +--- linux-3.0.24.org/net/netfilter/regexp/regexp.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-3.0.24/net/netfilter/regexp/regexp.h 2012-03-15 20:08:49.066043520 +0100 +@@ -0,0 +1,41 @@ ++/* ++ * Definitions etc. for regexp(3) routines. ++ * ++ * Caveat: this is V8 regexp(3) [actually, a reimplementation thereof], ++ * not the System V one. ++ */ ++ ++#ifndef REGEXP_H ++#define REGEXP_H ++ ++ ++/* ++http://www.opensource.apple.com/darwinsource/10.3/expect-1/expect/expect.h , ++which contains a version of this library, says: ++ ++ * ++ * NSUBEXP must be at least 10, and no greater than 117 or the parser ++ * will not work properly. ++ * ++ ++However, it looks rather like this library is limited to 10. If you think ++otherwise, let us know. ++*/ ++ ++#define NSUBEXP 10 ++typedef struct regexp { ++ char *startp[NSUBEXP]; ++ char *endp[NSUBEXP]; ++ char regstart; /* Internal use only. */ ++ char reganch; /* Internal use only. */ ++ char *regmust; /* Internal use only. */ ++ int regmlen; /* Internal use only. */ ++ char program[1]; /* Unwarranted chumminess with compiler. */ ++} regexp; ++ ++regexp * regcomp(char *exp, int *patternsize); ++int regexec(regexp *prog, char *string); ++void regsub(regexp *prog, char *source, char *dest); ++void regerror(char *s); ++ ++#endif +diff -Naur linux-3.0.24.org/net/netfilter/regexp/regmagic.h linux-3.0.24/net/netfilter/regexp/regmagic.h +--- linux-3.0.24.org/net/netfilter/regexp/regmagic.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-3.0.24/net/netfilter/regexp/regmagic.h 2012-03-15 20:08:49.066043520 +0100 +@@ -0,0 +1,5 @@ ++/* ++ * The first byte of the regexp internal "program" is actually this magic ++ * number; the start node begins in the second byte. ++ */ ++#define MAGIC 0234 +diff -Naur linux-3.0.24.org/net/netfilter/regexp/regsub.c linux-3.0.24/net/netfilter/regexp/regsub.c +--- linux-3.0.24.org/net/netfilter/regexp/regsub.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-3.0.24/net/netfilter/regexp/regsub.c 2012-03-15 20:08:49.076047746 +0100 +@@ -0,0 +1,95 @@ ++/* ++ * regsub ++ * @(#)regsub.c 1.3 of 2 April 86 ++ * ++ * Copyright (c) 1986 by University of Toronto. ++ * Written by Henry Spencer. Not derived from licensed software. ++ * ++ * Permission is granted to anyone to use this software for any ++ * purpose on any computer system, and to redistribute it freely, ++ * subject to the following restrictions: ++ * ++ * 1. The author is not responsible for the consequences of use of ++ * this software, no matter how awful, even if they arise ++ * from defects in it. ++ * ++ * 2. The origin of this software must not be misrepresented, either ++ * by explicit claim or by omission. ++ * ++ * 3. Altered versions must be plainly marked as such, and must not ++ * be misrepresented as being the original software. ++ * ++ * ++ * This code was modified by Ethan Sommer to work within the kernel ++ * (it now uses kmalloc etc..) ++ * ++ */ ++#include "regexp.h" ++#include "regmagic.h" ++#include <linux/string.h> ++ ++ ++#ifndef CHARBITS ++#define UCHARAT(p) ((int)*(unsigned char *)(p)) ++#else ++#define UCHARAT(p) ((int)*(p)&CHARBITS) ++#endif ++ ++#if 0 ++//void regerror(char * s) ++//{ ++// printk("regexp(3): %s", s); ++// /* NOTREACHED */ ++//} ++#endif ++ ++/* ++ - regsub - perform substitutions after a regexp match ++ */ ++void ++regsub(regexp * prog, char * source, char * dest) ++{ ++ register char *src; ++ register char *dst; ++ register char c; ++ register int no; ++ register int len; ++ ++ /* Not necessary and gcc doesn't like it -MLS */ ++ /*extern char *strncpy();*/ ++ ++ if (prog == NULL || source == NULL || dest == NULL) { ++ regerror("NULL parm to regsub"); ++ return; ++ } ++ if (UCHARAT(prog->program) != MAGIC) { ++ regerror("damaged regexp fed to regsub"); ++ return; ++ } ++ ++ src = source; ++ dst = dest; ++ while ((c = *src++) != '\0') { ++ if (c == '&') ++ no = 0; ++ else if (c == '\\' && '0' <= *src && *src <= '9') ++ no = *src++ - '0'; ++ else ++ no = -1; ++ ++ if (no < 0) { /* Ordinary character. */ ++ if (c == '\\' && (*src == '\\' || *src == '&')) ++ c = *src++; ++ *dst++ = c; ++ } else if (prog->startp[no] != NULL && prog->endp[no] != NULL) { ++ len = prog->endp[no] - prog->startp[no]; ++ (void) strncpy(dst, prog->startp[no], len); ++ dst += len; ++ if (len != 0 && *(dst-1) == '\0') { /* strncpy hit NUL. */ ++ regerror("damaged match string"); ++ return; ++ } ++ } ++ } ++ *dst++ = '\0'; ++} +diff -Naur linux-3.0.24.org/net/netfilter/xt_layer7.c linux-3.0.24/net/netfilter/xt_layer7.c +--- linux-3.0.24.org/net/netfilter/xt_layer7.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-3.0.24/net/netfilter/xt_layer7.c 2012-03-20 01:44:50.907527097 +0100 +@@ -0,0 +1,684 @@ ++/* ++ Kernel module to match application layer (OSI layer 7) data in connections. ++ ++ http://l7-filter.sf.net ++ ++ (C) 2003-2009 Matthew Strait and Ethan Sommer. ++ ++ This program is free software; you can redistribute it and/or ++ modify it under the terms of the GNU General Public License ++ as published by the Free Software Foundation; either version ++ 2 of the License, or (at your option) any later version. ++ http://www.gnu.org/licenses/gpl.txt ++ ++ Based on ipt_string.c (C) 2000 Emmanuel Roger <winfield(a)freegates.be>, ++ xt_helper.c (C) 2002 Harald Welte and cls_layer7.c (C) 2003 Matthew Strait, ++ Ethan Sommer, Justin Levandoski. ++*/ ++ ++#include <linux/spinlock.h> ++#include <linux/version.h> ++#include <net/ip.h> ++#include <net/tcp.h> ++#include <linux/module.h> ++#include <linux/skbuff.h> ++#include <linux/netfilter.h> ++#include <net/netfilter/nf_conntrack.h> ++#include <net/netfilter/nf_conntrack_core.h> ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) ++#include <net/netfilter/nf_conntrack_extend.h> ++#include <net/netfilter/nf_conntrack_acct.h> ++#endif ++#include <linux/netfilter/x_tables.h> ++#include <linux/netfilter/xt_layer7.h> ++#include <linux/ctype.h> ++#include <linux/proc_fs.h> ++ ++#include "regexp/regexp.c" ++ ++MODULE_LICENSE("GPL"); ++MODULE_AUTHOR("Matthew Strait <quadong(a)users.sf.net>, Ethan Sommer <sommere(a)users.sf.net>"); ++MODULE_DESCRIPTION("iptables application layer match module"); ++MODULE_ALIAS("ipt_layer7"); ++MODULE_VERSION("2.22ipfire"); ++ ++static int maxdatalen = 2048; // this is the default ++module_param(maxdatalen, int, 0444); ++MODULE_PARM_DESC(maxdatalen, "maximum bytes of data looked at by l7-filter"); ++#ifdef CONFIG_NETFILTER_XT_MATCH_LAYER7_DEBUG ++ #define DPRINTK(format,args...) printk(format,##args) ++#else ++ #define DPRINTK(format,args...) ++#endif ++ ++/* Number of packets whose data we look at. ++This can be modified through /proc/net/layer7_numpackets */ ++static int num_packets = 10; ++ ++static struct pattern_cache { ++ char * regex_string; ++ regexp * pattern; ++ struct pattern_cache * next; ++} * first_pattern_cache = NULL; ++ ++DEFINE_SPINLOCK(l7_lock); ++ ++static int total_acct_packets(struct nf_conn *ct) ++{ ++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 26) ++ BUG_ON(ct == NULL); ++ return (ct->counters[IP_CT_DIR_ORIGINAL].packets + ct->counters[IP_CT_DIR_REPLY].packets); ++#else ++ struct nf_conn_counter *acct; ++ ++ BUG_ON(ct == NULL); ++ acct = nf_conn_acct_find(ct); ++ if (!acct) ++ return 0; ++ return (acct[IP_CT_DIR_ORIGINAL].packets + acct[IP_CT_DIR_REPLY].packets); ++#endif ++} ++ ++#ifdef CONFIG_IP_NF_MATCH_LAYER7_DEBUG ++/* Converts an unfriendly string into a friendly one by ++replacing unprintables with periods and all whitespace with " ". */ ++static char * friendly_print(unsigned char * s) ++{ ++ char * f = kmalloc(strlen(s) + 1, GFP_ATOMIC); ++ int i; ++ ++ if(!f) { ++ if (net_ratelimit()) ++ printk(KERN_ERR "layer7: out of memory in " ++ "friendly_print, bailing.\n"); ++ return NULL; ++ } ++ ++ for(i = 0; i < strlen(s); i++){ ++ if(isprint(s[i]) && s[i] < 128) f[i] = s[i]; ++ else if(isspace(s[i])) f[i] = ' '; ++ else f[i] = '.'; ++ } ++ f[i] = '\0'; ++ return f; ++} ++ ++static char dec2hex(int i) ++{ ++ switch (i) { ++ case 0 ... 9: ++ return (i + '0'); ++ break; ++ case 10 ... 15: ++ return (i - 10 + 'a'); ++ break; ++ default: ++ if (net_ratelimit()) ++ printk("layer7: Problem in dec2hex\n"); ++ return '\0'; ++ } ++} ++ ++static char * hex_print(unsigned char * s) ++{ ++ char * g = kmalloc(strlen(s)*3 + 1, GFP_ATOMIC); ++ int i; ++ ++ if(!g) { ++ if (net_ratelimit()) ++ printk(KERN_ERR "layer7: out of memory in hex_print, " ++ "bailing.\n"); ++ return NULL; ++ } ++ ++ for(i = 0; i < strlen(s); i++) { ++ g[i*3 ] = dec2hex(s[i]/16); ++ g[i*3 + 1] = dec2hex(s[i]%16); ++ g[i*3 + 2] = ' '; ++ } ++ g[i*3] = '\0'; ++ ++ return g; ++} ++#endif // DEBUG ++ ++/* Use instead of regcomp. As we expect to be seeing the same regexps over and ++over again, it make sense to cache the results. */ ++static regexp * compile_and_cache(const char * regex_string, ++ const char * protocol) ++{ ++ struct pattern_cache * node = first_pattern_cache; ++ struct pattern_cache * last_pattern_cache = first_pattern_cache; ++ struct pattern_cache * tmp; ++ unsigned int len; ++ ++ while (node != NULL) { ++ if (!strcmp(node->regex_string, regex_string)) ++ return node->pattern; ++ ++ last_pattern_cache = node;/* points at the last non-NULL node */ ++ node = node->next; ++ } ++ ++ /* If we reach the end of the list, then we have not yet cached ++ the pattern for this regex. Let's do that now. ++ Be paranoid about running out of memory to avoid list corruption. */ ++ tmp = kmalloc(sizeof(struct pattern_cache), GFP_ATOMIC); ++ ++ if(!tmp) { ++ if (net_ratelimit()) ++ printk(KERN_ERR "layer7: out of memory in " ++ "compile_and_cache, bailing.\n"); ++ return NULL; ++ } ++ ++ tmp->regex_string = kmalloc(strlen(regex_string) + 1, GFP_ATOMIC); ++ tmp->pattern = kmalloc(sizeof(struct regexp), GFP_ATOMIC); ++ tmp->next = NULL; ++ ++ if(!tmp->regex_string || !tmp->pattern) { ++ if (net_ratelimit()) ++ printk(KERN_ERR "layer7: out of memory in " ++ "compile_and_cache, bailing.\n"); ++ kfree(tmp->regex_string); ++ kfree(tmp->pattern); ++ kfree(tmp); ++ return NULL; ++ } ++ ++ /* Ok. The new node is all ready now. */ ++ node = tmp; ++ ++ if(first_pattern_cache == NULL) /* list is empty */ ++ first_pattern_cache = node; /* make node the beginning */ ++ else ++ last_pattern_cache->next = node; /* attach node to the end */ ++ ++ /* copy the string and compile the regex */ ++ len = strlen(regex_string); ++ DPRINTK("layer7: about to compile this: \"%s\"\n", regex_string); ++ node->pattern = regcomp((char *)regex_string, &len); ++ if ( !node->pattern ) { ++ if (net_ratelimit()) ++ printk(KERN_ERR "layer7: Error compiling regexp " ++ "\"%s\" (%s)\n", ++ regex_string, protocol); ++ /* pattern is now cached as NULL, so we won't try again. */ ++ } ++ ++ strcpy(node->regex_string, regex_string); ++ return node->pattern; ++} ++ ++static int can_handle(const struct sk_buff *skb) ++{ ++ if(!ip_hdr(skb)) /* not IP */ ++ return 0; ++ if(ip_hdr(skb)->protocol != IPPROTO_TCP && ++ ip_hdr(skb)->protocol != IPPROTO_UDP && ++ ip_hdr(skb)->protocol != IPPROTO_ICMP) ++ return 0; ++ return 1; ++} ++ ++/* Returns offset the into the skb->data that the application data starts */ ++static int app_data_offset(const struct sk_buff *skb) ++{ ++ /* In case we are ported somewhere (ebtables?) where ip_hdr(skb) ++ isn't set, this can be gotten from 4*(skb->data[0] & 0x0f) as well. */ ++ int ip_hl = 4*ip_hdr(skb)->ihl; ++ ++ if( ip_hdr(skb)->protocol == IPPROTO_TCP ) { ++ /* 12 == offset into TCP header for the header length field. ++ Can't get this with skb->h.th->doff because the tcphdr ++ struct doesn't get set when routing (this is confirmed to be ++ true in Netfilter as well as QoS.) */ ++ int tcp_hl = 4*(skb->data[ip_hl + 12] >> 4); ++ ++ return ip_hl + tcp_hl; ++ } else if( ip_hdr(skb)->protocol == IPPROTO_UDP ) { ++ return ip_hl + 8; /* UDP header is always 8 bytes */ ++ } else if( ip_hdr(skb)->protocol == IPPROTO_ICMP ) { ++ return ip_hl + 8; /* ICMP header is 8 bytes */ ++ } else { ++ if (net_ratelimit()) ++ printk(KERN_ERR "layer7: tried to handle unknown " ++ "protocol!\n"); ++ return ip_hl + 8; /* something reasonable */ ++ } ++} ++ ++/* handles whether there's a match when we aren't appending data anymore */ ++static int match_no_append(struct nf_conn * conntrack, ++ struct nf_conn * master_conntrack, ++ enum ip_conntrack_info ctinfo, ++ enum ip_conntrack_info master_ctinfo, ++ const struct xt_layer7_info * info) ++{ ++ /* If we're in here, throw the app data away */ ++ if(master_conntrack->layer7.app_data != NULL) { ++ ++ #ifdef CONFIG_IP_NF_MATCH_LAYER7_DEBUG ++ if(!master_conntrack->layer7.app_proto) { ++ char * f = ++ friendly_print(master_conntrack->layer7.app_data); ++ char * g = ++ hex_print(master_conntrack->layer7.app_data); ++ DPRINTK("\nl7-filter gave up after %d bytes " ++ "(%d packets):\n%s\n", ++ strlen(f), total_acct_packets(master_conntrack), f); ++ kfree(f); ++ DPRINTK("In hex: %s\n", g); ++ kfree(g); ++ } ++ #endif ++ ++ kfree(master_conntrack->layer7.app_data); ++ master_conntrack->layer7.app_data = NULL; /* don't free again */ ++ } ++ ++ if(master_conntrack->layer7.app_proto){ ++ /* Here child connections set their .app_proto (for /proc) */ ++ if(!conntrack->layer7.app_proto) { ++ conntrack->layer7.app_proto = ++ kmalloc(strlen(master_conntrack->layer7.app_proto)+1, ++ GFP_ATOMIC); ++ if(!conntrack->layer7.app_proto){ ++ if (net_ratelimit()) ++ printk(KERN_ERR "layer7: out of memory " ++ "in match_no_append, " ++ "bailing.\n"); ++ return 1; ++ } ++ strcpy(conntrack->layer7.app_proto, ++ master_conntrack->layer7.app_proto); ++ } ++ ++ return (!strcmp(master_conntrack->layer7.app_proto, ++ info->protocol)); ++ } ++ else { ++ /* If not classified, set to "unknown" to distinguish from ++ connections that are still being tested. */ ++ master_conntrack->layer7.app_proto = ++ kmalloc(strlen("unknown")+1, GFP_ATOMIC); ++ if(!master_conntrack->layer7.app_proto){ ++ if (net_ratelimit()) ++ printk(KERN_ERR "layer7: out of memory in " ++ "match_no_append, bailing.\n"); ++ return 1; ++ } ++ strcpy(master_conntrack->layer7.app_proto, "unknown"); ++ return 0; ++ } ++} ++ ++/* add the new app data to the conntrack. Return number of bytes added. */ ++static int add_data(struct nf_conn * master_conntrack, ++ char * app_data, int appdatalen) ++{ ++ int length = 0, i; ++ int oldlength = master_conntrack->layer7.app_data_len; ++ ++ /* This is a fix for a race condition by Deti Fliegl. However, I'm not ++ clear on whether the race condition exists or whether this really ++ fixes it. I might just be being dense... Anyway, if it's not really ++ a fix, all it does is waste a very small amount of time. */ ++ if(!master_conntrack->layer7.app_data) return 0; ++ ++ /* Strip nulls. Make everything lower case (our regex lib doesn't ++ do case insensitivity). Add it to the end of the current data. */ ++ for(i = 0; i < maxdatalen-oldlength-1 && ++ i < appdatalen; i++) { ++ if(app_data[i] != '\0') { ++ /* the kernel version of tolower mungs 'upper ascii' */ ++ master_conntrack->layer7.app_data[length+oldlength] = ++ isascii(app_data[i])? ++ tolower(app_data[i]) : app_data[i]; ++ length++; ++ } ++ } ++ ++ master_conntrack->layer7.app_data[length+oldlength] = '\0'; ++ master_conntrack->layer7.app_data_len = length + oldlength; ++ ++ return length; ++} ++ ++/* taken from drivers/video/modedb.c */ ++static int my_atoi(const char *s) ++{ ++ int val = 0; ++ ++ for (;; s++) { ++ switch (*s) { ++ case '0'...'9': ++ val = 10*val+(*s-'0'); ++ break; ++ default: ++ return val; ++ } ++ } ++} ++ ++/* write out num_packets to userland. */ ++static int layer7_read_proc(char* page, char ** start, off_t off, int count, ++ int* eof, void * data) ++{ ++ if(num_packets > 99 && net_ratelimit()) ++ printk(KERN_ERR "layer7: NOT REACHED. num_packets too big\n"); ++ ++ page[0] = num_packets/10 + '0'; ++ page[1] = num_packets%10 + '0'; ++ page[2] = '\n'; ++ page[3] = '\0'; ++ ++ *eof=1; ++ ++ return 3; ++} ++ ++/* Read in num_packets from userland */ ++static int layer7_write_proc(struct file* file, const char* buffer, ++ unsigned long count, void *data) ++{ ++ char * foo = kmalloc(count, GFP_ATOMIC); ++ ++ if(!foo){ ++ if (net_ratelimit()) ++ printk(KERN_ERR "layer7: out of memory, bailing. " ++ "num_packets unchanged.\n"); ++ return count; ++ } ++ ++ if(copy_from_user(foo, buffer, count)) { ++ return -EFAULT; ++ } ++ ++ ++ num_packets = my_atoi(foo); ++ kfree (foo); ++ ++ /* This has an arbitrary limit to make the math easier. I'm lazy. ++ But anyway, 99 is a LOT! If you want more, you're doing it wrong! */ ++ if(num_packets > 99) { ++ printk(KERN_WARNING "layer7: num_packets can't be > 99.\n"); ++ num_packets = 99; ++ } else if(num_packets < 1) { ++ printk(KERN_WARNING "layer7: num_packets can't be < 1.\n"); ++ num_packets = 1; ++ } ++ ++ return count; ++} ++ ++static bool ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35) ++match(const struct sk_buff *skbin, struct xt_action_param *par) ++#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28) ++match(const struct sk_buff *skbin, const struct xt_match_param *par) ++#else ++match(const struct sk_buff *skbin, ++ const struct net_device *in, ++ const struct net_device *out, ++ const struct xt_match *match, ++ const void *matchinfo, ++ int offset, ++ unsigned int protoff, ++ bool *hotdrop) ++#endif ++{ ++ /* sidestep const without getting a compiler warning... */ ++ struct sk_buff * skb = (struct sk_buff *)skbin; ++ ++ const struct xt_layer7_info * info = ++ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28) ++ par->matchinfo; ++ #else ++ matchinfo; ++ #endif ++ ++ enum ip_conntrack_info master_ctinfo, ctinfo; ++ struct nf_conn *master_conntrack, *conntrack; ++ unsigned char * app_data; ++ unsigned int pattern_result, appdatalen; ++ regexp * comppattern; ++ ++ /* Be paranoid/incompetent - lock the entire match function. */ ++ spin_lock_bh(&l7_lock); ++ ++ if(!can_handle(skb)){ ++ DPRINTK("layer7: This is some protocol I can't handle.\n"); ++ spin_unlock_bh(&l7_lock); ++ return info->invert; ++ } ++ ++ /* Treat parent & all its children together as one connection, except ++ for the purpose of setting conntrack->layer7.app_proto in the actual ++ connection. This makes /proc/net/ip_conntrack more satisfying. */ ++ if(!(conntrack = nf_ct_get(skb, &ctinfo)) || ++ !(master_conntrack=nf_ct_get(skb,&master_ctinfo))){ ++ DPRINTK("layer7: couldn't get conntrack.\n"); ++ spin_unlock_bh(&l7_lock); ++ return info->invert; ++ } ++ ++ /* Try to get a master conntrack (and its master etc) for FTP, etc. */ ++ while (master_ct(master_conntrack) != NULL) ++ master_conntrack = master_ct(master_conntrack); ++ ++ /* if we've classified it or seen too many packets */ ++ if(total_acct_packets(master_conntrack) > num_packets || ++ master_conntrack->layer7.app_proto) { ++ ++ pattern_result = match_no_append(conntrack, master_conntrack, ++ ctinfo, master_ctinfo, info); ++ ++ /* skb->cb[0] == seen. Don't do things twice if there are ++ multiple l7 rules. I'm not sure that using cb for this purpose ++ is correct, even though it says "put your private variables ++ there". But it doesn't look like it is being used for anything ++ else in the skbs that make it here. */ ++ skb->cb[0] = 1; /* marking it seen here's probably irrelevant */ ++ ++ spin_unlock_bh(&l7_lock); ++ return (pattern_result ^ info->invert); ++ } ++ ++ if(skb_is_nonlinear(skb)){ ++ if(skb_linearize(skb) != 0){ ++ if (net_ratelimit()) ++ printk(KERN_ERR "layer7: failed to linearize " ++ "packet, bailing.\n"); ++ spin_unlock_bh(&l7_lock); ++ return info->invert; ++ } ++ } ++ ++ /* now that the skb is linearized, it's safe to set these. */ ++ app_data = skb->data + app_data_offset(skb); ++ appdatalen = skb_tail_pointer(skb) - app_data; ++ ++ /* the return value gets checked later, when we're ready to use it */ ++ comppattern = compile_and_cache(info->pattern, info->protocol); ++ ++ /* On the first packet of a connection, allocate space for app data */ ++ if(total_acct_packets(master_conntrack) == 1 && !skb->cb[0] && ++ !master_conntrack->layer7.app_data){ ++ master_conntrack->layer7.app_data = ++ kmalloc(maxdatalen, GFP_ATOMIC); ++ if(!master_conntrack->layer7.app_data){ ++ if (net_ratelimit()) ++ printk(KERN_ERR "layer7: out of memory in " ++ "match, bailing.\n"); ++ spin_unlock_bh(&l7_lock); ++ return info->invert; ++ } ++ ++ master_conntrack->layer7.app_data[0] = '\0'; ++ } ++ ++ /* Can be here, but unallocated, if numpackets is increased near ++ the beginning of a connection */ ++ if(master_conntrack->layer7.app_data == NULL){ ++ spin_unlock_bh(&l7_lock); ++ return info->invert; /* unmatched */ ++ } ++ ++ if(!skb->cb[0]){ ++ int newbytes; ++ newbytes = add_data(master_conntrack, app_data, appdatalen); ++ ++ if(newbytes == 0) { /* didn't add any data */ ++ skb->cb[0] = 1; ++ /* Didn't match before, not going to match now */ ++ spin_unlock_bh(&l7_lock); ++ return info->invert; ++ } ++ } ++ ++ /* If looking for "unknown", then never match. "Unknown" means that ++ we've given up; we're still trying with these packets. */ ++ if(!strcmp(info->protocol, "unknown")) { ++ pattern_result = 0; ++ /* If looking for "unset", then always match. "Unset" means that we ++ haven't yet classified the connection. */ ++ } else if(!strcmp(info->protocol, "unset")) { ++ pattern_result = 2; ++ DPRINTK("layer7: matched unset: not yet classified " ++ "(%d/%d packets)\n", ++ total_acct_packets(master_conntrack), num_packets); ++ /* If the regexp failed to compile, don't bother running it */ ++ } else if(comppattern && ++ regexec(comppattern, master_conntrack->layer7.app_data)){ ++ DPRINTK("layer7: matched %s\n", info->protocol); ++ pattern_result = 1; ++ } else pattern_result = 0; ++ ++ if(pattern_result == 1) { ++ master_conntrack->layer7.app_proto = ++ kmalloc(strlen(info->protocol)+1, GFP_ATOMIC); ++ if(!master_conntrack->layer7.app_proto){ ++ if (net_ratelimit()) ++ printk(KERN_ERR "layer7: out of memory in " ++ "match, bailing.\n"); ++ spin_unlock_bh(&l7_lock); ++ return (pattern_result ^ info->invert); ++ } ++ strcpy(master_conntrack->layer7.app_proto, info->protocol); ++ } else if(pattern_result > 1) { /* cleanup from "unset" */ ++ pattern_result = 1; ++ } ++ ++ /* mark the packet seen */ ++ skb->cb[0] = 1; ++ ++ spin_unlock_bh(&l7_lock); ++ return (pattern_result ^ info->invert); ++} ++ ++// load nf_conntrack_ipv4 ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35) ++static int ++#else ++static bool ++#endif ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28) ++check(const struct xt_mtchk_param *par) ++{ ++ if (nf_ct_l3proto_try_module_get(par->match->family) < 0) { ++ printk(KERN_WARNING "can't load conntrack support for " ++ "proto=%d\n", par->match->family); ++#else ++check(const char *tablename, const void *inf, ++ const struct xt_match *match, void *matchinfo, ++ unsigned int hook_mask) ++{ ++ if (nf_ct_l3proto_try_module_get(match->family) < 0) { ++ printk(KERN_WARNING "can't load conntrack support for " ++ "proto=%d\n", match->family); ++#endif ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35) ++ return -EINVAL; ++ } ++ return 0; ++#else ++ return 0; ++ } ++ return 1; ++#endif ++} ++ ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28) ++ static void destroy(const struct xt_mtdtor_param *par) ++ { ++ nf_ct_l3proto_module_put(par->match->family); ++ } ++#else ++ static void destroy(const struct xt_match *match, void *matchinfo) ++ { ++ nf_ct_l3proto_module_put(match->family); ++ } ++#endif ++ ++static struct xt_match xt_layer7_match[] __read_mostly = { ++{ ++ .name = "layer7", ++ .family = AF_INET, ++ .checkentry = check, ++ .match = match, ++ .destroy = destroy, ++ .matchsize = sizeof(struct xt_layer7_info), ++ .me = THIS_MODULE ++} ++}; ++ ++static void layer7_cleanup_proc(void) ++{ ++ remove_proc_entry("layer7_numpackets", init_net.proc_net); ++} ++ ++/* register the proc file */ ++static void layer7_init_proc(void) ++{ ++ struct proc_dir_entry* entry; ++ entry = create_proc_entry("layer7_numpackets", 0644, init_net.proc_net); ++ entry->read_proc = layer7_read_proc; ++ entry->write_proc = layer7_write_proc; ++} ++ ++static int __init xt_layer7_init(void) ++{ ++ need_conntrack(); ++ ++ if (init_net.ct.sysctl_acct == 0) { ++ printk(KERN_WARNING "layer7: enabling nf_conntrack_acct\n"); ++ init_net.ct.sysctl_acct = 1; ++ } ++ ++ layer7_init_proc(); ++ if(maxdatalen < 1) { ++ printk(KERN_WARNING "layer7: maxdatalen can't be < 1, " ++ "using 1\n"); ++ maxdatalen = 1; ++ } ++ /* This is not a hard limit. It's just here to prevent people from ++ bringing their slow machines to a grinding halt. */ ++ else if(maxdatalen > 65536) { ++ printk(KERN_WARNING "layer7: maxdatalen can't be > 65536, " ++ "using 65536\n"); ++ maxdatalen = 65536; ++ } ++ return xt_register_matches(xt_layer7_match, ++ ARRAY_SIZE(xt_layer7_match)); ++} ++ ++static void __exit xt_layer7_fini(void) ++{ ++ layer7_cleanup_proc(); ++ xt_unregister_matches(xt_layer7_match, ARRAY_SIZE(xt_layer7_match)); ++} ++ ++module_init(xt_layer7_init); ++module_exit(xt_layer7_fini); hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM March 2012