Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a89ecb6a authored by Yasuyuki Kozakai's avatar Yasuyuki Kozakai Committed by David S. Miller
Browse files

[NETFILTER]: x_tables: unify IPv4/IPv6 multiport match 



This unifies ipt_multiport and ip6t_multiport to xt_multiport.
As a result, this addes support for inversion and port range match
to IPv6 packets.

Signed-off-by: default avatarYasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent dc5ab2fa

include/linux/netfilter/xt_multiport.h

0 → 100644
+30 −0
Original line number Diff line number Diff line 
#ifndef _XT_MULTIPORT_H

#define _XT_MULTIPORT_H



enum xt_multiport_flags

{

	XT_MULTIPORT_SOURCE,

	XT_MULTIPORT_DESTINATION,

	XT_MULTIPORT_EITHER

};



#define XT_MULTI_PORTS	15



/* Must fit inside union xt_matchinfo: 16 bytes */

struct xt_multiport

{

	u_int8_t flags;				/* Type of comparison */

	u_int8_t count;				/* Number of ports */

	u_int16_t ports[XT_MULTI_PORTS];	/* Ports */

};



struct xt_multiport_v1

{

	u_int8_t flags;				/* Type of comparison */

	u_int8_t count;				/* Number of ports */

	u_int16_t ports[XT_MULTI_PORTS];	/* Ports */

	u_int8_t pflags[XT_MULTI_PORTS];	/* Port flags */

	u_int8_t invert;			/* Invert flag */

};



#endif /*_XT_MULTIPORT_H*/

include/linux/netfilter_ipv4/ipt_multiport.h

+8 −23
Original line number Diff line number Diff line 
#ifndef _IPT_MULTIPORT_H

#define _IPT_MULTIPORT_H

#include <linux/netfilter_ipv4/ip_tables.h>



enum ipt_multiport_flags

{

	IPT_MULTIPORT_SOURCE,

	IPT_MULTIPORT_DESTINATION,

	IPT_MULTIPORT_EITHER

};

#include <linux/netfilter/xt_multiport.h>



#define IPT_MULTI_PORTS	15

#define IPT_MULTIPORT_SOURCE		XT_MULTIPORT_SOURCE

#define IPT_MULTIPORT_DESTINATION	XT_MULTIPORT_DESTINATION

#define IPT_MULTIPORT_EITHER		XT_MULTIPORT_EITHER



/* Must fit inside union ipt_matchinfo: 16 bytes */

struct ipt_multiport

{

	u_int8_t flags;				/* Type of comparison */

	u_int8_t count;				/* Number of ports */

	u_int16_t ports[IPT_MULTI_PORTS];	/* Ports */

};

#define IPT_MULTI_PORTS			XT_MULTI_PORTS



#define ipt_multiport			xt_multiport

#define ipt_multiport_v1		xt_multiport_v1



struct ipt_multiport_v1

{

	u_int8_t flags;				/* Type of comparison */

	u_int8_t count;				/* Number of ports */

	u_int16_t ports[IPT_MULTI_PORTS];	/* Ports */

	u_int8_t pflags[IPT_MULTI_PORTS];	/* Port flags */

	u_int8_t invert;			/* Invert flag */

};

#endif /*_IPT_MULTIPORT_H*/

include/linux/netfilter_ipv6/ip6t_multiport.h

+9 −16
Original line number Diff line number Diff line 
#ifndef _IP6T_MULTIPORT_H

#define _IP6T_MULTIPORT_H

#include <linux/netfilter_ipv6/ip6_tables.h>



enum ip6t_multiport_flags

{

	IP6T_MULTIPORT_SOURCE,

	IP6T_MULTIPORT_DESTINATION,

	IP6T_MULTIPORT_EITHER

};

#include <linux/netfilter/xt_multiport.h>



#define IP6T_MULTI_PORTS	15

#define IP6T_MULTIPORT_SOURCE		XT_MULTIPORT_SOURCE

#define IP6T_MULTIPORT_DESTINATION	XT_MULTIPORT_DESTINATION

#define IP6T_MULTIPORT_EITHER		XT_MULTIPORT_EITHER



/* Must fit inside union ip6t_matchinfo: 16 bytes */

struct ip6t_multiport

{

	u_int8_t flags;				/* Type of comparison */

	u_int8_t count;				/* Number of ports */

	u_int16_t ports[IP6T_MULTI_PORTS];	/* Ports */

};

#endif /*_IPT_MULTIPORT_H*/
 
#define IP6T_MULTI_PORTS		XT_MULTI_PORTS



#define ip6t_multiport			xt_multiport



#endif /*_IP6T_MULTIPORT_H*/

net/ipv4/netfilter/Kconfig

+0 −10
Original line number Diff line number Diff line
@@ -221,16 +221,6 @@ config IP_NF_MATCH_IPRANGE 


	  To compile it as a module, choose M here.  If unsure, say N.



config IP_NF_MATCH_MULTIPORT

	tristate "Multiple port match support"

	depends on IP_NF_IPTABLES

	help

	  Multiport matching allows you to match TCP or UDP packets based on

	  a series of source or destination ports: normally a rule can only

	  match a single range of ports.



	  To compile it as a module, choose M here.  If unsure, say N.



config IP_NF_MATCH_TOS

	tristate "TOS match support"

	depends on IP_NF_IPTABLES

net/ipv4/netfilter/Makefile

+0 −1
Original line number Diff line number Diff line
@@ -53,7 +53,6 @@ obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o 
# matches

obj-$(CONFIG_IP_NF_MATCH_HASHLIMIT) += ipt_hashlimit.o

obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o

obj-$(CONFIG_IP_NF_MATCH_MULTIPORT) += ipt_multiport.o

obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o

obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o

obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o