From 2aa32d4bcec2d644de2fd571bafb4ca50fe254fd Mon Sep 17 00:00:00 2001 From: Mohd Nawawi Mohamad Jamili Date: Fri, 7 Aug 2009 16:18:49 +0800 Subject: [PATCH 01/24] psd: import 20090807 code base --- doc/README.psd | 4 + extensions/Kbuild.psd | 1 + extensions/Mbuild.psd | 1 + extensions/libxt_psd.c | 166 +++++++++++++++++++ extensions/libxt_psd.man | 18 ++ extensions/xt_psd.Kconfig | 6 + extensions/xt_psd.c | 336 ++++++++++++++++++++++++++++++++++++++ extensions/xt_psd.h | 41 +++++ mconfig.psd | 2 + 9 files changed, 575 insertions(+) create mode 100644 doc/README.psd create mode 100644 extensions/Kbuild.psd create mode 100644 extensions/Mbuild.psd create mode 100644 extensions/libxt_psd.c create mode 100644 extensions/libxt_psd.man create mode 100644 extensions/xt_psd.Kconfig create mode 100644 extensions/xt_psd.c create mode 100644 extensions/xt_psd.h create mode 100644 mconfig.psd diff --git a/doc/README.psd b/doc/README.psd new file mode 100644 index 0000000..4612a7e --- /dev/null +++ b/doc/README.psd @@ -0,0 +1,4 @@ +PSD (Portscan Detection) External extensions for Xtables-addons + +Example: +iptables -A INPUT -m psd --psd-weight-threshold 21 --psd-delay-threshold 300 --psd-lo-ports-weight 1 --psd-hi-ports-weight 10 -j LOG --log-prefix "PSD: " diff --git a/extensions/Kbuild.psd b/extensions/Kbuild.psd new file mode 100644 index 0000000..9fd0305 --- /dev/null +++ b/extensions/Kbuild.psd @@ -0,0 +1 @@ +obj-${build_psd} += xt_psd.o diff --git a/extensions/Mbuild.psd b/extensions/Mbuild.psd new file mode 100644 index 0000000..5a1ae3b --- /dev/null +++ b/extensions/Mbuild.psd @@ -0,0 +1 @@ +obj-${build_psd} += libxt_psd.so diff --git a/extensions/libxt_psd.c b/extensions/libxt_psd.c new file mode 100644 index 0000000..9d7629b --- /dev/null +++ b/extensions/libxt_psd.c @@ -0,0 +1,166 @@ +/* + Shared library add-on to iptables to add PSD support + + Copyright (C) 2000,2001 astaro AG + + This file is distributed under the terms of the GNU General Public + License (GPL). Copies of the GPL can be obtained from: + ftp://prep.ai.mit.edu/pub/gnu/GPL + + 2000-05-04 Markus Hennig : initial + 2000-08-18 Dennis Koslowski : first release + 2000-12-01 Dennis Koslowski : UDP scans detection added + 2001-02-04 Jan Rekorajski : converted from target to match + 2003-03-02 Harald Welte : fix 'storage' bug + 2008-04-03 Mohd Nawawi : update to 2.6.24 / 1.4 code + 2008-06-24 Mohd Nawawi : update to 2.6.24 / 1.4.1 code + 2009-08-07 Mohd Nawawi Mohamad Jamili : ported to xtables-addons +*/ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "xt_psd.h" + +/* Function which prints out usage message. */ +static void psd_mt_help(void) { + printf( + "psd match options:\n" + " --psd-weight-threshold threshhold Portscan detection weight threshold\n" + " --psd-delay-threshold delay Portscan detection delay threshold\n" + " --psd-lo-ports-weight lo Privileged ports weight\n" + " --psd-hi-ports-weight hi High ports weight\n\n"); +} + +static const struct option psd_mt_opts[] = { + {.name = "psd-weight-threshold", .has_arg = true, .val = '1'}, + {.name = "psd-delay-threshold", .has_arg = true, .val = '2'}, + {.name = "psd-lo-ports-weight", .has_arg = true, .val = '3'}, + {.name = "psd-hi-ports-weight", .has_arg = true, .val = '4'}, + {NULL} +}; + +/* Initialize the target. */ +static void psd_mt_init(struct xt_entry_match *match) { + struct xt_psd_info *psdinfo = (struct xt_psd_info *)match->data; + psdinfo->weight_threshold = SCAN_WEIGHT_THRESHOLD; + psdinfo->delay_threshold = SCAN_DELAY_THRESHOLD; + psdinfo->lo_ports_weight = PORT_WEIGHT_PRIV; + psdinfo->hi_ports_weight = PORT_WEIGHT_HIGH; +} + +#define XT_PSD_OPT_CTRESH 0x01 +#define XT_PSD_OPT_DTRESH 0x02 +#define XT_PSD_OPT_LPWEIGHT 0x04 +#define XT_PSD_OPT_HPWEIGHT 0x08 + +static int psd_mt_parse(int c, char **argv, int invert, unsigned int *flags, + const void *entry, struct xt_entry_match **match) +{ + struct xt_psd_info *psdinfo = (struct xt_psd_info *)(*match)->data; + unsigned int num; + + switch (c) { + /* PSD-weight-threshold */ + case '1': + if(*flags & XT_PSD_OPT_CTRESH) { + xtables_error(PARAMETER_PROBLEM,"Can't specify --psd-weight-threshold twice"); + } + if(!xtables_strtoui(optarg, NULL,&num,0,PSD_MAX_RATE)) { + xtables_error(PARAMETER_PROBLEM, "bad --psd-weight-threshold '%s'", optarg); + } + psdinfo->weight_threshold = num; + *flags |= XT_PSD_OPT_CTRESH; + return true; + + /* PSD-delay-threshold */ + case '2': + if(*flags & XT_PSD_OPT_DTRESH) { + xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-delay-threshold twice"); + } + if(!xtables_strtoui(optarg, NULL,&num,0,PSD_MAX_RATE)) { + xtables_error(PARAMETER_PROBLEM,"bad --psd-delay-threshold '%s'", optarg); + } + psdinfo->delay_threshold = num; + *flags |= XT_PSD_OPT_DTRESH; + return true; + + /* PSD-lo-ports-weight */ + case '3': + if(*flags & XT_PSD_OPT_LPWEIGHT) { + xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-lo-ports-weight twice"); + } + if(!xtables_strtoui(optarg, NULL,&num,0,PSD_MAX_RATE)) { + xtables_error(PARAMETER_PROBLEM,"bad --psd-lo-ports-weight '%s'", optarg); + } + psdinfo->lo_ports_weight = num; + *flags |= XT_PSD_OPT_LPWEIGHT; + return true; + + /* PSD-hi-ports-weight */ + case '4': + if(*flags & XT_PSD_OPT_HPWEIGHT) { + xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-hi-ports-weight twice"); + } + if(!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE)) { + xtables_error(PARAMETER_PROBLEM, "bad --psd-hi-ports-weight '%s'", optarg); + } + psdinfo->hi_ports_weight = num; + *flags |= XT_PSD_OPT_HPWEIGHT; + return true; + } + return false; +} + +/* Final check; nothing. */ +static void psd_mt_final_check(unsigned int flags) {} + +/* Prints out the targinfo. */ +static void psd_mt_print(const void *ip, const struct xt_entry_match *match, int numeric) +{ + const struct xt_psd_info *psdinfo = (const struct xt_psd_info *)match->data; + printf("psd "); + printf("weight-threshold: %u ", psdinfo->weight_threshold); + printf("delay-threshold: %u ", psdinfo->delay_threshold); + printf("lo-ports-weight: %u ", psdinfo->lo_ports_weight); + printf("hi-ports-weight: %u ", psdinfo->hi_ports_weight); +} + +/* Saves the union ipt_targinfo in parsable form to stdout. */ +static void psd_mt_save(const void *ip, const struct xt_entry_match *match) +{ + const struct xt_psd_info *psdinfo = (const struct xt_psd_info *)match->data; + printf("--psd-weight-threshold %u ", psdinfo->weight_threshold); + printf("--psd-delay-threshold %u ", psdinfo->delay_threshold); + printf("--psd-lo-ports-weight %u ", psdinfo->lo_ports_weight); + printf("--psd-hi-ports-weight %u ", psdinfo->hi_ports_weight); +} + +static struct xtables_match psd_mt_reg = { + .name = "psd", + .version = XTABLES_VERSION, + .revision = 1, + .family = PF_INET, + .size = XT_ALIGN(sizeof(struct xt_psd_info)), + .userspacesize = XT_ALIGN(sizeof(struct xt_psd_info)), + .help = psd_mt_help, + .init = psd_mt_init, + .parse = psd_mt_parse, + .final_check = psd_mt_final_check, + .print = psd_mt_print, + .save = psd_mt_save, + .extra_opts = psd_mt_opts, +}; + +static __attribute__((constructor)) void psd_mt_ldr(void) +{ + xtables_register_match(&psd_mt_reg); +} + diff --git a/extensions/libxt_psd.man b/extensions/libxt_psd.man new file mode 100644 index 0000000..b73fffc --- /dev/null +++ b/extensions/libxt_psd.man @@ -0,0 +1,18 @@ +Attempt to detect TCP and UDP port scans. This match was derived from +Solar Designer's scanlogd. +.TP +.BI "--psd-weight-threshold " "threshold" +Total weight of the latest TCP/UDP packets with different +destination ports coming from the same host to be treated as port +scan sequence. +.TP +.BI "--psd-delay-threshold " "delay" +Delay (in hundredths of second) for the packets with different +destination ports coming from the same host to be treated as +possible port scan subsequence. +.TP +.BI "--psd-lo-ports-weight " "weight" +Weight of the packet with privileged (<=1024) destination port. +.TP +.BI "--psd-hi-ports-weight " "weight" +Weight of the packet with non-priviliged destination port. diff --git a/extensions/xt_psd.Kconfig b/extensions/xt_psd.Kconfig new file mode 100644 index 0000000..d6254a5 --- /dev/null +++ b/extensions/xt_psd.Kconfig @@ -0,0 +1,6 @@ +config NETFILTER_XT_MATCH_PSD + tristate 'psd match support' + depends on NETFILTER_XTABLES && NETFILTER_ADVANCED + ---help--- + This option adds a `psd' match, which allows you to create rules in + any iptables table wich will detect TCP and UDP port scans. diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c new file mode 100644 index 0000000..fb48791 --- /dev/null +++ b/extensions/xt_psd.c @@ -0,0 +1,336 @@ +/* + This is a module which is used for PSD (portscan detection) + Derived from scanlogd v2.1 written by Solar Designer + and LOG target module. + + Copyright (C) 2000,2001 astaro AG + + This file is distributed under the terms of the GNU General Public + License (GPL). Copies of the GPL can be obtained from: + ftp://prep.ai.mit.edu/pub/gnu/GPL + + 2000-05-04 Markus Hennig : initial + 2000-08-18 Dennis Koslowski : first release + 2000-12-01 Dennis Koslowski : UDP scans detection added + 2001-01-02 Dennis Koslowski : output modified + 2001-02-04 Jan Rekorajski : converted from target to match + 2004-05-05 Martijn Lievaart : ported to 2.6 + 2007-04-05 Mohd Nawawi Mohamad Jamili : ported to 2.6.18 + 2008-03-21 Mohd Nawawi Mohamad Jamili : ported to 2.6.24 + 2009-08-07 Mohd Nawawi Mohamad Jamili : ported to xtables-addons +*/ + +#include +#include +#include +#include +#include +#include +#include +#include +#include "xt_psd.h" +#include "compat_xtables.h" + +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("Dennis Koslowski "); +MODULE_AUTHOR("Martijn Lievaart "); +MODULE_AUTHOR("Jan Rekorajski "); +MODULE_AUTHOR(" Mohd Nawawi Mohamad Jamili "); +MODULE_DESCRIPTION("Xtables: PSD - portscan detection"); +MODULE_ALIAS("ipt_psd"); + +#define HF_DADDR_CHANGING 0x01 +#define HF_SPORT_CHANGING 0x02 +#define HF_TOS_CHANGING 0x04 +#define HF_TTL_CHANGING 0x08 + +/* + * Information we keep per each target port + */ +struct port { + u_int16_t number; /* port number */ + u_int8_t proto; /* protocol number */ + u_int8_t and_flags; /* tcp ANDed flags */ + u_int8_t or_flags; /* tcp ORed flags */ +}; + +/* + * Information we keep per each source address. + */ +struct host { + struct host *next; /* Next entry with the same hash */ + clock_t timestamp; /* Last update time */ + struct in_addr src_addr; /* Source address */ + struct in_addr dest_addr; /* Destination address */ + unsigned short src_port; /* Source port */ + int count; /* Number of ports in the list */ + int weight; /* Total weight of ports in the list */ + struct port ports[SCAN_MAX_COUNT - 1]; /* List of ports */ + unsigned char tos; /* TOS */ + unsigned char ttl; /* TTL */ + unsigned char flags; /* HF_ flags bitmask */ +}; + +/* + * State information. + */ +static struct { + spinlock_t lock; + struct host list[LIST_SIZE]; /* List of source addresses */ + struct host *hash[HASH_SIZE]; /* Hash: pointers into the list */ + int index; /* Oldest entry to be replaced */ +} state; + +/* + * Convert an IP address into a hash table index. + */ +static inline int hashfunc(struct in_addr addr) +{ + unsigned int value; + int hash; + + value = addr.s_addr; + hash = 0; + do { + hash ^= value; + } while ((value >>= HASH_LOG)); + + return hash & (HASH_SIZE - 1); +} + +static bool +xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) +{ + struct iphdr *ip_hdr; + struct tcphdr *tcp_hdr; + struct in_addr addr; + u_int16_t src_port,dest_port; + u_int8_t tcp_flags, proto; + clock_t now; + struct host *curr, *last, **head; + int hash, index, count; + /* Parameters from userspace */ + const struct xt_psd_info *psdinfo = match->matchinfo; + + /* IP header */ + ip_hdr = (struct iphdr*) pskb->network_header; + + /* Sanity check */ + if (ntohs(ip_hdr->frag_off) & IP_OFFSET) { + pr_debug(KBUILD_MODNAME "sanity check failed\n"); + return false; + } + + /* TCP or UDP ? */ + proto = ip_hdr->protocol; + + if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) { + pr_debug(KBUILD_MODNAME "protocol not supported\n"); + return false; + } + + /* Get the source address, source & destination ports, and TCP flags */ + + addr.s_addr = ip_hdr->saddr; + + tcp_hdr = (struct tcphdr*)((u_int32_t *)ip_hdr + ip_hdr->ihl); + + /* Yep, itīs dirty */ + src_port = tcp_hdr->source; + dest_port = tcp_hdr->dest; + + if (proto == IPPROTO_TCP) { + tcp_flags = *((u_int8_t*)tcp_hdr + 13); + } + else { + tcp_flags = 0x00; + } + + /* We're using IP address 0.0.0.0 for a special purpose here, so don't let + * them spoof us. [DHCP needs this feature - HW] */ + if (!addr.s_addr) { + pr_debug(KBUILD_MODNAME "spoofed source address (0.0.0.0)\n"); + return false; + } + + /* Use jiffies here not to depend on someone setting the time while we're + * running; we need to be careful with possible return value overflows. */ + now = jiffies; + + spin_lock(&state.lock); + + /* Do we know this source address already? */ + count = 0; + last = NULL; + if ((curr = *(head = &state.hash[hash = hashfunc(addr)]))) + do { + if (curr->src_addr.s_addr == addr.s_addr) break; + count++; + if (curr->next) last = curr; + } while ((curr = curr->next)); + + if (curr) { + + /* We know this address, and the entry isn't too old. Update it. */ + if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 && + time_after_eq(now, curr->timestamp)) { + + /* Just update the appropriate list entry if we've seen this port already */ + for (index = 0; index < curr->count; index++) { + if (curr->ports[index].number == dest_port) { + curr->ports[index].proto = proto; + curr->ports[index].and_flags &= tcp_flags; + curr->ports[index].or_flags |= tcp_flags; + goto out_no_match; + } + } + + /* TCP/ACK and/or TCP/RST to a new port? This could be an outgoing connection. */ + if (proto == IPPROTO_TCP && (tcp_hdr->ack || tcp_hdr->rst)) + goto out_no_match; + + /* Packet to a new port, and not TCP/ACK: update the timestamp */ + curr->timestamp = now; + + /* Logged this scan already? Then drop the packet. */ + if (curr->weight >= psdinfo->weight_threshold) + goto out_match; + + /* Specify if destination address, source port, TOS or TTL are not fixed */ + if (curr->dest_addr.s_addr != ip_hdr->daddr) + curr->flags |= HF_DADDR_CHANGING; + if (curr->src_port != src_port) + curr->flags |= HF_SPORT_CHANGING; + if (curr->tos != ip_hdr->tos) + curr->flags |= HF_TOS_CHANGING; + if (curr->ttl != ip_hdr->ttl) + curr->flags |= HF_TTL_CHANGING; + + /* Update the total weight */ + curr->weight += (ntohs(dest_port) < 1024) ? + psdinfo->lo_ports_weight : psdinfo->hi_ports_weight; + + /* Got enough destination ports to decide that this is a scan? */ + /* Then log it and drop the packet. */ + if (curr->weight >= psdinfo->weight_threshold) + goto out_match; + + /* Remember the new port */ + if (curr->count < SCAN_MAX_COUNT) { + curr->ports[curr->count].number = dest_port; + curr->ports[curr->count].proto = proto; + curr->ports[curr->count].and_flags = tcp_flags; + curr->ports[curr->count].or_flags = tcp_flags; + curr->count++; + } + + goto out_no_match; + } + + /* We know this address, but the entry is outdated. Mark it unused, and + * remove from the hash table. We'll allocate a new entry instead since + * this one might get re-used too soon. */ + curr->src_addr.s_addr = 0; + if (last) + last->next = last->next->next; + else if (*head) + *head = (*head)->next; + last = NULL; + } + + /* We don't need an ACK from a new source address */ + if (proto == IPPROTO_TCP && tcp_hdr->ack) + goto out_no_match; + + /* Got too many source addresses with the same hash value? Then remove the + * oldest one from the hash table, so that they can't take too much of our + * CPU time even with carefully chosen spoofed IP addresses. */ + if (count >= HASH_MAX && last) last->next = NULL; + + /* We're going to re-use the oldest list entry, so remove it from the hash + * table first (if it is really already in use, and isn't removed from the + * hash table already because of the HASH_MAX check above). */ + + /* First, find it */ + if (state.list[state.index].src_addr.s_addr) + head = &state.hash[hashfunc(state.list[state.index].src_addr)]; + else + head = &last; + last = NULL; + if ((curr = *head)) + do { + if (curr == &state.list[state.index]) break; + last = curr; + } while ((curr = curr->next)); + + /* Then, remove it */ + if (curr) { + if (last) + last->next = last->next->next; + else if (*head) + *head = (*head)->next; + } + + /* Get our list entry */ + curr = &state.list[state.index++]; + if (state.index >= LIST_SIZE) state.index = 0; + + /* Link it into the hash table */ + head = &state.hash[hash]; + curr->next = *head; + *head = curr; + + /* And fill in the fields */ + curr->timestamp = now; + curr->src_addr = addr; + curr->dest_addr.s_addr = ip_hdr->daddr; + curr->src_port = src_port; + curr->count = 1; + curr->weight = (ntohs(dest_port) < 1024) ? psdinfo->lo_ports_weight : psdinfo->hi_ports_weight; + curr->ports[0].number = dest_port; + curr->ports[0].proto = proto; + curr->ports[0].and_flags = tcp_flags; + curr->ports[0].or_flags = tcp_flags; + curr->tos = ip_hdr->tos; + curr->ttl = ip_hdr->ttl; + +out_no_match: + spin_unlock(&state.lock); + return false; + +out_match: + spin_unlock(&state.lock); + return true; +} + +static bool xt_psd_checkentry(const struct xt_mtchk_param *par) { + return true; +} + +static struct xt_match xt_psd_reg = { + .name = "psd", + .family = AF_INET, + .revision = 9, + .match = xt_psd_match, + .matchsize = sizeof(struct xt_psd_info), + .checkentry = xt_psd_checkentry, + .me = THIS_MODULE +}; + +static int __init xt_psd_init(void) +{ + if(xt_register_match(&xt_psd_reg)) { + memset(&state, 0, sizeof(state)); + } + spin_lock_init(&(state.lock)); + return 0; +} + +static void __exit xt_psd_exit(void) +{ + xt_unregister_match(&xt_psd_reg); +} + +module_init(xt_psd_init); +module_exit(xt_psd_exit); + diff --git a/extensions/xt_psd.h b/extensions/xt_psd.h new file mode 100644 index 0000000..8847408 --- /dev/null +++ b/extensions/xt_psd.h @@ -0,0 +1,41 @@ +#ifndef _LINUX_NETFILTER_XT_PSD_H +#define _LINUX_NETFILTER_XT_PSD_H 1 + +#include +#include + +/* + * High port numbers have a lower weight to reduce the frequency of false + * positives, such as from passive mode FTP transfers. + */ +#define PORT_WEIGHT_PRIV 3 +#define PORT_WEIGHT_HIGH 1 +#define PSD_MAX_RATE 10000 + +/* + * Port scan detection thresholds: at least COUNT ports need to be scanned + * from the same source, with no longer than DELAY ticks between ports. + */ +#define SCAN_MIN_COUNT 7 +#define SCAN_MAX_COUNT (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV) +#define SCAN_WEIGHT_THRESHOLD SCAN_MAX_COUNT +#define SCAN_DELAY_THRESHOLD (300) /* old usage of HZ here was erroneously and broke under uml */ + +/* + * Keep track of up to LIST_SIZE source addresses, using a hash table of + * HASH_SIZE entries for faster lookups, but limiting hash collisions to + * HASH_MAX source addresses per the same hash value. + */ +#define LIST_SIZE 0x100 +#define HASH_LOG 9 +#define HASH_SIZE (1 << HASH_LOG) +#define HASH_MAX 0x10 + +struct xt_psd_info { + unsigned int weight_threshold; + unsigned int delay_threshold; + unsigned short lo_ports_weight; + unsigned short hi_ports_weight; +}; + +#endif /*_LINUX_NETFILTER_XT_PSD_H*/ diff --git a/mconfig.psd b/mconfig.psd new file mode 100644 index 0000000..a01f5ea --- /dev/null +++ b/mconfig.psd @@ -0,0 +1,2 @@ +# -*- Makefile -*- +build_psd=m From 579484ed7025fcd773c544a5ec1bedeab6c1ab1a Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 13 Aug 2009 00:38:39 +0200 Subject: [PATCH 02/24] psd: avoid shadowing of function ip_hdr and tcp_hdr are actually functions. Because we need them means they must not be shadowed by variables. --- extensions/xt_psd.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c index fb48791..ab21363 100644 --- a/extensions/xt_psd.c +++ b/extensions/xt_psd.c @@ -101,8 +101,8 @@ static inline int hashfunc(struct in_addr addr) static bool xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) { - struct iphdr *ip_hdr; - struct tcphdr *tcp_hdr; + struct iphdr *iph; + struct tcphdr *tcph; struct in_addr addr; u_int16_t src_port,dest_port; u_int8_t tcp_flags, proto; @@ -113,16 +113,16 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) const struct xt_psd_info *psdinfo = match->matchinfo; /* IP header */ - ip_hdr = (struct iphdr*) pskb->network_header; + iph = (struct iphdr*) pskb->network_header; /* Sanity check */ - if (ntohs(ip_hdr->frag_off) & IP_OFFSET) { + if (ntohs(iph->frag_off) & IP_OFFSET) { pr_debug(KBUILD_MODNAME "sanity check failed\n"); return false; } /* TCP or UDP ? */ - proto = ip_hdr->protocol; + proto = iph->protocol; if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) { pr_debug(KBUILD_MODNAME "protocol not supported\n"); @@ -131,16 +131,16 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) /* Get the source address, source & destination ports, and TCP flags */ - addr.s_addr = ip_hdr->saddr; + addr.s_addr = iph->saddr; - tcp_hdr = (struct tcphdr*)((u_int32_t *)ip_hdr + ip_hdr->ihl); + tcph = (struct tcphdr*)((u_int32_t *)iph + iph->ihl); /* Yep, itīs dirty */ - src_port = tcp_hdr->source; - dest_port = tcp_hdr->dest; + src_port = tcph->source; + dest_port = tcph->dest; if (proto == IPPROTO_TCP) { - tcp_flags = *((u_int8_t*)tcp_hdr + 13); + tcp_flags = *((u_int8_t*)tcph + 13); } else { tcp_flags = 0x00; @@ -186,7 +186,7 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) } /* TCP/ACK and/or TCP/RST to a new port? This could be an outgoing connection. */ - if (proto == IPPROTO_TCP && (tcp_hdr->ack || tcp_hdr->rst)) + if (proto == IPPROTO_TCP && (tcph->ack || tcph->rst)) goto out_no_match; /* Packet to a new port, and not TCP/ACK: update the timestamp */ @@ -197,13 +197,13 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) goto out_match; /* Specify if destination address, source port, TOS or TTL are not fixed */ - if (curr->dest_addr.s_addr != ip_hdr->daddr) + if (curr->dest_addr.s_addr != iph->daddr) curr->flags |= HF_DADDR_CHANGING; if (curr->src_port != src_port) curr->flags |= HF_SPORT_CHANGING; - if (curr->tos != ip_hdr->tos) + if (curr->tos != iph->tos) curr->flags |= HF_TOS_CHANGING; - if (curr->ttl != ip_hdr->ttl) + if (curr->ttl != iph->ttl) curr->flags |= HF_TTL_CHANGING; /* Update the total weight */ @@ -239,7 +239,7 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) } /* We don't need an ACK from a new source address */ - if (proto == IPPROTO_TCP && tcp_hdr->ack) + if (proto == IPPROTO_TCP && tcph->ack) goto out_no_match; /* Got too many source addresses with the same hash value? Then remove the @@ -283,7 +283,7 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) /* And fill in the fields */ curr->timestamp = now; curr->src_addr = addr; - curr->dest_addr.s_addr = ip_hdr->daddr; + curr->dest_addr.s_addr = iph->daddr; curr->src_port = src_port; curr->count = 1; curr->weight = (ntohs(dest_port) < 1024) ? psdinfo->lo_ports_weight : psdinfo->hi_ports_weight; @@ -291,8 +291,8 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) curr->ports[0].proto = proto; curr->ports[0].and_flags = tcp_flags; curr->ports[0].or_flags = tcp_flags; - curr->tos = ip_hdr->tos; - curr->ttl = ip_hdr->ttl; + curr->tos = iph->tos; + curr->ttl = iph->ttl; out_no_match: spin_unlock(&state.lock); From 1e5315d33864331a69fe98345582dffc4c0e60d2 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 13 Aug 2009 00:42:01 +0200 Subject: [PATCH 03/24] psd: replace open-coded access by skb handling functions pskb->network_header would not even compile under older kernels. This also fixes the compile warning: xt_psd.c:116:18: warning: cast to pointer from integer of different size --- extensions/xt_psd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c index ab21363..750fad6 100644 --- a/extensions/xt_psd.c +++ b/extensions/xt_psd.c @@ -113,7 +113,7 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) const struct xt_psd_info *psdinfo = match->matchinfo; /* IP header */ - iph = (struct iphdr*) pskb->network_header; + iph = ip_hdr(pskb); /* Sanity check */ if (ntohs(iph->frag_off) & IP_OFFSET) { @@ -133,7 +133,7 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) addr.s_addr = iph->saddr; - tcph = (struct tcphdr*)((u_int32_t *)iph + iph->ihl); + tcph = (void *)iph + ip_hdrlen(pskb); /* Yep, itīs dirty */ src_port = tcph->source; From 10bd08d0f3f2770f1da62d54d01b898c85c51bd9 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 13 Aug 2009 00:44:39 +0200 Subject: [PATCH 04/24] psd: remove empty checkentry function --- extensions/xt_psd.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c index 750fad6..cadebdc 100644 --- a/extensions/xt_psd.c +++ b/extensions/xt_psd.c @@ -303,17 +303,12 @@ out_match: return true; } -static bool xt_psd_checkentry(const struct xt_mtchk_param *par) { - return true; -} - static struct xt_match xt_psd_reg = { .name = "psd", .family = AF_INET, .revision = 9, .match = xt_psd_match, .matchsize = sizeof(struct xt_psd_info), - .checkentry = xt_psd_checkentry, .me = THIS_MODULE }; From a7ceccc0f408e0f63ce4125bcf6a928545938744 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 13 Aug 2009 00:45:52 +0200 Subject: [PATCH 05/24] psd: bss is always zero-initialized --- extensions/xt_psd.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c index cadebdc..bb5d012 100644 --- a/extensions/xt_psd.c +++ b/extensions/xt_psd.c @@ -314,9 +314,7 @@ static struct xt_match xt_psd_reg = { static int __init xt_psd_init(void) { - if(xt_register_match(&xt_psd_reg)) { - memset(&state, 0, sizeof(state)); - } + xt_register_match(&xt_psd_reg); spin_lock_init(&(state.lock)); return 0; } From 502c1c05aa4ef0890f2522dcb38a636c16dd5b67 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 13 Aug 2009 00:46:33 +0200 Subject: [PATCH 06/24] psd: return correct status from init --- extensions/xt_psd.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c index bb5d012..ca22972 100644 --- a/extensions/xt_psd.c +++ b/extensions/xt_psd.c @@ -314,9 +314,8 @@ static struct xt_match xt_psd_reg = { static int __init xt_psd_init(void) { - xt_register_match(&xt_psd_reg); spin_lock_init(&(state.lock)); - return 0; + return xt_register_match(&xt_psd_reg); } static void __exit xt_psd_exit(void) From 760edd3db61f751c0e8bfb2cad06ffd27616336e Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 13 Aug 2009 00:52:46 +0200 Subject: [PATCH 07/24] psd: use fixated types in info struct --- extensions/xt_psd.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/extensions/xt_psd.h b/extensions/xt_psd.h index 8847408..ac65687 100644 --- a/extensions/xt_psd.h +++ b/extensions/xt_psd.h @@ -32,10 +32,10 @@ #define HASH_MAX 0x10 struct xt_psd_info { - unsigned int weight_threshold; - unsigned int delay_threshold; - unsigned short lo_ports_weight; - unsigned short hi_ports_weight; + __u32 weight_threshold; + __u32 delay_threshold; + __u16 lo_ports_weight; + __u16 hi_ports_weight; }; #endif /*_LINUX_NETFILTER_XT_PSD_H*/ From 8e5219636ad9ffc3b0c6a5df32122cdf9cd653e7 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 13 Aug 2009 01:04:26 +0200 Subject: [PATCH 08/24] psd: tag match reg struct as __read_mostly --- extensions/xt_psd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c index ca22972..7dee714 100644 --- a/extensions/xt_psd.c +++ b/extensions/xt_psd.c @@ -135,7 +135,7 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) tcph = (void *)iph + ip_hdrlen(pskb); - /* Yep, itīs dirty */ + /* Yep, it's dirty */ src_port = tcph->source; dest_port = tcph->dest; @@ -303,7 +303,7 @@ out_match: return true; } -static struct xt_match xt_psd_reg = { +static struct xt_match xt_psd_reg __read_mostly = { .name = "psd", .family = AF_INET, .revision = 9, From 380b1b6997f5ad3bc5e9e5b1520e40440c0a138b Mon Sep 17 00:00:00 2001 From: Mohd Nawawi Mohamad Jamili Date: Thu, 13 Aug 2009 17:36:42 +0800 Subject: [PATCH 09/24] psd: fix revision mismatch --- extensions/xt_psd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c index 7dee714..ff79aa7 100644 --- a/extensions/xt_psd.c +++ b/extensions/xt_psd.c @@ -306,7 +306,7 @@ out_match: static struct xt_match xt_psd_reg __read_mostly = { .name = "psd", .family = AF_INET, - .revision = 9, + .revision = 1, .match = xt_psd_match, .matchsize = sizeof(struct xt_psd_info), .me = THIS_MODULE From cebadbfcd7971d4a404cb27d4d86d66c12c52a65 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Fri, 14 Aug 2009 20:12:43 +0200 Subject: [PATCH 10/24] psd: merge into main configuration files When psd is included in the main tree, it can use the main configuration files. --- extensions/Kbuild | 1 + extensions/Kbuild.psd | 1 - extensions/Mbuild | 1 + extensions/Mbuild.psd | 1 - mconfig | 1 + mconfig.psd | 2 -- 6 files changed, 3 insertions(+), 4 deletions(-) delete mode 100644 extensions/Kbuild.psd delete mode 100644 extensions/Mbuild.psd delete mode 100644 mconfig.psd diff --git a/extensions/Kbuild b/extensions/Kbuild index 64c7d35..4b8dcb2 100644 --- a/extensions/Kbuild +++ b/extensions/Kbuild @@ -25,6 +25,7 @@ obj-${build_ipset} += ipset/ obj-${build_ipv4options} += xt_ipv4options.o obj-${build_length2} += xt_length2.o obj-${build_lscan} += xt_lscan.o +obj-${build_psd} += xt_psd.o obj-${build_quota2} += xt_quota2.o -include ${M}/*.Kbuild diff --git a/extensions/Kbuild.psd b/extensions/Kbuild.psd deleted file mode 100644 index 9fd0305..0000000 --- a/extensions/Kbuild.psd +++ /dev/null @@ -1 +0,0 @@ -obj-${build_psd} += xt_psd.o diff --git a/extensions/Mbuild b/extensions/Mbuild index 0a24854..c6baa17 100644 --- a/extensions/Mbuild +++ b/extensions/Mbuild @@ -18,4 +18,5 @@ obj-${build_ipset} += ipset/ obj-${build_ipv4options} += libxt_ipv4options.so obj-${build_length2} += libxt_length2.so obj-${build_lscan} += libxt_lscan.so +obj-${build_psd} += libxt_psd.so obj-${build_quota2} += libxt_quota2.so diff --git a/extensions/Mbuild.psd b/extensions/Mbuild.psd deleted file mode 100644 index 5a1ae3b..0000000 --- a/extensions/Mbuild.psd +++ /dev/null @@ -1 +0,0 @@ -obj-${build_psd} += libxt_psd.so diff --git a/mconfig b/mconfig index 47761a8..6337155 100644 --- a/mconfig +++ b/mconfig @@ -20,4 +20,5 @@ build_ipset=m build_ipv4options=m build_length2=m build_lscan=m +build_psd=m build_quota2=m diff --git a/mconfig.psd b/mconfig.psd deleted file mode 100644 index a01f5ea..0000000 --- a/mconfig.psd +++ /dev/null @@ -1,2 +0,0 @@ -# -*- Makefile -*- -build_psd=m From 0887365f8b0d41b8aee172510b65bc27639c708f Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Fri, 14 Aug 2009 20:15:00 +0200 Subject: [PATCH 11/24] psd: remove whitespace at EOL --- extensions/libxt_psd.c | 20 ++++++++++---------- extensions/xt_psd.c | 2 +- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/extensions/libxt_psd.c b/extensions/libxt_psd.c index 9d7629b..99ee99b 100644 --- a/extensions/libxt_psd.c +++ b/extensions/libxt_psd.c @@ -1,6 +1,6 @@ -/* - Shared library add-on to iptables to add PSD support - +/* + Shared library add-on to iptables to add PSD support + Copyright (C) 2000,2001 astaro AG This file is distributed under the terms of the GNU General Public @@ -50,7 +50,7 @@ static const struct option psd_mt_opts[] = { /* Initialize the target. */ static void psd_mt_init(struct xt_entry_match *match) { struct xt_psd_info *psdinfo = (struct xt_psd_info *)match->data; - psdinfo->weight_threshold = SCAN_WEIGHT_THRESHOLD; + psdinfo->weight_threshold = SCAN_WEIGHT_THRESHOLD; psdinfo->delay_threshold = SCAN_DELAY_THRESHOLD; psdinfo->lo_ports_weight = PORT_WEIGHT_PRIV; psdinfo->hi_ports_weight = PORT_WEIGHT_HIGH; @@ -60,13 +60,13 @@ static void psd_mt_init(struct xt_entry_match *match) { #define XT_PSD_OPT_DTRESH 0x02 #define XT_PSD_OPT_LPWEIGHT 0x04 #define XT_PSD_OPT_HPWEIGHT 0x08 - + static int psd_mt_parse(int c, char **argv, int invert, unsigned int *flags, - const void *entry, struct xt_entry_match **match) + const void *entry, struct xt_entry_match **match) { struct xt_psd_info *psdinfo = (struct xt_psd_info *)(*match)->data; unsigned int num; - + switch (c) { /* PSD-weight-threshold */ case '1': @@ -134,7 +134,7 @@ static void psd_mt_print(const void *ip, const struct xt_entry_match *match, int } /* Saves the union ipt_targinfo in parsable form to stdout. */ -static void psd_mt_save(const void *ip, const struct xt_entry_match *match) +static void psd_mt_save(const void *ip, const struct xt_entry_match *match) { const struct xt_psd_info *psdinfo = (const struct xt_psd_info *)match->data; printf("--psd-weight-threshold %u ", psdinfo->weight_threshold); @@ -143,7 +143,7 @@ static void psd_mt_save(const void *ip, const struct xt_entry_match *match) printf("--psd-hi-ports-weight %u ", psdinfo->hi_ports_weight); } -static struct xtables_match psd_mt_reg = { +static struct xtables_match psd_mt_reg = { .name = "psd", .version = XTABLES_VERSION, .revision = 1, @@ -163,4 +163,4 @@ static __attribute__((constructor)) void psd_mt_ldr(void) { xtables_register_match(&psd_mt_reg); } - + diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c index ff79aa7..32e41b3 100644 --- a/extensions/xt_psd.c +++ b/extensions/xt_psd.c @@ -309,7 +309,7 @@ static struct xt_match xt_psd_reg __read_mostly = { .revision = 1, .match = xt_psd_match, .matchsize = sizeof(struct xt_psd_info), - .me = THIS_MODULE + .me = THIS_MODULE, }; static int __init xt_psd_init(void) From 6b175b40cb14ba898fdbc3d6f6c0a4079b04908c Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Fri, 14 Aug 2009 20:19:13 +0200 Subject: [PATCH 12/24] psd: jiffies is an unsigned long, fix compiler warning "jiffies" has always been unsigned long, not clock_t. xt_psd.c:176:7: warning: comparison of distinct pointer types lacks a cast --- extensions/xt_psd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c index 32e41b3..404bb48 100644 --- a/extensions/xt_psd.c +++ b/extensions/xt_psd.c @@ -59,7 +59,7 @@ struct port { */ struct host { struct host *next; /* Next entry with the same hash */ - clock_t timestamp; /* Last update time */ + unsigned long timestamp; /* Last update time */ struct in_addr src_addr; /* Source address */ struct in_addr dest_addr; /* Destination address */ unsigned short src_port; /* Source port */ @@ -106,7 +106,7 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) struct in_addr addr; u_int16_t src_port,dest_port; u_int8_t tcp_flags, proto; - clock_t now; + unsigned long now; struct host *curr, *last, **head; int hash, index, count; /* Parameters from userspace */ From 5b07e046004f3e3931bd9e176cf18999efaa4bb5 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Fri, 14 Aug 2009 20:24:36 +0200 Subject: [PATCH 13/24] psd: style: break double statements --- extensions/xt_psd.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c index 404bb48..2da6b0c 100644 --- a/extensions/xt_psd.c +++ b/extensions/xt_psd.c @@ -164,9 +164,11 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) last = NULL; if ((curr = *(head = &state.hash[hash = hashfunc(addr)]))) do { - if (curr->src_addr.s_addr == addr.s_addr) break; + if (curr->src_addr.s_addr == addr.s_addr) + break; count++; - if (curr->next) last = curr; + if (curr->next) + last = curr; } while ((curr = curr->next)); if (curr) { @@ -245,7 +247,8 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) /* Got too many source addresses with the same hash value? Then remove the * oldest one from the hash table, so that they can't take too much of our * CPU time even with carefully chosen spoofed IP addresses. */ - if (count >= HASH_MAX && last) last->next = NULL; + if (count >= HASH_MAX && last) + last->next = NULL; /* We're going to re-use the oldest list entry, so remove it from the hash * table first (if it is really already in use, and isn't removed from the @@ -258,10 +261,11 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) head = &last; last = NULL; if ((curr = *head)) - do { - if (curr == &state.list[state.index]) break; - last = curr; - } while ((curr = curr->next)); + do { + if (curr == &state.list[state.index]) + break; + last = curr; + } while ((curr = curr->next)); /* Then, remove it */ if (curr) { @@ -273,7 +277,8 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) /* Get our list entry */ curr = &state.list[state.index++]; - if (state.index >= LIST_SIZE) state.index = 0; + if (state.index >= LIST_SIZE) + state.index = 0; /* Link it into the hash table */ head = &state.hash[hash]; From 65a257a67d51fd796aee0a0f9676614979e39024 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Fri, 14 Aug 2009 20:26:37 +0200 Subject: [PATCH 14/24] psd: style: add explicit comparisons where not used in bool context --- extensions/xt_psd.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c index 2da6b0c..dc61cf6 100644 --- a/extensions/xt_psd.c +++ b/extensions/xt_psd.c @@ -93,7 +93,7 @@ static inline int hashfunc(struct in_addr addr) hash = 0; do { hash ^= value; - } while ((value >>= HASH_LOG)); + } while ((value >>= HASH_LOG) != 0); return hash & (HASH_SIZE - 1); } @@ -148,7 +148,7 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) /* We're using IP address 0.0.0.0 for a special purpose here, so don't let * them spoof us. [DHCP needs this feature - HW] */ - if (!addr.s_addr) { + if (addr.s_addr == 0) { pr_debug(KBUILD_MODNAME "spoofed source address (0.0.0.0)\n"); return false; } @@ -162,16 +162,16 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) /* Do we know this source address already? */ count = 0; last = NULL; - if ((curr = *(head = &state.hash[hash = hashfunc(addr)]))) + if ((curr = *(head = &state.hash[hash = hashfunc(addr)])) != NULL) do { if (curr->src_addr.s_addr == addr.s_addr) break; count++; - if (curr->next) + if (curr->next != NULL) last = curr; - } while ((curr = curr->next)); + } while ((curr = curr->next) != NULL); - if (curr) { + if (curr != NULL) { /* We know this address, and the entry isn't too old. Update it. */ if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 && @@ -233,9 +233,9 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) * remove from the hash table. We'll allocate a new entry instead since * this one might get re-used too soon. */ curr->src_addr.s_addr = 0; - if (last) + if (last != NULL) last->next = last->next->next; - else if (*head) + else if (*head != NULL) *head = (*head)->next; last = NULL; } @@ -247,7 +247,7 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) /* Got too many source addresses with the same hash value? Then remove the * oldest one from the hash table, so that they can't take too much of our * CPU time even with carefully chosen spoofed IP addresses. */ - if (count >= HASH_MAX && last) + if (count >= HASH_MAX && last != NULL) last->next = NULL; /* We're going to re-use the oldest list entry, so remove it from the hash @@ -255,23 +255,23 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) * hash table already because of the HASH_MAX check above). */ /* First, find it */ - if (state.list[state.index].src_addr.s_addr) + if (state.list[state.index].src_addr.s_addr != 0) head = &state.hash[hashfunc(state.list[state.index].src_addr)]; else head = &last; last = NULL; - if ((curr = *head)) + if ((curr = *head) != NULL) do { if (curr == &state.list[state.index]) break; last = curr; - } while ((curr = curr->next)); + } while ((curr = curr->next) != NULL); /* Then, remove it */ - if (curr) { - if (last) + if (curr != NULL) { + if (last != NULL) last->next = last->next->next; - else if (*head) + else if (*head != NULL) *head = (*head)->next; } From efd4c91557440132fb4fec6fb246a8fe907f91c8 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Sun, 16 Aug 2009 12:40:44 +0200 Subject: [PATCH 15/24] psd: style: remove braces for single statements in ifs --- extensions/libxt_psd.c | 32 ++++++++++++-------------------- extensions/xt_psd.c | 6 ++---- 2 files changed, 14 insertions(+), 24 deletions(-) diff --git a/extensions/libxt_psd.c b/extensions/libxt_psd.c index 99ee99b..88510d0 100644 --- a/extensions/libxt_psd.c +++ b/extensions/libxt_psd.c @@ -70,53 +70,45 @@ static int psd_mt_parse(int c, char **argv, int invert, unsigned int *flags, switch (c) { /* PSD-weight-threshold */ case '1': - if(*flags & XT_PSD_OPT_CTRESH) { + if (*flags & XT_PSD_OPT_CTRESH) xtables_error(PARAMETER_PROBLEM,"Can't specify --psd-weight-threshold twice"); - } - if(!xtables_strtoui(optarg, NULL,&num,0,PSD_MAX_RATE)) { + if (!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE)) xtables_error(PARAMETER_PROBLEM, "bad --psd-weight-threshold '%s'", optarg); - } psdinfo->weight_threshold = num; *flags |= XT_PSD_OPT_CTRESH; return true; /* PSD-delay-threshold */ case '2': - if(*flags & XT_PSD_OPT_DTRESH) { + if (*flags & XT_PSD_OPT_DTRESH) xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-delay-threshold twice"); - } - if(!xtables_strtoui(optarg, NULL,&num,0,PSD_MAX_RATE)) { - xtables_error(PARAMETER_PROBLEM,"bad --psd-delay-threshold '%s'", optarg); - } + if (!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE)) + xtables_error(PARAMETER_PROBLEM, "bad --psd-delay-threshold '%s'", optarg); psdinfo->delay_threshold = num; *flags |= XT_PSD_OPT_DTRESH; return true; /* PSD-lo-ports-weight */ case '3': - if(*flags & XT_PSD_OPT_LPWEIGHT) { + if (*flags & XT_PSD_OPT_LPWEIGHT) xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-lo-ports-weight twice"); - } - if(!xtables_strtoui(optarg, NULL,&num,0,PSD_MAX_RATE)) { - xtables_error(PARAMETER_PROBLEM,"bad --psd-lo-ports-weight '%s'", optarg); - } + if (!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE)) + xtables_error(PARAMETER_PROBLEM, "bad --psd-lo-ports-weight '%s'", optarg); psdinfo->lo_ports_weight = num; *flags |= XT_PSD_OPT_LPWEIGHT; return true; /* PSD-hi-ports-weight */ case '4': - if(*flags & XT_PSD_OPT_HPWEIGHT) { + if (*flags & XT_PSD_OPT_HPWEIGHT) xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-hi-ports-weight twice"); - } - if(!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE)) { + if (!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE)) xtables_error(PARAMETER_PROBLEM, "bad --psd-hi-ports-weight '%s'", optarg); - } psdinfo->hi_ports_weight = num; *flags |= XT_PSD_OPT_HPWEIGHT; return true; - } - return false; + } + return false; } /* Final check; nothing. */ diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c index dc61cf6..49a6118 100644 --- a/extensions/xt_psd.c +++ b/extensions/xt_psd.c @@ -139,12 +139,10 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) src_port = tcph->source; dest_port = tcph->dest; - if (proto == IPPROTO_TCP) { + if (proto == IPPROTO_TCP) tcp_flags = *((u_int8_t*)tcph + 13); - } - else { + else tcp_flags = 0x00; - } /* We're using IP address 0.0.0.0 for a special purpose here, so don't let * them spoof us. [DHCP needs this feature - HW] */ From 83e474f9ab18a3b765465d99ab9aeb0bf4310e3d Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Fri, 28 Aug 2009 12:32:23 +0200 Subject: [PATCH 16/24] psd: move pr_ prefix into pr_fmt --- extensions/xt_psd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c index 49a6118..f12e5cf 100644 --- a/extensions/xt_psd.c +++ b/extensions/xt_psd.c @@ -20,6 +20,7 @@ 2009-08-07 Mohd Nawawi Mohamad Jamili : ported to xtables-addons */ +#define pr_fmt(x) KBUILD_MODNAME ": " x #include #include #include @@ -117,7 +118,7 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) /* Sanity check */ if (ntohs(iph->frag_off) & IP_OFFSET) { - pr_debug(KBUILD_MODNAME "sanity check failed\n"); + pr_debug("sanity check failed\n"); return false; } @@ -125,7 +126,7 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) proto = iph->protocol; if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) { - pr_debug(KBUILD_MODNAME "protocol not supported\n"); + pr_debug("protocol not supported\n"); return false; } @@ -147,7 +148,7 @@ xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) /* We're using IP address 0.0.0.0 for a special purpose here, so don't let * them spoof us. [DHCP needs this feature - HW] */ if (addr.s_addr == 0) { - pr_debug(KBUILD_MODNAME "spoofed source address (0.0.0.0)\n"); + pr_debug("spoofed source address (0.0.0.0)\n"); return false; } From 3e26335cbdd1b15cb0a23485b8ef8bcb9fe735a3 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Fri, 21 Aug 2009 16:03:50 +0200 Subject: [PATCH 17/24] ipset: fast forward to v3.2 --- doc/changelog.txt | 1 + extensions/ipset/ip_set.c | 16 +++++++++++++--- extensions/ipset/ip_set_iptreemap.c | 4 ++-- extensions/ipset/ip_set_malloc.h | 4 ++-- extensions/ipset/ip_set_setlist.c | 12 +++++------- extensions/ipset/ipset.8 | 3 +++ extensions/ipset/ipset.c | 2 +- 7 files changed, 27 insertions(+), 15 deletions(-) diff --git a/doc/changelog.txt b/doc/changelog.txt index a2a3545..7dc2ab8 100644 --- a/doc/changelog.txt +++ b/doc/changelog.txt @@ -1,6 +1,7 @@ - build: support for Linux 2.6.31-rc1 +- ipset: fast forward to v3.2 - quota2: support anonymous counters - quota2: reduce memory footprint for anonymous counters - quota2: extend locked period during cleanup (locking bugfix) diff --git a/extensions/ipset/ip_set.c b/extensions/ipset/ip_set.c index 90c7f8d..8ea57fc 100644 --- a/extensions/ipset/ip_set.c +++ b/extensions/ipset/ip_set.c @@ -1373,7 +1373,7 @@ static int ip_set_restore(void *data, while (members_size + set->type->reqsize <= set_restore->members_size) { line++; - DP("members: %d, line %d", members_size, line); + DP("members: %d, line %d", members_size, line); res = __ip_set_addip(index, data + used + members_size, set->type->reqsize); @@ -1911,13 +1911,23 @@ ip_set_sockfn_get(struct sock *sk, int optval, void *user, int *len) res = -ENOENT; goto done; } + +#define SETLIST(set) (strcmp(set->type->typename, "setlist") == 0) + used = 0; if (index == IP_SET_INVALID_ID) { - /* Save all sets */ + /* Save all sets: ugly setlist type dependency */ + int setlist = 0; + setlists: for (i = 0; i < ip_set_max && res == 0; i++) { - if (ip_set_list[i] != NULL) + if (ip_set_list[i] != NULL + && !(setlist ^ SETLIST(ip_set_list[i]))) res = ip_set_save_set(i, data, &used, *len); } + if (!setlist) { + setlist = 1; + goto setlists; + } } else { /* Save an individual set */ res = ip_set_save_set(index, data, &used, *len); diff --git a/extensions/ipset/ip_set_iptreemap.c b/extensions/ipset/ip_set_iptreemap.c index f1fec0c..00f3357 100644 --- a/extensions/ipset/ip_set_iptreemap.c +++ b/extensions/ipset/ip_set_iptreemap.c @@ -338,7 +338,7 @@ KADT(iptreemap, add, ipaddr, ip) static inline int __delip_single(struct ip_set *set, ip_set_ip_t *hash_ip, - ip_set_ip_t ip, unsigned int __nocast flags) + ip_set_ip_t ip, gfp_t flags) { struct ip_set_iptreemap *map = set->data; struct ip_set_iptreemap_b *btree; @@ -364,7 +364,7 @@ __delip_single(struct ip_set *set, ip_set_ip_t *hash_ip, static inline int iptreemap_del(struct ip_set *set, ip_set_ip_t *hash_ip, - ip_set_ip_t start, ip_set_ip_t end, unsigned int __nocast flags) + ip_set_ip_t start, ip_set_ip_t end, gfp_t flags) { struct ip_set_iptreemap *map = set->data; struct ip_set_iptreemap_b *btree; diff --git a/extensions/ipset/ip_set_malloc.h b/extensions/ipset/ip_set_malloc.h index 8bce667..2a80443 100644 --- a/extensions/ipset/ip_set_malloc.h +++ b/extensions/ipset/ip_set_malloc.h @@ -40,7 +40,7 @@ struct harray { }; static inline void * -__harray_malloc(size_t hashsize, size_t typesize, int flags) +__harray_malloc(size_t hashsize, size_t typesize, gfp_t flags) { struct harray *harray; size_t max_elements, size, i, j; @@ -88,7 +88,7 @@ __harray_malloc(size_t hashsize, size_t typesize, int flags) } static inline void * -harray_malloc(size_t hashsize, size_t typesize, int flags) +harray_malloc(size_t hashsize, size_t typesize, gfp_t flags) { void *harray; diff --git a/extensions/ipset/ip_set_setlist.c b/extensions/ipset/ip_set_setlist.c index d4945f1..ba743b7 100644 --- a/extensions/ipset/ip_set_setlist.c +++ b/extensions/ipset/ip_set_setlist.c @@ -21,7 +21,7 @@ * after ==> ref, index */ -static inline bool +static inline int next_index_eq(const struct ip_set_setlist *map, int i, ip_set_id_t index) { return i < map->size && map->index[i] == index; @@ -38,17 +38,15 @@ setlist_utest(struct ip_set *set, const void *data, u_int32_t size, struct ip_set *s; if (req->before && req->ref[0] == '\0') - return -EINVAL; + return 0; index = __ip_set_get_byname(req->name, &s); if (index == IP_SET_INVALID_ID) - return -EEXIST; + return 0; if (req->ref[0] != '\0') { ref = __ip_set_get_byname(req->ref, &s); - if (ref == IP_SET_INVALID_ID) { - res = -EEXIST; + if (ref == IP_SET_INVALID_ID) goto finish; - } } for (i = 0; i < map->size && map->index[i] != IP_SET_INVALID_ID; i++) { @@ -172,7 +170,7 @@ setlist_kadd(struct ip_set *set, return res; } -static inline bool +static inline int unshift_setlist(struct ip_set_setlist *map, int i) { int j; diff --git a/extensions/ipset/ipset.8 b/extensions/ipset/ipset.8 index 522608e..6ef1179 100644 --- a/extensions/ipset/ipset.8 +++ b/extensions/ipset/ipset.8 @@ -50,6 +50,9 @@ IP set bindings pointing to sets and iptables matches and targets referring to sets creates references, which protects the given sets in the kernel. A set cannot be removed (destroyed) while there is a single reference pointing to it. +.P +.B +Please note, binding sets is a deprecated feature and will be removed in a later release. Switch to the multidata type of sets from using bindings. .SH OPTIONS The options that are recognized by .B ipset diff --git a/extensions/ipset/ipset.c b/extensions/ipset/ipset.c index 70935a3..0a8d91d 100644 --- a/extensions/ipset/ipset.c +++ b/extensions/ipset/ipset.c @@ -30,7 +30,7 @@ #define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe" #endif -#define IPSET_VERSION "2.5.0" +#define IPSET_VERSION "3.2" char program_name[] = "ipset"; char program_version[] = IPSET_VERSION; From 27c16768219517681e97580b09cc2a2e1d1dd2a7 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Tue, 1 Sep 2009 00:50:27 +0200 Subject: [PATCH 18/24] ipset: fix compile error with 2.6.20 $e/ipset/ip_set_iptree.c: In function "iptree_test": $e/ipset/ip_set_iptree.c:84:6: warning: implicit declaration of function "time_after" $e/ipset/ip_set_iptree.c:84:39: error: "jiffies" undeclared (first use in this function) $e/ipset/ip_set_iptree.c:84:39: error: (Each undeclared identifier is reported only once $e/ipset/ip_set_iptree.c:84:39: error: for each function it appears in.) $e/ipset/ip_set_iptree.c: In function "iptree_add": $e/ipset/ip_set_iptree.c:130:57: error: "jiffies" undeclared (first use in this function) $e/ipset/ip_set_iptree.c:134:48: error: "HZ" undeclared (first use in this function) $e/ipset/ip_set_iptree.c: In function "ip_tree_gc": $e/ipset/ip_set_iptree.c:214:8: warning: implicit declaration of function "time_before" $e/ipset/ip_set_iptree.c:214:42: error: "jiffies" undeclared (first use in this function) $e/ipset/ip_set_iptree.c:258:49: error: "HZ" undeclared (first use in this function) $e/ipset/ip_set_iptree.c: In function "init_gc_timer": $e/ipset/ip_set_iptree.c:274:20: error: "jiffies" undeclared (first use in this function) $e/ipset/ip_set_iptree.c:274:49: error: "HZ" undeclared (first use in this function) $e/ipset/ip_set_iptree.c: In function "iptree_list_members_size": $e/ipset/ip_set_iptree.c:380:58: error: "jiffies" undeclared (first use in this function) $e/ipset/ip_set_iptree.c: In function "iptree_list_members": $e/ipset/ip_set_iptree.c:407:58: error: "jiffies" undeclared (first use in this function) $e/ipset/ip_set_iptree.c:411:37: error: "HZ" undeclared (first use in this function) $e/ipset/ip_set_iptreemap.c: In function "gc": $e/ipset/ip_set_iptreemap.c:456:20: error: "jiffies" undeclared (first use in this function) $e/ipset/ip_set_iptreemap.c:456:20: error: (Each undeclared identifier is reported only once $e/ipset/ip_set_iptreemap.c:456:20: error: for each function it appears in.) $e/ipset/ip_set_iptreemap.c:456:49: error: "HZ" undeclared (first use in this function) $e/ipset/ip_set_iptreemap.c: In function "init_gc_timer": $e/ipset/ip_set_iptreemap.c:468:20: error: "jiffies" undeclared (first use in this function) $e/ipset/ip_set_iptreemap.c:468:49: error: "HZ" undeclared (first use in this function) --- extensions/ipset/ip_set_iptree.c | 1 + extensions/ipset/ip_set_iptreemap.c | 1 + 2 files changed, 2 insertions(+) diff --git a/extensions/ipset/ip_set_iptree.c b/extensions/ipset/ip_set_iptree.c index ba0bf24..362ebd6 100644 --- a/extensions/ipset/ip_set_iptree.c +++ b/extensions/ipset/ip_set_iptree.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include #include diff --git a/extensions/ipset/ip_set_iptreemap.c b/extensions/ipset/ip_set_iptreemap.c index 00f3357..fd558ef 100644 --- a/extensions/ipset/ip_set_iptreemap.c +++ b/extensions/ipset/ip_set_iptreemap.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include #include From 26f25a43a950ec408ddd67a213491a2ef438110c Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Wed, 9 Sep 2009 17:37:07 +0200 Subject: [PATCH 19/24] Xtables-addons 1.18 --- configure.ac | 4 ++-- doc/changelog.txt | 6 +++++- xtables-addons.8.in | 4 ++-- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/configure.ac b/configure.ac index 68abfbb..21164b3 100644 --- a/configure.ac +++ b/configure.ac @@ -1,5 +1,5 @@ -AC_INIT([xtables-addons], [1.17]) +AC_INIT([xtables-addons], [1.18]) AC_CONFIG_HEADERS([config.h]) AC_CONFIG_MACRO_DIR([m4]) AC_PROG_INSTALL @@ -89,7 +89,7 @@ else fi; fi; echo "Found kernel version $kmajor.$kminor.$kmicro.$kstable in $kbuilddir"; -if test "$kmajor" -gt 2 -o "$kminor" -gt 6 -o "$kmicro" -gt 30; then +if test "$kmajor" -gt 2 -o "$kminor" -gt 6 -o "$kmicro" -gt 31; then echo "WARNING: You are trying a newer kernel. Results may vary. :-)"; elif test \( "$kmajor" -lt 2 -o "$kminor" -lt 6 -o "$kmicro" -lt 17 \) -o \ \( "$kmajor" -eq 2 -a "$kminor" -eq 6 -a "$kmicro" -eq 18 -a \ diff --git a/doc/changelog.txt b/doc/changelog.txt index 7dc2ab8..6e522c6 100644 --- a/doc/changelog.txt +++ b/doc/changelog.txt @@ -1,11 +1,15 @@ -- build: support for Linux 2.6.31-rc1 +Xtables-addons 1.18 (September 09 2009) +======================================= +- build: support for Linux 2.6.31 - ipset: fast forward to v3.2 - quota2: support anonymous counters - quota2: reduce memory footprint for anonymous counters - quota2: extend locked period during cleanup (locking bugfix) - quota2: use strtoull instead of strtoul +- merged xt_ACCOUNT module +- merged xt_psd module Xtables-addons 1.17 (June 16 2009) diff --git a/xtables-addons.8.in b/xtables-addons.8.in index 0bca8b5..aa7b848 100644 --- a/xtables-addons.8.in +++ b/xtables-addons.8.in @@ -1,6 +1,6 @@ -.TH xtables\-addons 8 "v1.17 (2009\-06\-16)" "" "v1.17 (2009\-06\-16)" +.TH xtables-addons 8 "v1.18 (2009-09-09)" "" "v1.18 (2009-09-09)" .SH Name -Xtables\-addons - additional extensions for iptables, ip6tables, etc. +Xtables-addons \(em additional extensions for iptables, ip6tables, etc. .SH Targets .\" @TARGET@ .SH Matches From 09bfb8496edb19312f9c0fc6b97e1be51a464a91 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Sat, 12 Sep 2009 02:12:16 +0200 Subject: [PATCH 20/24] condition: fix compile error on 2.6.31-rt xt_condition.c:58:8: warning: type defaults to 'int' in declaration of 'DECLARE_MUTEX' --- extensions/xt_condition.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/extensions/xt_condition.c b/extensions/xt_condition.c index 20ed734..7e88183 100644 --- a/extensions/xt_condition.c +++ b/extensions/xt_condition.c @@ -55,7 +55,7 @@ struct condition_variable { /* proc_lock is a user context only semaphore used for write access */ /* to the conditions' list. */ -static DECLARE_MUTEX(proc_lock); +static struct semaphore proc_lock; static LIST_HEAD(conditions_list); static struct proc_dir_entry *proc_net_condition; @@ -232,6 +232,7 @@ static int __init condition_mt_init(void) { int ret; + sema_init(&proc_lock, 1); proc_net_condition = proc_mkdir(dir_name, init_net__proc_net); if (proc_net_condition == NULL) return -EACCES; From b07434386bd22ea240c82f6b29607d506cd95b2b Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Sat, 12 Sep 2009 02:14:00 +0200 Subject: [PATCH 21/24] ipset: fix compile error on 2.6.31-rt ip_set.c:42:8: warning: type defaults to 'int' in declaration of 'DECLARE_MUTEX' 2.6.31-rt has cleaned up the naming mess in semaphore.h. Without making use of #if hackery, we can use struct semaphore as declaration plus an explicit sema_init() call. --- doc/changelog.txt | 3 +++ extensions/ipset/ip_set.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/doc/changelog.txt b/doc/changelog.txt index 6e522c6..8e95275 100644 --- a/doc/changelog.txt +++ b/doc/changelog.txt @@ -1,5 +1,8 @@ +- build: compile fixes for 2.6.31-rt + + Xtables-addons 1.18 (September 09 2009) ======================================= - build: support for Linux 2.6.31 diff --git a/extensions/ipset/ip_set.c b/extensions/ipset/ip_set.c index 8ea57fc..df84f97 100644 --- a/extensions/ipset/ip_set.c +++ b/extensions/ipset/ip_set.c @@ -39,7 +39,7 @@ static struct list_head set_type_list; /* all registered sets */ static struct ip_set **ip_set_list; /* all individual sets */ static DEFINE_RWLOCK(ip_set_lock); /* protects the lists and the hash */ -static DECLARE_MUTEX(ip_set_app_mutex); /* serializes user access */ +static struct semaphore ip_set_app_mutex; /* serializes user access */ static ip_set_id_t ip_set_max = CONFIG_IP_NF_SET_MAX; static ip_set_id_t ip_set_bindings_hash_size = CONFIG_IP_NF_SET_HASHSIZE; static struct list_head *ip_set_hash; /* hash of bindings */ @@ -2016,6 +2016,7 @@ static int __init ip_set_init(void) int res; ip_set_id_t i; + sema_init(&ip_set_app_mutex, 1); get_random_bytes(&ip_set_hash_random, 4); if (max_sets) ip_set_max = max_sets; From b0a6111054826e24d4fb7ad91e37272307cebb79 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Sat, 12 Sep 2009 02:41:58 +0200 Subject: [PATCH 22/24] build: stable version number detection fix --- configure.ac | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 21164b3..06dfea9 100644 --- a/configure.ac +++ b/configure.ac @@ -79,11 +79,10 @@ krel="${krel#*.}"; kminor="${krel%%.*}"; krel="${krel#*.}"; kmicro="${krel%%.*}"; -krel2="${krel#*.}"; -if test "$krel" = "$krel2"; then +if test "$kmicro" = "$krel"; then kstable=0; else - kstable="${krel%%.*}"; + kstable="${krel#*.}"; if test -z "$kstable"; then kstable=0; fi; From 537f25dbad90de87c14a8cd3d52cc7405444a1d5 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Sat, 19 Sep 2009 20:11:59 +0200 Subject: [PATCH 23/24] build: use automake in ipset/ --- configure.ac | 2 +- extensions/ipset/GNUmakefile.in | 85 --------------------------------- extensions/ipset/Makefile.am | 45 +++++++++++++++++ 3 files changed, 46 insertions(+), 86 deletions(-) delete mode 100644 extensions/ipset/GNUmakefile.in create mode 100644 extensions/ipset/Makefile.am diff --git a/configure.ac b/configure.ac index 06dfea9..513fe21 100644 --- a/configure.ac +++ b/configure.ac @@ -103,5 +103,5 @@ AC_SUBST([kinclude_CFLAGS]) AC_SUBST([kbuilddir]) AC_SUBST([ksourcedir]) AC_SUBST([xtlibdir]) -AC_CONFIG_FILES([Makefile extensions/GNUmakefile extensions/ipset/GNUmakefile]) +AC_CONFIG_FILES([Makefile extensions/GNUmakefile extensions/ipset/Makefile]) AC_OUTPUT diff --git a/extensions/ipset/GNUmakefile.in b/extensions/ipset/GNUmakefile.in deleted file mode 100644 index 39bf160..0000000 --- a/extensions/ipset/GNUmakefile.in +++ /dev/null @@ -1,85 +0,0 @@ -# -*- Makefile -*- - -top_srcdir := @top_srcdir@ -srcdir := @srcdir@ -datarootdir := @datarootdir@ -abstop_srcdir := $(shell readlink -f ${top_srcdir}) -abssrcdir := $(shell readlink -f ${srcdir}) - -ifeq (${abstop_srcdir},) -$(error Path resolution of ${top_srcdir} failed) -endif -ifeq (${abssrcdir},) -$(error Path resolution of ${srcdir} failed) -endif - -prefix := @prefix@ -exec_prefix := @exec_prefix@ -sbindir := @sbindir@ -libdir := @libdir@ -libexecdir := @libexecdir@ -xtlibdir := @xtlibdir@ -kbuilddir := @kbuilddir@ -man8dir := @mandir@/man8 - -CC := @CC@ -CCLD := ${CC} -CFLAGS := @CFLAGS@ -LDFLAGS := @LDFLAGS@ -regular_CFLAGS := @regular_CFLAGS@ -kinclude_CFLAGS := @kinclude_CFLAGS@ -xtables_CFLAGS := @xtables_CFLAGS@ - -AM_CFLAGS := ${regular_CFLAGS} -I${top_srcdir}/include ${xtables_CFLAGS} ${kinclude_CFLAGS} -DIPSET_LIB_DIR=\"${xtlibdir}\" -AM_DEPFLAGS = -Wp,-MMD,$(@D)/.$(@F).d,-MT,$@ - -VU := 0 -am__1verbose_CC_0 = @echo " CC " $@; -am__1verbose_CCLD_0 = @echo " CCLD " $@; -am__1verbose_CC_1 = @echo " CC " $@ "<-" $<; -am__1verbose_CCLD_1 = @echo " CCLD " $@ "<-" $^; -am__verbose_CC = ${am__1verbose_CC_${VU}} -am__verbose_CCLD = ${am__1verbose_CCLD_${VU}} - -# -# Building blocks -# -targets := $(addsuffix .so,$(addprefix libipset_, \ - iphash ipmap ipporthash ipportiphash ipportnethash iptree \ - iptreemap macipmap nethash portmap setlist)) - -.SECONDARY: - -.PHONY: all install clean distclean FORCE - -all: ipset ${targets} - -install: all - @mkdir -p "${DESTDIR}${sbindir}" "${DESTDIR}${xtlibdir}" "${DESTDIR}${man8dir}"; - install -pm0755 ipset "${DESTDIR}${sbindir}/"; - install -pm0755 ${targets} "${DESTDIR}${xtlibdir}/"; - install -pm0644 ipset.8 "${DESTDIR}${man8dir}/"; - -clean: - rm -f *.oo *.so *.o ipset; - -distclean: clean - rm -f .*.d; - --include .*.d - - -ipset: ipset.o - ${am__verbose_CCLD}${CCLD} ${AM_LDFLAGS} ${LDFLAGS} -o $@ $< -ldl -rdynamic; - -# -# Shared libraries -# -lib%.so: lib%.oo - ${am__verbose_CCLD}${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $<; - -libipset_%.oo: ${srcdir}/ipset_%.c - ${am__verbose_CC}${CC} ${AM_DEPFLAGS} ${AM_CFLAGS} -DPIC -fPIC ${CFLAGS} -o $@ -c $<; - -%.o: %.c - ${am__verbose_CC}${CC} ${AM_DEPFLAGS} ${AM_CFLAGS} ${CFLAGS} -o $@ -c $<; diff --git a/extensions/ipset/Makefile.am b/extensions/ipset/Makefile.am new file mode 100644 index 0000000..c9607e4 --- /dev/null +++ b/extensions/ipset/Makefile.am @@ -0,0 +1,45 @@ +# -*- Makefile -*- + +AM_CFLAGS = ${regular_CFLAGS} -DIPSET_LIB_DIR=\"${xtlibdir}\" + +sbin_PROGRAMS = ipset +pkglibexec_LTLIBRARIES = \ + libipset_iphash.la \ + libipset_ipmap.la \ + libipset_ipporthash.la \ + libipset_ipportiphash.la \ + libipset_ipportnethash.la \ + libipset_iptree.la \ + libipset_iptreemap.la \ + libipset_macipmap.la \ + libipset_nethash.la \ + libipset_portmap.la \ + libipset_setlist.la + +ipset_LDADD = -ldl +ipset_LDFLAGS = -rdynamic + +module_flags = -avoid-version -module + +libipset_iphash_la_SOURCES = ipset_iphash.c +libipset_iphash_la_LDFLAGS = ${module_flags} +libipset_ipmap_la_SOURCES = ipset_ipmap.c +libipset_ipmap_la_LDFLAGS = ${module_flags} +libipset_ipporthash_la_SOURCES = ipset_ipporthash.c +libipset_ipporthash_la_LDFLAGS = ${module_flags} +libipset_ipportiphash_la_SOURCES = ipset_ipportiphash.c +libipset_ipportiphash_la_LDFLAGS = ${module_flags} +libipset_ipportnethash_la_SOURCES = ipset_ipportnethash.c +libipset_ipportnethash_la_LDFLAGS = ${module_flags} +libipset_iptree_la_SOURCES = ipset_iptree.c +libipset_iptree_la_LDFLAGS = ${module_flags} +libipset_iptreemap_la_SOURCES = ipset_iptreemap.c +libipset_iptreemap_la_LDFLAGS = ${module_flags} +libipset_macipmap_la_SOURCES = ipset_macipmap.c +libipset_macipmap_la_LDFLAGS = ${module_flags} +libipset_nethash_la_SOURCES = ipset_nethash.c +libipset_nethash_la_LDFLAGS = ${module_flags} +libipset_portmap_la_SOURCES = ipset_portmap.c +libipset_portmap_la_LDFLAGS = ${module_flags} +libipset_setlist_la_SOURCES = ipset_setlist.c +libipset_setlist_la_LDFLAGS = ${module_flags} From 2c5360508485ac48bb4fc5d3a43e37a526c30516 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Sun, 20 Sep 2009 18:55:16 +0200 Subject: [PATCH 24/24] build: enable automake for extensions/ directory Because we are likely to be having more userspace programs soon, and reproducing manual makefiles is a bad idea, make extensions/ ready for automake traversal. The build pattern now is: 1. toplevel Makefile.am starts off with extensions/Makefile.am 2. Makefile.am a. builds programs in current directory b. runs Kbuild - only from extensions/Makefile.am (so it does not get reinvoked from case 2cII) - Kbuild recurses on its own c. runs Mbuild I. builds iptables shared libraries in current directory II. runs Makefile.am in each subdir (goto step 2.) --- .gitignore | 6 ++ INSTALL | 14 ++-- Makefile.am | 12 +-- Makefile.extra | 29 +++++++ Makefile.iptrules.in | 59 +++++++++++++++ Makefile.mans.in | 40 ++++++++++ configure.ac | 3 +- extensions/GNUmakefile.in | 141 ----------------------------------- extensions/Kbuild | 4 +- extensions/Makefile.am | 24 ++++++ extensions/Mbuild | 2 + extensions/ipset/Makefile.am | 42 +---------- extensions/ipset/Mbuild | 7 ++ 13 files changed, 186 insertions(+), 197 deletions(-) create mode 100644 Makefile.extra create mode 100644 Makefile.iptrules.in create mode 100644 Makefile.mans.in delete mode 100644 extensions/GNUmakefile.in create mode 100644 extensions/Makefile.am create mode 100644 extensions/ipset/Mbuild diff --git a/.gitignore b/.gitignore index 37ce316..13da62f 100644 --- a/.gitignore +++ b/.gitignore @@ -10,6 +10,12 @@ GNUmakefile /downloads +/Makefile.iptrules +/Makefile.mans +/.*.lst +/matches.man +/targets.man + /aclocal.m4 /autom4te*.cache /compile diff --git a/INSTALL b/INSTALL index 483d526..0b30e06 100644 --- a/INSTALL +++ b/INSTALL @@ -46,6 +46,9 @@ Configuring and compiling /lib/modules/$(running version)/build, which usually points to the right directory. (If not, you need to install something.) + For RPM building, it should be /usr/src/linux-obj/... + or whatever location the distro makes use of. + --with-xtables= Specifies the path to the directory where we may find @@ -55,11 +58,11 @@ Configuring and compiling include/xtables.h. (The latter to support both standard /usr/include and the iptables source root.) ---with-libxtdir= +--with-xtlibdir= Specifies the path to where the newly built extensions should be installed when `make install` is run. It uses the same - default as the Xtables package, ${libexecdir}/xtables. + default as the Xtables/iptables package, ${libexecdir}/xtables. If you want to enable debugging, use @@ -72,15 +75,10 @@ much easier.) Build-time options ================== -V= controls the kernel's make verbosity. +V= controls the verbosity of make commands. V=0 "silent" (output filename) V=1 "verbose" (entire gcc command line) -VU= controls the Xt-a make verbosity. -VU=0 output filename -VU=1 output filename and source file -VU=2 entire gcc command line - Note to distribution packagers ============================== diff --git a/Makefile.am b/Makefile.am index f03174a..de6fb6b 100644 --- a/Makefile.am +++ b/Makefile.am @@ -5,16 +5,16 @@ SUBDIRS = extensions man_MANS := xtables-addons.8 -xtables-addons.8: ${srcdir}/xtables-addons.8.in extensions/matches.man extensions/targets.man - ${am__verbose_GEN}sed -e '/@MATCHES@/ r extensions/matches.man' -e '/@TARGET@/ r extensions/targets.man' $< >$@; +.PHONY: FORCE +FORCE: -extensions/%: - ${MAKE} ${AM_MAKEFLAGS} -C $(@D) $(@F) +xtables-addons.8: FORCE + ${MAKE} -f Makefile.mans all; -install-exec-local: +install-exec-hook: depmod -a || :; -config.status: extensions/GNUmakefile.in +config.status: Makefile.iptrules.in .PHONY: tarball tarball: diff --git a/Makefile.extra b/Makefile.extra new file mode 100644 index 0000000..f689774 --- /dev/null +++ b/Makefile.extra @@ -0,0 +1,29 @@ +# -*- Makefile -*- +# AUTOMAKE + +XA_SRCDIR = ${srcdir} +XA_TOPSRCDIR = ${top_srcdir} +XA_ABSTOPSRCDIR = ${abs_top_srcdir} +export XA_SRCDIR +export XA_TOPSRCDIR +export XA_ABSTOPSRCDIR + +_mcall = ${MAKE} -f ${top_builddir}/Makefile.iptrules + +all-local: user-all-local + +install-exec-local: user-install-local + +clean-local: user-clean-local + +user-all-local: + ${_mcall} all; + +# Have no user-install-data-local ATM +user-install-local: user-install-exec-local + +user-install-exec-local: + ${_mcall} install; + +user-clean-local: + ${_mcall} clean; diff --git a/Makefile.iptrules.in b/Makefile.iptrules.in new file mode 100644 index 0000000..4fcdd02 --- /dev/null +++ b/Makefile.iptrules.in @@ -0,0 +1,59 @@ +# -*- Makefile -*- +# MANUAL + +prefix = @prefix@ +exec_prefix = @exec_prefix@ +libexecdir = @libexecdir@ +xtlibdir = @xtlibdir@ + +CC = @CC@ +CCLD = ${CC} + +regular_CFLAGS = @regular_CFLAGS@ +xtables_CFLAGS = @xtables_CFLAGS@ +AM_CFLAGS = ${regular_CFLAGS} ${xtables_CFLAGS} +AM_DEPFLAGS = -Wp,-MMD,$(@D)/.$(@F).d,-MT,$@ + +AM_DEFAULT_VERBOSITY = 0 +am__v_CC_0 = @echo " CC " $@; +am__v_CCLD_0 = @echo " CCLD " $@; +am__v_GEN_0 = @echo " GEN " $@; +am__v_SILENT_0 = @ +am__v_CC_ = ${am__v_CC_${AM_DEFAULT_VERBOSITY}} +am__v_CCLD_ = ${am__v_CCLD_${AM_DEFAULT_VERBOSITY}} +am__v_GEN_ = ${am__v_GEN_${AM_DEFAULT_VERBOSITY}} +am__v_SILENT_ = ${am__v_SILENT_${AM_DEFAULT_VERBOSITY}} +AM_V_CC = ${am__v_CC_${V}} +AM_V_CCLD = ${am__v_CCLD_${V}} +AM_V_GEN = ${am__v_GEN_${V}} +AM_V_silent = ${am__v_GEN_${V}} + +include ${XA_TOPSRCDIR}/mconfig +-include ${XA_TOPSRCDIR}/mconfig.* +include ${XA_SRCDIR}/Mbuild +-include ${XA_SRCDIR}/Mbuild.* + +targets := $(filter-out %/,${obj-m}) +subdirs_list := $(filter %/,${obj-m}) + +.SECONDARY: + +.PHONY: all install clean + +all: ${targets} + @for i in ${subdirs_list}; do ${MAKE} -C $$i; done; + +install: ${targets} + @for i in ${subdirs_list}; do ${MAKE} -C $$i $@; done; + install -dm0755 "${DESTDIR}/${xtlibdir}"; + install -pm0755 $^ "${DESTDIR}/${xtlibdir}"; + +clean: + @for i in ${subdirs_list}; do ${MAKE} -C $$i $@; done; + rm -f *.oo *.so; + +lib%.so: lib%.oo + ${AM_V_CCLD}${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $<; + +%.oo: ${XA_SRCDIR}/%.c + ${AM_V_CC}${CC} ${AM_DEPFLAGS} ${AM_CFLAGS} -DPIC -fPIC ${CFLAGS} -o $@ -c $<; diff --git a/Makefile.mans.in b/Makefile.mans.in new file mode 100644 index 0000000..49f447a --- /dev/null +++ b/Makefile.mans.in @@ -0,0 +1,40 @@ +# -*- Makefile -*- +# MANUAL + +srcdir := @srcdir@ + +wcman_matches := $(shell find "${srcdir}" -name 'libxt_[a-z]*.man') +wcman_targets := $(shell find "${srcdir}" -name 'libxt_[A-Z]*.man') +wlist_matches := $(patsubst ${srcdir}/libxt_%.man,%,${wcman_matches}) +wlist_targets := $(patsubst ${srcdir}/libxt_%.man,%,${wcman_targets}) + +.PHONY: FORCE + +FORCE: + +.manpages.lst: FORCE + @echo "${wlist_targets} ${wlist_matches}" >$@.tmp; \ + cmp -s $@ $@.tmp || mv $@.tmp $@; \ + rm -f $@.tmp; + +man_run = \ + ${AM_V_GEN}for ext in $(1); do \ + name="$${ext%.man}"; \ + name="$${name\#\#*/libxt_}"; \ + if [ -f "$$ext" ]; then \ + echo ".SS $$name"; \ + cat "$$ext"; \ + continue; \ + fi; \ + done >$@; + +all: xtables-addons.8 + +xtables-addons.8: ${srcdir}/xtables-addons.8.in matches.man targets.man + ${AM_V_GEN}sed -e '/@MATCHES@/ r matches.man' -e '/@TARGET@/ r targets.man' $< >$@; + +matches.man: .manpages.lst ${wcman_matches} + $(call man_run,${wlist_matches}) + +targets.man: .manpages.lst ${wcman_targets} + $(call man_run,${wlist_targets}) diff --git a/configure.ac b/configure.ac index 513fe21..72ba18c 100644 --- a/configure.ac +++ b/configure.ac @@ -103,5 +103,6 @@ AC_SUBST([kinclude_CFLAGS]) AC_SUBST([kbuilddir]) AC_SUBST([ksourcedir]) AC_SUBST([xtlibdir]) -AC_CONFIG_FILES([Makefile extensions/GNUmakefile extensions/ipset/Makefile]) +AC_CONFIG_FILES([Makefile Makefile.iptrules Makefile.mans + extensions/Makefile extensions/ipset/Makefile]) AC_OUTPUT diff --git a/extensions/GNUmakefile.in b/extensions/GNUmakefile.in deleted file mode 100644 index c603f0b..0000000 --- a/extensions/GNUmakefile.in +++ /dev/null @@ -1,141 +0,0 @@ -# -*- Makefile -*- - -top_srcdir := @top_srcdir@ -srcdir := @srcdir@ -abstop_srcdir := $(shell readlink -f ${top_srcdir}) -abssrcdir := $(shell readlink -f ${srcdir}) - -ifeq (${abstop_srcdir},) -$(error Path resolution of ${top_srcdir} failed) -endif -ifeq (${abssrcdir},) -$(error Path resolution of ${srcdir} failed) -endif - -prefix := @prefix@ -exec_prefix := @exec_prefix@ -libdir := @libdir@ -libexecdir := @libexecdir@ -xtlibdir := @xtlibdir@ -kbuilddir := @kbuilddir@ - -CC := @CC@ -CCLD := ${CC} -CFLAGS := @CFLAGS@ -LDFLAGS := @LDFLAGS@ -regular_CFLAGS := @regular_CFLAGS@ -kinclude_CFLAGS := @kinclude_CFLAGS@ -xtables_CFLAGS := @xtables_CFLAGS@ - -AM_CFLAGS := ${regular_CFLAGS} -I${top_srcdir}/include ${xtables_CFLAGS} ${kinclude_CFLAGS} -AM_DEPFLAGS = -Wp,-MMD,$(@D)/.$(@F).d,-MT,$@ - -VU := 0 -am__v_CC_0 = @echo " CC " $@; -am__v_CCLD_0 = @echo " CCLD " $@; -am__v_GEN_0 = @echo " GEN " $@; -am__v_SILENT_0 = @ -AM_V_CC = ${am__v_CC_${VU}} -AM_V_CCLD = ${am__v_CCLD_${VU}} -AM_V_GEN = ${am__v_GEN_${VU}} -AM_V_silent = ${am__v_GEN_${VU}} - - -# -# Wildcard module list -# -include ${top_srcdir}/mconfig --include ${top_srcdir}/mconfig.* -include ${srcdir}/Mbuild --include ${srcdir}/Mbuild.* --include ${srcdir}/*.Mbuild - - -# -# Building blocks -# -targets := $(filter-out %/,${obj-m}) -targets_install := ${targets} -subdirs_list := $(filter %/,${obj-m}) - -.SECONDARY: - -.PHONY: all install clean distclean FORCE - -all: subdirs modules user matches.man targets.man - -subdirs: - @for i in ${subdirs_list}; do ${MAKE} -C $$i; done; - -subdirs-install: - @for i in ${subdirs_list}; do ${MAKE} -C $$i install; done; - -user: ${targets} - -install: modules_install subdirs-install ${targets_install} - @mkdir -p "${DESTDIR}${xtlibdir}"; - install -pm0755 ${targets_install} "${DESTDIR}${xtlibdir}/"; - -clean: clean_modules - @for i in ${subdirs_list}; do ${MAKE} -C $$i clean; done; - rm -f *.oo *.so; - -distclean: clean - rm -f .*.d .manpages.lst; - --include .*.d - - -# -# Call out to kbuild -# -.PHONY: modules modules_install clean_modules - -modules: - ${AM_V_silent}if [ -n "${kbuilddir}" ]; then ${MAKE} -C ${kbuilddir} M=${abssrcdir} XA_TOPSRCDIR=${abstop_srcdir} modules; fi; - -modules_install: - ${AM_V_silent}if [ -n "${kbuilddir}" ]; then ${MAKE} -C ${kbuilddir} M=${abssrcdir} XA_TOPSRCDIR=${abstop_srcdir} INSTALL_MOD_PATH=${DESTDIR} modules_install; fi; - -clean_modules: - ${AM_V_silent}if [ -n "${kbuilddir}" ]; then ${MAKE} -C ${kbuilddir} M=${abssrcdir} XA_TOPSRCDIR=${abstop_srcdir} clean; fi; - - -# -# Shared libraries -# -lib%.so: lib%.oo - ${AM_V_CCLD}${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $<; - -lib%.oo: ${srcdir}/lib%.c - ${AM_V_CC}${CC} ${AM_DEPFLAGS} ${AM_CFLAGS} -D_INIT=lib$*_init -DPIC -fPIC ${CFLAGS} -o $@ -c $<; - - -# -# Manpages -# -wcman_matches := $(wildcard ${srcdir}/libxt_[a-z]*.man) -wcman_targets := $(wildcard ${srcdir}/libxt_[A-Z]*.man) -wlist_matches := $(patsubst ${srcdir}/libxt_%.man,%,${wcman_matches}) -wlist_targets := $(patsubst ${srcdir}/libxt_%.man,%,${wcman_targets}) - -.manpages.lst: FORCE - @echo "${wlist_targets} ${wlist_matches}" >$@.tmp; \ - cmp -s $@ $@.tmp || mv $@.tmp $@; \ - rm -f $@.tmp; - -man_run = \ - ${AM_V_GEN}for ext in $(1); do \ - f="${srcdir}/libxt_$$ext.man"; \ - if [ -f "$$f" ]; then \ - echo ".SS $$ext"; \ - cat "$$f"; \ - continue; \ - fi; \ - done >$@; - -matches.man: .manpages.lst ${wcman_matches} - $(call man_run,${wlist_matches}) - -targets.man: .manpages.lst ${wcman_targets} - $(call man_run,${wlist_targets}) diff --git a/extensions/Kbuild b/extensions/Kbuild index 8a2095d..4ff2ed9 100644 --- a/extensions/Kbuild +++ b/extensions/Kbuild @@ -1,7 +1,7 @@ # -*- Makefile -*- -include ${XA_TOPSRCDIR}/mconfig --include ${XA_TOPSRCDIR}/mconfig.* +include ${XA_ABSTOPSRCDIR}/mconfig +-include ${XA_ABSTOPSRCDIR}/mconfig.* obj-m += compat_xtables.o diff --git a/extensions/Makefile.am b/extensions/Makefile.am new file mode 100644 index 0000000..ea56f2c --- /dev/null +++ b/extensions/Makefile.am @@ -0,0 +1,24 @@ +# -*- Makefile -*- +# AUTOMAKE + +# Not having Kbuild in Makefile.extra because it will already recurse +.PHONY: modules modules_install clean_modules + +_kcall = ${MAKE} -C ${kbuilddir} M=${abs_srcdir} + +modules: + ${AM_V_silent}if [ -n "${kbuilddir}" ]; then ${_kcall} modules; fi; + +modules_install: + ${AM_V_silent}if [ -n "${kbuilddir}" ]; then ${_kcall} INSTALL_MOD_PATH=${DESTDIR} modules_install; fi; + +clean_modules: + ${AM_V_silent}if [ -n "${kbuilddir}" ]; then ${_kcall} clean; fi; + +all-local: modules + +install-exec-local: modules_install + +clean-local: clean_modules + +include ../Makefile.extra diff --git a/extensions/Mbuild b/extensions/Mbuild index 21aed33..a1fb901 100644 --- a/extensions/Mbuild +++ b/extensions/Mbuild @@ -1,3 +1,5 @@ +# -*- Makefile -*- + obj-${build_ACCOUNT} += libxt_ACCOUNT.so obj-${build_CHAOS} += libxt_CHAOS.so obj-${build_DELUDE} += libxt_DELUDE.so diff --git a/extensions/ipset/Makefile.am b/extensions/ipset/Makefile.am index c9607e4..0b2bec9 100644 --- a/extensions/ipset/Makefile.am +++ b/extensions/ipset/Makefile.am @@ -1,45 +1,9 @@ # -*- Makefile -*- -AM_CFLAGS = ${regular_CFLAGS} -DIPSET_LIB_DIR=\"${xtlibdir}\" +AM_CFLAGS = ${regular_CFLAGS} -DIPSET_LIB_DIR=\"${xtlibdir}\" + +include ../../Makefile.extra sbin_PROGRAMS = ipset -pkglibexec_LTLIBRARIES = \ - libipset_iphash.la \ - libipset_ipmap.la \ - libipset_ipporthash.la \ - libipset_ipportiphash.la \ - libipset_ipportnethash.la \ - libipset_iptree.la \ - libipset_iptreemap.la \ - libipset_macipmap.la \ - libipset_nethash.la \ - libipset_portmap.la \ - libipset_setlist.la - ipset_LDADD = -ldl ipset_LDFLAGS = -rdynamic - -module_flags = -avoid-version -module - -libipset_iphash_la_SOURCES = ipset_iphash.c -libipset_iphash_la_LDFLAGS = ${module_flags} -libipset_ipmap_la_SOURCES = ipset_ipmap.c -libipset_ipmap_la_LDFLAGS = ${module_flags} -libipset_ipporthash_la_SOURCES = ipset_ipporthash.c -libipset_ipporthash_la_LDFLAGS = ${module_flags} -libipset_ipportiphash_la_SOURCES = ipset_ipportiphash.c -libipset_ipportiphash_la_LDFLAGS = ${module_flags} -libipset_ipportnethash_la_SOURCES = ipset_ipportnethash.c -libipset_ipportnethash_la_LDFLAGS = ${module_flags} -libipset_iptree_la_SOURCES = ipset_iptree.c -libipset_iptree_la_LDFLAGS = ${module_flags} -libipset_iptreemap_la_SOURCES = ipset_iptreemap.c -libipset_iptreemap_la_LDFLAGS = ${module_flags} -libipset_macipmap_la_SOURCES = ipset_macipmap.c -libipset_macipmap_la_LDFLAGS = ${module_flags} -libipset_nethash_la_SOURCES = ipset_nethash.c -libipset_nethash_la_LDFLAGS = ${module_flags} -libipset_portmap_la_SOURCES = ipset_portmap.c -libipset_portmap_la_LDFLAGS = ${module_flags} -libipset_setlist_la_SOURCES = ipset_setlist.c -libipset_setlist_la_LDFLAGS = ${module_flags} diff --git a/extensions/ipset/Mbuild b/extensions/ipset/Mbuild new file mode 100644 index 0000000..40c70c2 --- /dev/null +++ b/extensions/ipset/Mbuild @@ -0,0 +1,7 @@ +# -*- Makefile -*- + +obj-m += $(addprefix lib,$(patsubst %.c,%.so,$(notdir \ + $(wildcard ${XA_SRCDIR}/ipset_*.c)))) + +libipset_%.oo: ${XA_SRCDIR}/ipset_%.c + ${AM_V_CC}${CC} ${AM_DEPFLAGS} ${AM_CFLAGS} -DPIC -fPIC ${CFLAGS} -o $@ -c $<;