[NETFILTER]: Rename ipt_iprange to xt_iprange

This patch moves ipt_iprange to xt_iprange, in preparation for adding
IPv6 support to xt_iprange.

Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
index ac9e6429f74717e77a31599e8b1657d81a32456a..91fef0cae42f2bf28feddeb0d0d0ad715baaaee8 100644 (file)
--- a/include/linux/netfilter/Kbuild
+++ b/include/linux/netfilter/Kbuild
@@ -21,6 +21,7 @@ header-y += xt_dccp.h
 header-y += xt_dscp.h
 header-y += xt_esp.h
 header-y += xt_hashlimit.h
+header-y += xt_iprange.h
 header-y += xt_helper.h
 header-y += xt_length.h
 header-y += xt_limit.h

diff --git a/include/linux/netfilter/xt_iprange.h b/include/linux/netfilter/xt_iprange.h
new file mode 100644 (file)
index 0000000..a4299c7
--- /dev/null
+++ b/include/linux/netfilter/xt_iprange.h
@@ -0,0 +1,17 @@
+#ifndef _LINUX_NETFILTER_XT_IPRANGE_H
+#define _LINUX_NETFILTER_XT_IPRANGE_H 1
+
+enum {
+       IPRANGE_SRC     = 1 << 0,       /* match source IP address */
+       IPRANGE_DST     = 1 << 1,       /* match destination IP address */
+       IPRANGE_SRC_INV = 1 << 4,       /* negate the condition */
+       IPRANGE_DST_INV = 1 << 5,       /* -"- */
+};
+
+struct xt_iprange_mtinfo {
+       union nf_inet_addr src_min, src_max;
+       union nf_inet_addr dst_min, dst_max;
+       u_int8_t flags;
+};
+
+#endif /* _LINUX_NETFILTER_XT_IPRANGE_H */

diff --git a/include/linux/netfilter_ipv4/ipt_iprange.h b/include/linux/netfilter_ipv4/ipt_iprange.h
index a92fefc3c7ecbc222f76694101c600886f61b6da..5f1aebde4d2fa6457c633b98d7845b8f0186254f 100644 (file)
--- a/include/linux/netfilter_ipv4/ipt_iprange.h
+++ b/include/linux/netfilter_ipv4/ipt_iprange.h
@@ -2,11 +2,7 @@
 #define _IPT_IPRANGE_H
 
 #include <linux/types.h>
-
-#define IPRANGE_SRC            0x01    /* Match source IP address */
-#define IPRANGE_DST            0x02    /* Match destination IP address */
-#define IPRANGE_SRC_INV                0x10    /* Negate the condition */
-#define IPRANGE_DST_INV                0x20    /* Negate the condition */
+#include <linux/netfilter/xt_iprange.h>
 
 struct ipt_iprange {
        /* Inclusive: network order. */

diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 10ca307b84991c7e410364a31f4362ba37be0f01..9a077cb2479841787936a49c3652d93ac8542ba4 100644 (file)
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -57,16 +57,6 @@ config IP_NF_IPTABLES
          To compile it as a module, choose M here.  If unsure, say N.
 
 # The matches.
-config IP_NF_MATCH_IPRANGE
-       tristate '"iprange" match support'
-       depends on IP_NF_IPTABLES
-       depends on NETFILTER_ADVANCED
-       help
-         This option makes possible to match IP addresses against IP address
-         ranges.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-
 config IP_NF_MATCH_RECENT
        tristate '"recent" match support'
        depends on IP_NF_IPTABLES

diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index fd7d4a5b436cce4f7d543985767b25f529020804..0c7dc78a62e99ab6eaf77320a2624024cfa4199c 100644 (file)
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -44,7 +44,6 @@ obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
 obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
 obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
-obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
 obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
 

diff --git a/net/ipv4/netfilter/ipt_iprange.c b/net/ipv4/netfilter/ipt_iprange.c
deleted file mode 100644 (file)
index 9a2aba8..0000000
--- a/net/ipv4/netfilter/ipt_iprange.c
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * iptables module to match IP address ranges
- *
- * (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/ip.h>
-#include <linux/netfilter/x_tables.h>
-#include <linux/netfilter_ipv4/ipt_iprange.h>
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
-MODULE_DESCRIPTION("Xtables: arbitrary IPv4 range matching");
-
-static bool
-iprange_mt(const struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, const struct xt_match *match,
-           const void *matchinfo, int offset, unsigned int protoff,
-           bool *hotdrop)
-{
-       const struct ipt_iprange_info *info = matchinfo;
-       const struct iphdr *iph = ip_hdr(skb);
-
-       if (info->flags & IPRANGE_SRC) {
-               if ((ntohl(iph->saddr) < ntohl(info->src.min_ip)
-                         || ntohl(iph->saddr) > ntohl(info->src.max_ip))
-                        ^ !!(info->flags & IPRANGE_SRC_INV)) {
-                       pr_debug("src IP %u.%u.%u.%u NOT in range %s"
-                                "%u.%u.%u.%u-%u.%u.%u.%u\n",
-                                NIPQUAD(iph->saddr),
-                                info->flags & IPRANGE_SRC_INV ? "(INV) " : "",
-                                NIPQUAD(info->src.min_ip),
-                                NIPQUAD(info->src.max_ip));
-                       return false;
-               }
-       }
-       if (info->flags & IPRANGE_DST) {
-               if ((ntohl(iph->daddr) < ntohl(info->dst.min_ip)
-                         || ntohl(iph->daddr) > ntohl(info->dst.max_ip))
-                        ^ !!(info->flags & IPRANGE_DST_INV)) {
-                       pr_debug("dst IP %u.%u.%u.%u NOT in range %s"
-                                "%u.%u.%u.%u-%u.%u.%u.%u\n",
-                                NIPQUAD(iph->daddr),
-                                info->flags & IPRANGE_DST_INV ? "(INV) " : "",
-                                NIPQUAD(info->dst.min_ip),
-                                NIPQUAD(info->dst.max_ip));
-                       return false;
-               }
-       }
-       return true;
-}
-
-static struct xt_match iprange_mt_reg __read_mostly = {
-       .name           = "iprange",
-       .family         = AF_INET,
-       .match          = iprange_mt,
-       .matchsize      = sizeof(struct ipt_iprange_info),
-       .me             = THIS_MODULE
-};
-
-static int __init iprange_mt_init(void)
-{
-       return xt_register_match(&iprange_mt_reg);
-}
-
-static void __exit iprange_mt_exit(void)
-{
-       xt_unregister_match(&iprange_mt_reg);
-}
-
-module_init(iprange_mt_init);
-module_exit(iprange_mt_exit);

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 79d71437e310bca8db86952fd18a602c9c80d6ae..daf5b881064da7d1ba507f8f532ef6f1c5bc5af3 100644 (file)
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -567,6 +567,17 @@ config NETFILTER_XT_MATCH_HELPER
 
          To compile it as a module, choose M here.  If unsure, say Y.
 
+config NETFILTER_XT_MATCH_IPRANGE
+       tristate '"iprange" address range match support'
+       depends on NETFILTER_XTABLES
+       depends on NETFILTER_ADVANCED
+       ---help---
+       This option adds a "iprange" match, which allows you to match based on
+       an IP address range. (Normal iptables only matches on single addresses
+       with an optional mask.)
+
+       If unsure, say M.
+
 config NETFILTER_XT_MATCH_LENGTH
        tristate '"length" match support'
        depends on NETFILTER_XTABLES

diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 3b9ea8fb3a074b57d82461eda11f51ed420b31af..c910caee0d4f9bb0d15e4c9a7d58457523450fa2 100644 (file)
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -63,6 +63,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_LENGTH) += xt_length.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_LIMIT) += xt_limit.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_MAC) += xt_mac.o

diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c
new file mode 100644 (file)
index 0000000..c57a6cf
--- /dev/null
+++ b/net/netfilter/xt_iprange.c
@@ -0,0 +1,76 @@
+/*
+ *     xt_iprange - Netfilter module to match IP address ranges
+ *
+ *     (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+ *
+ *     This program is free software; you can redistribute it and/or modify
+ *     it under the terms of the GNU General Public License version 2 as
+ *     published by the Free Software Foundation.
+ */
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_ipv4/ipt_iprange.h>
+
+static bool
+iprange_mt_v0(const struct sk_buff *skb, const struct net_device *in,
+              const struct net_device *out, const struct xt_match *match,
+              const void *matchinfo, int offset, unsigned int protoff,
+              bool *hotdrop)
+{
+       const struct ipt_iprange_info *info = matchinfo;
+       const struct iphdr *iph = ip_hdr(skb);
+
+       if (info->flags & IPRANGE_SRC) {
+               if ((ntohl(iph->saddr) < ntohl(info->src.min_ip)
+                         || ntohl(iph->saddr) > ntohl(info->src.max_ip))
+                        ^ !!(info->flags & IPRANGE_SRC_INV)) {
+                       pr_debug("src IP %u.%u.%u.%u NOT in range %s"
+                                "%u.%u.%u.%u-%u.%u.%u.%u\n",
+                                NIPQUAD(iph->saddr),
+                                info->flags & IPRANGE_SRC_INV ? "(INV) " : "",
+                                NIPQUAD(info->src.min_ip),
+                                NIPQUAD(info->src.max_ip));
+                       return false;
+               }
+       }
+       if (info->flags & IPRANGE_DST) {
+               if ((ntohl(iph->daddr) < ntohl(info->dst.min_ip)
+                         || ntohl(iph->daddr) > ntohl(info->dst.max_ip))
+                        ^ !!(info->flags & IPRANGE_DST_INV)) {
+                       pr_debug("dst IP %u.%u.%u.%u NOT in range %s"
+                                "%u.%u.%u.%u-%u.%u.%u.%u\n",
+                                NIPQUAD(iph->daddr),
+                                info->flags & IPRANGE_DST_INV ? "(INV) " : "",
+                                NIPQUAD(info->dst.min_ip),
+                                NIPQUAD(info->dst.max_ip));
+                       return false;
+               }
+       }
+       return true;
+}
+
+static struct xt_match iprange_mt_reg __read_mostly = {
+       .name           = "iprange",
+       .family         = AF_INET,
+       .match          = iprange_mt_v0,
+       .matchsize      = sizeof(struct ipt_iprange_info),
+       .me             = THIS_MODULE
+};
+
+static int __init iprange_mt_init(void)
+{
+       return xt_register_match(&iprange_mt_reg);
+}
+
+static void __exit iprange_mt_exit(void)
+{
+       xt_unregister_match(&iprange_mt_reg);
+}
+
+module_init(iprange_mt_init);
+module_exit(iprange_mt_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
+MODULE_DESCRIPTION("Xtables: arbitrary IPv4 range matching");