* [PATCH] Time match in mangle/POSTROUTING?
@ 2006-12-18 17:19 Alejandro David Galera Ruiz
2006-12-19 12:10 ` Patrick McHardy
0 siblings, 1 reply; 5+ messages in thread
From: Alejandro David Galera Ruiz @ 2006-12-18 17:19 UTC (permalink / raw)
To: netfilter-devel; +Cc: brad, kaber
De:
Alejandro David Galera Ruiz
<alejandro.galera@gmail.com>
Para:
brad@info-link.net
Cc:
netfilter-devel@lists.netfilter.org,
kaber@trash.net
Asunto:
Re:
Fecha:
Mon, 18 Dec 2006 17:28:16 +0100
I'm trying to use netfilter with classify and temporal filters. Due to I
realised that POSTROUTING wasn't supported in mangle table, I decided to
patch ipt_time module following Brad Fisher's PATCH.
I've tried to update this patch for kernel 2.6.17 and the lastest
version of patch-o-matic (20061213).
It's my first contribution to this project, I hope to be a little bit
useful for your great project.
Using:
Patch-o-matic 20061213
Modifications:
* Time modification (the same from Brad Fisher
http://lists.netfilter.org/pipermail/netfilter-devel/2003-December/013367.html)
> >Brad Fisher wrote:
> >
> >* I don't see any reason why the above approach
> > wouldn't work in any chain, so I
> > removed the check from checkentry.
* I think it could be more deffensive and flexible in the future if we
add NF_IP_POST_ROUTING checking to checkentry function instead of quit
any verification.
* System message according to let POST_ROUTING.
* System warning message specifying invalid argument is due to time
higher than 24h (it also has been taken from Brad Fisher's patch)
All your suggestions, indications or tests will be wellcome
Thanks in advance
--- ipt_time.c.old 2006-12-14 19:21:10.000000000 +0100
+++ ipt_time.c 2006-12-14 19:12:20.000000000 +0100
@@ -79,8 +79,15 @@
/* ... check the time now */
packet_time = (currenttime.tm_hour * 60) + currenttime.tm_min;
- if ((packet_time < info->time_start) || (packet_time >
info->time_stop))
- return 0;
+ if (info->time_start <= info->time_stop) {
+ /* normal order: start <= stop */
+ if ((packet_time < info->time_start) || (packet_time >
info->time_stop))
+ return 0;
+ } else {
+ /* reversed order: stop < start */
+ if ((packet_time < info->time_start) && (packet_time >
info->time_stop))
+ return 0;
+ }
/* here we match ! */
return 1;
@@ -104,9 +111,9 @@
/* First, check that we are in the correct hooks */
if (hook_mask
- & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_IN) | (1
<< NF_IP_FORWARD) | (1 << NF_IP_LOCAL_OUT)))
+ & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_IN) | (1
<< NF_IP_FORWARD) | (1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_POST_ROUTING)))
{
- printk("ipt_time: error, only valid for PRE_ROUTING,
LOCAL_IN, FORWARD and OUTPUT)\n");
+ printk("ipt_time: error, only valid for PRE_ROUTING,
POST_ROUTING, LOCAL_IN, FORWARD and OUTPUT)\n");
return 0;
}
@@ -120,7 +127,7 @@
if ((info->time_start > 1439) || /* 23*60+59 = 1439*/
(info->time_stop > 1439))
{
- printk(KERN_WARNING "ipt_time: invalid argument\n");
+ printk(KERN_WARNING "ipt_time: invalid argument: start
or stop time greater than 24h\n");
return 0;
}
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] Time match in mangle/POSTROUTING?
@ 2006-12-19 11:54 Alejandro David Galera Ruiz
0 siblings, 0 replies; 5+ messages in thread
From: Alejandro David Galera Ruiz @ 2006-12-19 11:54 UTC (permalink / raw)
To: netfilter-devel
I'm trying to use netfilter with classify and temporal filters. Due to I
realised that POSTROUTING wasn't supported in mangle table, I decided to
patch ipt_time module following Brad Fisher's PATCH.
I've tried to update this patch for kernel 2.6.17 and the lastest
version of patch-o-matic (20061213).
It's my first contribution to this project, I hope to be a little bit
useful for your great project.
Using:
Patch-o-matic 20061213
Modifications:
* Time modification (the same from Brad Fisher
http://lists.netfilter.org/pipermail/netfilter-devel/2003-December/013367.html)
> >Brad Fisher wrote:
> >
> >* I don't see any reason why the above approach
> > wouldn't work in any chain, so I
> > removed the check from checkentry.
* I think it could be more deffensive and flexible in the future if we
add NF_IP_POST_ROUTING checking to checkentry function instead of quit
any verification.
* System message according to let POST_ROUTING.
* System warning message specifying invalid argument is due to time
higher than 24h (it also has been taken from Brad Fisher's patch)
All your suggestions, indications or tests will be wellcome
Thanks in advance
--- ipt_time.c.old 2006-12-14 19:21:10.000000000 +0100
+++ ipt_time.c 2006-12-14 19:12:20.000000000 +0100
@@ -79,8 +79,15 @@
/* ... check the time now */
packet_time = (currenttime.tm_hour * 60) + currenttime.tm_min;
- if ((packet_time < info->time_start) || (packet_time >
info->time_stop))
- return 0;
+ if (info->time_start <= info->time_stop) {
+ /* normal order: start <= stop */
+ if ((packet_time < info->time_start) || (packet_time >
info->time_stop))
+ return 0;
+ } else {
+ /* reversed order: stop < start */
+ if ((packet_time < info->time_start) && (packet_time >
info->time_stop))
+ return 0;
+ }
/* here we match ! */
return 1;
@@ -104,9 +111,9 @@
/* First, check that we are in the correct hooks */
if (hook_mask
- & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_IN) | (1
<< NF_IP_FORWARD) | (1 << NF_IP_LOCAL_OUT)))
+ & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_IN) | (1
<< NF_IP_FORWARD) | (1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_POST_ROUTING)))
{
- printk("ipt_time: error, only valid for PRE_ROUTING,
LOCAL_IN, FORWARD and OUTPUT)\n");
+ printk("ipt_time: error, only valid for PRE_ROUTING,
POST_ROUTING, LOCAL_IN, FORWARD and OUTPUT)\n");
return 0;
}
@@ -120,7 +127,7 @@
if ((info->time_start > 1439) || /* 23*60+59 = 1439*/
(info->time_stop > 1439))
{
- printk(KERN_WARNING "ipt_time: invalid argument\n");
+ printk(KERN_WARNING "ipt_time: invalid argument: start
or stop time greater than 24h\n");
return 0;
}
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] Time match in mangle/POSTROUTING?
2006-12-18 17:19 [PATCH] Time match in mangle/POSTROUTING? Alejandro David Galera Ruiz
@ 2006-12-19 12:10 ` Patrick McHardy
2006-12-19 13:24 ` Alejandro David Galera Ruiz
0 siblings, 1 reply; 5+ messages in thread
From: Patrick McHardy @ 2006-12-19 12:10 UTC (permalink / raw)
To: Alejandro David Galera Ruiz; +Cc: brad, netfilter-devel
Alejandro David Galera Ruiz wrote:
> I'm trying to use netfilter with classify and temporal filters. Due to I
> realised that POSTROUTING wasn't supported in mangle table, I decided to
> patch ipt_time module following Brad Fisher's PATCH.
>
> I've tried to update this patch for kernel 2.6.17 and the lastest
> version of patch-o-matic (20061213).
> It's my first contribution to this project, I hope to be a little bit
> useful for your great project.
>
> Using:
> Patch-o-matic 20061213
>
> Modifications:
>
> * Time modification (the same from Brad Fisher
> http://lists.netfilter.org/pipermail/netfilter-devel/2003-December/013367.html)
Your mailer mangled the patch, please resend as attachment.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] Time match in mangle/POSTROUTING?
2006-12-19 12:10 ` Patrick McHardy
@ 2006-12-19 13:24 ` Alejandro David Galera Ruiz
0 siblings, 0 replies; 5+ messages in thread
From: Alejandro David Galera Ruiz @ 2006-12-19 13:24 UTC (permalink / raw)
To: Patrick McHardy; +Cc: brad, netfilter-devel
[-- Attachment #1: Type: text/plain, Size: 1294 bytes --]
El mar, 19-12-2006 a las 13:10 +0100, Patrick McHardy escribió:
> Your mailer mangled the patch, please resend as attachment.
>
>
I'm trying to use netfilter with classify and temporal filters. Due to I
realised that POSTROUTING wasn't supported in mangle table, I decided to
patch ipt_time module following Brad Fisher's PATCH.
I've tried to update this patch for kernel 2.6.17 and the lastest
version of patch-o-matic (20061213).
It's my first contribution to this project, I hope to be a little bit
useful for your great project.
Using:
Patch-o-matic 20061213
Modifications:
* Time modification (the same from Brad Fisher
http://lists.netfilter.org/pipermail/netfilter-devel/2003-December/013367.html)
> >Brad Fisher wrote:
> >
> >* I don't see any reason why the above approach
> > wouldn't work in any chain, so I
> > removed the check from checkentry.
* I think it could be more deffensive and flexible in the future if we
add NF_IP_POST_ROUTING checking to checkentry function instead of quit
any verification.
* System message according to let POST_ROUTING.
* System warning message specifying invalid argument is due to time
higher than 24h (it also has been taken from Brad Fisher's patch)
All your suggestions, indications or tests will be wellcome
Thanks in advance
[-- Attachment #2: ipt_time-pom-20061213.patch --]
[-- Type: text/x-patch, Size: 1811 bytes --]
--- ipt_time.c.old 2006-12-14 19:21:10.000000000 +0100
+++ ipt_time.c 2006-12-14 19:12:20.000000000 +0100
@@ -79,8 +79,15 @@
/* ... check the time now */
packet_time = (currenttime.tm_hour * 60) + currenttime.tm_min;
- if ((packet_time < info->time_start) || (packet_time >
info->time_stop))
- return 0;
+ if (info->time_start <= info->time_stop) {
+ /* normal order: start <= stop */
+ if ((packet_time < info->time_start) || (packet_time >
info->time_stop))
+ return 0;
+ } else {
+ /* reversed order: stop < start */
+ if ((packet_time < info->time_start) && (packet_time >
info->time_stop))
+ return 0;
+ }
/* here we match ! */
return 1;
@@ -104,9 +111,9 @@
/* First, check that we are in the correct hooks */
if (hook_mask
- & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_IN) | (1
<< NF_IP_FORWARD) | (1 << NF_IP_LOCAL_OUT)))
+ & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_IN) | (1
<< NF_IP_FORWARD) | (1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_POST_ROUTING)))
{
- printk("ipt_time: error, only valid for PRE_ROUTING,
LOCAL_IN, FORWARD and OUTPUT)\n");
+ printk("ipt_time: error, only valid for PRE_ROUTING,
POST_ROUTING, LOCAL_IN, FORWARD and OUTPUT)\n");
return 0;
}
@@ -120,7 +127,7 @@
if ((info->time_start > 1439) || /* 23*60+59 = 1439*/
(info->time_stop > 1439))
{
- printk(KERN_WARNING "ipt_time: invalid argument\n");
+ printk(KERN_WARNING "ipt_time: invalid argument: start
or stop time greater than 24h\n");
return 0;
}
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] Time match in mangle/POSTROUTING?
@ 2006-12-19 15:08 Alejandro David Galera Ruiz
0 siblings, 0 replies; 5+ messages in thread
From: Alejandro David Galera Ruiz @ 2006-12-19 15:08 UTC (permalink / raw)
To: netfilter-devel
[-- Attachment #1: Type: text/plain, Size: 1160 bytes --]
I'm trying to use netfilter with classify and temporal filters. Due to I
realised that POSTROUTING wasn't supported in mangle table, I decided to
patch ipt_time module following Brad Fisher's PATCH.
I've tried to update this patch for kernel 2.6.17 and the lastest
version of patch-o-matic (20061213).
It's my first contribution to this project, I hope to be a little bit
useful for your great project.
Using:
Patch-o-matic 20061213
Modifications:
* Time modification (the same from Brad Fisher
http://lists.netfilter.org/pipermail/netfilter-devel/2003-December/013367.html)
> >Brad Fisher wrote:
> >
> >* I don't see any reason why the above approach
> > wouldn't work in any chain, so I
> > removed the check from checkentry.
* I think it could be more deffensive and flexible in the future if we
add NF_IP_POST_ROUTING checking to checkentry function instead of quit
any verification.
* System message according to let POST_ROUTING.
* System warning message specifying invalid argument is due to time
higher than 24h (it also has been taken from Brad Fisher's patch)
All your suggestions, indications or tests will be wellcome
Thanks in advance
[-- Attachment #2: ipt_time-pom-20061213.patch --]
[-- Type: text/x-patch, Size: 1811 bytes --]
--- ipt_time.c.old 2006-12-14 19:21:10.000000000 +0100
+++ ipt_time.c 2006-12-14 19:12:20.000000000 +0100
@@ -79,8 +79,15 @@
/* ... check the time now */
packet_time = (currenttime.tm_hour * 60) + currenttime.tm_min;
- if ((packet_time < info->time_start) || (packet_time >
info->time_stop))
- return 0;
+ if (info->time_start <= info->time_stop) {
+ /* normal order: start <= stop */
+ if ((packet_time < info->time_start) || (packet_time >
info->time_stop))
+ return 0;
+ } else {
+ /* reversed order: stop < start */
+ if ((packet_time < info->time_start) && (packet_time >
info->time_stop))
+ return 0;
+ }
/* here we match ! */
return 1;
@@ -104,9 +111,9 @@
/* First, check that we are in the correct hooks */
if (hook_mask
- & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_IN) | (1
<< NF_IP_FORWARD) | (1 << NF_IP_LOCAL_OUT)))
+ & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_IN) | (1
<< NF_IP_FORWARD) | (1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_POST_ROUTING)))
{
- printk("ipt_time: error, only valid for PRE_ROUTING,
LOCAL_IN, FORWARD and OUTPUT)\n");
+ printk("ipt_time: error, only valid for PRE_ROUTING,
POST_ROUTING, LOCAL_IN, FORWARD and OUTPUT)\n");
return 0;
}
@@ -120,7 +127,7 @@
if ((info->time_start > 1439) || /* 23*60+59 = 1439*/
(info->time_stop > 1439))
{
- printk(KERN_WARNING "ipt_time: invalid argument\n");
+ printk(KERN_WARNING "ipt_time: invalid argument: start
or stop time greater than 24h\n");
return 0;
}
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2006-12-19 15:08 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-12-18 17:19 [PATCH] Time match in mangle/POSTROUTING? Alejandro David Galera Ruiz
2006-12-19 12:10 ` Patrick McHardy
2006-12-19 13:24 ` Alejandro David Galera Ruiz
-- strict thread matches above, loose matches on Subject: below --
2006-12-19 11:54 Alejandro David Galera Ruiz
2006-12-19 15:08 Alejandro David Galera Ruiz
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.