[NETFILTER]: x_tables: unify IPv4/IPv6 multiport match

This unifies ipt_multiport and ip6t_multiport to xt_multiport.
As a result, this addes support for inversion and port range match
to IPv6 packets.

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

12 files changed, 372 insertions, 381 deletions

diff --git a/include/linux/netfilter/xt_multiport.h b/include/linux/netfilter/xt_multiport.h
new file mode 100644
index 0000000000..d49ee41837
--- /dev/null
+++ b/include/linux/netfilter/xt_multiport.h
@@ -0,0 +1,30 @@
+#ifndef _XT_MULTIPORT_H
+#define _XT_MULTIPORT_H
+
+enum xt_multiport_flags
+{
+        XT_MULTIPORT_SOURCE,
+        XT_MULTIPORT_DESTINATION,
+        XT_MULTIPORT_EITHER
+};
+
+#define XT_MULTI_PORTS  15
+
+/* Must fit inside union xt_matchinfo: 16 bytes */
+struct xt_multiport
+{
+        u_int8_t flags;                         /* Type of comparison */
+        u_int8_t count;                         /* Number of ports */
+        u_int16_t ports[XT_MULTI_PORTS];        /* Ports */
+};
+
+struct xt_multiport_v1
+{
+        u_int8_t flags;                         /* Type of comparison */
+        u_int8_t count;                         /* Number of ports */
+        u_int16_t ports[XT_MULTI_PORTS];        /* Ports */
+        u_int8_t pflags[XT_MULTI_PORTS];        /* Port flags */
+        u_int8_t invert;                        /* Invert flag */
+};
+
+#endif /*_XT_MULTIPORT_H*/
diff --git a/include/linux/netfilter_ipv4/ipt_multiport.h b/include/linux/netfilter_ipv4/ipt_multiport.h
index e6b6fff811..55fe85eca8 100644
--- a/include/linux/netfilter_ipv4/ipt_multiport.h
+++ b/include/linux/netfilter_ipv4/ipt_multiport.h
@@ -1,30 +1,15 @@
 #ifndef _IPT_MULTIPORT_H
 #define _IPT_MULTIPORT_H
-#include <linux/netfilter_ipv4/ip_tables.h>
 
-enum ipt_multiport_flags
-{
-        IPT_MULTIPORT_SOURCE,
-        IPT_MULTIPORT_DESTINATION,
-        IPT_MULTIPORT_EITHER
-};
+#include <linux/netfilter/xt_multiport.h>
 
-#define IPT_MULTI_PORTS 15
+#define IPT_MULTIPORT_SOURCE            XT_MULTIPORT_SOURCE
+#define IPT_MULTIPORT_DESTINATION       XT_MULTIPORT_DESTINATION
+#define IPT_MULTIPORT_EITHER            XT_MULTIPORT_EITHER
 
-/* Must fit inside union ipt_matchinfo: 16 bytes */
-struct ipt_multiport
-{
-        u_int8_t flags;                         /* Type of comparison */
-        u_int8_t count;                         /* Number of ports */
-        u_int16_t ports[IPT_MULTI_PORTS];       /* Ports */
-};
+#define IPT_MULTI_PORTS                 XT_MULTI_PORTS
+
+#define ipt_multiport                   xt_multiport
+#define ipt_multiport_v1                xt_multiport_v1
 
-struct ipt_multiport_v1
-{
-        u_int8_t flags;                         /* Type of comparison */
-        u_int8_t count;                         /* Number of ports */
-        u_int16_t ports[IPT_MULTI_PORTS];       /* Ports */
-        u_int8_t pflags[IPT_MULTI_PORTS];       /* Port flags */
-        u_int8_t invert;                        /* Invert flag */
-};
 #endif /*_IPT_MULTIPORT_H*/
diff --git a/include/linux/netfilter_ipv6/ip6t_multiport.h b/include/linux/netfilter_ipv6/ip6t_multiport.h
index efe4954a86..042c92661c 100644
--- a/include/linux/netfilter_ipv6/ip6t_multiport.h
+++ b/include/linux/netfilter_ipv6/ip6t_multiport.h
@@ -1,21 +1,14 @@
 #ifndef _IP6T_MULTIPORT_H
 #define _IP6T_MULTIPORT_H
-#include <linux/netfilter_ipv6/ip6_tables.h>
 
-enum ip6t_multiport_flags
-{
-        IP6T_MULTIPORT_SOURCE,
-        IP6T_MULTIPORT_DESTINATION,
-        IP6T_MULTIPORT_EITHER
-};
+#include <linux/netfilter/xt_multiport.h>
 
-#define IP6T_MULTI_PORTS        15
+#define IP6T_MULTIPORT_SOURCE           XT_MULTIPORT_SOURCE
+#define IP6T_MULTIPORT_DESTINATION      XT_MULTIPORT_DESTINATION
+#define IP6T_MULTIPORT_EITHER           XT_MULTIPORT_EITHER
 
-/* Must fit inside union ip6t_matchinfo: 16 bytes */
-struct ip6t_multiport
-{
-        u_int8_t flags;                         /* Type of comparison */
-        u_int8_t count;                         /* Number of ports */
-        u_int16_t ports[IP6T_MULTI_PORTS];      /* Ports */
-};
-#endif /*_IPT_MULTIPORT_H*/
+#define IP6T_MULTI_PORTS                XT_MULTI_PORTS
+
+#define ip6t_multiport                  xt_multiport
+
+#endif /*_IP6T_MULTIPORT_H*/
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index ebbd644fa8..77855ccd6b 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -221,16 +221,6 @@ config IP_NF_MATCH_IPRANGE
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP_NF_MATCH_MULTIPORT
-        tristate "Multiple port match support"
-        depends on IP_NF_IPTABLES
-        help
-          Multiport matching allows you to match TCP or UDP packets based on
-          a series of source or destination ports: normally a rule can only
-          match a single range of ports.
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
 config IP_NF_MATCH_TOS
         tristate "TOS match support"
         depends on IP_NF_IPTABLES
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 09ae167632..461cb1eb5d 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -53,7 +53,6 @@ obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
 # matches
 obj-$(CONFIG_IP_NF_MATCH_HASHLIMIT) += ipt_hashlimit.o
 obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
-obj-$(CONFIG_IP_NF_MATCH_MULTIPORT) += ipt_multiport.o
 obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
 obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
 obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
diff --git a/net/ipv4/netfilter/ipt_multiport.c b/net/ipv4/netfilter/ipt_multiport.c
deleted file mode 100644
index ac95d8390b..0000000000
--- a/net/ipv4/netfilter/ipt_multiport.c
+++ /dev/null
@@ -1,195 +0,0 @@
-/* Kernel module to match one of a list of TCP/UDP ports: ports are in
-   the same place so we can treat them as equal. */
-
-/* (C) 1999-2001 Paul `Rusty' Russell
- * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/udp.h>
-#include <linux/skbuff.h>
-
-#include <linux/netfilter_ipv4/ipt_multiport.h>
-#include <linux/netfilter_ipv4/ip_tables.h>
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
-MODULE_DESCRIPTION("iptables multiple port match module");
-
-#if 0
-#define duprintf(format, args...) printk(format , ## args)
-#else
-#define duprintf(format, args...)
-#endif
-
-/* Returns 1 if the port is matched by the test, 0 otherwise. */
-static inline int
-ports_match(const u_int16_t *portlist, enum ipt_multiport_flags flags,
-            u_int8_t count, u_int16_t src, u_int16_t dst)
-{
-        unsigned int i;
-        for (i=0; i<count; i++) {
-                if (flags != IPT_MULTIPORT_DESTINATION
-                    && portlist[i] == src)
-                        return 1;
-
-                if (flags != IPT_MULTIPORT_SOURCE
-                    && portlist[i] == dst)
-                        return 1;
-        }
-
-        return 0;
-}
-
-/* Returns 1 if the port is matched by the test, 0 otherwise. */
-static inline int
-ports_match_v1(const struct ipt_multiport_v1 *minfo,