forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

netfilter: add IPv4/6 IPComp extension match support

Browse source 
With this plugin, user could specify IPComp tagged with certain
CPI that host not interested will be DROPped or any other action.

For example:
iptables  -A INPUT -p 108 -m ipcomp --ipcompspi 0x87 -j DROP
ip6tables -A INPUT -p 108 -m ipcomp --ipcompspi 0x87 -j DROP

Then input IPComp packet with CPI equates 0x87 will not reach
upper layer anymore.

Signed-off-by: Fan Du <fan.du@windriver.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
fan.du 2013-12-18 11:27:02 +08:00 • committed by Pablo Neira Ayuso
commit 6a649f3398
5 changed files with 138 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
include/uapi/linux/netfilter/Kbuild
View file

@ -54,6 +54,7 @@ header-y += xt_ecn.h
header-y += xt_esp.h
header-y += xt_hashlimit.h
header-y += xt_helper.h
header-y += xt_ipcomp.h
header-y += xt_iprange.h
header-y += xt_ipvs.h
header-y += xt_length.h

16
include/uapi/linux/netfilter/xt_ipcomp.h Normal file
View file

@ -0,0 +1,16 @@
#ifndef _XT_IPCOMP_H
#define _XT_IPCOMP_H
#include <linux/types.h>
struct xt_ipcomp {
__u32 spis[2]; /* Security Parameter Index */
__u8 invflags; /* Inverse flags */
__u8 hdrres; /* Test of the Reserved Filed */
};
/* Values for "invflags" field in struct xt_ipcomp. */
#define XT_IPCOMP_INV_SPI 0x01 /* Invert the sense of spi. */
#define XT_IPCOMP_INV_MASK 0x01 /* All possible flags. */
#endif /*_XT_IPCOMP_H*/