: port physdev to ip6tables

Hi Dave,

at the netfilter workshop Harald and I agreed that it would be easier if I would submit netfilter patches directly to you, if you don't mind. I'll try not to clash with Harald. If you're fine with this, here is the first one:

[email protected], 2004-09-16 17:45:08+02:00, [email protected]
[NETFILTER]: port physdev to ip6tables

According to Bart, the physdev module is essential for people wanting to filter bridged IPv6 frames.

You can also pull the patch from bk://212.42.230.204/net-2.6

# This is a BitKeeper generated diff -Nru style patch. #
# ChangeSet
# 2004/09/16 17:45:08+02:00 [email protected]
# [NETFILTER]: port physdev to ip6tables
#
# Signed-off-by: Bart De Schuymer <[email protected]>
# Signed-off-by: Patrick McHardy <[email protected]>
#

# net/ipv6/netfilter/ip6t_physdev.c
#   2004/09/16 17:44:45+02:00 [email protected] +136 -0
# 
# net/ipv6/netfilter/ip6t_physdev.c
#   2004/09/16 17:44:45+02:00 [email protected] +0 -0
#   BitKeeper file /home/kaber/src/net/net-2.6/net/ipv6/netfilter/ip6t_physdev.c
# 
# include/linux/netfilter_ipv6/ip6t_physdev.h
#   2004/09/16 17:44:43+02:00 [email protected] +24 -0
# 
# net/ipv6/netfilter/Makefile
#   2004/09/16 17:44:43+02:00 [email protected] +1 -0
#   [NETFILTER]: port physdev to ip6tables
# 
# net/ipv6/netfilter/Kconfig
#   2004/09/16 17:44:43+02:00 [email protected] +9 -0
#   [NETFILTER]: port physdev to ip6tables
# 
# include/linux/netfilter_ipv6/ip6t_physdev.h
#   2004/09/16 17:44:43+02:00 [email protected] +0 -0
#   BitKeeper file /home/kaber/src/net/net-2.6/include/linux/netfilter_ipv6/ip6t_physdev.h
# 
diff -Nru a/include/linux/netfilter_ipv6/ip6t_physdev.h b/include/linux/netfilter_ipv6/ip6t_physdev.h
--- /dev/null	Wed Dec 31 16:00:00 196900
+++ b/include/linux/netfilter_ipv6/ip6t_physdev.h	2004-09-16 18:30:22 +02:00
@@ -0,0 +1,24 @@
+#ifndef _IP6T_PHYSDEV_H
+#define _IP6T_PHYSDEV_H
+
+#ifdef __KERNEL__
+#include <linux/if.h>
+#endif
+
+#define IP6T_PHYSDEV_OP_IN		0x01
+#define IP6T_PHYSDEV_OP_OUT		0x02
+#define IP6T_PHYSDEV_OP_BRIDGED		0x04
+#define IP6T_PHYSDEV_OP_ISIN		0x08
+#define IP6T_PHYSDEV_OP_ISOUT		0x10
+#define IP6T_PHYSDEV_OP_MASK		(0x20 - 1)
+
+struct ip6t_physdev_info {
+	char physindev[IFNAMSIZ];
+	char in_mask[IFNAMSIZ];
+	char physoutdev[IFNAMSIZ];
+	char out_mask[IFNAMSIZ];
+	u_int8_t invert;
+	u_int8_t bitmask;
+};
+
+#endif /*_IP6T_PHYSDEV_H*/
diff -Nru a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
--- a/net/ipv6/netfilter/Kconfig	2004-09-16 18:30:22 +02:00
+++ b/net/ipv6/netfilter/Kconfig	2004-09-16 18:30:22 +02:00
@@ -158,6 +158,15 @@

To compile it as a module, choose M here. If unsure, say N.

+config IP6_NF_MATCH_PHYSDEV
+ tristate "Physdev match support"
+ depends on IP6_NF_IPTABLES && BRIDGE_NETFILTER
+ help
+ Physdev packet matching matches against the physical bridge ports
+ the IP packet arrived on or will leave by.
+
+ To compile it as a module, choose M here. If unsure, say N.
+

 #  dep_tristate '  Multiple port match support' CONFIG_IP6_NF_MATCH_MULTIPORT $CONFIG_IP6_NF_IPTABLES
 #  dep_tristate '  TOS match support' CONFIG_IP6_NF_MATCH_TOS $CONFIG_IP6_NF_IPTABLES
 #  if [ "$CONFIG_IP6_NF_CONNTRACK" != "n" ]; then

diff -Nru a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
@@ -16,6 +16,7 @@
 obj-$(CONFIG_IP6_NF_MATCH_EUI64) += ip6t_eui64.o
 obj-$(CONFIG_IP6_NF_MATCH_MULTIPORT) += ip6t_multiport.o
 obj-$(CONFIG_IP6_NF_MATCH_OWNER) += ip6t_owner.o
+obj-$(CONFIG_IP6_NF_MATCH_PHYSDEV) += ip6t_physdev.o
 obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
 obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
 obj-$(CONFIG_IP6_NF_TARGET_MARK) += ip6t_MARK.o

I'm totally fine with this.

Applied, thanks guys.