ipt_mask

Hi, i've made a netfilter match module called ipt_mask. Basically it provides arbitrary mask syntax to do a match whit the destination address. ie:

iptables -m mask --mask 0x01,0x00 -j MARK --set-mark 6900 iptables -m mask --mask 0x01,0x01 -j MARK --set-mark 6901

will logical AND the first parameter(and_mask) whit the daddress and then compare the result whit the second parameter(cmpr_mask) As result it is MARKing whit 6900 the even daddress and whit 6901 the odd daddress.

It works for me to do a dirty ;-) load balancing between to or more providers.

I guess maybe can be usefull(?) to match broadcast address using ie:
iptables -m mask --mask 0xF,0xF

Whell if you see it is usefull in some way i will be glad to make a working patch against the las patch-o-matic version (this patchs are againsta iptables-1.2.7a and linux-2.4.19). Anyway i have a lot of fun doing it :-)

Suegestion/modifications are welcome. This is my first hack ever, so it maybe look like a newbie has code it =).

Attached patch also aviable at http://lupe.praga.org.ar/dev/ipt_mask/
Greetings !

--
Luciano
ps: sorry about my pour english.

diff -Naur linux-2.4.19.orig/include/linux/netfilter_ipv4/ipt_mask.h linux-2.4.19/include/linux/netfilter_ipv4/ipt_mask.h
@@ -0,0 +1,9 @@
+#ifndef _IPT_MASK_H
+#define _IPT_MASK_H
+
+
+struct ipt_mask_info {
+	u_int32_t and_mask; // mask to be ANDed whit addres
+	u_int32_t cmpr_mask; // mask to compare after AND
+};
+#endif /*_IPT_MASK_H*/

diff -Naur linux-2.4.19.orig/net/ipv4/netfilter/Config.in linux-2.4.19/net/ipv4/netfilter/Config.in
@@ -25,6 +25,8 @@
   dep_tristate '  LENGTH match support' CONFIG_IP_NF_MATCH_LENGTH $CONFIG_IP_NF_IPTABLES
   dep_tristate '  TTL match support' CONFIG_IP_NF_MATCH_TTL $CONFIG_IP_NF_IPTABLES
   dep_tristate '  tcpmss match support' CONFIG_IP_NF_MATCH_TCPMSS $CONFIG_IP_NF_IPTABLES
+  dep_tristate '  arbitrary mask syntax match support' CONFIG_IP_NF_MATCH_MASK $CONFIG_IP_NF_IPTABLES
+  
   if [ "$CONFIG_IP_NF_CONNTRACK" != "n" ]; then
     dep_tristate '  Connection state match support' CONFIG_IP_NF_MATCH_STATE $CONFIG_IP_NF_CONNTRACK $CONFIG_IP_NF_IPTABLES 
   fi

+
+static struct ipt_match mask_match
+= { { NULL, NULL }, "mask", &match, &checkentry, NULL, THIS_MODULE }; +
+static int __init init(void)
+{
+ return ipt_register_match(&mask_match);
+}
+
+static void __exit fini(void)
+{
+ ipt_unregister_match(&mask_match);
+}
+
+module_init(init);
+module_exit(fini);
+MODULE_LICENSE("GPL");
+

diff -Naur linux-2.4.19.orig/net/ipv4/netfilter/Makefile linux-2.4.19/net/ipv4/netfilter/Makefile
@@ -55,6 +55,7 @@
 obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
 obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
 obj-$(CONFIG_IP_NF_MATCH_AH_ESP) += ipt_ah.o ipt_esp.o
+obj-$(CONFIG_IP_NF_MATCH_MASK) += ipt_mask.o
 
 obj-$(CONFIG_IP_NF_MATCH_LENGTH) += ipt_length.o
 

diff -Naur iptables-1.2.7a.orig/extensions/Makefile iptables-1.2.7a/extensions/Makefile
@@ -1,6 +1,6 @@
 #! /usr/bin/make
 
-PF_EXT_SLIB:=ah conntrack dscp ecn esp helper icmp length limit mac mark multiport owner pkttype standard state tcp tcpmss tos ttl udp unclean DNAT DSCP ECN LOG MARK MASQUERADE MIRROR REDIRECT REJECT SAME SNAT TCPMSS TOS ULOG
+PF_EXT_SLIB:=ah conntrack dscp ecn esp helper icmp length limit mac mark mask multiport owner pkttype standard state tcp tcpmss tos ttl udp unclean DNAT DSCP ECN LOG MARK MASQUERADE MIRROR REDIRECT REJECT SAME SNAT TCPMSS TOS ULOG
 PF6_EXT_SLIB:=eui64 icmpv6 length limit mac mark multiport owner standard tcp udp LOG MARK
 
 # The following may not be present, but compile them anyway.

Hi, sorry for my late reply.

Due to the experimental nature of this match (and the lack of practical use, from my point of view), I will not integrate it into patch-o-matic.

I hope you will understand this,

Harald.

- Harald Welte / [email protected]               http://www.gnumonks.org/
============================================================================
"If this were a dictatorship, it'd be a heck of a lot easier, just so long
 as I'm the dictator."  --  George W. Bush Dec 18, 2000

it' is possible that netfilter make NAT or MASQ over a tcp-packet from the one net (10.0.1.0) , and back to the same net (back to the 10.0.1.0 again ) ?

                                                              ____________
My PC---->tcp request --->   eth0 -->  |                       |
(10.0.1.105)                                          |       FW          |-
eth1 -----------> - internet
                   MyWWW  <--eth0------   |___________
  -mydns
                    (10.0.1.100)

Miguel Angel Amador Lorca | mailto:[email protected]
-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCM d- s:+ a- C++++ UL+++ P- L+++ E--- W+++ N++ o K- w++ O- M- V- PS+ PE++ Y PGP- t 5 X+++ R !tv b+ DI- D G++ e- h* r- y*
------END GEEK CODE BLOCK------

Yes, by combining DNAT and SNAT. Next time post into -user mailing list, this one is for development.

Bye,

Peter Surda (Shurdeek) <[email protected]>, ICQ 10236103, +436505122023

--
If Bill Gates had a dime for every time a Windows box crashed...
...Oh, wait a minute, he already does.