addrtype match
PATCH RESEND 1/1 addrtype match
This patch adds support for the addrtype match which matches what routing thinks of an address. Since last post i renamed the options again, they are now named src-type and dst-type which fits better with other matches.
Is there a chance this is going to be accepted ? Otherwise i'll stop resending.
Best regards,
Patrick
patch-o-matic/extra/addrtype.patch +84 -0
@@ -0,0 +1,84 @@ +diff -urN a/include/linux/netfilter_ipv4/ipt_addrtype.h b/include/linux/netfilter_ipv4/ipt_addrtype.h +--- a/include/linux/netfilter_ipv4/ipt_addrtype.h 1970-01-01 01:00:00.000000000 +0100 ++++ b/include/linux/netfilter_ipv4/ipt_addrtype.h 2003-04-09 13:42:03.000000000 +0200 +@@ -0,0 +1,11 @@ ++#ifndef _IPT_ADDRTYPE_H ++#define _IPT_ADDRTYPE_H ++ ++struct ipt_addrtype_info { ++ u_int16_t source; /* source-type mask */ ++ u_int16_t dest; /* dest-type mask */ ++ int invert_source; ++ int invert_dest; ++}; ++ ++#endif +diff -urN a/net/ipv4/netfilter/ipt_addrtype.c b/net/ipv4/netfilter/ipt_addrtype.c +--- a/net/ipv4/netfilter/ipt_addrtype.c 1970-01-01 01:00:00.000000000 +0100 ++++ b/net/ipv4/netfilter/ipt_addrtype.c 2003-04-09 13:43:50.000000000 +0200 +@@ -0,0 +1,65 @@ ++/* ++ * iptables module to match inet_addr_type() of an ip. ++ */ ++ ++#include <linux/module.h> ++#include <linux/skbuff.h> ++#include <linux/netdevice.h> ++#include <net/route.h> ++ ++#include <linux/netfilter_ipv4/ipt_addrtype.h> ++#include <linux/netfilter_ipv4/ip_tables.h> ++ ++MODULE_LICENSE("GPL"); ++ ++static inline int match_type(u_int32_t addr, u_int16_t mask) ++{ ++ return !!(mask & (1 << inet_addr_type(addr))); ++} ++ ++static int match(const struct sk_buff *skb, const struct net_device *in, ++ const struct net_device *out, const void *matchinfo, ++ int offset, const void *hdr, u_int16_t datalen, ++ int *hotdrop) ++{ ++ const struct ipt_addrtype_info *info = matchinfo; ++ const struct iphdr *iph = skb->nh.iph; ++ int ret = 1; ++ ++ if (info->source) ++ ret &= match_type(iph->saddr, info->source)^info->invert_source; ++ if (info->dest) ++ ret &= match_type(iph->daddr, info->dest)^info->invert_dest; ++ ++ return ret; ++} ++ ++static int checkentry(const char *tablename, const struct ipt_ip *ip, ++ void *matchinfo, unsigned int matchsize, ++ unsigned int hook_mask) ++{ ++ if (matchsize != IPT_ALIGN(sizeof(struct ipt_addrtype_info))) { ++ printk(KERN_ERR "ipt_addrtype: invalid size (%u != %u)\n.", ++ matchsize, IPT_ALIGN(sizeof(struct ipt_addrtype_info))); ++ return 0; ++ } ++ ++ return 1; ++} ++ ++static struct ipt_match addrtype_match = { { NULL, NULL }, "addrtype", &match, ++ &checkentry, NULL, THIS_MODULE }; ++ ++static int __init init(void) ++{ ++ return ipt_register_match(&addrtype_match); ++} ++ ++static void __exit fini(void) ++{ ++ ipt_unregister_match(&addrtype_match); ++ ++} ++ ++module_init(init); ++module_exit(fini);
patch-o-matic/extra/addrtype.patch.config.in +2 -0
@@ -0,0 +1,2 @@ + dep_tristate ' TTL match support' CONFIG_IP_NF_MATCH_TTL $CONFIG_IP_NF_IPTABLES + dep_tristate ' address type match support' CONFIG_IP_NF_MATCH_ADDRTYPE $CONFIG_IP_NF_IPTABLES
patch-o-matic/extra/addrtype.patch.configure.help +8 -0
@@ -0,0 +1,8 @@ +CONFIG_IP_NF_MATCH_LIMIT +addrtype match support +CONFIG_IP_NF_MATCH_ADDRTYPE + This option allows you to match what routing thinks of an address, + eg. UNICAST, LOCAL, BROADCAST, ... + + If you want to compile it as a module, say M here and read + Documentation/modules.txt. If unsure, say `N'.
patch-o-matic/extra/addrtype.patch.help +28 -0
@@ -0,0 +1,28 @@ +Author: Patrick McHardy <[email protected]> +Status: Working + +This match allows you to match address types as seen by the routing code. +Valid types (from include/linux/rtnetlink.h) are: + +UNSPEC +UNICAST +LOCAL +BROADCAST +ANYCAST +MULTICAST +BLACKHOLE +UNREACHABLE +PROHIBIT +THROW +NAT +XRESOLVE + +Usage: + -m addrtype --src-type type[,type..] --dst-type type[,type..] + +Example: + + iptables ... -m addrtype --src-type LOCAL ... + iptables ... -m addrtype --dst-type ANYCAST ... + +
patch-o-matic/extra/addrtype.patch.makefile +2 -0
@@ -0,0 +1,2 @@ +obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o +obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
userspace/extensions/.addrtype-test +5 -0
@@ -0,0 +1,5 @@ +#!/bin/bash + +if test -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_addrtype.h; then + echo "addrtype" +fi
userspace/extensions/libipt_addrtype.c +214 -0
214 lines not on this page · raw message
Quoted 7 lines · Patrick McHardy
This patch adds support for the addrtype match which matches what routing thinks of an address. Since last post i renamed the options again, they are now named src-type and dst-type which fits better with other matches.
Is there a chance this is going to be accepted ? Otherwise i'll stop resending.
I've added this to cvs. Sorry about the delay.
Signature · 1 line
/Martin