Comment match

Attached is a comment match which I wrote a while back. I was hoping that maybe it would be suitable for inclusion in patch-o-matic. Basically this allows one to add a comment to any rule as follows:

iptables -A INPUT -m comment --comment "This is a comment" <other
stuff here>

Currently, comments are limited to 255 bytes because of a statically allocated buffer. For iptables-save to work correctly, it may be a good idea not to use comments with double-quote chars (") or line breaks/new lines. The code doesn't currently check this.

Hope someone finds this helpful.

-Brad

dep_tristate ' tcpmss match support' CONFIG_IP_NF_MATCH_TCPMSS $CONFIG_IP_NF_IPTABLES dep_tristate ' comment match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_COMMENT $CONFIG_IP_NF_IPTABLES

diff -ruN linux-2.4.20/include/linux/netfilter_ipv4/ipt_comment.h linux-2.4.20-comment/include/linux/netfilter_ipv4/ipt_comment.h
@@ -0,0 +1,10 @@
+#ifndef _IPT_COMMENT_H
+#define _IPT_COMMENT_H
+
+#define IPT_MAX_COMMENT_LEN 256
+
+struct ipt_comment_info {
+  char comment[IPT_MAX_COMMENT_LEN];
+};
+
+#endif /* _IPT_COMMENT_H */

CONFIG_IP_NF_MATCH_TCPMSS
COMMENT match support CONFIG_IP_NF_MATCH_COMMENT
This option adds a `comment' match, which allows you to associate a comment string with any rule.

If you say Y here, try iptables -m comment --help for more information.

If you want to compile it as a module, say M here and read Documentation/modules.txt. If unsure, say `N'.

Author: Brad Fisher <[email protected]>
Status: It Works For Me.

This option adds CONFIG_IP_NF_MATCH_COMMENT, which supplies a comment match module. This match allows you to add comments (up to 256 characters) to any rule.

Supported options:
--comment COMMENT

Example:
-A INPUT -s 192.168.0.0/16 -c comment --comment "A privatized IP block"

obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o

obj-$(CONFIG_IP_NF_MATCH_COMMENT) += ipt_comment.o

diff -ruN iptables-1.2.8/extensions/.comment-test iptables-1.2.8-comment-new/extensions/.comment-test
@@ -0,0 +1,3 @@
+#!/bin/sh
+[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_comment.h ] && echo comment
+