new match (equal)
PATCH 1/1 new match (equal)
Hello!
This is a new match to check for equal IPs and/or devices. Maybe it's of any use to somebody else...
Please add it patch-o-matic-ng.
Comments welcome!
Regards
Sven Anders
Signature · 5 lines
Sven Anders <[email protected]> () Ascii Ribbon Campaign /\ Support plain text e-mail ANDURAS service solutions AG Innstraße 71 - 94036 Passau - Germany Web: www.anduras.de - Tel: +49 (0)851-4 90 50-0 - Fax: +49 (0)851-4 90 50-55
patchlets/equal/help +4 -0
@@ -0,0 +1,4 @@ +Kernel module to match + - equal src/dest addresses + - equal in/out devices + - equal physical in/out devices
patchlets/equal/info +7 -0
@@ -0,0 +1,7 @@ +Title: iptables `equal' match +Author: Sven Anders <[email protected]> +Status: Stable +Requires: linux-2.6 >= 2.6.16 +Recompile: netfilter, iptables +Repository: extra +
patchlets/equal/iptables/extensions/.equal-test +2 -0
@@ -0,0 +1,2 @@ +#! /bin/sh +[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_equal.h ] && echo equal
patchlets/equal/iptables/extensions/.equal-test6 +2 -0
@@ -0,0 +1,2 @@ +#! /bin/sh +[ -f $KERNEL_DIR/include/linux/netfilter_ipv6/ip6t_equal.h ] && echo equal
patchlets/equal/iptables/extensions/libip6t_equal.c +153 -0
153 lines not on this page · raw message
patchlets/equal/iptables/extensions/libip6t_equal.man +12 -0
@@ -0,0 +1,12 @@ +This module matches on equal or unequal source and destination IP addresses, +on equal or unequal input and output devices (normal and physical devices). +.TP +.BI "--ips" +Test if source and destination IP addresses are equal. +.TP +.BI "--devices" +Test if input and output devices are equal. +.TP +.BI "--phys-devices" +Test if the physical input and output devices are equal. +This is only useful if your are using bridged devices.
patchlets/equal/iptables/extensions/libipt_equal.c +154 -0
154 lines not on this page · raw message
patchlets/equal/iptables/extensions/libipt_equal.man +12 -0
@@ -0,0 +1,12 @@ +This module matches on equal or unequal source and destination IP addresses, +on equal or unequal input and output devices (normal and physical devices). +.TP +.BI "--ips" +Test if source and destination IP addresses are equal. +.TP +.BI "--devices" +Test if input and output devices are equal. +.TP +.BI "--phys-devices" +Test if the physical input and output devices are equal. +This is only useful if your are using bridged devices.
patchlets/equal/linux-2.6/Documentation/Configure.help.ladd +8 -0
@@ -0,0 +1,8 @@ +NETFILTER_XT_MATCH_TCPMSS +"equal" match support +NETFILTER_XT_MATCH_EQUAL + This option adds a `equal' match, which allows you to match for + equal source and destination addresses, equal in and out devices + and/or equal physical in and out devices. + + To compile it as a module, choose M here. If unsure, say N.
patchlets/equal/linux-2.6/include/linux/netfilter/xt_equal.h +17 -0
@@ -0,0 +1,17 @@ +#ifndef _XT_EQUAL_H +#define _XT_EQUAL_H + +#define XT_EQUAL_NONE 0x00 + +#define XT_EQUAL_IPS 0x01/* test for (un)equal source/dest IPs */ +#define XT_EQUAL_DEVICES 0x02/* test for (un)equal in/out devices */ +#define XT_EQUAL_PHYS_DEVICES 0x04/* test for (un)equal physical in/out devices */ + +#define XT_EQUAL_ALL 0xFF + +struct xt_equal_info { +u_int8_t inv; +u_int8_t flags; +}; + +#endif /*_XT_EQUAL_H*/
patchlets/equal/linux-2.6/include/linux/netfilter_ipv4/ipt_equal.h +16 -0
@@ -0,0 +1,16 @@ +#ifndef _IPT_EQUAL_H +#define _IPT_EQUAL_H + +/* Backwards compatibility for old userspace */ + +#include <linux/netfilter/xt_equal.h> + +#define IPT_EQUAL_NONE XT_EQUAL_NONE +#define IPT_EQUAL_IPS XT_EQUAL_IPS +#define IPT_EQUAL_DEVICES XT_EQUAL_DEVICES +#define IPT_EQUAL_PHYS_DEVICES XT_EQUAL_PHYS_DEVICES +#define IPT_EQUAL_ALL XT_EQUAL_ALL + +#define ipt_equal_info xt_equal_info + +#endif /*_IPT_EQUAL_H*/
patchlets/equal/linux-2.6/include/linux/netfilter_ipv6/ip6t_equal.h +16 -0
@@ -0,0 +1,16 @@ +#ifndef _IP6T_EQUAL_H +#define _IP6T_EQUAL_H + +/* Backwards compatibility for old userspace */ + +#include <linux/netfilter/xt_equal.h> + +#define IP6T_EQUAL_NONE XT_EQUAL_NONE +#define IP6T_EQUAL_IPS XT_EQUAL_IPS +#define IP6T_EQUAL_DEVICES XT_EQUAL_DEVICES +#define IP6T_EQUAL_PHYS_DEVICES XT_EQUAL_PHYS_DEVICES +#define IP6T_EQUAL_ALL XT_EQUAL_ALL + +#define ip6t_equal_info xt_equal_info + +#endif /*_IP6T_EQUAL_H*/
patchlets/equal/linux-2.6/net/netfilter/Kconfig.ladd +9 -0
@@ -0,0 +1,9 @@ +config NETFILTER_XT_MATCH_EQUAL + tristate '"equal" match support' + depends on NETFILTER_XTABLES + help + This option adds a `equal' match, which allows you to match for + equal source and destination addresses, equal in and out devices + and/or equal physical in and out devices. + + To compile it as a module, choose M here. If unsure, say N.
patchlets/equal/linux-2.6/net/netfilter/Makefile.ladd +2 -0
@@ -0,0 +1,2 @@ +obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o +obj-$(CONFIG_NETFILTER_XT_MATCH_EQUAL) += xt_equal.o
patchlets/equal/linux-2.6/net/netfilter/xt_equal.c +154 -0
154 lines not on this page · raw message
y
Quoted 6 lines · Sven Anders
Hello!
This is a new match to check for equal IPs and/or devices. Maybe it's of any use to somebody else...
Please add it patch-o-matic-ng.
I'm not sure this is something we want to take care of ourselves, but feel free to send me a URL to an external repository to include.
Quoted 1 line
Comments welcome!
This mainly shows too me that we really want something like the meta ematch (but also for non-meta data), which would also obsolete all matches that basically only compare a single attribute of a packet (or do range matches or something like that).