: [NETFILTER]: Add policy match
Subsystems (3)
[NETFILTER]: Add policy match
Signed-off-by Patrick McHardy <[email protected]>
---
commit 84053f60747fa31fc46ccba57df29b639e509130
tree c9f2133a0b5b6df2fce4d15349d7e6ce433fc425
parent f12c4452cdb1b7d0d33a00120145e301507458e4
author Patrick McHardy <[email protected]> Fri, 11 Nov 2005 06:16:45 +0100 committer Patrick McHardy <[email protected]> Fri, 11 Nov 2005 06:16:45 +0100
include/linux/netfilter_ipv4/ipt_policy.h | 52 ++++++++ include/linux/netfilter_ipv6/ip6t_policy.h | 52 ++++++++ net/ipv4/netfilter/Kconfig | 10 ++ net/ipv4/netfilter/Makefile | 1 net/ipv4/netfilter/ipt_policy.c | 170 +++++++++++++++++++++++++++ net/ipv6/netfilter/Kconfig | 10 ++ net/ipv6/netfilter/Makefile | 1 net/ipv6/netfilter/ip6t_policy.c | 175 ++++++++++++++++++++++++++++ 8 files changed, 471 insertions(+), 0 deletions(-)
include/linux/netfilter_ipv4/ipt_policy.h new file +52 -0
@@ -0,0 +1,52 @@ +#ifndef _IPT_POLICY_H +#define _IPT_POLICY_H + +#define IPT_POLICY_MAX_ELEM 4 + +enum ipt_policy_flags +{ +IPT_POLICY_MATCH_IN =0x1 , +IPT_POLICY_MATCH_OUT =0x2 , +IPT_POLICY_MATCH_NONE =0x4 , +IPT_POLICY_MATCH_STRICT =0x8 , +}; + +enum ipt_policy_modes +{ +IPT_POLICY_MODE_TRANSPORT , +IPT_POLICY_MODE_TUNNEL +}; + +struct ipt_policy_spec +{ +u_int8_t saddr:1 , + daddr:1 , + proto:1 , + mode:1 , + spi:1 , + reqid:1 ; +}; + +struct ipt_policy_elem +{ +u_int32_t saddr; +u_int32_t smask; +u_int32_t daddr; +u_int32_t dmask; +u_int32_t spi; +u_int32_t reqid; +u_int8_t proto; +u_int8_t mode; + +struct ipt_policy_spec match; +struct ipt_policy_spec invert; +}; + +struct ipt_policy_info +{ +struct ipt_policy_elem pol[IPT_POLICY_MAX_ELEM ]; +u_int16_t flags; +u_int16_t len; +}; + +#endif /* _IPT_POLICY_H */
include/linux/netfilter_ipv6/ip6t_policy.h new file +52 -0
52 lines not on this page · raw message
net/ipv4/netfilter/Kconfig +10 -0
@@ -468,6 +468,16 @@ config IP_NF_MATCH_STRING To compile it as a module, choose M here. If unsure, say N. +config IP_NF_MATCH_POLICY + tristate "IPsec policy match support" + depends on IP_NF_IPTABLES && XFRM + help + Policy matching allows you to match packets based on the + IPsec policy that was used during decapsulation/will + be used during encapsulation. + + To compile it as a module, choose M here. If unsure, say N. + # `filter', generic and specific targets config IP_NF_FILTER tristate "Packet filtering"
net/ipv4/netfilter/Makefile +1 -0
@@ -71,6 +71,7 @@ obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_ obj-$(CONFIG_IP_NF_MATCH_REALM) += ipt_realm.o obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o +obj-$(CONFIG_IP_NF_MATCH_POLICY) += ipt_policy.o obj-$(CONFIG_IP_NF_MATCH_COMMENT) += ipt_comment.o obj-$(CONFIG_IP_NF_MATCH_STRING) += ipt_string.o
net/ipv4/netfilter/ipt_policy.c new file +170 -0
170 lines not on this page · raw message
net/ipv6/netfilter/Kconfig +10 -0
@@ -170,6 +170,16 @@ config IP6_NF_MATCH_PHYSDEV To compile it as a module, choose M here. If unsure, say N. +config IP6_NF_MATCH_POLICY + tristate "IPsec policy match support" + depends on IP6_NF_IPTABLES && XFRM + help + Policy matching allows you to match packets based on the + IPsec policy that was used during decapsulation/will + be used during encapsulation. + + To compile it as a module, choose M here. If unsure, say N. + # dep_tristate ' Multiple port match support' CONFIG_IP6_NF_MATCH_MULTIPORT $CONFIG_IP6_NF_IPTABLES # dep_tristate ' TOS match support' CONFIG_IP6_NF_MATCH_TOS $CONFIG_IP6_NF_IPTABLES # if [ "$CONFIG_IP6_NF_CONNTRACK" != "n" ]; then
net/ipv6/netfilter/Makefile +1 -0
@@ -13,6 +13,7 @@ obj-$(CONFIG_IP6_NF_MATCH_OPTS) += ip6t_ obj-$(CONFIG_IP6_NF_MATCH_IPV6HEADER) += ip6t_ipv6header.o obj-$(CONFIG_IP6_NF_MATCH_FRAG) += ip6t_frag.o obj-$(CONFIG_IP6_NF_MATCH_AHESP) += ip6t_esp.o ip6t_ah.o +obj-$(CONFIG_IP6_NF_MATCH_POLICY) += ip6t_policy.o obj-$(CONFIG_IP6_NF_MATCH_EUI64) += ip6t_eui64.o obj-$(CONFIG_IP6_NF_MATCH_MULTIPORT) += ip6t_multiport.o obj-$(CONFIG_IP6_NF_MATCH_OWNER) += ip6t_owner.o
net/ipv6/netfilter/ip6t_policy.c new file +175 -0
175 lines not on this page · raw message