New extension: CRYPT target

Hi all!!!

After some months of development we have finished this new extension. CRYPT is a new target extension for Netfilter/Iptables that enables the user to encrypt, decrypt and authenticate any IP protocol traffic using the Linux Cryptographic API.

For example, if you want to encrypt active FTP (TCP) traffic between host A and host B, you can do as follows:

(on host A, 1.2.3.4, FTP client)

# iptables -t mangle -A POSTROUTING -d 1.2.3.5 -p tcp --dport 20:21 -j
CRYPT --cipher blowfish --key topsecret --mode ecb --direction encrypt
# iptables -t mangle -A PREROUTING -s 1.2.3.5 -p 206 -j CRYPT --cipher
3des --key topsecretkeyinascii12345 --mode cbc --direction decrypt

(on host B, 1.2.3.5, FTP server)

# iptables -t mangle -A POSTROUTING -d 1.2.3.4 -p tcp --sport 20:21 -j
CRYPT --cipher 3des --key topsecretkeyinascii12345 --mode cbc
--direction encrypt
# iptables -t mangle -A PREROUTING -s 1.2.3.4 -p 206 -j CRYPT --cipher
blowfish --key topsecret --mode ecb --direction decrypt

_Note_ the symmetry in the rules. Also note the use of protocol 206 (CRYPT_PROTOCOL) in decryption.

You can download it from:
http://crypt.negocios-sa.com.ar

We hope you can test it and we are open for comments and suggestions.

--
Gervasio Bernal <gervasiobernal(at)gmail(dot)com>
Pedro Deis <pedrakos(at)gmail(dot)com>