CAN firewall

Is there any sort of CAN firewall/gateway capability like ipfilter/iptables available?

Thanks!

Hi Neal,

long time no see :-)

First thing is to use the CAN filters provided by CAN_RAW sockets:

https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/Documentation/networking/can.txt?h=linux-4.2.y#n436

which provides a 'private' view to the CAN interface for each socket. These filters are provided by the candump commandline options too.

In the case you don't trust the CAN application(??), you might try to limit your untrusted application to use a virtual CAN (e.g. vcan0) and forward the traffic from/to the 'real' can0 via can-gw rules.

Try 'cangw -?' from the can-utils package for a full feature description. You can route and modify CAN frames from one CAN interface to another.

(But don't forget to modprobe can-gw before as it doesn't autoload)

The can-gw is a netlink configuration based routing an modifying functionality for CAN frames.

Hope that helps so far - can you tell more about your use-case?

Regards,
Oliver