From patchwork Thu Jun 20 12:52:35 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 252901 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id C97262C02B7 for ; Thu, 20 Jun 2013 22:52:42 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757863Ab3FTMwk (ORCPT ); Thu, 20 Jun 2013 08:52:40 -0400 Received: from mail-ee0-f44.google.com ([74.125.83.44]:44069 "EHLO mail-ee0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757847Ab3FTMwk (ORCPT ); Thu, 20 Jun 2013 08:52:40 -0400 Received: by mail-ee0-f44.google.com with SMTP id c13so3930492eek.31 for ; Thu, 20 Jun 2013 05:52:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:subject:from:to:cc:date:in-reply-to:references :content-type:x-mailer:content-transfer-encoding:mime-version; bh=rL8luMkwHgfyQygWVUpHc1OlX0JoP3cy7c9sSlRRGxA=; b=whX5Hl2nCywrDx+nINkQgKgzsJpQ92ieDiWtGEWUUrIQ8T+h/ct8BMQY7VmGcXset8 wYutVq7M3xmN6eKdJKqRaPqog/9JmN2MSvsvapX/aCd07SmSWAbpH3OOI0xwm8f5LeiU 2z4IgAXQ1o1pe6W7A87pA1Sh3A68kQJmBz8eovMQAlMneoSDHPUec/NxIRTU8LSK4TwS DfnRU1VcTx4nXIaSpg6B+PPafPbS2fkFftXLZUzpxK4InA/cCbAX1BgTW1Z0bx1XU6by dC9rHmOii/M0JJsEv78sF3xb5hndbSVZf5M7APxYPuWcvoy205XlXQ4JxiQLIdxU6M1i Z9mw== X-Received: by 10.14.178.8 with SMTP id e8mr4144440eem.20.1371732758313; Thu, 20 Jun 2013 05:52:38 -0700 (PDT) Received: from [172.28.90.44] ([172.28.90.44]) by mx.google.com with ESMTPSA id p49sm362402eeu.2.2013.06.20.05.52.36 for (version=SSLv3 cipher=RC4-SHA bits=128/128); Thu, 20 Jun 2013 05:52:37 -0700 (PDT) Message-ID: <1371732755.3252.409.camel@edumazet-glaptop> Subject: [PATCH iptables] xt_socket: add --nowildcard flag From: Eric Dumazet To: Pablo Neira Ayuso Cc: netdev , netfilter-devel@vger.kernel.org, Jesper Dangaard Brouer , Patrick McHardy Date: Thu, 20 Jun 2013 05:52:35 -0700 In-Reply-To: <1370300249.24311.190.camel@edumazet-glaptop> References: <1370300249.24311.190.camel@edumazet-glaptop> X-Mailer: Evolution 3.2.3-0ubuntu6 Mime-Version: 1.0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org From: Eric Dumazet xt_socket module can be a nice replacement to conntrack module in some cases (SYN filtering for example) But it lacks the ability to match the 3rd packet of TCP handshake (ACK coming from the client). Add a XT_SOCKET_NOWILDCARD flag to disable the wildcard mechanism The wildcard is the legacy socket match behavior, that ignores LISTEN sockets bound to INADDR_ANY (or ipv6 equivalent) iptables -I INPUT -p tcp --syn -j SYN_CHAIN iptables -I INPUT -m socket -j ACCEPT Signed-off-by: Eric Dumazet Cc: Patrick McHardy Cc: Jesper Dangaard Brouer --- extensions/libxt_socket.c | 62 ++++++++++++++++++++++++++ include/linux/netfilter/xt_socket.h | 7 ++ 2 files changed, 69 insertions(+) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/extensions/libxt_socket.c b/extensions/libxt_socket.c index 3901649..f19c280 100644 --- a/extensions/libxt_socket.c +++ b/extensions/libxt_socket.c @@ -9,6 +9,7 @@ enum { O_TRANSPARENT = 0, + O_NOWILDCARD = 1, }; static const struct xt_option_entry socket_mt_opts[] = { @@ -16,6 +17,12 @@ static const struct xt_option_entry socket_mt_opts[] = { XTOPT_TABLEEND, }; +static const struct xt_option_entry socket_mt_opts_v2[] = { + {.name = "transparent", .id = O_TRANSPARENT, .type = XTTYPE_NONE}, + {.name = "nowildcard", .id = O_NOWILDCARD, .type = XTTYPE_NONE}, + XTOPT_TABLEEND, +}; + static void socket_mt_help(void) { printf( @@ -23,6 +30,14 @@ static void socket_mt_help(void) " --transparent Ignore non-transparent sockets\n\n"); } +static void socket_mt_help_v2(void) +{ + printf( + "socket match options:\n" + " --nowildcard Do not ignore LISTEN sockets bound on INADDR_ANY\n" + " --transparent Ignore non-transparent sockets\n\n"); +} + static void socket_mt_parse(struct xt_option_call *cb) { struct xt_socket_mtinfo1 *info = cb->data; @@ -35,6 +50,21 @@ static void socket_mt_parse(struct xt_option_call *cb) } } +static void socket_mt_parse_v2(struct xt_option_call *cb) +{ + struct xt_socket_mtinfo2 *info = cb->data; + + xtables_option_parse(cb); + switch (cb->entry->id) { + case O_TRANSPARENT: + info->flags |= XT_SOCKET_TRANSPARENT; + break; + case O_NOWILDCARD: + info->flags |= XT_SOCKET_NOWILDCARD; + break; + } +} + static void socket_mt_save(const void *ip, const struct xt_entry_match *match) { @@ -52,6 +82,25 @@ socket_mt_print(const void *ip, const struct xt_entry_match *match, socket_mt_save(ip, match); } +static void +socket_mt_save_v2(const void *ip, const struct xt_entry_match *match) +{ + const struct xt_socket_mtinfo2 *info = (const void *)match->data; + + if (info->flags & XT_SOCKET_TRANSPARENT) + printf(" --transparent"); + if (info->flags & XT_SOCKET_NOWILDCARD) + printf(" --nowildcard"); +} + +static void +socket_mt_print_v2(const void *ip, const struct xt_entry_match *match, + int numeric) +{ + printf(" socket"); + socket_mt_save_v2(ip, match); +} + static struct xtables_match socket_mt_reg[] = { { .name = "socket", @@ -74,6 +123,19 @@ static struct xtables_match socket_mt_reg[] = { .x6_parse = socket_mt_parse, .x6_options = socket_mt_opts, }, + { + .name = "socket", + .revision = 2, + .family = NFPROTO_UNSPEC, + .version = XTABLES_VERSION, + .size = XT_ALIGN(sizeof(struct xt_socket_mtinfo2)), + .userspacesize = XT_ALIGN(sizeof(struct xt_socket_mtinfo2)), + .help = socket_mt_help_v2, + .print = socket_mt_print_v2, + .save = socket_mt_save_v2, + .x6_parse = socket_mt_parse_v2, + .x6_options = socket_mt_opts_v2, + }, }; void _init(void) diff --git a/include/linux/netfilter/xt_socket.h b/include/linux/netfilter/xt_socket.h index 26d7217..6315e2a 100644 --- a/include/linux/netfilter/xt_socket.h +++ b/include/linux/netfilter/xt_socket.h @@ -5,10 +5,17 @@ enum { XT_SOCKET_TRANSPARENT = 1 << 0, + XT_SOCKET_NOWILDCARD = 1 << 1, }; struct xt_socket_mtinfo1 { __u8 flags; }; +#define XT_SOCKET_FLAGS_V1 XT_SOCKET_TRANSPARENT + +struct xt_socket_mtinfo2 { + __u8 flags; +}; +#define XT_SOCKET_FLAGS_V2 (XT_SOCKET_TRANSPARENT | XT_SOCKET_NOWILDCARD) #endif /* _XT_SOCKET_H */