diff options
| author | Laszlo Attila Toth <panther@balabit.hu> | 2007-12-04 23:30:18 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-01-28 14:55:56 -0800 |
| commit | e2cf5ecbea861ff05105bbd40f4f0d7823d9e213 (patch) | |
| tree | f1563dbe6d1e3c06f63d966e43d5c777c912ca4a /include/linux/netfilter_ipv4 | |
| parent | 0553811612a6178365f3b062c30234913b218a96 (diff) | |
| download | linux-stable-e2cf5ecbea861ff05105bbd40f4f0d7823d9e213.tar.gz linux-stable-e2cf5ecbea861ff05105bbd40f4f0d7823d9e213.tar.bz2 linux-stable-e2cf5ecbea861ff05105bbd40f4f0d7823d9e213.zip | |
[NETFILTER]: ipt_addrtype: limit address type checking to an interface
Addrtype match has a new revision (1), which lets address type checking
limited to the interface the current packet belongs to. Either incoming
or outgoing interface can be used depending on the current hook. In the
FORWARD hook two maches should be used if both interfaces have to be checked.
The new structure is ipt_addrtype_info_v1.
Revision 0 lets older userspace programs use the match as earlier.
ipt_addrtype_info is used.
Signed-off-by: Laszlo Attila Toth <panther@balabit.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/linux/netfilter_ipv4')
| -rw-r--r-- | include/linux/netfilter_ipv4/ipt_addrtype.h | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/include/linux/netfilter_ipv4/ipt_addrtype.h b/include/linux/netfilter_ipv4/ipt_addrtype.h index 166ed01a8122..446de6aef983 100644 --- a/include/linux/netfilter_ipv4/ipt_addrtype.h +++ b/include/linux/netfilter_ipv4/ipt_addrtype.h @@ -1,6 +1,20 @@ #ifndef _IPT_ADDRTYPE_H #define _IPT_ADDRTYPE_H +enum { + IPT_ADDRTYPE_INVERT_SOURCE = 0x0001, + IPT_ADDRTYPE_INVERT_DEST = 0x0002, + IPT_ADDRTYPE_LIMIT_IFACE_IN = 0x0004, + IPT_ADDRTYPE_LIMIT_IFACE_OUT = 0x0008, +}; + +struct ipt_addrtype_info_v1 { + u_int16_t source; /* source-type mask */ + u_int16_t dest; /* dest-type mask */ + u_int32_t flags; +}; + +/* revision 0 */ struct ipt_addrtype_info { u_int16_t source; /* source-type mask */ u_int16_t dest; /* dest-type mask */ |