mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-05 18:39:59 +00:00
![Harout Hedeshian](/assets/img/avatar_default.png)
xt_socket is useful for matching sockets with IP_TRANSPARENT and taking some action on the matching packets. However, it lacks the ability to match only a small subset of transparent sockets. Suppose there are 2 applications, each with its own set of transparent sockets. The first application wants all matching packets dropped, while the second application wants them forwarded somewhere else. Add the ability to retore the skb->mark from the sk_mark. The mark is only restored if a matching socket is found and the transparent / nowildcard conditions are satisfied. Now the 2 hypothetical applications can differentiate their sockets based on a mark value set with SO_MARK. iptables -t mangle -I PREROUTING -m socket --transparent \ --restore-skmark -j action iptables -t mangle -A action -m mark --mark 10 -j action2 iptables -t mangle -A action -m mark --mark 11 -j action3 Signed-off-by: Harout Hedeshian <harouth@codeaurora.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
29 lines
577 B
C
29 lines
577 B
C
#ifndef _XT_SOCKET_H
|
|
#define _XT_SOCKET_H
|
|
|
|
#include <linux/types.h>
|
|
|
|
enum {
|
|
XT_SOCKET_TRANSPARENT = 1 << 0,
|
|
XT_SOCKET_NOWILDCARD = 1 << 1,
|
|
XT_SOCKET_RESTORESKMARK = 1 << 2,
|
|
};
|
|
|
|
struct xt_socket_mtinfo1 {
|
|
__u8 flags;
|
|
};
|
|
#define XT_SOCKET_FLAGS_V1 XT_SOCKET_TRANSPARENT
|
|
|
|
struct xt_socket_mtinfo2 {
|
|
__u8 flags;
|
|
};
|
|
#define XT_SOCKET_FLAGS_V2 (XT_SOCKET_TRANSPARENT | XT_SOCKET_NOWILDCARD)
|
|
|
|
struct xt_socket_mtinfo3 {
|
|
__u8 flags;
|
|
};
|
|
#define XT_SOCKET_FLAGS_V3 (XT_SOCKET_TRANSPARENT \
|
|
| XT_SOCKET_NOWILDCARD \
|
|
| XT_SOCKET_RESTORESKMARK)
|
|
|
|
#endif /* _XT_SOCKET_H */
|