diff options
| author | Eric Dumazet <edumazet@google.com> | 2015-08-21 19:21:43 -0600 |
|---|---|---|
| committer | Linux Build Service Account <lnxbuild@localhost> | 2015-10-06 03:30:27 -0600 |
| commit | 29e08c5a8a9afca125b2c4ca9803add4f86a6e14 (patch) | |
| tree | 4e380bacb46e1ee2ecbb394ce3cb5a2ceb8a40c5 /extensions/libip6t_NETMAP.c | |
| parent | 3c931c53ce24a6bd8d0f94b3b2b1a0b90616c993 (diff) | |
| download | android_external_iptables-29e08c5a8a9afca125b2c4ca9803add4f86a6e14.tar.gz android_external_iptables-29e08c5a8a9afca125b2c4ca9803add4f86a6e14.tar.bz2 android_external_iptables-29e08c5a8a9afca125b2c4ca9803add4f86a6e14.zip | |
xt_socket: add --nowildcard flag
xt_socket module can be a nice replacement to conntrack module
in some cases (SYN filtering for example)
But it lacks the ability to match the 3rd packet of TCP
handshake (ACK coming from the client).
Add a XT_SOCKET_NOWILDCARD flag to disable the wildcard mechanism
The wildcard is the legacy socket match behavior, that ignores
LISTEN sockets bound to INADDR_ANY (or ipv6 equivalent)
iptables -I INPUT -p tcp --syn -j SYN_CHAIN
iptables -I INPUT -m socket -j ACCEPT
Change-Id: Ic5bbebbfccc1ccede0157cd3b5ea4863c1ed2fa7
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Patrick McHardy <kaber@trash.net>
Cc: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions/libip6t_NETMAP.c')
0 files changed, 0 insertions, 0 deletions