Skip to content
  • Eric Dumazet's avatar
    netfilter: xt_socket: add XT_SOCKET_NOWILDCARD flag · 681f130f
    Eric Dumazet authored
    
    
    xt_socket module can be a nice replacement to conntrack module
    in some cases (SYN filtering for example)
    
    But it lacks the ability to match the 3rd packet of TCP
    handshake (ACK coming from the client).
    
    Add a XT_SOCKET_NOWILDCARD flag to disable the wildcard mechanism.
    
    The wildcard is the legacy socket match behavior, that ignores
    LISTEN sockets bound to INADDR_ANY (or ipv6 equivalent)
    
    iptables -I INPUT -p tcp --syn -j SYN_CHAIN
    iptables -I INPUT -m socket --nowildcard -j ACCEPT
    
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Cc: Patrick McHardy <kaber@trash.net>
    Cc: Jesper Dangaard Brouer <brouer@redhat.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    681f130f