netfilter: introduce l2tp match extension

Introduce an xtables add-on for matching L2TP packets. Supports L2TPv2 and L2TPv3 over IPv4 and IPv6. As well as filtering on L2TP tunnel-id and session-id, the filtering decision can also include the L2TP packet type (control or data), protocol version (2 or 3) and encapsulation type (UDP or IP). The most common use for this will likely be to filter L2TP data packets of individual L2TP tunnels or sessions. While a u32 match can be used, the L2TP protocol headers are such that field offsets differ depending on bits set in the header, making rules for matching generic L2TP connections cumbersome. This match extension takes care of all that.

James Chapman committed 12 years ago

Commit 74f77a61 parent d0eb1f75 files · +393 −0Browse files

Showing the changes to include/uapi/linux (2 of 5 files). Show all

Unified · Split

2 files

include/uapi/linux/netfilter/Kbuild +1 −0
include/uapi/linux/netfilter/xt_l2tp.h +27 −0

include/uapi/linux/netfilter/Kbuild+1−0

@@ -58,6 +58,7 @@ header-y += xt_helper.h · 57 unmodified lines
58	header-y += xt_ipcomp.h	58	header-y += xt_ipcomp.h
59	header-y += xt_iprange.h	59	header-y += xt_iprange.h
60	header-y += xt_ipvs.h	60	header-y += xt_ipvs.h
		61	header-y += xt_l2tp.h
61	header-y += xt_length.h	62	header-y += xt_length.h
62	header-y += xt_limit.h	63	header-y += xt_limit.h
63	header-y += xt_mac.h	64	header-y += xt_mac.h

include/uapi/linux/netfilter/xt_l2tp.h+27−0

@@ -0,0 +1,27 @@
	1	#ifndef _LINUX_NETFILTER_XT_L2TP_H
	2	#define _LINUX_NETFILTER_XT_L2TP_H
	3
	4	#include <linux/types.h>
	5
	6	enum xt_l2tp_type {
	7	XT_L2TP_TYPE_CONTROL,
	8	XT_L2TP_TYPE_DATA,
	9	};
	10
	11	/* L2TP matching stuff */
	12	struct xt_l2tp_info {
	13	__u32 tid; /* tunnel id */
	14	__u32 sid; /* session id */
	15	__u8 version; /* L2TP protocol version */
	16	__u8 type; /* L2TP packet type */
	17	__u8 flags; /* which fields to match */
	18	};
	19
	20	enum {
	21	XT_L2TP_TID = (1 << 0), /* match L2TP tunnel id */
	22	XT_L2TP_SID = (1 << 1), /* match L2TP session id */
	23	XT_L2TP_VERSION = (1 << 2), /* match L2TP protocol version */
	24	XT_L2TP_TYPE = (1 << 3), /* match L2TP packet type */
	25	};
	26
	27	#endif /* _LINUX_NETFILTER_XT_L2TP_H */