diff options
| author | Bart De Schuymer <bdschuym@pandora.be> | 2007-04-12 22:15:06 -0700 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2007-04-25 22:28:58 -0700 |
| commit | c15bf6e699f4c366f2d1e19ac5d7add21c6b5a19 (patch) | |
| tree | 2bcd680115a8b07cd6d7493b134ae2d36fe637be /include | |
| parent | 516299d2f5b6f9703b9b388faf91898dc636a678 (diff) | |
| download | linux-3.10-c15bf6e699f4c366f2d1e19ac5d7add21c6b5a19.tar.gz linux-3.10-c15bf6e699f4c366f2d1e19ac5d7add21c6b5a19.tar.bz2 linux-3.10-c15bf6e699f4c366f2d1e19ac5d7add21c6b5a19.zip | |
[NETFILTER]: ebt_arp: add gratuitous arp filtering
The attached patch adds gratuitous arp filtering, more precisely: it
allows checking that the IPv4 source address matches the IPv4
destination address inside the ARP header. It also adds a check for the
hardware address type when matching MAC addresses (nothing critical,
just for better consistency).
Signed-off-by: Bart De Schuymer <bdschuym@pandora.be>
Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/netfilter_bridge/ebt_arp.h | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/include/linux/netfilter_bridge/ebt_arp.h b/include/linux/netfilter_bridge/ebt_arp.h index 97e4dbde1f8..cbf4843b6b0 100644 --- a/include/linux/netfilter_bridge/ebt_arp.h +++ b/include/linux/netfilter_bridge/ebt_arp.h @@ -8,8 +8,10 @@ #define EBT_ARP_DST_IP 0x10 #define EBT_ARP_SRC_MAC 0x20 #define EBT_ARP_DST_MAC 0x40 +#define EBT_ARP_GRAT 0x80 #define EBT_ARP_MASK (EBT_ARP_OPCODE | EBT_ARP_HTYPE | EBT_ARP_PTYPE | \ - EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC) + EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC | \ + EBT_ARP_GRAT) #define EBT_ARP_MATCH "arp" struct ebt_arp_info |