linux.git/net/netfilter/xt_ipcomp.c, branch v5.1

netfilter: x_tables: use pr ratelimiting in all remaining spots

2018-02-14T20:05:38+00:00

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: return booleans instead of integers

2018-01-19T13:02:18+00:00

Return statements in functions returning bool should use
true/false instead of 1/0.

These issues were detected with the help of Coccinelle.

Signed-off-by: Gustavo A. R. Silva 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_ipcomp: add "ip[6]t_ipcomp" module alias name

2016-10-17T15:38:19+00:00

Otherwise, user cannot add related rules if xt_ipcomp.ko is not loaded:
  # iptables -A OUTPUT -p 108 -m ipcomp --ipcompspi 1
  iptables: No chain/target/match by that name.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_ipcomp: Use ntohs to ease sparse warning

2014-02-19T10:41:25+00:00

0-DAY kernel build testing backend reported:

sparse warnings: (new ones prefixed by >>)

 >> >> net/netfilter/xt_ipcomp.c:63:26: sparse: restricted __be16 degrades to integer
 >> >> net/netfilter/xt_ipcomp.c:63:26: sparse: cast to restricted __be32

Fix this by using ntohs without shifting.

Tested with: make C=1 CF=-D__CHECK_ENDIAN__

Signed-off-by: Fan Du 
Signed-off-by: Pablo Neira Ayuso

netfilter: add IPv4/6 IPComp extension match support

2013-12-24T11:37:58+00:00

With this plugin, user could specify IPComp tagged with certain
CPI that host not interested will be DROPped or any other action.

For example:
iptables  -A INPUT -p 108 -m ipcomp --ipcompspi 0x87 -j DROP
ip6tables -A INPUT -p 108 -m ipcomp --ipcompspi 0x87 -j DROP

Then input IPComp packet with CPI equates 0x87 will not reach
upper layer anymore.

Signed-off-by: Fan Du 
Signed-off-by: Pablo Neira Ayuso