• Anders K. Pedersen's avatar
    netfilter: ipset: Support package fragments for IPv4 protos without ports · 60b0fe37
    Anders K. Pedersen authored
    Enable ipset port set types to match IPv4 package fragments for
    protocols that doesn't have ports (or the port information isn't
    supported by ipset).
    
    For example this allows a hash:ip,port ipset containing the entry
    192.168.0.1,gre:0 to match all package fragments for PPTP VPN tunnels
    to/from the host. Without this patch only the first package fragment
    (with fragment offset 0) was matched, while subsequent fragments wasn't.
    
    This is not possible for IPv6, where the protocol is in the fragmented
    part of the package unlike IPv4, where the protocol is in the IP header.
    
    IPPROTO_ICMPV6 is deliberately not included, because it isn't relevant
    for IPv4.
    Signed-off-by: default avatarAnders K. Pedersen <akp@surftown.com>
    Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
    60b0fe37
ip_set_getport.c 3.76 KB