tree 1fd8db59906709fcd8082e2fd59db7e96e2ea28d
parent 8643adc8f0f0fe1e22ca0de0503eee0ee1e22bf5
author Eric Dumazet <edumazet@google.com> 1371732755 -0700
committer Pablo Neira Ayuso <pablo@netfilter.org> 1375807429 +0200

xt_socket: add --nowildcard flag

xt_socket module can be a nice replacement to conntrack module
in some cases (SYN filtering for example)

But it lacks the ability to match the 3rd packet of TCP
handshake (ACK coming from the client).

Add a XT_SOCKET_NOWILDCARD flag to disable the wildcard mechanism

The wildcard is the legacy socket match behavior, that ignores
LISTEN sockets bound to INADDR_ANY (or ipv6 equivalent)

iptables -I INPUT -p tcp --syn -j SYN_CHAIN
iptables -I INPUT -m socket -j ACCEPT

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Patrick McHardy <kaber@trash.net>
Cc: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>