]> xenbits.xensource.com Git - people/liuw/libxenctrl-split/libvirt.git/commit
nwfilter: Add support for icmpv6 filtering
authorStefan Berger <stefanb@linux.vnet.ibm.com>
Wed, 7 Jan 2015 16:41:49 +0000 (11:41 -0500)
committerStefan Berger <stefanb@linux.vnet.ibm.com>
Wed, 7 Jan 2015 16:41:49 +0000 (11:41 -0500)
commit3a3b3691d145418dc6616e7ce8a5ca8ba857bc5b
treee95eeb5403baa3053adc2bb1f292178717bedccd
parentb073179085cb470e13e8e87e2a92cf2356c680eb
nwfilter: Add support for icmpv6 filtering

Make use of the ebtables functionality to be able to filter certain
parameters of icmpv6 packets. Extend the XML parser for icmpv6 types,
type ranges, codes, and code ranges. Extend the nwfilter documentation,
schema, and test cases.

Being able to filter icmpv6 types and codes helps extending the DHCP
snooper for IPv6 and filtering at least some parameters of IPv6's NDP
(Neighbor Discovery Protocol) packets. However, the filtering will not
be as good as the filtering of ARP packets since we cannot
check on IP addresses in the payload of the NDP packets.

Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
docs/formatnwfilter.html.in
docs/schemas/nwfilter.rng
src/conf/nwfilter_conf.c
src/conf/nwfilter_conf.h
src/nwfilter/nwfilter_ebiptables_driver.c
tests/nwfilterxml2firewalldata/ipv6-linux.args
tests/nwfilterxml2firewalldata/ipv6.xml
tests/nwfilterxml2xmlin/ipv6-test.xml
tests/nwfilterxml2xmlout/ipv6-test.xml