You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

71 lines
2.8 KiB

# --- SDE-COPYRIGHT-NOTE-BEGIN ---
# This copyright note is auto-generated by ./scripts/Create-CopyPatch.
#
# Filename: package/.../etcnet/0001-iptables-syntax-add-TPROXY-target-extension.patch
# Copyright (C) 2011 The OpenSDE Project
#
# More information can be found in the files COPYING and README.
#
# This patch file is dual-licensed. It is available under the license the
# patched project is licensed under, as long as it is an OpenSource license
# as defined at http://www.opensource.org/ (e.g. BSD, X11) or under the terms
# of the GNU General Public License as published by the Free Software
# Foundation; either version 2 of the License, or (at your option) any later
# version.
# --- SDE-COPYRIGHT-NOTE-END ---
From 8403a9c75f66023f86cb36a6d48d1a186c097f60 Mon Sep 17 00:00:00 2001
From: Christian Wiese <christian.wiese@securepoint.de>
Date: Mon, 17 Jan 2011 11:33:39 +0100
Subject: [PATCH 1/2] iptables/syntax: add TPROXY target extension
iptables.8 man page:
-----------------------------------------------------------------------
TPROXY
This target is only valid in the mangle table, in the PREROUTING chain
and user-defined chains which are only called from this chain. It redi-
rects the packet to a local socket without changing the packet header
in any way. It can also change the mark value which can then be used in
advanced routing rules. It takes three options:
--on-port port
This specifies a destination port to use. It is a required
option, 0 means the new destination port is the same as the
original. This is only valid if the rule also specifies -p tcp
or -p udp.
--on-ip address
This specifies a destination address to use. By default the
address is the IP address of the incoming interface. This is
only valid if the rule also specifies -p tcp or -p udp.
--tproxy-mark value[/mask]
Marks packets with the given value/mask. The fwmark value set
here can be used by advanced routing. (Required for transparent
proxying to work: otherwise these packets will get forwarded,
which is probably not what you want.)
-----------------------------------------------------------------------
---
etc/net/ifaces/default/fw/iptables/syntax | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/etc/net/ifaces/default/fw/iptables/syntax b/etc/net/ifaces/default/fw/iptables/syntax
index 6085955..fecef79 100644
--- a/etc/net/ifaces/default/fw/iptables/syntax
+++ b/etc/net/ifaces/default/fw/iptables/syntax
@@ -82,6 +82,10 @@ ulog-nlgroup: --ulog-nlgroup
ulog-prefix: --ulog-prefix
ulog-cprange: --ulog-cprange
ulog-qthreshold: --ulog-qthreshold
+# TPROXY target extension
+on-port: --on-port
+on-ip: --on-ip
+tproxy-mark: -j TPROXY --tproxy-mark
# Match extensions
srctype: -maddrtype --src-type
--
1.6.6.2