Re: CAN firewall

[Oliver Hartkopp <socketcan@hartkopp.net>]

Hi Neal,

long time no see :-)

On 10/30/2015 01:42 PM, Neal Probert wrote:
> Is there any sort of CAN firewall/gateway capability like
> ipfilter/iptables available?

First thing is to use the CAN filters provided by CAN_RAW sockets:

https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/Documentation/networking/can.txt?h=linux-4.2.y#n436

which provides a 'private' view to the CAN interface for each socket.
These filters are provided by the candump commandline options too.

In the case you don't trust the CAN application(??), you might try to limit
your untrusted application to use a virtual CAN (e.g. vcan0) and forward the
traffic from/to the 'real' can0 via can-gw rules.

Try 'cangw -?' from the can-utils package for a full feature description.
You can route and modify CAN frames from one CAN interface to another.

(But don't forget to modprobe can-gw before as it doesn't autoload)

The can-gw is a netlink configuration based routing an modifying functionality
for CAN frames.

Hope that helps so far - can you tell more about your use-case?

Regards,
Oliver