* CAN firewall
@ 2015-10-30 12:42 Neal Probert
2015-10-30 14:38 ` Oliver Hartkopp
0 siblings, 1 reply; 2+ messages in thread
From: Neal Probert @ 2015-10-30 12:42 UTC (permalink / raw)
To: linux-can
[-- Attachment #1: Type: text/plain, Size: 104 bytes --]
Is there any sort of CAN firewall/gateway capability like
ipfilter/iptables available?
Thanks!
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: CAN firewall
2015-10-30 12:42 CAN firewall Neal Probert
@ 2015-10-30 14:38 ` Oliver Hartkopp
0 siblings, 0 replies; 2+ messages in thread
From: Oliver Hartkopp @ 2015-10-30 14:38 UTC (permalink / raw)
To: Neal Probert; +Cc: linux-can@vger.kernel.org
Hi Neal,
long time no see :-)
On 10/30/2015 01:42 PM, Neal Probert wrote:
> Is there any sort of CAN firewall/gateway capability like
> ipfilter/iptables available?
First thing is to use the CAN filters provided by CAN_RAW sockets:
https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/Documentation/networking/can.txt?h=linux-4.2.y#n436
which provides a 'private' view to the CAN interface for each socket.
These filters are provided by the candump commandline options too.
In the case you don't trust the CAN application(??), you might try to limit
your untrusted application to use a virtual CAN (e.g. vcan0) and forward the
traffic from/to the 'real' can0 via can-gw rules.
Try 'cangw -?' from the can-utils package for a full feature description.
You can route and modify CAN frames from one CAN interface to another.
(But don't forget to modprobe can-gw before as it doesn't autoload)
The can-gw is a netlink configuration based routing an modifying functionality
for CAN frames.
Hope that helps so far - can you tell more about your use-case?
Regards,
Oliver
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-10-30 14:38 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-10-30 12:42 CAN firewall Neal Probert
2015-10-30 14:38 ` Oliver Hartkopp
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).