Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1/* Kernel module to match the bridge port in and
2 * out device for IP packets coming into contact with a bridge. */
3
4/* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10
11#include <linux/module.h>
12#include <linux/skbuff.h>
13#include <linux/netfilter/xt_physdev.h>
14#include <linux/netfilter/x_tables.h>
15#include <linux/netfilter_bridge.h>
16#define MATCH 1
17#define NOMATCH 0
18
19MODULE_LICENSE("GPL");
20MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
21MODULE_DESCRIPTION("iptables bridge physical device match module");
22MODULE_ALIAS("ipt_physdev");
23MODULE_ALIAS("ip6t_physdev");
24
25static int
26match(const struct sk_buff *skb,
27 const struct net_device *in,
28 const struct net_device *out,
29 const struct xt_match *match,
30 const void *matchinfo,
31 int offset,
32 unsigned int protoff,
33 int *hotdrop)
34{
35 int i;
36 static const char nulldevname[IFNAMSIZ];
37 const struct xt_physdev_info *info = matchinfo;
38 unsigned int ret;
39 const char *indev, *outdev;
40 struct nf_bridge_info *nf_bridge;
41
42 /* Not a bridged IP packet or no info available yet:
43 * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
44 * the destination device will be a bridge. */
45 if (!(nf_bridge = skb->nf_bridge)) {
46 /* Return MATCH if the invert flags of the used options are on */
47 if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
48 !(info->invert & XT_PHYSDEV_OP_BRIDGED))
49 return NOMATCH;
50 if ((info->bitmask & XT_PHYSDEV_OP_ISIN) &&
51 !(info->invert & XT_PHYSDEV_OP_ISIN))
52 return NOMATCH;
53 if ((info->bitmask & XT_PHYSDEV_OP_ISOUT) &&
54 !(info->invert & XT_PHYSDEV_OP_ISOUT))
55 return NOMATCH;
56 if ((info->bitmask & XT_PHYSDEV_OP_IN) &&
57 !(info->invert & XT_PHYSDEV_OP_IN))
58 return NOMATCH;
59 if ((info->bitmask & XT_PHYSDEV_OP_OUT) &&
60 !(info->invert & XT_PHYSDEV_OP_OUT))
61 return NOMATCH;
62 return MATCH;
63 }
64
65 /* This only makes sense in the FORWARD and POSTROUTING chains */
66 if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
67 (!!(nf_bridge->mask & BRNF_BRIDGED) ^
68 !(info->invert & XT_PHYSDEV_OP_BRIDGED)))
69 return NOMATCH;
70
71 if ((info->bitmask & XT_PHYSDEV_OP_ISIN &&
72 (!nf_bridge->physindev ^ !!(info->invert & XT_PHYSDEV_OP_ISIN))) ||
73 (info->bitmask & XT_PHYSDEV_OP_ISOUT &&
74 (!nf_bridge->physoutdev ^ !!(info->invert & XT_PHYSDEV_OP_ISOUT))))
75 return NOMATCH;
76
77 if (!(info->bitmask & XT_PHYSDEV_OP_IN))
78 goto match_outdev;
79 indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname;
80 for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
81 ret |= (((const unsigned int *)indev)[i]
82 ^ ((const unsigned int *)info->physindev)[i])
83 & ((const unsigned int *)info->in_mask)[i];
84 }
85
86 if ((ret == 0) ^ !(info->invert & XT_PHYSDEV_OP_IN))
87 return NOMATCH;
88
89match_outdev:
90 if (!(info->bitmask & XT_PHYSDEV_OP_OUT))
91 return MATCH;
92 outdev = nf_bridge->physoutdev ?
93 nf_bridge->physoutdev->name : nulldevname;
94 for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
95 ret |= (((const unsigned int *)outdev)[i]
96 ^ ((const unsigned int *)info->physoutdev)[i])
97 & ((const unsigned int *)info->out_mask)[i];
98 }
99
100 return (ret != 0) ^ !(info->invert & XT_PHYSDEV_OP_OUT);
101}
102
103static int
104checkentry(const char *tablename,
105 const void *ip,
106 const struct xt_match *match,
107 void *matchinfo,
108 unsigned int matchsize,
109 unsigned int hook_mask)
110{
111 const struct xt_physdev_info *info = matchinfo;
112
113 if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
114 info->bitmask & ~XT_PHYSDEV_OP_MASK)
115 return 0;
116 return 1;
117}
118
119static struct xt_match physdev_match = {
120 .name = "physdev",
121 .match = match,
122 .matchsize = sizeof(struct xt_physdev_info),
123 .checkentry = checkentry,
124 .family = AF_INET,
125 .me = THIS_MODULE,
126};
127
128static struct xt_match physdev6_match = {
129 .name = "physdev",
130 .match = match,
131 .matchsize = sizeof(struct xt_physdev_info),
132 .checkentry = checkentry,
133 .family = AF_INET6,
134 .me = THIS_MODULE,
135};
136
137static int __init xt_physdev_init(void)
138{
139 int ret;
140
141 ret = xt_register_match(&physdev_match);
142 if (ret < 0)
143 return ret;
144
145 ret = xt_register_match(&physdev6_match);
146 if (ret < 0)
147 xt_unregister_match(&physdev_match);
148
149 return ret;
150}
151
152static void __exit xt_physdev_fini(void)
153{
154 xt_unregister_match(&physdev_match);
155 xt_unregister_match(&physdev6_match);
156}
157
158module_init(xt_physdev_init);
159module_exit(xt_physdev_fini);