Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1/* Kernel module to match the bridge port in and
2 * out device for IP packets coming into contact with a bridge. */
3
4/* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10
11#include <linux/module.h>
12#include <linux/skbuff.h>
13#include <linux/netfilter_bridge.h>
14#include <linux/netfilter/xt_physdev.h>
15#include <linux/netfilter/x_tables.h>
16
17MODULE_LICENSE("GPL");
18MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
19MODULE_DESCRIPTION("iptables bridge physical device match module");
20MODULE_ALIAS("ipt_physdev");
21MODULE_ALIAS("ip6t_physdev");
22
23static bool
24match(const struct sk_buff *skb,
25 const struct net_device *in,
26 const struct net_device *out,
27 const struct xt_match *match,
28 const void *matchinfo,
29 int offset,
30 unsigned int protoff,
31 bool *hotdrop)
32{
33 int i;
34 static const char nulldevname[IFNAMSIZ];
35 const struct xt_physdev_info *info = matchinfo;
36 bool ret;
37 const char *indev, *outdev;
38 const struct nf_bridge_info *nf_bridge;
39
40 /* Not a bridged IP packet or no info available yet:
41 * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
42 * the destination device will be a bridge. */
43 if (!(nf_bridge = skb->nf_bridge)) {
44 /* Return MATCH if the invert flags of the used options are on */
45 if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
46 !(info->invert & XT_PHYSDEV_OP_BRIDGED))
47 return false;
48 if ((info->bitmask & XT_PHYSDEV_OP_ISIN) &&
49 !(info->invert & XT_PHYSDEV_OP_ISIN))
50 return false;
51 if ((info->bitmask & XT_PHYSDEV_OP_ISOUT) &&
52 !(info->invert & XT_PHYSDEV_OP_ISOUT))
53 return false;
54 if ((info->bitmask & XT_PHYSDEV_OP_IN) &&
55 !(info->invert & XT_PHYSDEV_OP_IN))
56 return false;
57 if ((info->bitmask & XT_PHYSDEV_OP_OUT) &&
58 !(info->invert & XT_PHYSDEV_OP_OUT))
59 return false;
60 return true;
61 }
62
63 /* This only makes sense in the FORWARD and POSTROUTING chains */
64 if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
65 (!!(nf_bridge->mask & BRNF_BRIDGED) ^
66 !(info->invert & XT_PHYSDEV_OP_BRIDGED)))
67 return false;
68
69 if ((info->bitmask & XT_PHYSDEV_OP_ISIN &&
70 (!nf_bridge->physindev ^ !!(info->invert & XT_PHYSDEV_OP_ISIN))) ||
71 (info->bitmask & XT_PHYSDEV_OP_ISOUT &&
72 (!nf_bridge->physoutdev ^ !!(info->invert & XT_PHYSDEV_OP_ISOUT))))
73 return false;
74
75 if (!(info->bitmask & XT_PHYSDEV_OP_IN))
76 goto match_outdev;
77 indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname;
78 for (i = 0, ret = false; i < IFNAMSIZ/sizeof(unsigned int); i++) {
79 ret |= (((const unsigned int *)indev)[i]
80 ^ ((const unsigned int *)info->physindev)[i])
81 & ((const unsigned int *)info->in_mask)[i];
82 }
83
84 if (!ret ^ !(info->invert & XT_PHYSDEV_OP_IN))
85 return false;
86
87match_outdev:
88 if (!(info->bitmask & XT_PHYSDEV_OP_OUT))
89 return true;
90 outdev = nf_bridge->physoutdev ?
91 nf_bridge->physoutdev->name : nulldevname;
92 for (i = 0, ret = false; i < IFNAMSIZ/sizeof(unsigned int); i++) {
93 ret |= (((const unsigned int *)outdev)[i]
94 ^ ((const unsigned int *)info->physoutdev)[i])
95 & ((const unsigned int *)info->out_mask)[i];
96 }
97
98 return ret ^ !(info->invert & XT_PHYSDEV_OP_OUT);
99}
100
101static bool
102checkentry(const char *tablename,
103 const void *ip,
104 const struct xt_match *match,
105 void *matchinfo,
106 unsigned int hook_mask)
107{
108 const struct xt_physdev_info *info = matchinfo;
109
110 if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
111 info->bitmask & ~XT_PHYSDEV_OP_MASK)
112 return false;
113 if (info->bitmask & XT_PHYSDEV_OP_OUT &&
114 (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
115 info->invert & XT_PHYSDEV_OP_BRIDGED) &&
116 hook_mask & ((1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_FORWARD) |
117 (1 << NF_IP_POST_ROUTING))) {
118 printk(KERN_WARNING "physdev match: using --physdev-out in the "
119 "OUTPUT, FORWARD and POSTROUTING chains for non-bridged "
120 "traffic is not supported anymore.\n");
121 if (hook_mask & (1 << NF_IP_LOCAL_OUT))
122 return false;
123 }
124 return true;
125}
126
127static struct xt_match xt_physdev_match[] __read_mostly = {
128 {
129 .name = "physdev",
130 .family = AF_INET,
131 .checkentry = checkentry,
132 .match = match,
133 .matchsize = sizeof(struct xt_physdev_info),
134 .me = THIS_MODULE,
135 },
136 {
137 .name = "physdev",
138 .family = AF_INET6,
139 .checkentry = checkentry,
140 .match = match,
141 .matchsize = sizeof(struct xt_physdev_info),
142 .me = THIS_MODULE,
143 },
144};
145
146static int __init xt_physdev_init(void)
147{
148 return xt_register_matches(xt_physdev_match,
149 ARRAY_SIZE(xt_physdev_match));
150}
151
152static void __exit xt_physdev_fini(void)
153{
154 xt_unregister_matches(xt_physdev_match, ARRAY_SIZE(xt_physdev_match));
155}
156
157module_init(xt_physdev_init);
158module_exit(xt_physdev_fini);