[linux-2.6-block.git] / net / bridge / netfilter / ebt_arp.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 *  ebt_arp
 *
 *	Authors:
 *	Bart De Schuymer <bdschuym@pandora.be>
 *	Tim Gardner <timg@tpi.com>
 *
 *  April, 2002
 *
 */
#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <linux/module.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_bridge/ebtables.h>
#include <linux/netfilter_bridge/ebt_arp.h>

static bool
ebt_arp_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct ebt_arp_info *info = par->matchinfo;
	const struct arphdr *ah;
	struct arphdr _arph;

	ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
	if (ah == NULL)
		return false;
	if ((info->bitmask & EBT_ARP_OPCODE) &&
	    NF_INVF(info, EBT_ARP_OPCODE, info->opcode != ah->ar_op))
		return false;
	if ((info->bitmask & EBT_ARP_HTYPE) &&
	    NF_INVF(info, EBT_ARP_HTYPE, info->htype != ah->ar_hrd))
		return false;
	if ((info->bitmask & EBT_ARP_PTYPE) &&
	    NF_INVF(info, EBT_ARP_PTYPE, info->ptype != ah->ar_pro))
		return false;

	if (info->bitmask & (EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_GRAT)) {
		const __be32 *sap, *dap;
		__be32 saddr, daddr;

		if (ah->ar_pln != sizeof(__be32) || ah->ar_pro != htons(ETH_P_IP))
			return false;
		sap = skb_header_pointer(skb, sizeof(struct arphdr) +
					ah->ar_hln, sizeof(saddr),
					&saddr);
		if (sap == NULL)
			return false;
		dap = skb_header_pointer(skb, sizeof(struct arphdr) +
					2*ah->ar_hln+sizeof(saddr),
					sizeof(daddr), &daddr);
		if (dap == NULL)
			return false;
		if ((info->bitmask & EBT_ARP_SRC_IP) &&
		    NF_INVF(info, EBT_ARP_SRC_IP,
			    info->saddr != (*sap & info->smsk)))
			return false;
		if ((info->bitmask & EBT_ARP_DST_IP) &&
		    NF_INVF(info, EBT_ARP_DST_IP,
			    info->daddr != (*dap & info->dmsk)))
			return false;
		if ((info->bitmask & EBT_ARP_GRAT) &&
		    NF_INVF(info, EBT_ARP_GRAT, *dap != *sap))
			return false;
	}

	if (info->bitmask & (EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC)) {
		const unsigned char *mp;
		unsigned char _mac[ETH_ALEN];

		if (ah->ar_hln != ETH_ALEN || ah->ar_hrd != htons(ARPHRD_ETHER))
			return false;
		if (info->bitmask & EBT_ARP_SRC_MAC) {
			mp = skb_header_pointer(skb, sizeof(struct arphdr),
						sizeof(_mac), &_mac);
			if (mp == NULL)
				return false;
			if (NF_INVF(info, EBT_ARP_SRC_MAC,
				    !ether_addr_equal_masked(mp, info->smaddr,
							     info->smmsk)))
				return false;
		}

		if (info->bitmask & EBT_ARP_DST_MAC) {
			mp = skb_header_pointer(skb, sizeof(struct arphdr) +
						ah->ar_hln + ah->ar_pln,
						sizeof(_mac), &_mac);
			if (mp == NULL)
				return false;
			if (NF_INVF(info, EBT_ARP_DST_MAC,
				    !ether_addr_equal_masked(mp, info->dmaddr,
							     info->dmmsk)))
				return false;
		}
	}

	return true;
}

static int ebt_arp_mt_check(const struct xt_mtchk_param *par)
{
	const struct ebt_arp_info *info = par->matchinfo;
	const struct ebt_entry *e = par->entryinfo;

	if ((e->ethproto != htons(ETH_P_ARP) &&
	   e->ethproto != htons(ETH_P_RARP)) ||
	   e->invflags & EBT_IPROTO)
		return -EINVAL;
	if (info->bitmask & ~EBT_ARP_MASK || info->invflags & ~EBT_ARP_MASK)
		return -EINVAL;
	return 0;
}

static struct xt_match ebt_arp_mt_reg __read_mostly = {
	.name		= "arp",
	.revision	= 0,
	.family		= NFPROTO_BRIDGE,
	.match		= ebt_arp_mt,
	.checkentry	= ebt_arp_mt_check,
	.matchsize	= sizeof(struct ebt_arp_info),
	.me		= THIS_MODULE,
};

static int __init ebt_arp_init(void)
{
	return xt_register_match(&ebt_arp_mt_reg);
}

static void __exit ebt_arp_fini(void)
{
	xt_unregister_match(&ebt_arp_mt_reg);
}

module_init(ebt_arp_init);
module_exit(ebt_arp_fini);
MODULE_DESCRIPTION("Ebtables: ARP protocol packet match");
MODULE_LICENSE("GPL");
Commit	Line	Data
09c434b8	1	// SPDX-License-Identifier: GPL-2.0-only
1da177e4 LT	2	/*
	3	* ebt_arp
	4	*
	5	* Authors:
	6	* Bart De Schuymer <bdschuym@pandora.be>
	7	* Tim Gardner <timg@tpi.com>
	8	*
	9	* April, 2002
	10	*
	11	*/
1da177e4 LT	12	#include <linux/if_arp.h>
	13	#include <linux/if_ether.h>
	14	#include <linux/module.h>
18219d3f JE	15	#include <linux/netfilter/x_tables.h>
	16	#include <linux/netfilter_bridge/ebtables.h>
	17	#include <linux/netfilter_bridge/ebt_arp.h>
1da177e4	18
2d06d4a5	19	static bool
62fc8051	20	ebt_arp_mt(const struct sk_buff skb, struct xt_action_param par)
1da177e4	21	{
f7108a20	22	const struct ebt_arp_info *info = par->matchinfo;
abfdf1c4 JE	23	const struct arphdr *ah;
abfdf1c4 JE	24	struct arphdr _arph;
1da177e4 LT	25
	26	ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
	27	if (ah == NULL)
8cc784ee	28	return false;
c37a2dfa JP	29	if ((info->bitmask & EBT_ARP_OPCODE) &&
c37a2dfa JP	30	NF_INVF(info, EBT_ARP_OPCODE, info->opcode != ah->ar_op))
8cc784ee	31	return false;
c37a2dfa JP	32	if ((info->bitmask & EBT_ARP_HTYPE) &&
c37a2dfa JP	33	NF_INVF(info, EBT_ARP_HTYPE, info->htype != ah->ar_hrd))
8cc784ee	34	return false;
c37a2dfa JP	35	if ((info->bitmask & EBT_ARP_PTYPE) &&
c37a2dfa JP	36	NF_INVF(info, EBT_ARP_PTYPE, info->ptype != ah->ar_pro))
8cc784ee	37	return false;
1da177e4	38
e011ff48	39	if (info->bitmask & (EBT_ARP_SRC_IP \| EBT_ARP_DST_IP \| EBT_ARP_GRAT)) {
abfdf1c4 JE	40	const __be32 sap, dap;
abfdf1c4 JE	41	__be32 saddr, daddr;
1da177e4	42
c15bf6e6	43	if (ah->ar_pln != sizeof(__be32) \|\| ah->ar_pro != htons(ETH_P_IP))
8cc784ee	44	return false;
c15bf6e6 BDS	45	sap = skb_header_pointer(skb, sizeof(struct arphdr) +
	46	ah->ar_hln, sizeof(saddr),
	47	&saddr);
	48	if (sap == NULL)
8cc784ee	49	return false;
c15bf6e6 BDS	50	dap = skb_header_pointer(skb, sizeof(struct arphdr) +
	51	2*ah->ar_hln+sizeof(saddr),
	52	sizeof(daddr), &daddr);
	53	if (dap == NULL)
8cc784ee	54	return false;
c37a2dfa JP	55	if ((info->bitmask & EBT_ARP_SRC_IP) &&
	56	NF_INVF(info, EBT_ARP_SRC_IP,
	57	info->saddr != (*sap & info->smsk)))
8cc784ee	58	return false;
c37a2dfa JP	59	if ((info->bitmask & EBT_ARP_DST_IP) &&
	60	NF_INVF(info, EBT_ARP_DST_IP,
	61	info->daddr != (*dap & info->dmsk)))
8cc784ee	62	return false;
c37a2dfa JP	63	if ((info->bitmask & EBT_ARP_GRAT) &&
c37a2dfa JP	64	NF_INVF(info, EBT_ARP_GRAT, dap != sap))
8cc784ee	65	return false;
1da177e4 LT	66	}
	67
	68	if (info->bitmask & (EBT_ARP_SRC_MAC \| EBT_ARP_DST_MAC)) {
abfdf1c4 JE	69	const unsigned char *mp;
abfdf1c4 JE	70	unsigned char _mac[ETH_ALEN];
1da177e4	71
c15bf6e6	72	if (ah->ar_hln != ETH_ALEN \|\| ah->ar_hrd != htons(ARPHRD_ETHER))
8cc784ee	73	return false;
1da177e4 LT	74	if (info->bitmask & EBT_ARP_SRC_MAC) {
	75	mp = skb_header_pointer(skb, sizeof(struct arphdr),
	76	sizeof(_mac), &_mac);
	77	if (mp == NULL)
8cc784ee	78	return false;
c37a2dfa JP	79	if (NF_INVF(info, EBT_ARP_SRC_MAC,
	80	!ether_addr_equal_masked(mp, info->smaddr,
	81	info->smmsk)))
8cc784ee	82	return false;
1da177e4 LT	83	}
	84
	85	if (info->bitmask & EBT_ARP_DST_MAC) {
	86	mp = skb_header_pointer(skb, sizeof(struct arphdr) +
	87	ah->ar_hln + ah->ar_pln,
	88	sizeof(_mac), &_mac);
	89	if (mp == NULL)
8cc784ee	90	return false;
c37a2dfa JP	91	if (NF_INVF(info, EBT_ARP_DST_MAC,
	92	!ether_addr_equal_masked(mp, info->dmaddr,
	93	info->dmmsk)))
8cc784ee	94	return false;
1da177e4 LT	95	}
	96	}
	97
8cc784ee	98	return true;
1da177e4 LT	99	}
1da177e4 LT	100
b0f38452	101	static int ebt_arp_mt_check(const struct xt_mtchk_param *par)
1da177e4	102	{
9b4fce7a JE	103	const struct ebt_arp_info *info = par->matchinfo;
9b4fce7a JE	104	const struct ebt_entry *e = par->entryinfo;
1da177e4	105
1da177e4 LT	106	if ((e->ethproto != htons(ETH_P_ARP) &&
	107	e->ethproto != htons(ETH_P_RARP)) \|\|
	108	e->invflags & EBT_IPROTO)
bd414ee6	109	return -EINVAL;
1da177e4	110	if (info->bitmask & ~EBT_ARP_MASK \|\| info->invflags & ~EBT_ARP_MASK)
bd414ee6 JE	111	return -EINVAL;
bd414ee6 JE	112	return 0;
1da177e4 LT	113	}
1da177e4 LT	114
043ef46c JE	115	static struct xt_match ebt_arp_mt_reg __read_mostly = {
043ef46c JE	116	.name = "arp",
001a18d3 JE	117	.revision = 0,
001a18d3 JE	118	.family = NFPROTO_BRIDGE,
2d06d4a5 JE	119	.match = ebt_arp_mt,
2d06d4a5 JE	120	.checkentry = ebt_arp_mt_check,
fc0e3df4	121	.matchsize = sizeof(struct ebt_arp_info),
1da177e4 LT	122	.me = THIS_MODULE,
	123	};
	124
65b4b4e8	125	static int __init ebt_arp_init(void)
1da177e4	126	{
043ef46c	127	return xt_register_match(&ebt_arp_mt_reg);
1da177e4 LT	128	}
1da177e4 LT	129
65b4b4e8	130	static void __exit ebt_arp_fini(void)
1da177e4	131	{
043ef46c	132	xt_unregister_match(&ebt_arp_mt_reg);
1da177e4 LT	133	}
1da177e4 LT	134
65b4b4e8 AM	135	module_init(ebt_arp_init);
65b4b4e8 AM	136	module_exit(ebt_arp_fini);
f776c4cd	137	MODULE_DESCRIPTION("Ebtables: ARP protocol packet match");
1da177e4	138	MODULE_LICENSE("GPL");