[linux-2.6-block.git] / net / bridge / netfilter / ebt_arp.c

/*
 *  ebt_arp
 *
 *	Authors:
 *	Bart De Schuymer <bdschuym@pandora.be>
 *	Tim Gardner <timg@tpi.com>
 *
 *  April, 2002
 *
 */

#include <linux/netfilter_bridge/ebtables.h>
#include <linux/netfilter_bridge/ebt_arp.h>
#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <linux/module.h>

static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in,
   const struct net_device *out, const void *data, unsigned int datalen)
{
	struct ebt_arp_info *info = (struct ebt_arp_info *)data;
	struct arphdr _arph, *ah;

	ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
	if (ah == NULL)
		return EBT_NOMATCH;
	if (info->bitmask & EBT_ARP_OPCODE && FWINV(info->opcode !=
	   ah->ar_op, EBT_ARP_OPCODE))
		return EBT_NOMATCH;
	if (info->bitmask & EBT_ARP_HTYPE && FWINV(info->htype !=
	   ah->ar_hrd, EBT_ARP_HTYPE))
		return EBT_NOMATCH;
	if (info->bitmask & EBT_ARP_PTYPE && FWINV(info->ptype !=
	   ah->ar_pro, EBT_ARP_PTYPE))
		return EBT_NOMATCH;

	if (info->bitmask & (EBT_ARP_SRC_IP | EBT_ARP_DST_IP)) {
		__be32 saddr, daddr, *sap, *dap;

		if (ah->ar_pln != sizeof(__be32) || ah->ar_pro != htons(ETH_P_IP))
			return EBT_NOMATCH;
		sap = skb_header_pointer(skb, sizeof(struct arphdr) +
					ah->ar_hln, sizeof(saddr),
					&saddr);
		if (sap == NULL)
			return EBT_NOMATCH;
		dap = skb_header_pointer(skb, sizeof(struct arphdr) +
					2*ah->ar_hln+sizeof(saddr),
					sizeof(daddr), &daddr);
		if (dap == NULL)
			return EBT_NOMATCH;
		if (info->bitmask & EBT_ARP_SRC_IP &&
		    FWINV(info->saddr != (*sap & info->smsk), EBT_ARP_SRC_IP))
			return EBT_NOMATCH;
		if (info->bitmask & EBT_ARP_DST_IP &&
		    FWINV(info->daddr != (*dap & info->dmsk), EBT_ARP_DST_IP))
			return EBT_NOMATCH;
		if (info->bitmask & EBT_ARP_GRAT &&
		    FWINV(*dap != *sap, EBT_ARP_GRAT))
			return EBT_NOMATCH;
	}

	if (info->bitmask & (EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC)) {
		unsigned char _mac[ETH_ALEN], *mp;
		uint8_t verdict, i;

		if (ah->ar_hln != ETH_ALEN || ah->ar_hrd != htons(ARPHRD_ETHER))
			return EBT_NOMATCH;
		if (info->bitmask & EBT_ARP_SRC_MAC) {
			mp = skb_header_pointer(skb, sizeof(struct arphdr),
						sizeof(_mac), &_mac);
			if (mp == NULL)
				return EBT_NOMATCH;
			verdict = 0;
			for (i = 0; i < 6; i++)
				verdict |= (mp[i] ^ info->smaddr[i]) &
				       info->smmsk[i];
			if (FWINV(verdict != 0, EBT_ARP_SRC_MAC))
				return EBT_NOMATCH;
		}

		if (info->bitmask & EBT_ARP_DST_MAC) {
			mp = skb_header_pointer(skb, sizeof(struct arphdr) +
						ah->ar_hln + ah->ar_pln,
						sizeof(_mac), &_mac);
			if (mp == NULL)
				return EBT_NOMATCH;
			verdict = 0;
			for (i = 0; i < 6; i++)
				verdict |= (mp[i] ^ info->dmaddr[i]) &
					info->dmmsk[i];
			if (FWINV(verdict != 0, EBT_ARP_DST_MAC))
				return EBT_NOMATCH;
		}
	}

	return EBT_MATCH;
}

static int ebt_arp_check(const char *tablename, unsigned int hookmask,
   const struct ebt_entry *e, void *data, unsigned int datalen)
{
	struct ebt_arp_info *info = (struct ebt_arp_info *)data;

	if (datalen != EBT_ALIGN(sizeof(struct ebt_arp_info)))
		return -EINVAL;
	if ((e->ethproto != htons(ETH_P_ARP) &&
	   e->ethproto != htons(ETH_P_RARP)) ||
	   e->invflags & EBT_IPROTO)
		return -EINVAL;
	if (info->bitmask & ~EBT_ARP_MASK || info->invflags & ~EBT_ARP_MASK)
		return -EINVAL;
	return 0;
}

static struct ebt_match filter_arp =
{
	.name		= EBT_ARP_MATCH,
	.match		= ebt_filter_arp,
	.check		= ebt_arp_check,
	.me		= THIS_MODULE,
};

static int __init ebt_arp_init(void)
{
	return ebt_register_match(&filter_arp);
}

static void __exit ebt_arp_fini(void)
{
	ebt_unregister_match(&filter_arp);
}

module_init(ebt_arp_init);
module_exit(ebt_arp_fini);
MODULE_LICENSE("GPL");
Commit	Line	Data
1da177e4 LT	1	/*
	2	* ebt_arp
	3	*
	4	* Authors:
	5	* Bart De Schuymer <bdschuym@pandora.be>
	6	* Tim Gardner <timg@tpi.com>
	7	*
	8	* April, 2002
	9	*
	10	*/
	11
	12	#include <linux/netfilter_bridge/ebtables.h>
	13	#include <linux/netfilter_bridge/ebt_arp.h>
	14	#include <linux/if_arp.h>
	15	#include <linux/if_ether.h>
	16	#include <linux/module.h>
	17
	18	static int ebt_filter_arp(const struct sk_buff skb, const struct net_device in,
	19	const struct net_device out, const void data, unsigned int datalen)
	20	{
	21	struct ebt_arp_info info = (struct ebt_arp_info )data;
	22	struct arphdr _arph, *ah;
	23
	24	ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
	25	if (ah == NULL)
	26	return EBT_NOMATCH;
	27	if (info->bitmask & EBT_ARP_OPCODE && FWINV(info->opcode !=
	28	ah->ar_op, EBT_ARP_OPCODE))
	29	return EBT_NOMATCH;
	30	if (info->bitmask & EBT_ARP_HTYPE && FWINV(info->htype !=
	31	ah->ar_hrd, EBT_ARP_HTYPE))
	32	return EBT_NOMATCH;
	33	if (info->bitmask & EBT_ARP_PTYPE && FWINV(info->ptype !=
	34	ah->ar_pro, EBT_ARP_PTYPE))
	35	return EBT_NOMATCH;
	36
	37	if (info->bitmask & (EBT_ARP_SRC_IP \| EBT_ARP_DST_IP)) {
c15bf6e6	38	__be32 saddr, daddr, sap, dap;
1da177e4	39
c15bf6e6 BDS	40	if (ah->ar_pln != sizeof(__be32) \|\| ah->ar_pro != htons(ETH_P_IP))
	41	return EBT_NOMATCH;
	42	sap = skb_header_pointer(skb, sizeof(struct arphdr) +
	43	ah->ar_hln, sizeof(saddr),
	44	&saddr);
	45	if (sap == NULL)
	46	return EBT_NOMATCH;
	47	dap = skb_header_pointer(skb, sizeof(struct arphdr) +
	48	2*ah->ar_hln+sizeof(saddr),
	49	sizeof(daddr), &daddr);
	50	if (dap == NULL)
	51	return EBT_NOMATCH;
	52	if (info->bitmask & EBT_ARP_SRC_IP &&
	53	FWINV(info->saddr != (*sap & info->smsk), EBT_ARP_SRC_IP))
	54	return EBT_NOMATCH;
	55	if (info->bitmask & EBT_ARP_DST_IP &&
	56	FWINV(info->daddr != (*dap & info->dmsk), EBT_ARP_DST_IP))
	57	return EBT_NOMATCH;
	58	if (info->bitmask & EBT_ARP_GRAT &&
	59	FWINV(dap != sap, EBT_ARP_GRAT))
1da177e4	60	return EBT_NOMATCH;
1da177e4 LT	61	}
	62
	63	if (info->bitmask & (EBT_ARP_SRC_MAC \| EBT_ARP_DST_MAC)) {
	64	unsigned char _mac[ETH_ALEN], *mp;
	65	uint8_t verdict, i;
	66
c15bf6e6	67	if (ah->ar_hln != ETH_ALEN \|\| ah->ar_hrd != htons(ARPHRD_ETHER))
1da177e4 LT	68	return EBT_NOMATCH;
	69	if (info->bitmask & EBT_ARP_SRC_MAC) {
	70	mp = skb_header_pointer(skb, sizeof(struct arphdr),
	71	sizeof(_mac), &_mac);
	72	if (mp == NULL)
	73	return EBT_NOMATCH;
	74	verdict = 0;
	75	for (i = 0; i < 6; i++)
	76	verdict \|= (mp[i] ^ info->smaddr[i]) &
	77	info->smmsk[i];
	78	if (FWINV(verdict != 0, EBT_ARP_SRC_MAC))
	79	return EBT_NOMATCH;
	80	}
	81
	82	if (info->bitmask & EBT_ARP_DST_MAC) {
	83	mp = skb_header_pointer(skb, sizeof(struct arphdr) +
	84	ah->ar_hln + ah->ar_pln,
	85	sizeof(_mac), &_mac);
	86	if (mp == NULL)
	87	return EBT_NOMATCH;
	88	verdict = 0;
	89	for (i = 0; i < 6; i++)
	90	verdict \|= (mp[i] ^ info->dmaddr[i]) &
	91	info->dmmsk[i];
	92	if (FWINV(verdict != 0, EBT_ARP_DST_MAC))
	93	return EBT_NOMATCH;
	94	}
	95	}
	96
	97	return EBT_MATCH;
	98	}
	99
	100	static int ebt_arp_check(const char *tablename, unsigned int hookmask,
	101	const struct ebt_entry e, void data, unsigned int datalen)
	102	{
	103	struct ebt_arp_info info = (struct ebt_arp_info )data;
	104
	105	if (datalen != EBT_ALIGN(sizeof(struct ebt_arp_info)))
	106	return -EINVAL;
	107	if ((e->ethproto != htons(ETH_P_ARP) &&
	108	e->ethproto != htons(ETH_P_RARP)) \|\|
	109	e->invflags & EBT_IPROTO)
	110	return -EINVAL;
	111	if (info->bitmask & ~EBT_ARP_MASK \|\| info->invflags & ~EBT_ARP_MASK)
	112	return -EINVAL;
	113	return 0;
	114	}
	115
	116	static struct ebt_match filter_arp =
	117	{
	118	.name = EBT_ARP_MATCH,
	119	.match = ebt_filter_arp,
	120	.check = ebt_arp_check,
	121	.me = THIS_MODULE,
	122	};
	123
65b4b4e8	124	static int __init ebt_arp_init(void)
1da177e4 LT	125	{
	126	return ebt_register_match(&filter_arp);
	127	}
	128
65b4b4e8	129	static void __exit ebt_arp_fini(void)
1da177e4 LT	130	{
	131	ebt_unregister_match(&filter_arp);
	132	}
	133
65b4b4e8 AM	134	module_init(ebt_arp_init);
65b4b4e8 AM	135	module_exit(ebt_arp_fini);
1da177e4	136	MODULE_LICENSE("GPL");