[linux-2.6-block.git] / net / netfilter / xt_physdev.c

/* Kernel module to match the bridge port in and
 * out device for IP packets coming into contact with a bridge. */

/* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/netfilter/xt_physdev.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_bridge.h>
#define MATCH   1
#define NOMATCH 0

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
MODULE_DESCRIPTION("iptables bridge physical device match module");
MODULE_ALIAS("ipt_physdev");
MODULE_ALIAS("ip6t_physdev");

static int
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const struct xt_match *match,
      const void *matchinfo,
      int offset,
      unsigned int protoff,
      int *hotdrop)
{
	int i;
	static const char nulldevname[IFNAMSIZ];
	const struct xt_physdev_info *info = matchinfo;
	unsigned int ret;
	const char *indev, *outdev;
	struct nf_bridge_info *nf_bridge;

	/* Not a bridged IP packet or no info available yet:
	 * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
	 * the destination device will be a bridge. */
	if (!(nf_bridge = skb->nf_bridge)) {
		/* Return MATCH if the invert flags of the used options are on */
		if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
		    !(info->invert & XT_PHYSDEV_OP_BRIDGED))
			return NOMATCH;
		if ((info->bitmask & XT_PHYSDEV_OP_ISIN) &&
		    !(info->invert & XT_PHYSDEV_OP_ISIN))
			return NOMATCH;
		if ((info->bitmask & XT_PHYSDEV_OP_ISOUT) &&
		    !(info->invert & XT_PHYSDEV_OP_ISOUT))
			return NOMATCH;
		if ((info->bitmask & XT_PHYSDEV_OP_IN) &&
		    !(info->invert & XT_PHYSDEV_OP_IN))
			return NOMATCH;
		if ((info->bitmask & XT_PHYSDEV_OP_OUT) &&
		    !(info->invert & XT_PHYSDEV_OP_OUT))
			return NOMATCH;
		return MATCH;
	}

	/* This only makes sense in the FORWARD and POSTROUTING chains */
	if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
	    (!!(nf_bridge->mask & BRNF_BRIDGED) ^
	    !(info->invert & XT_PHYSDEV_OP_BRIDGED)))
		return NOMATCH;

	if ((info->bitmask & XT_PHYSDEV_OP_ISIN &&
	    (!nf_bridge->physindev ^ !!(info->invert & XT_PHYSDEV_OP_ISIN))) ||
	    (info->bitmask & XT_PHYSDEV_OP_ISOUT &&
	    (!nf_bridge->physoutdev ^ !!(info->invert & XT_PHYSDEV_OP_ISOUT))))
		return NOMATCH;

	if (!(info->bitmask & XT_PHYSDEV_OP_IN))
		goto match_outdev;
	indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname;
	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
		ret |= (((const unsigned int *)indev)[i]
			^ ((const unsigned int *)info->physindev)[i])
			& ((const unsigned int *)info->in_mask)[i];
	}

	if ((ret == 0) ^ !(info->invert & XT_PHYSDEV_OP_IN))
		return NOMATCH;

match_outdev:
	if (!(info->bitmask & XT_PHYSDEV_OP_OUT))
		return MATCH;
	outdev = nf_bridge->physoutdev ?
		 nf_bridge->physoutdev->name : nulldevname;
	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
		ret |= (((const unsigned int *)outdev)[i]
			^ ((const unsigned int *)info->physoutdev)[i])
			& ((const unsigned int *)info->out_mask)[i];
	}

	return (ret != 0) ^ !(info->invert & XT_PHYSDEV_OP_OUT);
}

static int
checkentry(const char *tablename,
		       const void *ip,
		       const struct xt_match *match,
		       void *matchinfo,
		       unsigned int matchsize,
		       unsigned int hook_mask)
{
	const struct xt_physdev_info *info = matchinfo;

	if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
	    info->bitmask & ~XT_PHYSDEV_OP_MASK)
		return 0;
	return 1;
}

static struct xt_match physdev_match = {
	.name		= "physdev",
	.match		= match,
	.matchsize	= sizeof(struct xt_physdev_info),
	.checkentry	= checkentry,
	.family		= AF_INET,
	.me		= THIS_MODULE,
};

static struct xt_match physdev6_match = {
	.name		= "physdev",
	.match		= match,
	.matchsize	= sizeof(struct xt_physdev_info),
	.checkentry	= checkentry,
	.family		= AF_INET6,
	.me		= THIS_MODULE,
};

static int __init xt_physdev_init(void)
{
	int ret;

	ret = xt_register_match(&physdev_match);
	if (ret < 0)
		return ret;

	ret = xt_register_match(&physdev6_match);
	if (ret < 0)
		xt_unregister_match(&physdev_match);

	return ret;
}

static void __exit xt_physdev_fini(void)
{
	xt_unregister_match(&physdev_match);
	xt_unregister_match(&physdev6_match);
}

module_init(xt_physdev_init);
module_exit(xt_physdev_fini);
Commit	Line	Data
1da177e4 LT	1	/* Kernel module to match the bridge port in and
	2	* out device for IP packets coming into contact with a bridge. */
	3
	4	/* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
	11	#include <linux/module.h>
	12	#include <linux/skbuff.h>
2e4e6a17 HW	13	#include <linux/netfilter/xt_physdev.h>
2e4e6a17 HW	14	#include <linux/netfilter/x_tables.h>
1da177e4 LT	15	#include <linux/netfilter_bridge.h>
	16	#define MATCH 1
	17	#define NOMATCH 0
	18
	19	MODULE_LICENSE("GPL");
	20	MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
	21	MODULE_DESCRIPTION("iptables bridge physical device match module");
2e4e6a17 HW	22	MODULE_ALIAS("ipt_physdev");
2e4e6a17 HW	23	MODULE_ALIAS("ip6t_physdev");
1da177e4 LT	24
	25	static int
	26	match(const struct sk_buff *skb,
	27	const struct net_device *in,
	28	const struct net_device *out,
c4986734	29	const struct xt_match *match,
1da177e4 LT	30	const void *matchinfo,
	31	int offset,
	32	unsigned int protoff,
	33	int *hotdrop)
	34	{
	35	int i;
	36	static const char nulldevname[IFNAMSIZ];
2e4e6a17	37	const struct xt_physdev_info *info = matchinfo;
1da177e4 LT	38	unsigned int ret;
	39	const char indev, outdev;
	40	struct nf_bridge_info *nf_bridge;
	41
	42	/* Not a bridged IP packet or no info available yet:
	43	* LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
	44	* the destination device will be a bridge. */
	45	if (!(nf_bridge = skb->nf_bridge)) {
	46	/* Return MATCH if the invert flags of the used options are on */
2e4e6a17 HW	47	if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
2e4e6a17 HW	48	!(info->invert & XT_PHYSDEV_OP_BRIDGED))
1da177e4	49	return NOMATCH;
2e4e6a17 HW	50	if ((info->bitmask & XT_PHYSDEV_OP_ISIN) &&
2e4e6a17 HW	51	!(info->invert & XT_PHYSDEV_OP_ISIN))
1da177e4	52	return NOMATCH;
2e4e6a17 HW	53	if ((info->bitmask & XT_PHYSDEV_OP_ISOUT) &&
2e4e6a17 HW	54	!(info->invert & XT_PHYSDEV_OP_ISOUT))
1da177e4	55	return NOMATCH;
2e4e6a17 HW	56	if ((info->bitmask & XT_PHYSDEV_OP_IN) &&
2e4e6a17 HW	57	!(info->invert & XT_PHYSDEV_OP_IN))
1da177e4	58	return NOMATCH;
2e4e6a17 HW	59	if ((info->bitmask & XT_PHYSDEV_OP_OUT) &&
2e4e6a17 HW	60	!(info->invert & XT_PHYSDEV_OP_OUT))
1da177e4 LT	61	return NOMATCH;
	62	return MATCH;
	63	}
	64
	65	/* This only makes sense in the FORWARD and POSTROUTING chains */
2e4e6a17	66	if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
1da177e4	67	(!!(nf_bridge->mask & BRNF_BRIDGED) ^
2e4e6a17	68	!(info->invert & XT_PHYSDEV_OP_BRIDGED)))
1da177e4 LT	69	return NOMATCH;
1da177e4 LT	70
2e4e6a17 HW	71	if ((info->bitmask & XT_PHYSDEV_OP_ISIN &&
	72	(!nf_bridge->physindev ^ !!(info->invert & XT_PHYSDEV_OP_ISIN))) \|\|
	73	(info->bitmask & XT_PHYSDEV_OP_ISOUT &&
	74	(!nf_bridge->physoutdev ^ !!(info->invert & XT_PHYSDEV_OP_ISOUT))))
1da177e4 LT	75	return NOMATCH;
1da177e4 LT	76
2e4e6a17	77	if (!(info->bitmask & XT_PHYSDEV_OP_IN))
1da177e4 LT	78	goto match_outdev;
	79	indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname;
	80	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
	81	ret \|= (((const unsigned int *)indev)[i]
	82	^ ((const unsigned int *)info->physindev)[i])
	83	& ((const unsigned int *)info->in_mask)[i];
	84	}
	85
2e4e6a17	86	if ((ret == 0) ^ !(info->invert & XT_PHYSDEV_OP_IN))
1da177e4 LT	87	return NOMATCH;
	88
	89	match_outdev:
2e4e6a17	90	if (!(info->bitmask & XT_PHYSDEV_OP_OUT))
1da177e4 LT	91	return MATCH;
	92	outdev = nf_bridge->physoutdev ?
	93	nf_bridge->physoutdev->name : nulldevname;
	94	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
	95	ret \|= (((const unsigned int *)outdev)[i]
	96	^ ((const unsigned int *)info->physoutdev)[i])
	97	& ((const unsigned int *)info->out_mask)[i];
	98	}
	99
2e4e6a17	100	return (ret != 0) ^ !(info->invert & XT_PHYSDEV_OP_OUT);
1da177e4 LT	101	}
	102
	103	static int
	104	checkentry(const char *tablename,
2e4e6a17	105	const void *ip,
c4986734	106	const struct xt_match *match,
1da177e4 LT	107	void *matchinfo,
	108	unsigned int matchsize,
	109	unsigned int hook_mask)
	110	{
2e4e6a17	111	const struct xt_physdev_info *info = matchinfo;
1da177e4	112
2e4e6a17 HW	113	if (!(info->bitmask & XT_PHYSDEV_OP_MASK) \|\|
2e4e6a17 HW	114	info->bitmask & ~XT_PHYSDEV_OP_MASK)
1da177e4 LT	115	return 0;
	116	return 1;
	117	}
	118
2e4e6a17 HW	119	static struct xt_match physdev_match = {
2e4e6a17 HW	120	.name = "physdev",
5d04bff0 PM	121	.match = match,
	122	.matchsize = sizeof(struct xt_physdev_info),
	123	.checkentry = checkentry,
a45049c5	124	.family = AF_INET,
2e4e6a17 HW	125	.me = THIS_MODULE,
	126	};
	127
	128	static struct xt_match physdev6_match = {
1da177e4	129	.name = "physdev",
5d04bff0 PM	130	.match = match,
	131	.matchsize = sizeof(struct xt_physdev_info),
	132	.checkentry = checkentry,
a45049c5	133	.family = AF_INET6,
1da177e4 LT	134	.me = THIS_MODULE,
	135	};
	136
65b4b4e8	137	static int __init xt_physdev_init(void)
1da177e4	138	{
2e4e6a17 HW	139	int ret;
2e4e6a17 HW	140
a45049c5	141	ret = xt_register_match(&physdev_match);
2e4e6a17 HW	142	if (ret < 0)
	143	return ret;
	144
a45049c5	145	ret = xt_register_match(&physdev6_match);
2e4e6a17	146	if (ret < 0)
a45049c5	147	xt_unregister_match(&physdev_match);
2e4e6a17 HW	148
2e4e6a17 HW	149	return ret;
1da177e4 LT	150	}
1da177e4 LT	151
65b4b4e8	152	static void __exit xt_physdev_fini(void)
1da177e4	153	{
a45049c5 PNA	154	xt_unregister_match(&physdev_match);
a45049c5 PNA	155	xt_unregister_match(&physdev6_match);
1da177e4 LT	156	}
1da177e4 LT	157
65b4b4e8 AM	158	module_init(xt_physdev_init);
65b4b4e8 AM	159	module_exit(xt_physdev_fini);