[linux-2.6-block.git] / net / netfilter / xt_physdev.c

/* Kernel module to match the bridge port in and
 * out device for IP packets coming into contact with a bridge. */

/* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/netfilter/xt_physdev.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_bridge.h>
#define MATCH   1
#define NOMATCH 0

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
MODULE_DESCRIPTION("iptables bridge physical device match module");
MODULE_ALIAS("ipt_physdev");
MODULE_ALIAS("ip6t_physdev");

static int
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const struct xt_match *match,
      const void *matchinfo,
      int offset,
      unsigned int protoff,
      int *hotdrop)
{
	int i;
	static const char nulldevname[IFNAMSIZ];
	const struct xt_physdev_info *info = matchinfo;
	unsigned int ret;
	const char *indev, *outdev;
	struct nf_bridge_info *nf_bridge;

	/* Not a bridged IP packet or no info available yet:
	 * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
	 * the destination device will be a bridge. */
	if (!(nf_bridge = skb->nf_bridge)) {
		/* Return MATCH if the invert flags of the used options are on */
		if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
		    !(info->invert & XT_PHYSDEV_OP_BRIDGED))
			return NOMATCH;
		if ((info->bitmask & XT_PHYSDEV_OP_ISIN) &&
		    !(info->invert & XT_PHYSDEV_OP_ISIN))
			return NOMATCH;
		if ((info->bitmask & XT_PHYSDEV_OP_ISOUT) &&
		    !(info->invert & XT_PHYSDEV_OP_ISOUT))
			return NOMATCH;
		if ((info->bitmask & XT_PHYSDEV_OP_IN) &&
		    !(info->invert & XT_PHYSDEV_OP_IN))
			return NOMATCH;
		if ((info->bitmask & XT_PHYSDEV_OP_OUT) &&
		    !(info->invert & XT_PHYSDEV_OP_OUT))
			return NOMATCH;
		return MATCH;
	}

	/* This only makes sense in the FORWARD and POSTROUTING chains */
	if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
	    (!!(nf_bridge->mask & BRNF_BRIDGED) ^
	    !(info->invert & XT_PHYSDEV_OP_BRIDGED)))
		return NOMATCH;

	if ((info->bitmask & XT_PHYSDEV_OP_ISIN &&
	    (!nf_bridge->physindev ^ !!(info->invert & XT_PHYSDEV_OP_ISIN))) ||
	    (info->bitmask & XT_PHYSDEV_OP_ISOUT &&
	    (!nf_bridge->physoutdev ^ !!(info->invert & XT_PHYSDEV_OP_ISOUT))))
		return NOMATCH;

	if (!(info->bitmask & XT_PHYSDEV_OP_IN))
		goto match_outdev;
	indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname;
	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
		ret |= (((const unsigned int *)indev)[i]
			^ ((const unsigned int *)info->physindev)[i])
			& ((const unsigned int *)info->in_mask)[i];
	}

	if ((ret == 0) ^ !(info->invert & XT_PHYSDEV_OP_IN))
		return NOMATCH;

match_outdev:
	if (!(info->bitmask & XT_PHYSDEV_OP_OUT))
		return MATCH;
	outdev = nf_bridge->physoutdev ?
		 nf_bridge->physoutdev->name : nulldevname;
	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
		ret |= (((const unsigned int *)outdev)[i]
			^ ((const unsigned int *)info->physoutdev)[i])
			& ((const unsigned int *)info->out_mask)[i];
	}

	return (ret != 0) ^ !(info->invert & XT_PHYSDEV_OP_OUT);
}

static int
checkentry(const char *tablename,
		       const void *ip,
		       const struct xt_match *match,
		       void *matchinfo,
		       unsigned int matchsize,
		       unsigned int hook_mask)
{
	const struct xt_physdev_info *info = matchinfo;

	if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
	    info->bitmask & ~XT_PHYSDEV_OP_MASK)
		return 0;
	return 1;
}

static struct xt_match physdev_match = {
	.name		= "physdev",
	.match		= match,
	.matchsize	= sizeof(struct xt_physdev_info),
	.checkentry	= checkentry,
	.family		= AF_INET,
	.me		= THIS_MODULE,
};

static struct xt_match physdev6_match = {
	.name		= "physdev",
	.match		= match,
	.matchsize	= sizeof(struct xt_physdev_info),
	.checkentry	= checkentry,
	.family		= AF_INET6,
	.me		= THIS_MODULE,
};

static int __init xt_physdev_init(void)
{
	int ret;

	ret = xt_register_match(&physdev_match);
	if (ret < 0)
		return ret;

	ret = xt_register_match(&physdev6_match);
	if (ret < 0)
		xt_unregister_match(&physdev_match);

	return ret;
}

static void __exit xt_physdev_fini(void)
{
	xt_unregister_match(&physdev_match);
	xt_unregister_match(&physdev6_match);
}

module_init(xt_physdev_init);
module_exit(xt_physdev_fini);
Commit	Line	Data
	1	/* Kernel module to match the bridge port in and
	2	* out device for IP packets coming into contact with a bridge. */
	3
	4	/* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
	11	#include <linux/module.h>
	12	#include <linux/skbuff.h>
	13	#include <linux/netfilter/xt_physdev.h>
	14	#include <linux/netfilter/x_tables.h>
	15	#include <linux/netfilter_bridge.h>
	16	#define MATCH 1
	17	#define NOMATCH 0
	18
	19	MODULE_LICENSE("GPL");
	20	MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
	21	MODULE_DESCRIPTION("iptables bridge physical device match module");
	22	MODULE_ALIAS("ipt_physdev");
	23	MODULE_ALIAS("ip6t_physdev");
	24
	25	static int
	26	match(const struct sk_buff *skb,
	27	const struct net_device *in,
	28	const struct net_device *out,
	29	const struct xt_match *match,
	30	const void *matchinfo,
	31	int offset,
	32	unsigned int protoff,
	33	int *hotdrop)
	34	{
	35	int i;
	36	static const char nulldevname[IFNAMSIZ];
	37	const struct xt_physdev_info *info = matchinfo;
	38	unsigned int ret;
	39	const char indev, outdev;
	40	struct nf_bridge_info *nf_bridge;
	41
	42	/* Not a bridged IP packet or no info available yet:
	43	* LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
	44	* the destination device will be a bridge. */
	45	if (!(nf_bridge = skb->nf_bridge)) {
	46	/* Return MATCH if the invert flags of the used options are on */
	47	if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
	48	!(info->invert & XT_PHYSDEV_OP_BRIDGED))
	49	return NOMATCH;
	50	if ((info->bitmask & XT_PHYSDEV_OP_ISIN) &&
	51	!(info->invert & XT_PHYSDEV_OP_ISIN))
	52	return NOMATCH;
	53	if ((info->bitmask & XT_PHYSDEV_OP_ISOUT) &&
	54	!(info->invert & XT_PHYSDEV_OP_ISOUT))
	55	return NOMATCH;
	56	if ((info->bitmask & XT_PHYSDEV_OP_IN) &&
	57	!(info->invert & XT_PHYSDEV_OP_IN))
	58	return NOMATCH;
	59	if ((info->bitmask & XT_PHYSDEV_OP_OUT) &&
	60	!(info->invert & XT_PHYSDEV_OP_OUT))
	61	return NOMATCH;
	62	return MATCH;
	63	}
	64
	65	/* This only makes sense in the FORWARD and POSTROUTING chains */
	66	if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
	67	(!!(nf_bridge->mask & BRNF_BRIDGED) ^
	68	!(info->invert & XT_PHYSDEV_OP_BRIDGED)))
	69	return NOMATCH;
	70
	71	if ((info->bitmask & XT_PHYSDEV_OP_ISIN &&
	72	(!nf_bridge->physindev ^ !!(info->invert & XT_PHYSDEV_OP_ISIN))) \|\|
	73	(info->bitmask & XT_PHYSDEV_OP_ISOUT &&
	74	(!nf_bridge->physoutdev ^ !!(info->invert & XT_PHYSDEV_OP_ISOUT))))
	75	return NOMATCH;
	76
	77	if (!(info->bitmask & XT_PHYSDEV_OP_IN))
	78	goto match_outdev;
	79	indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname;
	80	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
	81	ret \|= (((const unsigned int *)indev)[i]
	82	^ ((const unsigned int *)info->physindev)[i])
	83	& ((const unsigned int *)info->in_mask)[i];
	84	}
	85
	86	if ((ret == 0) ^ !(info->invert & XT_PHYSDEV_OP_IN))
	87	return NOMATCH;
	88
	89	match_outdev:
	90	if (!(info->bitmask & XT_PHYSDEV_OP_OUT))
	91	return MATCH;
	92	outdev = nf_bridge->physoutdev ?
	93	nf_bridge->physoutdev->name : nulldevname;
	94	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
	95	ret \|= (((const unsigned int *)outdev)[i]
	96	^ ((const unsigned int *)info->physoutdev)[i])
	97	& ((const unsigned int *)info->out_mask)[i];
	98	}
	99
	100	return (ret != 0) ^ !(info->invert & XT_PHYSDEV_OP_OUT);
	101	}
	102
	103	static int
	104	checkentry(const char *tablename,
	105	const void *ip,
	106	const struct xt_match *match,
	107	void *matchinfo,
	108	unsigned int matchsize,
	109	unsigned int hook_mask)
	110	{
	111	const struct xt_physdev_info *info = matchinfo;
	112
	113	if (!(info->bitmask & XT_PHYSDEV_OP_MASK) \|\|
	114	info->bitmask & ~XT_PHYSDEV_OP_MASK)
	115	return 0;
	116	return 1;
	117	}
	118
	119	static struct xt_match physdev_match = {
	120	.name = "physdev",
	121	.match = match,
	122	.matchsize = sizeof(struct xt_physdev_info),
	123	.checkentry = checkentry,
	124	.family = AF_INET,
	125	.me = THIS_MODULE,
	126	};
	127
	128	static struct xt_match physdev6_match = {
	129	.name = "physdev",
	130	.match = match,
	131	.matchsize = sizeof(struct xt_physdev_info),
	132	.checkentry = checkentry,
	133	.family = AF_INET6,
	134	.me = THIS_MODULE,
	135	};
	136
	137	static int __init xt_physdev_init(void)
	138	{
	139	int ret;
	140
	141	ret = xt_register_match(&physdev_match);
	142	if (ret < 0)
	143	return ret;
	144
	145	ret = xt_register_match(&physdev6_match);
	146	if (ret < 0)
	147	xt_unregister_match(&physdev_match);
	148
	149	return ret;
	150	}
	151
	152	static void __exit xt_physdev_fini(void)
	153	{
	154	xt_unregister_match(&physdev_match);
	155	xt_unregister_match(&physdev6_match);
	156	}
	157
	158	module_init(xt_physdev_init);
	159	module_exit(xt_physdev_fini);