1 /* Kernel module to match the bridge port in and 2 * out device for IP packets coming into contact with a bridge. */ 3 4 /* (C) 2001-2003 Bart De Schuymer <[email protected]> 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 2 as 8 * published by the Free Software Foundation. 9 */ 10 11 #include <linux/module.h> 12 #include <linux/skbuff.h> 13 #include <linux/netfilter_bridge.h> 14 #include <linux/netfilter/xt_physdev.h> 15 #include <linux/netfilter/x_tables.h> 16 17 MODULE_LICENSE("GPL"); 18 MODULE_AUTHOR("Bart De Schuymer <[email protected]>"); 19 MODULE_DESCRIPTION("iptables bridge physical device match module"); 20 MODULE_ALIAS("ipt_physdev"); 21 MODULE_ALIAS("ip6t_physdev"); 22 23 static bool 24 match(const struct sk_buff *skb, 25 const struct net_device *in, 26 const struct net_device *out, 27 const struct xt_match *match, 28 const void *matchinfo, 29 int offset, 30 unsigned int protoff, 31 bool *hotdrop) 32 { 33 int i; 34 static const char nulldevname[IFNAMSIZ]; 35 const struct xt_physdev_info *info = matchinfo; 36 bool ret; 37 const char *indev, *outdev; 38 const struct nf_bridge_info *nf_bridge; 39 40 /* Not a bridged IP packet or no info available yet: 41 * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if 42 * the destination device will be a bridge. */ 43 if (!(nf_bridge = skb->nf_bridge)) { 44 /* Return MATCH if the invert flags of the used options are on */ 45 if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) && 46 !(info->invert & XT_PHYSDEV_OP_BRIDGED)) 47 return false; 48 if ((info->bitmask & XT_PHYSDEV_OP_ISIN) && 49 !(info->invert & XT_PHYSDEV_OP_ISIN)) 50 return false; 51 if ((info->bitmask & XT_PHYSDEV_OP_ISOUT) && 52 !(info->invert & XT_PHYSDEV_OP_ISOUT)) 53 return false; 54 if ((info->bitmask & XT_PHYSDEV_OP_IN) && 55 !(info->invert & XT_PHYSDEV_OP_IN)) 56 return false; 57 if ((info->bitmask & XT_PHYSDEV_OP_OUT) && 58 !(info->invert & XT_PHYSDEV_OP_OUT)) 59 return false; 60 return true; 61 } 62 63 /* This only makes sense in the FORWARD and POSTROUTING chains */ 64 if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) && 65 (!!(nf_bridge->mask & BRNF_BRIDGED) ^ 66 !(info->invert & XT_PHYSDEV_OP_BRIDGED))) 67 return false; 68 69 if ((info->bitmask & XT_PHYSDEV_OP_ISIN && 70 (!nf_bridge->physindev ^ !!(info->invert & XT_PHYSDEV_OP_ISIN))) || 71 (info->bitmask & XT_PHYSDEV_OP_ISOUT && 72 (!nf_bridge->physoutdev ^ !!(info->invert & XT_PHYSDEV_OP_ISOUT)))) 73 return false; 74 75 if (!(info->bitmask & XT_PHYSDEV_OP_IN)) 76 goto match_outdev; 77 indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname; 78 for (i = 0, ret = false; i < IFNAMSIZ/sizeof(unsigned int); i++) { 79 ret |= (((const unsigned int *)indev)[i] 80 ^ ((const unsigned int *)info->physindev)[i]) 81 & ((const unsigned int *)info->in_mask)[i]; 82 } 83 84 if (!ret ^ !(info->invert & XT_PHYSDEV_OP_IN)) 85 return false; 86 87 match_outdev: 88 if (!(info->bitmask & XT_PHYSDEV_OP_OUT)) 89 return true; 90 outdev = nf_bridge->physoutdev ? 91 nf_bridge->physoutdev->name : nulldevname; 92 for (i = 0, ret = false; i < IFNAMSIZ/sizeof(unsigned int); i++) { 93 ret |= (((const unsigned int *)outdev)[i] 94 ^ ((const unsigned int *)info->physoutdev)[i]) 95 & ((const unsigned int *)info->out_mask)[i]; 96 } 97 98 return ret ^ !(info->invert & XT_PHYSDEV_OP_OUT); 99 } 100 101 static bool 102 checkentry(const char *tablename, 103 const void *ip, 104 const struct xt_match *match, 105 void *matchinfo, 106 unsigned int hook_mask) 107 { 108 const struct xt_physdev_info *info = matchinfo; 109 110 if (!(info->bitmask & XT_PHYSDEV_OP_MASK) || 111 info->bitmask & ~XT_PHYSDEV_OP_MASK) 112 return false; 113 if (info->bitmask & XT_PHYSDEV_OP_OUT && 114 (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) || 115 info->invert & XT_PHYSDEV_OP_BRIDGED) && 116 hook_mask & ((1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_FORWARD) | 117 (1 << NF_IP_POST_ROUTING))) { 118 printk(KERN_WARNING "physdev match: using --physdev-out in the " 119 "OUTPUT, FORWARD and POSTROUTING chains for non-bridged " 120 "traffic is not supported anymore.\n"); 121 if (hook_mask & (1 << NF_IP_LOCAL_OUT)) 122 return false; 123 } 124 return true; 125 } 126 127 static struct xt_match xt_physdev_match[] __read_mostly = { 128 { 129 .name = "physdev", 130 .family = AF_INET, 131 .checkentry = checkentry, 132 .match = match, 133 .matchsize = sizeof(struct xt_physdev_info), 134 .me = THIS_MODULE, 135 }, 136 { 137 .name = "physdev", 138 .family = AF_INET6, 139 .checkentry = checkentry, 140 .match = match, 141 .matchsize = sizeof(struct xt_physdev_info), 142 .me = THIS_MODULE, 143 }, 144 }; 145 146 static int __init xt_physdev_init(void) 147 { 148 return xt_register_matches(xt_physdev_match, 149 ARRAY_SIZE(xt_physdev_match)); 150 } 151 152 static void __exit xt_physdev_fini(void) 153 { 154 xt_unregister_matches(xt_physdev_match, ARRAY_SIZE(xt_physdev_match)); 155 } 156 157 module_init(xt_physdev_init); 158 module_exit(xt_physdev_fini); 159