[net-next-2.6.git] / net / ipv4 / netfilter / ipt_physdev.c

/* Kernel module to match the bridge port in and
 * out device for IP packets coming into contact with a bridge. */

/* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/netdevice.h>
#include <linux/skbuff.h>
#include <linux/netfilter_ipv4/ipt_physdev.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_bridge.h>
#define MATCH   1
#define NOMATCH 0

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
MODULE_DESCRIPTION("iptables bridge physical device match module");

static int
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const void *matchinfo,
      int offset,
      int *hotdrop)
{
	int i;
	static const char nulldevname[IFNAMSIZ];
	const struct ipt_physdev_info *info = matchinfo;
	unsigned int ret;
	const char *indev, *outdev;
	struct nf_bridge_info *nf_bridge;

	/* Not a bridged IP packet or no info available yet:
	 * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
	 * the destination device will be a bridge. */
	if (!(nf_bridge = skb->nf_bridge)) {
		/* Return MATCH if the invert flags of the used options are on */
		if ((info->bitmask & IPT_PHYSDEV_OP_BRIDGED) &&
		    !(info->invert & IPT_PHYSDEV_OP_BRIDGED))
			return NOMATCH;
		if ((info->bitmask & IPT_PHYSDEV_OP_ISIN) &&
		    !(info->invert & IPT_PHYSDEV_OP_ISIN))
			return NOMATCH;
		if ((info->bitmask & IPT_PHYSDEV_OP_ISOUT) &&
		    !(info->invert & IPT_PHYSDEV_OP_ISOUT))
			return NOMATCH;
		if ((info->bitmask & IPT_PHYSDEV_OP_IN) &&
		    !(info->invert & IPT_PHYSDEV_OP_IN))
			return NOMATCH;
		if ((info->bitmask & IPT_PHYSDEV_OP_OUT) &&
		    !(info->invert & IPT_PHYSDEV_OP_OUT))
			return NOMATCH;
		return MATCH;
	}

	/* This only makes sense in the FORWARD and POSTROUTING chains */
	if ((info->bitmask & IPT_PHYSDEV_OP_BRIDGED) &&
	    (!!(nf_bridge->mask & BRNF_BRIDGED) ^
	    !(info->invert & IPT_PHYSDEV_OP_BRIDGED)))
		return NOMATCH;

	if ((info->bitmask & IPT_PHYSDEV_OP_ISIN &&
	    (!nf_bridge->physindev ^ !!(info->invert & IPT_PHYSDEV_OP_ISIN))) ||
	    (info->bitmask & IPT_PHYSDEV_OP_ISOUT &&
	    (!nf_bridge->physoutdev ^ !!(info->invert & IPT_PHYSDEV_OP_ISOUT))))
		return NOMATCH;

	if (!(info->bitmask & IPT_PHYSDEV_OP_IN))
		goto match_outdev;
	indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname;
	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
		ret |= (((const unsigned int *)indev)[i]
			^ ((const unsigned int *)info->physindev)[i])
			& ((const unsigned int *)info->in_mask)[i];
	}

	if ((ret == 0) ^ !(info->invert & IPT_PHYSDEV_OP_IN))
		return NOMATCH;

match_outdev:
	if (!(info->bitmask & IPT_PHYSDEV_OP_OUT))
		return MATCH;
	outdev = nf_bridge->physoutdev ?
		 nf_bridge->physoutdev->name : nulldevname;
	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
		ret |= (((const unsigned int *)outdev)[i]
			^ ((const unsigned int *)info->physoutdev)[i])
			& ((const unsigned int *)info->out_mask)[i];
	}

	return (ret != 0) ^ !(info->invert & IPT_PHYSDEV_OP_OUT);
}

static int
checkentry(const char *tablename,
		       const struct ipt_ip *ip,
		       void *matchinfo,
		       unsigned int matchsize,
		       unsigned int hook_mask)
{
	const struct ipt_physdev_info *info = matchinfo;

	if (matchsize != IPT_ALIGN(sizeof(struct ipt_physdev_info)))
		return 0;
	if (!(info->bitmask & IPT_PHYSDEV_OP_MASK) ||
	    info->bitmask & ~IPT_PHYSDEV_OP_MASK)
		return 0;
	return 1;
}

static struct ipt_match physdev_match = {
	.name		= "physdev",
	.match		= &match,
	.checkentry	= &checkentry,
	.me		= THIS_MODULE,
};

static int __init init(void)
{
	return ipt_register_match(&physdev_match);
}

static void __exit fini(void)
{
	ipt_unregister_match(&physdev_match);
}

module_init(init);
module_exit(fini);
Commit	Line	Data
1da177e4 LT	1	/* Kernel module to match the bridge port in and
	2	* out device for IP packets coming into contact with a bridge. */
	3
	4	/* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
	11	#include <linux/module.h>
14c85021	12	#include <linux/netdevice.h>
1da177e4 LT	13	#include <linux/skbuff.h>
	14	#include <linux/netfilter_ipv4/ipt_physdev.h>
	15	#include <linux/netfilter_ipv4/ip_tables.h>
	16	#include <linux/netfilter_bridge.h>
	17	#define MATCH 1
	18	#define NOMATCH 0
	19
	20	MODULE_LICENSE("GPL");
	21	MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
	22	MODULE_DESCRIPTION("iptables bridge physical device match module");
	23
	24	static int
	25	match(const struct sk_buff *skb,
	26	const struct net_device *in,
	27	const struct net_device *out,
	28	const void *matchinfo,
	29	int offset,
	30	int *hotdrop)
	31	{
	32	int i;
	33	static const char nulldevname[IFNAMSIZ];
	34	const struct ipt_physdev_info *info = matchinfo;
	35	unsigned int ret;
	36	const char indev, outdev;
	37	struct nf_bridge_info *nf_bridge;
	38
	39	/* Not a bridged IP packet or no info available yet:
	40	* LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
	41	* the destination device will be a bridge. */
	42	if (!(nf_bridge = skb->nf_bridge)) {
	43	/* Return MATCH if the invert flags of the used options are on */
	44	if ((info->bitmask & IPT_PHYSDEV_OP_BRIDGED) &&
	45	!(info->invert & IPT_PHYSDEV_OP_BRIDGED))
	46	return NOMATCH;
	47	if ((info->bitmask & IPT_PHYSDEV_OP_ISIN) &&
	48	!(info->invert & IPT_PHYSDEV_OP_ISIN))
	49	return NOMATCH;
	50	if ((info->bitmask & IPT_PHYSDEV_OP_ISOUT) &&
	51	!(info->invert & IPT_PHYSDEV_OP_ISOUT))
	52	return NOMATCH;
	53	if ((info->bitmask & IPT_PHYSDEV_OP_IN) &&
	54	!(info->invert & IPT_PHYSDEV_OP_IN))
	55	return NOMATCH;
	56	if ((info->bitmask & IPT_PHYSDEV_OP_OUT) &&
	57	!(info->invert & IPT_PHYSDEV_OP_OUT))
	58	return NOMATCH;
	59	return MATCH;
	60	}
	61
	62	/* This only makes sense in the FORWARD and POSTROUTING chains */
	63	if ((info->bitmask & IPT_PHYSDEV_OP_BRIDGED) &&
	64	(!!(nf_bridge->mask & BRNF_BRIDGED) ^
	65	!(info->invert & IPT_PHYSDEV_OP_BRIDGED)))
	66	return NOMATCH;
	67
	68	if ((info->bitmask & IPT_PHYSDEV_OP_ISIN &&
	69	(!nf_bridge->physindev ^ !!(info->invert & IPT_PHYSDEV_OP_ISIN))) \|\|
	70	(info->bitmask & IPT_PHYSDEV_OP_ISOUT &&
	71	(!nf_bridge->physoutdev ^ !!(info->invert & IPT_PHYSDEV_OP_ISOUT))))
	72	return NOMATCH;
	73
	74	if (!(info->bitmask & IPT_PHYSDEV_OP_IN))
	75	goto match_outdev;
	76	indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname;
77	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
78	ret \|= (((const unsigned int *)indev)[i]
79	^ ((const unsigned int *)info->physindev)[i])
80	& ((const unsigned int *)info->in_mask)[i];
81	}
82
83	if ((ret == 0) ^ !(info->invert & IPT_PHYSDEV_OP_IN))
84	return NOMATCH;
85
86	match_outdev:
87	if (!(info->bitmask & IPT_PHYSDEV_OP_OUT))
88	return MATCH;
89	outdev = nf_bridge->physoutdev ?
90	nf_bridge->physoutdev->name : nulldevname;
91	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
92	ret \|= (((const unsigned int *)outdev)[i]
93	^ ((const unsigned int *)info->physoutdev)[i])
94	& ((const unsigned int *)info->out_mask)[i];
95	}
96
97	return (ret != 0) ^ !(info->invert & IPT_PHYSDEV_OP_OUT);
98	}
99
100	static int
101	checkentry(const char *tablename,
102	const struct ipt_ip *ip,
103	void *matchinfo,
104	unsigned int matchsize,
105	unsigned int hook_mask)
106	{
107	const struct ipt_physdev_info *info = matchinfo;
108
109	if (matchsize != IPT_ALIGN(sizeof(struct ipt_physdev_info)))
110	return 0;
111	if (!(info->bitmask & IPT_PHYSDEV_OP_MASK) \|\|
112	info->bitmask & ~IPT_PHYSDEV_OP_MASK)
113	return 0;
114	return 1;
115	}
116
117	static struct ipt_match physdev_match = {
118	.name = "physdev",
119	.match = &match,
120	.checkentry = &checkentry,
121	.me = THIS_MODULE,
122	};
123
124	static int __init init(void)
125	{
126	return ipt_register_match(&physdev_match);
127	}
128
129	static void __exit fini(void)
130	{
131	ipt_unregister_match(&physdev_match);
132	}
133
134	module_init(init);
135	module_exit(fini);