1 /* Kernel module to match the bridge port in and
2 * out device for IP packets coming into contact with a bridge. */
4 /* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
13 #include <linux/netfilter/xt_physdev.h>
14 #include <linux/netfilter/x_tables.h>
15 #include <linux/netfilter_bridge.h>
19 MODULE_LICENSE("GPL");
20 MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
21 MODULE_DESCRIPTION("iptables bridge physical device match module");
22 MODULE_ALIAS("ipt_physdev");
23 MODULE_ALIAS("ip6t_physdev");
26 match(const struct sk_buff *skb,
27 const struct net_device *in,
28 const struct net_device *out,
29 const struct xt_match *match,
30 const void *matchinfo,
36 static const char nulldevname[IFNAMSIZ];
37 const struct xt_physdev_info *info = matchinfo;
39 const char *indev, *outdev;
40 struct nf_bridge_info *nf_bridge;
42 /* Not a bridged IP packet or no info available yet:
43 * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
44 * the destination device will be a bridge. */
45 if (!(nf_bridge = skb->nf_bridge)) {
46 /* Return MATCH if the invert flags of the used options are on */
47 if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
48 !(info->invert & XT_PHYSDEV_OP_BRIDGED))
50 if ((info->bitmask & XT_PHYSDEV_OP_ISIN) &&
51 !(info->invert & XT_PHYSDEV_OP_ISIN))
53 if ((info->bitmask & XT_PHYSDEV_OP_ISOUT) &&
54 !(info->invert & XT_PHYSDEV_OP_ISOUT))
56 if ((info->bitmask & XT_PHYSDEV_OP_IN) &&
57 !(info->invert & XT_PHYSDEV_OP_IN))
59 if ((info->bitmask & XT_PHYSDEV_OP_OUT) &&
60 !(info->invert & XT_PHYSDEV_OP_OUT))
65 /* This only makes sense in the FORWARD and POSTROUTING chains */
66 if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
67 (!!(nf_bridge->mask & BRNF_BRIDGED) ^
68 !(info->invert & XT_PHYSDEV_OP_BRIDGED)))
71 if ((info->bitmask & XT_PHYSDEV_OP_ISIN &&
72 (!nf_bridge->physindev ^ !!(info->invert & XT_PHYSDEV_OP_ISIN))) ||
73 (info->bitmask & XT_PHYSDEV_OP_ISOUT &&
74 (!nf_bridge->physoutdev ^ !!(info->invert & XT_PHYSDEV_OP_ISOUT))))
77 if (!(info->bitmask & XT_PHYSDEV_OP_IN))
79 indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname;
80 for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
81 ret |= (((const unsigned int *)indev)[i]
82 ^ ((const unsigned int *)info->physindev)[i])
83 & ((const unsigned int *)info->in_mask)[i];
86 if ((ret == 0) ^ !(info->invert & XT_PHYSDEV_OP_IN))
90 if (!(info->bitmask & XT_PHYSDEV_OP_OUT))
92 outdev = nf_bridge->physoutdev ?
93 nf_bridge->physoutdev->name : nulldevname;
94 for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
95 ret |= (((const unsigned int *)outdev)[i]
96 ^ ((const unsigned int *)info->physoutdev)[i])
97 & ((const unsigned int *)info->out_mask)[i];
100 return (ret != 0) ^ !(info->invert & XT_PHYSDEV_OP_OUT);
104 checkentry(const char *tablename,
106 const struct xt_match *match,
108 unsigned int matchsize,
109 unsigned int hook_mask)
111 const struct xt_physdev_info *info = matchinfo;
113 if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
114 info->bitmask & ~XT_PHYSDEV_OP_MASK)
119 static struct xt_match physdev_match = {
122 .matchsize = sizeof(struct xt_physdev_info),
123 .checkentry = checkentry,
128 static struct xt_match physdev6_match = {
131 .matchsize = sizeof(struct xt_physdev_info),
132 .checkentry = checkentry,
137 static int __init xt_physdev_init(void)
141 ret = xt_register_match(&physdev_match);
145 ret = xt_register_match(&physdev6_match);
147 xt_unregister_match(&physdev_match);
152 static void __exit xt_physdev_fini(void)
154 xt_unregister_match(&physdev_match);
155 xt_unregister_match(&physdev6_match);
158 module_init(xt_physdev_init);
159 module_exit(xt_physdev_fini);