1d2912cb1SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
22e4e6a17SHarald Welte /* Kernel module to match the bridge port in and
32e4e6a17SHarald Welte * out device for IP packets coming into contact with a bridge. */
42e4e6a17SHarald Welte
52e4e6a17SHarald Welte /* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
62e4e6a17SHarald Welte */
78bee4badSJan Engelhardt #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
885cfbc25SJeremy Sowden
985cfbc25SJeremy Sowden #include <linux/if.h>
102e4e6a17SHarald Welte #include <linux/module.h>
112e4e6a17SHarald Welte #include <linux/skbuff.h>
12deb47c66SAndrew Morton #include <linux/netfilter_bridge.h>
132e4e6a17SHarald Welte #include <linux/netfilter/x_tables.h>
1485cfbc25SJeremy Sowden #include <uapi/linux/netfilter/xt_physdev.h>
152e4e6a17SHarald Welte
162e4e6a17SHarald Welte MODULE_LICENSE("GPL");
172e4e6a17SHarald Welte MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
182ae15b64SJan Engelhardt MODULE_DESCRIPTION("Xtables: Bridge physical device match");
192e4e6a17SHarald Welte MODULE_ALIAS("ipt_physdev");
202e4e6a17SHarald Welte MODULE_ALIAS("ip6t_physdev");
212e4e6a17SHarald Welte
22eacc17fbSEric Dumazet
231d93a9cbSJan Engelhardt static bool
physdev_mt(const struct sk_buff * skb,struct xt_action_param * par)2462fc8051SJan Engelhardt physdev_mt(const struct sk_buff *skb, struct xt_action_param *par)
252e4e6a17SHarald Welte {
26f7108a20SJan Engelhardt const struct xt_physdev_info *info = par->matchinfo;
27a99074aeSFlorian Westphal const struct net_device *physdev;
284f1c3b7eSEric Dumazet unsigned long ret;
292e4e6a17SHarald Welte const char *indev, *outdev;
302e4e6a17SHarald Welte
312e4e6a17SHarald Welte /* Not a bridged IP packet or no info available yet:
322e4e6a17SHarald Welte * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
332e4e6a17SHarald Welte * the destination device will be a bridge. */
34c4b0e771SFlorian Westphal if (!nf_bridge_info_exists(skb)) {
352e4e6a17SHarald Welte /* Return MATCH if the invert flags of the used options are on */
362e4e6a17SHarald Welte if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
372e4e6a17SHarald Welte !(info->invert & XT_PHYSDEV_OP_BRIDGED))
381d93a9cbSJan Engelhardt return false;
392e4e6a17SHarald Welte if ((info->bitmask & XT_PHYSDEV_OP_ISIN) &&
402e4e6a17SHarald Welte !(info->invert & XT_PHYSDEV_OP_ISIN))
411d93a9cbSJan Engelhardt return false;
422e4e6a17SHarald Welte if ((info->bitmask & XT_PHYSDEV_OP_ISOUT) &&
432e4e6a17SHarald Welte !(info->invert & XT_PHYSDEV_OP_ISOUT))
441d93a9cbSJan Engelhardt return false;
452e4e6a17SHarald Welte if ((info->bitmask & XT_PHYSDEV_OP_IN) &&
462e4e6a17SHarald Welte !(info->invert & XT_PHYSDEV_OP_IN))
471d93a9cbSJan Engelhardt return false;
482e4e6a17SHarald Welte if ((info->bitmask & XT_PHYSDEV_OP_OUT) &&
492e4e6a17SHarald Welte !(info->invert & XT_PHYSDEV_OP_OUT))
501d93a9cbSJan Engelhardt return false;
511d93a9cbSJan Engelhardt return true;
522e4e6a17SHarald Welte }
532e4e6a17SHarald Welte
54a99074aeSFlorian Westphal physdev = nf_bridge_get_physoutdev(skb);
55a99074aeSFlorian Westphal outdev = physdev ? physdev->name : NULL;
56a99074aeSFlorian Westphal
572e4e6a17SHarald Welte /* This only makes sense in the FORWARD and POSTROUTING chains */
582e4e6a17SHarald Welte if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
59a99074aeSFlorian Westphal (!!outdev ^ !(info->invert & XT_PHYSDEV_OP_BRIDGED)))
601d93a9cbSJan Engelhardt return false;
612e4e6a17SHarald Welte
62*96c510a5SPavel Tikhomirov physdev = nf_bridge_get_physindev(skb, xt_net(par));
63a99074aeSFlorian Westphal indev = physdev ? physdev->name : NULL;
64a99074aeSFlorian Westphal
652e4e6a17SHarald Welte if ((info->bitmask & XT_PHYSDEV_OP_ISIN &&
66a99074aeSFlorian Westphal (!indev ^ !!(info->invert & XT_PHYSDEV_OP_ISIN))) ||
672e4e6a17SHarald Welte (info->bitmask & XT_PHYSDEV_OP_ISOUT &&
68a99074aeSFlorian Westphal (!outdev ^ !!(info->invert & XT_PHYSDEV_OP_ISOUT))))
691d93a9cbSJan Engelhardt return false;
702e4e6a17SHarald Welte
712e4e6a17SHarald Welte if (!(info->bitmask & XT_PHYSDEV_OP_IN))
722e4e6a17SHarald Welte goto match_outdev;
73a99074aeSFlorian Westphal
74a99074aeSFlorian Westphal if (indev) {
75a99074aeSFlorian Westphal ret = ifname_compare_aligned(indev, info->physindev,
76a99074aeSFlorian Westphal info->in_mask);
772e4e6a17SHarald Welte
781d93a9cbSJan Engelhardt if (!ret ^ !(info->invert & XT_PHYSDEV_OP_IN))
791d93a9cbSJan Engelhardt return false;
80a99074aeSFlorian Westphal }
812e4e6a17SHarald Welte
822e4e6a17SHarald Welte match_outdev:
832e4e6a17SHarald Welte if (!(info->bitmask & XT_PHYSDEV_OP_OUT))
841d93a9cbSJan Engelhardt return true;
85a99074aeSFlorian Westphal
86a99074aeSFlorian Westphal if (!outdev)
87a99074aeSFlorian Westphal return false;
88a99074aeSFlorian Westphal
89b8dfe498SEric Dumazet ret = ifname_compare_aligned(outdev, info->physoutdev, info->out_mask);
90eacc17fbSEric Dumazet
914f1c3b7eSEric Dumazet return (!!ret ^ !(info->invert & XT_PHYSDEV_OP_OUT));
922e4e6a17SHarald Welte }
932e4e6a17SHarald Welte
physdev_mt_check(const struct xt_mtchk_param * par)94b0f38452SJan Engelhardt static int physdev_mt_check(const struct xt_mtchk_param *par)
952e4e6a17SHarald Welte {
969b4fce7aSJan Engelhardt const struct xt_physdev_info *info = par->matchinfo;
978e2f311aSFlorian Westphal static bool brnf_probed __read_mostly;
984b7fd5d9SPablo Neira Ayuso
992e4e6a17SHarald Welte if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
1002e4e6a17SHarald Welte info->bitmask & ~XT_PHYSDEV_OP_MASK)
101bd414ee6SJan Engelhardt return -EINVAL;
10247c74456SHangbin Liu if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) &&
10310ea6ac8SPatrick McHardy (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
10410ea6ac8SPatrick McHardy info->invert & XT_PHYSDEV_OP_BRIDGED) &&
1053cf2f450STodd Seidelmann par->hook_mask & (1 << NF_INET_LOCAL_OUT)) {
106b2606644SFlorian Westphal pr_info_ratelimited("--physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic\n");
107bd414ee6SJan Engelhardt return -EINVAL;
10810ea6ac8SPatrick McHardy }
1098e2f311aSFlorian Westphal
1108e2f311aSFlorian Westphal if (!brnf_probed) {
1118e2f311aSFlorian Westphal brnf_probed = true;
1128e2f311aSFlorian Westphal request_module("br_netfilter");
1138e2f311aSFlorian Westphal }
1148e2f311aSFlorian Westphal
115bd414ee6SJan Engelhardt return 0;
1162e4e6a17SHarald Welte }
1172e4e6a17SHarald Welte
118ab4f21e6SJan Engelhardt static struct xt_match physdev_mt_reg __read_mostly = {
1192e4e6a17SHarald Welte .name = "physdev",
120ab4f21e6SJan Engelhardt .revision = 0,
121ab4f21e6SJan Engelhardt .family = NFPROTO_UNSPEC,
122d3c5ee6dSJan Engelhardt .checkentry = physdev_mt_check,
123d3c5ee6dSJan Engelhardt .match = physdev_mt,
1245d04bff0SPatrick McHardy .matchsize = sizeof(struct xt_physdev_info),
1252e4e6a17SHarald Welte .me = THIS_MODULE,
1262e4e6a17SHarald Welte };
1272e4e6a17SHarald Welte
physdev_mt_init(void)128d3c5ee6dSJan Engelhardt static int __init physdev_mt_init(void)
1292e4e6a17SHarald Welte {
130ab4f21e6SJan Engelhardt return xt_register_match(&physdev_mt_reg);
1312e4e6a17SHarald Welte }
1322e4e6a17SHarald Welte
physdev_mt_exit(void)133d3c5ee6dSJan Engelhardt static void __exit physdev_mt_exit(void)
1342e4e6a17SHarald Welte {
135ab4f21e6SJan Engelhardt xt_unregister_match(&physdev_mt_reg);
1362e4e6a17SHarald Welte }
1372e4e6a17SHarald Welte
138d3c5ee6dSJan Engelhardt module_init(physdev_mt_init);
139d3c5ee6dSJan Engelhardt module_exit(physdev_mt_exit);
140