1 /* Kernel module to match the bridge port in and 2 * out device for IP packets coming into contact with a bridge. */ 3 4 /* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be> 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 2 as 8 * published by the Free Software Foundation. 9 */ 10 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 11 #include <linux/module.h> 12 #include <linux/skbuff.h> 13 #include <linux/netfilter_bridge.h> 14 #include <linux/netfilter/xt_physdev.h> 15 #include <linux/netfilter/x_tables.h> 16 #include <net/netfilter/br_netfilter.h> 17 18 MODULE_LICENSE("GPL"); 19 MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>"); 20 MODULE_DESCRIPTION("Xtables: Bridge physical device match"); 21 MODULE_ALIAS("ipt_physdev"); 22 MODULE_ALIAS("ip6t_physdev"); 23 24 25 static bool 26 physdev_mt(const struct sk_buff *skb, struct xt_action_param *par) 27 { 28 const struct xt_physdev_info *info = par->matchinfo; 29 const struct net_device *physdev; 30 unsigned long ret; 31 const char *indev, *outdev; 32 33 /* Not a bridged IP packet or no info available yet: 34 * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if 35 * the destination device will be a bridge. */ 36 if (!skb->nf_bridge) { 37 /* Return MATCH if the invert flags of the used options are on */ 38 if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) && 39 !(info->invert & XT_PHYSDEV_OP_BRIDGED)) 40 return false; 41 if ((info->bitmask & XT_PHYSDEV_OP_ISIN) && 42 !(info->invert & XT_PHYSDEV_OP_ISIN)) 43 return false; 44 if ((info->bitmask & XT_PHYSDEV_OP_ISOUT) && 45 !(info->invert & XT_PHYSDEV_OP_ISOUT)) 46 return false; 47 if ((info->bitmask & XT_PHYSDEV_OP_IN) && 48 !(info->invert & XT_PHYSDEV_OP_IN)) 49 return false; 50 if ((info->bitmask & XT_PHYSDEV_OP_OUT) && 51 !(info->invert & XT_PHYSDEV_OP_OUT)) 52 return false; 53 return true; 54 } 55 56 physdev = nf_bridge_get_physoutdev(skb); 57 outdev = physdev ? physdev->name : NULL; 58 59 /* This only makes sense in the FORWARD and POSTROUTING chains */ 60 if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) && 61 (!!outdev ^ !(info->invert & XT_PHYSDEV_OP_BRIDGED))) 62 return false; 63 64 physdev = nf_bridge_get_physindev(skb); 65 indev = physdev ? physdev->name : NULL; 66 67 if ((info->bitmask & XT_PHYSDEV_OP_ISIN && 68 (!indev ^ !!(info->invert & XT_PHYSDEV_OP_ISIN))) || 69 (info->bitmask & XT_PHYSDEV_OP_ISOUT && 70 (!outdev ^ !!(info->invert & XT_PHYSDEV_OP_ISOUT)))) 71 return false; 72 73 if (!(info->bitmask & XT_PHYSDEV_OP_IN)) 74 goto match_outdev; 75 76 if (indev) { 77 ret = ifname_compare_aligned(indev, info->physindev, 78 info->in_mask); 79 80 if (!ret ^ !(info->invert & XT_PHYSDEV_OP_IN)) 81 return false; 82 } 83 84 match_outdev: 85 if (!(info->bitmask & XT_PHYSDEV_OP_OUT)) 86 return true; 87 88 if (!outdev) 89 return false; 90 91 ret = ifname_compare_aligned(outdev, info->physoutdev, info->out_mask); 92 93 return (!!ret ^ !(info->invert & XT_PHYSDEV_OP_OUT)); 94 } 95 96 static int physdev_mt_check(const struct xt_mtchk_param *par) 97 { 98 const struct xt_physdev_info *info = par->matchinfo; 99 100 br_netfilter_enable(); 101 102 if (!(info->bitmask & XT_PHYSDEV_OP_MASK) || 103 info->bitmask & ~XT_PHYSDEV_OP_MASK) 104 return -EINVAL; 105 if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) && 106 (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) || 107 info->invert & XT_PHYSDEV_OP_BRIDGED) && 108 par->hook_mask & ((1 << NF_INET_LOCAL_OUT) | 109 (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) { 110 pr_info_ratelimited("--physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic\n"); 111 if (par->hook_mask & (1 << NF_INET_LOCAL_OUT)) 112 return -EINVAL; 113 } 114 return 0; 115 } 116 117 static struct xt_match physdev_mt_reg __read_mostly = { 118 .name = "physdev", 119 .revision = 0, 120 .family = NFPROTO_UNSPEC, 121 .checkentry = physdev_mt_check, 122 .match = physdev_mt, 123 .matchsize = sizeof(struct xt_physdev_info), 124 .me = THIS_MODULE, 125 }; 126 127 static int __init physdev_mt_init(void) 128 { 129 return xt_register_match(&physdev_mt_reg); 130 } 131 132 static void __exit physdev_mt_exit(void) 133 { 134 xt_unregister_match(&physdev_mt_reg); 135 } 136 137 module_init(physdev_mt_init); 138 module_exit(physdev_mt_exit); 139