5 * Bart De Schuymer <bdschuym@pandora.be>
6 * Tim Gardner <timg@tpi.com>
12 #include <linux/netfilter_bridge/ebtables.h>
13 #include <linux/netfilter_bridge/ebt_arp.h>
14 #include <linux/if_arp.h>
15 #include <linux/if_ether.h>
16 #include <linux/module.h>
18 static int ebt_filter_arp(const struct sk_buff
*skb
, const struct net_device
*in
,
19 const struct net_device
*out
, const void *data
, unsigned int datalen
)
21 const struct ebt_arp_info
*info
= data
;
22 const struct arphdr
*ah
;
25 ah
= skb_header_pointer(skb
, 0, sizeof(_arph
), &_arph
);
28 if (info
->bitmask
& EBT_ARP_OPCODE
&& FWINV(info
->opcode
!=
29 ah
->ar_op
, EBT_ARP_OPCODE
))
31 if (info
->bitmask
& EBT_ARP_HTYPE
&& FWINV(info
->htype
!=
32 ah
->ar_hrd
, EBT_ARP_HTYPE
))
34 if (info
->bitmask
& EBT_ARP_PTYPE
&& FWINV(info
->ptype
!=
35 ah
->ar_pro
, EBT_ARP_PTYPE
))
38 if (info
->bitmask
& (EBT_ARP_SRC_IP
| EBT_ARP_DST_IP
| EBT_ARP_GRAT
)) {
39 const __be32
*sap
, *dap
;
42 if (ah
->ar_pln
!= sizeof(__be32
) || ah
->ar_pro
!= htons(ETH_P_IP
))
44 sap
= skb_header_pointer(skb
, sizeof(struct arphdr
) +
45 ah
->ar_hln
, sizeof(saddr
),
49 dap
= skb_header_pointer(skb
, sizeof(struct arphdr
) +
50 2*ah
->ar_hln
+sizeof(saddr
),
51 sizeof(daddr
), &daddr
);
54 if (info
->bitmask
& EBT_ARP_SRC_IP
&&
55 FWINV(info
->saddr
!= (*sap
& info
->smsk
), EBT_ARP_SRC_IP
))
57 if (info
->bitmask
& EBT_ARP_DST_IP
&&
58 FWINV(info
->daddr
!= (*dap
& info
->dmsk
), EBT_ARP_DST_IP
))
60 if (info
->bitmask
& EBT_ARP_GRAT
&&
61 FWINV(*dap
!= *sap
, EBT_ARP_GRAT
))
65 if (info
->bitmask
& (EBT_ARP_SRC_MAC
| EBT_ARP_DST_MAC
)) {
66 const unsigned char *mp
;
67 unsigned char _mac
[ETH_ALEN
];
70 if (ah
->ar_hln
!= ETH_ALEN
|| ah
->ar_hrd
!= htons(ARPHRD_ETHER
))
72 if (info
->bitmask
& EBT_ARP_SRC_MAC
) {
73 mp
= skb_header_pointer(skb
, sizeof(struct arphdr
),
78 for (i
= 0; i
< 6; i
++)
79 verdict
|= (mp
[i
] ^ info
->smaddr
[i
]) &
81 if (FWINV(verdict
!= 0, EBT_ARP_SRC_MAC
))
85 if (info
->bitmask
& EBT_ARP_DST_MAC
) {
86 mp
= skb_header_pointer(skb
, sizeof(struct arphdr
) +
87 ah
->ar_hln
+ ah
->ar_pln
,
92 for (i
= 0; i
< 6; i
++)
93 verdict
|= (mp
[i
] ^ info
->dmaddr
[i
]) &
95 if (FWINV(verdict
!= 0, EBT_ARP_DST_MAC
))
103 static int ebt_arp_check(const char *tablename
, unsigned int hookmask
,
104 const struct ebt_entry
*e
, void *data
, unsigned int datalen
)
106 const struct ebt_arp_info
*info
= data
;
108 if (datalen
!= EBT_ALIGN(sizeof(struct ebt_arp_info
)))
110 if ((e
->ethproto
!= htons(ETH_P_ARP
) &&
111 e
->ethproto
!= htons(ETH_P_RARP
)) ||
112 e
->invflags
& EBT_IPROTO
)
114 if (info
->bitmask
& ~EBT_ARP_MASK
|| info
->invflags
& ~EBT_ARP_MASK
)
119 static struct ebt_match filter_arp
=
121 .name
= EBT_ARP_MATCH
,
122 .match
= ebt_filter_arp
,
123 .check
= ebt_arp_check
,
127 static int __init
ebt_arp_init(void)
129 return ebt_register_match(&filter_arp
);
132 static void __exit
ebt_arp_fini(void)
134 ebt_unregister_match(&filter_arp
);
137 module_init(ebt_arp_init
);
138 module_exit(ebt_arp_fini
);
139 MODULE_DESCRIPTION("Ebtables: ARP protocol packet match");
140 MODULE_LICENSE("GPL");