1 /* Kernel module to match the bridge port in and
2 * out device for IP packets coming into contact with a bridge. */
4 /* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
13 #include <linux/netfilter_bridge.h>
14 #include <linux/netfilter/xt_physdev.h>
15 #include <linux/netfilter/x_tables.h>
16 #include <linux/netfilter_bridge.h>
20 MODULE_LICENSE("GPL");
21 MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
22 MODULE_DESCRIPTION("iptables bridge physical device match module");
23 MODULE_ALIAS("ipt_physdev");
24 MODULE_ALIAS("ip6t_physdev");
28 match(const struct sk_buff
*skb
,
29 const struct net_device
*in
,
30 const struct net_device
*out
,
31 const struct xt_match
*match
,
32 const void *matchinfo
,
37 static const char nulldevname
[IFNAMSIZ
] __attribute__((aligned(sizeof(long))));
38 const struct xt_physdev_info
*info
= matchinfo
;
40 const char *indev
, *outdev
;
41 struct nf_bridge_info
*nf_bridge
;
43 /* Not a bridged IP packet or no info available yet:
44 * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
45 * the destination device will be a bridge. */
46 if (!(nf_bridge
= skb
->nf_bridge
)) {
47 /* Return MATCH if the invert flags of the used options are on */
48 if ((info
->bitmask
& XT_PHYSDEV_OP_BRIDGED
) &&
49 !(info
->invert
& XT_PHYSDEV_OP_BRIDGED
))
51 if ((info
->bitmask
& XT_PHYSDEV_OP_ISIN
) &&
52 !(info
->invert
& XT_PHYSDEV_OP_ISIN
))
54 if ((info
->bitmask
& XT_PHYSDEV_OP_ISOUT
) &&
55 !(info
->invert
& XT_PHYSDEV_OP_ISOUT
))
57 if ((info
->bitmask
& XT_PHYSDEV_OP_IN
) &&
58 !(info
->invert
& XT_PHYSDEV_OP_IN
))
60 if ((info
->bitmask
& XT_PHYSDEV_OP_OUT
) &&
61 !(info
->invert
& XT_PHYSDEV_OP_OUT
))
66 /* This only makes sense in the FORWARD and POSTROUTING chains */
67 if ((info
->bitmask
& XT_PHYSDEV_OP_BRIDGED
) &&
68 (!!(nf_bridge
->mask
& BRNF_BRIDGED
) ^
69 !(info
->invert
& XT_PHYSDEV_OP_BRIDGED
)))
72 if ((info
->bitmask
& XT_PHYSDEV_OP_ISIN
&&
73 (!nf_bridge
->physindev
^ !!(info
->invert
& XT_PHYSDEV_OP_ISIN
))) ||
74 (info
->bitmask
& XT_PHYSDEV_OP_ISOUT
&&
75 (!nf_bridge
->physoutdev
^ !!(info
->invert
& XT_PHYSDEV_OP_ISOUT
))))
78 if (!(info
->bitmask
& XT_PHYSDEV_OP_IN
))
80 indev
= nf_bridge
->physindev
? nf_bridge
->physindev
->name
: nulldevname
;
81 ret
= ifname_compare_aligned(indev
, info
->physindev
, info
->in_mask
);
83 if ((ret
== 0) ^ !(info
->invert
& XT_PHYSDEV_OP_IN
))
87 if (!(info
->bitmask
& XT_PHYSDEV_OP_OUT
))
89 outdev
= nf_bridge
->physoutdev
?
90 nf_bridge
->physoutdev
->name
: nulldevname
;
91 ret
= ifname_compare_aligned(outdev
, info
->physoutdev
, info
->out_mask
);
93 return (!!ret
^ !(info
->invert
& XT_PHYSDEV_OP_OUT
));
97 checkentry(const char *tablename
,
99 const struct xt_match
*match
,
101 unsigned int hook_mask
)
103 const struct xt_physdev_info
*info
= matchinfo
;
105 if (!(info
->bitmask
& XT_PHYSDEV_OP_MASK
) ||
106 info
->bitmask
& ~XT_PHYSDEV_OP_MASK
)
108 if (info
->bitmask
& XT_PHYSDEV_OP_OUT
&&
109 (!(info
->bitmask
& XT_PHYSDEV_OP_BRIDGED
) ||
110 info
->invert
& XT_PHYSDEV_OP_BRIDGED
) &&
111 hook_mask
& ((1 << NF_IP_LOCAL_OUT
) | (1 << NF_IP_FORWARD
) |
112 (1 << NF_IP_POST_ROUTING
))) {
113 printk(KERN_WARNING
"physdev match: using --physdev-out in the "
114 "OUTPUT, FORWARD and POSTROUTING chains for non-bridged "
115 "traffic is not supported anymore.\n");
116 if (hook_mask
& (1 << NF_IP_LOCAL_OUT
))
122 static struct xt_match xt_physdev_match
[] = {
126 .checkentry
= checkentry
,
128 .matchsize
= sizeof(struct xt_physdev_info
),
134 .checkentry
= checkentry
,
136 .matchsize
= sizeof(struct xt_physdev_info
),
141 static int __init
xt_physdev_init(void)
143 return xt_register_matches(xt_physdev_match
,
144 ARRAY_SIZE(xt_physdev_match
));
147 static void __exit
xt_physdev_fini(void)
149 xt_unregister_matches(xt_physdev_match
, ARRAY_SIZE(xt_physdev_match
));
152 module_init(xt_physdev_init
);
153 module_exit(xt_physdev_fini
);