5 * Bart De Schuymer <bdschuym@pandora.be>
6 * Tim Gardner <timg@tpi.com>
11 #include <linux/if_arp.h>
12 #include <linux/if_ether.h>
13 #include <linux/module.h>
14 #include <linux/netfilter/x_tables.h>
15 #include <linux/netfilter_bridge/ebtables.h>
16 #include <linux/netfilter_bridge/ebt_arp.h>
18 static bool ebt_filter_arp(const struct sk_buff
*skb
,
19 const struct net_device
*in
,
20 const struct net_device
*out
, const void *data
, unsigned int datalen
)
22 const struct ebt_arp_info
*info
= data
;
23 const struct arphdr
*ah
;
26 ah
= skb_header_pointer(skb
, 0, sizeof(_arph
), &_arph
);
29 if (info
->bitmask
& EBT_ARP_OPCODE
&& FWINV(info
->opcode
!=
30 ah
->ar_op
, EBT_ARP_OPCODE
))
32 if (info
->bitmask
& EBT_ARP_HTYPE
&& FWINV(info
->htype
!=
33 ah
->ar_hrd
, EBT_ARP_HTYPE
))
35 if (info
->bitmask
& EBT_ARP_PTYPE
&& FWINV(info
->ptype
!=
36 ah
->ar_pro
, EBT_ARP_PTYPE
))
39 if (info
->bitmask
& (EBT_ARP_SRC_IP
| EBT_ARP_DST_IP
| EBT_ARP_GRAT
)) {
40 const __be32
*sap
, *dap
;
43 if (ah
->ar_pln
!= sizeof(__be32
) || ah
->ar_pro
!= htons(ETH_P_IP
))
45 sap
= skb_header_pointer(skb
, sizeof(struct arphdr
) +
46 ah
->ar_hln
, sizeof(saddr
),
50 dap
= skb_header_pointer(skb
, sizeof(struct arphdr
) +
51 2*ah
->ar_hln
+sizeof(saddr
),
52 sizeof(daddr
), &daddr
);
55 if (info
->bitmask
& EBT_ARP_SRC_IP
&&
56 FWINV(info
->saddr
!= (*sap
& info
->smsk
), EBT_ARP_SRC_IP
))
58 if (info
->bitmask
& EBT_ARP_DST_IP
&&
59 FWINV(info
->daddr
!= (*dap
& info
->dmsk
), EBT_ARP_DST_IP
))
61 if (info
->bitmask
& EBT_ARP_GRAT
&&
62 FWINV(*dap
!= *sap
, EBT_ARP_GRAT
))
66 if (info
->bitmask
& (EBT_ARP_SRC_MAC
| EBT_ARP_DST_MAC
)) {
67 const unsigned char *mp
;
68 unsigned char _mac
[ETH_ALEN
];
71 if (ah
->ar_hln
!= ETH_ALEN
|| ah
->ar_hrd
!= htons(ARPHRD_ETHER
))
73 if (info
->bitmask
& EBT_ARP_SRC_MAC
) {
74 mp
= skb_header_pointer(skb
, sizeof(struct arphdr
),
79 for (i
= 0; i
< 6; i
++)
80 verdict
|= (mp
[i
] ^ info
->smaddr
[i
]) &
82 if (FWINV(verdict
!= 0, EBT_ARP_SRC_MAC
))
86 if (info
->bitmask
& EBT_ARP_DST_MAC
) {
87 mp
= skb_header_pointer(skb
, sizeof(struct arphdr
) +
88 ah
->ar_hln
+ ah
->ar_pln
,
93 for (i
= 0; i
< 6; i
++)
94 verdict
|= (mp
[i
] ^ info
->dmaddr
[i
]) &
96 if (FWINV(verdict
!= 0, EBT_ARP_DST_MAC
))
104 static bool ebt_arp_check(const char *tablename
, unsigned int hookmask
,
105 const struct ebt_entry
*e
, void *data
, unsigned int datalen
)
107 const struct ebt_arp_info
*info
= data
;
109 if ((e
->ethproto
!= htons(ETH_P_ARP
) &&
110 e
->ethproto
!= htons(ETH_P_RARP
)) ||
111 e
->invflags
& EBT_IPROTO
)
113 if (info
->bitmask
& ~EBT_ARP_MASK
|| info
->invflags
& ~EBT_ARP_MASK
)
118 static struct ebt_match filter_arp __read_mostly
= {
119 .name
= EBT_ARP_MATCH
,
121 .family
= NFPROTO_BRIDGE
,
122 .match
= ebt_filter_arp
,
123 .check
= ebt_arp_check
,
124 .matchsize
= XT_ALIGN(sizeof(struct ebt_arp_info
)),
128 static int __init
ebt_arp_init(void)
130 return ebt_register_match(&filter_arp
);
133 static void __exit
ebt_arp_fini(void)
135 ebt_unregister_match(&filter_arp
);
138 module_init(ebt_arp_init
);
139 module_exit(ebt_arp_fini
);
140 MODULE_DESCRIPTION("Ebtables: ARP protocol packet match");
141 MODULE_LICENSE("GPL");