]>
git.proxmox.com Git - mirror_ubuntu-kernels.git/blob - net/ipv6/netfilter/ip6t_physdev.c
1 /* Kernel module to match the bridge port in and
2 * out device for IP packets coming into contact with a bridge. */
4 /* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
13 #include <linux/netfilter_ipv6/ip6t_physdev.h>
14 #include <linux/netfilter_ipv6/ip6_tables.h>
15 #include <linux/netfilter_bridge.h>
19 MODULE_LICENSE("GPL");
20 MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
21 MODULE_DESCRIPTION("iptables bridge physical device match module");
24 match(const struct sk_buff
*skb
,
25 const struct net_device
*in
,
26 const struct net_device
*out
,
27 const void *matchinfo
,
33 static const char nulldevname
[IFNAMSIZ
];
34 const struct ip6t_physdev_info
*info
= matchinfo
;
36 const char *indev
, *outdev
;
37 struct nf_bridge_info
*nf_bridge
;
39 /* Not a bridged IP packet or no info available yet:
40 * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
41 * the destination device will be a bridge. */
42 if (!(nf_bridge
= skb
->nf_bridge
)) {
43 /* Return MATCH if the invert flags of the used options are on */
44 if ((info
->bitmask
& IP6T_PHYSDEV_OP_BRIDGED
) &&
45 !(info
->invert
& IP6T_PHYSDEV_OP_BRIDGED
))
47 if ((info
->bitmask
& IP6T_PHYSDEV_OP_ISIN
) &&
48 !(info
->invert
& IP6T_PHYSDEV_OP_ISIN
))
50 if ((info
->bitmask
& IP6T_PHYSDEV_OP_ISOUT
) &&
51 !(info
->invert
& IP6T_PHYSDEV_OP_ISOUT
))
53 if ((info
->bitmask
& IP6T_PHYSDEV_OP_IN
) &&
54 !(info
->invert
& IP6T_PHYSDEV_OP_IN
))
56 if ((info
->bitmask
& IP6T_PHYSDEV_OP_OUT
) &&
57 !(info
->invert
& IP6T_PHYSDEV_OP_OUT
))
62 /* This only makes sense in the FORWARD and POSTROUTING chains */
63 if ((info
->bitmask
& IP6T_PHYSDEV_OP_BRIDGED
) &&
64 (!!(nf_bridge
->mask
& BRNF_BRIDGED
) ^
65 !(info
->invert
& IP6T_PHYSDEV_OP_BRIDGED
)))
68 if ((info
->bitmask
& IP6T_PHYSDEV_OP_ISIN
&&
69 (!nf_bridge
->physindev
^ !!(info
->invert
& IP6T_PHYSDEV_OP_ISIN
))) ||
70 (info
->bitmask
& IP6T_PHYSDEV_OP_ISOUT
&&
71 (!nf_bridge
->physoutdev
^ !!(info
->invert
& IP6T_PHYSDEV_OP_ISOUT
))))
74 if (!(info
->bitmask
& IP6T_PHYSDEV_OP_IN
))
76 indev
= nf_bridge
->physindev
? nf_bridge
->physindev
->name
: nulldevname
;
77 for (i
= 0, ret
= 0; i
< IFNAMSIZ
/sizeof(unsigned int); i
++) {
78 ret
|= (((const unsigned int *)indev
)[i
]
79 ^ ((const unsigned int *)info
->physindev
)[i
])
80 & ((const unsigned int *)info
->in_mask
)[i
];
83 if ((ret
== 0) ^ !(info
->invert
& IP6T_PHYSDEV_OP_IN
))
87 if (!(info
->bitmask
& IP6T_PHYSDEV_OP_OUT
))
89 outdev
= nf_bridge
->physoutdev
?
90 nf_bridge
->physoutdev
->name
: nulldevname
;
91 for (i
= 0, ret
= 0; i
< IFNAMSIZ
/sizeof(unsigned int); i
++) {
92 ret
|= (((const unsigned int *)outdev
)[i
]
93 ^ ((const unsigned int *)info
->physoutdev
)[i
])
94 & ((const unsigned int *)info
->out_mask
)[i
];
97 return (ret
!= 0) ^ !(info
->invert
& IP6T_PHYSDEV_OP_OUT
);
101 checkentry(const char *tablename
,
102 const struct ip6t_ip6
*ip
,
104 unsigned int matchsize
,
105 unsigned int hook_mask
)
107 const struct ip6t_physdev_info
*info
= matchinfo
;
109 if (matchsize
!= IP6T_ALIGN(sizeof(struct ip6t_physdev_info
)))
111 if (!(info
->bitmask
& IP6T_PHYSDEV_OP_MASK
) ||
112 info
->bitmask
& ~IP6T_PHYSDEV_OP_MASK
)
117 static struct ip6t_match physdev_match
= {
120 .checkentry
= &checkentry
,
124 static int __init
init(void)
126 return ip6t_register_match(&physdev_match
);
129 static void __exit
fini(void)
131 ip6t_unregister_match(&physdev_match
);