extensions/libipt_physdev.c

   1 /* Shared library add-on to iptables to add bridge port matching support. */
   2 #include <stdio.h>
   3 #include <string.h>
   4 #include <stdlib.h>
   5 #include <getopt.h>
   6 #include <ctype.h>
   7 #include <iptables.h>
   8 #include <linux/netfilter_ipv4/ipt_physdev.h>
   9 #if defined(__GLIBC__) && __GLIBC__ == 2
  10 #include <net/ethernet.h>
  11 #else
  12 #include <linux/if_ether.h>
  13 #endif
  14
  15 static void
  16 help(void)
  17 {
  18         printf(
  19 "physdev v%s options:\n"
  20 " --physdev-in [!] input name[+]                bridge port name ([+] for wildcard)\n"
  21 " --physdev-out [!] output name[+]      bridge port name ([+] for wildcard)\n"
  22 " [!] --physdev-is-in                   arrived on a bridge device\n"
  23 " [!] --physdev-is-out                  will leave on a bridge device\n"
  24 " [!] --physdev-is-bridged              it's a bridged packet\n"
  25 "\n", IPTABLES_VERSION);
  26 }
  27
  28 static struct option opts[] = {
  29         { "physdev-in", 1, 0, '1' },
  30         { "physdev-out", 1, 0, '2' },
  31         { "physdev-is-in", 0, 0, '3' },
  32         { "physdev-is-out", 0, 0, '4' },
  33         { "physdev-is-bridged", 0, 0, '5' },
  34         {0}
  35 };
  36
  37 /* copied from iptables.c */
  38 static void
  39 parse_interface(const char *arg, char *vianame, unsigned char *mask)
  40 {
  41         int vialen = strlen(arg);
  42         unsigned int i;
  43
  44         memset(mask, 0, IFNAMSIZ);
  45         memset(vianame, 0, IFNAMSIZ);
  46
  47         if (vialen + 1 > IFNAMSIZ)
  48                 exit_error(PARAMETER_PROBLEM,
  49                            "interface name `%s' must be shorter than IFNAMSIZ"
  50                            " (%i)", arg, IFNAMSIZ-1);
  51
  52         strcpy(vianame, arg);
  53         if (vialen == 0)
  54                 memset(mask, 0, IFNAMSIZ);
  55         else if (vianame[vialen - 1] == '+') {
  56                 memset(mask, 0xFF, vialen - 1);
  57                 memset(mask + vialen - 1, 0, IFNAMSIZ - vialen + 1);
  58                 /* Don't remove `+' here! -HW */
  59         } else {
  60                 /* Include nul-terminator in match */
  61                 memset(mask, 0xFF, vialen + 1);
  62                 memset(mask + vialen + 1, 0, IFNAMSIZ - vialen - 1);
  63                 for (i = 0; vianame[i]; i++) {
  64                         if (!isalnum(vianame[i])
  65                             && vianame[i] != '_'
  66                             && vianame[i] != '.') {
  67                                 printf("Warning: wierd character in interface"
  68                                        " `%s' (No aliases, :, ! or *).\n",
  69                                        vianame);
  70                                 break;
  71                         }
  72                 }
  73         }
  74 }
  75
  76 static void
  77 init(struct ipt_entry_match *m, unsigned int *nfcache)
  78 {
  79 }
  80
  81 static int
  82 parse(int c, char **argv, int invert, unsigned int *flags,
  83       const struct ipt_entry *entry,
  84       unsigned int *nfcache,
  85       struct ipt_entry_match **match)
  86 {
  87         struct ipt_physdev_info *info =
  88                 (struct ipt_physdev_info*)(*match)->data;
  89
  90         switch (c) {
  91         case '1':
  92                 if (*flags & IPT_PHYSDEV_OP_IN)
  93                         goto multiple_use;
  94                 check_inverse(optarg, &invert, &optind, 0);
  95                 parse_interface(argv[optind-1], info->physindev, info->in_mask);
  96                 if (invert)
  97                         info->invert |= IPT_PHYSDEV_OP_IN;
  98                 info->bitmask |= IPT_PHYSDEV_OP_IN;
  99                 *flags |= IPT_PHYSDEV_OP_IN;
 100                 break;
 101
 102         case '2':
 103                 if (*flags & IPT_PHYSDEV_OP_OUT)
 104                         goto multiple_use;
 105                 check_inverse(optarg, &invert, &optind, 0);
 106                 parse_interface(argv[optind-1], info->physoutdev,
 107                                 info->out_mask);
 108                 if (invert)
 109                         info->invert |= IPT_PHYSDEV_OP_OUT;
 110                 info->bitmask |= IPT_PHYSDEV_OP_OUT;
 111                 *flags |= IPT_PHYSDEV_OP_OUT;
 112                 break;
 113
 114         case '3':
 115                 if (*flags & IPT_PHYSDEV_OP_ISIN)
 116                         goto multiple_use;
 117                 check_inverse(optarg, &invert, &optind, 0);
 118                 info->bitmask |= IPT_PHYSDEV_OP_ISIN;
 119                 if (invert)
 120                         info->invert |= IPT_PHYSDEV_OP_ISIN;
 121                 *flags |= IPT_PHYSDEV_OP_ISIN;
 122                 break;
 123
 124         case '4':
 125                 if (*flags & IPT_PHYSDEV_OP_ISOUT)
 126                         goto multiple_use;
 127                 check_inverse(optarg, &invert, &optind, 0);
 128                 info->bitmask |= IPT_PHYSDEV_OP_ISOUT;
 129                 if (invert)
 130                         info->invert |= IPT_PHYSDEV_OP_ISOUT;
 131                 *flags |= IPT_PHYSDEV_OP_ISOUT;
 132                 break;
 133
 134         case '5':
 135                 if (*flags & IPT_PHYSDEV_OP_BRIDGED)
 136                         goto multiple_use;
 137                 check_inverse(optarg, &invert, &optind, 0);
 138                 if (invert)
 139                         info->invert |= IPT_PHYSDEV_OP_BRIDGED;
 140                 *flags |= IPT_PHYSDEV_OP_BRIDGED;
 141                 info->bitmask |= IPT_PHYSDEV_OP_BRIDGED;
 142                 break;
 143
 144         default:
 145                 return 0;
 146         }
 147
 148         return 1;
 149 multiple_use:
 150         exit_error(PARAMETER_PROBLEM,
 151            "multiple use of the same physdev option is not allowed");
 152
 153 }
 154
 155 static void final_check(unsigned int flags)
 156 {
 157         if (flags == 0)
 158                 exit_error(PARAMETER_PROBLEM, "PHYSDEV: no physdev option specified");
 159 }
 160
 161 static void
 162 print(const struct ipt_ip *ip,
 163       const struct ipt_entry_match *match,
 164       int numeric)
 165 {
 166         struct ipt_physdev_info *info =
 167                 (struct ipt_physdev_info*)match->data;
 168
 169         printf("PHYSDEV match");
 170         if (info->bitmask & IPT_PHYSDEV_OP_ISIN)
 171                 printf("%s --physdev-is-in",
 172                        info->invert & IPT_PHYSDEV_OP_ISIN ? " !":"");
 173         if (info->bitmask & IPT_PHYSDEV_OP_IN)
 174                 printf("%s --physdev-in %s",
 175                 (info->invert & IPT_PHYSDEV_OP_IN) ? " !":"", info->physindev);
 176
 177         if (info->bitmask & IPT_PHYSDEV_OP_ISOUT)
 178                 printf("%s --physdev-is-out",
 179                        info->invert & IPT_PHYSDEV_OP_ISOUT ? " !":"");
 180         if (info->bitmask & IPT_PHYSDEV_OP_OUT)
 181                 printf("%s --physdev-out %s",
 182                 (info->invert & IPT_PHYSDEV_OP_OUT) ? " !":"", info->physoutdev);
 183         if (info->bitmask & IPT_PHYSDEV_OP_BRIDGED)
 184                 printf("%s --physdev-is-bridged",
 185                        info->invert & IPT_PHYSDEV_OP_BRIDGED ? " !":"");
 186         printf(" ");
 187 }
 188
 189 static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
 190 {
 191         struct ipt_physdev_info *info =
 192                 (struct ipt_physdev_info*)match->data;
 193
 194         if (info->bitmask & IPT_PHYSDEV_OP_ISIN)
 195                 printf("%s --physdev-is-in",
 196                        info->invert & IPT_PHYSDEV_OP_ISIN ? " !":"");
 197         if (info->bitmask & IPT_PHYSDEV_OP_IN)
 198                 printf("%s --physdev-in %s",
 199                 (info->invert & IPT_PHYSDEV_OP_IN) ? " !":"", info->physindev);
 200
 201         if (info->bitmask & IPT_PHYSDEV_OP_ISOUT)
 202                 printf("%s --physdev-is-out",
 203                        info->invert & IPT_PHYSDEV_OP_ISOUT ? " !":"");
 204         if (info->bitmask & IPT_PHYSDEV_OP_OUT)
 205                 printf("%s --physdev-out %s",
 206                 (info->invert & IPT_PHYSDEV_OP_OUT) ? " !":"", info->physoutdev);
 207         if (info->bitmask & IPT_PHYSDEV_OP_BRIDGED)
 208                 printf("%s --physdev-is-bridged",
 209                        info->invert & IPT_PHYSDEV_OP_BRIDGED ? " !":"");
 210         printf(" ");
 211 }
 212
 213 static
 214 struct iptables_match physdev
 215 = { NULL,
 216     "physdev",
 217     IPTABLES_VERSION,
 218     IPT_ALIGN(sizeof(struct ipt_physdev_info)),
 219     IPT_ALIGN(sizeof(struct ipt_physdev_info)),
 220     &help,
 221     &init,
 222     &parse,
 223     &final_check,
 224     &print,
 225     &save,
 226     opts
 227 };
 228
 229 void _init(void)
 230 {
 231         register_match(&physdev);
 232 }