net/bridge/netfilter/ebt_ip.c

   1 /*
   2  *  ebt_ip
   3  *
   4  *      Authors:
   5  *      Bart De Schuymer <bdschuym@pandora.be>
   6  *
   7  *  April, 2002
   8  *
   9  *  Changes:
  10  *    added ip-sport and ip-dport
  11  *    Innominate Security Technologies AG <mhopf@innominate.com>
  12  *    September, 2002
  13  */
  14
  15 #include <linux/netfilter_bridge/ebtables.h>
  16 #include <linux/netfilter_bridge/ebt_ip.h>
  17 #include <linux/ip.h>
  18 #include <linux/in.h>
  19 #include <linux/module.h>
  20
  21 struct tcpudphdr {
  22         uint16_t src;
  23         uint16_t dst;
  24 };
  25
  26 static int ebt_filter_ip(const struct sk_buff *skb, const struct net_device *in,
  27    const struct net_device *out, const void *data,
  28    unsigned int datalen)
  29 {
  30         struct ebt_ip_info *info = (struct ebt_ip_info *)data;
  31         union {struct iphdr iph; struct tcpudphdr ports;} u;
  32
  33         if (skb_copy_bits(skb, 0, &u.iph, sizeof(u.iph)))
  34                 return EBT_NOMATCH;
  35         if (info->bitmask & EBT_IP_TOS &&
  36            FWINV(info->tos != u.iph.tos, EBT_IP_TOS))
  37                 return EBT_NOMATCH;
  38         if (info->bitmask & EBT_IP_SOURCE &&
  39            FWINV((u.iph.saddr & info->smsk) !=
  40            info->saddr, EBT_IP_SOURCE))
  41                 return EBT_NOMATCH;
  42         if ((info->bitmask & EBT_IP_DEST) &&
  43            FWINV((u.iph.daddr & info->dmsk) !=
  44            info->daddr, EBT_IP_DEST))
  45                 return EBT_NOMATCH;
  46         if (info->bitmask & EBT_IP_PROTO) {
  47                 if (FWINV(info->protocol != u.iph.protocol, EBT_IP_PROTO))
  48                         return EBT_NOMATCH;
  49                 if (!(info->bitmask & EBT_IP_DPORT) &&
  50                     !(info->bitmask & EBT_IP_SPORT))
  51                         return EBT_MATCH;
  52                 if (skb_copy_bits(skb, u.iph.ihl*4, &u.ports,
  53                     sizeof(u.ports)))
  54                         return EBT_NOMATCH;
  55                 if (info->bitmask & EBT_IP_DPORT) {
  56                         u.ports.dst = ntohs(u.ports.dst);
  57                         if (FWINV(u.ports.dst < info->dport[0] ||
  58                                   u.ports.dst > info->dport[1],
  59                                   EBT_IP_DPORT))
  60                         return EBT_NOMATCH;
  61                 }
  62                 if (info->bitmask & EBT_IP_SPORT) {
  63                         u.ports.src = ntohs(u.ports.src);
  64                         if (FWINV(u.ports.src < info->sport[0] ||
  65                                   u.ports.src > info->sport[1],
  66                                   EBT_IP_SPORT))
  67                         return EBT_NOMATCH;
  68                 }
  69         }
  70         return EBT_MATCH;
  71 }
  72
  73 static int ebt_ip_check(const char *tablename, unsigned int hookmask,
  74    const struct ebt_entry *e, void *data, unsigned int datalen)
  75 {
  76         struct ebt_ip_info *info = (struct ebt_ip_info *)data;
  77
  78         if (datalen != EBT_ALIGN(sizeof(struct ebt_ip_info)))
  79                 return -EINVAL;
  80         if (e->ethproto != __constant_htons(ETH_P_IP) ||
  81            e->invflags & EBT_IPROTO)
  82                 return -EINVAL;
  83         if (info->bitmask & ~EBT_IP_MASK || info->invflags & ~EBT_IP_MASK)
  84                 return -EINVAL;
  85         if (info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT)) {
  86                 if (info->invflags & EBT_IP_PROTO)
  87                         return -EINVAL;
  88                 if (info->protocol != IPPROTO_TCP &&
  89                     info->protocol != IPPROTO_UDP)
  90                          return -EINVAL;
  91         }
  92         if (info->bitmask & EBT_IP_DPORT && info->dport[0] > info->dport[1])
  93                 return -EINVAL;
  94         if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1])
  95                 return -EINVAL;
  96         return 0;
  97 }
  98
  99 static struct ebt_match filter_ip =
 100 {
 101         .name           = EBT_IP_MATCH,
 102         .match          = ebt_filter_ip,
 103         .check          = ebt_ip_check,
 104         .me             = THIS_MODULE,
 105 };
 106
 107 static int __init init(void)
 108 {
 109         return ebt_register_match(&filter_ip);
 110 }
 111
 112 static void __exit fini(void)
 113 {
 114         ebt_unregister_match(&filter_ip);
 115 }
 116
 117 module_init(init);
 118 module_exit(fini);
 119 MODULE_LICENSE("GPL");