1 /* Kernel module to match the bridge port in and
2 * out device for IP packets coming into contact with a bridge. */
4 /* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
13 #include <linux/netfilter_ipv6/ip6t_physdev.h>
14 #include <linux/netfilter_ipv6/ip6_tables.h>
15 #include <linux/netfilter_bridge.h>
19 MODULE_LICENSE("GPL");
20 MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
21 MODULE_DESCRIPTION("iptables bridge physical device match module");
24 match(const struct sk_buff *skb,
25 const struct net_device *in,
26 const struct net_device *out,
27 const void *matchinfo,
34 static const char nulldevname[IFNAMSIZ];
35 const struct ip6t_physdev_info *info = matchinfo;
37 const char *indev, *outdev;
38 struct nf_bridge_info *nf_bridge;
40 /* Not a bridged IP packet or no info available yet:
41 * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
42 * the destination device will be a bridge. */
43 if (!(nf_bridge = skb->nf_bridge)) {
44 /* Return MATCH if the invert flags of the used options are on */
45 if ((info->bitmask & IP6T_PHYSDEV_OP_BRIDGED) &&
46 !(info->invert & IP6T_PHYSDEV_OP_BRIDGED))
48 if ((info->bitmask & IP6T_PHYSDEV_OP_ISIN) &&
49 !(info->invert & IP6T_PHYSDEV_OP_ISIN))
51 if ((info->bitmask & IP6T_PHYSDEV_OP_ISOUT) &&
52 !(info->invert & IP6T_PHYSDEV_OP_ISOUT))
54 if ((info->bitmask & IP6T_PHYSDEV_OP_IN) &&
55 !(info->invert & IP6T_PHYSDEV_OP_IN))
57 if ((info->bitmask & IP6T_PHYSDEV_OP_OUT) &&
58 !(info->invert & IP6T_PHYSDEV_OP_OUT))
63 /* This only makes sense in the FORWARD and POSTROUTING chains */
64 if ((info->bitmask & IP6T_PHYSDEV_OP_BRIDGED) &&
65 (!!(nf_bridge->mask & BRNF_BRIDGED) ^
66 !(info->invert & IP6T_PHYSDEV_OP_BRIDGED)))
69 if ((info->bitmask & IP6T_PHYSDEV_OP_ISIN &&
70 (!nf_bridge->physindev ^ !!(info->invert & IP6T_PHYSDEV_OP_ISIN))) ||
71 (info->bitmask & IP6T_PHYSDEV_OP_ISOUT &&
72 (!nf_bridge->physoutdev ^ !!(info->invert & IP6T_PHYSDEV_OP_ISOUT))))
75 if (!(info->bitmask & IP6T_PHYSDEV_OP_IN))
77 indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname;
78 for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
79 ret |= (((const unsigned int *)indev)[i]
80 ^ ((const unsigned int *)info->physindev)[i])
81 & ((const unsigned int *)info->in_mask)[i];
84 if ((ret == 0) ^ !(info->invert & IP6T_PHYSDEV_OP_IN))
88 if (!(info->bitmask & IP6T_PHYSDEV_OP_OUT))
90 outdev = nf_bridge->physoutdev ?
91 nf_bridge->physoutdev->name : nulldevname;
92 for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned int); i++) {
93 ret |= (((const unsigned int *)outdev)[i]
94 ^ ((const unsigned int *)info->physoutdev)[i])
95 & ((const unsigned int *)info->out_mask)[i];
98 return (ret != 0) ^ !(info->invert & IP6T_PHYSDEV_OP_OUT);
102 checkentry(const char *tablename,
103 const struct ip6t_ip6 *ip,
105 unsigned int matchsize,
106 unsigned int hook_mask)
108 const struct ip6t_physdev_info *info = matchinfo;
110 if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_physdev_info)))
112 if (!(info->bitmask & IP6T_PHYSDEV_OP_MASK) ||
113 info->bitmask & ~IP6T_PHYSDEV_OP_MASK)
118 static struct ip6t_match physdev_match = {
121 .checkentry = &checkentry,
125 static int __init init(void)
127 return ip6t_register_match(&physdev_match);
130 static void __exit fini(void)
132 ip6t_unregister_match(&physdev_match);