1/* Kernel module to match the bridge port in and
2 * out device for IP packets coming into contact with a bridge. */
3
4/* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11#include <linux/module.h>
12#include <linux/skbuff.h>
13#include <linux/netfilter_bridge.h>
14#include <linux/netfilter/xt_physdev.h>
15#include <linux/netfilter/x_tables.h>
16#include <net/netfilter/br_netfilter.h>
17
18MODULE_LICENSE("GPL");
19MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
20MODULE_DESCRIPTION("Xtables: Bridge physical device match");
21MODULE_ALIAS("ipt_physdev");
22MODULE_ALIAS("ip6t_physdev");
23
24
25static bool
26physdev_mt(const struct sk_buff *skb, struct xt_action_param *par)
27{
28	const struct xt_physdev_info *info = par->matchinfo;
29	const struct net_device *physdev;
30	unsigned long ret;
31	const char *indev, *outdev;
32
33	/* Not a bridged IP packet or no info available yet:
34	 * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
35	 * the destination device will be a bridge. */
36	if (!skb->nf_bridge) {
37		/* Return MATCH if the invert flags of the used options are on */
38		if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
39		    !(info->invert & XT_PHYSDEV_OP_BRIDGED))
40			return false;
41		if ((info->bitmask & XT_PHYSDEV_OP_ISIN) &&
42		    !(info->invert & XT_PHYSDEV_OP_ISIN))
43			return false;
44		if ((info->bitmask & XT_PHYSDEV_OP_ISOUT) &&
45		    !(info->invert & XT_PHYSDEV_OP_ISOUT))
46			return false;
47		if ((info->bitmask & XT_PHYSDEV_OP_IN) &&
48		    !(info->invert & XT_PHYSDEV_OP_IN))
49			return false;
50		if ((info->bitmask & XT_PHYSDEV_OP_OUT) &&
51		    !(info->invert & XT_PHYSDEV_OP_OUT))
52			return false;
53		return true;
54	}
55
56	physdev = nf_bridge_get_physoutdev(skb);
57	outdev = physdev ? physdev->name : NULL;
58
59	/* This only makes sense in the FORWARD and POSTROUTING chains */
60	if ((info->bitmask & XT_PHYSDEV_OP_BRIDGED) &&
61	    (!!outdev ^ !(info->invert & XT_PHYSDEV_OP_BRIDGED)))
62		return false;
63
64	physdev = nf_bridge_get_physindev(skb);
65	indev = physdev ? physdev->name : NULL;
66
67	if ((info->bitmask & XT_PHYSDEV_OP_ISIN &&
68	    (!indev ^ !!(info->invert & XT_PHYSDEV_OP_ISIN))) ||
69	    (info->bitmask & XT_PHYSDEV_OP_ISOUT &&
70	    (!outdev ^ !!(info->invert & XT_PHYSDEV_OP_ISOUT))))
71		return false;
72
73	if (!(info->bitmask & XT_PHYSDEV_OP_IN))
74		goto match_outdev;
75
76	if (indev) {
77		ret = ifname_compare_aligned(indev, info->physindev,
78					     info->in_mask);
79
80		if (!ret ^ !(info->invert & XT_PHYSDEV_OP_IN))
81			return false;
82	}
83
84match_outdev:
85	if (!(info->bitmask & XT_PHYSDEV_OP_OUT))
86		return true;
87
88	if (!outdev)
89		return false;
90
91	ret = ifname_compare_aligned(outdev, info->physoutdev, info->out_mask);
92
93	return (!!ret ^ !(info->invert & XT_PHYSDEV_OP_OUT));
94}
95
96static int physdev_mt_check(const struct xt_mtchk_param *par)
97{
98	const struct xt_physdev_info *info = par->matchinfo;
99
100	br_netfilter_enable();
101
102	if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
103	    info->bitmask & ~XT_PHYSDEV_OP_MASK)
104		return -EINVAL;
105	if (info->bitmask & XT_PHYSDEV_OP_OUT &&
106	    (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
107	     info->invert & XT_PHYSDEV_OP_BRIDGED) &&
108	    par->hook_mask & ((1 << NF_INET_LOCAL_OUT) |
109	    (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) {
110		pr_info("using --physdev-out in the OUTPUT, FORWARD and "
111			"POSTROUTING chains for non-bridged traffic is not "
112			"supported anymore.\n");
113		if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
114			return -EINVAL;
115	}
116	return 0;
117}
118
119static struct xt_match physdev_mt_reg __read_mostly = {
120	.name       = "physdev",
121	.revision   = 0,
122	.family     = NFPROTO_UNSPEC,
123	.checkentry = physdev_mt_check,
124	.match      = physdev_mt,
125	.matchsize  = sizeof(struct xt_physdev_info),
126	.me         = THIS_MODULE,
127};
128
129static int __init physdev_mt_init(void)
130{
131	return xt_register_match(&physdev_mt_reg);
132}
133
134static void __exit physdev_mt_exit(void)
135{
136	xt_unregister_match(&physdev_mt_reg);
137}
138
139module_init(physdev_mt_init);
140module_exit(physdev_mt_exit);
141