1 /* Kernel module to match the bridge port in and
2 * out device for IP packets coming into contact with a bridge. */
4 /* (C) 2001-2003 Bart De Schuymer <bdschuym@pandora.be>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
10 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
13 #include <linux/netfilter_bridge.h>
14 #include <linux/netfilter/xt_physdev.h>
15 #include <linux/netfilter/x_tables.h>
16 #include <net/netfilter/br_netfilter.h>
18 MODULE_LICENSE("GPL");
19 MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
20 MODULE_DESCRIPTION("Xtables: Bridge physical device match");
21 MODULE_ALIAS("ipt_physdev");
22 MODULE_ALIAS("ip6t_physdev");
26 physdev_mt(const struct sk_buff
*skb
, struct xt_action_param
*par
)
28 static const char nulldevname
[IFNAMSIZ
] __attribute__((aligned(sizeof(long))));
29 const struct xt_physdev_info
*info
= par
->matchinfo
;
31 const char *indev
, *outdev
;
32 const struct nf_bridge_info
*nf_bridge
;
34 /* Not a bridged IP packet or no info available yet:
35 * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
36 * the destination device will be a bridge. */
37 if (!(nf_bridge
= skb
->nf_bridge
)) {
38 /* Return MATCH if the invert flags of the used options are on */
39 if ((info
->bitmask
& XT_PHYSDEV_OP_BRIDGED
) &&
40 !(info
->invert
& XT_PHYSDEV_OP_BRIDGED
))
42 if ((info
->bitmask
& XT_PHYSDEV_OP_ISIN
) &&
43 !(info
->invert
& XT_PHYSDEV_OP_ISIN
))
45 if ((info
->bitmask
& XT_PHYSDEV_OP_ISOUT
) &&
46 !(info
->invert
& XT_PHYSDEV_OP_ISOUT
))
48 if ((info
->bitmask
& XT_PHYSDEV_OP_IN
) &&
49 !(info
->invert
& XT_PHYSDEV_OP_IN
))
51 if ((info
->bitmask
& XT_PHYSDEV_OP_OUT
) &&
52 !(info
->invert
& XT_PHYSDEV_OP_OUT
))
57 /* This only makes sense in the FORWARD and POSTROUTING chains */
58 if ((info
->bitmask
& XT_PHYSDEV_OP_BRIDGED
) &&
59 (!!nf_bridge
->physoutdev
^ !(info
->invert
& XT_PHYSDEV_OP_BRIDGED
)))
62 if ((info
->bitmask
& XT_PHYSDEV_OP_ISIN
&&
63 (!nf_bridge
->physindev
^ !!(info
->invert
& XT_PHYSDEV_OP_ISIN
))) ||
64 (info
->bitmask
& XT_PHYSDEV_OP_ISOUT
&&
65 (!nf_bridge
->physoutdev
^ !!(info
->invert
& XT_PHYSDEV_OP_ISOUT
))))
68 if (!(info
->bitmask
& XT_PHYSDEV_OP_IN
))
70 indev
= nf_bridge
->physindev
? nf_bridge
->physindev
->name
: nulldevname
;
71 ret
= ifname_compare_aligned(indev
, info
->physindev
, info
->in_mask
);
73 if (!ret
^ !(info
->invert
& XT_PHYSDEV_OP_IN
))
77 if (!(info
->bitmask
& XT_PHYSDEV_OP_OUT
))
79 outdev
= nf_bridge
->physoutdev
?
80 nf_bridge
->physoutdev
->name
: nulldevname
;
81 ret
= ifname_compare_aligned(outdev
, info
->physoutdev
, info
->out_mask
);
83 return (!!ret
^ !(info
->invert
& XT_PHYSDEV_OP_OUT
));
86 static int physdev_mt_check(const struct xt_mtchk_param
*par
)
88 const struct xt_physdev_info
*info
= par
->matchinfo
;
90 br_netfilter_enable();
92 if (!(info
->bitmask
& XT_PHYSDEV_OP_MASK
) ||
93 info
->bitmask
& ~XT_PHYSDEV_OP_MASK
)
95 if (info
->bitmask
& XT_PHYSDEV_OP_OUT
&&
96 (!(info
->bitmask
& XT_PHYSDEV_OP_BRIDGED
) ||
97 info
->invert
& XT_PHYSDEV_OP_BRIDGED
) &&
98 par
->hook_mask
& ((1 << NF_INET_LOCAL_OUT
) |
99 (1 << NF_INET_FORWARD
) | (1 << NF_INET_POST_ROUTING
))) {
100 pr_info("using --physdev-out in the OUTPUT, FORWARD and "
101 "POSTROUTING chains for non-bridged traffic is not "
102 "supported anymore.\n");
103 if (par
->hook_mask
& (1 << NF_INET_LOCAL_OUT
))
109 static struct xt_match physdev_mt_reg __read_mostly
= {
112 .family
= NFPROTO_UNSPEC
,
113 .checkentry
= physdev_mt_check
,
115 .matchsize
= sizeof(struct xt_physdev_info
),
119 static int __init
physdev_mt_init(void)
121 return xt_register_match(&physdev_mt_reg
);
124 static void __exit
physdev_mt_exit(void)
126 xt_unregister_match(&physdev_mt_reg
);
129 module_init(physdev_mt_init
);
130 module_exit(physdev_mt_exit
);