kernel/linux/net/bridge/netfilter/ebt_ip.c

   1 /*
   2  *  ebt_ip
   3  *
   4  *      Authors:
   5  *      Bart De Schuymer <bdschuym@pandora.be>
   6  *
   7  *  April, 2002
   8  *
   9  *  Changes:
  10  *    added ip-sport and ip-dport
  11  *    Innominate Security Technologies AG <mhopf@innominate.com>
  12  *    September, 2002
  13  */
  14
  15 #include <linux/netfilter_bridge/ebtables.h>
  16 #include <linux/netfilter_bridge/ebt_ip.h>
  17 #include <linux/ip.h>
  18 #include <linux/in.h>
  19 #include <linux/module.h>
  20
  21 #define PPPOE_HDR_OFFSET 8
  22
  23 struct tcpudphdr {
  24         uint16_t src;
  25         uint16_t dst;
  26 };
  27
  28 static int ebt_filter_ip(const struct sk_buff *skb, const struct net_device *in,
  29    const struct net_device *out, const void *data,
  30    unsigned int datalen)
  31 {
  32         struct ebt_ip_info *info = (struct ebt_ip_info *)data;
  33         union {struct iphdr iph; struct tcpudphdr ports;} u;
  34        if(ETH_P_PPP_SES!= skb->mac.ethernet->h_proto)
  35        {
  36                 if (skb_copy_bits(skb, 0, &u.iph, sizeof(u.iph)))
  37                         return EBT_NOMATCH;
  38                 if (info->bitmask & EBT_IP_TOS &&
  39                    FWINV(info->tos != u.iph.tos, EBT_IP_TOS))
  40                         return EBT_NOMATCH;
  41                 if (info->bitmask & EBT_IP_SOURCE &&
  42                    FWINV((u.iph.saddr & info->smsk) !=
  43                    info->saddr, EBT_IP_SOURCE))
  44                         return EBT_NOMATCH;
  45                 if ((info->bitmask & EBT_IP_DEST) &&
  46                    FWINV((u.iph.daddr & info->dmsk) !=
  47                    info->daddr, EBT_IP_DEST))
  48                         return EBT_NOMATCH;
  49                 if (info->bitmask & EBT_IP_PROTO) {
  50                         if (FWINV(info->protocol != u.iph.protocol, EBT_IP_PROTO))
  51                                 return EBT_NOMATCH;
  52                         if (!(info->bitmask & EBT_IP_DPORT) &&
  53                             !(info->bitmask & EBT_IP_SPORT))
  54                                 return EBT_MATCH;
  55                         if (skb_copy_bits(skb, u.iph.ihl*4, &u.ports,
  56                             sizeof(u.ports)))
  57                                 return EBT_NOMATCH;
  58                         if (info->bitmask & EBT_IP_DPORT) {
  59                                 u.ports.dst = ntohs(u.ports.dst);
  60                                 if (FWINV(u.ports.dst < info->dport[0] ||
  61                                           u.ports.dst > info->dport[1],
  62                                           EBT_IP_DPORT))
  63                                 return EBT_NOMATCH;
  64                         }
  65                         if (info->bitmask & EBT_IP_SPORT) {
  66                                 u.ports.src = ntohs(u.ports.src);
  67                                 if (FWINV(u.ports.src < info->sport[0] ||
  68                                           u.ports.src > info->sport[1],
  69                                           EBT_IP_SPORT))
  70                                 return EBT_NOMATCH;
  71                         }
  72                 }
  73                 return EBT_MATCH;
  74        }
  75         else
  76         {
  77                 if (skb_copy_bits(skb, PPPOE_HDR_OFFSET, &u.iph, sizeof(u.iph)))
  78                         return EBT_NOMATCH;
  79                 if (info->bitmask & EBT_IP_TOS &&
  80                    FWINV(info->tos != u.iph.tos, EBT_IP_TOS))
  81                         return EBT_NOMATCH;
  82                 if (info->bitmask & EBT_IP_SOURCE &&
  83                    FWINV((u.iph.saddr & info->smsk) !=
  84                    info->saddr, EBT_IP_SOURCE))
  85                         return EBT_NOMATCH;
  86                 if ((info->bitmask & EBT_IP_DEST) &&
  87                    FWINV((u.iph.daddr & info->dmsk) !=
  88                    info->daddr, EBT_IP_DEST))
  89                         return EBT_NOMATCH;
  90                 if (info->bitmask & EBT_IP_PROTO) {
  91                         if (FWINV(info->protocol != u.iph.protocol, EBT_IP_PROTO))
  92                                 return EBT_NOMATCH;
  93                         if (!(info->bitmask & EBT_IP_DPORT) &&
  94                             !(info->bitmask & EBT_IP_SPORT))
  95                                 return EBT_MATCH;
  96                         if (skb_copy_bits(skb, u.iph.ihl*4+PPPOE_HDR_OFFSET, &u.ports,
  97                             sizeof(u.ports)))
  98                                 return EBT_NOMATCH;
  99                         if (info->bitmask & EBT_IP_DPORT) {
 100                                 u.ports.dst = ntohs(u.ports.dst);
 101                                 if (FWINV(u.ports.dst < info->dport[0] ||
 102                                           u.ports.dst > info->dport[1],
 103                                           EBT_IP_DPORT))
 104                                 return EBT_NOMATCH;
 105                         }
 106                         if (info->bitmask & EBT_IP_SPORT) {
 107                                 u.ports.src = ntohs(u.ports.src);
 108                                 if (FWINV(u.ports.src < info->sport[0] ||
 109                                           u.ports.src > info->sport[1],
 110                                           EBT_IP_SPORT))
 111                                 return EBT_NOMATCH;
 112                         }
 113                 }
 114                 return EBT_MATCH;
 115         }
 116 }
 117
 118 static int ebt_ip_check(const char *tablename, unsigned int hookmask,
 119    const struct ebt_entry *e, void *data, unsigned int datalen)
 120 {
 121         struct ebt_ip_info *info = (struct ebt_ip_info *)data;
 122
 123         if (datalen != EBT_ALIGN(sizeof(struct ebt_ip_info)))
 124                 return -EINVAL;
 125         if (e->ethproto != __constant_htons(ETH_P_IP) ||
 126            e->invflags & EBT_IPROTO)
 127                 return -EINVAL;
 128         if (info->bitmask & ~EBT_IP_MASK || info->invflags & ~EBT_IP_MASK)
 129                 return -EINVAL;
 130         if (info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT)) {
 131                 if (info->invflags & EBT_IP_PROTO)
 132                         return -EINVAL;
 133                 if (info->protocol != IPPROTO_TCP &&
 134                     info->protocol != IPPROTO_UDP)
 135                          return -EINVAL;
 136         }
 137         if (info->bitmask & EBT_IP_DPORT && info->dport[0] > info->dport[1])
 138                 return -EINVAL;
 139         if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1])
 140                 return -EINVAL;
 141         return 0;
 142 }
 143
 144 static struct ebt_match filter_ip =
 145 {
 146         .name           = EBT_IP_MATCH,
 147         .match          = ebt_filter_ip,
 148         .check          = ebt_ip_check,
 149         .me             = THIS_MODULE,
 150 };
 151
 152 static int __init init(void)
 153 {
 154         return ebt_register_match(&filter_ip);
 155 }
 156
 157 static void __exit fini(void)
 158 {
 159         ebt_unregister_match(&filter_ip);
 160 }
 161
 162 module_init(init);
 163 module_exit(fini);
 164 MODULE_LICENSE("GPL");