net/netfilter/xt_devgroup.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
0004  */
0005
0006 #include <linux/module.h>
0007 #include <linux/skbuff.h>
0008 #include <linux/netdevice.h>
0009
0010 #include <linux/netfilter/xt_devgroup.h>
0011 #include <linux/netfilter/x_tables.h>
0012
0013 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
0014 MODULE_LICENSE("GPL");
0015 MODULE_DESCRIPTION("Xtables: Device group match");
0016 MODULE_ALIAS("ipt_devgroup");
0017 MODULE_ALIAS("ip6t_devgroup");
0018
0019 static bool devgroup_mt(const struct sk_buff *skb, struct xt_action_param *par)
0020 {
0021     const struct xt_devgroup_info *info = par->matchinfo;
0022
0023     if (info->flags & XT_DEVGROUP_MATCH_SRC &&
0024         (((info->src_group ^ xt_in(par)->group) & info->src_mask ? 1 : 0) ^
0025          ((info->flags & XT_DEVGROUP_INVERT_SRC) ? 1 : 0)))
0026         return false;
0027
0028     if (info->flags & XT_DEVGROUP_MATCH_DST &&
0029         (((info->dst_group ^ xt_out(par)->group) & info->dst_mask ? 1 : 0) ^
0030          ((info->flags & XT_DEVGROUP_INVERT_DST) ? 1 : 0)))
0031         return false;
0032
0033     return true;
0034 }
0035
0036 static int devgroup_mt_checkentry(const struct xt_mtchk_param *par)
0037 {
0038     const struct xt_devgroup_info *info = par->matchinfo;
0039
0040     if (info->flags & ~(XT_DEVGROUP_MATCH_SRC | XT_DEVGROUP_INVERT_SRC |
0041                 XT_DEVGROUP_MATCH_DST | XT_DEVGROUP_INVERT_DST))
0042         return -EINVAL;
0043
0044     if (info->flags & XT_DEVGROUP_MATCH_SRC &&
0045         par->hook_mask & ~((1 << NF_INET_PRE_ROUTING) |
0046                    (1 << NF_INET_LOCAL_IN) |
0047                    (1 << NF_INET_FORWARD)))
0048         return -EINVAL;
0049
0050     if (info->flags & XT_DEVGROUP_MATCH_DST &&
0051         par->hook_mask & ~((1 << NF_INET_FORWARD) |
0052                    (1 << NF_INET_LOCAL_OUT) |
0053                    (1 << NF_INET_POST_ROUTING)))
0054         return -EINVAL;
0055
0056     return 0;
0057 }
0058
0059 static struct xt_match devgroup_mt_reg __read_mostly = {
0060     .name       = "devgroup",
0061     .match      = devgroup_mt,
0062     .checkentry = devgroup_mt_checkentry,
0063     .matchsize  = sizeof(struct xt_devgroup_info),
0064     .family     = NFPROTO_UNSPEC,
0065     .me     = THIS_MODULE
0066 };
0067
0068 static int __init devgroup_mt_init(void)
0069 {
0070     return xt_register_match(&devgroup_mt_reg);
0071 }
0072
0073 static void __exit devgroup_mt_exit(void)
0074 {
0075     xt_unregister_match(&devgroup_mt_reg);
0076 }
0077
0078 module_init(devgroup_mt_init);
0079 module_exit(devgroup_mt_exit);