1 // SPDX-License-Identifier: GPL-2.0-only
6 * Grzegorz Borowiak <grzes@gnu.univ.gda.pl>
11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 #include <linux/if_arp.h>
14 #include <linux/module.h>
15 #include <linux/netfilter/x_tables.h>
16 #include <linux/netfilter_bridge/ebtables.h>
17 #include <linux/netfilter_bridge/ebt_among.h>
19 static bool ebt_mac_wormhash_contains(const struct ebt_mac_wormhash
*wh
,
20 const char *mac
, __be32 ip
)
22 /* You may be puzzled as to how this code works.
23 * Some tricks were used, refer to
24 * include/linux/netfilter_bridge/ebt_among.h
25 * as there you can find a solution of this mystery.
27 const struct ebt_mac_wormhash_tuple
*p
;
29 uint32_t cmp
[2] = { 0, 0 };
30 int key
= ((const unsigned char *)mac
)[5];
32 ether_addr_copy(((char *) cmp
) + 2, mac
);
33 start
= wh
->table
[key
];
34 limit
= wh
->table
[key
+ 1];
36 for (i
= start
; i
< limit
; i
++) {
38 if (cmp
[1] == p
->cmp
[1] && cmp
[0] == p
->cmp
[0])
39 if (p
->ip
== 0 || p
->ip
== ip
)
43 for (i
= start
; i
< limit
; i
++) {
45 if (cmp
[1] == p
->cmp
[1] && cmp
[0] == p
->cmp
[0])
53 static int ebt_mac_wormhash_check_integrity(const struct ebt_mac_wormhash
58 for (i
= 0; i
< 256; i
++) {
59 if (wh
->table
[i
] > wh
->table
[i
+ 1])
63 if (wh
->table
[i
] > wh
->poolsize
)
66 if (wh
->table
[256] > wh
->poolsize
)
71 static int get_ip_dst(const struct sk_buff
*skb
, __be32
*addr
)
73 if (eth_hdr(skb
)->h_proto
== htons(ETH_P_IP
)) {
74 const struct iphdr
*ih
;
77 ih
= skb_header_pointer(skb
, 0, sizeof(_iph
), &_iph
);
81 } else if (eth_hdr(skb
)->h_proto
== htons(ETH_P_ARP
)) {
82 const struct arphdr
*ah
;
87 ah
= skb_header_pointer(skb
, 0, sizeof(_arph
), &_arph
);
89 ah
->ar_pln
!= sizeof(__be32
) ||
90 ah
->ar_hln
!= ETH_ALEN
)
92 bp
= skb_header_pointer(skb
, sizeof(struct arphdr
) +
93 2 * ETH_ALEN
+ sizeof(__be32
),
94 sizeof(__be32
), &buf
);
102 static int get_ip_src(const struct sk_buff
*skb
, __be32
*addr
)
104 if (eth_hdr(skb
)->h_proto
== htons(ETH_P_IP
)) {
105 const struct iphdr
*ih
;
108 ih
= skb_header_pointer(skb
, 0, sizeof(_iph
), &_iph
);
112 } else if (eth_hdr(skb
)->h_proto
== htons(ETH_P_ARP
)) {
113 const struct arphdr
*ah
;
118 ah
= skb_header_pointer(skb
, 0, sizeof(_arph
), &_arph
);
120 ah
->ar_pln
!= sizeof(__be32
) ||
121 ah
->ar_hln
!= ETH_ALEN
)
123 bp
= skb_header_pointer(skb
, sizeof(struct arphdr
) +
124 ETH_ALEN
, sizeof(__be32
), &buf
);
133 ebt_among_mt(const struct sk_buff
*skb
, struct xt_action_param
*par
)
135 const struct ebt_among_info
*info
= par
->matchinfo
;
136 const char *dmac
, *smac
;
137 const struct ebt_mac_wormhash
*wh_dst
, *wh_src
;
138 __be32 dip
= 0, sip
= 0;
140 wh_dst
= ebt_among_wh_dst(info
);
141 wh_src
= ebt_among_wh_src(info
);
144 smac
= eth_hdr(skb
)->h_source
;
145 if (get_ip_src(skb
, &sip
))
147 if (!(info
->bitmask
& EBT_AMONG_SRC_NEG
)) {
148 /* we match only if it contains */
149 if (!ebt_mac_wormhash_contains(wh_src
, smac
, sip
))
152 /* we match only if it DOES NOT contain */
153 if (ebt_mac_wormhash_contains(wh_src
, smac
, sip
))
159 dmac
= eth_hdr(skb
)->h_dest
;
160 if (get_ip_dst(skb
, &dip
))
162 if (!(info
->bitmask
& EBT_AMONG_DST_NEG
)) {
163 /* we match only if it contains */
164 if (!ebt_mac_wormhash_contains(wh_dst
, dmac
, dip
))
167 /* we match only if it DOES NOT contain */
168 if (ebt_mac_wormhash_contains(wh_dst
, dmac
, dip
))
176 static bool poolsize_invalid(const struct ebt_mac_wormhash
*w
)
178 return w
&& w
->poolsize
>= (INT_MAX
/ sizeof(struct ebt_mac_wormhash_tuple
));
181 static bool wormhash_offset_invalid(int off
, unsigned int len
)
183 if (off
== 0) /* not present */
186 if (off
< (int)sizeof(struct ebt_among_info
) ||
187 off
% __alignof__(struct ebt_mac_wormhash
))
190 off
+= sizeof(struct ebt_mac_wormhash
);
195 static bool wormhash_sizes_valid(const struct ebt_mac_wormhash
*wh
, int a
, int b
)
198 a
= sizeof(struct ebt_among_info
);
200 return ebt_mac_wormhash_size(wh
) + a
== b
;
203 static int ebt_among_mt_check(const struct xt_mtchk_param
*par
)
205 const struct ebt_among_info
*info
= par
->matchinfo
;
206 const struct ebt_entry_match
*em
=
207 container_of(par
->matchinfo
, const struct ebt_entry_match
, data
);
208 unsigned int expected_length
= sizeof(struct ebt_among_info
);
209 const struct ebt_mac_wormhash
*wh_dst
, *wh_src
;
212 if (expected_length
> em
->match_size
)
215 if (wormhash_offset_invalid(info
->wh_dst_ofs
, em
->match_size
) ||
216 wormhash_offset_invalid(info
->wh_src_ofs
, em
->match_size
))
219 wh_dst
= ebt_among_wh_dst(info
);
220 if (poolsize_invalid(wh_dst
))
223 expected_length
+= ebt_mac_wormhash_size(wh_dst
);
224 if (expected_length
> em
->match_size
)
227 wh_src
= ebt_among_wh_src(info
);
228 if (poolsize_invalid(wh_src
))
231 if (info
->wh_src_ofs
< info
->wh_dst_ofs
) {
232 if (!wormhash_sizes_valid(wh_src
, info
->wh_src_ofs
, info
->wh_dst_ofs
))
235 if (!wormhash_sizes_valid(wh_dst
, info
->wh_dst_ofs
, info
->wh_src_ofs
))
239 expected_length
+= ebt_mac_wormhash_size(wh_src
);
241 if (em
->match_size
!= EBT_ALIGN(expected_length
)) {
242 pr_err_ratelimited("wrong size: %d against expected %d, rounded to %zd\n",
243 em
->match_size
, expected_length
,
244 EBT_ALIGN(expected_length
));
247 if (wh_dst
&& (err
= ebt_mac_wormhash_check_integrity(wh_dst
))) {
248 pr_err_ratelimited("dst integrity fail: %x\n", -err
);
251 if (wh_src
&& (err
= ebt_mac_wormhash_check_integrity(wh_src
))) {
252 pr_err_ratelimited("src integrity fail: %x\n", -err
);
258 static struct xt_match ebt_among_mt_reg __read_mostly
= {
261 .family
= NFPROTO_BRIDGE
,
262 .match
= ebt_among_mt
,
263 .checkentry
= ebt_among_mt_check
,
264 .matchsize
= -1, /* special case */
268 static int __init
ebt_among_init(void)
270 return xt_register_match(&ebt_among_mt_reg
);
273 static void __exit
ebt_among_fini(void)
275 xt_unregister_match(&ebt_among_mt_reg
);
278 module_init(ebt_among_init
);
279 module_exit(ebt_among_fini
);
280 MODULE_DESCRIPTION("Ebtables: Combined MAC/IP address list matching");
281 MODULE_LICENSE("GPL");