mac match extension

PATCH New Thomas Heinz 1 participant 1 message Oct 15, 2002

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Thomas Heinz

author

2002-10-15 19:44 UTC #0 lore raw

PATCH 1/1 mac match extension

Some days ago, Dan Searle asked for a mac match extension where it should be possible to apply arbitrary masks to the mac address:
http://msgs.securepoint.com/cgi-bin/get/netfilter-0210/170.html

I extended the mac matching code and attached the patch to this e-mail.

Although I think that this feature will be used very rarely it might be helpful to have it in patch-o-matic. Anyway, it's your decision. If you don't like it or believe that it is not useful throw it away ;-)

Regards,

Thomas

include/linux/netfilter_ipv4/ipt_mac.h +4 -2

@@ -2,7 +2,9 @@
 #define _IPT_MAC_H
 
 struct ipt_mac_info {
-    unsigned char srcaddr[ETH_ALEN];
-    int invert;
+	unsigned char srcaddr[ETH_ALEN];
+	unsigned char mask[ETH_ALEN];
+	int is_mask;
+	int invert;
 };
 #endif /*_IPT_MAC_H*/

net/ipv4/netfilter/ipt_mac.c +23 -5

@@ -18,12 +18,30 @@
 {
     const struct ipt_mac_info *info = matchinfo;
 
-    /* Is mac pointer valid? */
-    return (skb->mac.raw >= skb->head
-	    && (skb->mac.raw + ETH_HLEN) <= skb->data
-	    /* If so, compare... */
-	    && ((memcmp(skb->mac.ethernet->h_source, info->srcaddr, ETH_ALEN)
+    if (info->is_mask) {
+	    if (skb->mac.raw >= skb->head &&
+		(skb->mac.raw + ETH_HLEN) <= skb->data) {
+		    int i;
+		    for (i = 0; i < ETH_HLEN; i++) {
+			    if ((skb->mac.ethernet->h_source[i] & 
+				 info->mask[i]) != 
+				(info->srcaddr[i] & info->mask[i])) {
+				    return info->invert;
+			    }
+		    }
+		    return !info->invert;
+	    } else {
+		    return 0;
+	    }
+    } else {
+	    /* Is mac pointer valid? */
+	    return (skb->mac.raw >= skb->head
+		    && (skb->mac.raw + ETH_HLEN) <= skb->data
+		    /* If so, compare... */
+		    && ((memcmp(skb->mac.ethernet->h_source,
+				info->srcaddr, ETH_ALEN)
 		== 0) ^ info->invert));
+    }
 }
 
 static int

Author: Thomas Heinz <[email protected]>
Status: should work :-)

This patch extends the mac match in a way that arbitrary masks can be applied.

Here is an example:

# iptables -A INPUT -m mac --mac-source 12:34:56:78:90:AB --mac-mask FF:FF:70:07:FF:FF -j REJECT

***** WARNING ***** This patch also patch the userspace directory which means that
you have to recompile and reinstall the iptables package after that.

extensions/libipt_mac.c renamed from extensions/libipt_mac.c~ +50 -8

124 lines not on this page · raw message