1/* Kernel module to match an IP address pool. */ 2 3#include <linux/module.h> 4#include <linux/ip.h> 5#include <linux/skbuff.h> 6 7#include <linux/netfilter_ipv4/ip_tables.h> 8#include <linux/netfilter_ipv4/ip_pool.h> 9#include <linux/netfilter_ipv4/ipt_pool.h> 10 11static inline int match_pool( 12 ip_pool_t index, 13 __u32 addr, 14 int inv 15) { 16 if (ip_pool_match(index, ntohl(addr))) 17 inv = !inv; 18 return inv; 19} 20 21static int match( 22 const struct sk_buff *skb, 23 const struct net_device *in, 24 const struct net_device *out, 25 const void *matchinfo, 26 int offset, 27 const void *hdr, 28 u_int16_t datalen, 29 int *hotdrop 30) { 31 const struct ipt_pool_info *info = matchinfo; 32 const struct iphdr *iph = skb->nh.iph; 33 34 if (info->src != IP_POOL_NONE && !match_pool(info->src, iph->saddr, 35 info->flags&IPT_POOL_INV_SRC)) 36 return 0; 37 38 if (info->dst != IP_POOL_NONE && !match_pool(info->dst, iph->daddr, 39 info->flags&IPT_POOL_INV_DST)) 40 return 0; 41 42 return 1; 43} 44 45static int checkentry( 46 const char *tablename, 47 const struct ipt_ip *ip, 48 void *matchinfo, 49 unsigned int matchsize, 50 unsigned int hook_mask 51) { 52 if (matchsize != IPT_ALIGN(sizeof(struct ipt_pool_info))) 53 return 0; 54 return 1; 55} 56 57static struct ipt_match pool_match 58= { { NULL, NULL }, "pool", &match, &checkentry, NULL, THIS_MODULE }; 59 60static int __init init(void) 61{ 62 return ipt_register_match(&pool_match); 63} 64 65static void __exit fini(void) 66{ 67 ipt_unregister_match(&pool_match); 68} 69 70module_init(init); 71module_exit(fini); 72