1/* Kernel module to match an IP address pool. */
2
3#include <linux/module.h>
4#include <linux/ip.h>
5#include <linux/skbuff.h>
6
7#include <linux/netfilter_ipv4/ip_tables.h>
8#include <linux/netfilter_ipv4/ip_pool.h>
9#include <linux/netfilter_ipv4/ipt_pool.h>
10
11static inline int match_pool(
12	ip_pool_t index,
13	__u32 addr,
14	int inv
15) {
16	if (ip_pool_match(index, ntohl(addr)))
17		inv = !inv;
18	return inv;
19}
20
21static int match(
22	const struct sk_buff *skb,
23	const struct net_device *in,
24	const struct net_device *out,
25	const void *matchinfo,
26	int offset,
27	const void *hdr,
28	u_int16_t datalen,
29	int *hotdrop
30) {
31	const struct ipt_pool_info *info = matchinfo;
32	const struct iphdr *iph = skb->nh.iph;
33
34	if (info->src != IP_POOL_NONE && !match_pool(info->src, iph->saddr,
35						info->flags&IPT_POOL_INV_SRC))
36		return 0;
37
38	if (info->dst != IP_POOL_NONE && !match_pool(info->dst, iph->daddr,
39						info->flags&IPT_POOL_INV_DST))
40		return 0;
41
42	return 1;
43}
44
45static int checkentry(
46	const char *tablename,
47	const struct ipt_ip *ip,
48	void *matchinfo,
49	unsigned int matchsize,
50	unsigned int hook_mask
51) {
52	if (matchsize != IPT_ALIGN(sizeof(struct ipt_pool_info)))
53		return 0;
54	return 1;
55}
56
57static struct ipt_match pool_match
58= { { NULL, NULL }, "pool", &match, &checkentry, NULL, THIS_MODULE };
59
60static int __init init(void)
61{
62	return ipt_register_match(&pool_match);
63}
64
65static void __exit fini(void)
66{
67	ipt_unregister_match(&pool_match);
68}
69
70module_init(init);
71module_exit(fini);
72