PATCH [1/2] ebtables-initial kernel part

diff -urN linux-2.6.11.10.orig/include/linux/if_bridge.h linux-2.6.11.10/include/linux/if_bridge.h
--- linux-2.6.11.10.orig/include/linux/if_bridge.h	2005-03-02 02:38:09.000000000 -0500
+++ linux-2.6.11.10/include/linux/if_bridge.h	2005-05-24 12:08:37.032805144 -0400
@@ -107,6 +107,7 @@
 extern void brioctl_set(int (*ioctl_hook)(unsigned int, void __user *));
 extern int (*br_handle_frame_hook)(struct net_bridge_port *p, struct sk_buff **pskb);
 extern int (*br_should_route_hook)(struct sk_buff **pskb);
+extern int (*br_initial_filter)(struct sk_buff **pskb);
 
 #endif
 
diff -urN linux-2.6.11.10.orig/include/linux/netfilter_bridge.h linux-2.6.11.10/include/linux/netfilter_bridge.h
--- linux-2.6.11.10.orig/include/linux/netfilter_bridge.h	2005-03-02 02:38:10.000000000 -0500
+++ linux-2.6.11.10/include/linux/netfilter_bridge.h	2005-05-24 11:50:13.526563592 -0400
@@ -24,7 +24,9 @@
 #define NF_BR_POST_ROUTING	4
 /* Not really a hook, but used for the ebtables broute table */
 #define NF_BR_BROUTING		5
-#define NF_BR_NUMHOOKS		6
+/* Also not really a hook, used for initial filtering. */
+#define NF_BR_INITIAL_IN	6
+#define NF_BR_NUMHOOKS		7
 
 #ifdef __KERNEL__
 
diff -urN linux-2.6.11.10.orig/net/bridge/br.c linux-2.6.11.10/net/bridge/br.c
--- linux-2.6.11.10.orig/net/bridge/br.c	2005-03-02 02:37:49.000000000 -0500
+++ linux-2.6.11.10/net/bridge/br.c	2005-05-24 12:09:03.319808912 -0400
@@ -28,6 +28,7 @@
 #endif
 
 int (*br_should_route_hook) (struct sk_buff **pskb) = NULL;
+int (*br_initial_filter) (struct sk_buff **pskb) = NULL;
 
 static int __init br_init(void)
 {
@@ -71,6 +72,7 @@
 }
 
 EXPORT_SYMBOL(br_should_route_hook);
+EXPORT_SYMBOL(br_initial_filter);
 
 module_init(br_init)
 module_exit(br_deinit)
diff -urN linux-2.6.11.10.orig/net/bridge/br_input.c linux-2.6.11.10/net/bridge/br_input.c
--- linux-2.6.11.10.orig/net/bridge/br_input.c	2005-03-02 02:37:50.000000000 -0500
+++ linux-2.6.11.10/net/bridge/br_input.c	2005-05-24 12:09:31.478528136 -0400
@@ -109,8 +109,14 @@
 		goto err;
 
 	if (p->state == BR_STATE_LEARNING ||
-	    p->state == BR_STATE_FORWARDING)
+	    p->state == BR_STATE_FORWARDING) {
+		if (br_initial_filter)
+			if (br_initial_filter(pskb)) {
+				kfree_skb(*pskb);
+				return 1;
+			}
 		br_fdb_insert(p->br, p, eth_hdr(skb)->h_source, 0);
+	}
 
 	if (p->br->stp_enabled &&
 	    !memcmp(dest, bridge_ula, 5) &&
diff -urN linux-2.6.11.10.orig/net/bridge/netfilter/Kconfig linux-2.6.11.10/net/bridge/netfilter/Kconfig
--- linux-2.6.11.10.orig/net/bridge/netfilter/Kconfig	2005-03-02 02:37:50.000000000 -0500
+++ linux-2.6.11.10/net/bridge/netfilter/Kconfig	2005-05-24 11:59:51.691669136 -0400
@@ -25,6 +25,15 @@
 
 	  To compile it as a module, choose M here.  If unsure, say N.
 
+config BRIDGE_EBT_INITIAL
+	tristate "ebt: initial table support"
+	depends on BRIDGE_NF_EBTABLES
+	help
+	  The ebtables initial table can be used to drop packets before they
+	  reach anything else.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
 config BRIDGE_EBT_T_FILTER
 	tristate "ebt: filter table support"
 	depends on BRIDGE_NF_EBTABLES
diff -urN linux-2.6.11.10.orig/net/bridge/netfilter/Makefile linux-2.6.11.10/net/bridge/netfilter/Makefile
--- linux-2.6.11.10.orig/net/bridge/netfilter/Makefile	2005-03-02 02:38:12.000000000 -0500
+++ linux-2.6.11.10/net/bridge/netfilter/Makefile	2005-05-24 12:00:24.959611640 -0400
@@ -6,6 +6,7 @@
 
 # tables
 obj-$(CONFIG_BRIDGE_EBT_BROUTE) += ebtable_broute.o
+obj-$(CONFIG_BRIDGE_EBT_INITIAL) += ebtable_initial.o
 obj-$(CONFIG_BRIDGE_EBT_T_FILTER) += ebtable_filter.o
 obj-$(CONFIG_BRIDGE_EBT_T_NAT) += ebtable_nat.o
 
diff -urN linux-2.6.11.10.orig/net/bridge/netfilter/ebtable_initial.c linux-2.6.11.10/net/bridge/netfilter/ebtable_initial.c
--- linux-2.6.11.10.orig/net/bridge/netfilter/ebtable_initial.c	1969-12-31 19:00:00.000000000 -0500
+++ linux-2.6.11.10/net/bridge/netfilter/ebtable_initial.c	2005-05-24 12:11:03.448546568 -0400
@@ -0,0 +1,88 @@
+/*
+ *  ebtable_initial
+ *	Author:
+ *	J. Anderson <janderson-PLjm5N+tXOMV+D8aMU/[email protected]>
+ * 
+ *	Based on ebtable_broute by:
+ *	Bart De Schuymer <[email protected]>
+ *
+ *  May, 2005
+ *
+ *  This table lets you drop frame before they reach the bridge code. This
+ *  table is traversed before any of the other tables, including brouting.
+ */
+
+#include <linux/netfilter_bridge/ebtables.h>
+#include <linux/module.h>
+#include <linux/if_bridge.h>
+
+#define INITIAL_VALID_HOOKS (1 << NF_BR_INITIAL_IN)
+#define INITIAL_NUM_HOOKS 1
+
+/* EBT_ACCEPT and EBT_DROP are the only two options here. */
+static struct ebt_entries initial_chain = {
+	.name		= "INPUT",
+	.policy		= EBT_ACCEPT,
+};
+
+static struct ebt_replace init_table =
+{
+	.name		= "initial",
+	.valid_hooks	= INITIAL_VALID_HOOKS,
+	.entries_size	= INITIAL_NUM_HOOKS * sizeof(struct ebt_entries),
+	.hook_entry	= {
+		[NF_BR_INITIAL_IN]	= &initial_chain,
+	},
+	.entries	= (char *)&initial_chain,
+};
+
+static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
+{
+	if (valid_hooks & ~INITIAL_VALID_HOOKS)
+		return -EINVAL;
+	return 0;
+}
+
+static struct ebt_table initial_table =
+{
+	.name		= "initial",
+	.table		= &init_table,
+	.valid_hooks	= INITIAL_VALID_HOOKS,
+	.lock		= RW_LOCK_UNLOCKED,
+	.check		= check,
+	.me		= THIS_MODULE,
+};
+
+static int ebt_initial_filter(struct sk_buff **pskb)
+{
+	int ret;
+
+	ret = ebt_do_table(NF_BR_INITIAL_IN, pskb, (*pskb)->dev, NULL,
+	   &initial_table);
+	if (ret == NF_DROP)
+		return 1; /* drop it */
+	return 0; /* leave it be */
+}
+
+static int __init init(void)
+{
+	int ret;
+
+	ret = ebt_register_table(&initial_table);
+	if (ret < 0)
+		return ret;
+	/* see br_input.c */
+	br_initial_filter = ebt_initial_filter;
+	return ret;
+}
+
+static void __exit fini(void)
+{
+	br_initial_filter = NULL;
+	synchronize_net();
+	ebt_unregister_table(&initial_table);
+}
+
+module_init(init);
+module_exit(fini);
+MODULE_LICENSE("GPL");