[mirror_ubuntu-jammy-kernel.git] / net / netfilter / xt_CT.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/gfp.h>
#include <linux/skbuff.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_CT.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_timeout.h>
#include <net/netfilter/nf_conntrack_zones.h>

static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
{
	/* Previously seen (loopback)? Ignore. */
	if (skb->_nfct != 0)
		return XT_CONTINUE;

	if (ct) {
		atomic_inc(&ct->ct_general.use);
		nf_ct_set(skb, ct, IP_CT_NEW);
	} else {
		nf_ct_set(skb, ct, IP_CT_UNTRACKED);
	}

	return XT_CONTINUE;
}

static unsigned int xt_ct_target_v0(struct sk_buff *skb,
				    const struct xt_action_param *par)
{
	const struct xt_ct_target_info *info = par->targinfo;
	struct nf_conn *ct = info->ct;

	return xt_ct_target(skb, ct);
}

static unsigned int xt_ct_target_v1(struct sk_buff *skb,
				    const struct xt_action_param *par)
{
	const struct xt_ct_target_info_v1 *info = par->targinfo;
	struct nf_conn *ct = info->ct;

	return xt_ct_target(skb, ct);
}

static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
{
	if (par->family == NFPROTO_IPV4) {
		const struct ipt_entry *e = par->entryinfo;

		if (e->ip.invflags & IPT_INV_PROTO)
			return 0;
		return e->ip.proto;
	} else if (par->family == NFPROTO_IPV6) {
		const struct ip6t_entry *e = par->entryinfo;

		if (e->ipv6.invflags & IP6T_INV_PROTO)
			return 0;
		return e->ipv6.proto;
	} else
		return 0;
}

static int
xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
		 const struct xt_tgchk_param *par)
{
	struct nf_conntrack_helper *helper;
	struct nf_conn_help *help;
	u8 proto;

	proto = xt_ct_find_proto(par);
	if (!proto) {
		pr_info_ratelimited("You must specify a L4 protocol and not use inversions on it\n");
		return -ENOENT;
	}

	helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
						    proto);
	if (helper == NULL) {
		pr_info_ratelimited("No such helper \"%s\"\n", helper_name);
		return -ENOENT;
	}

	help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
	if (help == NULL) {
		nf_conntrack_helper_put(helper);
		return -ENOMEM;
	}

	help->helper = helper;
	return 0;
}

static int
xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
		  const char *timeout_name)
{
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	const struct nf_conntrack_l4proto *l4proto;
	u8 proto;

	proto = xt_ct_find_proto(par);
	if (!proto) {
		pr_info_ratelimited("You must specify a L4 protocol and not "
				    "use inversions on it");
		return -EINVAL;
	}
	l4proto = nf_ct_l4proto_find(proto);
	return nf_ct_set_timeout(par->net, ct, par->family, l4proto->l4proto,
				 timeout_name);

#else
	return -EOPNOTSUPP;
#endif
}

static u16 xt_ct_flags_to_dir(const struct xt_ct_target_info_v1 *info)
{
	switch (info->flags & (XT_CT_ZONE_DIR_ORIG |
			       XT_CT_ZONE_DIR_REPL)) {
	case XT_CT_ZONE_DIR_ORIG:
		return NF_CT_ZONE_DIR_ORIG;
	case XT_CT_ZONE_DIR_REPL:
		return NF_CT_ZONE_DIR_REPL;
	default:
		return NF_CT_DEFAULT_ZONE_DIR;
	}
}

static int xt_ct_tg_check(const struct xt_tgchk_param *par,
			  struct xt_ct_target_info_v1 *info)
{
	struct nf_conntrack_zone zone;
	struct nf_conn_help *help;
	struct nf_conn *ct;
	int ret = -EOPNOTSUPP;

	if (info->flags & XT_CT_NOTRACK) {
		ct = NULL;
		goto out;
	}

#ifndef CONFIG_NF_CONNTRACK_ZONES
	if (info->zone || info->flags & (XT_CT_ZONE_DIR_ORIG |
					 XT_CT_ZONE_DIR_REPL |
					 XT_CT_ZONE_MARK))
		goto err1;
#endif

	ret = nf_ct_netns_get(par->net, par->family);
	if (ret < 0)
		goto err1;

	memset(&zone, 0, sizeof(zone));
	zone.id = info->zone;
	zone.dir = xt_ct_flags_to_dir(info);
	if (info->flags & XT_CT_ZONE_MARK)
		zone.flags |= NF_CT_FLAG_MARK;

	ct = nf_ct_tmpl_alloc(par->net, &zone, GFP_KERNEL);
	if (!ct) {
		ret = -ENOMEM;
		goto err2;
	}

	ret = 0;
	if ((info->ct_events || info->exp_events) &&
	    !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
				  GFP_KERNEL)) {
		ret = -EINVAL;
		goto err3;
	}

	if (info->helper[0]) {
		if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
			ret = -ENAMETOOLONG;
			goto err3;
		}

		ret = xt_ct_set_helper(ct, info->helper, par);
		if (ret < 0)
			goto err3;
	}

	if (info->timeout[0]) {
		if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
			ret = -ENAMETOOLONG;
			goto err4;
		}

		ret = xt_ct_set_timeout(ct, par, info->timeout);
		if (ret < 0)
			goto err4;
	}
	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
	nf_conntrack_get(&ct->ct_general);
out:
	info->ct = ct;
	return 0;

err4:
	help = nfct_help(ct);
	if (help)
		nf_conntrack_helper_put(help->helper);
err3:
	nf_ct_tmpl_free(ct);
err2:
	nf_ct_netns_put(par->net, par->family);
err1:
	return ret;
}

static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
{
	struct xt_ct_target_info *info = par->targinfo;
	struct xt_ct_target_info_v1 info_v1 = {
		.flags 		= info->flags,
		.zone		= info->zone,
		.ct_events	= info->ct_events,
		.exp_events	= info->exp_events,
	};
	int ret;

	if (info->flags & ~XT_CT_NOTRACK)
		return -EINVAL;

	memcpy(info_v1.helper, info->helper, sizeof(info->helper));

	ret = xt_ct_tg_check(par, &info_v1);
	if (ret < 0)
		return ret;

	info->ct = info_v1.ct;

	return ret;
}

static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
{
	struct xt_ct_target_info_v1 *info = par->targinfo;

	if (info->flags & ~XT_CT_NOTRACK)
		return -EINVAL;

	return xt_ct_tg_check(par, par->targinfo);
}

static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)
{
	struct xt_ct_target_info_v1 *info = par->targinfo;

	if (info->flags & ~XT_CT_MASK)
		return -EINVAL;

	return xt_ct_tg_check(par, par->targinfo);
}

static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
			     struct xt_ct_target_info_v1 *info)
{
	struct nf_conn *ct = info->ct;
	struct nf_conn_help *help;

	if (ct) {
		help = nfct_help(ct);
		if (help)
			nf_conntrack_helper_put(help->helper);

		nf_ct_netns_put(par->net, par->family);

		nf_ct_destroy_timeout(ct);
		nf_ct_put(info->ct);
	}
}

static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
{
	struct xt_ct_target_info *info = par->targinfo;
	struct xt_ct_target_info_v1 info_v1 = {
		.flags 		= info->flags,
		.zone		= info->zone,
		.ct_events	= info->ct_events,
		.exp_events	= info->exp_events,
		.ct		= info->ct,
	};
	memcpy(info_v1.helper, info->helper, sizeof(info->helper));

	xt_ct_tg_destroy(par, &info_v1);
}

static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
{
	xt_ct_tg_destroy(par, par->targinfo);
}

static struct xt_target xt_ct_tg_reg[] __read_mostly = {
	{
		.name		= "CT",
		.family		= NFPROTO_UNSPEC,
		.targetsize	= sizeof(struct xt_ct_target_info),
		.usersize	= offsetof(struct xt_ct_target_info, ct),
		.checkentry	= xt_ct_tg_check_v0,
		.destroy	= xt_ct_tg_destroy_v0,
		.target		= xt_ct_target_v0,
		.table		= "raw",
		.me		= THIS_MODULE,
	},
	{
		.name		= "CT",
		.family		= NFPROTO_UNSPEC,
		.revision	= 1,
		.targetsize	= sizeof(struct xt_ct_target_info_v1),
		.usersize	= offsetof(struct xt_ct_target_info, ct),
		.checkentry	= xt_ct_tg_check_v1,
		.destroy	= xt_ct_tg_destroy_v1,
		.target		= xt_ct_target_v1,
		.table		= "raw",
		.me		= THIS_MODULE,
	},
	{
		.name		= "CT",
		.family		= NFPROTO_UNSPEC,
		.revision	= 2,
		.targetsize	= sizeof(struct xt_ct_target_info_v1),
		.usersize	= offsetof(struct xt_ct_target_info, ct),
		.checkentry	= xt_ct_tg_check_v2,
		.destroy	= xt_ct_tg_destroy_v1,
		.target		= xt_ct_target_v1,
		.table		= "raw",
		.me		= THIS_MODULE,
	},
};

static unsigned int
notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
{
	/* Previously seen (loopback)? Ignore. */
	if (skb->_nfct != 0)
		return XT_CONTINUE;

	nf_ct_set(skb, NULL, IP_CT_UNTRACKED);

	return XT_CONTINUE;
}

static int notrack_chk(const struct xt_tgchk_param *par)
{
	if (!par->net->xt.notrack_deprecated_warning) {
		pr_info("netfilter: NOTRACK target is deprecated, "
			"use CT instead or upgrade iptables\n");
		par->net->xt.notrack_deprecated_warning = true;
	}
	return 0;
}

static struct xt_target notrack_tg_reg __read_mostly = {
	.name		= "NOTRACK",
	.revision	= 0,
	.family		= NFPROTO_UNSPEC,
	.checkentry	= notrack_chk,
	.target		= notrack_tg,
	.table		= "raw",
	.me		= THIS_MODULE,
};

static int __init xt_ct_tg_init(void)
{
	int ret;

	ret = xt_register_target(&notrack_tg_reg);
	if (ret < 0)
		return ret;

	ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
	if (ret < 0) {
		xt_unregister_target(&notrack_tg_reg);
		return ret;
	}
	return 0;
}

static void __exit xt_ct_tg_exit(void)
{
	xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
	xt_unregister_target(&notrack_tg_reg);
}

module_init(xt_ct_tg_init);
module_exit(xt_ct_tg_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Xtables: connection tracking target");
MODULE_ALIAS("ipt_CT");
MODULE_ALIAS("ip6t_CT");
MODULE_ALIAS("ipt_NOTRACK");
MODULE_ALIAS("ip6t_NOTRACK");
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
84f3bb9a PM	2	/*
84f3bb9a PM	3	* Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
84f3bb9a	4	*/
a7fed762	5	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
84f3bb9a	6	#include <linux/module.h>
5a0e3ad6	7	#include <linux/gfp.h>
84f3bb9a	8	#include <linux/skbuff.h>
84f3bb9a PM	9	#include <linux/netfilter_ipv4/ip_tables.h>
	10	#include <linux/netfilter_ipv6/ip6_tables.h>
	11	#include <linux/netfilter/x_tables.h>
	12	#include <linux/netfilter/xt_CT.h>
	13	#include <net/netfilter/nf_conntrack.h>
eeb4cb95	14	#include <net/netfilter/nf_conntrack_l4proto.h>
84f3bb9a PM	15	#include <net/netfilter/nf_conntrack_helper.h>
84f3bb9a PM	16	#include <net/netfilter/nf_conntrack_ecache.h>
24de58f4	17	#include <net/netfilter/nf_conntrack_timeout.h>
5d0aa2cc	18	#include <net/netfilter/nf_conntrack_zones.h>
84f3bb9a	19
d52ed437	20	static inline int xt_ct_target(struct sk_buff skb, struct nf_conn ct)
84f3bb9a	21	{
84f3bb9a	22	/* Previously seen (loopback)? Ignore. */
a9e419dc	23	if (skb->_nfct != 0)
84f3bb9a PM	24	return XT_CONTINUE;
84f3bb9a PM	25
cc41c84b FW	26	if (ct) {
	27	atomic_inc(&ct->ct_general.use);
	28	nf_ct_set(skb, ct, IP_CT_NEW);
	29	} else {
	30	nf_ct_set(skb, ct, IP_CT_UNTRACKED);
	31	}
84f3bb9a PM	32
	33	return XT_CONTINUE;
	34	}
	35
d52ed437	36	static unsigned int xt_ct_target_v0(struct sk_buff *skb,
24de58f4 PNA	37	const struct xt_action_param *par)
24de58f4 PNA	38	{
d52ed437	39	const struct xt_ct_target_info *info = par->targinfo;
24de58f4 PNA	40	struct nf_conn *ct = info->ct;
24de58f4 PNA	41
d52ed437 PNA	42	return xt_ct_target(skb, ct);
d52ed437 PNA	43	}
24de58f4	44
d52ed437 PNA	45	static unsigned int xt_ct_target_v1(struct sk_buff *skb,
	46	const struct xt_action_param *par)
	47	{
	48	const struct xt_ct_target_info_v1 *info = par->targinfo;
	49	struct nf_conn *ct = info->ct;
24de58f4	50
d52ed437	51	return xt_ct_target(skb, ct);
24de58f4 PNA	52	}
24de58f4 PNA	53
84f3bb9a PM	54	static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
84f3bb9a PM	55	{
076f7839	56	if (par->family == NFPROTO_IPV4) {
84f3bb9a PM	57	const struct ipt_entry *e = par->entryinfo;
	58
	59	if (e->ip.invflags & IPT_INV_PROTO)
	60	return 0;
	61	return e->ip.proto;
076f7839	62	} else if (par->family == NFPROTO_IPV6) {
84f3bb9a PM	63	const struct ip6t_entry *e = par->entryinfo;
	64
	65	if (e->ipv6.invflags & IP6T_INV_PROTO)
	66	return 0;
	67	return e->ipv6.proto;
	68	} else
	69	return 0;
	70	}
	71
236df005 PNA	72	static int
	73	xt_ct_set_helper(struct nf_conn ct, const char helper_name,
	74	const struct xt_tgchk_param *par)
	75	{
	76	struct nf_conntrack_helper *helper;
	77	struct nf_conn_help *help;
	78	u8 proto;
	79
	80	proto = xt_ct_find_proto(par);
	81	if (!proto) {
11f7aee2	82	pr_info_ratelimited("You must specify a L4 protocol and not use inversions on it\n");
236df005 PNA	83	return -ENOENT;
	84	}
	85
	86	helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
	87	proto);
	88	if (helper == NULL) {
11f7aee2	89	pr_info_ratelimited("No such helper \"%s\"\n", helper_name);
236df005 PNA	90	return -ENOENT;
	91	}
	92
440534d3	93	help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
236df005	94	if (help == NULL) {
d91fc59c	95	nf_conntrack_helper_put(helper);
236df005 PNA	96	return -ENOMEM;
	97	}
	98
	99	help->helper = helper;
	100	return 0;
	101	}
	102
236df005 PNA	103	static int
	104	xt_ct_set_timeout(struct nf_conn ct, const struct xt_tgchk_param par,
	105	const char *timeout_name)
	106	{
	107	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
b3480fe0	108	const struct nf_conntrack_l4proto *l4proto;
0153d5a8	109	u8 proto;
236df005	110
0153d5a8 PNA	111	proto = xt_ct_find_proto(par);
0153d5a8 PNA	112	if (!proto) {
717700d1 YHW	113	pr_info_ratelimited("You must specify a L4 protocol and not "
	114	"use inversions on it");
	115	return -EINVAL;
236df005	116	}
4a60dc74	117	l4proto = nf_ct_l4proto_find(proto);
717700d1 YHW	118	return nf_ct_set_timeout(par->net, ct, par->family, l4proto->l4proto,
717700d1 YHW	119	timeout_name);
236df005	120
236df005 PNA	121	#else
	122	return -EOPNOTSUPP;
	123	#endif
	124	}
	125
deedb590 DB	126	static u16 xt_ct_flags_to_dir(const struct xt_ct_target_info_v1 *info)
	127	{
	128	switch (info->flags & (XT_CT_ZONE_DIR_ORIG \|
	129	XT_CT_ZONE_DIR_REPL)) {
	130	case XT_CT_ZONE_DIR_ORIG:
	131	return NF_CT_ZONE_DIR_ORIG;
	132	case XT_CT_ZONE_DIR_REPL:
	133	return NF_CT_ZONE_DIR_REPL;
	134	default:
	135	return NF_CT_DEFAULT_ZONE_DIR;
	136	}
	137	}
	138
d52ed437 PNA	139	static int xt_ct_tg_check(const struct xt_tgchk_param *par,
d52ed437 PNA	140	struct xt_ct_target_info_v1 *info)
24de58f4	141	{
308ac914	142	struct nf_conntrack_zone zone;
470acf55	143	struct nf_conn_help *help;
24de58f4	144	struct nf_conn *ct;
4610476d	145	int ret = -EOPNOTSUPP;
236df005	146
24de58f4	147	if (info->flags & XT_CT_NOTRACK) {
27e7190e	148	ct = NULL;
24de58f4 PNA	149	goto out;
	150	}
	151
	152	#ifndef CONFIG_NF_CONNTRACK_ZONES
deedb590	153	if (info->zone \|\| info->flags & (XT_CT_ZONE_DIR_ORIG \|
5e8018fc DB	154	XT_CT_ZONE_DIR_REPL \|
5e8018fc DB	155	XT_CT_ZONE_MARK))
24de58f4 PNA	156	goto err1;
	157	#endif
	158
ecb2421b	159	ret = nf_ct_netns_get(par->net, par->family);
24de58f4 PNA	160	if (ret < 0)
	161	goto err1;
	162
308ac914 DB	163	memset(&zone, 0, sizeof(zone));
308ac914 DB	164	zone.id = info->zone;
deedb590	165	zone.dir = xt_ct_flags_to_dir(info);
5e8018fc DB	166	if (info->flags & XT_CT_ZONE_MARK)
5e8018fc DB	167	zone.flags \|= NF_CT_FLAG_MARK;
308ac914 DB	168
308ac914 DB	169	ct = nf_ct_tmpl_alloc(par->net, &zone, GFP_KERNEL);
1a727c63 DC	170	if (!ct) {
1a727c63 DC	171	ret = -ENOMEM;
24de58f4	172	goto err2;
1a727c63	173	}
24de58f4 PNA	174
	175	ret = 0;
	176	if ((info->ct_events \|\| info->exp_events) &&
	177	!nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
14abfa16 EL	178	GFP_KERNEL)) {
14abfa16 EL	179	ret = -EINVAL;
24de58f4	180	goto err3;
14abfa16	181	}
24de58f4 PNA	182
24de58f4 PNA	183	if (info->helper[0]) {
8f4d19aa GF	184	if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
	185	ret = -ENAMETOOLONG;
	186	goto err3;
	187	}
	188
236df005 PNA	189	ret = xt_ct_set_helper(ct, info->helper, par);
236df005 PNA	190	if (ret < 0)
1afc5679	191	goto err3;
24de58f4 PNA	192	}
24de58f4 PNA	193
6cf51852	194	if (info->timeout[0]) {
8f4d19aa GF	195	if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
	196	ret = -ENAMETOOLONG;
	197	goto err4;
	198	}
	199
236df005 PNA	200	ret = xt_ct_set_timeout(ct, par, info->timeout);
236df005 PNA	201	if (ret < 0)
470acf55	202	goto err4;
24de58f4	203	}
0838aa7f PNA	204	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
0838aa7f PNA	205	nf_conntrack_get(&ct->ct_general);
24de58f4 PNA	206	out:
	207	info->ct = ct;
	208	return 0;
	209
470acf55 GF	210	err4:
	211	help = nfct_help(ct);
	212	if (help)
d91fc59c	213	nf_conntrack_helper_put(help->helper);
24de58f4	214	err3:
9cf94eab	215	nf_ct_tmpl_free(ct);
24de58f4	216	err2:
ecb2421b	217	nf_ct_netns_put(par->net, par->family);
24de58f4 PNA	218	err1:
	219	return ret;
	220	}
	221
d52ed437	222	static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
84f3bb9a PM	223	{
84f3bb9a PM	224	struct xt_ct_target_info *info = par->targinfo;
d52ed437 PNA	225	struct xt_ct_target_info_v1 info_v1 = {
	226	.flags = info->flags,
	227	.zone = info->zone,
	228	.ct_events = info->ct_events,
	229	.exp_events = info->exp_events,
	230	};
	231	int ret;
84f3bb9a	232
5474f57f PNA	233	if (info->flags & ~XT_CT_NOTRACK)
	234	return -EINVAL;
	235
d52ed437	236	memcpy(info_v1.helper, info->helper, sizeof(info->helper));
84f3bb9a	237
d52ed437 PNA	238	ret = xt_ct_tg_check(par, &info_v1);
	239	if (ret < 0)
	240	return ret;
	241
	242	info->ct = info_v1.ct;
	243
	244	return ret;
	245	}
	246
	247	static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
	248	{
5474f57f PNA	249	struct xt_ct_target_info_v1 *info = par->targinfo;
	250
	251	if (info->flags & ~XT_CT_NOTRACK)
	252	return -EINVAL;
	253
	254	return xt_ct_tg_check(par, par->targinfo);
	255	}
	256
	257	static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)
	258	{
	259	struct xt_ct_target_info_v1 *info = par->targinfo;
	260
	261	if (info->flags & ~XT_CT_MASK)
	262	return -EINVAL;
	263
d52ed437	264	return xt_ct_tg_check(par, par->targinfo);
84f3bb9a PM	265	}
84f3bb9a PM	266
d52ed437 PNA	267	static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
d52ed437 PNA	268	struct xt_ct_target_info_v1 *info)
236df005	269	{
236df005 PNA	270	struct nf_conn *ct = info->ct;
	271	struct nf_conn_help *help;
	272
cc41c84b	273	if (ct) {
24de58f4 PNA	274	help = nfct_help(ct);
24de58f4 PNA	275	if (help)
d91fc59c	276	nf_conntrack_helper_put(help->helper);
24de58f4	277
ecb2421b	278	nf_ct_netns_put(par->net, par->family);
24de58f4	279
717700d1	280	nf_ct_destroy_timeout(ct);
27e7190e	281	nf_ct_put(info->ct);
24de58f4	282	}
d52ed437 PNA	283	}
	284
	285	static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
	286	{
	287	struct xt_ct_target_info *info = par->targinfo;
	288	struct xt_ct_target_info_v1 info_v1 = {
	289	.flags = info->flags,
	290	.zone = info->zone,
	291	.ct_events = info->ct_events,
	292	.exp_events = info->exp_events,
	293	.ct = info->ct,
	294	};
	295	memcpy(info_v1.helper, info->helper, sizeof(info->helper));
	296
	297	xt_ct_tg_destroy(par, &info_v1);
	298	}
	299
	300	static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
	301	{
	302	xt_ct_tg_destroy(par, par->targinfo);
24de58f4 PNA	303	}
	304
	305	static struct xt_target xt_ct_tg_reg[] __read_mostly = {
	306	{
	307	.name = "CT",
	308	.family = NFPROTO_UNSPEC,
	309	.targetsize = sizeof(struct xt_ct_target_info),
ec231890	310	.usersize = offsetof(struct xt_ct_target_info, ct),
24de58f4 PNA	311	.checkentry = xt_ct_tg_check_v0,
	312	.destroy = xt_ct_tg_destroy_v0,
	313	.target = xt_ct_target_v0,
	314	.table = "raw",
	315	.me = THIS_MODULE,
	316	},
	317	{
	318	.name = "CT",
	319	.family = NFPROTO_UNSPEC,
	320	.revision = 1,
	321	.targetsize = sizeof(struct xt_ct_target_info_v1),
ec231890	322	.usersize = offsetof(struct xt_ct_target_info, ct),
24de58f4 PNA	323	.checkentry = xt_ct_tg_check_v1,
	324	.destroy = xt_ct_tg_destroy_v1,
	325	.target = xt_ct_target_v1,
	326	.table = "raw",
	327	.me = THIS_MODULE,
	328	},
5474f57f PNA	329	{
	330	.name = "CT",
	331	.family = NFPROTO_UNSPEC,
	332	.revision = 2,
	333	.targetsize = sizeof(struct xt_ct_target_info_v1),
ec231890	334	.usersize = offsetof(struct xt_ct_target_info, ct),
5474f57f PNA	335	.checkentry = xt_ct_tg_check_v2,
	336	.destroy = xt_ct_tg_destroy_v1,
	337	.target = xt_ct_target_v1,
	338	.table = "raw",
	339	.me = THIS_MODULE,
	340	},
84f3bb9a PM	341	};
84f3bb9a PM	342
10db9069 PNA	343	static unsigned int
	344	notrack_tg(struct sk_buff skb, const struct xt_action_param par)
	345	{
	346	/* Previously seen (loopback)? Ignore. */
a9e419dc	347	if (skb->_nfct != 0)
10db9069 PNA	348	return XT_CONTINUE;
10db9069 PNA	349
cc41c84b	350	nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
10db9069 PNA	351
	352	return XT_CONTINUE;
	353	}
	354
	355	static int notrack_chk(const struct xt_tgchk_param *par)
	356	{
	357	if (!par->net->xt.notrack_deprecated_warning) {
	358	pr_info("netfilter: NOTRACK target is deprecated, "
	359	"use CT instead or upgrade iptables\n");
	360	par->net->xt.notrack_deprecated_warning = true;
	361	}
	362	return 0;
	363	}
	364
	365	static struct xt_target notrack_tg_reg __read_mostly = {
	366	.name = "NOTRACK",
	367	.revision = 0,
	368	.family = NFPROTO_UNSPEC,
	369	.checkentry = notrack_chk,
	370	.target = notrack_tg,
	371	.table = "raw",
	372	.me = THIS_MODULE,
	373	};
	374
84f3bb9a PM	375	static int __init xt_ct_tg_init(void)
84f3bb9a PM	376	{
10db9069 PNA	377	int ret;
	378
	379	ret = xt_register_target(&notrack_tg_reg);
	380	if (ret < 0)
	381	return ret;
	382
	383	ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
	384	if (ret < 0) {
	385	xt_unregister_target(&notrack_tg_reg);
	386	return ret;
	387	}
	388	return 0;
84f3bb9a PM	389	}
	390
	391	static void __exit xt_ct_tg_exit(void)
	392	{
24de58f4	393	xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
10db9069	394	xt_unregister_target(&notrack_tg_reg);
84f3bb9a PM	395	}
	396
	397	module_init(xt_ct_tg_init);
	398	module_exit(xt_ct_tg_exit);
	399
	400	MODULE_LICENSE("GPL");
	401	MODULE_DESCRIPTION("Xtables: connection tracking target");
	402	MODULE_ALIAS("ipt_CT");
	403	MODULE_ALIAS("ip6t_CT");
10db9069 PNA	404	MODULE_ALIAS("ipt_NOTRACK");
10db9069 PNA	405	MODULE_ALIAS("ip6t_NOTRACK");