]>
Commit | Line | Data |
---|---|---|
84f3bb9a PM |
1 | /* |
2 | * Copyright (c) 2010 Patrick McHardy <kaber@trash.net> | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License version 2 as | |
6 | * published by the Free Software Foundation. | |
7 | */ | |
8 | ||
9 | #include <linux/module.h> | |
10 | #include <linux/skbuff.h> | |
11 | #include <linux/selinux.h> | |
12 | #include <linux/netfilter_ipv4/ip_tables.h> | |
13 | #include <linux/netfilter_ipv6/ip6_tables.h> | |
14 | #include <linux/netfilter/x_tables.h> | |
15 | #include <linux/netfilter/xt_CT.h> | |
16 | #include <net/netfilter/nf_conntrack.h> | |
17 | #include <net/netfilter/nf_conntrack_helper.h> | |
18 | #include <net/netfilter/nf_conntrack_ecache.h> | |
5d0aa2cc | 19 | #include <net/netfilter/nf_conntrack_zones.h> |
84f3bb9a PM |
20 | |
21 | static unsigned int xt_ct_target(struct sk_buff *skb, | |
22 | const struct xt_target_param *par) | |
23 | { | |
24 | const struct xt_ct_target_info *info = par->targinfo; | |
25 | struct nf_conn *ct = info->ct; | |
26 | ||
27 | /* Previously seen (loopback)? Ignore. */ | |
28 | if (skb->nfct != NULL) | |
29 | return XT_CONTINUE; | |
30 | ||
31 | atomic_inc(&ct->ct_general.use); | |
32 | skb->nfct = &ct->ct_general; | |
33 | skb->nfctinfo = IP_CT_NEW; | |
34 | ||
35 | return XT_CONTINUE; | |
36 | } | |
37 | ||
38 | static u8 xt_ct_find_proto(const struct xt_tgchk_param *par) | |
39 | { | |
40 | if (par->family == AF_INET) { | |
41 | const struct ipt_entry *e = par->entryinfo; | |
42 | ||
43 | if (e->ip.invflags & IPT_INV_PROTO) | |
44 | return 0; | |
45 | return e->ip.proto; | |
46 | } else if (par->family == AF_INET6) { | |
47 | const struct ip6t_entry *e = par->entryinfo; | |
48 | ||
49 | if (e->ipv6.invflags & IP6T_INV_PROTO) | |
50 | return 0; | |
51 | return e->ipv6.proto; | |
52 | } else | |
53 | return 0; | |
54 | } | |
55 | ||
56 | static bool xt_ct_tg_check(const struct xt_tgchk_param *par) | |
57 | { | |
58 | struct xt_ct_target_info *info = par->targinfo; | |
59 | struct nf_conntrack_tuple t; | |
60 | struct nf_conn_help *help; | |
61 | struct nf_conn *ct; | |
62 | u8 proto; | |
63 | ||
64 | if (info->flags & ~XT_CT_NOTRACK) | |
65 | return false; | |
66 | ||
67 | if (info->flags & XT_CT_NOTRACK) { | |
68 | ct = &nf_conntrack_untracked; | |
69 | atomic_inc(&ct->ct_general.use); | |
70 | goto out; | |
71 | } | |
72 | ||
5d0aa2cc PM |
73 | #ifndef CONFIG_NF_CONNTRACK_ZONES |
74 | if (info->zone) | |
75 | goto err1; | |
76 | #endif | |
77 | ||
84f3bb9a PM |
78 | if (nf_ct_l3proto_try_module_get(par->family) < 0) |
79 | goto err1; | |
80 | ||
81 | memset(&t, 0, sizeof(t)); | |
5d0aa2cc | 82 | ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL); |
84f3bb9a PM |
83 | if (IS_ERR(ct)) |
84 | goto err2; | |
85 | ||
86 | if ((info->ct_events || info->exp_events) && | |
87 | !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events, | |
88 | GFP_KERNEL)) | |
89 | goto err3; | |
90 | ||
91 | if (info->helper[0]) { | |
92 | proto = xt_ct_find_proto(par); | |
93 | if (!proto) | |
94 | goto err3; | |
95 | ||
96 | help = nf_ct_helper_ext_add(ct, GFP_KERNEL); | |
97 | if (help == NULL) | |
98 | goto err3; | |
99 | ||
100 | help->helper = nf_conntrack_helper_try_module_get(info->helper, | |
101 | par->family, | |
102 | proto); | |
103 | if (help->helper == NULL) | |
104 | goto err3; | |
105 | } | |
106 | ||
107 | __set_bit(IPS_TEMPLATE_BIT, &ct->status); | |
108 | __set_bit(IPS_CONFIRMED_BIT, &ct->status); | |
109 | out: | |
110 | info->ct = ct; | |
111 | return true; | |
112 | ||
113 | err3: | |
114 | nf_conntrack_free(ct); | |
115 | err2: | |
116 | nf_ct_l3proto_module_put(par->family); | |
117 | err1: | |
118 | return false; | |
119 | } | |
120 | ||
121 | static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par) | |
122 | { | |
123 | struct xt_ct_target_info *info = par->targinfo; | |
124 | struct nf_conn *ct = info->ct; | |
125 | struct nf_conn_help *help; | |
126 | ||
127 | if (ct != &nf_conntrack_untracked) { | |
128 | help = nfct_help(ct); | |
129 | if (help) | |
130 | module_put(help->helper->me); | |
131 | ||
132 | nf_ct_l3proto_module_put(par->family); | |
133 | } | |
134 | nf_ct_put(info->ct); | |
135 | } | |
136 | ||
137 | static struct xt_target xt_ct_tg __read_mostly = { | |
138 | .name = "CT", | |
139 | .family = NFPROTO_UNSPEC, | |
140 | .targetsize = XT_ALIGN(sizeof(struct xt_ct_target_info)), | |
141 | .checkentry = xt_ct_tg_check, | |
142 | .destroy = xt_ct_tg_destroy, | |
143 | .target = xt_ct_target, | |
144 | .table = "raw", | |
145 | .me = THIS_MODULE, | |
146 | }; | |
147 | ||
148 | static int __init xt_ct_tg_init(void) | |
149 | { | |
150 | return xt_register_target(&xt_ct_tg); | |
151 | } | |
152 | ||
153 | static void __exit xt_ct_tg_exit(void) | |
154 | { | |
155 | xt_unregister_target(&xt_ct_tg); | |
156 | } | |
157 | ||
158 | module_init(xt_ct_tg_init); | |
159 | module_exit(xt_ct_tg_exit); | |
160 | ||
161 | MODULE_LICENSE("GPL"); | |
162 | MODULE_DESCRIPTION("Xtables: connection tracking target"); | |
163 | MODULE_ALIAS("ipt_CT"); | |
164 | MODULE_ALIAS("ip6t_CT"); |