[mirror_ubuntu-bionic-kernel.git] / net / netfilter / xt_connlabel.c

/*
 * (C) 2013 Astaro GmbH & Co KG
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_labels.h>
#include <linux/netfilter/x_tables.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
MODULE_DESCRIPTION("Xtables: add/match connection trackling labels");
MODULE_ALIAS("ipt_connlabel");
MODULE_ALIAS("ip6t_connlabel");

static bool connlabel_match(const struct nf_conn *ct, u16 bit)
{
	struct nf_conn_labels *labels = nf_ct_labels_find(ct);

	if (!labels)
		return false;

	return test_bit(bit, labels->bits);
}

static bool
connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_connlabel_mtinfo *info = par->matchinfo;
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;
	bool invert = info->options & XT_CONNLABEL_OP_INVERT;

	ct = nf_ct_get(skb, &ctinfo);
	if (ct == NULL || nf_ct_is_untracked(ct))
		return invert;

	if (info->options & XT_CONNLABEL_OP_SET)
		return (nf_connlabel_set(ct, info->bit) == 0) ^ invert;

	return connlabel_match(ct, info->bit) ^ invert;
}

static int connlabel_mt_check(const struct xt_mtchk_param *par)
{
	const int options = XT_CONNLABEL_OP_INVERT |
			    XT_CONNLABEL_OP_SET;
	struct xt_connlabel_mtinfo *info = par->matchinfo;
	int ret;

	if (info->options & ~options) {
		pr_err("Unknown options in mask %x\n", info->options);
		return -EINVAL;
	}

	ret = nf_ct_l3proto_try_module_get(par->family);
	if (ret < 0) {
		pr_info("cannot load conntrack support for proto=%u\n",
							par->family);
		return ret;
	}

	ret = nf_connlabels_get(par->net, info->bit);
	if (ret < 0)
		nf_ct_l3proto_module_put(par->family);
	return ret;
}

static void connlabel_mt_destroy(const struct xt_mtdtor_param *par)
{
	nf_connlabels_put(par->net);
	nf_ct_l3proto_module_put(par->family);
}

static struct xt_match connlabels_mt_reg __read_mostly = {
	.name           = "connlabel",
	.family         = NFPROTO_UNSPEC,
	.checkentry     = connlabel_mt_check,
	.match          = connlabel_mt,
	.matchsize      = sizeof(struct xt_connlabel_mtinfo),
	.destroy        = connlabel_mt_destroy,
	.me             = THIS_MODULE,
};

static int __init connlabel_mt_init(void)
{
	return xt_register_match(&connlabels_mt_reg);
}

static void __exit connlabel_mt_exit(void)
{
	xt_unregister_match(&connlabels_mt_reg);
}

module_init(connlabel_mt_init);
module_exit(connlabel_mt_exit);
Commit	Line	Data
c539f017 FW	1	/*
	2	* (C) 2013 Astaro GmbH & Co KG
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
	8
	9	#include <linux/module.h>
	10	#include <linux/skbuff.h>
	11	#include <net/netfilter/nf_conntrack.h>
	12	#include <net/netfilter/nf_conntrack_labels.h>
	13	#include <linux/netfilter/x_tables.h>
	14
	15	MODULE_LICENSE("GPL");
	16	MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
	17	MODULE_DESCRIPTION("Xtables: add/match connection trackling labels");
	18	MODULE_ALIAS("ipt_connlabel");
	19	MODULE_ALIAS("ip6t_connlabel");
	20
b4ef1599 FW	21	static bool connlabel_match(const struct nf_conn *ct, u16 bit)
	22	{
	23	struct nf_conn_labels *labels = nf_ct_labels_find(ct);
	24
	25	if (!labels)
	26	return false;
	27
23014011	28	return test_bit(bit, labels->bits);
b4ef1599 FW	29	}
b4ef1599 FW	30
c539f017 FW	31	static bool
	32	connlabel_mt(const struct sk_buff skb, struct xt_action_param par)
	33	{
	34	const struct xt_connlabel_mtinfo *info = par->matchinfo;
	35	enum ip_conntrack_info ctinfo;
	36	struct nf_conn *ct;
	37	bool invert = info->options & XT_CONNLABEL_OP_INVERT;
	38
	39	ct = nf_ct_get(skb, &ctinfo);
	40	if (ct == NULL \|\| nf_ct_is_untracked(ct))
	41	return invert;
	42
	43	if (info->options & XT_CONNLABEL_OP_SET)
	44	return (nf_connlabel_set(ct, info->bit) == 0) ^ invert;
	45
b4ef1599	46	return connlabel_match(ct, info->bit) ^ invert;
c539f017 FW	47	}
	48
	49	static int connlabel_mt_check(const struct xt_mtchk_param *par)
	50	{
	51	const int options = XT_CONNLABEL_OP_INVERT \|
	52	XT_CONNLABEL_OP_SET;
	53	struct xt_connlabel_mtinfo *info = par->matchinfo;
	54	int ret;
c539f017 FW	55
	56	if (info->options & ~options) {
	57	pr_err("Unknown options in mask %x\n", info->options);
	58	return -EINVAL;
	59	}
	60
	61	ret = nf_ct_l3proto_try_module_get(par->family);
	62	if (ret < 0) {
	63	pr_info("cannot load conntrack support for proto=%u\n",
	64	par->family);
	65	return ret;
	66	}
	67
adff6c65	68	ret = nf_connlabels_get(par->net, info->bit);
86ca02e7 JS	69	if (ret < 0)
86ca02e7 JS	70	nf_ct_l3proto_module_put(par->family);
c539f017 FW	71	return ret;
	72	}
	73
	74	static void connlabel_mt_destroy(const struct xt_mtdtor_param *par)
	75	{
86ca02e7	76	nf_connlabels_put(par->net);
c539f017 FW	77	nf_ct_l3proto_module_put(par->family);
	78	}
	79
	80	static struct xt_match connlabels_mt_reg __read_mostly = {
	81	.name = "connlabel",
	82	.family = NFPROTO_UNSPEC,
	83	.checkentry = connlabel_mt_check,
	84	.match = connlabel_mt,
	85	.matchsize = sizeof(struct xt_connlabel_mtinfo),
	86	.destroy = connlabel_mt_destroy,
	87	.me = THIS_MODULE,
	88	};
	89
	90	static int __init connlabel_mt_init(void)
	91	{
	92	return xt_register_match(&connlabels_mt_reg);
	93	}
	94
	95	static void __exit connlabel_mt_exit(void)
	96	{
	97	xt_unregister_match(&connlabels_mt_reg);
	98	}
	99
	100	module_init(connlabel_mt_init);
	101	module_exit(connlabel_mt_exit);