[mirror_ubuntu-artful-kernel.git] / net / netfilter / xt_state.c

/* Kernel module to match connection tracking information. */

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2005 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/netfilter/nf_conntrack.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_state.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
MODULE_DESCRIPTION("ip[6]_tables connection tracking state match module");
MODULE_ALIAS("ipt_state");
MODULE_ALIAS("ip6t_state");

static bool
state_mt(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct xt_state_info *sinfo = par->matchinfo;
	enum ip_conntrack_info ctinfo;
	unsigned int statebit;

	if (nf_ct_is_untracked(skb))
		statebit = XT_STATE_UNTRACKED;
	else if (!nf_ct_get(skb, &ctinfo))
		statebit = XT_STATE_INVALID;
	else
		statebit = XT_STATE_BIT(ctinfo);

	return (sinfo->statemask & statebit);
}

static int state_mt_check(const struct xt_mtchk_param *par)
{
	int ret;

	ret = nf_ct_l3proto_try_module_get(par->family);
	if (ret < 0)
		pr_info("cannot load conntrack support for proto=%u\n",
			par->family);
	return ret;
}

static void state_mt_destroy(const struct xt_mtdtor_param *par)
{
	nf_ct_l3proto_module_put(par->family);
}

static struct xt_match state_mt_reg[] __read_mostly = {
	{
		.name		= "state",
		.family		= NFPROTO_IPV4,
		.checkentry	= state_mt_check,
		.match		= state_mt,
		.destroy	= state_mt_destroy,
		.matchsize	= sizeof(struct xt_state_info),
		.me		= THIS_MODULE,
	},
	{
		.name		= "state",
		.family		= NFPROTO_IPV6,
		.checkentry	= state_mt_check,
		.match		= state_mt,
		.destroy	= state_mt_destroy,
		.matchsize	= sizeof(struct xt_state_info),
		.me		= THIS_MODULE,
	},
};

static int __init state_mt_init(void)
{
	return xt_register_matches(state_mt_reg, ARRAY_SIZE(state_mt_reg));
}

static void __exit state_mt_exit(void)
{
	xt_unregister_matches(state_mt_reg, ARRAY_SIZE(state_mt_reg));
}

module_init(state_mt_init);
module_exit(state_mt_exit);
Commit	Line	Data
1da177e4 LT	1	/* Kernel module to match connection tracking information. */
	2
	3	/* (C) 1999-2001 Paul `Rusty' Russell
2e4e6a17	4	* (C) 2002-2005 Netfilter Core Team <coreteam@netfilter.org>
1da177e4 LT	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
	11	#include <linux/module.h>
	12	#include <linux/skbuff.h>
587aa641	13	#include <net/netfilter/nf_conntrack.h>
2e4e6a17 HW	14	#include <linux/netfilter/x_tables.h>
2e4e6a17 HW	15	#include <linux/netfilter/xt_state.h>
1da177e4 LT	16
	17	MODULE_LICENSE("GPL");
	18	MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
2e4e6a17 HW	19	MODULE_DESCRIPTION("ip[6]_tables connection tracking state match module");
	20	MODULE_ALIAS("ipt_state");
	21	MODULE_ALIAS("ip6t_state");
1da177e4	22
1d93a9cb	23	static bool
f7108a20	24	state_mt(const struct sk_buff skb, const struct xt_match_param par)
1da177e4	25	{
f7108a20	26	const struct xt_state_info *sinfo = par->matchinfo;
1da177e4 LT	27	enum ip_conntrack_info ctinfo;
	28	unsigned int statebit;
	29
9fb9cbb1	30	if (nf_ct_is_untracked(skb))
2e4e6a17	31	statebit = XT_STATE_UNTRACKED;
587aa641	32	else if (!nf_ct_get(skb, &ctinfo))
2e4e6a17	33	statebit = XT_STATE_INVALID;
1da177e4	34	else
2e4e6a17	35	statebit = XT_STATE_BIT(ctinfo);
1da177e4 LT	36
	37	return (sinfo->statemask & statebit);
	38	}
	39
b0f38452	40	static int state_mt_check(const struct xt_mtchk_param *par)
b9f78f9f	41	{
4a5a5c73 JE	42	int ret;
	43
	44	ret = nf_ct_l3proto_try_module_get(par->family);
f95c74e3	45	if (ret < 0)
8bee4bad JE	46	pr_info("cannot load conntrack support for proto=%u\n",
8bee4bad JE	47	par->family);
f95c74e3	48	return ret;
b9f78f9f PNA	49	}
b9f78f9f PNA	50
6be3d859	51	static void state_mt_destroy(const struct xt_mtdtor_param *par)
b9f78f9f	52	{
aa5fa318	53	nf_ct_l3proto_module_put(par->family);
b9f78f9f PNA	54	}
b9f78f9f PNA	55
d3c5ee6d	56	static struct xt_match state_mt_reg[] __read_mostly = {
4470bbc7 PM	57	{
4470bbc7 PM	58	.name = "state",
ee999d8b	59	.family = NFPROTO_IPV4,
d3c5ee6d JE	60	.checkentry = state_mt_check,
	61	.match = state_mt,
	62	.destroy = state_mt_destroy,
4470bbc7 PM	63	.matchsize = sizeof(struct xt_state_info),
	64	.me = THIS_MODULE,
	65	},
	66	{
	67	.name = "state",
ee999d8b	68	.family = NFPROTO_IPV6,
d3c5ee6d JE	69	.checkentry = state_mt_check,
	70	.match = state_mt,
	71	.destroy = state_mt_destroy,
4470bbc7 PM	72	.matchsize = sizeof(struct xt_state_info),
	73	.me = THIS_MODULE,
	74	},
1da177e4 LT	75	};
1da177e4 LT	76
d3c5ee6d	77	static int __init state_mt_init(void)
1da177e4	78	{
d3c5ee6d	79	return xt_register_matches(state_mt_reg, ARRAY_SIZE(state_mt_reg));
1da177e4 LT	80	}
1da177e4 LT	81
d3c5ee6d	82	static void __exit state_mt_exit(void)
1da177e4	83	{
d3c5ee6d	84	xt_unregister_matches(state_mt_reg, ARRAY_SIZE(state_mt_reg));
1da177e4 LT	85	}
1da177e4 LT	86
d3c5ee6d JE	87	module_init(state_mt_init);
d3c5ee6d JE	88	module_exit(state_mt_exit);