1 /* This kernel module is used to modify the connection mark values, or
2 * to optionally restore the skb nfmark from the connection mark
4 * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
5 * by Henrik Nordstrom <hno@marasystems.com>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 #include <linux/module.h>
22 #include <linux/skbuff.h>
24 #include <net/checksum.h>
26 MODULE_AUTHOR("Henrik Nordstrom <hno@marasystems.com>");
27 MODULE_DESCRIPTION("IP tables CONNMARK matching module");
28 MODULE_LICENSE("GPL");
29 MODULE_ALIAS("ipt_CONNMARK");
30 MODULE_ALIAS("ip6t_CONNMARK");
32 #include <linux/netfilter/x_tables.h>
33 #include <linux/netfilter/xt_CONNMARK.h>
34 #include <net/netfilter/nf_conntrack_ecache.h>
37 connmark_tg(struct sk_buff
*skb
, const struct net_device
*in
,
38 const struct net_device
*out
, unsigned int hooknum
,
39 const struct xt_target
*target
, const void *targinfo
)
41 const struct xt_connmark_target_info
*markinfo
= targinfo
;
43 enum ip_conntrack_info ctinfo
;
48 ct
= nf_ct_get(skb
, &ctinfo
);
50 switch(markinfo
->mode
) {
52 newmark
= (ct
->mark
& ~markinfo
->mask
) | markinfo
->mark
;
53 if (newmark
!= ct
->mark
) {
55 nf_conntrack_event_cache(IPCT_MARK
, skb
);
58 case XT_CONNMARK_SAVE
:
59 newmark
= (ct
->mark
& ~markinfo
->mask
) |
60 (skb
->mark
& markinfo
->mask
);
61 if (ct
->mark
!= newmark
) {
63 nf_conntrack_event_cache(IPCT_MARK
, skb
);
66 case XT_CONNMARK_RESTORE
:
68 diff
= (ct
->mark
^ mark
) & markinfo
->mask
;
69 skb
->mark
= mark
^ diff
;
78 connmark_tg_check(const char *tablename
, const void *entry
,
79 const struct xt_target
*target
, void *targinfo
,
80 unsigned int hook_mask
)
82 const struct xt_connmark_target_info
*matchinfo
= targinfo
;
84 if (matchinfo
->mode
== XT_CONNMARK_RESTORE
) {
85 if (strcmp(tablename
, "mangle") != 0) {
86 printk(KERN_WARNING
"CONNMARK: restore can only be "
87 "called from \"mangle\" table, not \"%s\"\n",
92 if (matchinfo
->mark
> 0xffffffff || matchinfo
->mask
> 0xffffffff) {
93 printk(KERN_WARNING
"CONNMARK: Only supports 32bit mark\n");
96 if (nf_ct_l3proto_try_module_get(target
->family
) < 0) {
97 printk(KERN_WARNING
"can't load conntrack support for "
98 "proto=%d\n", target
->family
);
105 connmark_tg_destroy(const struct xt_target
*target
, void *targinfo
)
107 nf_ct_l3proto_module_put(target
->family
);
111 struct compat_xt_connmark_target_info
{
112 compat_ulong_t mark
, mask
;
118 static void connmark_tg_compat_from_user(void *dst
, void *src
)
120 const struct compat_xt_connmark_target_info
*cm
= src
;
121 struct xt_connmark_target_info m
= {
126 memcpy(dst
, &m
, sizeof(m
));
129 static int connmark_tg_compat_to_user(void __user
*dst
, void *src
)
131 const struct xt_connmark_target_info
*m
= src
;
132 struct compat_xt_connmark_target_info cm
= {
137 return copy_to_user(dst
, &cm
, sizeof(cm
)) ? -EFAULT
: 0;
139 #endif /* CONFIG_COMPAT */
141 static struct xt_target connmark_tg_reg
[] __read_mostly
= {
145 .checkentry
= connmark_tg_check
,
146 .destroy
= connmark_tg_destroy
,
147 .target
= connmark_tg
,
148 .targetsize
= sizeof(struct xt_connmark_target_info
),
150 .compatsize
= sizeof(struct compat_xt_connmark_target_info
),
151 .compat_from_user
= connmark_tg_compat_from_user
,
152 .compat_to_user
= connmark_tg_compat_to_user
,
159 .checkentry
= connmark_tg_check
,
160 .destroy
= connmark_tg_destroy
,
161 .target
= connmark_tg
,
162 .targetsize
= sizeof(struct xt_connmark_target_info
),
164 .compatsize
= sizeof(struct compat_xt_connmark_target_info
),
165 .compat_from_user
= connmark_tg_compat_from_user
,
166 .compat_to_user
= connmark_tg_compat_to_user
,
172 static int __init
connmark_tg_init(void)
174 return xt_register_targets(connmark_tg_reg
,
175 ARRAY_SIZE(connmark_tg_reg
));
178 static void __exit
connmark_tg_exit(void)
180 xt_unregister_targets(connmark_tg_reg
, ARRAY_SIZE(connmark_tg_reg
));
183 module_init(connmark_tg_init
);
184 module_exit(connmark_tg_exit
);