2 * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9 #include <linux/module.h>
10 #include <linux/gfp.h>
11 #include <linux/skbuff.h>
12 #include <linux/netfilter_ipv4/ip_tables.h>
13 #include <linux/netfilter_ipv6/ip6_tables.h>
14 #include <linux/netfilter/x_tables.h>
15 #include <linux/netfilter/xt_CT.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_l4proto.h>
18 #include <net/netfilter/nf_conntrack_helper.h>
19 #include <net/netfilter/nf_conntrack_ecache.h>
20 #include <net/netfilter/nf_conntrack_timeout.h>
21 #include <net/netfilter/nf_conntrack_zones.h>
23 static inline int xt_ct_target(struct sk_buff
*skb
, struct nf_conn
*ct
)
25 /* Previously seen (loopback)? Ignore. */
29 /* special case the untracked ct : we want the percpu object */
31 ct
= nf_ct_untracked_get();
32 atomic_inc(&ct
->ct_general
.use
);
33 nf_ct_set(skb
, ct
, IP_CT_NEW
);
38 static unsigned int xt_ct_target_v0(struct sk_buff
*skb
,
39 const struct xt_action_param
*par
)
41 const struct xt_ct_target_info
*info
= par
->targinfo
;
42 struct nf_conn
*ct
= info
->ct
;
44 return xt_ct_target(skb
, ct
);
47 static unsigned int xt_ct_target_v1(struct sk_buff
*skb
,
48 const struct xt_action_param
*par
)
50 const struct xt_ct_target_info_v1
*info
= par
->targinfo
;
51 struct nf_conn
*ct
= info
->ct
;
53 return xt_ct_target(skb
, ct
);
56 static u8
xt_ct_find_proto(const struct xt_tgchk_param
*par
)
58 if (par
->family
== NFPROTO_IPV4
) {
59 const struct ipt_entry
*e
= par
->entryinfo
;
61 if (e
->ip
.invflags
& IPT_INV_PROTO
)
64 } else if (par
->family
== NFPROTO_IPV6
) {
65 const struct ip6t_entry
*e
= par
->entryinfo
;
67 if (e
->ipv6
.invflags
& IP6T_INV_PROTO
)
75 xt_ct_set_helper(struct nf_conn
*ct
, const char *helper_name
,
76 const struct xt_tgchk_param
*par
)
78 struct nf_conntrack_helper
*helper
;
79 struct nf_conn_help
*help
;
82 proto
= xt_ct_find_proto(par
);
84 pr_info("You must specify a L4 protocol, and not use "
85 "inversions on it.\n");
89 helper
= nf_conntrack_helper_try_module_get(helper_name
, par
->family
,
92 pr_info("No such helper \"%s\"\n", helper_name
);
96 help
= nf_ct_helper_ext_add(ct
, helper
, GFP_KERNEL
);
98 module_put(helper
->me
);
102 help
->helper
= helper
;
106 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
107 static void __xt_ct_tg_timeout_put(struct ctnl_timeout
*timeout
)
109 typeof(nf_ct_timeout_put_hook
) timeout_put
;
111 timeout_put
= rcu_dereference(nf_ct_timeout_put_hook
);
113 timeout_put(timeout
);
118 xt_ct_set_timeout(struct nf_conn
*ct
, const struct xt_tgchk_param
*par
,
119 const char *timeout_name
)
121 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
122 typeof(nf_ct_timeout_find_get_hook
) timeout_find_get
;
123 struct ctnl_timeout
*timeout
;
124 struct nf_conn_timeout
*timeout_ext
;
125 struct nf_conntrack_l4proto
*l4proto
;
130 timeout_find_get
= rcu_dereference(nf_ct_timeout_find_get_hook
);
131 if (timeout_find_get
== NULL
) {
133 pr_info("Timeout policy base is empty\n");
137 proto
= xt_ct_find_proto(par
);
140 pr_info("You must specify a L4 protocol, and not use "
141 "inversions on it.\n");
145 timeout
= timeout_find_get(par
->net
, timeout_name
);
146 if (timeout
== NULL
) {
148 pr_info("No such timeout policy \"%s\"\n", timeout_name
);
152 if (timeout
->l3num
!= par
->family
) {
154 pr_info("Timeout policy `%s' can only be used by L3 protocol "
155 "number %d\n", timeout_name
, timeout
->l3num
);
156 goto err_put_timeout
;
158 /* Make sure the timeout policy matches any existing protocol tracker,
159 * otherwise default to generic.
161 l4proto
= __nf_ct_l4proto_find(par
->family
, proto
);
162 if (timeout
->l4proto
->l4proto
!= l4proto
->l4proto
) {
164 pr_info("Timeout policy `%s' can only be used by L4 protocol "
166 timeout_name
, timeout
->l4proto
->l4proto
);
167 goto err_put_timeout
;
169 timeout_ext
= nf_ct_timeout_ext_add(ct
, timeout
, GFP_ATOMIC
);
170 if (timeout_ext
== NULL
)
177 __xt_ct_tg_timeout_put(timeout
);
186 static u16
xt_ct_flags_to_dir(const struct xt_ct_target_info_v1
*info
)
188 switch (info
->flags
& (XT_CT_ZONE_DIR_ORIG
|
189 XT_CT_ZONE_DIR_REPL
)) {
190 case XT_CT_ZONE_DIR_ORIG
:
191 return NF_CT_ZONE_DIR_ORIG
;
192 case XT_CT_ZONE_DIR_REPL
:
193 return NF_CT_ZONE_DIR_REPL
;
195 return NF_CT_DEFAULT_ZONE_DIR
;
199 static int xt_ct_tg_check(const struct xt_tgchk_param
*par
,
200 struct xt_ct_target_info_v1
*info
)
202 struct nf_conntrack_zone zone
;
204 int ret
= -EOPNOTSUPP
;
206 if (info
->flags
& XT_CT_NOTRACK
) {
211 #ifndef CONFIG_NF_CONNTRACK_ZONES
212 if (info
->zone
|| info
->flags
& (XT_CT_ZONE_DIR_ORIG
|
213 XT_CT_ZONE_DIR_REPL
|
218 ret
= nf_ct_netns_get(par
->net
, par
->family
);
222 memset(&zone
, 0, sizeof(zone
));
223 zone
.id
= info
->zone
;
224 zone
.dir
= xt_ct_flags_to_dir(info
);
225 if (info
->flags
& XT_CT_ZONE_MARK
)
226 zone
.flags
|= NF_CT_FLAG_MARK
;
228 ct
= nf_ct_tmpl_alloc(par
->net
, &zone
, GFP_KERNEL
);
235 if ((info
->ct_events
|| info
->exp_events
) &&
236 !nf_ct_ecache_ext_add(ct
, info
->ct_events
, info
->exp_events
,
242 if (info
->helper
[0]) {
243 ret
= xt_ct_set_helper(ct
, info
->helper
, par
);
248 if (info
->timeout
[0]) {
249 ret
= xt_ct_set_timeout(ct
, par
, info
->timeout
);
253 __set_bit(IPS_CONFIRMED_BIT
, &ct
->status
);
254 nf_conntrack_get(&ct
->ct_general
);
262 nf_ct_netns_put(par
->net
, par
->family
);
267 static int xt_ct_tg_check_v0(const struct xt_tgchk_param
*par
)
269 struct xt_ct_target_info
*info
= par
->targinfo
;
270 struct xt_ct_target_info_v1 info_v1
= {
271 .flags
= info
->flags
,
273 .ct_events
= info
->ct_events
,
274 .exp_events
= info
->exp_events
,
278 if (info
->flags
& ~XT_CT_NOTRACK
)
281 memcpy(info_v1
.helper
, info
->helper
, sizeof(info
->helper
));
283 ret
= xt_ct_tg_check(par
, &info_v1
);
287 info
->ct
= info_v1
.ct
;
292 static int xt_ct_tg_check_v1(const struct xt_tgchk_param
*par
)
294 struct xt_ct_target_info_v1
*info
= par
->targinfo
;
296 if (info
->flags
& ~XT_CT_NOTRACK
)
299 return xt_ct_tg_check(par
, par
->targinfo
);
302 static int xt_ct_tg_check_v2(const struct xt_tgchk_param
*par
)
304 struct xt_ct_target_info_v1
*info
= par
->targinfo
;
306 if (info
->flags
& ~XT_CT_MASK
)
309 return xt_ct_tg_check(par
, par
->targinfo
);
312 static void xt_ct_destroy_timeout(struct nf_conn
*ct
)
314 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
315 struct nf_conn_timeout
*timeout_ext
;
316 typeof(nf_ct_timeout_put_hook
) timeout_put
;
319 timeout_put
= rcu_dereference(nf_ct_timeout_put_hook
);
322 timeout_ext
= nf_ct_timeout_find(ct
);
324 timeout_put(timeout_ext
->timeout
);
325 RCU_INIT_POINTER(timeout_ext
->timeout
, NULL
);
332 static void xt_ct_tg_destroy(const struct xt_tgdtor_param
*par
,
333 struct xt_ct_target_info_v1
*info
)
335 struct nf_conn
*ct
= info
->ct
;
336 struct nf_conn_help
*help
;
338 if (ct
&& !nf_ct_is_untracked(ct
)) {
339 help
= nfct_help(ct
);
341 module_put(help
->helper
->me
);
343 nf_ct_netns_put(par
->net
, par
->family
);
345 xt_ct_destroy_timeout(ct
);
350 static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param
*par
)
352 struct xt_ct_target_info
*info
= par
->targinfo
;
353 struct xt_ct_target_info_v1 info_v1
= {
354 .flags
= info
->flags
,
356 .ct_events
= info
->ct_events
,
357 .exp_events
= info
->exp_events
,
360 memcpy(info_v1
.helper
, info
->helper
, sizeof(info
->helper
));
362 xt_ct_tg_destroy(par
, &info_v1
);
365 static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param
*par
)
367 xt_ct_tg_destroy(par
, par
->targinfo
);
370 static struct xt_target xt_ct_tg_reg
[] __read_mostly
= {
373 .family
= NFPROTO_UNSPEC
,
374 .targetsize
= sizeof(struct xt_ct_target_info
),
375 .usersize
= offsetof(struct xt_ct_target_info
, ct
),
376 .checkentry
= xt_ct_tg_check_v0
,
377 .destroy
= xt_ct_tg_destroy_v0
,
378 .target
= xt_ct_target_v0
,
384 .family
= NFPROTO_UNSPEC
,
386 .targetsize
= sizeof(struct xt_ct_target_info_v1
),
387 .usersize
= offsetof(struct xt_ct_target_info
, ct
),
388 .checkentry
= xt_ct_tg_check_v1
,
389 .destroy
= xt_ct_tg_destroy_v1
,
390 .target
= xt_ct_target_v1
,
396 .family
= NFPROTO_UNSPEC
,
398 .targetsize
= sizeof(struct xt_ct_target_info_v1
),
399 .usersize
= offsetof(struct xt_ct_target_info
, ct
),
400 .checkentry
= xt_ct_tg_check_v2
,
401 .destroy
= xt_ct_tg_destroy_v1
,
402 .target
= xt_ct_target_v1
,
409 notrack_tg(struct sk_buff
*skb
, const struct xt_action_param
*par
)
411 /* Previously seen (loopback)? Ignore. */
415 nf_ct_set(skb
, nf_ct_untracked_get(), IP_CT_NEW
);
416 nf_conntrack_get(skb_nfct(skb
));
421 static int notrack_chk(const struct xt_tgchk_param
*par
)
423 if (!par
->net
->xt
.notrack_deprecated_warning
) {
424 pr_info("netfilter: NOTRACK target is deprecated, "
425 "use CT instead or upgrade iptables\n");
426 par
->net
->xt
.notrack_deprecated_warning
= true;
431 static struct xt_target notrack_tg_reg __read_mostly
= {
434 .family
= NFPROTO_UNSPEC
,
435 .checkentry
= notrack_chk
,
436 .target
= notrack_tg
,
441 static int __init
xt_ct_tg_init(void)
445 ret
= xt_register_target(¬rack_tg_reg
);
449 ret
= xt_register_targets(xt_ct_tg_reg
, ARRAY_SIZE(xt_ct_tg_reg
));
451 xt_unregister_target(¬rack_tg_reg
);
457 static void __exit
xt_ct_tg_exit(void)
459 xt_unregister_targets(xt_ct_tg_reg
, ARRAY_SIZE(xt_ct_tg_reg
));
460 xt_unregister_target(¬rack_tg_reg
);
463 module_init(xt_ct_tg_init
);
464 module_exit(xt_ct_tg_exit
);
466 MODULE_LICENSE("GPL");
467 MODULE_DESCRIPTION("Xtables: connection tracking target");
468 MODULE_ALIAS("ipt_CT");
469 MODULE_ALIAS("ip6t_CT");
470 MODULE_ALIAS("ipt_NOTRACK");
471 MODULE_ALIAS("ip6t_NOTRACK");