2 * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
9 #include <linux/module.h>
10 #include <linux/skbuff.h>
11 #include <linux/selinux.h>
12 #include <linux/netfilter_ipv4/ip_tables.h>
13 #include <linux/netfilter_ipv6/ip6_tables.h>
14 #include <linux/netfilter/x_tables.h>
15 #include <linux/netfilter/xt_CT.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_helper.h>
18 #include <net/netfilter/nf_conntrack_ecache.h>
20 static unsigned int xt_ct_target(struct sk_buff *skb,
21 const struct xt_target_param *par)
23 const struct xt_ct_target_info *info = par->targinfo;
24 struct nf_conn *ct = info->ct;
26 /* Previously seen (loopback)? Ignore. */
27 if (skb->nfct != NULL)
30 atomic_inc(&ct->ct_general.use);
31 skb->nfct = &ct->ct_general;
32 skb->nfctinfo = IP_CT_NEW;
37 static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
39 if (par->family == AF_INET) {
40 const struct ipt_entry *e = par->entryinfo;
42 if (e->ip.invflags & IPT_INV_PROTO)
45 } else if (par->family == AF_INET6) {
46 const struct ip6t_entry *e = par->entryinfo;
48 if (e->ipv6.invflags & IP6T_INV_PROTO)
55 static bool xt_ct_tg_check(const struct xt_tgchk_param *par)
57 struct xt_ct_target_info *info = par->targinfo;
58 struct nf_conntrack_tuple t;
59 struct nf_conn_help *help;
63 if (info->flags & ~XT_CT_NOTRACK)
66 if (info->flags & XT_CT_NOTRACK) {
67 ct = &nf_conntrack_untracked;
68 atomic_inc(&ct->ct_general.use);
72 if (nf_ct_l3proto_try_module_get(par->family) < 0)
75 memset(&t, 0, sizeof(t));
76 ct = nf_conntrack_alloc(par->net, &t, &t, GFP_KERNEL);
80 if ((info->ct_events || info->exp_events) &&
81 !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
85 if (info->helper[0]) {
86 proto = xt_ct_find_proto(par);
90 help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
94 help->helper = nf_conntrack_helper_try_module_get(info->helper,
97 if (help->helper == NULL)
101 __set_bit(IPS_TEMPLATE_BIT, &ct->status);
102 __set_bit(IPS_CONFIRMED_BIT, &ct->status);
108 nf_conntrack_free(ct);
110 nf_ct_l3proto_module_put(par->family);
115 static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par)
117 struct xt_ct_target_info *info = par->targinfo;
118 struct nf_conn *ct = info->ct;
119 struct nf_conn_help *help;
121 if (ct != &nf_conntrack_untracked) {
122 help = nfct_help(ct);
124 module_put(help->helper->me);
126 nf_ct_l3proto_module_put(par->family);
131 static struct xt_target xt_ct_tg __read_mostly = {
133 .family = NFPROTO_UNSPEC,
134 .targetsize = XT_ALIGN(sizeof(struct xt_ct_target_info)),
135 .checkentry = xt_ct_tg_check,
136 .destroy = xt_ct_tg_destroy,
137 .target = xt_ct_target,
142 static int __init xt_ct_tg_init(void)
144 return xt_register_target(&xt_ct_tg);
147 static void __exit xt_ct_tg_exit(void)
149 xt_unregister_target(&xt_ct_tg);
152 module_init(xt_ct_tg_init);
153 module_exit(xt_ct_tg_exit);
155 MODULE_LICENSE("GPL");
156 MODULE_DESCRIPTION("Xtables: connection tracking target");
157 MODULE_ALIAS("ipt_CT");
158 MODULE_ALIAS("ip6t_CT");