]>
Commit | Line | Data |
---|---|---|
84f3bb9a PM |
1 | /* |
2 | * Copyright (c) 2010 Patrick McHardy <kaber@trash.net> | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License version 2 as | |
6 | * published by the Free Software Foundation. | |
7 | */ | |
8 | ||
9 | #include <linux/module.h> | |
5a0e3ad6 | 10 | #include <linux/gfp.h> |
84f3bb9a | 11 | #include <linux/skbuff.h> |
84f3bb9a PM |
12 | #include <linux/netfilter_ipv4/ip_tables.h> |
13 | #include <linux/netfilter_ipv6/ip6_tables.h> | |
14 | #include <linux/netfilter/x_tables.h> | |
15 | #include <linux/netfilter/xt_CT.h> | |
16 | #include <net/netfilter/nf_conntrack.h> | |
17 | #include <net/netfilter/nf_conntrack_helper.h> | |
18 | #include <net/netfilter/nf_conntrack_ecache.h> | |
5d0aa2cc | 19 | #include <net/netfilter/nf_conntrack_zones.h> |
84f3bb9a PM |
20 | |
21 | static unsigned int xt_ct_target(struct sk_buff *skb, | |
4b560b44 | 22 | const struct xt_action_param *par) |
84f3bb9a PM |
23 | { |
24 | const struct xt_ct_target_info *info = par->targinfo; | |
25 | struct nf_conn *ct = info->ct; | |
26 | ||
27 | /* Previously seen (loopback)? Ignore. */ | |
28 | if (skb->nfct != NULL) | |
29 | return XT_CONTINUE; | |
30 | ||
31 | atomic_inc(&ct->ct_general.use); | |
32 | skb->nfct = &ct->ct_general; | |
33 | skb->nfctinfo = IP_CT_NEW; | |
34 | ||
35 | return XT_CONTINUE; | |
36 | } | |
37 | ||
38 | static u8 xt_ct_find_proto(const struct xt_tgchk_param *par) | |
39 | { | |
076f7839 | 40 | if (par->family == NFPROTO_IPV4) { |
84f3bb9a PM |
41 | const struct ipt_entry *e = par->entryinfo; |
42 | ||
43 | if (e->ip.invflags & IPT_INV_PROTO) | |
44 | return 0; | |
45 | return e->ip.proto; | |
076f7839 | 46 | } else if (par->family == NFPROTO_IPV6) { |
84f3bb9a PM |
47 | const struct ip6t_entry *e = par->entryinfo; |
48 | ||
49 | if (e->ipv6.invflags & IP6T_INV_PROTO) | |
50 | return 0; | |
51 | return e->ipv6.proto; | |
52 | } else | |
53 | return 0; | |
54 | } | |
55 | ||
135367b8 | 56 | static int xt_ct_tg_check(const struct xt_tgchk_param *par) |
84f3bb9a PM |
57 | { |
58 | struct xt_ct_target_info *info = par->targinfo; | |
59 | struct nf_conntrack_tuple t; | |
60 | struct nf_conn_help *help; | |
61 | struct nf_conn *ct; | |
4a5a5c73 | 62 | int ret = 0; |
84f3bb9a PM |
63 | u8 proto; |
64 | ||
65 | if (info->flags & ~XT_CT_NOTRACK) | |
d6b00a53 | 66 | return -EINVAL; |
84f3bb9a PM |
67 | |
68 | if (info->flags & XT_CT_NOTRACK) { | |
5bfddbd4 | 69 | ct = nf_ct_untracked_get(); |
84f3bb9a PM |
70 | atomic_inc(&ct->ct_general.use); |
71 | goto out; | |
72 | } | |
73 | ||
5d0aa2cc PM |
74 | #ifndef CONFIG_NF_CONNTRACK_ZONES |
75 | if (info->zone) | |
76 | goto err1; | |
77 | #endif | |
78 | ||
4a5a5c73 JE |
79 | ret = nf_ct_l3proto_try_module_get(par->family); |
80 | if (ret < 0) | |
84f3bb9a PM |
81 | goto err1; |
82 | ||
83 | memset(&t, 0, sizeof(t)); | |
5d0aa2cc | 84 | ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL); |
4a5a5c73 | 85 | ret = PTR_ERR(ct); |
84f3bb9a PM |
86 | if (IS_ERR(ct)) |
87 | goto err2; | |
88 | ||
4a5a5c73 | 89 | ret = 0; |
84f3bb9a PM |
90 | if ((info->ct_events || info->exp_events) && |
91 | !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events, | |
92 | GFP_KERNEL)) | |
93 | goto err3; | |
94 | ||
95 | if (info->helper[0]) { | |
4a5a5c73 | 96 | ret = -ENOENT; |
84f3bb9a PM |
97 | proto = xt_ct_find_proto(par); |
98 | if (!proto) | |
99 | goto err3; | |
100 | ||
4a5a5c73 | 101 | ret = -ENOMEM; |
84f3bb9a PM |
102 | help = nf_ct_helper_ext_add(ct, GFP_KERNEL); |
103 | if (help == NULL) | |
104 | goto err3; | |
105 | ||
4a5a5c73 | 106 | ret = -ENOENT; |
84f3bb9a PM |
107 | help->helper = nf_conntrack_helper_try_module_get(info->helper, |
108 | par->family, | |
109 | proto); | |
110 | if (help->helper == NULL) | |
111 | goto err3; | |
112 | } | |
113 | ||
114 | __set_bit(IPS_TEMPLATE_BIT, &ct->status); | |
115 | __set_bit(IPS_CONFIRMED_BIT, &ct->status); | |
116 | out: | |
117 | info->ct = ct; | |
d6b00a53 | 118 | return 0; |
84f3bb9a PM |
119 | |
120 | err3: | |
121 | nf_conntrack_free(ct); | |
122 | err2: | |
123 | nf_ct_l3proto_module_put(par->family); | |
124 | err1: | |
4a5a5c73 | 125 | return ret; |
84f3bb9a PM |
126 | } |
127 | ||
128 | static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par) | |
129 | { | |
130 | struct xt_ct_target_info *info = par->targinfo; | |
131 | struct nf_conn *ct = info->ct; | |
132 | struct nf_conn_help *help; | |
133 | ||
5bfddbd4 | 134 | if (!nf_ct_is_untracked(ct)) { |
84f3bb9a PM |
135 | help = nfct_help(ct); |
136 | if (help) | |
137 | module_put(help->helper->me); | |
138 | ||
139 | nf_ct_l3proto_module_put(par->family); | |
140 | } | |
141 | nf_ct_put(info->ct); | |
142 | } | |
143 | ||
144 | static struct xt_target xt_ct_tg __read_mostly = { | |
145 | .name = "CT", | |
146 | .family = NFPROTO_UNSPEC, | |
7d5f7ed8 | 147 | .targetsize = sizeof(struct xt_ct_target_info), |
84f3bb9a PM |
148 | .checkentry = xt_ct_tg_check, |
149 | .destroy = xt_ct_tg_destroy, | |
150 | .target = xt_ct_target, | |
151 | .table = "raw", | |
152 | .me = THIS_MODULE, | |
153 | }; | |
154 | ||
155 | static int __init xt_ct_tg_init(void) | |
156 | { | |
157 | return xt_register_target(&xt_ct_tg); | |
158 | } | |
159 | ||
160 | static void __exit xt_ct_tg_exit(void) | |
161 | { | |
162 | xt_unregister_target(&xt_ct_tg); | |
163 | } | |
164 | ||
165 | module_init(xt_ct_tg_init); | |
166 | module_exit(xt_ct_tg_exit); | |
167 | ||
168 | MODULE_LICENSE("GPL"); | |
169 | MODULE_DESCRIPTION("Xtables: connection tracking target"); | |
170 | MODULE_ALIAS("ipt_CT"); | |
171 | MODULE_ALIAS("ip6t_CT"); |