[linux-2.6-block.git] / net / netfilter / xt_state.c

/* Kernel module to match connection tracking information. */

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2005 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/netfilter/nf_conntrack.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_state.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
MODULE_DESCRIPTION("ip[6]_tables connection tracking state match module");
MODULE_ALIAS("ipt_state");
MODULE_ALIAS("ip6t_state");

static bool
state_mt(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct xt_state_info *sinfo = par->matchinfo;
	enum ip_conntrack_info ctinfo;
	unsigned int statebit;

	if (nf_ct_is_untracked(skb))
		statebit = XT_STATE_UNTRACKED;
	else if (!nf_ct_get(skb, &ctinfo))
		statebit = XT_STATE_INVALID;
	else
		statebit = XT_STATE_BIT(ctinfo);

	return (sinfo->statemask & statebit);
}

static bool state_mt_check(const struct xt_mtchk_param *par)
{
	if (nf_ct_l3proto_try_module_get(par->match->family) < 0) {
		printk(KERN_WARNING "can't load conntrack support for "
				    "proto=%u\n", par->match->family);
		return false;
	}
	return true;
}

static void state_mt_destroy(const struct xt_mtdtor_param *par)
{
	nf_ct_l3proto_module_put(par->match->family);
}

static struct xt_match state_mt_reg[] __read_mostly = {
	{
		.name		= "state",
		.family		= NFPROTO_IPV4,
		.checkentry	= state_mt_check,
		.match		= state_mt,
		.destroy	= state_mt_destroy,
		.matchsize	= sizeof(struct xt_state_info),
		.me		= THIS_MODULE,
	},
	{
		.name		= "state",
		.family		= NFPROTO_IPV6,
		.checkentry	= state_mt_check,
		.match		= state_mt,
		.destroy	= state_mt_destroy,
		.matchsize	= sizeof(struct xt_state_info),
		.me		= THIS_MODULE,
	},
};

static int __init state_mt_init(void)
{
	return xt_register_matches(state_mt_reg, ARRAY_SIZE(state_mt_reg));
}

static void __exit state_mt_exit(void)
{
	xt_unregister_matches(state_mt_reg, ARRAY_SIZE(state_mt_reg));
}

module_init(state_mt_init);
module_exit(state_mt_exit);
Commit	Line	Data
1da177e4 LT	1	/* Kernel module to match connection tracking information. */
	2
	3	/* (C) 1999-2001 Paul `Rusty' Russell
2e4e6a17	4	* (C) 2002-2005 Netfilter Core Team <coreteam@netfilter.org>
1da177e4 LT	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
	11	#include <linux/module.h>
	12	#include <linux/skbuff.h>
587aa641	13	#include <net/netfilter/nf_conntrack.h>
2e4e6a17 HW	14	#include <linux/netfilter/x_tables.h>
2e4e6a17 HW	15	#include <linux/netfilter/xt_state.h>
1da177e4 LT	16
	17	MODULE_LICENSE("GPL");
	18	MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
2e4e6a17 HW	19	MODULE_DESCRIPTION("ip[6]_tables connection tracking state match module");
	20	MODULE_ALIAS("ipt_state");
	21	MODULE_ALIAS("ip6t_state");
1da177e4	22
1d93a9cb	23	static bool
f7108a20	24	state_mt(const struct sk_buff skb, const struct xt_match_param par)
1da177e4	25	{
f7108a20	26	const struct xt_state_info *sinfo = par->matchinfo;
1da177e4 LT	27	enum ip_conntrack_info ctinfo;
	28	unsigned int statebit;
	29
9fb9cbb1	30	if (nf_ct_is_untracked(skb))
2e4e6a17	31	statebit = XT_STATE_UNTRACKED;
587aa641	32	else if (!nf_ct_get(skb, &ctinfo))
2e4e6a17	33	statebit = XT_STATE_INVALID;
1da177e4	34	else
2e4e6a17	35	statebit = XT_STATE_BIT(ctinfo);
1da177e4 LT	36
	37	return (sinfo->statemask & statebit);
	38	}
	39
9b4fce7a	40	static bool state_mt_check(const struct xt_mtchk_param *par)
b9f78f9f	41	{
9b4fce7a	42	if (nf_ct_l3proto_try_module_get(par->match->family) < 0) {
fe0b9294	43	printk(KERN_WARNING "can't load conntrack support for "
9b4fce7a	44	"proto=%u\n", par->match->family);
ccb79bdc	45	return false;
b9f78f9f	46	}
ccb79bdc	47	return true;
b9f78f9f PNA	48	}
b9f78f9f PNA	49
6be3d859	50	static void state_mt_destroy(const struct xt_mtdtor_param *par)
b9f78f9f	51	{
6be3d859	52	nf_ct_l3proto_module_put(par->match->family);
b9f78f9f PNA	53	}
b9f78f9f PNA	54
d3c5ee6d	55	static struct xt_match state_mt_reg[] __read_mostly = {
4470bbc7 PM	56	{
4470bbc7 PM	57	.name = "state",
ee999d8b	58	.family = NFPROTO_IPV4,
d3c5ee6d JE	59	.checkentry = state_mt_check,
	60	.match = state_mt,
	61	.destroy = state_mt_destroy,
4470bbc7 PM	62	.matchsize = sizeof(struct xt_state_info),
	63	.me = THIS_MODULE,
	64	},
	65	{
	66	.name = "state",
ee999d8b	67	.family = NFPROTO_IPV6,
d3c5ee6d JE	68	.checkentry = state_mt_check,
	69	.match = state_mt,
	70	.destroy = state_mt_destroy,
4470bbc7 PM	71	.matchsize = sizeof(struct xt_state_info),
	72	.me = THIS_MODULE,
	73	},
1da177e4 LT	74	};
1da177e4 LT	75
d3c5ee6d	76	static int __init state_mt_init(void)
1da177e4	77	{
d3c5ee6d	78	return xt_register_matches(state_mt_reg, ARRAY_SIZE(state_mt_reg));
1da177e4 LT	79	}
1da177e4 LT	80
d3c5ee6d	81	static void __exit state_mt_exit(void)
1da177e4	82	{
d3c5ee6d	83	xt_unregister_matches(state_mt_reg, ARRAY_SIZE(state_mt_reg));
1da177e4 LT	84	}
1da177e4 LT	85
d3c5ee6d JE	86	module_init(state_mt_init);
d3c5ee6d JE	87	module_exit(state_mt_exit);