Commit | Line | Data |
---|---|---|
84f3bb9a PM |
1 | /* |
2 | * Copyright (c) 2010 Patrick McHardy <kaber@trash.net> | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License version 2 as | |
6 | * published by the Free Software Foundation. | |
7 | */ | |
8 | ||
9 | #include <linux/module.h> | |
5a0e3ad6 | 10 | #include <linux/gfp.h> |
84f3bb9a PM |
11 | #include <linux/skbuff.h> |
12 | #include <linux/selinux.h> | |
13 | #include <linux/netfilter_ipv4/ip_tables.h> | |
14 | #include <linux/netfilter_ipv6/ip6_tables.h> | |
15 | #include <linux/netfilter/x_tables.h> | |
16 | #include <linux/netfilter/xt_CT.h> | |
17 | #include <net/netfilter/nf_conntrack.h> | |
18 | #include <net/netfilter/nf_conntrack_helper.h> | |
19 | #include <net/netfilter/nf_conntrack_ecache.h> | |
5d0aa2cc | 20 | #include <net/netfilter/nf_conntrack_zones.h> |
84f3bb9a PM |
21 | |
22 | static unsigned int xt_ct_target(struct sk_buff *skb, | |
23 | const struct xt_target_param *par) | |
24 | { | |
25 | const struct xt_ct_target_info *info = par->targinfo; | |
26 | struct nf_conn *ct = info->ct; | |
27 | ||
28 | /* Previously seen (loopback)? Ignore. */ | |
29 | if (skb->nfct != NULL) | |
30 | return XT_CONTINUE; | |
31 | ||
32 | atomic_inc(&ct->ct_general.use); | |
33 | skb->nfct = &ct->ct_general; | |
34 | skb->nfctinfo = IP_CT_NEW; | |
35 | ||
36 | return XT_CONTINUE; | |
37 | } | |
38 | ||
39 | static u8 xt_ct_find_proto(const struct xt_tgchk_param *par) | |
40 | { | |
41 | if (par->family == AF_INET) { | |
42 | const struct ipt_entry *e = par->entryinfo; | |
43 | ||
44 | if (e->ip.invflags & IPT_INV_PROTO) | |
45 | return 0; | |
46 | return e->ip.proto; | |
47 | } else if (par->family == AF_INET6) { | |
48 | const struct ip6t_entry *e = par->entryinfo; | |
49 | ||
50 | if (e->ipv6.invflags & IP6T_INV_PROTO) | |
51 | return 0; | |
52 | return e->ipv6.proto; | |
53 | } else | |
54 | return 0; | |
55 | } | |
56 | ||
57 | static bool xt_ct_tg_check(const struct xt_tgchk_param *par) | |
58 | { | |
59 | struct xt_ct_target_info *info = par->targinfo; | |
60 | struct nf_conntrack_tuple t; | |
61 | struct nf_conn_help *help; | |
62 | struct nf_conn *ct; | |
63 | u8 proto; | |
64 | ||
65 | if (info->flags & ~XT_CT_NOTRACK) | |
66 | return false; | |
67 | ||
68 | if (info->flags & XT_CT_NOTRACK) { | |
69 | ct = &nf_conntrack_untracked; | |
70 | atomic_inc(&ct->ct_general.use); | |
71 | goto out; | |
72 | } | |
73 | ||
5d0aa2cc PM |
74 | #ifndef CONFIG_NF_CONNTRACK_ZONES |
75 | if (info->zone) | |
76 | goto err1; | |
77 | #endif | |
78 | ||
84f3bb9a PM |
79 | if (nf_ct_l3proto_try_module_get(par->family) < 0) |
80 | goto err1; | |
81 | ||
82 | memset(&t, 0, sizeof(t)); | |
5d0aa2cc | 83 | ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL); |
84f3bb9a PM |
84 | if (IS_ERR(ct)) |
85 | goto err2; | |
86 | ||
87 | if ((info->ct_events || info->exp_events) && | |
88 | !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events, | |
89 | GFP_KERNEL)) | |
90 | goto err3; | |
91 | ||
92 | if (info->helper[0]) { | |
93 | proto = xt_ct_find_proto(par); | |
94 | if (!proto) | |
95 | goto err3; | |
96 | ||
97 | help = nf_ct_helper_ext_add(ct, GFP_KERNEL); | |
98 | if (help == NULL) | |
99 | goto err3; | |
100 | ||
101 | help->helper = nf_conntrack_helper_try_module_get(info->helper, | |
102 | par->family, | |
103 | proto); | |
104 | if (help->helper == NULL) | |
105 | goto err3; | |
106 | } | |
107 | ||
108 | __set_bit(IPS_TEMPLATE_BIT, &ct->status); | |
109 | __set_bit(IPS_CONFIRMED_BIT, &ct->status); | |
110 | out: | |
111 | info->ct = ct; | |
112 | return true; | |
113 | ||
114 | err3: | |
115 | nf_conntrack_free(ct); | |
116 | err2: | |
117 | nf_ct_l3proto_module_put(par->family); | |
118 | err1: | |
119 | return false; | |
120 | } | |
121 | ||
122 | static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par) | |
123 | { | |
124 | struct xt_ct_target_info *info = par->targinfo; | |
125 | struct nf_conn *ct = info->ct; | |
126 | struct nf_conn_help *help; | |
127 | ||
128 | if (ct != &nf_conntrack_untracked) { | |
129 | help = nfct_help(ct); | |
130 | if (help) | |
131 | module_put(help->helper->me); | |
132 | ||
133 | nf_ct_l3proto_module_put(par->family); | |
134 | } | |
135 | nf_ct_put(info->ct); | |
136 | } | |
137 | ||
138 | static struct xt_target xt_ct_tg __read_mostly = { | |
139 | .name = "CT", | |
140 | .family = NFPROTO_UNSPEC, | |
141 | .targetsize = XT_ALIGN(sizeof(struct xt_ct_target_info)), | |
142 | .checkentry = xt_ct_tg_check, | |
143 | .destroy = xt_ct_tg_destroy, | |
144 | .target = xt_ct_target, | |
145 | .table = "raw", | |
146 | .me = THIS_MODULE, | |
147 | }; | |
148 | ||
149 | static int __init xt_ct_tg_init(void) | |
150 | { | |
151 | return xt_register_target(&xt_ct_tg); | |
152 | } | |
153 | ||
154 | static void __exit xt_ct_tg_exit(void) | |
155 | { | |
156 | xt_unregister_target(&xt_ct_tg); | |
157 | } | |
158 | ||
159 | module_init(xt_ct_tg_init); | |
160 | module_exit(xt_ct_tg_exit); | |
161 | ||
162 | MODULE_LICENSE("GPL"); | |
163 | MODULE_DESCRIPTION("Xtables: connection tracking target"); | |
164 | MODULE_ALIAS("ipt_CT"); | |
165 | MODULE_ALIAS("ip6t_CT"); |