[linux-2.6-block.git] / net / netfilter / xt_connmark.c

/*
 *	xt_connmark - Netfilter module to operate on connection marks
 *
 *	Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
 *	by Henrik Nordstrom <hno@marasystems.com>
 *	Copyright © CC Computer Consultants GmbH, 2007 - 2008
 *	Jan Engelhardt <jengelh@medozas.de>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_connmark.h>

MODULE_AUTHOR("Henrik Nordstrom <hno@marasystems.com>");
MODULE_DESCRIPTION("Xtables: connection mark operations");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_CONNMARK");
MODULE_ALIAS("ip6t_CONNMARK");
MODULE_ALIAS("ipt_connmark");
MODULE_ALIAS("ip6t_connmark");

static unsigned int
connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info)
{
	enum ip_conntrack_info ctinfo;
	u_int32_t new_targetmark;
	struct nf_conn *ct;
	u_int32_t newmark;

	ct = nf_ct_get(skb, &ctinfo);
	if (ct == NULL)
		return XT_CONTINUE;

	switch (info->mode) {
	case XT_CONNMARK_SET:
		newmark = (ct->mark & ~info->ctmask) ^ info->ctmark;
		if (info->shift_dir == D_SHIFT_RIGHT)
			newmark >>= info->shift_bits;
		else
			newmark <<= info->shift_bits;

		if (ct->mark != newmark) {
			ct->mark = newmark;
			nf_conntrack_event_cache(IPCT_MARK, ct);
		}
		break;
	case XT_CONNMARK_SAVE:
		new_targetmark = (skb->mark & info->nfmask);
		if (info->shift_dir == D_SHIFT_RIGHT)
			new_targetmark >>= info->shift_bits;
		else
			new_targetmark <<= info->shift_bits;

		newmark = (ct->mark & ~info->ctmask) ^
			  new_targetmark;
		if (ct->mark != newmark) {
			ct->mark = newmark;
			nf_conntrack_event_cache(IPCT_MARK, ct);
		}
		break;
	case XT_CONNMARK_RESTORE:
		new_targetmark = (ct->mark & info->ctmask);
		if (info->shift_dir == D_SHIFT_RIGHT)
			new_targetmark >>= info->shift_bits;
		else
			new_targetmark <<= info->shift_bits;

		newmark = (skb->mark & ~info->nfmask) ^
			  new_targetmark;
		skb->mark = newmark;
		break;
	}
	return XT_CONTINUE;
}

static unsigned int
connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct xt_connmark_tginfo1 *info = par->targinfo;
	const struct xt_connmark_tginfo2 info2 = {
		.ctmark	= info->ctmark,
		.ctmask	= info->ctmask,
		.nfmask	= info->nfmask,
		.mode	= info->mode,
	};

	return connmark_tg_shift(skb, &info2);
}

static unsigned int
connmark_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct xt_connmark_tginfo2 *info = par->targinfo;

	return connmark_tg_shift(skb, info);
}

static int connmark_tg_check(const struct xt_tgchk_param *par)
{
	int ret;

	ret = nf_ct_netns_get(par->net, par->family);
	if (ret < 0)
		pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
				    par->family);
	return ret;
}

static void connmark_tg_destroy(const struct xt_tgdtor_param *par)
{
	nf_ct_netns_put(par->net, par->family);
}

static bool
connmark_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_connmark_mtinfo1 *info = par->matchinfo;
	enum ip_conntrack_info ctinfo;
	const struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	if (ct == NULL)
		return false;

	return ((ct->mark & info->mask) == info->mark) ^ info->invert;
}

static int connmark_mt_check(const struct xt_mtchk_param *par)
{
	int ret;

	ret = nf_ct_netns_get(par->net, par->family);
	if (ret < 0)
		pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
				    par->family);
	return ret;
}

static void connmark_mt_destroy(const struct xt_mtdtor_param *par)
{
	nf_ct_netns_put(par->net, par->family);
}

static struct xt_target connmark_tg_reg[] __read_mostly = {
	{
		.name           = "CONNMARK",
		.revision       = 1,
		.family         = NFPROTO_UNSPEC,
		.checkentry     = connmark_tg_check,
		.target         = connmark_tg,
		.targetsize     = sizeof(struct xt_connmark_tginfo1),
		.destroy        = connmark_tg_destroy,
		.me             = THIS_MODULE,
	},
	{
		.name           = "CONNMARK",
		.revision       = 2,
		.family         = NFPROTO_UNSPEC,
		.checkentry     = connmark_tg_check,
		.target         = connmark_tg_v2,
		.targetsize     = sizeof(struct xt_connmark_tginfo2),
		.destroy        = connmark_tg_destroy,
		.me             = THIS_MODULE,
	}
};

static struct xt_match connmark_mt_reg __read_mostly = {
	.name           = "connmark",
	.revision       = 1,
	.family         = NFPROTO_UNSPEC,
	.checkentry     = connmark_mt_check,
	.match          = connmark_mt,
	.matchsize      = sizeof(struct xt_connmark_mtinfo1),
	.destroy        = connmark_mt_destroy,
	.me             = THIS_MODULE,
};

static int __init connmark_mt_init(void)
{
	int ret;

	ret = xt_register_targets(connmark_tg_reg,
				  ARRAY_SIZE(connmark_tg_reg));
	if (ret < 0)
		return ret;
	ret = xt_register_match(&connmark_mt_reg);
	if (ret < 0) {
		xt_unregister_targets(connmark_tg_reg,
				      ARRAY_SIZE(connmark_tg_reg));
		return ret;
	}
	return 0;
}

static void __exit connmark_mt_exit(void)
{
	xt_unregister_match(&connmark_mt_reg);
	xt_unregister_targets(connmark_tg_reg, ARRAY_SIZE(connmark_tg_reg));
}

module_init(connmark_mt_init);
module_exit(connmark_mt_exit);
Commit	Line	Data
96e32272	1	/*
b8f00ba2	2	* xt_connmark - Netfilter module to operate on connection marks
1da177e4	3	*
96e32272 JE	4	* Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
	5	* by Henrik Nordstrom <hno@marasystems.com>
	6	* Copyright © CC Computer Consultants GmbH, 2007 - 2008
408ffaa4	7	* Jan Engelhardt <jengelh@medozas.de>
1da177e4 LT	8	*
	9	* This program is free software; you can redistribute it and/or modify
	10	* it under the terms of the GNU General Public License as published by
	11	* the Free Software Foundation; either version 2 of the License, or
	12	* (at your option) any later version.
	13	*
	14	* This program is distributed in the hope that it will be useful,
	15	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	16	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	17	* GNU General Public License for more details.
	18	*
	19	* You should have received a copy of the GNU General Public License
e664eabd	20	* along with this program; if not, see <http://www.gnu.org/licenses/>.
1da177e4 LT	21	*/
	22
	23	#include <linux/module.h>
	24	#include <linux/skbuff.h>
587aa641	25	#include <net/netfilter/nf_conntrack.h>
b8f00ba2	26	#include <net/netfilter/nf_conntrack_ecache.h>
587aa641 PM	27	#include <linux/netfilter/x_tables.h>
587aa641 PM	28	#include <linux/netfilter/xt_connmark.h>
1da177e4	29
3a4fa0a2	30	MODULE_AUTHOR("Henrik Nordstrom <hno@marasystems.com>");
b8f00ba2	31	MODULE_DESCRIPTION("Xtables: connection mark operations");
1da177e4	32	MODULE_LICENSE("GPL");
b8f00ba2 JE	33	MODULE_ALIAS("ipt_CONNMARK");
b8f00ba2 JE	34	MODULE_ALIAS("ip6t_CONNMARK");
2e4e6a17	35	MODULE_ALIAS("ipt_connmark");
73aaf935	36	MODULE_ALIAS("ip6t_connmark");
1da177e4	37
b8f00ba2	38	static unsigned int
5a786232	39	connmark_tg_shift(struct sk_buff skb, const struct xt_connmark_tginfo2 info)
b8f00ba2	40	{
b8f00ba2	41	enum ip_conntrack_info ctinfo;
cf43ae63	42	u_int32_t new_targetmark;
b8f00ba2 JE	43	struct nf_conn *ct;
	44	u_int32_t newmark;
	45
	46	ct = nf_ct_get(skb, &ctinfo);
ab8bc7ed	47	if (ct == NULL)
b8f00ba2 JE	48	return XT_CONTINUE;
	49
	50	switch (info->mode) {
	51	case XT_CONNMARK_SET:
	52	newmark = (ct->mark & ~info->ctmask) ^ info->ctmark;
5a786232 PNA	53	if (info->shift_dir == D_SHIFT_RIGHT)
5a786232 PNA	54	newmark >>= info->shift_bits;
472a73e0	55	else
5a786232 PNA	56	newmark <<= info->shift_bits;
5a786232 PNA	57
b8f00ba2 JE	58	if (ct->mark != newmark) {
	59	ct->mark = newmark;
	60	nf_conntrack_event_cache(IPCT_MARK, ct);
	61	}
	62	break;
	63	case XT_CONNMARK_SAVE:
cf43ae63	64	new_targetmark = (skb->mark & info->nfmask);
5a786232 PNA	65	if (info->shift_dir == D_SHIFT_RIGHT)
5a786232 PNA	66	new_targetmark >>= info->shift_bits;
472a73e0	67	else
5a786232 PNA	68	new_targetmark <<= info->shift_bits;
5a786232 PNA	69
cf43ae63 JM	70	newmark = (ct->mark & ~info->ctmask) ^
cf43ae63 JM	71	new_targetmark;
b8f00ba2 JE	72	if (ct->mark != newmark) {
	73	ct->mark = newmark;
	74	nf_conntrack_event_cache(IPCT_MARK, ct);
	75	}
	76	break;
	77	case XT_CONNMARK_RESTORE:
cf43ae63	78	new_targetmark = (ct->mark & info->ctmask);
5a786232 PNA	79	if (info->shift_dir == D_SHIFT_RIGHT)
5a786232 PNA	80	new_targetmark >>= info->shift_bits;
472a73e0	81	else
5a786232 PNA	82	new_targetmark <<= info->shift_bits;
5a786232 PNA	83
cf43ae63 JM	84	newmark = (skb->mark & ~info->nfmask) ^
cf43ae63 JM	85	new_targetmark;
b8f00ba2 JE	86	skb->mark = newmark;
	87	break;
	88	}
b8f00ba2 JE	89	return XT_CONTINUE;
	90	}
	91
472a73e0 JM	92	static unsigned int
	93	connmark_tg(struct sk_buff skb, const struct xt_action_param par)
	94	{
	95	const struct xt_connmark_tginfo1 *info = par->targinfo;
5a786232 PNA	96	const struct xt_connmark_tginfo2 info2 = {
	97	.ctmark = info->ctmark,
	98	.ctmask = info->ctmask,
	99	.nfmask = info->nfmask,
	100	.mode = info->mode,
	101	};
472a73e0	102
5a786232	103	return connmark_tg_shift(skb, &info2);
472a73e0 JM	104	}
	105
	106	static unsigned int
	107	connmark_tg_v2(struct sk_buff skb, const struct xt_action_param par)
	108	{
	109	const struct xt_connmark_tginfo2 *info = par->targinfo;
	110
5a786232	111	return connmark_tg_shift(skb, info);
472a73e0 JM	112	}
472a73e0 JM	113
135367b8	114	static int connmark_tg_check(const struct xt_tgchk_param *par)
b8f00ba2	115	{
4a5a5c73 JE	116	int ret;
4a5a5c73 JE	117
ecb2421b	118	ret = nf_ct_netns_get(par->net, par->family);
f95c74e3	119	if (ret < 0)
b2606644 FW	120	pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
b2606644 FW	121	par->family);
f95c74e3	122	return ret;
b8f00ba2 JE	123	}
	124
	125	static void connmark_tg_destroy(const struct xt_tgdtor_param *par)
	126	{
ecb2421b	127	nf_ct_netns_put(par->net, par->family);
b8f00ba2 JE	128	}
b8f00ba2 JE	129
1d93a9cb	130	static bool
62fc8051	131	connmark_mt(const struct sk_buff skb, struct xt_action_param par)
96e32272	132	{
f7108a20	133	const struct xt_connmark_mtinfo1 *info = par->matchinfo;
96e32272 JE	134	enum ip_conntrack_info ctinfo;
	135	const struct nf_conn *ct;
	136
	137	ct = nf_ct_get(skb, &ctinfo);
ab8bc7ed	138	if (ct == NULL)
96e32272 JE	139	return false;
	140
	141	return ((ct->mark & info->mask) == info->mark) ^ info->invert;
	142	}
	143
b0f38452	144	static int connmark_mt_check(const struct xt_mtchk_param *par)
96e32272	145	{
4a5a5c73 JE	146	int ret;
4a5a5c73 JE	147
ecb2421b	148	ret = nf_ct_netns_get(par->net, par->family);
f95c74e3	149	if (ret < 0)
b2606644 FW	150	pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
b2606644 FW	151	par->family);
f95c74e3	152	return ret;
96e32272 JE	153	}
96e32272 JE	154
6be3d859	155	static void connmark_mt_destroy(const struct xt_mtdtor_param *par)
b9f78f9f	156	{
ecb2421b	157	nf_ct_netns_put(par->net, par->family);
b9f78f9f PNA	158	}
b9f78f9f PNA	159
472a73e0 JM	160	static struct xt_target connmark_tg_reg[] __read_mostly = {
	161	{
	162	.name = "CONNMARK",
	163	.revision = 1,
	164	.family = NFPROTO_UNSPEC,
	165	.checkentry = connmark_tg_check,
	166	.target = connmark_tg,
	167	.targetsize = sizeof(struct xt_connmark_tginfo1),
	168	.destroy = connmark_tg_destroy,
	169	.me = THIS_MODULE,
	170	},
	171	{
	172	.name = "CONNMARK",
	173	.revision = 2,
	174	.family = NFPROTO_UNSPEC,
	175	.checkentry = connmark_tg_check,
	176	.target = connmark_tg_v2,
	177	.targetsize = sizeof(struct xt_connmark_tginfo2),
	178	.destroy = connmark_tg_destroy,
	179	.me = THIS_MODULE,
	180	}
b8f00ba2 JE	181	};
b8f00ba2 JE	182
84899a2b JE	183	static struct xt_match connmark_mt_reg __read_mostly = {
	184	.name = "connmark",
	185	.revision = 1,
	186	.family = NFPROTO_UNSPEC,
	187	.checkentry = connmark_mt_check,
	188	.match = connmark_mt,
	189	.matchsize = sizeof(struct xt_connmark_mtinfo1),
	190	.destroy = connmark_mt_destroy,
	191	.me = THIS_MODULE,
1da177e4 LT	192	};
1da177e4 LT	193
d3c5ee6d	194	static int __init connmark_mt_init(void)
1da177e4	195	{
b8f00ba2 JE	196	int ret;
b8f00ba2 JE	197
472a73e0 JM	198	ret = xt_register_targets(connmark_tg_reg,
472a73e0 JM	199	ARRAY_SIZE(connmark_tg_reg));
b8f00ba2 JE	200	if (ret < 0)
	201	return ret;
	202	ret = xt_register_match(&connmark_mt_reg);
	203	if (ret < 0) {
472a73e0 JM	204	xt_unregister_targets(connmark_tg_reg,
472a73e0 JM	205	ARRAY_SIZE(connmark_tg_reg));
b8f00ba2 JE	206	return ret;
	207	}
	208	return 0;
1da177e4 LT	209	}
1da177e4 LT	210
d3c5ee6d	211	static void __exit connmark_mt_exit(void)
1da177e4	212	{
84899a2b	213	xt_unregister_match(&connmark_mt_reg);
fc6ddbec	214	xt_unregister_targets(connmark_tg_reg, ARRAY_SIZE(connmark_tg_reg));
1da177e4 LT	215	}
1da177e4 LT	216
d3c5ee6d JE	217	module_init(connmark_mt_init);
d3c5ee6d JE	218	module_exit(connmark_mt_exit);