[linux-block.git] / net / netfilter / xt_connmark.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *	xt_connmark - Netfilter module to operate on connection marks
 *
 *	Copyright (C) 2002,2004 MARA Systems AB <https://www.marasystems.com>
 *	by Henrik Nordstrom <hno@marasystems.com>
 *	Copyright © CC Computer Consultants GmbH, 2007 - 2008
 *	Jan Engelhardt <jengelh@medozas.de>
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_connmark.h>

MODULE_AUTHOR("Henrik Nordstrom <hno@marasystems.com>");
MODULE_DESCRIPTION("Xtables: connection mark operations");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_CONNMARK");
MODULE_ALIAS("ip6t_CONNMARK");
MODULE_ALIAS("ipt_connmark");
MODULE_ALIAS("ip6t_connmark");

static unsigned int
connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info)
{
	enum ip_conntrack_info ctinfo;
	u_int32_t new_targetmark;
	struct nf_conn *ct;
	u_int32_t newmark;

	ct = nf_ct_get(skb, &ctinfo);
	if (ct == NULL)
		return XT_CONTINUE;

	switch (info->mode) {
	case XT_CONNMARK_SET:
		newmark = (ct->mark & ~info->ctmask) ^ info->ctmark;
		if (info->shift_dir == D_SHIFT_RIGHT)
			newmark >>= info->shift_bits;
		else
			newmark <<= info->shift_bits;

		if (ct->mark != newmark) {
			ct->mark = newmark;
			nf_conntrack_event_cache(IPCT_MARK, ct);
		}
		break;
	case XT_CONNMARK_SAVE:
		new_targetmark = (skb->mark & info->nfmask);
		if (info->shift_dir == D_SHIFT_RIGHT)
			new_targetmark >>= info->shift_bits;
		else
			new_targetmark <<= info->shift_bits;

		newmark = (ct->mark & ~info->ctmask) ^
			  new_targetmark;
		if (ct->mark != newmark) {
			ct->mark = newmark;
			nf_conntrack_event_cache(IPCT_MARK, ct);
		}
		break;
	case XT_CONNMARK_RESTORE:
		new_targetmark = (ct->mark & info->ctmask);
		if (info->shift_dir == D_SHIFT_RIGHT)
			new_targetmark >>= info->shift_bits;
		else
			new_targetmark <<= info->shift_bits;

		newmark = (skb->mark & ~info->nfmask) ^
			  new_targetmark;
		skb->mark = newmark;
		break;
	}
	return XT_CONTINUE;
}

static unsigned int
connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct xt_connmark_tginfo1 *info = par->targinfo;
	const struct xt_connmark_tginfo2 info2 = {
		.ctmark	= info->ctmark,
		.ctmask	= info->ctmask,
		.nfmask	= info->nfmask,
		.mode	= info->mode,
	};

	return connmark_tg_shift(skb, &info2);
}

static unsigned int
connmark_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct xt_connmark_tginfo2 *info = par->targinfo;

	return connmark_tg_shift(skb, info);
}

static int connmark_tg_check(const struct xt_tgchk_param *par)
{
	int ret;

	ret = nf_ct_netns_get(par->net, par->family);
	if (ret < 0)
		pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
				    par->family);
	return ret;
}

static void connmark_tg_destroy(const struct xt_tgdtor_param *par)
{
	nf_ct_netns_put(par->net, par->family);
}

static bool
connmark_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_connmark_mtinfo1 *info = par->matchinfo;
	enum ip_conntrack_info ctinfo;
	const struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	if (ct == NULL)
		return false;

	return ((ct->mark & info->mask) == info->mark) ^ info->invert;
}

static int connmark_mt_check(const struct xt_mtchk_param *par)
{
	int ret;

	ret = nf_ct_netns_get(par->net, par->family);
	if (ret < 0)
		pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
				    par->family);
	return ret;
}

static void connmark_mt_destroy(const struct xt_mtdtor_param *par)
{
	nf_ct_netns_put(par->net, par->family);
}

static struct xt_target connmark_tg_reg[] __read_mostly = {
	{
		.name           = "CONNMARK",
		.revision       = 1,
		.family         = NFPROTO_UNSPEC,
		.checkentry     = connmark_tg_check,
		.target         = connmark_tg,
		.targetsize     = sizeof(struct xt_connmark_tginfo1),
		.destroy        = connmark_tg_destroy,
		.me             = THIS_MODULE,
	},
	{
		.name           = "CONNMARK",
		.revision       = 2,
		.family         = NFPROTO_UNSPEC,
		.checkentry     = connmark_tg_check,
		.target         = connmark_tg_v2,
		.targetsize     = sizeof(struct xt_connmark_tginfo2),
		.destroy        = connmark_tg_destroy,
		.me             = THIS_MODULE,
	}
};

static struct xt_match connmark_mt_reg __read_mostly = {
	.name           = "connmark",
	.revision       = 1,
	.family         = NFPROTO_UNSPEC,
	.checkentry     = connmark_mt_check,
	.match          = connmark_mt,
	.matchsize      = sizeof(struct xt_connmark_mtinfo1),
	.destroy        = connmark_mt_destroy,
	.me             = THIS_MODULE,
};

static int __init connmark_mt_init(void)
{
	int ret;

	ret = xt_register_targets(connmark_tg_reg,
				  ARRAY_SIZE(connmark_tg_reg));
	if (ret < 0)
		return ret;
	ret = xt_register_match(&connmark_mt_reg);
	if (ret < 0) {
		xt_unregister_targets(connmark_tg_reg,
				      ARRAY_SIZE(connmark_tg_reg));
		return ret;
	}
	return 0;
}

static void __exit connmark_mt_exit(void)
{
	xt_unregister_match(&connmark_mt_reg);
	xt_unregister_targets(connmark_tg_reg, ARRAY_SIZE(connmark_tg_reg));
}

module_init(connmark_mt_init);
module_exit(connmark_mt_exit);
Commit	Line	Data
1ccea77e	1	// SPDX-License-Identifier: GPL-2.0-or-later
96e32272	2	/*
b8f00ba2	3	* xt_connmark - Netfilter module to operate on connection marks
1da177e4	4	*
50935339	5	* Copyright (C) 2002,2004 MARA Systems AB <https://www.marasystems.com>
96e32272 JE	6	* by Henrik Nordstrom <hno@marasystems.com>
96e32272 JE	7	* Copyright © CC Computer Consultants GmbH, 2007 - 2008
408ffaa4	8	* Jan Engelhardt <jengelh@medozas.de>
1da177e4 LT	9	*/
	10
	11	#include <linux/module.h>
	12	#include <linux/skbuff.h>
587aa641	13	#include <net/netfilter/nf_conntrack.h>
b8f00ba2	14	#include <net/netfilter/nf_conntrack_ecache.h>
587aa641 PM	15	#include <linux/netfilter/x_tables.h>
587aa641 PM	16	#include <linux/netfilter/xt_connmark.h>
1da177e4	17
3a4fa0a2	18	MODULE_AUTHOR("Henrik Nordstrom <hno@marasystems.com>");
b8f00ba2	19	MODULE_DESCRIPTION("Xtables: connection mark operations");
1da177e4	20	MODULE_LICENSE("GPL");
b8f00ba2 JE	21	MODULE_ALIAS("ipt_CONNMARK");
b8f00ba2 JE	22	MODULE_ALIAS("ip6t_CONNMARK");
2e4e6a17	23	MODULE_ALIAS("ipt_connmark");
73aaf935	24	MODULE_ALIAS("ip6t_connmark");
1da177e4	25
b8f00ba2	26	static unsigned int
5a786232	27	connmark_tg_shift(struct sk_buff skb, const struct xt_connmark_tginfo2 info)
b8f00ba2	28	{
b8f00ba2	29	enum ip_conntrack_info ctinfo;
cf43ae63	30	u_int32_t new_targetmark;
b8f00ba2 JE	31	struct nf_conn *ct;
	32	u_int32_t newmark;
	33
	34	ct = nf_ct_get(skb, &ctinfo);
ab8bc7ed	35	if (ct == NULL)
b8f00ba2 JE	36	return XT_CONTINUE;
	37
	38	switch (info->mode) {
	39	case XT_CONNMARK_SET:
	40	newmark = (ct->mark & ~info->ctmask) ^ info->ctmark;
5a786232 PNA	41	if (info->shift_dir == D_SHIFT_RIGHT)
5a786232 PNA	42	newmark >>= info->shift_bits;
472a73e0	43	else
5a786232 PNA	44	newmark <<= info->shift_bits;
5a786232 PNA	45
b8f00ba2 JE	46	if (ct->mark != newmark) {
	47	ct->mark = newmark;
	48	nf_conntrack_event_cache(IPCT_MARK, ct);
	49	}
	50	break;
	51	case XT_CONNMARK_SAVE:
cf43ae63	52	new_targetmark = (skb->mark & info->nfmask);
5a786232 PNA	53	if (info->shift_dir == D_SHIFT_RIGHT)
5a786232 PNA	54	new_targetmark >>= info->shift_bits;
472a73e0	55	else
5a786232 PNA	56	new_targetmark <<= info->shift_bits;
5a786232 PNA	57
cf43ae63 JM	58	newmark = (ct->mark & ~info->ctmask) ^
cf43ae63 JM	59	new_targetmark;
b8f00ba2 JE	60	if (ct->mark != newmark) {
	61	ct->mark = newmark;
	62	nf_conntrack_event_cache(IPCT_MARK, ct);
	63	}
	64	break;
	65	case XT_CONNMARK_RESTORE:
cf43ae63	66	new_targetmark = (ct->mark & info->ctmask);
5a786232 PNA	67	if (info->shift_dir == D_SHIFT_RIGHT)
5a786232 PNA	68	new_targetmark >>= info->shift_bits;
472a73e0	69	else
5a786232 PNA	70	new_targetmark <<= info->shift_bits;
5a786232 PNA	71
cf43ae63 JM	72	newmark = (skb->mark & ~info->nfmask) ^
cf43ae63 JM	73	new_targetmark;
b8f00ba2 JE	74	skb->mark = newmark;
	75	break;
	76	}
b8f00ba2 JE	77	return XT_CONTINUE;
	78	}
	79
472a73e0 JM	80	static unsigned int
	81	connmark_tg(struct sk_buff skb, const struct xt_action_param par)
	82	{
	83	const struct xt_connmark_tginfo1 *info = par->targinfo;
5a786232 PNA	84	const struct xt_connmark_tginfo2 info2 = {
	85	.ctmark = info->ctmark,
	86	.ctmask = info->ctmask,
	87	.nfmask = info->nfmask,
	88	.mode = info->mode,
	89	};
472a73e0	90
5a786232	91	return connmark_tg_shift(skb, &info2);
472a73e0 JM	92	}
	93
	94	static unsigned int
	95	connmark_tg_v2(struct sk_buff skb, const struct xt_action_param par)
	96	{
	97	const struct xt_connmark_tginfo2 *info = par->targinfo;
	98
5a786232	99	return connmark_tg_shift(skb, info);
472a73e0 JM	100	}
472a73e0 JM	101
135367b8	102	static int connmark_tg_check(const struct xt_tgchk_param *par)
b8f00ba2	103	{
4a5a5c73 JE	104	int ret;
4a5a5c73 JE	105
ecb2421b	106	ret = nf_ct_netns_get(par->net, par->family);
f95c74e3	107	if (ret < 0)
b2606644 FW	108	pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
b2606644 FW	109	par->family);
f95c74e3	110	return ret;
b8f00ba2 JE	111	}
	112
	113	static void connmark_tg_destroy(const struct xt_tgdtor_param *par)
	114	{
ecb2421b	115	nf_ct_netns_put(par->net, par->family);
b8f00ba2 JE	116	}
b8f00ba2 JE	117
1d93a9cb	118	static bool
62fc8051	119	connmark_mt(const struct sk_buff skb, struct xt_action_param par)
96e32272	120	{
f7108a20	121	const struct xt_connmark_mtinfo1 *info = par->matchinfo;
96e32272 JE	122	enum ip_conntrack_info ctinfo;
	123	const struct nf_conn *ct;
	124
	125	ct = nf_ct_get(skb, &ctinfo);
ab8bc7ed	126	if (ct == NULL)
96e32272 JE	127	return false;
	128
	129	return ((ct->mark & info->mask) == info->mark) ^ info->invert;
	130	}
	131
b0f38452	132	static int connmark_mt_check(const struct xt_mtchk_param *par)
96e32272	133	{
4a5a5c73 JE	134	int ret;
4a5a5c73 JE	135
ecb2421b	136	ret = nf_ct_netns_get(par->net, par->family);
f95c74e3	137	if (ret < 0)
b2606644 FW	138	pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
b2606644 FW	139	par->family);
f95c74e3	140	return ret;
96e32272 JE	141	}
96e32272 JE	142
6be3d859	143	static void connmark_mt_destroy(const struct xt_mtdtor_param *par)
b9f78f9f	144	{
ecb2421b	145	nf_ct_netns_put(par->net, par->family);
b9f78f9f PNA	146	}
b9f78f9f PNA	147
472a73e0 JM	148	static struct xt_target connmark_tg_reg[] __read_mostly = {
	149	{
	150	.name = "CONNMARK",
	151	.revision = 1,
	152	.family = NFPROTO_UNSPEC,
	153	.checkentry = connmark_tg_check,
	154	.target = connmark_tg,
	155	.targetsize = sizeof(struct xt_connmark_tginfo1),
	156	.destroy = connmark_tg_destroy,
	157	.me = THIS_MODULE,
	158	},
	159	{
	160	.name = "CONNMARK",
	161	.revision = 2,
	162	.family = NFPROTO_UNSPEC,
	163	.checkentry = connmark_tg_check,
	164	.target = connmark_tg_v2,
	165	.targetsize = sizeof(struct xt_connmark_tginfo2),
	166	.destroy = connmark_tg_destroy,
	167	.me = THIS_MODULE,
	168	}
b8f00ba2 JE	169	};
b8f00ba2 JE	170
84899a2b JE	171	static struct xt_match connmark_mt_reg __read_mostly = {
	172	.name = "connmark",
	173	.revision = 1,
	174	.family = NFPROTO_UNSPEC,
	175	.checkentry = connmark_mt_check,
	176	.match = connmark_mt,
	177	.matchsize = sizeof(struct xt_connmark_mtinfo1),
	178	.destroy = connmark_mt_destroy,
	179	.me = THIS_MODULE,
1da177e4 LT	180	};
1da177e4 LT	181
d3c5ee6d	182	static int __init connmark_mt_init(void)
1da177e4	183	{
b8f00ba2 JE	184	int ret;
b8f00ba2 JE	185
472a73e0 JM	186	ret = xt_register_targets(connmark_tg_reg,
472a73e0 JM	187	ARRAY_SIZE(connmark_tg_reg));
b8f00ba2 JE	188	if (ret < 0)
	189	return ret;
	190	ret = xt_register_match(&connmark_mt_reg);
	191	if (ret < 0) {
472a73e0 JM	192	xt_unregister_targets(connmark_tg_reg,
472a73e0 JM	193	ARRAY_SIZE(connmark_tg_reg));
b8f00ba2 JE	194	return ret;
	195	}
	196	return 0;
1da177e4 LT	197	}
1da177e4 LT	198
d3c5ee6d	199	static void __exit connmark_mt_exit(void)
1da177e4	200	{
84899a2b	201	xt_unregister_match(&connmark_mt_reg);
fc6ddbec	202	xt_unregister_targets(connmark_tg_reg, ARRAY_SIZE(connmark_tg_reg));
1da177e4 LT	203	}
1da177e4 LT	204
d3c5ee6d JE	205	module_init(connmark_mt_init);
d3c5ee6d JE	206	module_exit(connmark_mt_exit);