[linux-block.git] / net / netfilter / xt_socket.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Transparent proxy support for Linux/iptables
 *
 * Copyright (C) 2007-2008 BalaBit IT Ltd.
 * Author: Krisztian Kovacs
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <net/tcp.h>
#include <net/udp.h>
#include <net/icmp.h>
#include <net/sock.h>
#include <net/inet_sock.h>
#include <net/netfilter/ipv4/nf_defrag_ipv4.h>

#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <net/inet6_hashtables.h>
#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
#endif

#include <net/netfilter/nf_socket.h>
#include <linux/netfilter/xt_socket.h>

/* "socket" match based redirection (no specific rule)
 * ===================================================
 *
 * There are connections with dynamic endpoints (e.g. FTP data
 * connection) that the user is unable to add explicit rules
 * for. These are taken care of by a generic "socket" rule. It is
 * assumed that the proxy application is trusted to open such
 * connections without explicit iptables rule (except of course the
 * generic 'socket' rule). In this case the following sockets are
 * matched in preference order:
 *
 *   - match: if there's a fully established connection matching the
 *     _packet_ tuple
 *
 *   - match: if there's a non-zero bound listener (possibly with a
 *     non-local address) We don't accept zero-bound listeners, since
 *     then local services could intercept traffic going through the
 *     box.
 */
static bool
socket_match(const struct sk_buff *skb, struct xt_action_param *par,
	     const struct xt_socket_mtinfo1 *info)
{
	struct sk_buff *pskb = (struct sk_buff *)skb;
	struct sock *sk = skb->sk;

	if (sk && !net_eq(xt_net(par), sock_net(sk)))
		sk = NULL;

	if (!sk)
		sk = nf_sk_lookup_slow_v4(xt_net(par), skb, xt_in(par));

	if (sk) {
		bool wildcard;
		bool transparent = true;

		/* Ignore sockets listening on INADDR_ANY,
		 * unless XT_SOCKET_NOWILDCARD is set
		 */
		wildcard = (!(info->flags & XT_SOCKET_NOWILDCARD) &&
			    sk_fullsock(sk) &&
			    inet_sk(sk)->inet_rcv_saddr == 0);

		/* Ignore non-transparent sockets,
		 * if XT_SOCKET_TRANSPARENT is used
		 */
		if (info->flags & XT_SOCKET_TRANSPARENT)
			transparent = inet_sk_transparent(sk);

		if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
		    transparent && sk_fullsock(sk))
			pskb->mark = READ_ONCE(sk->sk_mark);

		if (sk != skb->sk)
			sock_gen_put(sk);

		if (wildcard || !transparent)
			sk = NULL;
	}

	return sk != NULL;
}

static bool
socket_mt4_v0(const struct sk_buff *skb, struct xt_action_param *par)
{
	static struct xt_socket_mtinfo1 xt_info_v0 = {
		.flags = 0,
	};

	return socket_match(skb, par, &xt_info_v0);
}

static bool
socket_mt4_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
{
	return socket_match(skb, par, par->matchinfo);
}

#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
static bool
socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
	struct sk_buff *pskb = (struct sk_buff *)skb;
	struct sock *sk = skb->sk;

	if (sk && !net_eq(xt_net(par), sock_net(sk)))
		sk = NULL;

	if (!sk)
		sk = nf_sk_lookup_slow_v6(xt_net(par), skb, xt_in(par));

	if (sk) {
		bool wildcard;
		bool transparent = true;

		/* Ignore sockets listening on INADDR_ANY
		 * unless XT_SOCKET_NOWILDCARD is set
		 */
		wildcard = (!(info->flags & XT_SOCKET_NOWILDCARD) &&
			    sk_fullsock(sk) &&
			    ipv6_addr_any(&sk->sk_v6_rcv_saddr));

		/* Ignore non-transparent sockets,
		 * if XT_SOCKET_TRANSPARENT is used
		 */
		if (info->flags & XT_SOCKET_TRANSPARENT)
			transparent = inet_sk_transparent(sk);

		if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
		    transparent && sk_fullsock(sk))
			pskb->mark = READ_ONCE(sk->sk_mark);

		if (sk != skb->sk)
			sock_gen_put(sk);

		if (wildcard || !transparent)
			sk = NULL;
	}

	return sk != NULL;
}
#endif

static int socket_mt_enable_defrag(struct net *net, int family)
{
	switch (family) {
	case NFPROTO_IPV4:
		return nf_defrag_ipv4_enable(net);
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
	case NFPROTO_IPV6:
		return nf_defrag_ipv6_enable(net);
#endif
	}
	WARN_ONCE(1, "Unknown family %d\n", family);
	return 0;
}

static int socket_mt_v1_check(const struct xt_mtchk_param *par)
{
	const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
	int err;

	err = socket_mt_enable_defrag(par->net, par->family);
	if (err)
		return err;

	if (info->flags & ~XT_SOCKET_FLAGS_V1) {
		pr_info_ratelimited("unknown flags 0x%x\n",
				    info->flags & ~XT_SOCKET_FLAGS_V1);
		return -EINVAL;
	}
	return 0;
}

static int socket_mt_v2_check(const struct xt_mtchk_param *par)
{
	const struct xt_socket_mtinfo2 *info = (struct xt_socket_mtinfo2 *) par->matchinfo;
	int err;

	err = socket_mt_enable_defrag(par->net, par->family);
	if (err)
		return err;

	if (info->flags & ~XT_SOCKET_FLAGS_V2) {
		pr_info_ratelimited("unknown flags 0x%x\n",
				    info->flags & ~XT_SOCKET_FLAGS_V2);
		return -EINVAL;
	}
	return 0;
}

static int socket_mt_v3_check(const struct xt_mtchk_param *par)
{
	const struct xt_socket_mtinfo3 *info =
				    (struct xt_socket_mtinfo3 *)par->matchinfo;
	int err;

	err = socket_mt_enable_defrag(par->net, par->family);
	if (err)
		return err;
	if (info->flags & ~XT_SOCKET_FLAGS_V3) {
		pr_info_ratelimited("unknown flags 0x%x\n",
				    info->flags & ~XT_SOCKET_FLAGS_V3);
		return -EINVAL;
	}
	return 0;
}

static void socket_mt_destroy(const struct xt_mtdtor_param *par)
{
	if (par->family == NFPROTO_IPV4)
		nf_defrag_ipv4_disable(par->net);
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
	else if (par->family == NFPROTO_IPV6)
		nf_defrag_ipv6_disable(par->net);
#endif
}

static struct xt_match socket_mt_reg[] __read_mostly = {
	{
		.name		= "socket",
		.revision	= 0,
		.family		= NFPROTO_IPV4,
		.match		= socket_mt4_v0,
		.hooks		= (1 << NF_INET_PRE_ROUTING) |
				  (1 << NF_INET_LOCAL_IN),
		.me		= THIS_MODULE,
	},
	{
		.name		= "socket",
		.revision	= 1,
		.family		= NFPROTO_IPV4,
		.match		= socket_mt4_v1_v2_v3,
		.destroy	= socket_mt_destroy,
		.checkentry	= socket_mt_v1_check,
		.matchsize	= sizeof(struct xt_socket_mtinfo1),
		.hooks		= (1 << NF_INET_PRE_ROUTING) |
				  (1 << NF_INET_LOCAL_IN),
		.me		= THIS_MODULE,
	},
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
	{
		.name		= "socket",
		.revision	= 1,
		.family		= NFPROTO_IPV6,
		.match		= socket_mt6_v1_v2_v3,
		.checkentry	= socket_mt_v1_check,
		.matchsize	= sizeof(struct xt_socket_mtinfo1),
		.destroy	= socket_mt_destroy,
		.hooks		= (1 << NF_INET_PRE_ROUTING) |
				  (1 << NF_INET_LOCAL_IN),
		.me		= THIS_MODULE,
	},
#endif
	{
		.name		= "socket",
		.revision	= 2,
		.family		= NFPROTO_IPV4,
		.match		= socket_mt4_v1_v2_v3,
		.checkentry	= socket_mt_v2_check,
		.destroy	= socket_mt_destroy,
		.matchsize	= sizeof(struct xt_socket_mtinfo1),
		.hooks		= (1 << NF_INET_PRE_ROUTING) |
				  (1 << NF_INET_LOCAL_IN),
		.me		= THIS_MODULE,
	},
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
	{
		.name		= "socket",
		.revision	= 2,
		.family		= NFPROTO_IPV6,
		.match		= socket_mt6_v1_v2_v3,
		.checkentry	= socket_mt_v2_check,
		.destroy	= socket_mt_destroy,
		.matchsize	= sizeof(struct xt_socket_mtinfo1),
		.hooks		= (1 << NF_INET_PRE_ROUTING) |
				  (1 << NF_INET_LOCAL_IN),
		.me		= THIS_MODULE,
	},
#endif
	{
		.name		= "socket",
		.revision	= 3,
		.family		= NFPROTO_IPV4,
		.match		= socket_mt4_v1_v2_v3,
		.checkentry	= socket_mt_v3_check,
		.destroy	= socket_mt_destroy,
		.matchsize	= sizeof(struct xt_socket_mtinfo1),
		.hooks		= (1 << NF_INET_PRE_ROUTING) |
				  (1 << NF_INET_LOCAL_IN),
		.me		= THIS_MODULE,
	},
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
	{
		.name		= "socket",
		.revision	= 3,
		.family		= NFPROTO_IPV6,
		.match		= socket_mt6_v1_v2_v3,
		.checkentry	= socket_mt_v3_check,
		.destroy	= socket_mt_destroy,
		.matchsize	= sizeof(struct xt_socket_mtinfo1),
		.hooks		= (1 << NF_INET_PRE_ROUTING) |
				  (1 << NF_INET_LOCAL_IN),
		.me		= THIS_MODULE,
	},
#endif
};

static int __init socket_mt_init(void)
{
	return xt_register_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
}

static void __exit socket_mt_exit(void)
{
	xt_unregister_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
}

module_init(socket_mt_init);
module_exit(socket_mt_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Krisztian Kovacs, Balazs Scheidler");
MODULE_DESCRIPTION("x_tables socket match module");
MODULE_ALIAS("ipt_socket");
MODULE_ALIAS("ip6t_socket");
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
136cdc71 KK	2	/*
	3	* Transparent proxy support for Linux/iptables
	4	*
	5	* Copyright (C) 2007-2008 BalaBit IT Ltd.
	6	* Author: Krisztian Kovacs
136cdc71	7	*/
ff67e4e4	8	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
136cdc71 KK	9	#include <linux/module.h>
	10	#include <linux/skbuff.h>
	11	#include <linux/netfilter/x_tables.h>
	12	#include <linux/netfilter_ipv4/ip_tables.h>
	13	#include <net/tcp.h>
	14	#include <net/udp.h>
	15	#include <net/icmp.h>
	16	#include <net/sock.h>
	17	#include <net/inet_sock.h>
136cdc71	18	#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
f6318e55	19
c0cd1156	20	#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
f6318e55	21	#include <linux/netfilter_ipv6/ip6_tables.h>
93742cf8	22	#include <net/inet6_hashtables.h>
b64c9256	23	#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
f6318e55	24	#endif
136cdc71	25
8db4c5be	26	#include <net/netfilter/nf_socket.h>
a31e1ffd LAT	27	#include <linux/netfilter/xt_socket.h>
a31e1ffd LAT	28
93742cf8 FW	29	/* "socket" match based redirection (no specific rule)
	30	* ===================================================
	31	*
	32	* There are connections with dynamic endpoints (e.g. FTP data
	33	* connection) that the user is unable to add explicit rules
	34	* for. These are taken care of by a generic "socket" rule. It is
	35	* assumed that the proxy application is trusted to open such
	36	* connections without explicit iptables rule (except of course the
	37	* generic 'socket' rule). In this case the following sockets are
	38	* matched in preference order:
	39	*
	40	* - match: if there's a fully established connection matching the
	41	* _packet_ tuple
	42	*
	43	* - match: if there's a non-zero bound listener (possibly with a
	44	* non-local address) We don't accept zero-bound listeners, since
	45	* then local services could intercept traffic going through the
	46	* box.
	47	*/
d64d80a2 DB	48	static bool
	49	socket_match(const struct sk_buff skb, struct xt_action_param par,
	50	const struct xt_socket_mtinfo1 *info)
	51	{
01555e74	52	struct sk_buff pskb = (struct sk_buff )skb;
d64d80a2 DB	53	struct sock *sk = skb->sk;
d64d80a2 DB	54
40e4f26e	55	if (sk && !net_eq(xt_net(par), sock_net(sk)))
f5646501 FL	56	sk = NULL;
f5646501 FL	57
00028aa3	58	if (!sk)
613dbd95	59	sk = nf_sk_lookup_slow_v4(xt_net(par), skb, xt_in(par));
f5646501	60
00028aa3	61	if (sk) {
a31e1ffd LAT	62	bool wildcard;
	63	bool transparent = true;
	64
681f130f ED	65	/* Ignore sockets listening on INADDR_ANY,
	66	* unless XT_SOCKET_NOWILDCARD is set
	67	*/
	68	wildcard = (!(info->flags & XT_SOCKET_NOWILDCARD) &&
a9407000	69	sk_fullsock(sk) &&
c720c7e8	70	inet_sk(sk)->inet_rcv_saddr == 0);
a31e1ffd LAT	71
a31e1ffd LAT	72	/* Ignore non-transparent sockets,
a9407000 ED	73	* if XT_SOCKET_TRANSPARENT is used
a9407000 ED	74	*/
baf60efa	75	if (info->flags & XT_SOCKET_TRANSPARENT)
8d6e5557	76	transparent = inet_sk_transparent(sk);
136cdc71	77
01555e74	78	if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
89fcbb56	79	transparent && sk_fullsock(sk))
3c5b4d69	80	pskb->mark = READ_ONCE(sk->sk_mark);
01555e74	81
00028aa3	82	if (sk != skb->sk)
1a8bf6ee	83	sock_gen_put(sk);
a31e1ffd LAT	84
a31e1ffd LAT	85	if (wildcard \|\| !transparent)
136cdc71 KK	86	sk = NULL;
	87	}
	88
d64d80a2	89	return sk != NULL;
136cdc71 KK	90	}
136cdc71 KK	91
a31e1ffd	92	static bool
b64c9256	93	socket_mt4_v0(const struct sk_buff skb, struct xt_action_param par)
a31e1ffd	94	{
baf60efa ED	95	static struct xt_socket_mtinfo1 xt_info_v0 = {
	96	.flags = 0,
	97	};
	98
	99	return socket_match(skb, par, &xt_info_v0);
a31e1ffd LAT	100	}
	101
	102	static bool
01555e74	103	socket_mt4_v1_v2_v3(const struct sk_buff skb, struct xt_action_param par)
a31e1ffd LAT	104	{
	105	return socket_match(skb, par, par->matchinfo);
	106	}
	107
8db4c5be	108	#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
d64d80a2	109	static bool
01555e74	110	socket_mt6_v1_v2_v3(const struct sk_buff skb, struct xt_action_param par)
d64d80a2 DB	111	{
d64d80a2 DB	112	const struct xt_socket_mtinfo1 info = (struct xt_socket_mtinfo1 ) par->matchinfo;
01555e74	113	struct sk_buff pskb = (struct sk_buff )skb;
d64d80a2 DB	114	struct sock *sk = skb->sk;
d64d80a2 DB	115
40e4f26e	116	if (sk && !net_eq(xt_net(par), sock_net(sk)))
f5646501 FL	117	sk = NULL;
f5646501 FL	118
00028aa3	119	if (!sk)
613dbd95	120	sk = nf_sk_lookup_slow_v6(xt_net(par), skb, xt_in(par));
f5646501	121
00028aa3	122	if (sk) {
b64c9256 BS	123	bool wildcard;
	124	bool transparent = true;
	125
681f130f ED	126	/* Ignore sockets listening on INADDR_ANY
	127	* unless XT_SOCKET_NOWILDCARD is set
	128	*/
	129	wildcard = (!(info->flags & XT_SOCKET_NOWILDCARD) &&
a9407000	130	sk_fullsock(sk) &&
efe4208f	131	ipv6_addr_any(&sk->sk_v6_rcv_saddr));
b64c9256 BS	132
b64c9256 BS	133	/* Ignore non-transparent sockets,
a9407000 ED	134	* if XT_SOCKET_TRANSPARENT is used
a9407000 ED	135	*/
baf60efa	136	if (info->flags & XT_SOCKET_TRANSPARENT)
8d6e5557	137	transparent = inet_sk_transparent(sk);
b64c9256	138
01555e74	139	if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
89fcbb56	140	transparent && sk_fullsock(sk))
3c5b4d69	141	pskb->mark = READ_ONCE(sk->sk_mark);
01555e74	142
00028aa3	143	if (sk != skb->sk)
1a8bf6ee	144	sock_gen_put(sk);
b64c9256 BS	145
	146	if (wildcard \|\| !transparent)
	147	sk = NULL;
	148	}
	149
d64d80a2	150	return sk != NULL;
b64c9256 BS	151	}
	152	#endif
	153
834184b1 FW	154	static int socket_mt_enable_defrag(struct net *net, int family)
	155	{
	156	switch (family) {
	157	case NFPROTO_IPV4:
	158	return nf_defrag_ipv4_enable(net);
6bd3d192	159	#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
834184b1 FW	160	case NFPROTO_IPV6:
	161	return nf_defrag_ipv6_enable(net);
	162	#endif
	163	}
	164	WARN_ONCE(1, "Unknown family %d\n", family);
	165	return 0;
	166	}
	167
681f130f ED	168	static int socket_mt_v1_check(const struct xt_mtchk_param *par)
	169	{
	170	const struct xt_socket_mtinfo1 info = (struct xt_socket_mtinfo1 ) par->matchinfo;
834184b1 FW	171	int err;
	172
	173	err = socket_mt_enable_defrag(par->net, par->family);
	174	if (err)
	175	return err;
681f130f ED	176
681f130f ED	177	if (info->flags & ~XT_SOCKET_FLAGS_V1) {
b2606644 FW	178	pr_info_ratelimited("unknown flags 0x%x\n",
b2606644 FW	179	info->flags & ~XT_SOCKET_FLAGS_V1);
681f130f ED	180	return -EINVAL;
	181	}
	182	return 0;
	183	}
	184
	185	static int socket_mt_v2_check(const struct xt_mtchk_param *par)
	186	{
	187	const struct xt_socket_mtinfo2 info = (struct xt_socket_mtinfo2 ) par->matchinfo;
834184b1 FW	188	int err;
	189
	190	err = socket_mt_enable_defrag(par->net, par->family);
	191	if (err)
	192	return err;
681f130f ED	193
681f130f ED	194	if (info->flags & ~XT_SOCKET_FLAGS_V2) {
b2606644 FW	195	pr_info_ratelimited("unknown flags 0x%x\n",
b2606644 FW	196	info->flags & ~XT_SOCKET_FLAGS_V2);
681f130f ED	197	return -EINVAL;
	198	}
	199	return 0;
	200	}
	201
01555e74 HH	202	static int socket_mt_v3_check(const struct xt_mtchk_param *par)
	203	{
	204	const struct xt_socket_mtinfo3 *info =
	205	(struct xt_socket_mtinfo3 *)par->matchinfo;
834184b1	206	int err;
01555e74	207
834184b1 FW	208	err = socket_mt_enable_defrag(par->net, par->family);
	209	if (err)
	210	return err;
01555e74	211	if (info->flags & ~XT_SOCKET_FLAGS_V3) {
b2606644 FW	212	pr_info_ratelimited("unknown flags 0x%x\n",
b2606644 FW	213	info->flags & ~XT_SOCKET_FLAGS_V3);
01555e74 HH	214	return -EINVAL;
	215	}
	216	return 0;
	217	}
	218
de8c1211 FW	219	static void socket_mt_destroy(const struct xt_mtdtor_param *par)
	220	{
	221	if (par->family == NFPROTO_IPV4)
	222	nf_defrag_ipv4_disable(par->net);
2874b791	223	#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
de8c1211	224	else if (par->family == NFPROTO_IPV6)
75063c92	225	nf_defrag_ipv6_disable(par->net);
2874b791	226	#endif
de8c1211 FW	227	}
de8c1211 FW	228
a31e1ffd LAT	229	static struct xt_match socket_mt_reg[] __read_mostly = {
	230	{
	231	.name = "socket",
	232	.revision = 0,
	233	.family = NFPROTO_IPV4,
b64c9256	234	.match = socket_mt4_v0,
aa3c487f JE	235	.hooks = (1 << NF_INET_PRE_ROUTING) \|
aa3c487f JE	236	(1 << NF_INET_LOCAL_IN),
a31e1ffd LAT	237	.me = THIS_MODULE,
	238	},
	239	{
	240	.name = "socket",
	241	.revision = 1,
	242	.family = NFPROTO_IPV4,
01555e74	243	.match = socket_mt4_v1_v2_v3,
de8c1211	244	.destroy = socket_mt_destroy,
681f130f	245	.checkentry = socket_mt_v1_check,
a31e1ffd	246	.matchsize = sizeof(struct xt_socket_mtinfo1),
aa3c487f JE	247	.hooks = (1 << NF_INET_PRE_ROUTING) \|
aa3c487f JE	248	(1 << NF_INET_LOCAL_IN),
a31e1ffd LAT	249	.me = THIS_MODULE,
a31e1ffd LAT	250	},
8db4c5be	251	#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
b64c9256 BS	252	{
	253	.name = "socket",
	254	.revision = 1,
	255	.family = NFPROTO_IPV6,
01555e74	256	.match = socket_mt6_v1_v2_v3,
681f130f ED	257	.checkentry = socket_mt_v1_check,
681f130f ED	258	.matchsize = sizeof(struct xt_socket_mtinfo1),
de8c1211	259	.destroy = socket_mt_destroy,
681f130f ED	260	.hooks = (1 << NF_INET_PRE_ROUTING) \|
	261	(1 << NF_INET_LOCAL_IN),
	262	.me = THIS_MODULE,
	263	},
	264	#endif
	265	{
	266	.name = "socket",
	267	.revision = 2,
	268	.family = NFPROTO_IPV4,
01555e74	269	.match = socket_mt4_v1_v2_v3,
681f130f	270	.checkentry = socket_mt_v2_check,
de8c1211	271	.destroy = socket_mt_destroy,
681f130f ED	272	.matchsize = sizeof(struct xt_socket_mtinfo1),
	273	.hooks = (1 << NF_INET_PRE_ROUTING) \|
	274	(1 << NF_INET_LOCAL_IN),
	275	.me = THIS_MODULE,
	276	},
8db4c5be	277	#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
681f130f ED	278	{
	279	.name = "socket",
	280	.revision = 2,
	281	.family = NFPROTO_IPV6,
01555e74	282	.match = socket_mt6_v1_v2_v3,
681f130f	283	.checkentry = socket_mt_v2_check,
de8c1211	284	.destroy = socket_mt_destroy,
b64c9256 BS	285	.matchsize = sizeof(struct xt_socket_mtinfo1),
	286	.hooks = (1 << NF_INET_PRE_ROUTING) \|
	287	(1 << NF_INET_LOCAL_IN),
	288	.me = THIS_MODULE,
	289	},
01555e74 HH	290	#endif
	291	{
	292	.name = "socket",
	293	.revision = 3,
	294	.family = NFPROTO_IPV4,
	295	.match = socket_mt4_v1_v2_v3,
	296	.checkentry = socket_mt_v3_check,
de8c1211	297	.destroy = socket_mt_destroy,
01555e74 HH	298	.matchsize = sizeof(struct xt_socket_mtinfo1),
	299	.hooks = (1 << NF_INET_PRE_ROUTING) \|
	300	(1 << NF_INET_LOCAL_IN),
	301	.me = THIS_MODULE,
	302	},
8db4c5be	303	#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
01555e74 HH	304	{
	305	.name = "socket",
	306	.revision = 3,
	307	.family = NFPROTO_IPV6,
	308	.match = socket_mt6_v1_v2_v3,
	309	.checkentry = socket_mt_v3_check,
de8c1211	310	.destroy = socket_mt_destroy,
01555e74 HH	311	.matchsize = sizeof(struct xt_socket_mtinfo1),
	312	.hooks = (1 << NF_INET_PRE_ROUTING) \|
	313	(1 << NF_INET_LOCAL_IN),
	314	.me = THIS_MODULE,
	315	},
b64c9256	316	#endif
136cdc71 KK	317	};
	318
	319	static int __init socket_mt_init(void)
	320	{
a31e1ffd	321	return xt_register_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
136cdc71 KK	322	}
	323
	324	static void __exit socket_mt_exit(void)
	325	{
a31e1ffd	326	xt_unregister_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
136cdc71 KK	327	}
	328
	329	module_init(socket_mt_init);
	330	module_exit(socket_mt_exit);
	331
	332	MODULE_LICENSE("GPL");
	333	MODULE_AUTHOR("Krisztian Kovacs, Balazs Scheidler");
	334	MODULE_DESCRIPTION("x_tables socket match module");
	335	MODULE_ALIAS("ipt_socket");
b64c9256	336	MODULE_ALIAS("ip6t_socket");