Commit | Line | Data |
---|---|---|
84f3bb9a PM |
1 | /* |
2 | * Copyright (c) 2010 Patrick McHardy <kaber@trash.net> | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License version 2 as | |
6 | * published by the Free Software Foundation. | |
7 | */ | |
8 | ||
9 | #include <linux/module.h> | |
10 | #include <linux/skbuff.h> | |
11 | #include <linux/selinux.h> | |
12 | #include <linux/netfilter_ipv4/ip_tables.h> | |
13 | #include <linux/netfilter_ipv6/ip6_tables.h> | |
14 | #include <linux/netfilter/x_tables.h> | |
15 | #include <linux/netfilter/xt_CT.h> | |
16 | #include <net/netfilter/nf_conntrack.h> | |
17 | #include <net/netfilter/nf_conntrack_helper.h> | |
18 | #include <net/netfilter/nf_conntrack_ecache.h> | |
19 | ||
20 | static unsigned int xt_ct_target(struct sk_buff *skb, | |
21 | const struct xt_target_param *par) | |
22 | { | |
23 | const struct xt_ct_target_info *info = par->targinfo; | |
24 | struct nf_conn *ct = info->ct; | |
25 | ||
26 | /* Previously seen (loopback)? Ignore. */ | |
27 | if (skb->nfct != NULL) | |
28 | return XT_CONTINUE; | |
29 | ||
30 | atomic_inc(&ct->ct_general.use); | |
31 | skb->nfct = &ct->ct_general; | |
32 | skb->nfctinfo = IP_CT_NEW; | |
33 | ||
34 | return XT_CONTINUE; | |
35 | } | |
36 | ||
37 | static u8 xt_ct_find_proto(const struct xt_tgchk_param *par) | |
38 | { | |
39 | if (par->family == AF_INET) { | |
40 | const struct ipt_entry *e = par->entryinfo; | |
41 | ||
42 | if (e->ip.invflags & IPT_INV_PROTO) | |
43 | return 0; | |
44 | return e->ip.proto; | |
45 | } else if (par->family == AF_INET6) { | |
46 | const struct ip6t_entry *e = par->entryinfo; | |
47 | ||
48 | if (e->ipv6.invflags & IP6T_INV_PROTO) | |
49 | return 0; | |
50 | return e->ipv6.proto; | |
51 | } else | |
52 | return 0; | |
53 | } | |
54 | ||
55 | static bool xt_ct_tg_check(const struct xt_tgchk_param *par) | |
56 | { | |
57 | struct xt_ct_target_info *info = par->targinfo; | |
58 | struct nf_conntrack_tuple t; | |
59 | struct nf_conn_help *help; | |
60 | struct nf_conn *ct; | |
61 | u8 proto; | |
62 | ||
63 | if (info->flags & ~XT_CT_NOTRACK) | |
64 | return false; | |
65 | ||
66 | if (info->flags & XT_CT_NOTRACK) { | |
67 | ct = &nf_conntrack_untracked; | |
68 | atomic_inc(&ct->ct_general.use); | |
69 | goto out; | |
70 | } | |
71 | ||
72 | if (nf_ct_l3proto_try_module_get(par->family) < 0) | |
73 | goto err1; | |
74 | ||
75 | memset(&t, 0, sizeof(t)); | |
76 | ct = nf_conntrack_alloc(par->net, &t, &t, GFP_KERNEL); | |
77 | if (IS_ERR(ct)) | |
78 | goto err2; | |
79 | ||
80 | if ((info->ct_events || info->exp_events) && | |
81 | !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events, | |
82 | GFP_KERNEL)) | |
83 | goto err3; | |
84 | ||
85 | if (info->helper[0]) { | |
86 | proto = xt_ct_find_proto(par); | |
87 | if (!proto) | |
88 | goto err3; | |
89 | ||
90 | help = nf_ct_helper_ext_add(ct, GFP_KERNEL); | |
91 | if (help == NULL) | |
92 | goto err3; | |
93 | ||
94 | help->helper = nf_conntrack_helper_try_module_get(info->helper, | |
95 | par->family, | |
96 | proto); | |
97 | if (help->helper == NULL) | |
98 | goto err3; | |
99 | } | |
100 | ||
101 | __set_bit(IPS_TEMPLATE_BIT, &ct->status); | |
102 | __set_bit(IPS_CONFIRMED_BIT, &ct->status); | |
103 | out: | |
104 | info->ct = ct; | |
105 | return true; | |
106 | ||
107 | err3: | |
108 | nf_conntrack_free(ct); | |
109 | err2: | |
110 | nf_ct_l3proto_module_put(par->family); | |
111 | err1: | |
112 | return false; | |
113 | } | |
114 | ||
115 | static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par) | |
116 | { | |
117 | struct xt_ct_target_info *info = par->targinfo; | |
118 | struct nf_conn *ct = info->ct; | |
119 | struct nf_conn_help *help; | |
120 | ||
121 | if (ct != &nf_conntrack_untracked) { | |
122 | help = nfct_help(ct); | |
123 | if (help) | |
124 | module_put(help->helper->me); | |
125 | ||
126 | nf_ct_l3proto_module_put(par->family); | |
127 | } | |
128 | nf_ct_put(info->ct); | |
129 | } | |
130 | ||
131 | static struct xt_target xt_ct_tg __read_mostly = { | |
132 | .name = "CT", | |
133 | .family = NFPROTO_UNSPEC, | |
134 | .targetsize = XT_ALIGN(sizeof(struct xt_ct_target_info)), | |
135 | .checkentry = xt_ct_tg_check, | |
136 | .destroy = xt_ct_tg_destroy, | |
137 | .target = xt_ct_target, | |
138 | .table = "raw", | |
139 | .me = THIS_MODULE, | |
140 | }; | |
141 | ||
142 | static int __init xt_ct_tg_init(void) | |
143 | { | |
144 | return xt_register_target(&xt_ct_tg); | |
145 | } | |
146 | ||
147 | static void __exit xt_ct_tg_exit(void) | |
148 | { | |
149 | xt_unregister_target(&xt_ct_tg); | |
150 | } | |
151 | ||
152 | module_init(xt_ct_tg_init); | |
153 | module_exit(xt_ct_tg_exit); | |
154 | ||
155 | MODULE_LICENSE("GPL"); | |
156 | MODULE_DESCRIPTION("Xtables: connection tracking target"); | |
157 | MODULE_ALIAS("ipt_CT"); | |
158 | MODULE_ALIAS("ip6t_CT"); |