Commit | Line | Data |
---|---|---|
64eb12f9 JE |
1 | /* |
2 | * xt_conntrack - Netfilter module to match connection tracking | |
3 | * information. (Superset of Rusty's minimalistic state match.) | |
1da177e4 | 4 | * |
64eb12f9 JE |
5 | * (C) 2001 Marc Boucher (marc@mbsi.ca). |
6 | * Copyright © CC Computer Consultants GmbH, 2007 - 2008 | |
1da177e4 | 7 | * |
64eb12f9 JE |
8 | * This program is free software; you can redistribute it and/or modify |
9 | * it under the terms of the GNU General Public License version 2 as | |
10 | * published by the Free Software Foundation. | |
1da177e4 LT |
11 | */ |
12 | ||
13 | #include <linux/module.h> | |
14 | #include <linux/skbuff.h> | |
64eb12f9 | 15 | #include <net/ipv6.h> |
2e4e6a17 HW |
16 | #include <linux/netfilter/x_tables.h> |
17 | #include <linux/netfilter/xt_conntrack.h> | |
587aa641 | 18 | #include <net/netfilter/nf_conntrack.h> |
1da177e4 LT |
19 | |
20 | MODULE_LICENSE("GPL"); | |
21 | MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>"); | |
9e05ec4b | 22 | MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>"); |
2ae15b64 | 23 | MODULE_DESCRIPTION("Xtables: connection tracking state match"); |
2e4e6a17 | 24 | MODULE_ALIAS("ipt_conntrack"); |
64eb12f9 | 25 | MODULE_ALIAS("ip6t_conntrack"); |
1da177e4 | 26 | |
64eb12f9 JE |
27 | static bool |
28 | conntrack_addrcmp(const union nf_inet_addr *kaddr, | |
29 | const union nf_inet_addr *uaddr, | |
30 | const union nf_inet_addr *umask, unsigned int l3proto) | |
31 | { | |
ee999d8b | 32 | if (l3proto == NFPROTO_IPV4) |
6556874d | 33 | return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0; |
ee999d8b | 34 | else if (l3proto == NFPROTO_IPV6) |
64eb12f9 JE |
35 | return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6, |
36 | &uaddr->in6) == 0; | |
37 | else | |
38 | return false; | |
39 | } | |
40 | ||
41 | static inline bool | |
42 | conntrack_mt_origsrc(const struct nf_conn *ct, | |
d6d3f08b | 43 | const struct xt_conntrack_mtinfo2 *info, |
76108cea | 44 | u_int8_t family) |
64eb12f9 JE |
45 | { |
46 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3, | |
47 | &info->origsrc_addr, &info->origsrc_mask, family); | |
48 | } | |
49 | ||
50 | static inline bool | |
51 | conntrack_mt_origdst(const struct nf_conn *ct, | |
d6d3f08b | 52 | const struct xt_conntrack_mtinfo2 *info, |
76108cea | 53 | u_int8_t family) |
64eb12f9 JE |
54 | { |
55 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3, | |
56 | &info->origdst_addr, &info->origdst_mask, family); | |
57 | } | |
58 | ||
59 | static inline bool | |
60 | conntrack_mt_replsrc(const struct nf_conn *ct, | |
d6d3f08b | 61 | const struct xt_conntrack_mtinfo2 *info, |
76108cea | 62 | u_int8_t family) |
64eb12f9 JE |
63 | { |
64 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3, | |
65 | &info->replsrc_addr, &info->replsrc_mask, family); | |
66 | } | |
67 | ||
68 | static inline bool | |
69 | conntrack_mt_repldst(const struct nf_conn *ct, | |
d6d3f08b | 70 | const struct xt_conntrack_mtinfo2 *info, |
76108cea | 71 | u_int8_t family) |
64eb12f9 JE |
72 | { |
73 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3, | |
74 | &info->repldst_addr, &info->repldst_mask, family); | |
75 | } | |
76 | ||
b4164998 | 77 | static inline bool |
d6d3f08b | 78 | ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info, |
b4164998 JE |
79 | const struct nf_conn *ct) |
80 | { | |
81 | const struct nf_conntrack_tuple *tuple; | |
82 | ||
83 | tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; | |
84 | if ((info->match_flags & XT_CONNTRACK_PROTO) && | |
5e8fbe2a | 85 | (nf_ct_protonum(ct) == info->l4proto) ^ |
b4164998 JE |
86 | !(info->invert_flags & XT_CONNTRACK_PROTO)) |
87 | return false; | |
88 | ||
89 | /* Shortcut to match all recognized protocols by using ->src.all. */ | |
90 | if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) && | |
91 | (tuple->src.u.all == info->origsrc_port) ^ | |
92 | !(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT)) | |
93 | return false; | |
94 | ||
95 | if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) && | |
96 | (tuple->dst.u.all == info->origdst_port) ^ | |
97 | !(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT)) | |
98 | return false; | |
99 | ||
100 | tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple; | |
101 | ||
102 | if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) && | |
103 | (tuple->src.u.all == info->replsrc_port) ^ | |
104 | !(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT)) | |
105 | return false; | |
106 | ||
107 | if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) && | |
108 | (tuple->dst.u.all == info->repldst_port) ^ | |
109 | !(info->invert_flags & XT_CONNTRACK_REPLDST_PORT)) | |
110 | return false; | |
111 | ||
112 | return true; | |
113 | } | |
114 | ||
64eb12f9 | 115 | static bool |
f7108a20 | 116 | conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par) |
64eb12f9 | 117 | { |
d6d3f08b | 118 | const struct xt_conntrack_mtinfo2 *info = par->matchinfo; |
64eb12f9 JE |
119 | enum ip_conntrack_info ctinfo; |
120 | const struct nf_conn *ct; | |
121 | unsigned int statebit; | |
122 | ||
123 | ct = nf_ct_get(skb, &ctinfo); | |
124 | ||
125 | if (ct == &nf_conntrack_untracked) | |
126 | statebit = XT_CONNTRACK_STATE_UNTRACKED; | |
127 | else if (ct != NULL) | |
128 | statebit = XT_CONNTRACK_STATE_BIT(ctinfo); | |
129 | else | |
130 | statebit = XT_CONNTRACK_STATE_INVALID; | |
131 | ||
132 | if (info->match_flags & XT_CONNTRACK_STATE) { | |
133 | if (ct != NULL) { | |
134 | if (test_bit(IPS_SRC_NAT_BIT, &ct->status)) | |
135 | statebit |= XT_CONNTRACK_STATE_SNAT; | |
136 | if (test_bit(IPS_DST_NAT_BIT, &ct->status)) | |
137 | statebit |= XT_CONNTRACK_STATE_DNAT; | |
138 | } | |
d61f89e9 | 139 | if (!!(info->state_mask & statebit) ^ |
64eb12f9 JE |
140 | !(info->invert_flags & XT_CONNTRACK_STATE)) |
141 | return false; | |
142 | } | |
143 | ||
144 | if (ct == NULL) | |
145 | return info->match_flags & XT_CONNTRACK_STATE; | |
b4164998 JE |
146 | if ((info->match_flags & XT_CONNTRACK_DIRECTION) && |
147 | (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^ | |
148 | !!(info->invert_flags & XT_CONNTRACK_DIRECTION)) | |
64eb12f9 JE |
149 | return false; |
150 | ||
151 | if (info->match_flags & XT_CONNTRACK_ORIGSRC) | |
92f3b2b1 | 152 | if (conntrack_mt_origsrc(ct, info, par->family) ^ |
64eb12f9 JE |
153 | !(info->invert_flags & XT_CONNTRACK_ORIGSRC)) |
154 | return false; | |
155 | ||
156 | if (info->match_flags & XT_CONNTRACK_ORIGDST) | |
92f3b2b1 | 157 | if (conntrack_mt_origdst(ct, info, par->family) ^ |
64eb12f9 JE |
158 | !(info->invert_flags & XT_CONNTRACK_ORIGDST)) |
159 | return false; | |
160 | ||
161 | if (info->match_flags & XT_CONNTRACK_REPLSRC) | |
92f3b2b1 | 162 | if (conntrack_mt_replsrc(ct, info, par->family) ^ |
64eb12f9 JE |
163 | !(info->invert_flags & XT_CONNTRACK_REPLSRC)) |
164 | return false; | |
165 | ||
166 | if (info->match_flags & XT_CONNTRACK_REPLDST) | |
92f3b2b1 | 167 | if (conntrack_mt_repldst(ct, info, par->family) ^ |
64eb12f9 JE |
168 | !(info->invert_flags & XT_CONNTRACK_REPLDST)) |
169 | return false; | |
170 | ||
b4164998 JE |
171 | if (!ct_proto_port_check(info, ct)) |
172 | return false; | |
173 | ||
64eb12f9 JE |
174 | if ((info->match_flags & XT_CONNTRACK_STATUS) && |
175 | (!!(info->status_mask & ct->status) ^ | |
176 | !(info->invert_flags & XT_CONNTRACK_STATUS))) | |
177 | return false; | |
178 | ||
179 | if (info->match_flags & XT_CONNTRACK_EXPIRES) { | |
180 | unsigned long expires = 0; | |
181 | ||
182 | if (timer_pending(&ct->timeout)) | |
183 | expires = (ct->timeout.expires - jiffies) / HZ; | |
184 | if ((expires >= info->expires_min && | |
185 | expires <= info->expires_max) ^ | |
186 | !(info->invert_flags & XT_CONNTRACK_EXPIRES)) | |
187 | return false; | |
188 | } | |
189 | return true; | |
190 | } | |
191 | ||
d6d3f08b JE |
192 | static bool |
193 | conntrack_mt_v1(const struct sk_buff *skb, const struct xt_match_param *par) | |
194 | { | |
195 | const struct xt_conntrack_mtinfo2 *const *info = par->matchinfo; | |
196 | struct xt_match_param newpar = *par; | |
197 | ||
198 | newpar.matchinfo = *info; | |
199 | return conntrack_mt(skb, &newpar); | |
200 | } | |
201 | ||
9b4fce7a | 202 | static bool conntrack_mt_check(const struct xt_mtchk_param *par) |
b9f78f9f | 203 | { |
92f3b2b1 | 204 | if (nf_ct_l3proto_try_module_get(par->family) < 0) { |
fe0b9294 | 205 | printk(KERN_WARNING "can't load conntrack support for " |
92f3b2b1 | 206 | "proto=%u\n", par->family); |
ccb79bdc | 207 | return false; |
b9f78f9f | 208 | } |
ccb79bdc | 209 | return true; |
b9f78f9f PNA |
210 | } |
211 | ||
d6d3f08b JE |
212 | static bool conntrack_mt_check_v1(const struct xt_mtchk_param *par) |
213 | { | |
214 | struct xt_conntrack_mtinfo1 *info = par->matchinfo; | |
215 | struct xt_conntrack_mtinfo2 *up; | |
216 | int ret = conntrack_mt_check(par); | |
217 | ||
218 | if (ret < 0) | |
219 | return ret; | |
220 | ||
221 | up = kmalloc(sizeof(*up), GFP_KERNEL); | |
222 | if (up == NULL) { | |
223 | nf_ct_l3proto_module_put(par->family); | |
224 | return -ENOMEM; | |
225 | } | |
226 | ||
227 | /* | |
228 | * The strategy here is to minimize the overhead of v1 matching, | |
229 | * by prebuilding a v2 struct and putting the pointer into the | |
230 | * v1 dataspace. | |
231 | */ | |
232 | memcpy(up, info, offsetof(typeof(*info), state_mask)); | |
233 | up->state_mask = info->state_mask; | |
234 | up->status_mask = info->status_mask; | |
235 | *(void **)info = up; | |
236 | return true; | |
237 | } | |
238 | ||
6be3d859 | 239 | static void conntrack_mt_destroy(const struct xt_mtdtor_param *par) |
b9f78f9f | 240 | { |
92f3b2b1 | 241 | nf_ct_l3proto_module_put(par->family); |
b9f78f9f PNA |
242 | } |
243 | ||
d6d3f08b JE |
244 | static void conntrack_mt_destroy_v1(const struct xt_mtdtor_param *par) |
245 | { | |
246 | struct xt_conntrack_mtinfo2 **info = par->matchinfo; | |
247 | kfree(*info); | |
248 | conntrack_mt_destroy(par); | |
249 | } | |
250 | ||
64eb12f9 | 251 | static struct xt_match conntrack_mt_reg[] __read_mostly = { |
64eb12f9 JE |
252 | { |
253 | .name = "conntrack", | |
254 | .revision = 1, | |
92f3b2b1 | 255 | .family = NFPROTO_UNSPEC, |
64eb12f9 | 256 | .matchsize = sizeof(struct xt_conntrack_mtinfo1), |
d6d3f08b JE |
257 | .match = conntrack_mt_v1, |
258 | .checkentry = conntrack_mt_check_v1, | |
259 | .destroy = conntrack_mt_destroy_v1, | |
260 | .me = THIS_MODULE, | |
261 | }, | |
262 | { | |
263 | .name = "conntrack", | |
264 | .revision = 2, | |
265 | .family = NFPROTO_UNSPEC, | |
266 | .matchsize = sizeof(struct xt_conntrack_mtinfo2), | |
64eb12f9 JE |
267 | .match = conntrack_mt, |
268 | .checkentry = conntrack_mt_check, | |
269 | .destroy = conntrack_mt_destroy, | |
270 | .me = THIS_MODULE, | |
271 | }, | |
1da177e4 LT |
272 | }; |
273 | ||
d3c5ee6d | 274 | static int __init conntrack_mt_init(void) |
1da177e4 | 275 | { |
64eb12f9 JE |
276 | return xt_register_matches(conntrack_mt_reg, |
277 | ARRAY_SIZE(conntrack_mt_reg)); | |
1da177e4 LT |
278 | } |
279 | ||
d3c5ee6d | 280 | static void __exit conntrack_mt_exit(void) |
1da177e4 | 281 | { |
64eb12f9 | 282 | xt_unregister_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg)); |
1da177e4 LT |
283 | } |
284 | ||
d3c5ee6d JE |
285 | module_init(conntrack_mt_init); |
286 | module_exit(conntrack_mt_exit); |