[deliverable/linux.git] / net / netfilter / xt_state.c

/* Kernel module to match connection tracking information. */

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2005 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/netfilter/nf_conntrack_compat.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_state.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
MODULE_DESCRIPTION("ip[6]_tables connection tracking state match module");
MODULE_ALIAS("ipt_state");
MODULE_ALIAS("ip6t_state");

static int
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const struct xt_match *match,
      const void *matchinfo,
      int offset,
      unsigned int protoff,
      int *hotdrop)
{
	const struct xt_state_info *sinfo = matchinfo;
	enum ip_conntrack_info ctinfo;
	unsigned int statebit;

	if (nf_ct_is_untracked(skb))
		statebit = XT_STATE_UNTRACKED;
	else if (!nf_ct_get_ctinfo(skb, &ctinfo))
		statebit = XT_STATE_INVALID;
	else
		statebit = XT_STATE_BIT(ctinfo);

	return (sinfo->statemask & statebit);
}

static int check(const char *tablename,
		 const void *inf,
		 const struct xt_match *match,
		 void *matchinfo,
		 unsigned int hook_mask)
{
#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
	if (nf_ct_l3proto_try_module_get(match->family) < 0) {
		printk(KERN_WARNING "can't load nf_conntrack support for "
				    "proto=%d\n", match->family);
		return 0;
	}
#endif
	return 1;
}

static void
destroy(const struct xt_match *match, void *matchinfo)
{
#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
	nf_ct_l3proto_module_put(match->family);
#endif
}

static struct xt_match xt_state_match[] = {
	{
		.name		= "state",
		.family		= AF_INET,
		.checkentry	= check,
		.match		= match,
		.destroy	= destroy,
		.matchsize	= sizeof(struct xt_state_info),
		.me		= THIS_MODULE,
	},
	{
		.name		= "state",
		.family		= AF_INET6,
		.checkentry	= check,
		.match		= match,
		.destroy	= destroy,
		.matchsize	= sizeof(struct xt_state_info),
		.me		= THIS_MODULE,
	},
};

static int __init xt_state_init(void)
{
	need_conntrack();
	return xt_register_matches(xt_state_match, ARRAY_SIZE(xt_state_match));
}

static void __exit xt_state_fini(void)
{
	xt_unregister_matches(xt_state_match, ARRAY_SIZE(xt_state_match));
}

module_init(xt_state_init);
module_exit(xt_state_fini);
Commit	Line	Data
1da177e4 LT	1	/* Kernel module to match connection tracking information. */
	2
	3	/* (C) 1999-2001 Paul `Rusty' Russell
2e4e6a17	4	* (C) 2002-2005 Netfilter Core Team <coreteam@netfilter.org>
1da177e4 LT	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
	11	#include <linux/module.h>
	12	#include <linux/skbuff.h>
9fb9cbb1	13	#include <net/netfilter/nf_conntrack_compat.h>
2e4e6a17 HW	14	#include <linux/netfilter/x_tables.h>
2e4e6a17 HW	15	#include <linux/netfilter/xt_state.h>
1da177e4 LT	16
	17	MODULE_LICENSE("GPL");
	18	MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
2e4e6a17 HW	19	MODULE_DESCRIPTION("ip[6]_tables connection tracking state match module");
	20	MODULE_ALIAS("ipt_state");
	21	MODULE_ALIAS("ip6t_state");
1da177e4 LT	22
	23	static int
	24	match(const struct sk_buff *skb,
	25	const struct net_device *in,
	26	const struct net_device *out,
c4986734	27	const struct xt_match *match,
1da177e4 LT	28	const void *matchinfo,
1da177e4 LT	29	int offset,
2e4e6a17	30	unsigned int protoff,
1da177e4 LT	31	int *hotdrop)
1da177e4 LT	32	{
2e4e6a17	33	const struct xt_state_info *sinfo = matchinfo;
1da177e4 LT	34	enum ip_conntrack_info ctinfo;
	35	unsigned int statebit;
	36
9fb9cbb1	37	if (nf_ct_is_untracked(skb))
2e4e6a17	38	statebit = XT_STATE_UNTRACKED;
9fb9cbb1	39	else if (!nf_ct_get_ctinfo(skb, &ctinfo))
2e4e6a17	40	statebit = XT_STATE_INVALID;
1da177e4	41	else
2e4e6a17	42	statebit = XT_STATE_BIT(ctinfo);
1da177e4 LT	43
	44	return (sinfo->statemask & statebit);
	45	}
	46
b9f78f9f PNA	47	static int check(const char *tablename,
	48	const void *inf,
	49	const struct xt_match *match,
	50	void *matchinfo,
b9f78f9f PNA	51	unsigned int hook_mask)
	52	{
	53	#if defined(CONFIG_NF_CONNTRACK) \|\| defined(CONFIG_NF_CONNTRACK_MODULE)
	54	if (nf_ct_l3proto_try_module_get(match->family) < 0) {
	55	printk(KERN_WARNING "can't load nf_conntrack support for "
	56	"proto=%d\n", match->family);
	57	return 0;
	58	}
	59	#endif
	60	return 1;
	61	}
	62
	63	static void
efa74165	64	destroy(const struct xt_match match, void matchinfo)
b9f78f9f PNA	65	{
	66	#if defined(CONFIG_NF_CONNTRACK) \|\| defined(CONFIG_NF_CONNTRACK_MODULE)
	67	nf_ct_l3proto_module_put(match->family);
	68	#endif
	69	}
	70
4470bbc7 PM	71	static struct xt_match xt_state_match[] = {
	72	{
	73	.name = "state",
	74	.family = AF_INET,
	75	.checkentry = check,
	76	.match = match,
	77	.destroy = destroy,
	78	.matchsize = sizeof(struct xt_state_info),
	79	.me = THIS_MODULE,
	80	},
	81	{
	82	.name = "state",
	83	.family = AF_INET6,
	84	.checkentry = check,
	85	.match = match,
	86	.destroy = destroy,
	87	.matchsize = sizeof(struct xt_state_info),
	88	.me = THIS_MODULE,
	89	},
1da177e4 LT	90	};
1da177e4 LT	91
65b4b4e8	92	static int __init xt_state_init(void)
1da177e4	93	{
2e4e6a17	94	need_conntrack();
4470bbc7	95	return xt_register_matches(xt_state_match, ARRAY_SIZE(xt_state_match));
1da177e4 LT	96	}
1da177e4 LT	97
65b4b4e8	98	static void __exit xt_state_fini(void)
1da177e4	99	{
4470bbc7	100	xt_unregister_matches(xt_state_match, ARRAY_SIZE(xt_state_match));
1da177e4 LT	101	}
1da177e4 LT	102
65b4b4e8 AM	103	module_init(xt_state_init);
65b4b4e8 AM	104	module_exit(xt_state_fini);