2 * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9 #include <linux/module.h>
10 #include <linux/gfp.h>
11 #include <linux/skbuff.h>
12 #include <linux/netfilter_ipv4/ip_tables.h>
13 #include <linux/netfilter_ipv6/ip6_tables.h>
14 #include <linux/netfilter/x_tables.h>
15 #include <linux/netfilter/xt_CT.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_l4proto.h>
18 #include <net/netfilter/nf_conntrack_helper.h>
19 #include <net/netfilter/nf_conntrack_ecache.h>
20 #include <net/netfilter/nf_conntrack_timeout.h>
21 #include <net/netfilter/nf_conntrack_zones.h>
23 static inline int xt_ct_target(struct sk_buff
*skb
, struct nf_conn
*ct
)
25 /* Previously seen (loopback)? Ignore. */
26 if (skb
->nfct
!= NULL
)
29 /* special case the untracked ct : we want the percpu object */
31 ct
= nf_ct_untracked_get();
32 atomic_inc(&ct
->ct_general
.use
);
33 skb
->nfct
= &ct
->ct_general
;
34 skb
->nfctinfo
= IP_CT_NEW
;
39 static unsigned int xt_ct_target_v0(struct sk_buff
*skb
,
40 const struct xt_action_param
*par
)
42 const struct xt_ct_target_info
*info
= par
->targinfo
;
43 struct nf_conn
*ct
= info
->ct
;
45 return xt_ct_target(skb
, ct
);
48 static unsigned int xt_ct_target_v1(struct sk_buff
*skb
,
49 const struct xt_action_param
*par
)
51 const struct xt_ct_target_info_v1
*info
= par
->targinfo
;
52 struct nf_conn
*ct
= info
->ct
;
54 return xt_ct_target(skb
, ct
);
57 static u8
xt_ct_find_proto(const struct xt_tgchk_param
*par
)
59 if (par
->family
== NFPROTO_IPV4
) {
60 const struct ipt_entry
*e
= par
->entryinfo
;
62 if (e
->ip
.invflags
& IPT_INV_PROTO
)
65 } else if (par
->family
== NFPROTO_IPV6
) {
66 const struct ip6t_entry
*e
= par
->entryinfo
;
68 if (e
->ipv6
.invflags
& IP6T_INV_PROTO
)
76 xt_ct_set_helper(struct nf_conn
*ct
, const char *helper_name
,
77 const struct xt_tgchk_param
*par
)
79 struct nf_conntrack_helper
*helper
;
80 struct nf_conn_help
*help
;
83 proto
= xt_ct_find_proto(par
);
85 pr_info("You must specify a L4 protocol, and not use "
86 "inversions on it.\n");
90 helper
= nf_conntrack_helper_try_module_get(helper_name
, par
->family
,
93 pr_info("No such helper \"%s\"\n", helper_name
);
97 help
= nf_ct_helper_ext_add(ct
, helper
, GFP_KERNEL
);
99 module_put(helper
->me
);
103 help
->helper
= helper
;
107 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
108 static void __xt_ct_tg_timeout_put(struct ctnl_timeout
*timeout
)
110 typeof(nf_ct_timeout_put_hook
) timeout_put
;
112 timeout_put
= rcu_dereference(nf_ct_timeout_put_hook
);
114 timeout_put(timeout
);
119 xt_ct_set_timeout(struct nf_conn
*ct
, const struct xt_tgchk_param
*par
,
120 const char *timeout_name
)
122 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
123 typeof(nf_ct_timeout_find_get_hook
) timeout_find_get
;
124 struct ctnl_timeout
*timeout
;
125 struct nf_conn_timeout
*timeout_ext
;
126 struct nf_conntrack_l4proto
*l4proto
;
131 timeout_find_get
= rcu_dereference(nf_ct_timeout_find_get_hook
);
132 if (timeout_find_get
== NULL
) {
134 pr_info("Timeout policy base is empty\n");
138 proto
= xt_ct_find_proto(par
);
141 pr_info("You must specify a L4 protocol, and not use "
142 "inversions on it.\n");
146 timeout
= timeout_find_get(timeout_name
);
147 if (timeout
== NULL
) {
149 pr_info("No such timeout policy \"%s\"\n", timeout_name
);
153 if (timeout
->l3num
!= par
->family
) {
155 pr_info("Timeout policy `%s' can only be used by L3 protocol "
156 "number %d\n", timeout_name
, timeout
->l3num
);
157 goto err_put_timeout
;
159 /* Make sure the timeout policy matches any existing protocol tracker,
160 * otherwise default to generic.
162 l4proto
= __nf_ct_l4proto_find(par
->family
, proto
);
163 if (timeout
->l4proto
->l4proto
!= l4proto
->l4proto
) {
165 pr_info("Timeout policy `%s' can only be used by L4 protocol "
167 timeout_name
, timeout
->l4proto
->l4proto
);
168 goto err_put_timeout
;
170 timeout_ext
= nf_ct_timeout_ext_add(ct
, timeout
, GFP_ATOMIC
);
171 if (timeout_ext
== NULL
)
175 __xt_ct_tg_timeout_put(timeout
);
184 static u16
xt_ct_flags_to_dir(const struct xt_ct_target_info_v1
*info
)
186 switch (info
->flags
& (XT_CT_ZONE_DIR_ORIG
|
187 XT_CT_ZONE_DIR_REPL
)) {
188 case XT_CT_ZONE_DIR_ORIG
:
189 return NF_CT_ZONE_DIR_ORIG
;
190 case XT_CT_ZONE_DIR_REPL
:
191 return NF_CT_ZONE_DIR_REPL
;
193 return NF_CT_DEFAULT_ZONE_DIR
;
197 static int xt_ct_tg_check(const struct xt_tgchk_param
*par
,
198 struct xt_ct_target_info_v1
*info
)
200 struct nf_conntrack_zone zone
;
202 int ret
= -EOPNOTSUPP
;
204 if (info
->flags
& XT_CT_NOTRACK
) {
209 #ifndef CONFIG_NF_CONNTRACK_ZONES
210 if (info
->zone
|| info
->flags
& (XT_CT_ZONE_DIR_ORIG
|
211 XT_CT_ZONE_DIR_REPL
))
215 ret
= nf_ct_l3proto_try_module_get(par
->family
);
219 memset(&zone
, 0, sizeof(zone
));
220 zone
.id
= info
->zone
;
221 zone
.dir
= xt_ct_flags_to_dir(info
);
223 ct
= nf_ct_tmpl_alloc(par
->net
, &zone
, GFP_KERNEL
);
229 if ((info
->ct_events
|| info
->exp_events
) &&
230 !nf_ct_ecache_ext_add(ct
, info
->ct_events
, info
->exp_events
,
236 if (info
->helper
[0]) {
237 ret
= xt_ct_set_helper(ct
, info
->helper
, par
);
242 if (info
->timeout
[0]) {
243 ret
= xt_ct_set_timeout(ct
, par
, info
->timeout
);
247 __set_bit(IPS_CONFIRMED_BIT
, &ct
->status
);
248 nf_conntrack_get(&ct
->ct_general
);
254 nf_conntrack_free(ct
);
256 nf_ct_l3proto_module_put(par
->family
);
261 static int xt_ct_tg_check_v0(const struct xt_tgchk_param
*par
)
263 struct xt_ct_target_info
*info
= par
->targinfo
;
264 struct xt_ct_target_info_v1 info_v1
= {
265 .flags
= info
->flags
,
267 .ct_events
= info
->ct_events
,
268 .exp_events
= info
->exp_events
,
272 if (info
->flags
& ~XT_CT_NOTRACK
)
275 memcpy(info_v1
.helper
, info
->helper
, sizeof(info
->helper
));
277 ret
= xt_ct_tg_check(par
, &info_v1
);
281 info
->ct
= info_v1
.ct
;
286 static int xt_ct_tg_check_v1(const struct xt_tgchk_param
*par
)
288 struct xt_ct_target_info_v1
*info
= par
->targinfo
;
290 if (info
->flags
& ~XT_CT_NOTRACK
)
293 return xt_ct_tg_check(par
, par
->targinfo
);
296 static int xt_ct_tg_check_v2(const struct xt_tgchk_param
*par
)
298 struct xt_ct_target_info_v1
*info
= par
->targinfo
;
300 if (info
->flags
& ~XT_CT_MASK
)
303 return xt_ct_tg_check(par
, par
->targinfo
);
306 static void xt_ct_destroy_timeout(struct nf_conn
*ct
)
308 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
309 struct nf_conn_timeout
*timeout_ext
;
310 typeof(nf_ct_timeout_put_hook
) timeout_put
;
313 timeout_put
= rcu_dereference(nf_ct_timeout_put_hook
);
316 timeout_ext
= nf_ct_timeout_find(ct
);
318 timeout_put(timeout_ext
->timeout
);
324 static void xt_ct_tg_destroy(const struct xt_tgdtor_param
*par
,
325 struct xt_ct_target_info_v1
*info
)
327 struct nf_conn
*ct
= info
->ct
;
328 struct nf_conn_help
*help
;
330 if (ct
&& !nf_ct_is_untracked(ct
)) {
331 help
= nfct_help(ct
);
333 module_put(help
->helper
->me
);
335 nf_ct_l3proto_module_put(par
->family
);
337 xt_ct_destroy_timeout(ct
);
342 static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param
*par
)
344 struct xt_ct_target_info
*info
= par
->targinfo
;
345 struct xt_ct_target_info_v1 info_v1
= {
346 .flags
= info
->flags
,
348 .ct_events
= info
->ct_events
,
349 .exp_events
= info
->exp_events
,
352 memcpy(info_v1
.helper
, info
->helper
, sizeof(info
->helper
));
354 xt_ct_tg_destroy(par
, &info_v1
);
357 static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param
*par
)
359 xt_ct_tg_destroy(par
, par
->targinfo
);
362 static struct xt_target xt_ct_tg_reg
[] __read_mostly
= {
365 .family
= NFPROTO_UNSPEC
,
366 .targetsize
= sizeof(struct xt_ct_target_info
),
367 .checkentry
= xt_ct_tg_check_v0
,
368 .destroy
= xt_ct_tg_destroy_v0
,
369 .target
= xt_ct_target_v0
,
375 .family
= NFPROTO_UNSPEC
,
377 .targetsize
= sizeof(struct xt_ct_target_info_v1
),
378 .checkentry
= xt_ct_tg_check_v1
,
379 .destroy
= xt_ct_tg_destroy_v1
,
380 .target
= xt_ct_target_v1
,
386 .family
= NFPROTO_UNSPEC
,
388 .targetsize
= sizeof(struct xt_ct_target_info_v1
),
389 .checkentry
= xt_ct_tg_check_v2
,
390 .destroy
= xt_ct_tg_destroy_v1
,
391 .target
= xt_ct_target_v1
,
398 notrack_tg(struct sk_buff
*skb
, const struct xt_action_param
*par
)
400 /* Previously seen (loopback)? Ignore. */
401 if (skb
->nfct
!= NULL
)
404 skb
->nfct
= &nf_ct_untracked_get()->ct_general
;
405 skb
->nfctinfo
= IP_CT_NEW
;
406 nf_conntrack_get(skb
->nfct
);
411 static int notrack_chk(const struct xt_tgchk_param
*par
)
413 if (!par
->net
->xt
.notrack_deprecated_warning
) {
414 pr_info("netfilter: NOTRACK target is deprecated, "
415 "use CT instead or upgrade iptables\n");
416 par
->net
->xt
.notrack_deprecated_warning
= true;
421 static struct xt_target notrack_tg_reg __read_mostly
= {
424 .family
= NFPROTO_UNSPEC
,
425 .checkentry
= notrack_chk
,
426 .target
= notrack_tg
,
431 static int __init
xt_ct_tg_init(void)
435 ret
= xt_register_target(¬rack_tg_reg
);
439 ret
= xt_register_targets(xt_ct_tg_reg
, ARRAY_SIZE(xt_ct_tg_reg
));
441 xt_unregister_target(¬rack_tg_reg
);
447 static void __exit
xt_ct_tg_exit(void)
449 xt_unregister_targets(xt_ct_tg_reg
, ARRAY_SIZE(xt_ct_tg_reg
));
450 xt_unregister_target(¬rack_tg_reg
);
453 module_init(xt_ct_tg_init
);
454 module_exit(xt_ct_tg_exit
);
456 MODULE_LICENSE("GPL");
457 MODULE_DESCRIPTION("Xtables: connection tracking target");
458 MODULE_ALIAS("ipt_CT");
459 MODULE_ALIAS("ip6t_CT");
460 MODULE_ALIAS("ipt_NOTRACK");
461 MODULE_ALIAS("ip6t_NOTRACK");