2 * (C) 2013 Astaro GmbH & Co KG
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
9 #include <linux/module.h>
10 #include <linux/skbuff.h>
11 #include <net/netfilter/nf_conntrack.h>
12 #include <net/netfilter/nf_conntrack_labels.h>
13 #include <linux/netfilter/x_tables.h>
15 MODULE_LICENSE("GPL");
16 MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
17 MODULE_DESCRIPTION("Xtables: add/match connection trackling labels");
18 MODULE_ALIAS("ipt_connlabel");
19 MODULE_ALIAS("ip6t_connlabel");
21 static bool connlabel_match(const struct nf_conn
*ct
, u16 bit
)
23 struct nf_conn_labels
*labels
= nf_ct_labels_find(ct
);
28 return BIT_WORD(bit
) < labels
->words
&& test_bit(bit
, labels
->bits
);
32 connlabel_mt(const struct sk_buff
*skb
, struct xt_action_param
*par
)
34 const struct xt_connlabel_mtinfo
*info
= par
->matchinfo
;
35 enum ip_conntrack_info ctinfo
;
37 bool invert
= info
->options
& XT_CONNLABEL_OP_INVERT
;
39 ct
= nf_ct_get(skb
, &ctinfo
);
40 if (ct
== NULL
|| nf_ct_is_untracked(ct
))
43 if (info
->options
& XT_CONNLABEL_OP_SET
)
44 return (nf_connlabel_set(ct
, info
->bit
) == 0) ^ invert
;
46 return connlabel_match(ct
, info
->bit
) ^ invert
;
49 static int connlabel_mt_check(const struct xt_mtchk_param
*par
)
51 const int options
= XT_CONNLABEL_OP_INVERT
|
53 struct xt_connlabel_mtinfo
*info
= par
->matchinfo
;
56 if (info
->options
& ~options
) {
57 pr_err("Unknown options in mask %x\n", info
->options
);
61 ret
= nf_ct_l3proto_try_module_get(par
->family
);
63 pr_info("cannot load conntrack support for proto=%u\n",
68 ret
= nf_connlabels_get(par
->net
, info
->bit
);
70 nf_ct_l3proto_module_put(par
->family
);
74 static void connlabel_mt_destroy(const struct xt_mtdtor_param
*par
)
76 nf_connlabels_put(par
->net
);
77 nf_ct_l3proto_module_put(par
->family
);
80 static struct xt_match connlabels_mt_reg __read_mostly
= {
82 .family
= NFPROTO_UNSPEC
,
83 .checkentry
= connlabel_mt_check
,
84 .match
= connlabel_mt
,
85 .matchsize
= sizeof(struct xt_connlabel_mtinfo
),
86 .destroy
= connlabel_mt_destroy
,
90 static int __init
connlabel_mt_init(void)
92 return xt_register_match(&connlabels_mt_reg
);
95 static void __exit
connlabel_mt_exit(void)
97 xt_unregister_match(&connlabels_mt_reg
);
100 module_init(connlabel_mt_init
);
101 module_exit(connlabel_mt_exit
);