tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1/* iptables module to match on related connections */
2/*
3 * (C) 2001 Martin Josefsson <gandalf@wlug.westbo.se>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 */
9
10#include <linux/module.h>
11#include <linux/skbuff.h>
12#include <linux/netfilter.h>
13#include <net/netfilter/nf_conntrack.h>
14#include <net/netfilter/nf_conntrack_core.h>
15#include <net/netfilter/nf_conntrack_helper.h>
16#include <linux/netfilter/x_tables.h>
17#include <linux/netfilter/xt_helper.h>
18
19MODULE_LICENSE("GPL");
20MODULE_AUTHOR("Martin Josefsson <gandalf@netfilter.org>");
21MODULE_DESCRIPTION("Xtables: Related connection matching");
22MODULE_ALIAS("ipt_helper");
23MODULE_ALIAS("ip6t_helper");
24
25
26static bool
27helper_mt(const struct sk_buff *skb, const struct net_device *in,
28 const struct net_device *out, const struct xt_match *match,
29 const void *matchinfo, int offset, unsigned int protoff,
30 bool *hotdrop)
31{
32 const struct xt_helper_info *info = matchinfo;
33 const struct nf_conn *ct;
34 const struct nf_conn_help *master_help;
35 const struct nf_conntrack_helper *helper;
36 enum ip_conntrack_info ctinfo;
37 bool ret = info->invert;
38
39 ct = nf_ct_get(skb, &ctinfo);
40 if (!ct || !ct->master)
41 return ret;
42
43 master_help = nfct_help(ct->master);
44 if (!master_help)
45 return ret;
46
47 /* rcu_read_lock()ed by nf_hook_slow */
48 helper = rcu_dereference(master_help->helper);
49 if (!helper)
50 return ret;
51
52 if (info->name[0] == '\0')
53 ret = !ret;
54 else
55 ret ^= !strncmp(helper->name, info->name,
56 strlen(helper->name));
57 return ret;
58}
59
60static bool
61helper_mt_check(const char *tablename, const void *inf,
62 const struct xt_match *match, void *matchinfo,
63 unsigned int hook_mask)
64{
65 struct xt_helper_info *info = matchinfo;
66
67 if (nf_ct_l3proto_try_module_get(match->family) < 0) {
68 printk(KERN_WARNING "can't load conntrack support for "
69 "proto=%u\n", match->family);
70 return false;
71 }
72 info->name[29] = '\0';
73 return true;
74}
75
76static void helper_mt_destroy(const struct xt_match *match, void *matchinfo)
77{
78 nf_ct_l3proto_module_put(match->family);
79}
80
81static struct xt_match helper_mt_reg[] __read_mostly = {
82 {
83 .name = "helper",
84 .family = AF_INET,
85 .checkentry = helper_mt_check,
86 .match = helper_mt,
87 .destroy = helper_mt_destroy,
88 .matchsize = sizeof(struct xt_helper_info),
89 .me = THIS_MODULE,
90 },
91 {
92 .name = "helper",
93 .family = AF_INET6,
94 .checkentry = helper_mt_check,
95 .match = helper_mt,
96 .destroy = helper_mt_destroy,
97 .matchsize = sizeof(struct xt_helper_info),
98 .me = THIS_MODULE,
99 },
100};
101
102static int __init helper_mt_init(void)
103{
104 return xt_register_matches(helper_mt_reg, ARRAY_SIZE(helper_mt_reg));
105}
106
107static void __exit helper_mt_exit(void)
108{
109 xt_unregister_matches(helper_mt_reg, ARRAY_SIZE(helper_mt_reg));
110}
111
112module_init(helper_mt_init);
113module_exit(helper_mt_exit);