tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1/*
2 * (C) 2013 Astaro GmbH & Co KG
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 */
8
9#include <linux/module.h>
10#include <linux/skbuff.h>
11#include <net/netfilter/nf_conntrack.h>
12#include <net/netfilter/nf_conntrack_labels.h>
13#include <linux/netfilter/x_tables.h>
14
15MODULE_LICENSE("GPL");
16MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
17MODULE_DESCRIPTION("Xtables: add/match connection trackling labels");
18MODULE_ALIAS("ipt_connlabel");
19MODULE_ALIAS("ip6t_connlabel");
20
21static bool
22connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par)
23{
24 const struct xt_connlabel_mtinfo *info = par->matchinfo;
25 enum ip_conntrack_info ctinfo;
26 struct nf_conn *ct;
27 bool invert = info->options & XT_CONNLABEL_OP_INVERT;
28
29 ct = nf_ct_get(skb, &ctinfo);
30 if (ct == NULL || nf_ct_is_untracked(ct))
31 return invert;
32
33 if (info->options & XT_CONNLABEL_OP_SET)
34 return (nf_connlabel_set(ct, info->bit) == 0) ^ invert;
35
36 return nf_connlabel_match(ct, info->bit) ^ invert;
37}
38
39static int connlabel_mt_check(const struct xt_mtchk_param *par)
40{
41 const int options = XT_CONNLABEL_OP_INVERT |
42 XT_CONNLABEL_OP_SET;
43 struct xt_connlabel_mtinfo *info = par->matchinfo;
44 int ret;
45
46 if (info->options & ~options) {
47 pr_err("Unknown options in mask %x\n", info->options);
48 return -EINVAL;
49 }
50
51 ret = nf_ct_l3proto_try_module_get(par->family);
52 if (ret < 0) {
53 pr_info("cannot load conntrack support for proto=%u\n",
54 par->family);
55 return ret;
56 }
57
58 ret = nf_connlabels_get(par->net, info->bit + 1);
59 if (ret < 0)
60 nf_ct_l3proto_module_put(par->family);
61 return ret;
62}
63
64static void connlabel_mt_destroy(const struct xt_mtdtor_param *par)
65{
66 nf_connlabels_put(par->net);
67 nf_ct_l3proto_module_put(par->family);
68}
69
70static struct xt_match connlabels_mt_reg __read_mostly = {
71 .name = "connlabel",
72 .family = NFPROTO_UNSPEC,
73 .checkentry = connlabel_mt_check,
74 .match = connlabel_mt,
75 .matchsize = sizeof(struct xt_connlabel_mtinfo),
76 .destroy = connlabel_mt_destroy,
77 .me = THIS_MODULE,
78};
79
80static int __init connlabel_mt_init(void)
81{
82 return xt_register_match(&connlabels_mt_reg);
83}
84
85static void __exit connlabel_mt_exit(void)
86{
87 xt_unregister_match(&connlabels_mt_reg);
88}
89
90module_init(connlabel_mt_init);
91module_exit(connlabel_mt_exit);