Root/
1 | /* |
2 | * xt_conntrack - Netfilter module to match connection tracking |
3 | * information. (Superset of Rusty's minimalistic state match.) |
4 | * |
5 | * (C) 2001 Marc Boucher (marc@mbsi.ca). |
6 | * (C) 2006-2012 Patrick McHardy <kaber@trash.net> |
7 | * Copyright © CC Computer Consultants GmbH, 2007 - 2008 |
8 | * |
9 | * This program is free software; you can redistribute it and/or modify |
10 | * it under the terms of the GNU General Public License version 2 as |
11 | * published by the Free Software Foundation. |
12 | */ |
13 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
14 | #include <linux/module.h> |
15 | #include <linux/skbuff.h> |
16 | #include <net/ipv6.h> |
17 | #include <linux/netfilter/x_tables.h> |
18 | #include <linux/netfilter/xt_conntrack.h> |
19 | #include <net/netfilter/nf_conntrack.h> |
20 | |
21 | MODULE_LICENSE("GPL"); |
22 | MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>"); |
23 | MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>"); |
24 | MODULE_DESCRIPTION("Xtables: connection tracking state match"); |
25 | MODULE_ALIAS("ipt_conntrack"); |
26 | MODULE_ALIAS("ip6t_conntrack"); |
27 | |
28 | static bool |
29 | conntrack_addrcmp(const union nf_inet_addr *kaddr, |
30 | const union nf_inet_addr *uaddr, |
31 | const union nf_inet_addr *umask, unsigned int l3proto) |
32 | { |
33 | if (l3proto == NFPROTO_IPV4) |
34 | return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0; |
35 | else if (l3proto == NFPROTO_IPV6) |
36 | return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6, |
37 | &uaddr->in6) == 0; |
38 | else |
39 | return false; |
40 | } |
41 | |
42 | static inline bool |
43 | conntrack_mt_origsrc(const struct nf_conn *ct, |
44 | const struct xt_conntrack_mtinfo2 *info, |
45 | u_int8_t family) |
46 | { |
47 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3, |
48 | &info->origsrc_addr, &info->origsrc_mask, family); |
49 | } |
50 | |
51 | static inline bool |
52 | conntrack_mt_origdst(const struct nf_conn *ct, |
53 | const struct xt_conntrack_mtinfo2 *info, |
54 | u_int8_t family) |
55 | { |
56 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3, |
57 | &info->origdst_addr, &info->origdst_mask, family); |
58 | } |
59 | |
60 | static inline bool |
61 | conntrack_mt_replsrc(const struct nf_conn *ct, |
62 | const struct xt_conntrack_mtinfo2 *info, |
63 | u_int8_t family) |
64 | { |
65 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3, |
66 | &info->replsrc_addr, &info->replsrc_mask, family); |
67 | } |
68 | |
69 | static inline bool |
70 | conntrack_mt_repldst(const struct nf_conn *ct, |
71 | const struct xt_conntrack_mtinfo2 *info, |
72 | u_int8_t family) |
73 | { |
74 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3, |
75 | &info->repldst_addr, &info->repldst_mask, family); |
76 | } |
77 | |
78 | static inline bool |
79 | ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info, |
80 | const struct nf_conn *ct) |
81 | { |
82 | const struct nf_conntrack_tuple *tuple; |
83 | |
84 | tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; |
85 | if ((info->match_flags & XT_CONNTRACK_PROTO) && |
86 | (nf_ct_protonum(ct) == info->l4proto) ^ |
87 | !(info->invert_flags & XT_CONNTRACK_PROTO)) |
88 | return false; |
89 | |
90 | /* Shortcut to match all recognized protocols by using ->src.all. */ |
91 | if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) && |
92 | (tuple->src.u.all == info->origsrc_port) ^ |
93 | !(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT)) |
94 | return false; |
95 | |
96 | if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) && |
97 | (tuple->dst.u.all == info->origdst_port) ^ |
98 | !(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT)) |
99 | return false; |
100 | |
101 | tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple; |
102 | |
103 | if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) && |
104 | (tuple->src.u.all == info->replsrc_port) ^ |
105 | !(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT)) |
106 | return false; |
107 | |
108 | if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) && |
109 | (tuple->dst.u.all == info->repldst_port) ^ |
110 | !(info->invert_flags & XT_CONNTRACK_REPLDST_PORT)) |
111 | return false; |
112 | |
113 | return true; |
114 | } |
115 | |
116 | static inline bool |
117 | port_match(u16 min, u16 max, u16 port, bool invert) |
118 | { |
119 | return (port >= min && port <= max) ^ invert; |
120 | } |
121 | |
122 | static inline bool |
123 | ct_proto_port_check_v3(const struct xt_conntrack_mtinfo3 *info, |
124 | const struct nf_conn *ct) |
125 | { |
126 | const struct nf_conntrack_tuple *tuple; |
127 | |
128 | tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; |
129 | if ((info->match_flags & XT_CONNTRACK_PROTO) && |
130 | (nf_ct_protonum(ct) == info->l4proto) ^ |
131 | !(info->invert_flags & XT_CONNTRACK_PROTO)) |
132 | return false; |
133 | |
134 | /* Shortcut to match all recognized protocols by using ->src.all. */ |
135 | if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) && |
136 | !port_match(info->origsrc_port, info->origsrc_port_high, |
137 | ntohs(tuple->src.u.all), |
138 | info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT)) |
139 | return false; |
140 | |
141 | if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) && |
142 | !port_match(info->origdst_port, info->origdst_port_high, |
143 | ntohs(tuple->dst.u.all), |
144 | info->invert_flags & XT_CONNTRACK_ORIGDST_PORT)) |
145 | return false; |
146 | |
147 | tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple; |
148 | |
149 | if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) && |
150 | !port_match(info->replsrc_port, info->replsrc_port_high, |
151 | ntohs(tuple->src.u.all), |
152 | info->invert_flags & XT_CONNTRACK_REPLSRC_PORT)) |
153 | return false; |
154 | |
155 | if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) && |
156 | !port_match(info->repldst_port, info->repldst_port_high, |
157 | ntohs(tuple->dst.u.all), |
158 | info->invert_flags & XT_CONNTRACK_REPLDST_PORT)) |
159 | return false; |
160 | |
161 | return true; |
162 | } |
163 | |
164 | static bool |
165 | conntrack_mt(const struct sk_buff *skb, struct xt_action_param *par, |
166 | u16 state_mask, u16 status_mask) |
167 | { |
168 | const struct xt_conntrack_mtinfo2 *info = par->matchinfo; |
169 | enum ip_conntrack_info ctinfo; |
170 | const struct nf_conn *ct; |
171 | unsigned int statebit; |
172 | |
173 | ct = nf_ct_get(skb, &ctinfo); |
174 | |
175 | if (ct) { |
176 | if (nf_ct_is_untracked(ct)) |
177 | statebit = XT_CONNTRACK_STATE_UNTRACKED; |
178 | else |
179 | statebit = XT_CONNTRACK_STATE_BIT(ctinfo); |
180 | } else |
181 | statebit = XT_CONNTRACK_STATE_INVALID; |
182 | |
183 | if (info->match_flags & XT_CONNTRACK_STATE) { |
184 | if (ct != NULL) { |
185 | if (test_bit(IPS_SRC_NAT_BIT, &ct->status)) |
186 | statebit |= XT_CONNTRACK_STATE_SNAT; |
187 | if (test_bit(IPS_DST_NAT_BIT, &ct->status)) |
188 | statebit |= XT_CONNTRACK_STATE_DNAT; |
189 | } |
190 | if (!!(state_mask & statebit) ^ |
191 | !(info->invert_flags & XT_CONNTRACK_STATE)) |
192 | return false; |
193 | } |
194 | |
195 | if (ct == NULL) |
196 | return info->match_flags & XT_CONNTRACK_STATE; |
197 | if ((info->match_flags & XT_CONNTRACK_DIRECTION) && |
198 | (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^ |
199 | !(info->invert_flags & XT_CONNTRACK_DIRECTION)) |
200 | return false; |
201 | |
202 | if (info->match_flags & XT_CONNTRACK_ORIGSRC) |
203 | if (conntrack_mt_origsrc(ct, info, par->family) ^ |
204 | !(info->invert_flags & XT_CONNTRACK_ORIGSRC)) |
205 | return false; |
206 | |
207 | if (info->match_flags & XT_CONNTRACK_ORIGDST) |
208 | if (conntrack_mt_origdst(ct, info, par->family) ^ |
209 | !(info->invert_flags & XT_CONNTRACK_ORIGDST)) |
210 | return false; |
211 | |
212 | if (info->match_flags & XT_CONNTRACK_REPLSRC) |
213 | if (conntrack_mt_replsrc(ct, info, par->family) ^ |
214 | !(info->invert_flags & XT_CONNTRACK_REPLSRC)) |
215 | return false; |
216 | |
217 | if (info->match_flags & XT_CONNTRACK_REPLDST) |
218 | if (conntrack_mt_repldst(ct, info, par->family) ^ |
219 | !(info->invert_flags & XT_CONNTRACK_REPLDST)) |
220 | return false; |
221 | |
222 | if (par->match->revision != 3) { |
223 | if (!ct_proto_port_check(info, ct)) |
224 | return false; |
225 | } else { |
226 | if (!ct_proto_port_check_v3(par->matchinfo, ct)) |
227 | return false; |
228 | } |
229 | |
230 | if ((info->match_flags & XT_CONNTRACK_STATUS) && |
231 | (!!(status_mask & ct->status) ^ |
232 | !(info->invert_flags & XT_CONNTRACK_STATUS))) |
233 | return false; |
234 | |
235 | if (info->match_flags & XT_CONNTRACK_EXPIRES) { |
236 | unsigned long expires = 0; |
237 | |
238 | if (timer_pending(&ct->timeout)) |
239 | expires = (ct->timeout.expires - jiffies) / HZ; |
240 | if ((expires >= info->expires_min && |
241 | expires <= info->expires_max) ^ |
242 | !(info->invert_flags & XT_CONNTRACK_EXPIRES)) |
243 | return false; |
244 | } |
245 | return true; |
246 | } |
247 | |
248 | static bool |
249 | conntrack_mt_v1(const struct sk_buff *skb, struct xt_action_param *par) |
250 | { |
251 | const struct xt_conntrack_mtinfo1 *info = par->matchinfo; |
252 | |
253 | return conntrack_mt(skb, par, info->state_mask, info->status_mask); |
254 | } |
255 | |
256 | static bool |
257 | conntrack_mt_v2(const struct sk_buff *skb, struct xt_action_param *par) |
258 | { |
259 | const struct xt_conntrack_mtinfo2 *info = par->matchinfo; |
260 | |
261 | return conntrack_mt(skb, par, info->state_mask, info->status_mask); |
262 | } |
263 | |
264 | static bool |
265 | conntrack_mt_v3(const struct sk_buff *skb, struct xt_action_param *par) |
266 | { |
267 | const struct xt_conntrack_mtinfo3 *info = par->matchinfo; |
268 | |
269 | return conntrack_mt(skb, par, info->state_mask, info->status_mask); |
270 | } |
271 | |
272 | static int conntrack_mt_check(const struct xt_mtchk_param *par) |
273 | { |
274 | int ret; |
275 | |
276 | ret = nf_ct_l3proto_try_module_get(par->family); |
277 | if (ret < 0) |
278 | pr_info("cannot load conntrack support for proto=%u\n", |
279 | par->family); |
280 | return ret; |
281 | } |
282 | |
283 | static void conntrack_mt_destroy(const struct xt_mtdtor_param *par) |
284 | { |
285 | nf_ct_l3proto_module_put(par->family); |
286 | } |
287 | |
288 | static struct xt_match conntrack_mt_reg[] __read_mostly = { |
289 | { |
290 | .name = "conntrack", |
291 | .revision = 1, |
292 | .family = NFPROTO_UNSPEC, |
293 | .matchsize = sizeof(struct xt_conntrack_mtinfo1), |
294 | .match = conntrack_mt_v1, |
295 | .checkentry = conntrack_mt_check, |
296 | .destroy = conntrack_mt_destroy, |
297 | .me = THIS_MODULE, |
298 | }, |
299 | { |
300 | .name = "conntrack", |
301 | .revision = 2, |
302 | .family = NFPROTO_UNSPEC, |
303 | .matchsize = sizeof(struct xt_conntrack_mtinfo2), |
304 | .match = conntrack_mt_v2, |
305 | .checkentry = conntrack_mt_check, |
306 | .destroy = conntrack_mt_destroy, |
307 | .me = THIS_MODULE, |
308 | }, |
309 | { |
310 | .name = "conntrack", |
311 | .revision = 3, |
312 | .family = NFPROTO_UNSPEC, |
313 | .matchsize = sizeof(struct xt_conntrack_mtinfo3), |
314 | .match = conntrack_mt_v3, |
315 | .checkentry = conntrack_mt_check, |
316 | .destroy = conntrack_mt_destroy, |
317 | .me = THIS_MODULE, |
318 | }, |
319 | }; |
320 | |
321 | static int __init conntrack_mt_init(void) |
322 | { |
323 | return xt_register_matches(conntrack_mt_reg, |
324 | ARRAY_SIZE(conntrack_mt_reg)); |
325 | } |
326 | |
327 | static void __exit conntrack_mt_exit(void) |
328 | { |
329 | xt_unregister_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg)); |
330 | } |
331 | |
332 | module_init(conntrack_mt_init); |
333 | module_exit(conntrack_mt_exit); |
334 |
Branches:
ben-wpan
ben-wpan-stefan
javiroman/ks7010
jz-2.6.34
jz-2.6.34-rc5
jz-2.6.34-rc6
jz-2.6.34-rc7
jz-2.6.35
jz-2.6.36
jz-2.6.37
jz-2.6.38
jz-2.6.39
jz-3.0
jz-3.1
jz-3.11
jz-3.12
jz-3.13
jz-3.15
jz-3.16
jz-3.18-dt
jz-3.2
jz-3.3
jz-3.4
jz-3.5
jz-3.6
jz-3.6-rc2-pwm
jz-3.9
jz-3.9-clk
jz-3.9-rc8
jz47xx
jz47xx-2.6.38
master
Tags:
od-2011-09-04
od-2011-09-18
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v3.9