Root/
1 | /* |
2 | * xt_conntrack - Netfilter module to match connection tracking |
3 | * information. (Superset of Rusty's minimalistic state match.) |
4 | * |
5 | * (C) 2001 Marc Boucher (marc@mbsi.ca). |
6 | * Copyright © CC Computer Consultants GmbH, 2007 - 2008 |
7 | * |
8 | * This program is free software; you can redistribute it and/or modify |
9 | * it under the terms of the GNU General Public License version 2 as |
10 | * published by the Free Software Foundation. |
11 | */ |
12 | |
13 | #include <linux/module.h> |
14 | #include <linux/skbuff.h> |
15 | #include <net/ipv6.h> |
16 | #include <linux/netfilter/x_tables.h> |
17 | #include <linux/netfilter/xt_conntrack.h> |
18 | #include <net/netfilter/nf_conntrack.h> |
19 | |
20 | MODULE_LICENSE("GPL"); |
21 | MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>"); |
22 | MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>"); |
23 | MODULE_DESCRIPTION("Xtables: connection tracking state match"); |
24 | MODULE_ALIAS("ipt_conntrack"); |
25 | MODULE_ALIAS("ip6t_conntrack"); |
26 | |
27 | static bool |
28 | conntrack_addrcmp(const union nf_inet_addr *kaddr, |
29 | const union nf_inet_addr *uaddr, |
30 | const union nf_inet_addr *umask, unsigned int l3proto) |
31 | { |
32 | if (l3proto == NFPROTO_IPV4) |
33 | return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0; |
34 | else if (l3proto == NFPROTO_IPV6) |
35 | return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6, |
36 | &uaddr->in6) == 0; |
37 | else |
38 | return false; |
39 | } |
40 | |
41 | static inline bool |
42 | conntrack_mt_origsrc(const struct nf_conn *ct, |
43 | const struct xt_conntrack_mtinfo2 *info, |
44 | u_int8_t family) |
45 | { |
46 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3, |
47 | &info->origsrc_addr, &info->origsrc_mask, family); |
48 | } |
49 | |
50 | static inline bool |
51 | conntrack_mt_origdst(const struct nf_conn *ct, |
52 | const struct xt_conntrack_mtinfo2 *info, |
53 | u_int8_t family) |
54 | { |
55 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3, |
56 | &info->origdst_addr, &info->origdst_mask, family); |
57 | } |
58 | |
59 | static inline bool |
60 | conntrack_mt_replsrc(const struct nf_conn *ct, |
61 | const struct xt_conntrack_mtinfo2 *info, |
62 | u_int8_t family) |
63 | { |
64 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3, |
65 | &info->replsrc_addr, &info->replsrc_mask, family); |
66 | } |
67 | |
68 | static inline bool |
69 | conntrack_mt_repldst(const struct nf_conn *ct, |
70 | const struct xt_conntrack_mtinfo2 *info, |
71 | u_int8_t family) |
72 | { |
73 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3, |
74 | &info->repldst_addr, &info->repldst_mask, family); |
75 | } |
76 | |
77 | static inline bool |
78 | ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info, |
79 | const struct nf_conn *ct) |
80 | { |
81 | const struct nf_conntrack_tuple *tuple; |
82 | |
83 | tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; |
84 | if ((info->match_flags & XT_CONNTRACK_PROTO) && |
85 | (nf_ct_protonum(ct) == info->l4proto) ^ |
86 | !(info->invert_flags & XT_CONNTRACK_PROTO)) |
87 | return false; |
88 | |
89 | /* Shortcut to match all recognized protocols by using ->src.all. */ |
90 | if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) && |
91 | (tuple->src.u.all == info->origsrc_port) ^ |
92 | !(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT)) |
93 | return false; |
94 | |
95 | if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) && |
96 | (tuple->dst.u.all == info->origdst_port) ^ |
97 | !(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT)) |
98 | return false; |
99 | |
100 | tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple; |
101 | |
102 | if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) && |
103 | (tuple->src.u.all == info->replsrc_port) ^ |
104 | !(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT)) |
105 | return false; |
106 | |
107 | if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) && |
108 | (tuple->dst.u.all == info->repldst_port) ^ |
109 | !(info->invert_flags & XT_CONNTRACK_REPLDST_PORT)) |
110 | return false; |
111 | |
112 | return true; |
113 | } |
114 | |
115 | static bool |
116 | conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par, |
117 | u16 state_mask, u16 status_mask) |
118 | { |
119 | const struct xt_conntrack_mtinfo2 *info = par->matchinfo; |
120 | enum ip_conntrack_info ctinfo; |
121 | const struct nf_conn *ct; |
122 | unsigned int statebit; |
123 | |
124 | ct = nf_ct_get(skb, &ctinfo); |
125 | |
126 | if (ct == &nf_conntrack_untracked) |
127 | statebit = XT_CONNTRACK_STATE_UNTRACKED; |
128 | else if (ct != NULL) |
129 | statebit = XT_CONNTRACK_STATE_BIT(ctinfo); |
130 | else |
131 | statebit = XT_CONNTRACK_STATE_INVALID; |
132 | |
133 | if (info->match_flags & XT_CONNTRACK_STATE) { |
134 | if (ct != NULL) { |
135 | if (test_bit(IPS_SRC_NAT_BIT, &ct->status)) |
136 | statebit |= XT_CONNTRACK_STATE_SNAT; |
137 | if (test_bit(IPS_DST_NAT_BIT, &ct->status)) |
138 | statebit |= XT_CONNTRACK_STATE_DNAT; |
139 | } |
140 | if (!!(state_mask & statebit) ^ |
141 | !(info->invert_flags & XT_CONNTRACK_STATE)) |
142 | return false; |
143 | } |
144 | |
145 | if (ct == NULL) |
146 | return info->match_flags & XT_CONNTRACK_STATE; |
147 | if ((info->match_flags & XT_CONNTRACK_DIRECTION) && |
148 | (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^ |
149 | !!(info->invert_flags & XT_CONNTRACK_DIRECTION)) |
150 | return false; |
151 | |
152 | if (info->match_flags & XT_CONNTRACK_ORIGSRC) |
153 | if (conntrack_mt_origsrc(ct, info, par->family) ^ |
154 | !(info->invert_flags & XT_CONNTRACK_ORIGSRC)) |
155 | return false; |
156 | |
157 | if (info->match_flags & XT_CONNTRACK_ORIGDST) |
158 | if (conntrack_mt_origdst(ct, info, par->family) ^ |
159 | !(info->invert_flags & XT_CONNTRACK_ORIGDST)) |
160 | return false; |
161 | |
162 | if (info->match_flags & XT_CONNTRACK_REPLSRC) |
163 | if (conntrack_mt_replsrc(ct, info, par->family) ^ |
164 | !(info->invert_flags & XT_CONNTRACK_REPLSRC)) |
165 | return false; |
166 | |
167 | if (info->match_flags & XT_CONNTRACK_REPLDST) |
168 | if (conntrack_mt_repldst(ct, info, par->family) ^ |
169 | !(info->invert_flags & XT_CONNTRACK_REPLDST)) |
170 | return false; |
171 | |
172 | if (!ct_proto_port_check(info, ct)) |
173 | return false; |
174 | |
175 | if ((info->match_flags & XT_CONNTRACK_STATUS) && |
176 | (!!(status_mask & ct->status) ^ |
177 | !(info->invert_flags & XT_CONNTRACK_STATUS))) |
178 | return false; |
179 | |
180 | if (info->match_flags & XT_CONNTRACK_EXPIRES) { |
181 | unsigned long expires = 0; |
182 | |
183 | if (timer_pending(&ct->timeout)) |
184 | expires = (ct->timeout.expires - jiffies) / HZ; |
185 | if ((expires >= info->expires_min && |
186 | expires <= info->expires_max) ^ |
187 | !(info->invert_flags & XT_CONNTRACK_EXPIRES)) |
188 | return false; |
189 | } |
190 | return true; |
191 | } |
192 | |
193 | static bool |
194 | conntrack_mt_v1(const struct sk_buff *skb, const struct xt_match_param *par) |
195 | { |
196 | const struct xt_conntrack_mtinfo1 *info = par->matchinfo; |
197 | |
198 | return conntrack_mt(skb, par, info->state_mask, info->status_mask); |
199 | } |
200 | |
201 | static bool |
202 | conntrack_mt_v2(const struct sk_buff *skb, const struct xt_match_param *par) |
203 | { |
204 | const struct xt_conntrack_mtinfo2 *info = par->matchinfo; |
205 | |
206 | return conntrack_mt(skb, par, info->state_mask, info->status_mask); |
207 | } |
208 | |
209 | static bool conntrack_mt_check(const struct xt_mtchk_param *par) |
210 | { |
211 | if (nf_ct_l3proto_try_module_get(par->family) < 0) { |
212 | printk(KERN_WARNING "can't load conntrack support for " |
213 | "proto=%u\n", par->family); |
214 | return false; |
215 | } |
216 | return true; |
217 | } |
218 | |
219 | static void conntrack_mt_destroy(const struct xt_mtdtor_param *par) |
220 | { |
221 | nf_ct_l3proto_module_put(par->family); |
222 | } |
223 | |
224 | static struct xt_match conntrack_mt_reg[] __read_mostly = { |
225 | { |
226 | .name = "conntrack", |
227 | .revision = 1, |
228 | .family = NFPROTO_UNSPEC, |
229 | .matchsize = sizeof(struct xt_conntrack_mtinfo1), |
230 | .match = conntrack_mt_v1, |
231 | .checkentry = conntrack_mt_check, |
232 | .destroy = conntrack_mt_destroy, |
233 | .me = THIS_MODULE, |
234 | }, |
235 | { |
236 | .name = "conntrack", |
237 | .revision = 2, |
238 | .family = NFPROTO_UNSPEC, |
239 | .matchsize = sizeof(struct xt_conntrack_mtinfo2), |
240 | .match = conntrack_mt_v2, |
241 | .checkentry = conntrack_mt_check, |
242 | .destroy = conntrack_mt_destroy, |
243 | .me = THIS_MODULE, |
244 | }, |
245 | }; |
246 | |
247 | static int __init conntrack_mt_init(void) |
248 | { |
249 | return xt_register_matches(conntrack_mt_reg, |
250 | ARRAY_SIZE(conntrack_mt_reg)); |
251 | } |
252 | |
253 | static void __exit conntrack_mt_exit(void) |
254 | { |
255 | xt_unregister_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg)); |
256 | } |
257 | |
258 | module_init(conntrack_mt_init); |
259 | module_exit(conntrack_mt_exit); |
260 |
Branches:
ben-wpan
ben-wpan-stefan
javiroman/ks7010
jz-2.6.34
jz-2.6.34-rc5
jz-2.6.34-rc6
jz-2.6.34-rc7
jz-2.6.35
jz-2.6.36
jz-2.6.37
jz-2.6.38
jz-2.6.39
jz-3.0
jz-3.1
jz-3.11
jz-3.12
jz-3.13
jz-3.15
jz-3.16
jz-3.18-dt
jz-3.2
jz-3.3
jz-3.4
jz-3.5
jz-3.6
jz-3.6-rc2-pwm
jz-3.9
jz-3.9-clk
jz-3.9-rc8
jz47xx
jz47xx-2.6.38
master
Tags:
od-2011-09-04
od-2011-09-18
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v3.9