1d2912cb1SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
284f3bb9aSPatrick McHardy /*
384f3bb9aSPatrick McHardy * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
484f3bb9aSPatrick McHardy */
5a7fed762SJan Engelhardt #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
684f3bb9aSPatrick McHardy #include <linux/module.h>
75a0e3ad6STejun Heo #include <linux/gfp.h>
884f3bb9aSPatrick McHardy #include <linux/skbuff.h>
984f3bb9aSPatrick McHardy #include <linux/netfilter_ipv4/ip_tables.h>
1084f3bb9aSPatrick McHardy #include <linux/netfilter_ipv6/ip6_tables.h>
1184f3bb9aSPatrick McHardy #include <linux/netfilter/x_tables.h>
1284f3bb9aSPatrick McHardy #include <linux/netfilter/xt_CT.h>
1384f3bb9aSPatrick McHardy #include <net/netfilter/nf_conntrack.h>
14eeb4cb95SPablo Neira Ayuso #include <net/netfilter/nf_conntrack_l4proto.h>
1584f3bb9aSPatrick McHardy #include <net/netfilter/nf_conntrack_helper.h>
1684f3bb9aSPatrick McHardy #include <net/netfilter/nf_conntrack_ecache.h>
1724de58f4SPablo Neira Ayuso #include <net/netfilter/nf_conntrack_timeout.h>
185d0aa2ccSPatrick McHardy #include <net/netfilter/nf_conntrack_zones.h>
1984f3bb9aSPatrick McHardy
xt_ct_target(struct sk_buff * skb,struct nf_conn * ct)20d52ed437SPablo Neira Ayuso static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
2184f3bb9aSPatrick McHardy {
2284f3bb9aSPatrick McHardy /* Previously seen (loopback)? Ignore. */
23a9e419dcSFlorian Westphal if (skb->_nfct != 0)
2484f3bb9aSPatrick McHardy return XT_CONTINUE;
2584f3bb9aSPatrick McHardy
26cc41c84bSFlorian Westphal if (ct) {
2771977437SFlorian Westphal refcount_inc(&ct->ct_general.use);
28c74454faSFlorian Westphal nf_ct_set(skb, ct, IP_CT_NEW);
29cc41c84bSFlorian Westphal } else {
30cc41c84bSFlorian Westphal nf_ct_set(skb, ct, IP_CT_UNTRACKED);
31cc41c84bSFlorian Westphal }
3284f3bb9aSPatrick McHardy
3384f3bb9aSPatrick McHardy return XT_CONTINUE;
3484f3bb9aSPatrick McHardy }
3584f3bb9aSPatrick McHardy
xt_ct_target_v0(struct sk_buff * skb,const struct xt_action_param * par)36d52ed437SPablo Neira Ayuso static unsigned int xt_ct_target_v0(struct sk_buff *skb,
37d52ed437SPablo Neira Ayuso const struct xt_action_param *par)
38d52ed437SPablo Neira Ayuso {
39d52ed437SPablo Neira Ayuso const struct xt_ct_target_info *info = par->targinfo;
40d52ed437SPablo Neira Ayuso struct nf_conn *ct = info->ct;
41d52ed437SPablo Neira Ayuso
42d52ed437SPablo Neira Ayuso return xt_ct_target(skb, ct);
43d52ed437SPablo Neira Ayuso }
44d52ed437SPablo Neira Ayuso
xt_ct_target_v1(struct sk_buff * skb,const struct xt_action_param * par)4524de58f4SPablo Neira Ayuso static unsigned int xt_ct_target_v1(struct sk_buff *skb,
4624de58f4SPablo Neira Ayuso const struct xt_action_param *par)
4724de58f4SPablo Neira Ayuso {
4824de58f4SPablo Neira Ayuso const struct xt_ct_target_info_v1 *info = par->targinfo;
4924de58f4SPablo Neira Ayuso struct nf_conn *ct = info->ct;
5024de58f4SPablo Neira Ayuso
51d52ed437SPablo Neira Ayuso return xt_ct_target(skb, ct);
5224de58f4SPablo Neira Ayuso }
5324de58f4SPablo Neira Ayuso
xt_ct_find_proto(const struct xt_tgchk_param * par)5484f3bb9aSPatrick McHardy static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
5584f3bb9aSPatrick McHardy {
56076f7839SJan Engelhardt if (par->family == NFPROTO_IPV4) {
5784f3bb9aSPatrick McHardy const struct ipt_entry *e = par->entryinfo;
5884f3bb9aSPatrick McHardy
5984f3bb9aSPatrick McHardy if (e->ip.invflags & IPT_INV_PROTO)
6084f3bb9aSPatrick McHardy return 0;
6184f3bb9aSPatrick McHardy return e->ip.proto;
62076f7839SJan Engelhardt } else if (par->family == NFPROTO_IPV6) {
6384f3bb9aSPatrick McHardy const struct ip6t_entry *e = par->entryinfo;
6484f3bb9aSPatrick McHardy
6584f3bb9aSPatrick McHardy if (e->ipv6.invflags & IP6T_INV_PROTO)
6684f3bb9aSPatrick McHardy return 0;
6784f3bb9aSPatrick McHardy return e->ipv6.proto;
6884f3bb9aSPatrick McHardy } else
6984f3bb9aSPatrick McHardy return 0;
7084f3bb9aSPatrick McHardy }
7184f3bb9aSPatrick McHardy
72236df005SPablo Neira Ayuso static int
xt_ct_set_helper(struct nf_conn * ct,const char * helper_name,const struct xt_tgchk_param * par)73236df005SPablo Neira Ayuso xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
74236df005SPablo Neira Ayuso const struct xt_tgchk_param *par)
75236df005SPablo Neira Ayuso {
76236df005SPablo Neira Ayuso struct nf_conntrack_helper *helper;
77236df005SPablo Neira Ayuso struct nf_conn_help *help;
78236df005SPablo Neira Ayuso u8 proto;
79236df005SPablo Neira Ayuso
80236df005SPablo Neira Ayuso proto = xt_ct_find_proto(par);
81236df005SPablo Neira Ayuso if (!proto) {
8211f7aee2SFlorian Westphal pr_info_ratelimited("You must specify a L4 protocol and not use inversions on it\n");
83236df005SPablo Neira Ayuso return -ENOENT;
84236df005SPablo Neira Ayuso }
85236df005SPablo Neira Ayuso
86236df005SPablo Neira Ayuso helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
87236df005SPablo Neira Ayuso proto);
88236df005SPablo Neira Ayuso if (helper == NULL) {
8911f7aee2SFlorian Westphal pr_info_ratelimited("No such helper \"%s\"\n", helper_name);
90236df005SPablo Neira Ayuso return -ENOENT;
91236df005SPablo Neira Ayuso }
92236df005SPablo Neira Ayuso
93440534d3SGao Feng help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
94236df005SPablo Neira Ayuso if (help == NULL) {
95d91fc59cSLiping Zhang nf_conntrack_helper_put(helper);
96236df005SPablo Neira Ayuso return -ENOMEM;
97236df005SPablo Neira Ayuso }
98236df005SPablo Neira Ayuso
99*e14575faSFlorian Westphal rcu_assign_pointer(help->helper, helper);
100236df005SPablo Neira Ayuso return 0;
101236df005SPablo Neira Ayuso }
102236df005SPablo Neira Ayuso
103236df005SPablo Neira Ayuso static int
xt_ct_set_timeout(struct nf_conn * ct,const struct xt_tgchk_param * par,const char * timeout_name)104236df005SPablo Neira Ayuso xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
105236df005SPablo Neira Ayuso const char *timeout_name)
106236df005SPablo Neira Ayuso {
107236df005SPablo Neira Ayuso #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
108b3480fe0SFlorian Westphal const struct nf_conntrack_l4proto *l4proto;
1090153d5a8SPablo Neira Ayuso u8 proto;
110236df005SPablo Neira Ayuso
1110153d5a8SPablo Neira Ayuso proto = xt_ct_find_proto(par);
1120153d5a8SPablo Neira Ayuso if (!proto) {
113717700d1SYi-Hung Wei pr_info_ratelimited("You must specify a L4 protocol and not "
114717700d1SYi-Hung Wei "use inversions on it");
115717700d1SYi-Hung Wei return -EINVAL;
116236df005SPablo Neira Ayuso }
1174a60dc74SFlorian Westphal l4proto = nf_ct_l4proto_find(proto);
118717700d1SYi-Hung Wei return nf_ct_set_timeout(par->net, ct, par->family, l4proto->l4proto,
119717700d1SYi-Hung Wei timeout_name);
120236df005SPablo Neira Ayuso
121236df005SPablo Neira Ayuso #else
122236df005SPablo Neira Ayuso return -EOPNOTSUPP;
123236df005SPablo Neira Ayuso #endif
124236df005SPablo Neira Ayuso }
125236df005SPablo Neira Ayuso
xt_ct_flags_to_dir(const struct xt_ct_target_info_v1 * info)126deedb590SDaniel Borkmann static u16 xt_ct_flags_to_dir(const struct xt_ct_target_info_v1 *info)
127deedb590SDaniel Borkmann {
128deedb590SDaniel Borkmann switch (info->flags & (XT_CT_ZONE_DIR_ORIG |
129deedb590SDaniel Borkmann XT_CT_ZONE_DIR_REPL)) {
130deedb590SDaniel Borkmann case XT_CT_ZONE_DIR_ORIG:
131deedb590SDaniel Borkmann return NF_CT_ZONE_DIR_ORIG;
132deedb590SDaniel Borkmann case XT_CT_ZONE_DIR_REPL:
133deedb590SDaniel Borkmann return NF_CT_ZONE_DIR_REPL;
134deedb590SDaniel Borkmann default:
135deedb590SDaniel Borkmann return NF_CT_DEFAULT_ZONE_DIR;
136deedb590SDaniel Borkmann }
137deedb590SDaniel Borkmann }
138deedb590SDaniel Borkmann
xt_ct_put_helper(struct nf_conn_help * help)139*e14575faSFlorian Westphal static void xt_ct_put_helper(struct nf_conn_help *help)
140*e14575faSFlorian Westphal {
141*e14575faSFlorian Westphal struct nf_conntrack_helper *helper;
142*e14575faSFlorian Westphal
143*e14575faSFlorian Westphal if (!help)
144*e14575faSFlorian Westphal return;
145*e14575faSFlorian Westphal
146*e14575faSFlorian Westphal /* not yet exposed to other cpus, or ruleset
147*e14575faSFlorian Westphal * already detached (post-replacement).
148*e14575faSFlorian Westphal */
149*e14575faSFlorian Westphal helper = rcu_dereference_raw(help->helper);
150*e14575faSFlorian Westphal if (helper)
151*e14575faSFlorian Westphal nf_conntrack_helper_put(helper);
152*e14575faSFlorian Westphal }
153*e14575faSFlorian Westphal
xt_ct_tg_check(const struct xt_tgchk_param * par,struct xt_ct_target_info_v1 * info)154d52ed437SPablo Neira Ayuso static int xt_ct_tg_check(const struct xt_tgchk_param *par,
155d52ed437SPablo Neira Ayuso struct xt_ct_target_info_v1 *info)
15624de58f4SPablo Neira Ayuso {
157308ac914SDaniel Borkmann struct nf_conntrack_zone zone;
158470acf55SGao Feng struct nf_conn_help *help;
15924de58f4SPablo Neira Ayuso struct nf_conn *ct;
1604610476dSPablo Neira Ayuso int ret = -EOPNOTSUPP;
161236df005SPablo Neira Ayuso
16224de58f4SPablo Neira Ayuso if (info->flags & XT_CT_NOTRACK) {
16327e7190eSEric Dumazet ct = NULL;
16424de58f4SPablo Neira Ayuso goto out;
16524de58f4SPablo Neira Ayuso }
16624de58f4SPablo Neira Ayuso
16724de58f4SPablo Neira Ayuso #ifndef CONFIG_NF_CONNTRACK_ZONES
168deedb590SDaniel Borkmann if (info->zone || info->flags & (XT_CT_ZONE_DIR_ORIG |
1695e8018fcSDaniel Borkmann XT_CT_ZONE_DIR_REPL |
1705e8018fcSDaniel Borkmann XT_CT_ZONE_MARK))
17124de58f4SPablo Neira Ayuso goto err1;
17224de58f4SPablo Neira Ayuso #endif
17324de58f4SPablo Neira Ayuso
174ecb2421bSFlorian Westphal ret = nf_ct_netns_get(par->net, par->family);
17524de58f4SPablo Neira Ayuso if (ret < 0)
17624de58f4SPablo Neira Ayuso goto err1;
17724de58f4SPablo Neira Ayuso
178308ac914SDaniel Borkmann memset(&zone, 0, sizeof(zone));
179308ac914SDaniel Borkmann zone.id = info->zone;
180deedb590SDaniel Borkmann zone.dir = xt_ct_flags_to_dir(info);
1815e8018fcSDaniel Borkmann if (info->flags & XT_CT_ZONE_MARK)
1825e8018fcSDaniel Borkmann zone.flags |= NF_CT_FLAG_MARK;
183308ac914SDaniel Borkmann
184308ac914SDaniel Borkmann ct = nf_ct_tmpl_alloc(par->net, &zone, GFP_KERNEL);
1851a727c63SDan Carpenter if (!ct) {
1861a727c63SDan Carpenter ret = -ENOMEM;
18724de58f4SPablo Neira Ayuso goto err2;
1881a727c63SDan Carpenter }
18924de58f4SPablo Neira Ayuso
19024de58f4SPablo Neira Ayuso if ((info->ct_events || info->exp_events) &&
19124de58f4SPablo Neira Ayuso !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
19214abfa16SEric Leblond GFP_KERNEL)) {
19314abfa16SEric Leblond ret = -EINVAL;
19424de58f4SPablo Neira Ayuso goto err3;
19514abfa16SEric Leblond }
19624de58f4SPablo Neira Ayuso
19724de58f4SPablo Neira Ayuso if (info->helper[0]) {
1988f4d19aaSGao Feng if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
1998f4d19aaSGao Feng ret = -ENAMETOOLONG;
2008f4d19aaSGao Feng goto err3;
2018f4d19aaSGao Feng }
2028f4d19aaSGao Feng
203236df005SPablo Neira Ayuso ret = xt_ct_set_helper(ct, info->helper, par);
204236df005SPablo Neira Ayuso if (ret < 0)
20524de58f4SPablo Neira Ayuso goto err3;
20624de58f4SPablo Neira Ayuso }
20724de58f4SPablo Neira Ayuso
2086cf51852SPablo Neira Ayuso if (info->timeout[0]) {
2098f4d19aaSGao Feng if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
2108f4d19aaSGao Feng ret = -ENAMETOOLONG;
2118f4d19aaSGao Feng goto err4;
2128f4d19aaSGao Feng }
2138f4d19aaSGao Feng
214236df005SPablo Neira Ayuso ret = xt_ct_set_timeout(ct, par, info->timeout);
215236df005SPablo Neira Ayuso if (ret < 0)
216470acf55SGao Feng goto err4;
21724de58f4SPablo Neira Ayuso }
2180838aa7fSPablo Neira Ayuso __set_bit(IPS_CONFIRMED_BIT, &ct->status);
21924de58f4SPablo Neira Ayuso out:
22024de58f4SPablo Neira Ayuso info->ct = ct;
22124de58f4SPablo Neira Ayuso return 0;
22224de58f4SPablo Neira Ayuso
223470acf55SGao Feng err4:
224470acf55SGao Feng help = nfct_help(ct);
225*e14575faSFlorian Westphal xt_ct_put_helper(help);
22624de58f4SPablo Neira Ayuso err3:
2279cf94eabSDaniel Borkmann nf_ct_tmpl_free(ct);
22824de58f4SPablo Neira Ayuso err2:
229ecb2421bSFlorian Westphal nf_ct_netns_put(par->net, par->family);
23024de58f4SPablo Neira Ayuso err1:
23124de58f4SPablo Neira Ayuso return ret;
23224de58f4SPablo Neira Ayuso }
23324de58f4SPablo Neira Ayuso
xt_ct_tg_check_v0(const struct xt_tgchk_param * par)234d52ed437SPablo Neira Ayuso static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
23584f3bb9aSPatrick McHardy {
23684f3bb9aSPatrick McHardy struct xt_ct_target_info *info = par->targinfo;
237d52ed437SPablo Neira Ayuso struct xt_ct_target_info_v1 info_v1 = {
238d52ed437SPablo Neira Ayuso .flags = info->flags,
239d52ed437SPablo Neira Ayuso .zone = info->zone,
240d52ed437SPablo Neira Ayuso .ct_events = info->ct_events,
241d52ed437SPablo Neira Ayuso .exp_events = info->exp_events,
242d52ed437SPablo Neira Ayuso };
243d52ed437SPablo Neira Ayuso int ret;
24484f3bb9aSPatrick McHardy
2455474f57fSPablo Neira Ayuso if (info->flags & ~XT_CT_NOTRACK)
2465474f57fSPablo Neira Ayuso return -EINVAL;
2475474f57fSPablo Neira Ayuso
248d52ed437SPablo Neira Ayuso memcpy(info_v1.helper, info->helper, sizeof(info->helper));
24984f3bb9aSPatrick McHardy
250d52ed437SPablo Neira Ayuso ret = xt_ct_tg_check(par, &info_v1);
251d52ed437SPablo Neira Ayuso if (ret < 0)
252d52ed437SPablo Neira Ayuso return ret;
253d52ed437SPablo Neira Ayuso
254d52ed437SPablo Neira Ayuso info->ct = info_v1.ct;
255d52ed437SPablo Neira Ayuso
256d52ed437SPablo Neira Ayuso return ret;
25784f3bb9aSPatrick McHardy }
258d52ed437SPablo Neira Ayuso
xt_ct_tg_check_v1(const struct xt_tgchk_param * par)259d52ed437SPablo Neira Ayuso static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
260d52ed437SPablo Neira Ayuso {
2615474f57fSPablo Neira Ayuso struct xt_ct_target_info_v1 *info = par->targinfo;
2625474f57fSPablo Neira Ayuso
2635474f57fSPablo Neira Ayuso if (info->flags & ~XT_CT_NOTRACK)
2645474f57fSPablo Neira Ayuso return -EINVAL;
2655474f57fSPablo Neira Ayuso
2665474f57fSPablo Neira Ayuso return xt_ct_tg_check(par, par->targinfo);
2675474f57fSPablo Neira Ayuso }
2685474f57fSPablo Neira Ayuso
xt_ct_tg_check_v2(const struct xt_tgchk_param * par)2695474f57fSPablo Neira Ayuso static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)
2705474f57fSPablo Neira Ayuso {
2715474f57fSPablo Neira Ayuso struct xt_ct_target_info_v1 *info = par->targinfo;
2725474f57fSPablo Neira Ayuso
2735474f57fSPablo Neira Ayuso if (info->flags & ~XT_CT_MASK)
2745474f57fSPablo Neira Ayuso return -EINVAL;
2755474f57fSPablo Neira Ayuso
276d52ed437SPablo Neira Ayuso return xt_ct_tg_check(par, par->targinfo);
27784f3bb9aSPatrick McHardy }
27884f3bb9aSPatrick McHardy
xt_ct_tg_destroy(const struct xt_tgdtor_param * par,struct xt_ct_target_info_v1 * info)279d52ed437SPablo Neira Ayuso static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
280d52ed437SPablo Neira Ayuso struct xt_ct_target_info_v1 *info)
281236df005SPablo Neira Ayuso {
282236df005SPablo Neira Ayuso struct nf_conn *ct = info->ct;
283236df005SPablo Neira Ayuso struct nf_conn_help *help;
284236df005SPablo Neira Ayuso
285cc41c84bSFlorian Westphal if (ct) {
286236df005SPablo Neira Ayuso help = nfct_help(ct);
287*e14575faSFlorian Westphal xt_ct_put_helper(help);
288236df005SPablo Neira Ayuso
289ecb2421bSFlorian Westphal nf_ct_netns_put(par->net, par->family);
290236df005SPablo Neira Ayuso
291717700d1SYi-Hung Wei nf_ct_destroy_timeout(ct);
29224de58f4SPablo Neira Ayuso nf_ct_put(info->ct);
29324de58f4SPablo Neira Ayuso }
29427e7190eSEric Dumazet }
29524de58f4SPablo Neira Ayuso
xt_ct_tg_destroy_v0(const struct xt_tgdtor_param * par)296d52ed437SPablo Neira Ayuso static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
297d52ed437SPablo Neira Ayuso {
298d52ed437SPablo Neira Ayuso struct xt_ct_target_info *info = par->targinfo;
299d52ed437SPablo Neira Ayuso struct xt_ct_target_info_v1 info_v1 = {
300d52ed437SPablo Neira Ayuso .flags = info->flags,
301d52ed437SPablo Neira Ayuso .zone = info->zone,
302d52ed437SPablo Neira Ayuso .ct_events = info->ct_events,
303d52ed437SPablo Neira Ayuso .exp_events = info->exp_events,
304d52ed437SPablo Neira Ayuso .ct = info->ct,
305d52ed437SPablo Neira Ayuso };
306d52ed437SPablo Neira Ayuso memcpy(info_v1.helper, info->helper, sizeof(info->helper));
307d52ed437SPablo Neira Ayuso
308d52ed437SPablo Neira Ayuso xt_ct_tg_destroy(par, &info_v1);
309d52ed437SPablo Neira Ayuso }
310d52ed437SPablo Neira Ayuso
xt_ct_tg_destroy_v1(const struct xt_tgdtor_param * par)311d52ed437SPablo Neira Ayuso static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
312d52ed437SPablo Neira Ayuso {
313d52ed437SPablo Neira Ayuso xt_ct_tg_destroy(par, par->targinfo);
314d52ed437SPablo Neira Ayuso }
315d52ed437SPablo Neira Ayuso
31624de58f4SPablo Neira Ayuso static struct xt_target xt_ct_tg_reg[] __read_mostly = {
31724de58f4SPablo Neira Ayuso {
31884f3bb9aSPatrick McHardy .name = "CT",
31984f3bb9aSPatrick McHardy .family = NFPROTO_UNSPEC,
3207d5f7ed8SJan Engelhardt .targetsize = sizeof(struct xt_ct_target_info),
321ec231890SWillem de Bruijn .usersize = offsetof(struct xt_ct_target_info, ct),
32224de58f4SPablo Neira Ayuso .checkentry = xt_ct_tg_check_v0,
32324de58f4SPablo Neira Ayuso .destroy = xt_ct_tg_destroy_v0,
32424de58f4SPablo Neira Ayuso .target = xt_ct_target_v0,
32584f3bb9aSPatrick McHardy .table = "raw",
32684f3bb9aSPatrick McHardy .me = THIS_MODULE,
32724de58f4SPablo Neira Ayuso },
32824de58f4SPablo Neira Ayuso {
32924de58f4SPablo Neira Ayuso .name = "CT",
33024de58f4SPablo Neira Ayuso .family = NFPROTO_UNSPEC,
33124de58f4SPablo Neira Ayuso .revision = 1,
33224de58f4SPablo Neira Ayuso .targetsize = sizeof(struct xt_ct_target_info_v1),
333ec231890SWillem de Bruijn .usersize = offsetof(struct xt_ct_target_info, ct),
33424de58f4SPablo Neira Ayuso .checkentry = xt_ct_tg_check_v1,
33524de58f4SPablo Neira Ayuso .destroy = xt_ct_tg_destroy_v1,
33624de58f4SPablo Neira Ayuso .target = xt_ct_target_v1,
33724de58f4SPablo Neira Ayuso .table = "raw",
33824de58f4SPablo Neira Ayuso .me = THIS_MODULE,
33924de58f4SPablo Neira Ayuso },
3405474f57fSPablo Neira Ayuso {
3415474f57fSPablo Neira Ayuso .name = "CT",
3425474f57fSPablo Neira Ayuso .family = NFPROTO_UNSPEC,
3435474f57fSPablo Neira Ayuso .revision = 2,
3445474f57fSPablo Neira Ayuso .targetsize = sizeof(struct xt_ct_target_info_v1),
345ec231890SWillem de Bruijn .usersize = offsetof(struct xt_ct_target_info, ct),
3465474f57fSPablo Neira Ayuso .checkentry = xt_ct_tg_check_v2,
3475474f57fSPablo Neira Ayuso .destroy = xt_ct_tg_destroy_v1,
3485474f57fSPablo Neira Ayuso .target = xt_ct_target_v1,
3495474f57fSPablo Neira Ayuso .table = "raw",
3505474f57fSPablo Neira Ayuso .me = THIS_MODULE,
3515474f57fSPablo Neira Ayuso },
35284f3bb9aSPatrick McHardy };
35384f3bb9aSPatrick McHardy
35410db9069SPablo Neira Ayuso static unsigned int
notrack_tg(struct sk_buff * skb,const struct xt_action_param * par)35510db9069SPablo Neira Ayuso notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
35610db9069SPablo Neira Ayuso {
35710db9069SPablo Neira Ayuso /* Previously seen (loopback)? Ignore. */
358a9e419dcSFlorian Westphal if (skb->_nfct != 0)
35910db9069SPablo Neira Ayuso return XT_CONTINUE;
36010db9069SPablo Neira Ayuso
361cc41c84bSFlorian Westphal nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
36210db9069SPablo Neira Ayuso
36310db9069SPablo Neira Ayuso return XT_CONTINUE;
36410db9069SPablo Neira Ayuso }
36510db9069SPablo Neira Ayuso
36610db9069SPablo Neira Ayuso static struct xt_target notrack_tg_reg __read_mostly = {
36710db9069SPablo Neira Ayuso .name = "NOTRACK",
36810db9069SPablo Neira Ayuso .revision = 0,
36910db9069SPablo Neira Ayuso .family = NFPROTO_UNSPEC,
37010db9069SPablo Neira Ayuso .target = notrack_tg,
37110db9069SPablo Neira Ayuso .table = "raw",
37210db9069SPablo Neira Ayuso .me = THIS_MODULE,
37310db9069SPablo Neira Ayuso };
37410db9069SPablo Neira Ayuso
xt_ct_tg_init(void)37584f3bb9aSPatrick McHardy static int __init xt_ct_tg_init(void)
37684f3bb9aSPatrick McHardy {
37710db9069SPablo Neira Ayuso int ret;
37810db9069SPablo Neira Ayuso
37910db9069SPablo Neira Ayuso ret = xt_register_target(¬rack_tg_reg);
38010db9069SPablo Neira Ayuso if (ret < 0)
38110db9069SPablo Neira Ayuso return ret;
38210db9069SPablo Neira Ayuso
38310db9069SPablo Neira Ayuso ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
38410db9069SPablo Neira Ayuso if (ret < 0) {
38510db9069SPablo Neira Ayuso xt_unregister_target(¬rack_tg_reg);
38610db9069SPablo Neira Ayuso return ret;
38710db9069SPablo Neira Ayuso }
38810db9069SPablo Neira Ayuso return 0;
38984f3bb9aSPatrick McHardy }
39084f3bb9aSPatrick McHardy
xt_ct_tg_exit(void)39184f3bb9aSPatrick McHardy static void __exit xt_ct_tg_exit(void)
39284f3bb9aSPatrick McHardy {
39324de58f4SPablo Neira Ayuso xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
39410db9069SPablo Neira Ayuso xt_unregister_target(¬rack_tg_reg);
39584f3bb9aSPatrick McHardy }
39684f3bb9aSPatrick McHardy
39784f3bb9aSPatrick McHardy module_init(xt_ct_tg_init);
39884f3bb9aSPatrick McHardy module_exit(xt_ct_tg_exit);
39984f3bb9aSPatrick McHardy
40084f3bb9aSPatrick McHardy MODULE_LICENSE("GPL");
40184f3bb9aSPatrick McHardy MODULE_DESCRIPTION("Xtables: connection tracking target");
40284f3bb9aSPatrick McHardy MODULE_ALIAS("ipt_CT");
40384f3bb9aSPatrick McHardy MODULE_ALIAS("ip6t_CT");
40410db9069SPablo Neira Ayuso MODULE_ALIAS("ipt_NOTRACK");
40510db9069SPablo Neira Ayuso MODULE_ALIAS("ip6t_NOTRACK");
406