1c539f017SFlorian Westphal /* 2c539f017SFlorian Westphal * (C) 2013 Astaro GmbH & Co KG 3c539f017SFlorian Westphal * 4c539f017SFlorian Westphal * This program is free software; you can redistribute it and/or modify 5c539f017SFlorian Westphal * it under the terms of the GNU General Public License version 2 as 6c539f017SFlorian Westphal * published by the Free Software Foundation. 7c539f017SFlorian Westphal */ 8c539f017SFlorian Westphal 9c539f017SFlorian Westphal #include <linux/module.h> 10c539f017SFlorian Westphal #include <linux/skbuff.h> 11c539f017SFlorian Westphal #include <net/netfilter/nf_conntrack.h> 12857ed310SFlorian Westphal #include <net/netfilter/nf_conntrack_ecache.h> 13c539f017SFlorian Westphal #include <net/netfilter/nf_conntrack_labels.h> 14c539f017SFlorian Westphal #include <linux/netfilter/x_tables.h> 15c539f017SFlorian Westphal 16c539f017SFlorian Westphal MODULE_LICENSE("GPL"); 17c539f017SFlorian Westphal MODULE_AUTHOR("Florian Westphal <fw@strlen.de>"); 181de6f334SColin Ian King MODULE_DESCRIPTION("Xtables: add/match connection tracking labels"); 19c539f017SFlorian Westphal MODULE_ALIAS("ipt_connlabel"); 20c539f017SFlorian Westphal MODULE_ALIAS("ip6t_connlabel"); 21c539f017SFlorian Westphal 22c539f017SFlorian Westphal static bool 23c539f017SFlorian Westphal connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par) 24c539f017SFlorian Westphal { 25c539f017SFlorian Westphal const struct xt_connlabel_mtinfo *info = par->matchinfo; 26c539f017SFlorian Westphal enum ip_conntrack_info ctinfo; 27857ed310SFlorian Westphal struct nf_conn_labels *labels; 28c539f017SFlorian Westphal struct nf_conn *ct; 29c539f017SFlorian Westphal bool invert = info->options & XT_CONNLABEL_OP_INVERT; 30c539f017SFlorian Westphal 31c539f017SFlorian Westphal ct = nf_ct_get(skb, &ctinfo); 32ab8bc7edSFlorian Westphal if (ct == NULL) 33c539f017SFlorian Westphal return invert; 34c539f017SFlorian Westphal 35857ed310SFlorian Westphal labels = nf_ct_labels_find(ct); 36857ed310SFlorian Westphal if (!labels) 37857ed310SFlorian Westphal return invert; 38c539f017SFlorian Westphal 39857ed310SFlorian Westphal if (test_bit(info->bit, labels->bits)) 40857ed310SFlorian Westphal return !invert; 41857ed310SFlorian Westphal 42857ed310SFlorian Westphal if (info->options & XT_CONNLABEL_OP_SET) { 43857ed310SFlorian Westphal if (!test_and_set_bit(info->bit, labels->bits)) 44857ed310SFlorian Westphal nf_conntrack_event_cache(IPCT_LABEL, ct); 45857ed310SFlorian Westphal 46857ed310SFlorian Westphal return !invert; 47857ed310SFlorian Westphal } 48857ed310SFlorian Westphal 49857ed310SFlorian Westphal return invert; 50c539f017SFlorian Westphal } 51c539f017SFlorian Westphal 52c539f017SFlorian Westphal static int connlabel_mt_check(const struct xt_mtchk_param *par) 53c539f017SFlorian Westphal { 54c539f017SFlorian Westphal const int options = XT_CONNLABEL_OP_INVERT | 55c539f017SFlorian Westphal XT_CONNLABEL_OP_SET; 56c539f017SFlorian Westphal struct xt_connlabel_mtinfo *info = par->matchinfo; 57c539f017SFlorian Westphal int ret; 58c539f017SFlorian Westphal 59c539f017SFlorian Westphal if (info->options & ~options) { 60b2606644SFlorian Westphal pr_info_ratelimited("Unknown options in mask %x\n", 61b2606644SFlorian Westphal info->options); 62c539f017SFlorian Westphal return -EINVAL; 63c539f017SFlorian Westphal } 64c539f017SFlorian Westphal 65ecb2421bSFlorian Westphal ret = nf_ct_netns_get(par->net, par->family); 66c539f017SFlorian Westphal if (ret < 0) { 67b2606644SFlorian Westphal pr_info_ratelimited("cannot load conntrack support for proto=%u\n", 68c539f017SFlorian Westphal par->family); 69c539f017SFlorian Westphal return ret; 70c539f017SFlorian Westphal } 71c539f017SFlorian Westphal 72adff6c65SFlorian Westphal ret = nf_connlabels_get(par->net, info->bit); 7386ca02e7SJoe Stringer if (ret < 0) 74ecb2421bSFlorian Westphal nf_ct_netns_put(par->net, par->family); 75c539f017SFlorian Westphal return ret; 76c539f017SFlorian Westphal } 77c539f017SFlorian Westphal 78c539f017SFlorian Westphal static void connlabel_mt_destroy(const struct xt_mtdtor_param *par) 79c539f017SFlorian Westphal { 8086ca02e7SJoe Stringer nf_connlabels_put(par->net); 81ecb2421bSFlorian Westphal nf_ct_netns_put(par->net, par->family); 82c539f017SFlorian Westphal } 83c539f017SFlorian Westphal 84c539f017SFlorian Westphal static struct xt_match connlabels_mt_reg __read_mostly = { 85c539f017SFlorian Westphal .name = "connlabel", 86c539f017SFlorian Westphal .family = NFPROTO_UNSPEC, 87c539f017SFlorian Westphal .checkentry = connlabel_mt_check, 88c539f017SFlorian Westphal .match = connlabel_mt, 89c539f017SFlorian Westphal .matchsize = sizeof(struct xt_connlabel_mtinfo), 90c539f017SFlorian Westphal .destroy = connlabel_mt_destroy, 91c539f017SFlorian Westphal .me = THIS_MODULE, 92c539f017SFlorian Westphal }; 93c539f017SFlorian Westphal 94c539f017SFlorian Westphal static int __init connlabel_mt_init(void) 95c539f017SFlorian Westphal { 96c539f017SFlorian Westphal return xt_register_match(&connlabels_mt_reg); 97c539f017SFlorian Westphal } 98c539f017SFlorian Westphal 99c539f017SFlorian Westphal static void __exit connlabel_mt_exit(void) 100c539f017SFlorian Westphal { 101c539f017SFlorian Westphal xt_unregister_match(&connlabels_mt_reg); 102c539f017SFlorian Westphal } 103c539f017SFlorian Westphal 104c539f017SFlorian Westphal module_init(connlabel_mt_init); 105c539f017SFlorian Westphal module_exit(connlabel_mt_exit); 106