1c539f017SFlorian Westphal /* 2c539f017SFlorian Westphal * (C) 2013 Astaro GmbH & Co KG 3c539f017SFlorian Westphal * 4c539f017SFlorian Westphal * This program is free software; you can redistribute it and/or modify 5c539f017SFlorian Westphal * it under the terms of the GNU General Public License version 2 as 6c539f017SFlorian Westphal * published by the Free Software Foundation. 7c539f017SFlorian Westphal */ 8c539f017SFlorian Westphal 9c539f017SFlorian Westphal #include <linux/module.h> 10c539f017SFlorian Westphal #include <linux/skbuff.h> 11c539f017SFlorian Westphal #include <net/netfilter/nf_conntrack.h> 12c539f017SFlorian Westphal #include <net/netfilter/nf_conntrack_labels.h> 13c539f017SFlorian Westphal #include <linux/netfilter/x_tables.h> 14c539f017SFlorian Westphal 15c539f017SFlorian Westphal MODULE_LICENSE("GPL"); 16c539f017SFlorian Westphal MODULE_AUTHOR("Florian Westphal <fw@strlen.de>"); 17c539f017SFlorian Westphal MODULE_DESCRIPTION("Xtables: add/match connection trackling labels"); 18c539f017SFlorian Westphal MODULE_ALIAS("ipt_connlabel"); 19c539f017SFlorian Westphal MODULE_ALIAS("ip6t_connlabel"); 20c539f017SFlorian Westphal 21c539f017SFlorian Westphal static bool 22c539f017SFlorian Westphal connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par) 23c539f017SFlorian Westphal { 24c539f017SFlorian Westphal const struct xt_connlabel_mtinfo *info = par->matchinfo; 25c539f017SFlorian Westphal enum ip_conntrack_info ctinfo; 26c539f017SFlorian Westphal struct nf_conn *ct; 27c539f017SFlorian Westphal bool invert = info->options & XT_CONNLABEL_OP_INVERT; 28c539f017SFlorian Westphal 29c539f017SFlorian Westphal ct = nf_ct_get(skb, &ctinfo); 30c539f017SFlorian Westphal if (ct == NULL || nf_ct_is_untracked(ct)) 31c539f017SFlorian Westphal return invert; 32c539f017SFlorian Westphal 33c539f017SFlorian Westphal if (info->options & XT_CONNLABEL_OP_SET) 34c539f017SFlorian Westphal return (nf_connlabel_set(ct, info->bit) == 0) ^ invert; 35c539f017SFlorian Westphal 36c539f017SFlorian Westphal return nf_connlabel_match(ct, info->bit) ^ invert; 37c539f017SFlorian Westphal } 38c539f017SFlorian Westphal 39c539f017SFlorian Westphal static int connlabel_mt_check(const struct xt_mtchk_param *par) 40c539f017SFlorian Westphal { 41c539f017SFlorian Westphal const int options = XT_CONNLABEL_OP_INVERT | 42c539f017SFlorian Westphal XT_CONNLABEL_OP_SET; 43c539f017SFlorian Westphal struct xt_connlabel_mtinfo *info = par->matchinfo; 44c539f017SFlorian Westphal int ret; 45c539f017SFlorian Westphal 46c539f017SFlorian Westphal if (info->options & ~options) { 47c539f017SFlorian Westphal pr_err("Unknown options in mask %x\n", info->options); 48c539f017SFlorian Westphal return -EINVAL; 49c539f017SFlorian Westphal } 50c539f017SFlorian Westphal 51c539f017SFlorian Westphal ret = nf_ct_l3proto_try_module_get(par->family); 52c539f017SFlorian Westphal if (ret < 0) { 53c539f017SFlorian Westphal pr_info("cannot load conntrack support for proto=%u\n", 54c539f017SFlorian Westphal par->family); 55c539f017SFlorian Westphal return ret; 56c539f017SFlorian Westphal } 57c539f017SFlorian Westphal 5886ca02e7SJoe Stringer ret = nf_connlabels_get(par->net, info->bit + 1); 5986ca02e7SJoe Stringer if (ret < 0) 6086ca02e7SJoe Stringer nf_ct_l3proto_module_put(par->family); 61c539f017SFlorian Westphal return ret; 62c539f017SFlorian Westphal } 63c539f017SFlorian Westphal 64c539f017SFlorian Westphal static void connlabel_mt_destroy(const struct xt_mtdtor_param *par) 65c539f017SFlorian Westphal { 6686ca02e7SJoe Stringer nf_connlabels_put(par->net); 67c539f017SFlorian Westphal nf_ct_l3proto_module_put(par->family); 68c539f017SFlorian Westphal } 69c539f017SFlorian Westphal 70c539f017SFlorian Westphal static struct xt_match connlabels_mt_reg __read_mostly = { 71c539f017SFlorian Westphal .name = "connlabel", 72c539f017SFlorian Westphal .family = NFPROTO_UNSPEC, 73c539f017SFlorian Westphal .checkentry = connlabel_mt_check, 74c539f017SFlorian Westphal .match = connlabel_mt, 75c539f017SFlorian Westphal .matchsize = sizeof(struct xt_connlabel_mtinfo), 76c539f017SFlorian Westphal .destroy = connlabel_mt_destroy, 77c539f017SFlorian Westphal .me = THIS_MODULE, 78c539f017SFlorian Westphal }; 79c539f017SFlorian Westphal 80c539f017SFlorian Westphal static int __init connlabel_mt_init(void) 81c539f017SFlorian Westphal { 82c539f017SFlorian Westphal return xt_register_match(&connlabels_mt_reg); 83c539f017SFlorian Westphal } 84c539f017SFlorian Westphal 85c539f017SFlorian Westphal static void __exit connlabel_mt_exit(void) 86c539f017SFlorian Westphal { 87c539f017SFlorian Westphal xt_unregister_match(&connlabels_mt_reg); 88c539f017SFlorian Westphal } 89c539f017SFlorian Westphal 90c539f017SFlorian Westphal module_init(connlabel_mt_init); 91c539f017SFlorian Westphal module_exit(connlabel_mt_exit); 92