1c539f017SFlorian Westphal /* 2c539f017SFlorian Westphal * (C) 2013 Astaro GmbH & Co KG 3c539f017SFlorian Westphal * 4c539f017SFlorian Westphal * This program is free software; you can redistribute it and/or modify 5c539f017SFlorian Westphal * it under the terms of the GNU General Public License version 2 as 6c539f017SFlorian Westphal * published by the Free Software Foundation. 7c539f017SFlorian Westphal */ 8c539f017SFlorian Westphal 9c539f017SFlorian Westphal #include <linux/module.h> 10c539f017SFlorian Westphal #include <linux/skbuff.h> 11c539f017SFlorian Westphal #include <net/netfilter/nf_conntrack.h> 12c539f017SFlorian Westphal #include <net/netfilter/nf_conntrack_labels.h> 13c539f017SFlorian Westphal #include <linux/netfilter/x_tables.h> 14c539f017SFlorian Westphal 15c539f017SFlorian Westphal MODULE_LICENSE("GPL"); 16c539f017SFlorian Westphal MODULE_AUTHOR("Florian Westphal <fw@strlen.de>"); 17c539f017SFlorian Westphal MODULE_DESCRIPTION("Xtables: add/match connection trackling labels"); 18c539f017SFlorian Westphal MODULE_ALIAS("ipt_connlabel"); 19c539f017SFlorian Westphal MODULE_ALIAS("ip6t_connlabel"); 20c539f017SFlorian Westphal 21c539f017SFlorian Westphal static bool 22c539f017SFlorian Westphal connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par) 23c539f017SFlorian Westphal { 24c539f017SFlorian Westphal const struct xt_connlabel_mtinfo *info = par->matchinfo; 25c539f017SFlorian Westphal enum ip_conntrack_info ctinfo; 26c539f017SFlorian Westphal struct nf_conn *ct; 27c539f017SFlorian Westphal bool invert = info->options & XT_CONNLABEL_OP_INVERT; 28c539f017SFlorian Westphal 29c539f017SFlorian Westphal ct = nf_ct_get(skb, &ctinfo); 30c539f017SFlorian Westphal if (ct == NULL || nf_ct_is_untracked(ct)) 31c539f017SFlorian Westphal return invert; 32c539f017SFlorian Westphal 33c539f017SFlorian Westphal if (info->options & XT_CONNLABEL_OP_SET) 34c539f017SFlorian Westphal return (nf_connlabel_set(ct, info->bit) == 0) ^ invert; 35c539f017SFlorian Westphal 36c539f017SFlorian Westphal return nf_connlabel_match(ct, info->bit) ^ invert; 37c539f017SFlorian Westphal } 38c539f017SFlorian Westphal 39c539f017SFlorian Westphal static int connlabel_mt_check(const struct xt_mtchk_param *par) 40c539f017SFlorian Westphal { 41c539f017SFlorian Westphal const int options = XT_CONNLABEL_OP_INVERT | 42c539f017SFlorian Westphal XT_CONNLABEL_OP_SET; 43c539f017SFlorian Westphal struct xt_connlabel_mtinfo *info = par->matchinfo; 44c539f017SFlorian Westphal int ret; 45c539f017SFlorian Westphal size_t words; 46c539f017SFlorian Westphal 47c539f017SFlorian Westphal if (info->bit > XT_CONNLABEL_MAXBIT) 48c539f017SFlorian Westphal return -ERANGE; 49c539f017SFlorian Westphal 50c539f017SFlorian Westphal if (info->options & ~options) { 51c539f017SFlorian Westphal pr_err("Unknown options in mask %x\n", info->options); 52c539f017SFlorian Westphal return -EINVAL; 53c539f017SFlorian Westphal } 54c539f017SFlorian Westphal 55c539f017SFlorian Westphal ret = nf_ct_l3proto_try_module_get(par->family); 56c539f017SFlorian Westphal if (ret < 0) { 57c539f017SFlorian Westphal pr_info("cannot load conntrack support for proto=%u\n", 58c539f017SFlorian Westphal par->family); 59c539f017SFlorian Westphal return ret; 60c539f017SFlorian Westphal } 61c539f017SFlorian Westphal 62c539f017SFlorian Westphal par->net->ct.labels_used++; 63c539f017SFlorian Westphal words = BITS_TO_LONGS(info->bit+1); 64c539f017SFlorian Westphal if (words > par->net->ct.label_words) 65c539f017SFlorian Westphal par->net->ct.label_words = words; 66c539f017SFlorian Westphal 67c539f017SFlorian Westphal return ret; 68c539f017SFlorian Westphal } 69c539f017SFlorian Westphal 70c539f017SFlorian Westphal static void connlabel_mt_destroy(const struct xt_mtdtor_param *par) 71c539f017SFlorian Westphal { 72c539f017SFlorian Westphal par->net->ct.labels_used--; 73c539f017SFlorian Westphal if (par->net->ct.labels_used == 0) 74c539f017SFlorian Westphal par->net->ct.label_words = 0; 75c539f017SFlorian Westphal nf_ct_l3proto_module_put(par->family); 76c539f017SFlorian Westphal } 77c539f017SFlorian Westphal 78c539f017SFlorian Westphal static struct xt_match connlabels_mt_reg __read_mostly = { 79c539f017SFlorian Westphal .name = "connlabel", 80c539f017SFlorian Westphal .family = NFPROTO_UNSPEC, 81c539f017SFlorian Westphal .checkentry = connlabel_mt_check, 82c539f017SFlorian Westphal .match = connlabel_mt, 83c539f017SFlorian Westphal .matchsize = sizeof(struct xt_connlabel_mtinfo), 84c539f017SFlorian Westphal .destroy = connlabel_mt_destroy, 85c539f017SFlorian Westphal .me = THIS_MODULE, 86c539f017SFlorian Westphal }; 87c539f017SFlorian Westphal 88c539f017SFlorian Westphal static int __init connlabel_mt_init(void) 89c539f017SFlorian Westphal { 90c539f017SFlorian Westphal return xt_register_match(&connlabels_mt_reg); 91c539f017SFlorian Westphal } 92c539f017SFlorian Westphal 93c539f017SFlorian Westphal static void __exit connlabel_mt_exit(void) 94c539f017SFlorian Westphal { 95c539f017SFlorian Westphal xt_unregister_match(&connlabels_mt_reg); 96c539f017SFlorian Westphal } 97c539f017SFlorian Westphal 98c539f017SFlorian Westphal module_init(connlabel_mt_init); 99c539f017SFlorian Westphal module_exit(connlabel_mt_exit); 100