1 /* 2 * (C) 2013 Astaro GmbH & Co KG 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 */ 8 9 #include <linux/module.h> 10 #include <linux/skbuff.h> 11 #include <net/netfilter/nf_conntrack.h> 12 #include <net/netfilter/nf_conntrack_labels.h> 13 #include <linux/netfilter/x_tables.h> 14 15 MODULE_LICENSE("GPL"); 16 MODULE_AUTHOR("Florian Westphal <fw@strlen.de>"); 17 MODULE_DESCRIPTION("Xtables: add/match connection trackling labels"); 18 MODULE_ALIAS("ipt_connlabel"); 19 MODULE_ALIAS("ip6t_connlabel"); 20 21 static bool 22 connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par) 23 { 24 const struct xt_connlabel_mtinfo *info = par->matchinfo; 25 enum ip_conntrack_info ctinfo; 26 struct nf_conn *ct; 27 bool invert = info->options & XT_CONNLABEL_OP_INVERT; 28 29 ct = nf_ct_get(skb, &ctinfo); 30 if (ct == NULL || nf_ct_is_untracked(ct)) 31 return invert; 32 33 if (info->options & XT_CONNLABEL_OP_SET) 34 return (nf_connlabel_set(ct, info->bit) == 0) ^ invert; 35 36 return nf_connlabel_match(ct, info->bit) ^ invert; 37 } 38 39 static int connlabel_mt_check(const struct xt_mtchk_param *par) 40 { 41 const int options = XT_CONNLABEL_OP_INVERT | 42 XT_CONNLABEL_OP_SET; 43 struct xt_connlabel_mtinfo *info = par->matchinfo; 44 int ret; 45 size_t words; 46 47 if (info->bit > XT_CONNLABEL_MAXBIT) 48 return -ERANGE; 49 50 if (info->options & ~options) { 51 pr_err("Unknown options in mask %x\n", info->options); 52 return -EINVAL; 53 } 54 55 ret = nf_ct_l3proto_try_module_get(par->family); 56 if (ret < 0) { 57 pr_info("cannot load conntrack support for proto=%u\n", 58 par->family); 59 return ret; 60 } 61 62 par->net->ct.labels_used++; 63 words = BITS_TO_LONGS(info->bit+1); 64 if (words > par->net->ct.label_words) 65 par->net->ct.label_words = words; 66 67 return ret; 68 } 69 70 static void connlabel_mt_destroy(const struct xt_mtdtor_param *par) 71 { 72 par->net->ct.labels_used--; 73 if (par->net->ct.labels_used == 0) 74 par->net->ct.label_words = 0; 75 nf_ct_l3proto_module_put(par->family); 76 } 77 78 static struct xt_match connlabels_mt_reg __read_mostly = { 79 .name = "connlabel", 80 .family = NFPROTO_UNSPEC, 81 .checkentry = connlabel_mt_check, 82 .match = connlabel_mt, 83 .matchsize = sizeof(struct xt_connlabel_mtinfo), 84 .destroy = connlabel_mt_destroy, 85 .me = THIS_MODULE, 86 }; 87 88 static int __init connlabel_mt_init(void) 89 { 90 return xt_register_match(&connlabels_mt_reg); 91 } 92 93 static void __exit connlabel_mt_exit(void) 94 { 95 xt_unregister_match(&connlabels_mt_reg); 96 } 97 98 module_init(connlabel_mt_init); 99 module_exit(connlabel_mt_exit); 100