1 /* 2 * (C) 2013 Astaro GmbH & Co KG 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 */ 8 9 #include <linux/module.h> 10 #include <linux/skbuff.h> 11 #include <net/netfilter/nf_conntrack.h> 12 #include <net/netfilter/nf_conntrack_labels.h> 13 #include <linux/netfilter/x_tables.h> 14 15 MODULE_LICENSE("GPL"); 16 MODULE_AUTHOR("Florian Westphal <fw@strlen.de>"); 17 MODULE_DESCRIPTION("Xtables: add/match connection trackling labels"); 18 MODULE_ALIAS("ipt_connlabel"); 19 MODULE_ALIAS("ip6t_connlabel"); 20 21 static bool 22 connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par) 23 { 24 const struct xt_connlabel_mtinfo *info = par->matchinfo; 25 enum ip_conntrack_info ctinfo; 26 struct nf_conn *ct; 27 bool invert = info->options & XT_CONNLABEL_OP_INVERT; 28 29 ct = nf_ct_get(skb, &ctinfo); 30 if (ct == NULL || nf_ct_is_untracked(ct)) 31 return invert; 32 33 if (info->options & XT_CONNLABEL_OP_SET) 34 return (nf_connlabel_set(ct, info->bit) == 0) ^ invert; 35 36 return nf_connlabel_match(ct, info->bit) ^ invert; 37 } 38 39 static int connlabel_mt_check(const struct xt_mtchk_param *par) 40 { 41 const int options = XT_CONNLABEL_OP_INVERT | 42 XT_CONNLABEL_OP_SET; 43 struct xt_connlabel_mtinfo *info = par->matchinfo; 44 int ret; 45 46 if (info->options & ~options) { 47 pr_err("Unknown options in mask %x\n", info->options); 48 return -EINVAL; 49 } 50 51 ret = nf_ct_l3proto_try_module_get(par->family); 52 if (ret < 0) { 53 pr_info("cannot load conntrack support for proto=%u\n", 54 par->family); 55 return ret; 56 } 57 58 ret = nf_connlabels_get(par->net, info->bit + 1); 59 if (ret < 0) 60 nf_ct_l3proto_module_put(par->family); 61 return ret; 62 } 63 64 static void connlabel_mt_destroy(const struct xt_mtdtor_param *par) 65 { 66 nf_connlabels_put(par->net); 67 nf_ct_l3proto_module_put(par->family); 68 } 69 70 static struct xt_match connlabels_mt_reg __read_mostly = { 71 .name = "connlabel", 72 .family = NFPROTO_UNSPEC, 73 .checkentry = connlabel_mt_check, 74 .match = connlabel_mt, 75 .matchsize = sizeof(struct xt_connlabel_mtinfo), 76 .destroy = connlabel_mt_destroy, 77 .me = THIS_MODULE, 78 }; 79 80 static int __init connlabel_mt_init(void) 81 { 82 return xt_register_match(&connlabels_mt_reg); 83 } 84 85 static void __exit connlabel_mt_exit(void) 86 { 87 xt_unregister_match(&connlabels_mt_reg); 88 } 89 90 module_init(connlabel_mt_init); 91 module_exit(connlabel_mt_exit); 92