1 /* This kernel module matches connection mark values set by the 2 * CONNMARK target 3 * 4 * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com> 5 * by Henrik Nordstrom <hno@marasystems.com> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License as published by 9 * the Free Software Foundation; either version 2 of the License, or 10 * (at your option) any later version. 11 * 12 * This program is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * GNU General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License 18 * along with this program; if not, write to the Free Software 19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 20 */ 21 22 #include <linux/module.h> 23 #include <linux/skbuff.h> 24 #include <net/netfilter/nf_conntrack.h> 25 #include <linux/netfilter/x_tables.h> 26 #include <linux/netfilter/xt_connmark.h> 27 28 MODULE_AUTHOR("Henrik Nordstrom <hno@marasytems.com>"); 29 MODULE_DESCRIPTION("IP tables connmark match module"); 30 MODULE_LICENSE("GPL"); 31 MODULE_ALIAS("ipt_connmark"); 32 MODULE_ALIAS("ip6t_connmark"); 33 34 static bool 35 match(const struct sk_buff *skb, 36 const struct net_device *in, 37 const struct net_device *out, 38 const struct xt_match *match, 39 const void *matchinfo, 40 int offset, 41 unsigned int protoff, 42 bool *hotdrop) 43 { 44 const struct xt_connmark_info *info = matchinfo; 45 const struct nf_conn *ct; 46 enum ip_conntrack_info ctinfo; 47 48 ct = nf_ct_get(skb, &ctinfo); 49 if (!ct) 50 return false; 51 52 return ((ct->mark & info->mask) == info->mark) ^ info->invert; 53 } 54 55 static bool 56 checkentry(const char *tablename, 57 const void *ip, 58 const struct xt_match *match, 59 void *matchinfo, 60 unsigned int hook_mask) 61 { 62 const struct xt_connmark_info *cm = matchinfo; 63 64 if (cm->mark > 0xffffffff || cm->mask > 0xffffffff) { 65 printk(KERN_WARNING "connmark: only support 32bit mark\n"); 66 return false; 67 } 68 if (nf_ct_l3proto_try_module_get(match->family) < 0) { 69 printk(KERN_WARNING "can't load conntrack support for " 70 "proto=%d\n", match->family); 71 return false; 72 } 73 return true; 74 } 75 76 static void 77 destroy(const struct xt_match *match, void *matchinfo) 78 { 79 nf_ct_l3proto_module_put(match->family); 80 } 81 82 #ifdef CONFIG_COMPAT 83 struct compat_xt_connmark_info { 84 compat_ulong_t mark, mask; 85 u_int8_t invert; 86 u_int8_t __pad1; 87 u_int16_t __pad2; 88 }; 89 90 static void compat_from_user(void *dst, void *src) 91 { 92 const struct compat_xt_connmark_info *cm = src; 93 struct xt_connmark_info m = { 94 .mark = cm->mark, 95 .mask = cm->mask, 96 .invert = cm->invert, 97 }; 98 memcpy(dst, &m, sizeof(m)); 99 } 100 101 static int compat_to_user(void __user *dst, void *src) 102 { 103 const struct xt_connmark_info *m = src; 104 struct compat_xt_connmark_info cm = { 105 .mark = m->mark, 106 .mask = m->mask, 107 .invert = m->invert, 108 }; 109 return copy_to_user(dst, &cm, sizeof(cm)) ? -EFAULT : 0; 110 } 111 #endif /* CONFIG_COMPAT */ 112 113 static struct xt_match xt_connmark_match[] __read_mostly = { 114 { 115 .name = "connmark", 116 .family = AF_INET, 117 .checkentry = checkentry, 118 .match = match, 119 .destroy = destroy, 120 .matchsize = sizeof(struct xt_connmark_info), 121 #ifdef CONFIG_COMPAT 122 .compatsize = sizeof(struct compat_xt_connmark_info), 123 .compat_from_user = compat_from_user, 124 .compat_to_user = compat_to_user, 125 #endif 126 .me = THIS_MODULE 127 }, 128 { 129 .name = "connmark", 130 .family = AF_INET6, 131 .checkentry = checkentry, 132 .match = match, 133 .destroy = destroy, 134 .matchsize = sizeof(struct xt_connmark_info), 135 .me = THIS_MODULE 136 }, 137 }; 138 139 static int __init xt_connmark_init(void) 140 { 141 return xt_register_matches(xt_connmark_match, 142 ARRAY_SIZE(xt_connmark_match)); 143 } 144 145 static void __exit xt_connmark_fini(void) 146 { 147 xt_unregister_matches(xt_connmark_match, ARRAY_SIZE(xt_connmark_match)); 148 } 149 150 module_init(xt_connmark_init); 151 module_exit(xt_connmark_fini); 152