1 /* This kernel module matches connection mark values set by the 2 * CONNMARK target 3 * 4 * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com> 5 * by Henrik Nordstrom <hno@marasystems.com> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License as published by 9 * the Free Software Foundation; either version 2 of the License, or 10 * (at your option) any later version. 11 * 12 * This program is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * GNU General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License 18 * along with this program; if not, write to the Free Software 19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 20 */ 21 22 #include <linux/module.h> 23 #include <linux/skbuff.h> 24 #include <net/netfilter/nf_conntrack.h> 25 #include <linux/netfilter/x_tables.h> 26 #include <linux/netfilter/xt_connmark.h> 27 28 MODULE_AUTHOR("Henrik Nordstrom <hno@marasytems.com>"); 29 MODULE_DESCRIPTION("IP tables connmark match module"); 30 MODULE_LICENSE("GPL"); 31 MODULE_ALIAS("ipt_connmark"); 32 33 static bool 34 match(const struct sk_buff *skb, 35 const struct net_device *in, 36 const struct net_device *out, 37 const struct xt_match *match, 38 const void *matchinfo, 39 int offset, 40 unsigned int protoff, 41 bool *hotdrop) 42 { 43 const struct xt_connmark_info *info = matchinfo; 44 struct nf_conn *ct; 45 enum ip_conntrack_info ctinfo; 46 47 ct = nf_ct_get(skb, &ctinfo); 48 if (!ct) 49 return false; 50 51 return (((ct->mark) & info->mask) == info->mark) ^ info->invert; 52 } 53 54 static bool 55 checkentry(const char *tablename, 56 const void *ip, 57 const struct xt_match *match, 58 void *matchinfo, 59 unsigned int hook_mask) 60 { 61 struct xt_connmark_info *cm = matchinfo; 62 63 if (cm->mark > 0xffffffff || cm->mask > 0xffffffff) { 64 printk(KERN_WARNING "connmark: only support 32bit mark\n"); 65 return false; 66 } 67 if (nf_ct_l3proto_try_module_get(match->family) < 0) { 68 printk(KERN_WARNING "can't load conntrack support for " 69 "proto=%d\n", match->family); 70 return false; 71 } 72 return true; 73 } 74 75 static void 76 destroy(const struct xt_match *match, void *matchinfo) 77 { 78 nf_ct_l3proto_module_put(match->family); 79 } 80 81 #ifdef CONFIG_COMPAT 82 struct compat_xt_connmark_info { 83 compat_ulong_t mark, mask; 84 u_int8_t invert; 85 u_int8_t __pad1; 86 u_int16_t __pad2; 87 }; 88 89 static void compat_from_user(void *dst, void *src) 90 { 91 struct compat_xt_connmark_info *cm = src; 92 struct xt_connmark_info m = { 93 .mark = cm->mark, 94 .mask = cm->mask, 95 .invert = cm->invert, 96 }; 97 memcpy(dst, &m, sizeof(m)); 98 } 99 100 static int compat_to_user(void __user *dst, void *src) 101 { 102 struct xt_connmark_info *m = src; 103 struct compat_xt_connmark_info cm = { 104 .mark = m->mark, 105 .mask = m->mask, 106 .invert = m->invert, 107 }; 108 return copy_to_user(dst, &cm, sizeof(cm)) ? -EFAULT : 0; 109 } 110 #endif /* CONFIG_COMPAT */ 111 112 static struct xt_match xt_connmark_match[] = { 113 { 114 .name = "connmark", 115 .family = AF_INET, 116 .checkentry = checkentry, 117 .match = match, 118 .destroy = destroy, 119 .matchsize = sizeof(struct xt_connmark_info), 120 #ifdef CONFIG_COMPAT 121 .compatsize = sizeof(struct compat_xt_connmark_info), 122 .compat_from_user = compat_from_user, 123 .compat_to_user = compat_to_user, 124 #endif 125 .me = THIS_MODULE 126 }, 127 { 128 .name = "connmark", 129 .family = AF_INET6, 130 .checkentry = checkentry, 131 .match = match, 132 .destroy = destroy, 133 .matchsize = sizeof(struct xt_connmark_info), 134 .me = THIS_MODULE 135 }, 136 }; 137 138 static int __init xt_connmark_init(void) 139 { 140 return xt_register_matches(xt_connmark_match, 141 ARRAY_SIZE(xt_connmark_match)); 142 } 143 144 static void __exit xt_connmark_fini(void) 145 { 146 xt_unregister_matches(xt_connmark_match, ARRAY_SIZE(xt_connmark_match)); 147 } 148 149 module_init(xt_connmark_init); 150 module_exit(xt_connmark_fini); 151