1 /* Kernel module to match connection tracking information. */ 2 3 /* (C) 1999-2001 Paul `Rusty' Russell 4 * (C) 2002-2005 Netfilter Core Team <coreteam@netfilter.org> 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 2 as 8 * published by the Free Software Foundation. 9 */ 10 11 #include <linux/module.h> 12 #include <linux/skbuff.h> 13 #include <net/netfilter/nf_conntrack.h> 14 #include <linux/netfilter/x_tables.h> 15 #include <linux/netfilter/xt_state.h> 16 17 MODULE_LICENSE("GPL"); 18 MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>"); 19 MODULE_DESCRIPTION("ip[6]_tables connection tracking state match module"); 20 MODULE_ALIAS("ipt_state"); 21 MODULE_ALIAS("ip6t_state"); 22 23 static int 24 match(const struct sk_buff *skb, 25 const struct net_device *in, 26 const struct net_device *out, 27 const struct xt_match *match, 28 const void *matchinfo, 29 int offset, 30 unsigned int protoff, 31 bool *hotdrop) 32 { 33 const struct xt_state_info *sinfo = matchinfo; 34 enum ip_conntrack_info ctinfo; 35 unsigned int statebit; 36 37 if (nf_ct_is_untracked(skb)) 38 statebit = XT_STATE_UNTRACKED; 39 else if (!nf_ct_get(skb, &ctinfo)) 40 statebit = XT_STATE_INVALID; 41 else 42 statebit = XT_STATE_BIT(ctinfo); 43 44 return (sinfo->statemask & statebit); 45 } 46 47 static int check(const char *tablename, 48 const void *inf, 49 const struct xt_match *match, 50 void *matchinfo, 51 unsigned int hook_mask) 52 { 53 if (nf_ct_l3proto_try_module_get(match->family) < 0) { 54 printk(KERN_WARNING "can't load conntrack support for " 55 "proto=%d\n", match->family); 56 return 0; 57 } 58 return 1; 59 } 60 61 static void 62 destroy(const struct xt_match *match, void *matchinfo) 63 { 64 nf_ct_l3proto_module_put(match->family); 65 } 66 67 static struct xt_match xt_state_match[] = { 68 { 69 .name = "state", 70 .family = AF_INET, 71 .checkentry = check, 72 .match = match, 73 .destroy = destroy, 74 .matchsize = sizeof(struct xt_state_info), 75 .me = THIS_MODULE, 76 }, 77 { 78 .name = "state", 79 .family = AF_INET6, 80 .checkentry = check, 81 .match = match, 82 .destroy = destroy, 83 .matchsize = sizeof(struct xt_state_info), 84 .me = THIS_MODULE, 85 }, 86 }; 87 88 static int __init xt_state_init(void) 89 { 90 return xt_register_matches(xt_state_match, ARRAY_SIZE(xt_state_match)); 91 } 92 93 static void __exit xt_state_fini(void) 94 { 95 xt_unregister_matches(xt_state_match, ARRAY_SIZE(xt_state_match)); 96 } 97 98 module_init(xt_state_init); 99 module_exit(xt_state_fini); 100