1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24#include <linux/module.h>
25#include <linux/skbuff.h>
26#include <net/netfilter/nf_conntrack.h>
27#include <linux/netfilter/x_tables.h>
28#include <linux/netfilter/xt_connmark.h>
29
30MODULE_AUTHOR("Henrik Nordstrom <hno@marasystems.com>");
31MODULE_DESCRIPTION("Xtables: connection mark match");
32MODULE_LICENSE("GPL");
33MODULE_ALIAS("ipt_connmark");
34MODULE_ALIAS("ip6t_connmark");
35
36static bool
37connmark_mt(const struct sk_buff *skb, const struct xt_match_param *par)
38{
39 const struct xt_connmark_mtinfo1 *info = par->matchinfo;
40 enum ip_conntrack_info ctinfo;
41 const struct nf_conn *ct;
42
43 ct = nf_ct_get(skb, &ctinfo);
44 if (ct == NULL)
45 return false;
46
47 return ((ct->mark & info->mask) == info->mark) ^ info->invert;
48}
49
50static bool
51connmark_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
52{
53 const struct xt_connmark_info *info = par->matchinfo;
54 const struct nf_conn *ct;
55 enum ip_conntrack_info ctinfo;
56
57 ct = nf_ct_get(skb, &ctinfo);
58 if (!ct)
59 return false;
60
61 return ((ct->mark & info->mask) == info->mark) ^ info->invert;
62}
63
64static bool connmark_mt_check_v0(const struct xt_mtchk_param *par)
65{
66 const struct xt_connmark_info *cm = par->matchinfo;
67
68 if (cm->mark > 0xffffffff || cm->mask > 0xffffffff) {
69 printk(KERN_WARNING "connmark: only support 32bit mark\n");
70 return false;
71 }
72 if (nf_ct_l3proto_try_module_get(par->family) < 0) {
73 printk(KERN_WARNING "can't load conntrack support for "
74 "proto=%u\n", par->family);
75 return false;
76 }
77 return true;
78}
79
80static bool connmark_mt_check(const struct xt_mtchk_param *par)
81{
82 if (nf_ct_l3proto_try_module_get(par->family) < 0) {
83 printk(KERN_WARNING "cannot load conntrack support for "
84 "proto=%u\n", par->family);
85 return false;
86 }
87 return true;
88}
89
90static void connmark_mt_destroy(const struct xt_mtdtor_param *par)
91{
92 nf_ct_l3proto_module_put(par->family);
93}
94
95#ifdef CONFIG_COMPAT
96struct compat_xt_connmark_info {
97 compat_ulong_t mark, mask;
98 u_int8_t invert;
99 u_int8_t __pad1;
100 u_int16_t __pad2;
101};
102
103static void connmark_mt_compat_from_user_v0(void *dst, void *src)
104{
105 const struct compat_xt_connmark_info *cm = src;
106 struct xt_connmark_info m = {
107 .mark = cm->mark,
108 .mask = cm->mask,
109 .invert = cm->invert,
110 };
111 memcpy(dst, &m, sizeof(m));
112}
113
114static int connmark_mt_compat_to_user_v0(void __user *dst, void *src)
115{
116 const struct xt_connmark_info *m = src;
117 struct compat_xt_connmark_info cm = {
118 .mark = m->mark,
119 .mask = m->mask,
120 .invert = m->invert,
121 };
122 return copy_to_user(dst, &cm, sizeof(cm)) ? -EFAULT : 0;
123}
124#endif
125
126static struct xt_match connmark_mt_reg[] __read_mostly = {
127 {
128 .name = "connmark",
129 .revision = 0,
130 .family = NFPROTO_UNSPEC,
131 .checkentry = connmark_mt_check_v0,
132 .match = connmark_mt_v0,
133 .destroy = connmark_mt_destroy,
134 .matchsize = sizeof(struct xt_connmark_info),
135#ifdef CONFIG_COMPAT
136 .compatsize = sizeof(struct compat_xt_connmark_info),
137 .compat_from_user = connmark_mt_compat_from_user_v0,
138 .compat_to_user = connmark_mt_compat_to_user_v0,
139#endif
140 .me = THIS_MODULE
141 },
142 {
143 .name = "connmark",
144 .revision = 1,
145 .family = NFPROTO_UNSPEC,
146 .checkentry = connmark_mt_check,
147 .match = connmark_mt,
148 .matchsize = sizeof(struct xt_connmark_mtinfo1),
149 .destroy = connmark_mt_destroy,
150 .me = THIS_MODULE,
151 },
152};
153
154static int __init connmark_mt_init(void)
155{
156 return xt_register_matches(connmark_mt_reg,
157 ARRAY_SIZE(connmark_mt_reg));
158}
159
160static void __exit connmark_mt_exit(void)
161{
162 xt_unregister_matches(connmark_mt_reg, ARRAY_SIZE(connmark_mt_reg));
163}
164
165module_init(connmark_mt_init);
166module_exit(connmark_mt_exit);
167
