net/netfilter/xt_connlabel.c

   1 /*
   2  * (C) 2013 Astaro GmbH & Co KG
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8
   9 #include <linux/module.h>
  10 #include <linux/skbuff.h>
  11 #include <net/netfilter/nf_conntrack.h>
  12 #include <net/netfilter/nf_conntrack_labels.h>
  13 #include <linux/netfilter/x_tables.h>
  14
  15 MODULE_LICENSE("GPL");
  16 MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
  17 MODULE_DESCRIPTION("Xtables: add/match connection trackling labels");
  18 MODULE_ALIAS("ipt_connlabel");
  19 MODULE_ALIAS("ip6t_connlabel");
  20
  21 static bool
  22 connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par)
  23 {
  24         const struct xt_connlabel_mtinfo *info = par->matchinfo;
  25         enum ip_conntrack_info ctinfo;
  26         struct nf_conn *ct;
  27         bool invert = info->options & XT_CONNLABEL_OP_INVERT;
  28
  29         ct = nf_ct_get(skb, &ctinfo);
  30         if (ct == NULL || nf_ct_is_untracked(ct))
  31                 return invert;
  32
  33         if (info->options & XT_CONNLABEL_OP_SET)
  34                 return (nf_connlabel_set(ct, info->bit) == 0) ^ invert;
  35
  36         return nf_connlabel_match(ct, info->bit) ^ invert;
  37 }
  38
  39 static int connlabel_mt_check(const struct xt_mtchk_param *par)
  40 {
  41         const int options = XT_CONNLABEL_OP_INVERT |
  42                             XT_CONNLABEL_OP_SET;
  43         struct xt_connlabel_mtinfo *info = par->matchinfo;
  44         int ret;
  45
  46         if (info->options & ~options) {
  47                 pr_err("Unknown options in mask %x\n", info->options);
  48                 return -EINVAL;
  49         }
  50
  51         ret = nf_ct_l3proto_try_module_get(par->family);
  52         if (ret < 0) {
  53                 pr_info("cannot load conntrack support for proto=%u\n",
  54                                                         par->family);
  55                 return ret;
  56         }
  57
  58         ret = nf_connlabels_get(par->net, info->bit + 1);
  59         if (ret < 0)
  60                 nf_ct_l3proto_module_put(par->family);
  61         return ret;
  62 }
  63
  64 static void connlabel_mt_destroy(const struct xt_mtdtor_param *par)
  65 {
  66         nf_connlabels_put(par->net);
  67         nf_ct_l3proto_module_put(par->family);
  68 }
  69
  70 static struct xt_match connlabels_mt_reg __read_mostly = {
  71         .name           = "connlabel",
  72         .family         = NFPROTO_UNSPEC,
  73         .checkentry     = connlabel_mt_check,
  74         .match          = connlabel_mt,
  75         .matchsize      = sizeof(struct xt_connlabel_mtinfo),
  76         .destroy        = connlabel_mt_destroy,
  77         .me             = THIS_MODULE,
  78 };
  79
  80 static int __init connlabel_mt_init(void)
  81 {
  82         return xt_register_match(&connlabels_mt_reg);
  83 }
  84
  85 static void __exit connlabel_mt_exit(void)
  86 {
  87         xt_unregister_match(&connlabels_mt_reg);
  88 }
  89
  90 module_init(connlabel_mt_init);
  91 module_exit(connlabel_mt_exit);