fed up with those stupid warnings
[mmotm.git] / net / netfilter / xt_conntrack.c
blob6dc4652f2fe8fdb5a9775b71f68e10970f057476
1 /*
2 * xt_conntrack - Netfilter module to match connection tracking
3 * information. (Superset of Rusty's minimalistic state match.)
5 * (C) 2001 Marc Boucher (marc@mbsi.ca).
6 * Copyright © CC Computer Consultants GmbH, 2007 - 2008
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
15 #include <net/ipv6.h>
16 #include <linux/netfilter/x_tables.h>
17 #include <linux/netfilter/xt_conntrack.h>
18 #include <net/netfilter/nf_conntrack.h>
20 MODULE_LICENSE("GPL");
21 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
22 MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
23 MODULE_DESCRIPTION("Xtables: connection tracking state match");
24 MODULE_ALIAS("ipt_conntrack");
25 MODULE_ALIAS("ip6t_conntrack");
27 static bool
28 conntrack_addrcmp(const union nf_inet_addr *kaddr,
29 const union nf_inet_addr *uaddr,
30 const union nf_inet_addr *umask, unsigned int l3proto)
32 if (l3proto == NFPROTO_IPV4)
33 return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0;
34 else if (l3proto == NFPROTO_IPV6)
35 return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6,
36 &uaddr->in6) == 0;
37 else
38 return false;
41 static inline bool
42 conntrack_mt_origsrc(const struct nf_conn *ct,
43 const struct xt_conntrack_mtinfo2 *info,
44 u_int8_t family)
46 return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
47 &info->origsrc_addr, &info->origsrc_mask, family);
50 static inline bool
51 conntrack_mt_origdst(const struct nf_conn *ct,
52 const struct xt_conntrack_mtinfo2 *info,
53 u_int8_t family)
55 return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
56 &info->origdst_addr, &info->origdst_mask, family);
59 static inline bool
60 conntrack_mt_replsrc(const struct nf_conn *ct,
61 const struct xt_conntrack_mtinfo2 *info,
62 u_int8_t family)
64 return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3,
65 &info->replsrc_addr, &info->replsrc_mask, family);
68 static inline bool
69 conntrack_mt_repldst(const struct nf_conn *ct,
70 const struct xt_conntrack_mtinfo2 *info,
71 u_int8_t family)
73 return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3,
74 &info->repldst_addr, &info->repldst_mask, family);
77 static inline bool
78 ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info,
79 const struct nf_conn *ct)
81 const struct nf_conntrack_tuple *tuple;
83 tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
84 if ((info->match_flags & XT_CONNTRACK_PROTO) &&
85 (nf_ct_protonum(ct) == info->l4proto) ^
86 !(info->invert_flags & XT_CONNTRACK_PROTO))
87 return false;
89 /* Shortcut to match all recognized protocols by using ->src.all. */
90 if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
91 (tuple->src.u.all == info->origsrc_port) ^
92 !(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
93 return false;
95 if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
96 (tuple->dst.u.all == info->origdst_port) ^
97 !(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
98 return false;
100 tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
102 if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
103 (tuple->src.u.all == info->replsrc_port) ^
104 !(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
105 return false;
107 if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
108 (tuple->dst.u.all == info->repldst_port) ^
109 !(info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
110 return false;
112 return true;
115 static bool
116 conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par)
118 const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
119 enum ip_conntrack_info ctinfo;
120 const struct nf_conn *ct;
121 unsigned int statebit;
123 ct = nf_ct_get(skb, &ctinfo);
125 if (ct == &nf_conntrack_untracked)
126 statebit = XT_CONNTRACK_STATE_UNTRACKED;
127 else if (ct != NULL)
128 statebit = XT_CONNTRACK_STATE_BIT(ctinfo);
129 else
130 statebit = XT_CONNTRACK_STATE_INVALID;
132 if (info->match_flags & XT_CONNTRACK_STATE) {
133 if (ct != NULL) {
134 if (test_bit(IPS_SRC_NAT_BIT, &ct->status))
135 statebit |= XT_CONNTRACK_STATE_SNAT;
136 if (test_bit(IPS_DST_NAT_BIT, &ct->status))
137 statebit |= XT_CONNTRACK_STATE_DNAT;
139 if (!!(info->state_mask & statebit) ^
140 !(info->invert_flags & XT_CONNTRACK_STATE))
141 return false;
144 if (ct == NULL)
145 return info->match_flags & XT_CONNTRACK_STATE;
146 if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
147 (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
148 !!(info->invert_flags & XT_CONNTRACK_DIRECTION))
149 return false;
151 if (info->match_flags & XT_CONNTRACK_ORIGSRC)
152 if (conntrack_mt_origsrc(ct, info, par->family) ^
153 !(info->invert_flags & XT_CONNTRACK_ORIGSRC))
154 return false;
156 if (info->match_flags & XT_CONNTRACK_ORIGDST)
157 if (conntrack_mt_origdst(ct, info, par->family) ^
158 !(info->invert_flags & XT_CONNTRACK_ORIGDST))
159 return false;
161 if (info->match_flags & XT_CONNTRACK_REPLSRC)
162 if (conntrack_mt_replsrc(ct, info, par->family) ^
163 !(info->invert_flags & XT_CONNTRACK_REPLSRC))
164 return false;
166 if (info->match_flags & XT_CONNTRACK_REPLDST)
167 if (conntrack_mt_repldst(ct, info, par->family) ^
168 !(info->invert_flags & XT_CONNTRACK_REPLDST))
169 return false;
171 if (!ct_proto_port_check(info, ct))
172 return false;
174 if ((info->match_flags & XT_CONNTRACK_STATUS) &&
175 (!!(info->status_mask & ct->status) ^
176 !(info->invert_flags & XT_CONNTRACK_STATUS)))
177 return false;
179 if (info->match_flags & XT_CONNTRACK_EXPIRES) {
180 unsigned long expires = 0;
182 if (timer_pending(&ct->timeout))
183 expires = (ct->timeout.expires - jiffies) / HZ;
184 if ((expires >= info->expires_min &&
185 expires <= info->expires_max) ^
186 !(info->invert_flags & XT_CONNTRACK_EXPIRES))
187 return false;
189 return true;
192 static bool
193 conntrack_mt_v1(const struct sk_buff *skb, const struct xt_match_param *par)
195 const struct xt_conntrack_mtinfo2 *const *info = par->matchinfo;
196 struct xt_match_param newpar = *par;
198 newpar.matchinfo = *info;
199 return conntrack_mt(skb, &newpar);
202 static bool conntrack_mt_check(const struct xt_mtchk_param *par)
204 if (nf_ct_l3proto_try_module_get(par->family) < 0) {
205 printk(KERN_WARNING "can't load conntrack support for "
206 "proto=%u\n", par->family);
207 return false;
209 return true;
212 static bool conntrack_mt_check_v1(const struct xt_mtchk_param *par)
214 struct xt_conntrack_mtinfo1 *info = par->matchinfo;
215 struct xt_conntrack_mtinfo2 *up;
216 int ret = conntrack_mt_check(par);
218 if (ret < 0)
219 return ret;
221 up = kmalloc(sizeof(*up), GFP_KERNEL);
222 if (up == NULL) {
223 nf_ct_l3proto_module_put(par->family);
224 return -ENOMEM;
228 * The strategy here is to minimize the overhead of v1 matching,
229 * by prebuilding a v2 struct and putting the pointer into the
230 * v1 dataspace.
232 memcpy(up, info, offsetof(typeof(*info), state_mask));
233 up->state_mask = info->state_mask;
234 up->status_mask = info->status_mask;
235 *(void **)info = up;
236 return true;
239 static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
241 nf_ct_l3proto_module_put(par->family);
244 static void conntrack_mt_destroy_v1(const struct xt_mtdtor_param *par)
246 struct xt_conntrack_mtinfo2 **info = par->matchinfo;
247 kfree(*info);
248 conntrack_mt_destroy(par);
251 static struct xt_match conntrack_mt_reg[] __read_mostly = {
253 .name = "conntrack",
254 .revision = 1,
255 .family = NFPROTO_UNSPEC,
256 .matchsize = sizeof(struct xt_conntrack_mtinfo1),
257 .match = conntrack_mt_v1,
258 .checkentry = conntrack_mt_check_v1,
259 .destroy = conntrack_mt_destroy_v1,
260 .me = THIS_MODULE,
263 .name = "conntrack",
264 .revision = 2,
265 .family = NFPROTO_UNSPEC,
266 .matchsize = sizeof(struct xt_conntrack_mtinfo2),
267 .match = conntrack_mt,
268 .checkentry = conntrack_mt_check,
269 .destroy = conntrack_mt_destroy,
270 .me = THIS_MODULE,
274 static int __init conntrack_mt_init(void)
276 return xt_register_matches(conntrack_mt_reg,
277 ARRAY_SIZE(conntrack_mt_reg));
280 static void __exit conntrack_mt_exit(void)
282 xt_unregister_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg));
285 module_init(conntrack_mt_init);
286 module_exit(conntrack_mt_exit);