net/ipv4/netfilter/ipt_state.c

   1 /* Kernel module to match connection tracking information. */
   2
   3 /* (C) 1999-2001 Paul `Rusty' Russell
   4  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  */
  10
  11 #include <linux/module.h>
  12 #include <linux/skbuff.h>
  13 #include <linux/netfilter_ipv4/ip_conntrack.h>
  14 #include <linux/netfilter_ipv4/ip_tables.h>
  15 #include <linux/netfilter_ipv4/ipt_state.h>
  16
  17 MODULE_LICENSE("GPL");
  18 MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
  19 MODULE_DESCRIPTION("iptables connection tracking state match module");
  20
  21 static int
  22 match(const struct sk_buff *skb,
  23       const struct net_device *in,
  24       const struct net_device *out,
  25       const void *matchinfo,
  26       int offset,
  27       int *hotdrop)
  28 {
  29         const struct ipt_state_info *sinfo = matchinfo;
  30         enum ip_conntrack_info ctinfo;
  31         unsigned int statebit;
  32
  33         if (skb->nfct == &ip_conntrack_untracked.ct_general)
  34                 statebit = IPT_STATE_UNTRACKED;
  35         else if (!ip_conntrack_get(skb, &ctinfo))
  36                 statebit = IPT_STATE_INVALID;
  37         else
  38                 statebit = IPT_STATE_BIT(ctinfo);
  39
  40         return (sinfo->statemask & statebit);
  41 }
  42
  43 static int check(const char *tablename,
  44                  const struct ipt_ip *ip,
  45                  void *matchinfo,
  46                  unsigned int matchsize,
  47                  unsigned int hook_mask)
  48 {
  49         if (matchsize != IPT_ALIGN(sizeof(struct ipt_state_info)))
  50                 return 0;
  51
  52         return 1;
  53 }
  54
  55 static struct ipt_match state_match = {
  56         .name           = "state",
  57         .match          = &match,
  58         .checkentry     = &check,
  59         .me             = THIS_MODULE,
  60 };
  61
  62 static int __init init(void)
  63 {
  64         need_ip_conntrack();
  65         return ipt_register_match(&state_match);
  66 }
  67
  68 static void __exit fini(void)
  69 {
  70         ipt_unregister_match(&state_match);
  71 }
  72
  73 module_init(init);
  74 module_exit(fini);