1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22#include <linux/module.h>
23#include <linux/skbuff.h>
24#include <net/netfilter/nf_conntrack.h>
25#include <linux/netfilter/x_tables.h>
26#include <linux/netfilter/xt_connmark.h>
27
28MODULE_AUTHOR("Henrik Nordstrom <hno@marasystems.com>");
29MODULE_DESCRIPTION("IP tables connmark match module");
30MODULE_LICENSE("GPL");
31MODULE_ALIAS("ipt_connmark");
32MODULE_ALIAS("ip6t_connmark");
33
34static bool
35match(const struct sk_buff *skb,
36 const struct net_device *in,
37 const struct net_device *out,
38 const struct xt_match *match,
39 const void *matchinfo,
40 int offset,
41 unsigned int protoff,
42 bool *hotdrop)
43{
44 const struct xt_connmark_info *info = matchinfo;
45 const struct nf_conn *ct;
46 enum ip_conntrack_info ctinfo;
47
48 ct = nf_ct_get(skb, &ctinfo);
49 if (!ct)
50 return false;
51
52 return ((ct->mark & info->mask) == info->mark) ^ info->invert;
53}
54
55static bool
56checkentry(const char *tablename,
57 const void *ip,
58 const struct xt_match *match,
59 void *matchinfo,
60 unsigned int hook_mask)
61{
62 const struct xt_connmark_info *cm = matchinfo;
63
64 if (cm->mark > 0xffffffff || cm->mask > 0xffffffff) {
65 printk(KERN_WARNING "connmark: only support 32bit mark\n");
66 return false;
67 }
68 if (nf_ct_l3proto_try_module_get(match->family) < 0) {
69 printk(KERN_WARNING "can't load conntrack support for "
70 "proto=%d\n", match->family);
71 return false;
72 }
73 return true;
74}
75
76static void
77destroy(const struct xt_match *match, void *matchinfo)
78{
79 nf_ct_l3proto_module_put(match->family);
80}
81
82#ifdef CONFIG_COMPAT
83struct compat_xt_connmark_info {
84 compat_ulong_t mark, mask;
85 u_int8_t invert;
86 u_int8_t __pad1;
87 u_int16_t __pad2;
88};
89
90static void compat_from_user(void *dst, void *src)
91{
92 const struct compat_xt_connmark_info *cm = src;
93 struct xt_connmark_info m = {
94 .mark = cm->mark,
95 .mask = cm->mask,
96 .invert = cm->invert,
97 };
98 memcpy(dst, &m, sizeof(m));
99}
100
101static int compat_to_user(void __user *dst, void *src)
102{
103 const struct xt_connmark_info *m = src;
104 struct compat_xt_connmark_info cm = {
105 .mark = m->mark,
106 .mask = m->mask,
107 .invert = m->invert,
108 };
109 return copy_to_user(dst, &cm, sizeof(cm)) ? -EFAULT : 0;
110}
111#endif
112
113static struct xt_match xt_connmark_match[] __read_mostly = {
114 {
115 .name = "connmark",
116 .family = AF_INET,
117 .checkentry = checkentry,
118 .match = match,
119 .destroy = destroy,
120 .matchsize = sizeof(struct xt_connmark_info),
121#ifdef CONFIG_COMPAT
122 .compatsize = sizeof(struct compat_xt_connmark_info),
123 .compat_from_user = compat_from_user,
124 .compat_to_user = compat_to_user,
125#endif
126 .me = THIS_MODULE
127 },
128 {
129 .name = "connmark",
130 .family = AF_INET6,
131 .checkentry = checkentry,
132 .match = match,
133 .destroy = destroy,
134 .matchsize = sizeof(struct xt_connmark_info),
135 .me = THIS_MODULE
136 },
137};
138
139static int __init xt_connmark_init(void)
140{
141 return xt_register_matches(xt_connmark_match,
142 ARRAY_SIZE(xt_connmark_match));
143}
144
145static void __exit xt_connmark_fini(void)
146{
147 xt_unregister_matches(xt_connmark_match, ARRAY_SIZE(xt_connmark_match));
148}
149
150module_init(xt_connmark_init);
151module_exit(xt_connmark_fini);
152