1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24#include <linux/module.h>
25#include <linux/skbuff.h>
26#include <net/netfilter/nf_conntrack.h>
27#include <linux/netfilter/x_tables.h>
28#include <linux/netfilter/xt_connmark.h>
29
30MODULE_AUTHOR("Henrik Nordstrom <hno@marasystems.com>");
31MODULE_DESCRIPTION("Xtables: connection mark match");
32MODULE_LICENSE("GPL");
33MODULE_ALIAS("ipt_connmark");
34MODULE_ALIAS("ip6t_connmark");
35
36static bool
37connmark_mt(const struct sk_buff *skb, const struct xt_match_param *par)
38{
39 const struct xt_connmark_mtinfo1 *info = par->matchinfo;
40 enum ip_conntrack_info ctinfo;
41 const struct nf_conn *ct;
42
43 ct = nf_ct_get(skb, &ctinfo);
44 if (ct == NULL)
45 return false;
46
47 return ((ct->mark & info->mask) == info->mark) ^ info->invert;
48}
49
50static bool connmark_mt_check(const struct xt_mtchk_param *par)
51{
52 if (nf_ct_l3proto_try_module_get(par->family) < 0) {
53 printk(KERN_WARNING "cannot load conntrack support for "
54 "proto=%u\n", par->family);
55 return false;
56 }
57 return true;
58}
59
60static void connmark_mt_destroy(const struct xt_mtdtor_param *par)
61{
62 nf_ct_l3proto_module_put(par->family);
63}
64
65static struct xt_match connmark_mt_reg __read_mostly = {
66 .name = "connmark",
67 .revision = 1,
68 .family = NFPROTO_UNSPEC,
69 .checkentry = connmark_mt_check,
70 .match = connmark_mt,
71 .matchsize = sizeof(struct xt_connmark_mtinfo1),
72 .destroy = connmark_mt_destroy,
73 .me = THIS_MODULE,
74};
75
76static int __init connmark_mt_init(void)
77{
78 return xt_register_match(&connmark_mt_reg);
79}
80
81static void __exit connmark_mt_exit(void)
82{
83 xt_unregister_match(&connmark_mt_reg);
84}
85
86module_init(connmark_mt_init);
87module_exit(connmark_mt_exit);
88