1
2
3
4
5
6
7
8
9
10
11
12
13#include <linux/module.h>
14#include <linux/skbuff.h>
15#include <net/ipv6.h>
16#include <linux/netfilter/x_tables.h>
17#include <linux/netfilter/xt_conntrack.h>
18#include <net/netfilter/nf_conntrack.h>
19
20MODULE_LICENSE("GPL");
21MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
22MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
23MODULE_DESCRIPTION("Xtables: connection tracking state match");
24MODULE_ALIAS("ipt_conntrack");
25MODULE_ALIAS("ip6t_conntrack");
26
27static bool
28conntrack_addrcmp(const union nf_inet_addr *kaddr,
29 const union nf_inet_addr *uaddr,
30 const union nf_inet_addr *umask, unsigned int l3proto)
31{
32 if (l3proto == NFPROTO_IPV4)
33 return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0;
34 else if (l3proto == NFPROTO_IPV6)
35 return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6,
36 &uaddr->in6) == 0;
37 else
38 return false;
39}
40
41static inline bool
42conntrack_mt_origsrc(const struct nf_conn *ct,
43 const struct xt_conntrack_mtinfo2 *info,
44 u_int8_t family)
45{
46 return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
47 &info->origsrc_addr, &info->origsrc_mask, family);
48}
49
50static inline bool
51conntrack_mt_origdst(const struct nf_conn *ct,
52 const struct xt_conntrack_mtinfo2 *info,
53 u_int8_t family)
54{
55 return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
56 &info->origdst_addr, &info->origdst_mask, family);
57}
58
59static inline bool
60conntrack_mt_replsrc(const struct nf_conn *ct,
61 const struct xt_conntrack_mtinfo2 *info,
62 u_int8_t family)
63{
64 return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3,
65 &info->replsrc_addr, &info->replsrc_mask, family);
66}
67
68static inline bool
69conntrack_mt_repldst(const struct nf_conn *ct,
70 const struct xt_conntrack_mtinfo2 *info,
71 u_int8_t family)
72{
73 return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3,
74 &info->repldst_addr, &info->repldst_mask, family);
75}
76
77static inline bool
78ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info,
79 const struct nf_conn *ct)
80{
81 const struct nf_conntrack_tuple *tuple;
82
83 tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
84 if ((info->match_flags & XT_CONNTRACK_PROTO) &&
85 (nf_ct_protonum(ct) == info->l4proto) ^
86 !(info->invert_flags & XT_CONNTRACK_PROTO))
87 return false;
88
89
90 if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
91 (tuple->src.u.all == info->origsrc_port) ^
92 !(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
93 return false;
94
95 if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
96 (tuple->dst.u.all == info->origdst_port) ^
97 !(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
98 return false;
99
100 tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
101
102 if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
103 (tuple->src.u.all == info->replsrc_port) ^
104 !(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
105 return false;
106
107 if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
108 (tuple->dst.u.all == info->repldst_port) ^
109 !(info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
110 return false;
111
112 return true;
113}
114
115static bool
116conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par)
117{
118 const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
119 enum ip_conntrack_info ctinfo;
120 const struct nf_conn *ct;
121 unsigned int statebit;
122
123 ct = nf_ct_get(skb, &ctinfo);
124
125 if (ct == &nf_conntrack_untracked)
126 statebit = XT_CONNTRACK_STATE_UNTRACKED;
127 else if (ct != NULL)
128 statebit = XT_CONNTRACK_STATE_BIT(ctinfo);
129 else
130 statebit = XT_CONNTRACK_STATE_INVALID;
131
132 if (info->match_flags & XT_CONNTRACK_STATE) {
133 if (ct != NULL) {
134 if (test_bit(IPS_SRC_NAT_BIT, &ct->status))
135 statebit |= XT_CONNTRACK_STATE_SNAT;
136 if (test_bit(IPS_DST_NAT_BIT, &ct->status))
137 statebit |= XT_CONNTRACK_STATE_DNAT;
138 }
139 if (!!(info->state_mask & statebit) ^
140 !(info->invert_flags & XT_CONNTRACK_STATE))
141 return false;
142 }
143
144 if (ct == NULL)
145 return info->match_flags & XT_CONNTRACK_STATE;
146 if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
147 (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
148 !!(info->invert_flags & XT_CONNTRACK_DIRECTION))
149 return false;
150
151 if (info->match_flags & XT_CONNTRACK_ORIGSRC)
152 if (conntrack_mt_origsrc(ct, info, par->family) ^
153 !(info->invert_flags & XT_CONNTRACK_ORIGSRC))
154 return false;
155
156 if (info->match_flags & XT_CONNTRACK_ORIGDST)
157 if (conntrack_mt_origdst(ct, info, par->family) ^
158 !(info->invert_flags & XT_CONNTRACK_ORIGDST))
159 return false;
160
161 if (info->match_flags & XT_CONNTRACK_REPLSRC)
162 if (conntrack_mt_replsrc(ct, info, par->family) ^
163 !(info->invert_flags & XT_CONNTRACK_REPLSRC))
164 return false;
165
166 if (info->match_flags & XT_CONNTRACK_REPLDST)
167 if (conntrack_mt_repldst(ct, info, par->family) ^
168 !(info->invert_flags & XT_CONNTRACK_REPLDST))
169 return false;
170
171 if (!ct_proto_port_check(info, ct))
172 return false;
173
174 if ((info->match_flags & XT_CONNTRACK_STATUS) &&
175 (!!(info->status_mask & ct->status) ^
176 !(info->invert_flags & XT_CONNTRACK_STATUS)))
177 return false;
178
179 if (info->match_flags & XT_CONNTRACK_EXPIRES) {
180 unsigned long expires = 0;
181
182 if (timer_pending(&ct->timeout))
183 expires = (ct->timeout.expires - jiffies) / HZ;
184 if ((expires >= info->expires_min &&
185 expires <= info->expires_max) ^
186 !(info->invert_flags & XT_CONNTRACK_EXPIRES))
187 return false;
188 }
189 return true;
190}
191
192static bool
193conntrack_mt_v1(const struct sk_buff *skb, const struct xt_match_param *par)
194{
195 const struct xt_conntrack_mtinfo2 *const *info = par->matchinfo;
196 struct xt_match_param newpar = *par;
197
198 newpar.matchinfo = *info;
199 return conntrack_mt(skb, &newpar);
200}
201
202static bool conntrack_mt_check(const struct xt_mtchk_param *par)
203{
204 if (nf_ct_l3proto_try_module_get(par->family) < 0) {
205 printk(KERN_WARNING "can't load conntrack support for "
206 "proto=%u\n", par->family);
207 return false;
208 }
209 return true;
210}
211
212static bool conntrack_mt_check_v1(const struct xt_mtchk_param *par)
213{
214 struct xt_conntrack_mtinfo1 *info = par->matchinfo;
215 struct xt_conntrack_mtinfo2 *up;
216 int ret = conntrack_mt_check(par);
217
218 if (ret < 0)
219 return ret;
220
221 up = kmalloc(sizeof(*up), GFP_KERNEL);
222 if (up == NULL) {
223 nf_ct_l3proto_module_put(par->family);
224 return -ENOMEM;
225 }
226
227
228
229
230
231
232 memcpy(up, info, offsetof(typeof(*info), state_mask));
233 up->state_mask = info->state_mask;
234 up->status_mask = info->status_mask;
235 *(void **)info = up;
236 return true;
237}
238
239static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
240{
241 nf_ct_l3proto_module_put(par->family);
242}
243
244static void conntrack_mt_destroy_v1(const struct xt_mtdtor_param *par)
245{
246 struct xt_conntrack_mtinfo2 **info = par->matchinfo;
247 kfree(*info);
248 conntrack_mt_destroy(par);
249}
250
251static struct xt_match conntrack_mt_reg[] __read_mostly = {
252 {
253 .name = "conntrack",
254 .revision = 1,
255 .family = NFPROTO_UNSPEC,
256 .matchsize = sizeof(struct xt_conntrack_mtinfo1),
257 .match = conntrack_mt_v1,
258 .checkentry = conntrack_mt_check_v1,
259 .destroy = conntrack_mt_destroy_v1,
260 .me = THIS_MODULE,
261 },
262 {
263 .name = "conntrack",
264 .revision = 2,
265 .family = NFPROTO_UNSPEC,
266 .matchsize = sizeof(struct xt_conntrack_mtinfo2),
267 .match = conntrack_mt,
268 .checkentry = conntrack_mt_check,
269 .destroy = conntrack_mt_destroy,
270 .me = THIS_MODULE,
271 },
272};
273
274static int __init conntrack_mt_init(void)
275{
276 return xt_register_matches(conntrack_mt_reg,
277 ARRAY_SIZE(conntrack_mt_reg));
278}
279
280static void __exit conntrack_mt_exit(void)
281{
282 xt_unregister_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg));
283}
284
285module_init(conntrack_mt_init);
286module_exit(conntrack_mt_exit);
287