[deliverable/linux.git] / net / netfilter / xt_conntrack.c

/*
 *	xt_conntrack - Netfilter module to match connection tracking
 *	information. (Superset of Rusty's minimalistic state match.)
 *
 *	(C) 2001  Marc Boucher (marc@mbsi.ca).
 *	(C) 2006-2012 Patrick McHardy <kaber@trash.net>
 *	Copyright © CC Computer Consultants GmbH, 2007 - 2008
 *
 *	This program is free software; you can redistribute it and/or modify
 *	it under the terms of the GNU General Public License version 2 as
 *	published by the Free Software Foundation.
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/ipv6.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_conntrack.h>
#include <net/netfilter/nf_conntrack.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
MODULE_DESCRIPTION("Xtables: connection tracking state match");
MODULE_ALIAS("ipt_conntrack");
MODULE_ALIAS("ip6t_conntrack");

static bool
conntrack_addrcmp(const union nf_inet_addr *kaddr,
                  const union nf_inet_addr *uaddr,
                  const union nf_inet_addr *umask, unsigned int l3proto)
{
	if (l3proto == NFPROTO_IPV4)
		return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0;
	else if (l3proto == NFPROTO_IPV6)
		return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6,
		       &uaddr->in6) == 0;
	else
		return false;
}

static inline bool
conntrack_mt_origsrc(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
	       &info->origsrc_addr, &info->origsrc_mask, family);
}

static inline bool
conntrack_mt_origdst(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
	       &info->origdst_addr, &info->origdst_mask, family);
}

static inline bool
conntrack_mt_replsrc(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3,
	       &info->replsrc_addr, &info->replsrc_mask, family);
}

static inline bool
conntrack_mt_repldst(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3,
	       &info->repldst_addr, &info->repldst_mask, family);
}

static inline bool
ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info,
                    const struct nf_conn *ct)
{
	const struct nf_conntrack_tuple *tuple;

	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
	    (nf_ct_protonum(ct) == info->l4proto) ^
	    !(info->invert_flags & XT_CONNTRACK_PROTO))
		return false;

	/* Shortcut to match all recognized protocols by using ->src.all. */
	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	    (tuple->src.u.all == info->origsrc_port) ^
	    !(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	    (tuple->dst.u.all == info->origdst_port) ^
	    !(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
		return false;

	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;

	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	    (tuple->src.u.all == info->replsrc_port) ^
	    !(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	    (tuple->dst.u.all == info->repldst_port) ^
	    !(info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
		return false;

	return true;
}

static inline bool
port_match(u16 min, u16 max, u16 port, bool invert)
{
	return (port >= min && port <= max) ^ invert;
}

static inline bool
ct_proto_port_check_v3(const struct xt_conntrack_mtinfo3 *info,
		       const struct nf_conn *ct)
{
	const struct nf_conntrack_tuple *tuple;

	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
	    (nf_ct_protonum(ct) == info->l4proto) ^
	    !(info->invert_flags & XT_CONNTRACK_PROTO))
		return false;

	/* Shortcut to match all recognized protocols by using ->src.all. */
	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	    !port_match(info->origsrc_port, info->origsrc_port_high,
			ntohs(tuple->src.u.all),
			info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	    !port_match(info->origdst_port, info->origdst_port_high,
			ntohs(tuple->dst.u.all),
			info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
		return false;

	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;

	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	    !port_match(info->replsrc_port, info->replsrc_port_high,
			ntohs(tuple->src.u.all),
			info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	    !port_match(info->repldst_port, info->repldst_port_high,
			ntohs(tuple->dst.u.all),
			info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
		return false;

	return true;
}

static bool
conntrack_mt(const struct sk_buff *skb, struct xt_action_param *par,
             u16 state_mask, u16 status_mask)
{
	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
	enum ip_conntrack_info ctinfo;
	const struct nf_conn *ct;
	unsigned int statebit;

	ct = nf_ct_get(skb, &ctinfo);

	if (ct) {
		if (nf_ct_is_untracked(ct))
			statebit = XT_CONNTRACK_STATE_UNTRACKED;
		else
			statebit = XT_CONNTRACK_STATE_BIT(ctinfo);
	} else
		statebit = XT_CONNTRACK_STATE_INVALID;

	if (info->match_flags & XT_CONNTRACK_STATE) {
		if (ct != NULL) {
			if (test_bit(IPS_SRC_NAT_BIT, &ct->status))
				statebit |= XT_CONNTRACK_STATE_SNAT;
			if (test_bit(IPS_DST_NAT_BIT, &ct->status))
				statebit |= XT_CONNTRACK_STATE_DNAT;
		}
		if (!!(state_mask & statebit) ^
		    !(info->invert_flags & XT_CONNTRACK_STATE))
			return false;
	}

	if (ct == NULL)
		return info->match_flags & XT_CONNTRACK_STATE;
	if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
	    (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
	    !(info->invert_flags & XT_CONNTRACK_DIRECTION))
		return false;

	if (info->match_flags & XT_CONNTRACK_ORIGSRC)
		if (conntrack_mt_origsrc(ct, info, par->family) ^
		    !(info->invert_flags & XT_CONNTRACK_ORIGSRC))
			return false;

	if (info->match_flags & XT_CONNTRACK_ORIGDST)
		if (conntrack_mt_origdst(ct, info, par->family) ^
		    !(info->invert_flags & XT_CONNTRACK_ORIGDST))
			return false;

	if (info->match_flags & XT_CONNTRACK_REPLSRC)
		if (conntrack_mt_replsrc(ct, info, par->family) ^
		    !(info->invert_flags & XT_CONNTRACK_REPLSRC))
			return false;

	if (info->match_flags & XT_CONNTRACK_REPLDST)
		if (conntrack_mt_repldst(ct, info, par->family) ^
		    !(info->invert_flags & XT_CONNTRACK_REPLDST))
			return false;

	if (par->match->revision != 3) {
		if (!ct_proto_port_check(info, ct))
			return false;
	} else {
		if (!ct_proto_port_check_v3(par->matchinfo, ct))
			return false;
	}

	if ((info->match_flags & XT_CONNTRACK_STATUS) &&
	    (!!(status_mask & ct->status) ^
	    !(info->invert_flags & XT_CONNTRACK_STATUS)))
		return false;

	if (info->match_flags & XT_CONNTRACK_EXPIRES) {
		unsigned long expires = nf_ct_expires(ct) / HZ;

		if ((expires >= info->expires_min &&
		    expires <= info->expires_max) ^
		    !(info->invert_flags & XT_CONNTRACK_EXPIRES))
			return false;
	}
	return true;
}

static bool
conntrack_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_conntrack_mtinfo1 *info = par->matchinfo;

	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
}

static bool
conntrack_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;

	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
}

static bool
conntrack_mt_v3(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_conntrack_mtinfo3 *info = par->matchinfo;

	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
}

static int conntrack_mt_check(const struct xt_mtchk_param *par)
{
	int ret;

	ret = nf_ct_l3proto_try_module_get(par->family);
	if (ret < 0)
		pr_info("cannot load conntrack support for proto=%u\n",
			par->family);
	return ret;
}

static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
{
	nf_ct_l3proto_module_put(par->family);
}

static struct xt_match conntrack_mt_reg[] __read_mostly = {
	{
		.name       = "conntrack",
		.revision   = 1,
		.family     = NFPROTO_UNSPEC,
		.matchsize  = sizeof(struct xt_conntrack_mtinfo1),
		.match      = conntrack_mt_v1,
		.checkentry = conntrack_mt_check,
		.destroy    = conntrack_mt_destroy,
		.me         = THIS_MODULE,
	},
	{
		.name       = "conntrack",
		.revision   = 2,
		.family     = NFPROTO_UNSPEC,
		.matchsize  = sizeof(struct xt_conntrack_mtinfo2),
		.match      = conntrack_mt_v2,
		.checkentry = conntrack_mt_check,
		.destroy    = conntrack_mt_destroy,
		.me         = THIS_MODULE,
	},
	{
		.name       = "conntrack",
		.revision   = 3,
		.family     = NFPROTO_UNSPEC,
		.matchsize  = sizeof(struct xt_conntrack_mtinfo3),
		.match      = conntrack_mt_v3,
		.checkentry = conntrack_mt_check,
		.destroy    = conntrack_mt_destroy,
		.me         = THIS_MODULE,
	},
};

static int __init conntrack_mt_init(void)
{
	return xt_register_matches(conntrack_mt_reg,
	       ARRAY_SIZE(conntrack_mt_reg));
}

static void __exit conntrack_mt_exit(void)
{
	xt_unregister_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg));
}

module_init(conntrack_mt_init);
module_exit(conntrack_mt_exit);
Commit	Line	Data
64eb12f9 JE	1	/*
	2	* xt_conntrack - Netfilter module to match connection tracking
	3	* information. (Superset of Rusty's minimalistic state match.)
1da177e4	4	*
64eb12f9	5	* (C) 2001 Marc Boucher (marc@mbsi.ca).
f229f6ce	6	* (C) 2006-2012 Patrick McHardy <kaber@trash.net>
64eb12f9	7	* Copyright © CC Computer Consultants GmbH, 2007 - 2008
1da177e4	8	*
64eb12f9 JE	9	* This program is free software; you can redistribute it and/or modify
	10	* it under the terms of the GNU General Public License version 2 as
	11	* published by the Free Software Foundation.
1da177e4	12	*/
8bee4bad	13	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
1da177e4 LT	14	#include <linux/module.h>
1da177e4 LT	15	#include <linux/skbuff.h>
64eb12f9	16	#include <net/ipv6.h>
2e4e6a17 HW	17	#include <linux/netfilter/x_tables.h>
2e4e6a17 HW	18	#include <linux/netfilter/xt_conntrack.h>
587aa641	19	#include <net/netfilter/nf_conntrack.h>
1da177e4 LT	20
	21	MODULE_LICENSE("GPL");
	22	MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
9e05ec4b	23	MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
2ae15b64	24	MODULE_DESCRIPTION("Xtables: connection tracking state match");
2e4e6a17	25	MODULE_ALIAS("ipt_conntrack");
64eb12f9	26	MODULE_ALIAS("ip6t_conntrack");
1da177e4	27
64eb12f9 JE	28	static bool
	29	conntrack_addrcmp(const union nf_inet_addr *kaddr,
	30	const union nf_inet_addr *uaddr,
	31	const union nf_inet_addr *umask, unsigned int l3proto)
	32	{
ee999d8b	33	if (l3proto == NFPROTO_IPV4)
6556874d	34	return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0;
ee999d8b	35	else if (l3proto == NFPROTO_IPV6)
64eb12f9 JE	36	return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6,
	37	&uaddr->in6) == 0;
	38	else
	39	return false;
	40	}
	41
	42	static inline bool
	43	conntrack_mt_origsrc(const struct nf_conn *ct,
d6d3f08b	44	const struct xt_conntrack_mtinfo2 *info,
76108cea	45	u_int8_t family)
64eb12f9 JE	46	{
	47	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
	48	&info->origsrc_addr, &info->origsrc_mask, family);
	49	}
	50
	51	static inline bool
	52	conntrack_mt_origdst(const struct nf_conn *ct,
d6d3f08b	53	const struct xt_conntrack_mtinfo2 *info,
76108cea	54	u_int8_t family)
64eb12f9 JE	55	{
	56	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
	57	&info->origdst_addr, &info->origdst_mask, family);
	58	}
	59
	60	static inline bool
	61	conntrack_mt_replsrc(const struct nf_conn *ct,
d6d3f08b	62	const struct xt_conntrack_mtinfo2 *info,
76108cea	63	u_int8_t family)
64eb12f9 JE	64	{
	65	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3,
	66	&info->replsrc_addr, &info->replsrc_mask, family);
	67	}
	68
	69	static inline bool
	70	conntrack_mt_repldst(const struct nf_conn *ct,
d6d3f08b	71	const struct xt_conntrack_mtinfo2 *info,
76108cea	72	u_int8_t family)
64eb12f9 JE	73	{
	74	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3,
	75	&info->repldst_addr, &info->repldst_mask, family);
	76	}
	77
b4164998	78	static inline bool
d6d3f08b	79	ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info,
b4164998 JE	80	const struct nf_conn *ct)
	81	{
	82	const struct nf_conntrack_tuple *tuple;
	83
	84	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	85	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
5e8fbe2a	86	(nf_ct_protonum(ct) == info->l4proto) ^
b4164998 JE	87	!(info->invert_flags & XT_CONNTRACK_PROTO))
	88	return false;
	89
	90	/* Shortcut to match all recognized protocols by using ->src.all. */
	91	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	92	(tuple->src.u.all == info->origsrc_port) ^
	93	!(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
	94	return false;
	95
	96	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	97	(tuple->dst.u.all == info->origdst_port) ^
	98	!(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
	99	return false;
	100
	101	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
	102
	103	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	104	(tuple->src.u.all == info->replsrc_port) ^
	105	!(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
	106	return false;
	107
	108	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	109	(tuple->dst.u.all == info->repldst_port) ^
	110	!(info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
	111	return false;
	112
	113	return true;
	114	}
	115
b017900a PM	116	static inline bool
	117	port_match(u16 min, u16 max, u16 port, bool invert)
	118	{
	119	return (port >= min && port <= max) ^ invert;
	120	}
	121
	122	static inline bool
	123	ct_proto_port_check_v3(const struct xt_conntrack_mtinfo3 *info,
	124	const struct nf_conn *ct)
	125	{
	126	const struct nf_conntrack_tuple *tuple;
	127
	128	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	129	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
	130	(nf_ct_protonum(ct) == info->l4proto) ^
	131	!(info->invert_flags & XT_CONNTRACK_PROTO))
	132	return false;
	133
	134	/* Shortcut to match all recognized protocols by using ->src.all. */
	135	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	136	!port_match(info->origsrc_port, info->origsrc_port_high,
	137	ntohs(tuple->src.u.all),
	138	info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
	139	return false;
	140
	141	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	142	!port_match(info->origdst_port, info->origdst_port_high,
	143	ntohs(tuple->dst.u.all),
	144	info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
	145	return false;
	146
	147	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
	148
	149	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	150	!port_match(info->replsrc_port, info->replsrc_port_high,
	151	ntohs(tuple->src.u.all),
	152	info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
	153	return false;
	154
	155	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	156	!port_match(info->repldst_port, info->repldst_port_high,
	157	ntohs(tuple->dst.u.all),
	158	info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
	159	return false;
	160
	161	return true;
	162	}
	163
64eb12f9	164	static bool
62fc8051	165	conntrack_mt(const struct sk_buff skb, struct xt_action_param par,
3a042929	166	u16 state_mask, u16 status_mask)
64eb12f9	167	{
d6d3f08b	168	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
64eb12f9 JE	169	enum ip_conntrack_info ctinfo;
	170	const struct nf_conn *ct;
	171	unsigned int statebit;
	172
	173	ct = nf_ct_get(skb, &ctinfo);
	174
5bfddbd4 ED	175	if (ct) {
	176	if (nf_ct_is_untracked(ct))
	177	statebit = XT_CONNTRACK_STATE_UNTRACKED;
	178	else
	179	statebit = XT_CONNTRACK_STATE_BIT(ctinfo);
	180	} else
64eb12f9 JE	181	statebit = XT_CONNTRACK_STATE_INVALID;
	182
	183	if (info->match_flags & XT_CONNTRACK_STATE) {
	184	if (ct != NULL) {
	185	if (test_bit(IPS_SRC_NAT_BIT, &ct->status))
	186	statebit \|= XT_CONNTRACK_STATE_SNAT;
	187	if (test_bit(IPS_DST_NAT_BIT, &ct->status))
	188	statebit \|= XT_CONNTRACK_STATE_DNAT;
	189	}
3a042929	190	if (!!(state_mask & statebit) ^
64eb12f9 JE	191	!(info->invert_flags & XT_CONNTRACK_STATE))
	192	return false;
	193	}
	194
	195	if (ct == NULL)
	196	return info->match_flags & XT_CONNTRACK_STATE;
b4164998 JE	197	if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
b4164998 JE	198	(CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
96120d86	199	!(info->invert_flags & XT_CONNTRACK_DIRECTION))
64eb12f9 JE	200	return false;
	201
	202	if (info->match_flags & XT_CONNTRACK_ORIGSRC)
92f3b2b1	203	if (conntrack_mt_origsrc(ct, info, par->family) ^
64eb12f9 JE	204	!(info->invert_flags & XT_CONNTRACK_ORIGSRC))
	205	return false;
	206
	207	if (info->match_flags & XT_CONNTRACK_ORIGDST)
92f3b2b1	208	if (conntrack_mt_origdst(ct, info, par->family) ^
64eb12f9 JE	209	!(info->invert_flags & XT_CONNTRACK_ORIGDST))
	210	return false;
	211
	212	if (info->match_flags & XT_CONNTRACK_REPLSRC)
92f3b2b1	213	if (conntrack_mt_replsrc(ct, info, par->family) ^
64eb12f9 JE	214	!(info->invert_flags & XT_CONNTRACK_REPLSRC))
	215	return false;
	216
	217	if (info->match_flags & XT_CONNTRACK_REPLDST)
92f3b2b1	218	if (conntrack_mt_repldst(ct, info, par->family) ^
64eb12f9 JE	219	!(info->invert_flags & XT_CONNTRACK_REPLDST))
	220	return false;
	221
b017900a PM	222	if (par->match->revision != 3) {
	223	if (!ct_proto_port_check(info, ct))
	224	return false;
	225	} else {
	226	if (!ct_proto_port_check_v3(par->matchinfo, ct))
	227	return false;
	228	}
b4164998	229
64eb12f9	230	if ((info->match_flags & XT_CONNTRACK_STATUS) &&
3a042929	231	(!!(status_mask & ct->status) ^
64eb12f9 JE	232	!(info->invert_flags & XT_CONNTRACK_STATUS)))
	233	return false;
	234
	235	if (info->match_flags & XT_CONNTRACK_EXPIRES) {
d0b35b93	236	unsigned long expires = nf_ct_expires(ct) / HZ;
64eb12f9	237
64eb12f9 JE	238	if ((expires >= info->expires_min &&
	239	expires <= info->expires_max) ^
	240	!(info->invert_flags & XT_CONNTRACK_EXPIRES))
	241	return false;
	242	}
	243	return true;
	244	}
	245
d6d3f08b	246	static bool
62fc8051	247	conntrack_mt_v1(const struct sk_buff skb, struct xt_action_param par)
d6d3f08b	248	{
3a042929	249	const struct xt_conntrack_mtinfo1 *info = par->matchinfo;
d6d3f08b	250
3a042929 FW	251	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
	252	}
	253
	254	static bool
62fc8051	255	conntrack_mt_v2(const struct sk_buff skb, struct xt_action_param par)
3a042929 FW	256	{
	257	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
	258
	259	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
d6d3f08b JE	260	}
d6d3f08b JE	261
b017900a PM	262	static bool
	263	conntrack_mt_v3(const struct sk_buff skb, struct xt_action_param par)
	264	{
	265	const struct xt_conntrack_mtinfo3 *info = par->matchinfo;
	266
	267	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
	268	}
	269
b0f38452	270	static int conntrack_mt_check(const struct xt_mtchk_param *par)
b9f78f9f	271	{
4a5a5c73 JE	272	int ret;
	273
	274	ret = nf_ct_l3proto_try_module_get(par->family);
f95c74e3	275	if (ret < 0)
8bee4bad JE	276	pr_info("cannot load conntrack support for proto=%u\n",
8bee4bad JE	277	par->family);
f95c74e3	278	return ret;
b9f78f9f PNA	279	}
b9f78f9f PNA	280
6be3d859	281	static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
b9f78f9f	282	{
92f3b2b1	283	nf_ct_l3proto_module_put(par->family);
b9f78f9f PNA	284	}
b9f78f9f PNA	285
64eb12f9	286	static struct xt_match conntrack_mt_reg[] __read_mostly = {
64eb12f9 JE	287	{
	288	.name = "conntrack",
	289	.revision = 1,
92f3b2b1	290	.family = NFPROTO_UNSPEC,
64eb12f9	291	.matchsize = sizeof(struct xt_conntrack_mtinfo1),
d6d3f08b	292	.match = conntrack_mt_v1,
3a042929 FW	293	.checkentry = conntrack_mt_check,
3a042929 FW	294	.destroy = conntrack_mt_destroy,
d6d3f08b JE	295	.me = THIS_MODULE,
	296	},
	297	{
	298	.name = "conntrack",
	299	.revision = 2,
	300	.family = NFPROTO_UNSPEC,
	301	.matchsize = sizeof(struct xt_conntrack_mtinfo2),
3a042929	302	.match = conntrack_mt_v2,
64eb12f9 JE	303	.checkentry = conntrack_mt_check,
	304	.destroy = conntrack_mt_destroy,
	305	.me = THIS_MODULE,
	306	},
b017900a PM	307	{
	308	.name = "conntrack",
	309	.revision = 3,
	310	.family = NFPROTO_UNSPEC,
	311	.matchsize = sizeof(struct xt_conntrack_mtinfo3),
	312	.match = conntrack_mt_v3,
	313	.checkentry = conntrack_mt_check,
	314	.destroy = conntrack_mt_destroy,
	315	.me = THIS_MODULE,
	316	},
1da177e4 LT	317	};
1da177e4 LT	318
d3c5ee6d	319	static int __init conntrack_mt_init(void)
1da177e4	320	{
64eb12f9 JE	321	return xt_register_matches(conntrack_mt_reg,
64eb12f9 JE	322	ARRAY_SIZE(conntrack_mt_reg));
1da177e4 LT	323	}
1da177e4 LT	324
d3c5ee6d	325	static void __exit conntrack_mt_exit(void)
1da177e4	326	{
64eb12f9	327	xt_unregister_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg));
1da177e4 LT	328	}
1da177e4 LT	329
d3c5ee6d JE	330	module_init(conntrack_mt_init);
d3c5ee6d JE	331	module_exit(conntrack_mt_exit);