2 * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9 #include <linux/module.h>
10 #include <linux/gfp.h>
11 #include <linux/skbuff.h>
12 #include <linux/netfilter_ipv4/ip_tables.h>
13 #include <linux/netfilter_ipv6/ip6_tables.h>
14 #include <linux/netfilter/x_tables.h>
15 #include <linux/netfilter/xt_CT.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_l4proto.h>
18 #include <net/netfilter/nf_conntrack_helper.h>
19 #include <net/netfilter/nf_conntrack_ecache.h>
20 #include <net/netfilter/nf_conntrack_timeout.h>
21 #include <net/netfilter/nf_conntrack_zones.h>
23 static inline int xt_ct_target(struct sk_buff
*skb
, struct nf_conn
*ct
)
25 /* Previously seen (loopback)? Ignore. */
26 if (skb
->nfct
!= NULL
)
29 /* special case the untracked ct : we want the percpu object */
31 ct
= nf_ct_untracked_get();
32 atomic_inc(&ct
->ct_general
.use
);
33 skb
->nfct
= &ct
->ct_general
;
34 skb
->nfctinfo
= IP_CT_NEW
;
39 static unsigned int xt_ct_target_v0(struct sk_buff
*skb
,
40 const struct xt_action_param
*par
)
42 const struct xt_ct_target_info
*info
= par
->targinfo
;
43 struct nf_conn
*ct
= info
->ct
;
45 return xt_ct_target(skb
, ct
);
48 static unsigned int xt_ct_target_v1(struct sk_buff
*skb
,
49 const struct xt_action_param
*par
)
51 const struct xt_ct_target_info_v1
*info
= par
->targinfo
;
52 struct nf_conn
*ct
= info
->ct
;
54 return xt_ct_target(skb
, ct
);
57 static u8
xt_ct_find_proto(const struct xt_tgchk_param
*par
)
59 if (par
->family
== NFPROTO_IPV4
) {
60 const struct ipt_entry
*e
= par
->entryinfo
;
62 if (e
->ip
.invflags
& IPT_INV_PROTO
)
65 } else if (par
->family
== NFPROTO_IPV6
) {
66 const struct ip6t_entry
*e
= par
->entryinfo
;
68 if (e
->ipv6
.invflags
& IP6T_INV_PROTO
)
76 xt_ct_set_helper(struct nf_conn
*ct
, const char *helper_name
,
77 const struct xt_tgchk_param
*par
)
79 struct nf_conntrack_helper
*helper
;
80 struct nf_conn_help
*help
;
83 proto
= xt_ct_find_proto(par
);
85 pr_info("You must specify a L4 protocol, and not use "
86 "inversions on it.\n");
90 helper
= nf_conntrack_helper_try_module_get(helper_name
, par
->family
,
93 pr_info("No such helper \"%s\"\n", helper_name
);
97 help
= nf_ct_helper_ext_add(ct
, helper
, GFP_KERNEL
);
99 module_put(helper
->me
);
103 help
->helper
= helper
;
107 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
108 static void __xt_ct_tg_timeout_put(struct ctnl_timeout
*timeout
)
110 typeof(nf_ct_timeout_put_hook
) timeout_put
;
112 timeout_put
= rcu_dereference(nf_ct_timeout_put_hook
);
114 timeout_put(timeout
);
119 xt_ct_set_timeout(struct nf_conn
*ct
, const struct xt_tgchk_param
*par
,
120 const char *timeout_name
)
122 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
123 typeof(nf_ct_timeout_find_get_hook
) timeout_find_get
;
124 struct ctnl_timeout
*timeout
;
125 struct nf_conn_timeout
*timeout_ext
;
126 struct nf_conntrack_l4proto
*l4proto
;
131 timeout_find_get
= rcu_dereference(nf_ct_timeout_find_get_hook
);
132 if (timeout_find_get
== NULL
) {
134 pr_info("Timeout policy base is empty\n");
138 proto
= xt_ct_find_proto(par
);
141 pr_info("You must specify a L4 protocol, and not use "
142 "inversions on it.\n");
146 timeout
= timeout_find_get(timeout_name
);
147 if (timeout
== NULL
) {
149 pr_info("No such timeout policy \"%s\"\n", timeout_name
);
153 if (timeout
->l3num
!= par
->family
) {
155 pr_info("Timeout policy `%s' can only be used by L3 protocol "
156 "number %d\n", timeout_name
, timeout
->l3num
);
157 goto err_put_timeout
;
159 /* Make sure the timeout policy matches any existing protocol tracker,
160 * otherwise default to generic.
162 l4proto
= __nf_ct_l4proto_find(par
->family
, proto
);
163 if (timeout
->l4proto
->l4proto
!= l4proto
->l4proto
) {
165 pr_info("Timeout policy `%s' can only be used by L4 protocol "
167 timeout_name
, timeout
->l4proto
->l4proto
);
168 goto err_put_timeout
;
170 timeout_ext
= nf_ct_timeout_ext_add(ct
, timeout
, GFP_ATOMIC
);
171 if (timeout_ext
== NULL
)
175 __xt_ct_tg_timeout_put(timeout
);
184 static u16
xt_ct_flags_to_dir(const struct xt_ct_target_info_v1
*info
)
186 switch (info
->flags
& (XT_CT_ZONE_DIR_ORIG
|
187 XT_CT_ZONE_DIR_REPL
)) {
188 case XT_CT_ZONE_DIR_ORIG
:
189 return NF_CT_ZONE_DIR_ORIG
;
190 case XT_CT_ZONE_DIR_REPL
:
191 return NF_CT_ZONE_DIR_REPL
;
193 return NF_CT_DEFAULT_ZONE_DIR
;
197 static int xt_ct_tg_check(const struct xt_tgchk_param
*par
,
198 struct xt_ct_target_info_v1
*info
)
200 struct nf_conntrack_zone zone
;
202 int ret
= -EOPNOTSUPP
;
204 if (info
->flags
& XT_CT_NOTRACK
) {
209 #ifndef CONFIG_NF_CONNTRACK_ZONES
210 if (info
->zone
|| info
->flags
& (XT_CT_ZONE_DIR_ORIG
|
211 XT_CT_ZONE_DIR_REPL
|
216 ret
= nf_ct_l3proto_try_module_get(par
->family
);
220 memset(&zone
, 0, sizeof(zone
));
221 zone
.id
= info
->zone
;
222 zone
.dir
= xt_ct_flags_to_dir(info
);
223 if (info
->flags
& XT_CT_ZONE_MARK
)
224 zone
.flags
|= NF_CT_FLAG_MARK
;
226 ct
= nf_ct_tmpl_alloc(par
->net
, &zone
, GFP_KERNEL
);
233 if ((info
->ct_events
|| info
->exp_events
) &&
234 !nf_ct_ecache_ext_add(ct
, info
->ct_events
, info
->exp_events
,
240 if (info
->helper
[0]) {
241 ret
= xt_ct_set_helper(ct
, info
->helper
, par
);
246 if (info
->timeout
[0]) {
247 ret
= xt_ct_set_timeout(ct
, par
, info
->timeout
);
251 __set_bit(IPS_CONFIRMED_BIT
, &ct
->status
);
252 nf_conntrack_get(&ct
->ct_general
);
260 nf_ct_l3proto_module_put(par
->family
);
265 static int xt_ct_tg_check_v0(const struct xt_tgchk_param
*par
)
267 struct xt_ct_target_info
*info
= par
->targinfo
;
268 struct xt_ct_target_info_v1 info_v1
= {
269 .flags
= info
->flags
,
271 .ct_events
= info
->ct_events
,
272 .exp_events
= info
->exp_events
,
276 if (info
->flags
& ~XT_CT_NOTRACK
)
279 memcpy(info_v1
.helper
, info
->helper
, sizeof(info
->helper
));
281 ret
= xt_ct_tg_check(par
, &info_v1
);
285 info
->ct
= info_v1
.ct
;
290 static int xt_ct_tg_check_v1(const struct xt_tgchk_param
*par
)
292 struct xt_ct_target_info_v1
*info
= par
->targinfo
;
294 if (info
->flags
& ~XT_CT_NOTRACK
)
297 return xt_ct_tg_check(par
, par
->targinfo
);
300 static int xt_ct_tg_check_v2(const struct xt_tgchk_param
*par
)
302 struct xt_ct_target_info_v1
*info
= par
->targinfo
;
304 if (info
->flags
& ~XT_CT_MASK
)
307 return xt_ct_tg_check(par
, par
->targinfo
);
310 static void xt_ct_destroy_timeout(struct nf_conn
*ct
)
312 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
313 struct nf_conn_timeout
*timeout_ext
;
314 typeof(nf_ct_timeout_put_hook
) timeout_put
;
317 timeout_put
= rcu_dereference(nf_ct_timeout_put_hook
);
320 timeout_ext
= nf_ct_timeout_find(ct
);
322 timeout_put(timeout_ext
->timeout
);
328 static void xt_ct_tg_destroy(const struct xt_tgdtor_param
*par
,
329 struct xt_ct_target_info_v1
*info
)
331 struct nf_conn
*ct
= info
->ct
;
332 struct nf_conn_help
*help
;
334 if (ct
&& !nf_ct_is_untracked(ct
)) {
335 help
= nfct_help(ct
);
337 module_put(help
->helper
->me
);
339 nf_ct_l3proto_module_put(par
->family
);
341 xt_ct_destroy_timeout(ct
);
346 static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param
*par
)
348 struct xt_ct_target_info
*info
= par
->targinfo
;
349 struct xt_ct_target_info_v1 info_v1
= {
350 .flags
= info
->flags
,
352 .ct_events
= info
->ct_events
,
353 .exp_events
= info
->exp_events
,
356 memcpy(info_v1
.helper
, info
->helper
, sizeof(info
->helper
));
358 xt_ct_tg_destroy(par
, &info_v1
);
361 static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param
*par
)
363 xt_ct_tg_destroy(par
, par
->targinfo
);
366 static struct xt_target xt_ct_tg_reg
[] __read_mostly
= {
369 .family
= NFPROTO_UNSPEC
,
370 .targetsize
= sizeof(struct xt_ct_target_info
),
371 .checkentry
= xt_ct_tg_check_v0
,
372 .destroy
= xt_ct_tg_destroy_v0
,
373 .target
= xt_ct_target_v0
,
379 .family
= NFPROTO_UNSPEC
,
381 .targetsize
= sizeof(struct xt_ct_target_info_v1
),
382 .checkentry
= xt_ct_tg_check_v1
,
383 .destroy
= xt_ct_tg_destroy_v1
,
384 .target
= xt_ct_target_v1
,
390 .family
= NFPROTO_UNSPEC
,
392 .targetsize
= sizeof(struct xt_ct_target_info_v1
),
393 .checkentry
= xt_ct_tg_check_v2
,
394 .destroy
= xt_ct_tg_destroy_v1
,
395 .target
= xt_ct_target_v1
,
402 notrack_tg(struct sk_buff
*skb
, const struct xt_action_param
*par
)
404 /* Previously seen (loopback)? Ignore. */
405 if (skb
->nfct
!= NULL
)
408 skb
->nfct
= &nf_ct_untracked_get()->ct_general
;
409 skb
->nfctinfo
= IP_CT_NEW
;
410 nf_conntrack_get(skb
->nfct
);
415 static int notrack_chk(const struct xt_tgchk_param
*par
)
417 if (!par
->net
->xt
.notrack_deprecated_warning
) {
418 pr_info("netfilter: NOTRACK target is deprecated, "
419 "use CT instead or upgrade iptables\n");
420 par
->net
->xt
.notrack_deprecated_warning
= true;
425 static struct xt_target notrack_tg_reg __read_mostly
= {
428 .family
= NFPROTO_UNSPEC
,
429 .checkentry
= notrack_chk
,
430 .target
= notrack_tg
,
435 static int __init
xt_ct_tg_init(void)
439 ret
= xt_register_target(¬rack_tg_reg
);
443 ret
= xt_register_targets(xt_ct_tg_reg
, ARRAY_SIZE(xt_ct_tg_reg
));
445 xt_unregister_target(¬rack_tg_reg
);
451 static void __exit
xt_ct_tg_exit(void)
453 xt_unregister_targets(xt_ct_tg_reg
, ARRAY_SIZE(xt_ct_tg_reg
));
454 xt_unregister_target(¬rack_tg_reg
);
457 module_init(xt_ct_tg_init
);
458 module_exit(xt_ct_tg_exit
);
460 MODULE_LICENSE("GPL");
461 MODULE_DESCRIPTION("Xtables: connection tracking target");
462 MODULE_ALIAS("ipt_CT");
463 MODULE_ALIAS("ip6t_CT");
464 MODULE_ALIAS("ipt_NOTRACK");
465 MODULE_ALIAS("ip6t_NOTRACK");