xt_state.c revision 4470bbc749e5551cce914529309456f631e25120
1/* Kernel module to match connection tracking information. */ 2 3/* (C) 1999-2001 Paul `Rusty' Russell 4 * (C) 2002-2005 Netfilter Core Team <coreteam@netfilter.org> 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 2 as 8 * published by the Free Software Foundation. 9 */ 10 11#include <linux/module.h> 12#include <linux/skbuff.h> 13#include <net/netfilter/nf_conntrack_compat.h> 14#include <linux/netfilter/x_tables.h> 15#include <linux/netfilter/xt_state.h> 16 17MODULE_LICENSE("GPL"); 18MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>"); 19MODULE_DESCRIPTION("ip[6]_tables connection tracking state match module"); 20MODULE_ALIAS("ipt_state"); 21MODULE_ALIAS("ip6t_state"); 22 23static int 24match(const struct sk_buff *skb, 25 const struct net_device *in, 26 const struct net_device *out, 27 const struct xt_match *match, 28 const void *matchinfo, 29 int offset, 30 unsigned int protoff, 31 int *hotdrop) 32{ 33 const struct xt_state_info *sinfo = matchinfo; 34 enum ip_conntrack_info ctinfo; 35 unsigned int statebit; 36 37 if (nf_ct_is_untracked(skb)) 38 statebit = XT_STATE_UNTRACKED; 39 else if (!nf_ct_get_ctinfo(skb, &ctinfo)) 40 statebit = XT_STATE_INVALID; 41 else 42 statebit = XT_STATE_BIT(ctinfo); 43 44 return (sinfo->statemask & statebit); 45} 46 47static int check(const char *tablename, 48 const void *inf, 49 const struct xt_match *match, 50 void *matchinfo, 51 unsigned int matchsize, 52 unsigned int hook_mask) 53{ 54#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 55 if (nf_ct_l3proto_try_module_get(match->family) < 0) { 56 printk(KERN_WARNING "can't load nf_conntrack support for " 57 "proto=%d\n", match->family); 58 return 0; 59 } 60#endif 61 return 1; 62} 63 64static void 65destroy(const struct xt_match *match, void *matchinfo, unsigned int matchsize) 66{ 67#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 68 nf_ct_l3proto_module_put(match->family); 69#endif 70} 71 72static struct xt_match xt_state_match[] = { 73 { 74 .name = "state", 75 .family = AF_INET, 76 .checkentry = check, 77 .match = match, 78 .destroy = destroy, 79 .matchsize = sizeof(struct xt_state_info), 80 .me = THIS_MODULE, 81 }, 82 { 83 .name = "state", 84 .family = AF_INET6, 85 .checkentry = check, 86 .match = match, 87 .destroy = destroy, 88 .matchsize = sizeof(struct xt_state_info), 89 .me = THIS_MODULE, 90 }, 91}; 92 93static int __init xt_state_init(void) 94{ 95 need_conntrack(); 96 return xt_register_matches(xt_state_match, ARRAY_SIZE(xt_state_match)); 97} 98 99static void __exit xt_state_fini(void) 100{ 101 xt_unregister_matches(xt_state_match, ARRAY_SIZE(xt_state_match)); 102} 103 104module_init(xt_state_init); 105module_exit(xt_state_fini); 106