xt_state.c revision 65b4b4e81a5094d52cbe372b887b1779abe53f9b
1/* Kernel module to match connection tracking information. */ 2 3/* (C) 1999-2001 Paul `Rusty' Russell 4 * (C) 2002-2005 Netfilter Core Team <coreteam@netfilter.org> 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 2 as 8 * published by the Free Software Foundation. 9 */ 10 11#include <linux/module.h> 12#include <linux/skbuff.h> 13#include <net/netfilter/nf_conntrack_compat.h> 14#include <linux/netfilter/x_tables.h> 15#include <linux/netfilter/xt_state.h> 16 17MODULE_LICENSE("GPL"); 18MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>"); 19MODULE_DESCRIPTION("ip[6]_tables connection tracking state match module"); 20MODULE_ALIAS("ipt_state"); 21MODULE_ALIAS("ip6t_state"); 22 23static int 24match(const struct sk_buff *skb, 25 const struct net_device *in, 26 const struct net_device *out, 27 const struct xt_match *match, 28 const void *matchinfo, 29 int offset, 30 unsigned int protoff, 31 int *hotdrop) 32{ 33 const struct xt_state_info *sinfo = matchinfo; 34 enum ip_conntrack_info ctinfo; 35 unsigned int statebit; 36 37 if (nf_ct_is_untracked(skb)) 38 statebit = XT_STATE_UNTRACKED; 39 else if (!nf_ct_get_ctinfo(skb, &ctinfo)) 40 statebit = XT_STATE_INVALID; 41 else 42 statebit = XT_STATE_BIT(ctinfo); 43 44 return (sinfo->statemask & statebit); 45} 46 47static int check(const char *tablename, 48 const void *inf, 49 const struct xt_match *match, 50 void *matchinfo, 51 unsigned int matchsize, 52 unsigned int hook_mask) 53{ 54#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 55 if (nf_ct_l3proto_try_module_get(match->family) < 0) { 56 printk(KERN_WARNING "can't load nf_conntrack support for " 57 "proto=%d\n", match->family); 58 return 0; 59 } 60#endif 61 return 1; 62} 63 64static void 65destroy(const struct xt_match *match, void *matchinfo, unsigned int matchsize) 66{ 67#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 68 nf_ct_l3proto_module_put(match->family); 69#endif 70} 71 72static struct xt_match state_match = { 73 .name = "state", 74 .match = match, 75 .checkentry = check, 76 .destroy = destroy, 77 .matchsize = sizeof(struct xt_state_info), 78 .family = AF_INET, 79 .me = THIS_MODULE, 80}; 81 82static struct xt_match state6_match = { 83 .name = "state", 84 .match = match, 85 .checkentry = check, 86 .destroy = destroy, 87 .matchsize = sizeof(struct xt_state_info), 88 .family = AF_INET6, 89 .me = THIS_MODULE, 90}; 91 92static int __init xt_state_init(void) 93{ 94 int ret; 95 96 need_conntrack(); 97 98 ret = xt_register_match(&state_match); 99 if (ret < 0) 100 return ret; 101 102 ret = xt_register_match(&state6_match); 103 if (ret < 0) 104 xt_unregister_match(&state_match); 105 106 return ret; 107} 108 109static void __exit xt_state_fini(void) 110{ 111 xt_unregister_match(&state_match); 112 xt_unregister_match(&state6_match); 113} 114 115module_init(xt_state_init); 116module_exit(xt_state_fini); 117