blob: 36c2defff238b193d7377b7e81dfa18d4705b007 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/* This kernel module matches connection mark values set by the
2 * CONNMARK target
3 *
4 * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
5 * by Henrik Nordstrom <hno@marasystems.com>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 */
21
22#include <linux/module.h>
23#include <linux/skbuff.h>
24
25MODULE_AUTHOR("Henrik Nordstrom <hno@marasytems.com>");
26MODULE_DESCRIPTION("IP tables connmark match module");
27MODULE_LICENSE("GPL");
Harald Welte2e4e6a12006-01-12 13:30:04 -080028MODULE_ALIAS("ipt_connmark");
Linus Torvalds1da177e2005-04-16 15:20:36 -070029
Harald Welte2e4e6a12006-01-12 13:30:04 -080030#include <linux/netfilter/x_tables.h>
31#include <linux/netfilter/xt_connmark.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080032#include <net/netfilter/nf_conntrack_compat.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070033
34static int
35match(const struct sk_buff *skb,
36 const struct net_device *in,
37 const struct net_device *out,
Patrick McHardyc4986732006-03-20 18:02:56 -080038 const struct xt_match *match,
Linus Torvalds1da177e2005-04-16 15:20:36 -070039 const void *matchinfo,
40 int offset,
Harald Welte2e4e6a12006-01-12 13:30:04 -080041 unsigned int protoff,
Linus Torvalds1da177e2005-04-16 15:20:36 -070042 int *hotdrop)
43{
Harald Welte2e4e6a12006-01-12 13:30:04 -080044 const struct xt_connmark_info *info = matchinfo;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080045 u_int32_t ctinfo;
46 const u_int32_t *ctmark = nf_ct_get_mark(skb, &ctinfo);
47 if (!ctmark)
Linus Torvalds1da177e2005-04-16 15:20:36 -070048 return 0;
49
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080050 return (((*ctmark) & info->mask) == info->mark) ^ info->invert;
Linus Torvalds1da177e2005-04-16 15:20:36 -070051}
52
53static int
54checkentry(const char *tablename,
Harald Welte2e4e6a12006-01-12 13:30:04 -080055 const void *ip,
Patrick McHardyc4986732006-03-20 18:02:56 -080056 const struct xt_match *match,
Linus Torvalds1da177e2005-04-16 15:20:36 -070057 void *matchinfo,
Linus Torvalds1da177e2005-04-16 15:20:36 -070058 unsigned int hook_mask)
59{
Patrick McHardy3e72b2f2006-05-29 18:19:19 -070060 struct xt_connmark_info *cm = matchinfo;
Linus Torvalds1da177e2005-04-16 15:20:36 -070061
Harald Weltebf3a46a2005-08-09 19:22:01 -070062 if (cm->mark > 0xffffffff || cm->mask > 0xffffffff) {
63 printk(KERN_WARNING "connmark: only support 32bit mark\n");
64 return 0;
65 }
Pablo Neira Ayusob9f78f92006-03-22 13:56:08 -080066 if (nf_ct_l3proto_try_module_get(match->family) < 0) {
Yasuyuki Kozakaife0b9292006-12-12 00:28:40 -080067 printk(KERN_WARNING "can't load conntrack support for "
Pablo Neira Ayusob9f78f92006-03-22 13:56:08 -080068 "proto=%d\n", match->family);
69 return 0;
70 }
Linus Torvalds1da177e2005-04-16 15:20:36 -070071 return 1;
72}
73
Pablo Neira Ayusob9f78f92006-03-22 13:56:08 -080074static void
Patrick McHardyefa74162006-08-22 00:36:37 -070075destroy(const struct xt_match *match, void *matchinfo)
Pablo Neira Ayusob9f78f92006-03-22 13:56:08 -080076{
Pablo Neira Ayusob9f78f92006-03-22 13:56:08 -080077 nf_ct_l3proto_module_put(match->family);
Pablo Neira Ayusob9f78f92006-03-22 13:56:08 -080078}
79
Patrick McHardyf1eda052006-09-20 12:06:25 -070080#ifdef CONFIG_COMPAT
81struct compat_xt_connmark_info {
82 compat_ulong_t mark, mask;
83 u_int8_t invert;
84 u_int8_t __pad1;
85 u_int16_t __pad2;
86};
87
88static void compat_from_user(void *dst, void *src)
89{
90 struct compat_xt_connmark_info *cm = src;
91 struct xt_connmark_info m = {
92 .mark = cm->mark,
93 .mask = cm->mask,
94 .invert = cm->invert,
95 };
96 memcpy(dst, &m, sizeof(m));
97}
98
99static int compat_to_user(void __user *dst, void *src)
100{
101 struct xt_connmark_info *m = src;
102 struct compat_xt_connmark_info cm = {
103 .mark = m->mark,
104 .mask = m->mask,
105 .invert = m->invert,
106 };
107 return copy_to_user(dst, &cm, sizeof(cm)) ? -EFAULT : 0;
108}
109#endif /* CONFIG_COMPAT */
110
Patrick McHardy4470bbc2006-08-22 00:34:04 -0700111static struct xt_match xt_connmark_match[] = {
112 {
113 .name = "connmark",
114 .family = AF_INET,
115 .checkentry = checkentry,
116 .match = match,
117 .destroy = destroy,
118 .matchsize = sizeof(struct xt_connmark_info),
Patrick McHardyf1eda052006-09-20 12:06:25 -0700119#ifdef CONFIG_COMPAT
120 .compatsize = sizeof(struct compat_xt_connmark_info),
121 .compat_from_user = compat_from_user,
122 .compat_to_user = compat_to_user,
123#endif
Patrick McHardy4470bbc2006-08-22 00:34:04 -0700124 .me = THIS_MODULE
125 },
126 {
127 .name = "connmark",
128 .family = AF_INET6,
129 .checkentry = checkentry,
130 .match = match,
131 .destroy = destroy,
132 .matchsize = sizeof(struct xt_connmark_info),
133 .me = THIS_MODULE
134 },
Patrick McHardy5d04bff2006-03-20 18:01:58 -0800135};
Harald Welte2e4e6a12006-01-12 13:30:04 -0800136
Andrew Morton65b4b4e2006-03-28 16:37:06 -0800137static int __init xt_connmark_init(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700138{
Patrick McHardy4470bbc2006-08-22 00:34:04 -0700139 return xt_register_matches(xt_connmark_match,
140 ARRAY_SIZE(xt_connmark_match));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700141}
142
Andrew Morton65b4b4e2006-03-28 16:37:06 -0800143static void __exit xt_connmark_fini(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700144{
Patrick McHardyf64ad5b2006-10-12 14:07:52 -0700145 xt_unregister_matches(xt_connmark_match, ARRAY_SIZE(xt_connmark_match));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700146}
147
Andrew Morton65b4b4e2006-03-28 16:37:06 -0800148module_init(xt_connmark_init);
149module_exit(xt_connmark_fini);