xt_connlabel.c 2.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * (C) 2013 Astaro GmbH & Co KG
  4. */
  5. #include <linux/module.h>
  6. #include <linux/skbuff.h>
  7. #include <net/netfilter/nf_conntrack.h>
  8. #include <net/netfilter/nf_conntrack_ecache.h>
  9. #include <net/netfilter/nf_conntrack_labels.h>
  10. #include <linux/netfilter/x_tables.h>
  11. MODULE_LICENSE("GPL");
  12. MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
  13. MODULE_DESCRIPTION("Xtables: add/match connection tracking labels");
  14. MODULE_ALIAS("ipt_connlabel");
  15. MODULE_ALIAS("ip6t_connlabel");
  16. static bool
  17. connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par)
  18. {
  19. const struct xt_connlabel_mtinfo *info = par->matchinfo;
  20. enum ip_conntrack_info ctinfo;
  21. struct nf_conn_labels *labels;
  22. struct nf_conn *ct;
  23. bool invert = info->options & XT_CONNLABEL_OP_INVERT;
  24. ct = nf_ct_get(skb, &ctinfo);
  25. if (ct == NULL)
  26. return invert;
  27. labels = nf_ct_labels_find(ct);
  28. if (!labels)
  29. return invert;
  30. if (test_bit(info->bit, labels->bits))
  31. return !invert;
  32. if (info->options & XT_CONNLABEL_OP_SET) {
  33. if (!test_and_set_bit(info->bit, labels->bits))
  34. nf_conntrack_event_cache(IPCT_LABEL, ct);
  35. return !invert;
  36. }
  37. return invert;
  38. }
  39. static int connlabel_mt_check(const struct xt_mtchk_param *par)
  40. {
  41. const int options = XT_CONNLABEL_OP_INVERT |
  42. XT_CONNLABEL_OP_SET;
  43. struct xt_connlabel_mtinfo *info = par->matchinfo;
  44. int ret;
  45. if (info->options & ~options) {
  46. pr_info_ratelimited("Unknown options in mask %x\n",
  47. info->options);
  48. return -EINVAL;
  49. }
  50. ret = nf_ct_netns_get(par->net, par->family);
  51. if (ret < 0) {
  52. pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
  53. par->family);
  54. return ret;
  55. }
  56. ret = nf_connlabels_get(par->net, info->bit);
  57. if (ret < 0)
  58. nf_ct_netns_put(par->net, par->family);
  59. return ret;
  60. }
  61. static void connlabel_mt_destroy(const struct xt_mtdtor_param *par)
  62. {
  63. nf_connlabels_put(par->net);
  64. nf_ct_netns_put(par->net, par->family);
  65. }
  66. static struct xt_match connlabels_mt_reg __read_mostly = {
  67. .name = "connlabel",
  68. .family = NFPROTO_UNSPEC,
  69. .checkentry = connlabel_mt_check,
  70. .match = connlabel_mt,
  71. .matchsize = sizeof(struct xt_connlabel_mtinfo),
  72. .destroy = connlabel_mt_destroy,
  73. .me = THIS_MODULE,
  74. };
  75. static int __init connlabel_mt_init(void)
  76. {
  77. return xt_register_match(&connlabels_mt_reg);
  78. }
  79. static void __exit connlabel_mt_exit(void)
  80. {
  81. xt_unregister_match(&connlabels_mt_reg);
  82. }
  83. module_init(connlabel_mt_init);
  84. module_exit(connlabel_mt_exit);