xt_helper.c 2.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /* iptables module to match on related connections */
  3. /*
  4. * (C) 2001 Martin Josefsson <gandalf@wlug.westbo.se>
  5. */
  6. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  7. #include <linux/module.h>
  8. #include <linux/skbuff.h>
  9. #include <linux/netfilter.h>
  10. #include <net/netfilter/nf_conntrack.h>
  11. #include <net/netfilter/nf_conntrack_core.h>
  12. #include <net/netfilter/nf_conntrack_helper.h>
  13. #include <linux/netfilter/x_tables.h>
  14. #include <linux/netfilter/xt_helper.h>
  15. MODULE_LICENSE("GPL");
  16. MODULE_AUTHOR("Martin Josefsson <gandalf@netfilter.org>");
  17. MODULE_DESCRIPTION("Xtables: Related connection matching");
  18. MODULE_ALIAS("ipt_helper");
  19. MODULE_ALIAS("ip6t_helper");
  20. static bool
  21. helper_mt(const struct sk_buff *skb, struct xt_action_param *par)
  22. {
  23. const struct xt_helper_info *info = par->matchinfo;
  24. const struct nf_conn *ct;
  25. const struct nf_conn_help *master_help;
  26. const struct nf_conntrack_helper *helper;
  27. enum ip_conntrack_info ctinfo;
  28. bool ret = info->invert;
  29. ct = nf_ct_get(skb, &ctinfo);
  30. if (!ct || !ct->master)
  31. return ret;
  32. master_help = nfct_help(ct->master);
  33. if (!master_help)
  34. return ret;
  35. /* rcu_read_lock()ed by nf_hook_thresh */
  36. helper = rcu_dereference(master_help->helper);
  37. if (!helper)
  38. return ret;
  39. if (info->name[0] == '\0')
  40. ret = !ret;
  41. else
  42. ret ^= !strncmp(helper->name, info->name,
  43. strlen(helper->name));
  44. return ret;
  45. }
  46. static int helper_mt_check(const struct xt_mtchk_param *par)
  47. {
  48. struct xt_helper_info *info = par->matchinfo;
  49. int ret;
  50. ret = nf_ct_netns_get(par->net, par->family);
  51. if (ret < 0) {
  52. pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
  53. par->family);
  54. return ret;
  55. }
  56. info->name[sizeof(info->name) - 1] = '\0';
  57. return 0;
  58. }
  59. static void helper_mt_destroy(const struct xt_mtdtor_param *par)
  60. {
  61. nf_ct_netns_put(par->net, par->family);
  62. }
  63. static struct xt_match helper_mt_reg __read_mostly = {
  64. .name = "helper",
  65. .revision = 0,
  66. .family = NFPROTO_UNSPEC,
  67. .checkentry = helper_mt_check,
  68. .match = helper_mt,
  69. .destroy = helper_mt_destroy,
  70. .matchsize = sizeof(struct xt_helper_info),
  71. .me = THIS_MODULE,
  72. };
  73. static int __init helper_mt_init(void)
  74. {
  75. return xt_register_match(&helper_mt_reg);
  76. }
  77. static void __exit helper_mt_exit(void)
  78. {
  79. xt_unregister_match(&helper_mt_reg);
  80. }
  81. module_init(helper_mt_init);
  82. module_exit(helper_mt_exit);