blob: bbe07b1be9a3627f798b03aad1fdbedde3a765f9 [file] [log] [blame]
Thomas Gleixnerd2912cb2019-06-04 10:11:33 +02001// SPDX-License-Identifier: GPL-2.0-only
Harald Welte2e4e6a12006-01-12 13:30:04 -08002/* Kernel module to match connection tracking information. */
3
4/* (C) 1999-2001 Paul `Rusty' Russell
5 * (C) 2002-2005 Netfilter Core Team <coreteam@netfilter.org>
Harald Welte2e4e6a12006-01-12 13:30:04 -08006 */
7
8#include <linux/module.h>
9#include <linux/skbuff.h>
Patrick McHardy587aa642007-03-14 16:37:25 -070010#include <net/netfilter/nf_conntrack.h>
Harald Welte2e4e6a12006-01-12 13:30:04 -080011#include <linux/netfilter/x_tables.h>
12#include <linux/netfilter/xt_state.h>
13
14MODULE_LICENSE("GPL");
15MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
16MODULE_DESCRIPTION("ip[6]_tables connection tracking state match module");
17MODULE_ALIAS("ipt_state");
18MODULE_ALIAS("ip6t_state");
19
Jan Engelhardt1d93a9c2007-07-07 22:15:35 -070020static bool
Jan Engelhardt62fc8052009-07-07 20:42:08 +020021state_mt(const struct sk_buff *skb, struct xt_action_param *par)
Harald Welte2e4e6a12006-01-12 13:30:04 -080022{
Jan Engelhardtf7108a202008-10-08 11:35:18 +020023 const struct xt_state_info *sinfo = par->matchinfo;
Harald Welte2e4e6a12006-01-12 13:30:04 -080024 enum ip_conntrack_info ctinfo;
25 unsigned int statebit;
Eric Dumazet5bfddbd2010-06-08 16:09:52 +020026 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
Harald Welte2e4e6a12006-01-12 13:30:04 -080027
Florian Westphalcc41c842017-04-14 20:31:08 +020028 if (ct)
29 statebit = XT_STATE_BIT(ctinfo);
30 else if (ctinfo == IP_CT_UNTRACKED)
31 statebit = XT_STATE_UNTRACKED;
32 else
Harald Welte2e4e6a12006-01-12 13:30:04 -080033 statebit = XT_STATE_INVALID;
Florian Westphalcc41c842017-04-14 20:31:08 +020034
Harald Welte2e4e6a12006-01-12 13:30:04 -080035 return (sinfo->statemask & statebit);
36}
37
Jan Engelhardtb0f38452010-03-19 17:16:42 +010038static int state_mt_check(const struct xt_mtchk_param *par)
Pablo Neira Ayusob9f78f92006-03-22 13:56:08 -080039{
Jan Engelhardt4a5a5c72010-03-19 17:32:59 +010040 int ret;
41
Florian Westphalecb24212016-11-15 21:36:40 +010042 ret = nf_ct_netns_get(par->net, par->family);
Jan Engelhardtf95c74e2010-03-21 04:05:56 +010043 if (ret < 0)
Florian Westphalb2606642018-02-09 15:52:07 +010044 pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
45 par->family);
Jan Engelhardtf95c74e2010-03-21 04:05:56 +010046 return ret;
Pablo Neira Ayusob9f78f92006-03-22 13:56:08 -080047}
48
Jan Engelhardt6be3d852008-10-08 11:35:19 +020049static void state_mt_destroy(const struct xt_mtdtor_param *par)
Pablo Neira Ayusob9f78f92006-03-22 13:56:08 -080050{
Florian Westphalecb24212016-11-15 21:36:40 +010051 nf_ct_netns_put(par->net, par->family);
Pablo Neira Ayusob9f78f92006-03-22 13:56:08 -080052}
53
Jan Engelhardtb4467282010-03-24 22:50:01 +010054static struct xt_match state_mt_reg __read_mostly = {
55 .name = "state",
56 .family = NFPROTO_UNSPEC,
57 .checkentry = state_mt_check,
58 .match = state_mt,
59 .destroy = state_mt_destroy,
60 .matchsize = sizeof(struct xt_state_info),
61 .me = THIS_MODULE,
Harald Welte2e4e6a12006-01-12 13:30:04 -080062};
63
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -080064static int __init state_mt_init(void)
Harald Welte2e4e6a12006-01-12 13:30:04 -080065{
Jan Engelhardtb4467282010-03-24 22:50:01 +010066 return xt_register_match(&state_mt_reg);
Harald Welte2e4e6a12006-01-12 13:30:04 -080067}
68
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -080069static void __exit state_mt_exit(void)
Harald Welte2e4e6a12006-01-12 13:30:04 -080070{
Jan Engelhardtb4467282010-03-24 22:50:01 +010071 xt_unregister_match(&state_mt_reg);
Harald Welte2e4e6a12006-01-12 13:30:04 -080072}
73
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -080074module_init(state_mt_init);
75module_exit(state_mt_exit);