SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/netfilter/xt_helper.c

   1 /* iptables module to match on related connections */
   2 /*
   3  * (C) 2001 Martin Josefsson <gandalf@wlug.westbo.se>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  */
   9
  10 #include <linux/module.h>
  11 #include <linux/skbuff.h>
  12 #include <linux/netfilter.h>
  13 #include <net/netfilter/nf_conntrack.h>
  14 #include <net/netfilter/nf_conntrack_core.h>
  15 #include <net/netfilter/nf_conntrack_helper.h>
  16 #include <linux/netfilter/x_tables.h>
  17 #include <linux/netfilter/xt_helper.h>
  18
  19 MODULE_LICENSE("GPL");
  20 MODULE_AUTHOR("Martin Josefsson <gandalf@netfilter.org>");
  21 MODULE_DESCRIPTION("iptables helper match module");
  22 MODULE_ALIAS("ipt_helper");
  23 MODULE_ALIAS("ip6t_helper");
  24
  25
  26 static bool
  27 match(const struct sk_buff *skb,
  28       const struct net_device *in,
  29       const struct net_device *out,
  30       const struct xt_match *match,
  31       const void *matchinfo,
  32       int offset,
  33       unsigned int protoff,
  34       bool *hotdrop)
  35 {
  36         const struct xt_helper_info *info = matchinfo;
  37         const struct nf_conn *ct;
  38         const struct nf_conn_help *master_help;
  39         const struct nf_conntrack_helper *helper;
  40         enum ip_conntrack_info ctinfo;
  41         bool ret = info->invert;
  42
  43         ct = nf_ct_get(skb, &ctinfo);
  44         if (!ct || !ct->master)
  45                 return ret;
  46
  47         master_help = nfct_help(ct->master);
  48         if (!master_help)
  49                 return ret;
  50
  51         /* rcu_read_lock()ed by nf_hook_slow */
  52         helper = rcu_dereference(master_help->helper);
  53         if (!helper)
  54                 return ret;
  55
  56         if (info->name[0] == '\0')
  57                 ret = !ret;
  58         else
  59                 ret ^= !strncmp(helper->name, info->name,
  60                                 strlen(helper->name));
  61         return ret;
  62 }
  63
  64 static bool check(const char *tablename,
  65                   const void *inf,
  66                   const struct xt_match *match,
  67                   void *matchinfo,
  68                   unsigned int hook_mask)
  69 {
  70         struct xt_helper_info *info = matchinfo;
  71
  72         if (nf_ct_l3proto_try_module_get(match->family) < 0) {
  73                 printk(KERN_WARNING "can't load conntrack support for "
  74                                     "proto=%d\n", match->family);
  75                 return false;
  76         }
  77         info->name[29] = '\0';
  78         return true;
  79 }
  80
  81 static void
  82 destroy(const struct xt_match *match, void *matchinfo)
  83 {
  84         nf_ct_l3proto_module_put(match->family);
  85 }
  86
  87 static struct xt_match xt_helper_match[] __read_mostly = {
  88         {
  89                 .name           = "helper",
  90                 .family         = AF_INET,
  91                 .checkentry     = check,
  92                 .match          = match,
  93                 .destroy        = destroy,
  94                 .matchsize      = sizeof(struct xt_helper_info),
  95                 .me             = THIS_MODULE,
  96         },
  97         {
  98                 .name           = "helper",
  99                 .family         = AF_INET6,
 100                 .checkentry     = check,
 101                 .match          = match,
 102                 .destroy        = destroy,
 103                 .matchsize      = sizeof(struct xt_helper_info),
 104                 .me             = THIS_MODULE,
 105         },
 106 };
 107
 108 static int __init xt_helper_init(void)
 109 {
 110         return xt_register_matches(xt_helper_match,
 111                                    ARRAY_SIZE(xt_helper_match));
 112 }
 113
 114 static void __exit xt_helper_fini(void)
 115 {
 116         xt_unregister_matches(xt_helper_match, ARRAY_SIZE(xt_helper_match));
 117 }
 118
 119 module_init(xt_helper_init);
 120 module_exit(xt_helper_fini);
 121