[linux.git] / net / netfilter / xt_conntrack.c

/*
 *	xt_conntrack - Netfilter module to match connection tracking
 *	information. (Superset of Rusty's minimalistic state match.)
 *
 *	(C) 2001  Marc Boucher ([email protected]).
 *	(C) 2006-2012 Patrick McHardy <[email protected]>
 *	Copyright © CC Computer Consultants GmbH, 2007 - 2008
 *
 *	This program is free software; you can redistribute it and/or modify
 *	it under the terms of the GNU General Public License version 2 as
 *	published by the Free Software Foundation.
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/ipv6.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_conntrack.h>
#include <net/netfilter/nf_conntrack.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Marc Boucher <[email protected]>");
MODULE_AUTHOR("Jan Engelhardt <[email protected]>");
MODULE_DESCRIPTION("Xtables: connection tracking state match");
MODULE_ALIAS("ipt_conntrack");
MODULE_ALIAS("ip6t_conntrack");

static bool
conntrack_addrcmp(const union nf_inet_addr *kaddr,
                  const union nf_inet_addr *uaddr,
                  const union nf_inet_addr *umask, unsigned int l3proto)
{
	if (l3proto == NFPROTO_IPV4)
		return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0;
	else if (l3proto == NFPROTO_IPV6)
		return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6,
		       &uaddr->in6) == 0;
	else
		return false;
}

static inline bool
conntrack_mt_origsrc(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
	       &info->origsrc_addr, &info->origsrc_mask, family);
}

static inline bool
conntrack_mt_origdst(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
	       &info->origdst_addr, &info->origdst_mask, family);
}

static inline bool
conntrack_mt_replsrc(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3,
	       &info->replsrc_addr, &info->replsrc_mask, family);
}

static inline bool
conntrack_mt_repldst(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3,
	       &info->repldst_addr, &info->repldst_mask, family);
}

static inline bool
ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info,
                    const struct nf_conn *ct)
{
	const struct nf_conntrack_tuple *tuple;

	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
	    (nf_ct_protonum(ct) == info->l4proto) ^
	    !(info->invert_flags & XT_CONNTRACK_PROTO))
		return false;

	/* Shortcut to match all recognized protocols by using ->src.all. */
	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	    (tuple->src.u.all == info->origsrc_port) ^
	    !(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	    (tuple->dst.u.all == info->origdst_port) ^
	    !(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
		return false;

	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;

	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	    (tuple->src.u.all == info->replsrc_port) ^
	    !(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	    (tuple->dst.u.all == info->repldst_port) ^
	    !(info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
		return false;

	return true;
}

static inline bool
port_match(u16 min, u16 max, u16 port, bool invert)
{
	return (port >= min && port <= max) ^ invert;
}

static inline bool
ct_proto_port_check_v3(const struct xt_conntrack_mtinfo3 *info,
		       const struct nf_conn *ct)
{
	const struct nf_conntrack_tuple *tuple;

	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
	    (nf_ct_protonum(ct) == info->l4proto) ^
	    !(info->invert_flags & XT_CONNTRACK_PROTO))
		return false;

	/* Shortcut to match all recognized protocols by using ->src.all. */
	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	    !port_match(info->origsrc_port, info->origsrc_port_high,
			ntohs(tuple->src.u.all),
			info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	    !port_match(info->origdst_port, info->origdst_port_high,
			ntohs(tuple->dst.u.all),
			info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
		return false;

	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;

	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	    !port_match(info->replsrc_port, info->replsrc_port_high,
			ntohs(tuple->src.u.all),
			info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	    !port_match(info->repldst_port, info->repldst_port_high,
			ntohs(tuple->dst.u.all),
			info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
		return false;

	return true;
}

static bool
conntrack_mt(const struct sk_buff *skb, struct xt_action_param *par,
             u16 state_mask, u16 status_mask)
{
	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
	enum ip_conntrack_info ctinfo;
	const struct nf_conn *ct;
	unsigned int statebit;

	ct = nf_ct_get(skb, &ctinfo);

	if (ct)
		statebit = XT_CONNTRACK_STATE_BIT(ctinfo);
	else if (ctinfo == IP_CT_UNTRACKED)
		statebit = XT_CONNTRACK_STATE_UNTRACKED;
	else
		statebit = XT_CONNTRACK_STATE_INVALID;

	if (info->match_flags & XT_CONNTRACK_STATE) {
		if (ct != NULL) {
			if (test_bit(IPS_SRC_NAT_BIT, &ct->status))
				statebit |= XT_CONNTRACK_STATE_SNAT;
			if (test_bit(IPS_DST_NAT_BIT, &ct->status))
				statebit |= XT_CONNTRACK_STATE_DNAT;
		}
		if (!!(state_mask & statebit) ^
		    !(info->invert_flags & XT_CONNTRACK_STATE))
			return false;
	}

	if (ct == NULL)
		return info->match_flags & XT_CONNTRACK_STATE;
	if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
	    (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
	    !(info->invert_flags & XT_CONNTRACK_DIRECTION))
		return false;

	if (info->match_flags & XT_CONNTRACK_ORIGSRC)
		if (conntrack_mt_origsrc(ct, info, xt_family(par)) ^
		    !(info->invert_flags & XT_CONNTRACK_ORIGSRC))
			return false;

	if (info->match_flags & XT_CONNTRACK_ORIGDST)
		if (conntrack_mt_origdst(ct, info, xt_family(par)) ^
		    !(info->invert_flags & XT_CONNTRACK_ORIGDST))
			return false;

	if (info->match_flags & XT_CONNTRACK_REPLSRC)
		if (conntrack_mt_replsrc(ct, info, xt_family(par)) ^
		    !(info->invert_flags & XT_CONNTRACK_REPLSRC))
			return false;

	if (info->match_flags & XT_CONNTRACK_REPLDST)
		if (conntrack_mt_repldst(ct, info, xt_family(par)) ^
		    !(info->invert_flags & XT_CONNTRACK_REPLDST))
			return false;

	if (par->match->revision != 3) {
		if (!ct_proto_port_check(info, ct))
			return false;
	} else {
		if (!ct_proto_port_check_v3(par->matchinfo, ct))
			return false;
	}

	if ((info->match_flags & XT_CONNTRACK_STATUS) &&
	    (!!(status_mask & ct->status) ^
	    !(info->invert_flags & XT_CONNTRACK_STATUS)))
		return false;

	if (info->match_flags & XT_CONNTRACK_EXPIRES) {
		unsigned long expires = nf_ct_expires(ct) / HZ;

		if ((expires >= info->expires_min &&
		    expires <= info->expires_max) ^
		    !(info->invert_flags & XT_CONNTRACK_EXPIRES))
			return false;
	}
	return true;
}

static bool
conntrack_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_conntrack_mtinfo1 *info = par->matchinfo;

	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
}

static bool
conntrack_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;

	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
}

static bool
conntrack_mt_v3(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_conntrack_mtinfo3 *info = par->matchinfo;

	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
}

static int conntrack_mt_check(const struct xt_mtchk_param *par)
{
	int ret;

	ret = nf_ct_netns_get(par->net, par->family);
	if (ret < 0)
		pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
				    par->family);
	return ret;
}

static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
{
	nf_ct_netns_put(par->net, par->family);
}

static struct xt_match conntrack_mt_reg[] __read_mostly = {
	{
		.name       = "conntrack",
		.revision   = 1,
		.family     = NFPROTO_UNSPEC,
		.matchsize  = sizeof(struct xt_conntrack_mtinfo1),
		.match      = conntrack_mt_v1,
		.checkentry = conntrack_mt_check,
		.destroy    = conntrack_mt_destroy,
		.me         = THIS_MODULE,
	},
	{
		.name       = "conntrack",
		.revision   = 2,
		.family     = NFPROTO_UNSPEC,
		.matchsize  = sizeof(struct xt_conntrack_mtinfo2),
		.match      = conntrack_mt_v2,
		.checkentry = conntrack_mt_check,
		.destroy    = conntrack_mt_destroy,
		.me         = THIS_MODULE,
	},
	{
		.name       = "conntrack",
		.revision   = 3,
		.family     = NFPROTO_UNSPEC,
		.matchsize  = sizeof(struct xt_conntrack_mtinfo3),
		.match      = conntrack_mt_v3,
		.checkentry = conntrack_mt_check,
		.destroy    = conntrack_mt_destroy,
		.me         = THIS_MODULE,
	},
};

static int __init conntrack_mt_init(void)
{
	return xt_register_matches(conntrack_mt_reg,
	       ARRAY_SIZE(conntrack_mt_reg));
}

static void __exit conntrack_mt_exit(void)
{
	xt_unregister_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg));
}

module_init(conntrack_mt_init);
module_exit(conntrack_mt_exit);
Commit	Line	Data
64eb12f9 JE	1	/*
	2	* xt_conntrack - Netfilter module to match connection tracking
	3	* information. (Superset of Rusty's minimalistic state match.)
1da177e4	4	*
64eb12f9	5	* (C) 2001 Marc Boucher ([email protected]).
f229f6ce	6	* (C) 2006-2012 Patrick McHardy <[email protected]>
64eb12f9	7	* Copyright © CC Computer Consultants GmbH, 2007 - 2008
1da177e4	8	*
64eb12f9 JE	9	* This program is free software; you can redistribute it and/or modify
	10	* it under the terms of the GNU General Public License version 2 as
	11	* published by the Free Software Foundation.
1da177e4	12	*/
8bee4bad	13	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
1da177e4 LT	14	#include <linux/module.h>
1da177e4 LT	15	#include <linux/skbuff.h>
64eb12f9	16	#include <net/ipv6.h>
2e4e6a17 HW	17	#include <linux/netfilter/x_tables.h>
2e4e6a17 HW	18	#include <linux/netfilter/xt_conntrack.h>
587aa641	19	#include <net/netfilter/nf_conntrack.h>
1da177e4 LT	20
	21	MODULE_LICENSE("GPL");
	22	MODULE_AUTHOR("Marc Boucher <[email protected]>");
9e05ec4b	23	MODULE_AUTHOR("Jan Engelhardt <[email protected]>");
2ae15b64	24	MODULE_DESCRIPTION("Xtables: connection tracking state match");
2e4e6a17	25	MODULE_ALIAS("ipt_conntrack");
64eb12f9	26	MODULE_ALIAS("ip6t_conntrack");
1da177e4	27
64eb12f9 JE	28	static bool
	29	conntrack_addrcmp(const union nf_inet_addr *kaddr,
	30	const union nf_inet_addr *uaddr,
	31	const union nf_inet_addr *umask, unsigned int l3proto)
	32	{
ee999d8b	33	if (l3proto == NFPROTO_IPV4)
6556874d	34	return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0;
ee999d8b	35	else if (l3proto == NFPROTO_IPV6)
64eb12f9 JE	36	return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6,
	37	&uaddr->in6) == 0;
	38	else
	39	return false;
	40	}
	41
	42	static inline bool
	43	conntrack_mt_origsrc(const struct nf_conn *ct,
d6d3f08b	44	const struct xt_conntrack_mtinfo2 *info,
76108cea	45	u_int8_t family)
64eb12f9 JE	46	{
	47	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
	48	&info->origsrc_addr, &info->origsrc_mask, family);
	49	}
	50
	51	static inline bool
	52	conntrack_mt_origdst(const struct nf_conn *ct,
d6d3f08b	53	const struct xt_conntrack_mtinfo2 *info,
76108cea	54	u_int8_t family)
64eb12f9 JE	55	{
	56	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
	57	&info->origdst_addr, &info->origdst_mask, family);
	58	}
	59
	60	static inline bool
	61	conntrack_mt_replsrc(const struct nf_conn *ct,
d6d3f08b	62	const struct xt_conntrack_mtinfo2 *info,
76108cea	63	u_int8_t family)
64eb12f9 JE	64	{
	65	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3,
	66	&info->replsrc_addr, &info->replsrc_mask, family);
	67	}
	68
	69	static inline bool
	70	conntrack_mt_repldst(const struct nf_conn *ct,
d6d3f08b	71	const struct xt_conntrack_mtinfo2 *info,
76108cea	72	u_int8_t family)
64eb12f9 JE	73	{
	74	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3,
	75	&info->repldst_addr, &info->repldst_mask, family);
	76	}
	77
b4164998	78	static inline bool
d6d3f08b	79	ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info,
b4164998 JE	80	const struct nf_conn *ct)
	81	{
	82	const struct nf_conntrack_tuple *tuple;
	83
	84	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	85	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
5e8fbe2a	86	(nf_ct_protonum(ct) == info->l4proto) ^
b4164998 JE	87	!(info->invert_flags & XT_CONNTRACK_PROTO))
	88	return false;
	89
	90	/* Shortcut to match all recognized protocols by using ->src.all. */
	91	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	92	(tuple->src.u.all == info->origsrc_port) ^
	93	!(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
	94	return false;
	95
	96	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	97	(tuple->dst.u.all == info->origdst_port) ^
	98	!(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
	99	return false;
	100
	101	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
	102
	103	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	104	(tuple->src.u.all == info->replsrc_port) ^
	105	!(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
	106	return false;
	107
	108	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	109	(tuple->dst.u.all == info->repldst_port) ^
	110	!(info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
	111	return false;
	112
	113	return true;
	114	}
	115
b017900a PM	116	static inline bool
	117	port_match(u16 min, u16 max, u16 port, bool invert)
	118	{
	119	return (port >= min && port <= max) ^ invert;
	120	}
	121
	122	static inline bool
	123	ct_proto_port_check_v3(const struct xt_conntrack_mtinfo3 *info,
	124	const struct nf_conn *ct)
	125	{
	126	const struct nf_conntrack_tuple *tuple;
	127
	128	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	129	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
	130	(nf_ct_protonum(ct) == info->l4proto) ^
	131	!(info->invert_flags & XT_CONNTRACK_PROTO))
	132	return false;
	133
	134	/* Shortcut to match all recognized protocols by using ->src.all. */
	135	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	136	!port_match(info->origsrc_port, info->origsrc_port_high,
	137	ntohs(tuple->src.u.all),
	138	info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
	139	return false;
	140
	141	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	142	!port_match(info->origdst_port, info->origdst_port_high,
	143	ntohs(tuple->dst.u.all),
	144	info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
	145	return false;
	146
	147	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
	148
	149	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	150	!port_match(info->replsrc_port, info->replsrc_port_high,
	151	ntohs(tuple->src.u.all),
	152	info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
	153	return false;
	154
	155	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	156	!port_match(info->repldst_port, info->repldst_port_high,
	157	ntohs(tuple->dst.u.all),
	158	info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
	159	return false;
	160
	161	return true;
	162	}
	163
64eb12f9	164	static bool
62fc8051	165	conntrack_mt(const struct sk_buff skb, struct xt_action_param par,
3a042929	166	u16 state_mask, u16 status_mask)
64eb12f9	167	{
d6d3f08b	168	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
64eb12f9 JE	169	enum ip_conntrack_info ctinfo;
	170	const struct nf_conn *ct;
	171	unsigned int statebit;
	172
	173	ct = nf_ct_get(skb, &ctinfo);
	174
cc41c84b FW	175	if (ct)
	176	statebit = XT_CONNTRACK_STATE_BIT(ctinfo);
	177	else if (ctinfo == IP_CT_UNTRACKED)
	178	statebit = XT_CONNTRACK_STATE_UNTRACKED;
	179	else
64eb12f9 JE	180	statebit = XT_CONNTRACK_STATE_INVALID;
	181
	182	if (info->match_flags & XT_CONNTRACK_STATE) {
	183	if (ct != NULL) {
	184	if (test_bit(IPS_SRC_NAT_BIT, &ct->status))
	185	statebit \|= XT_CONNTRACK_STATE_SNAT;
	186	if (test_bit(IPS_DST_NAT_BIT, &ct->status))
	187	statebit \|= XT_CONNTRACK_STATE_DNAT;
	188	}
3a042929	189	if (!!(state_mask & statebit) ^
64eb12f9 JE	190	!(info->invert_flags & XT_CONNTRACK_STATE))
	191	return false;
	192	}
	193
	194	if (ct == NULL)
	195	return info->match_flags & XT_CONNTRACK_STATE;
b4164998 JE	196	if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
b4164998 JE	197	(CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
96120d86	198	!(info->invert_flags & XT_CONNTRACK_DIRECTION))
64eb12f9 JE	199	return false;
	200
	201	if (info->match_flags & XT_CONNTRACK_ORIGSRC)
613dbd95	202	if (conntrack_mt_origsrc(ct, info, xt_family(par)) ^
64eb12f9 JE	203	!(info->invert_flags & XT_CONNTRACK_ORIGSRC))
	204	return false;
	205
	206	if (info->match_flags & XT_CONNTRACK_ORIGDST)
613dbd95	207	if (conntrack_mt_origdst(ct, info, xt_family(par)) ^
64eb12f9 JE	208	!(info->invert_flags & XT_CONNTRACK_ORIGDST))
	209	return false;
	210
	211	if (info->match_flags & XT_CONNTRACK_REPLSRC)
613dbd95	212	if (conntrack_mt_replsrc(ct, info, xt_family(par)) ^
64eb12f9 JE	213	!(info->invert_flags & XT_CONNTRACK_REPLSRC))
	214	return false;
	215
	216	if (info->match_flags & XT_CONNTRACK_REPLDST)
613dbd95	217	if (conntrack_mt_repldst(ct, info, xt_family(par)) ^
64eb12f9 JE	218	!(info->invert_flags & XT_CONNTRACK_REPLDST))
	219	return false;
	220
b017900a PM	221	if (par->match->revision != 3) {
	222	if (!ct_proto_port_check(info, ct))
	223	return false;
	224	} else {
	225	if (!ct_proto_port_check_v3(par->matchinfo, ct))
	226	return false;
	227	}
b4164998	228
64eb12f9	229	if ((info->match_flags & XT_CONNTRACK_STATUS) &&
3a042929	230	(!!(status_mask & ct->status) ^
64eb12f9 JE	231	!(info->invert_flags & XT_CONNTRACK_STATUS)))
	232	return false;
	233
	234	if (info->match_flags & XT_CONNTRACK_EXPIRES) {
d0b35b93	235	unsigned long expires = nf_ct_expires(ct) / HZ;
64eb12f9	236
64eb12f9 JE	237	if ((expires >= info->expires_min &&
	238	expires <= info->expires_max) ^
	239	!(info->invert_flags & XT_CONNTRACK_EXPIRES))
	240	return false;
	241	}
	242	return true;
	243	}
	244
d6d3f08b	245	static bool
62fc8051	246	conntrack_mt_v1(const struct sk_buff skb, struct xt_action_param par)
d6d3f08b	247	{
3a042929	248	const struct xt_conntrack_mtinfo1 *info = par->matchinfo;
d6d3f08b	249
3a042929 FW	250	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
	251	}
	252
	253	static bool
62fc8051	254	conntrack_mt_v2(const struct sk_buff skb, struct xt_action_param par)
3a042929 FW	255	{
	256	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
	257
	258	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
d6d3f08b JE	259	}
d6d3f08b JE	260
b017900a PM	261	static bool
	262	conntrack_mt_v3(const struct sk_buff skb, struct xt_action_param par)
	263	{
	264	const struct xt_conntrack_mtinfo3 *info = par->matchinfo;
	265
	266	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
	267	}
	268
b0f38452	269	static int conntrack_mt_check(const struct xt_mtchk_param *par)
b9f78f9f	270	{
4a5a5c73 JE	271	int ret;
4a5a5c73 JE	272
ecb2421b	273	ret = nf_ct_netns_get(par->net, par->family);
f95c74e3	274	if (ret < 0)
b2606644 FW	275	pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
b2606644 FW	276	par->family);
f95c74e3	277	return ret;
b9f78f9f PNA	278	}
b9f78f9f PNA	279
6be3d859	280	static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
b9f78f9f	281	{
ecb2421b	282	nf_ct_netns_put(par->net, par->family);
b9f78f9f PNA	283	}
b9f78f9f PNA	284
64eb12f9	285	static struct xt_match conntrack_mt_reg[] __read_mostly = {
64eb12f9 JE	286	{
	287	.name = "conntrack",
	288	.revision = 1,
92f3b2b1	289	.family = NFPROTO_UNSPEC,
64eb12f9	290	.matchsize = sizeof(struct xt_conntrack_mtinfo1),
d6d3f08b	291	.match = conntrack_mt_v1,
3a042929 FW	292	.checkentry = conntrack_mt_check,
3a042929 FW	293	.destroy = conntrack_mt_destroy,
d6d3f08b JE	294	.me = THIS_MODULE,
	295	},
	296	{
	297	.name = "conntrack",
	298	.revision = 2,
	299	.family = NFPROTO_UNSPEC,
	300	.matchsize = sizeof(struct xt_conntrack_mtinfo2),
3a042929	301	.match = conntrack_mt_v2,
64eb12f9 JE	302	.checkentry = conntrack_mt_check,
	303	.destroy = conntrack_mt_destroy,
	304	.me = THIS_MODULE,
	305	},
b017900a PM	306	{
	307	.name = "conntrack",
	308	.revision = 3,
	309	.family = NFPROTO_UNSPEC,
	310	.matchsize = sizeof(struct xt_conntrack_mtinfo3),
	311	.match = conntrack_mt_v3,
	312	.checkentry = conntrack_mt_check,
	313	.destroy = conntrack_mt_destroy,
	314	.me = THIS_MODULE,
	315	},
1da177e4 LT	316	};
1da177e4 LT	317
d3c5ee6d	318	static int __init conntrack_mt_init(void)
1da177e4	319	{
64eb12f9 JE	320	return xt_register_matches(conntrack_mt_reg,
64eb12f9 JE	321	ARRAY_SIZE(conntrack_mt_reg));
1da177e4 LT	322	}
1da177e4 LT	323
d3c5ee6d	324	static void __exit conntrack_mt_exit(void)
1da177e4	325	{
64eb12f9	326	xt_unregister_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg));
1da177e4 LT	327	}
1da177e4 LT	328
d3c5ee6d JE	329	module_init(conntrack_mt_init);
d3c5ee6d JE	330	module_exit(conntrack_mt_exit);