err.no Git - linux-2.6/blob - net/netfilter/xt_helper.c

   1 /* iptables module to match on related connections */
   2 /*
   3  * (C) 2001 Martin Josefsson <gandalf@wlug.westbo.se>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  *   19 Mar 2002 Harald Welte <laforge@gnumonks.org>:
  10  *               - Port to newnat infrastructure
  11  */
  12
  13 #include <linux/module.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/netfilter.h>
  16 #include <net/netfilter/nf_conntrack.h>
  17 #include <net/netfilter/nf_conntrack_core.h>
  18 #include <net/netfilter/nf_conntrack_helper.h>
  19 #include <linux/netfilter/x_tables.h>
  20 #include <linux/netfilter/xt_helper.h>
  21
  22 MODULE_LICENSE("GPL");
  23 MODULE_AUTHOR("Martin Josefsson <gandalf@netfilter.org>");
  24 MODULE_DESCRIPTION("iptables helper match module");
  25 MODULE_ALIAS("ipt_helper");
  26 MODULE_ALIAS("ip6t_helper");
  27
  28 #if 0
  29 #define DEBUGP printk
  30 #else
  31 #define DEBUGP(format, args...)
  32 #endif
  33
  34 static int
  35 match(const struct sk_buff *skb,
  36       const struct net_device *in,
  37       const struct net_device *out,
  38       const struct xt_match *match,
  39       const void *matchinfo,
  40       int offset,
  41       unsigned int protoff,
  42       int *hotdrop)
  43 {
  44         const struct xt_helper_info *info = matchinfo;
  45         struct nf_conn *ct;
  46         struct nf_conn_help *master_help;
  47         enum ip_conntrack_info ctinfo;
  48         int ret = info->invert;
  49
  50         ct = nf_ct_get((struct sk_buff *)skb, &ctinfo);
  51         if (!ct) {
  52                 DEBUGP("xt_helper: Eek! invalid conntrack?\n");
  53                 return ret;
  54         }
  55
  56         if (!ct->master) {
  57                 DEBUGP("xt_helper: conntrack %p has no master\n", ct);
  58                 return ret;
  59         }
  60
  61         read_lock_bh(&nf_conntrack_lock);
  62         master_help = nfct_help(ct->master);
  63         if (!master_help || !master_help->helper) {
  64                 DEBUGP("xt_helper: master ct %p has no helper\n",
  65                         exp->expectant);
  66                 goto out_unlock;
  67         }
  68
  69         DEBUGP("master's name = %s , info->name = %s\n",
  70                 ct->master->helper->name, info->name);
  71
  72         if (info->name[0] == '\0')
  73                 ret ^= 1;
  74         else
  75                 ret ^= !strncmp(master_help->helper->name, info->name,
  76                                 strlen(master_help->helper->name));
  77 out_unlock:
  78         read_unlock_bh(&nf_conntrack_lock);
  79         return ret;
  80 }
  81
  82 static int check(const char *tablename,
  83                  const void *inf,
  84                  const struct xt_match *match,
  85                  void *matchinfo,
  86                  unsigned int hook_mask)
  87 {
  88         struct xt_helper_info *info = matchinfo;
  89
  90         if (nf_ct_l3proto_try_module_get(match->family) < 0) {
  91                 printk(KERN_WARNING "can't load conntrack support for "
  92                                     "proto=%d\n", match->family);
  93                 return 0;
  94         }
  95         info->name[29] = '\0';
  96         return 1;
  97 }
  98
  99 static void
 100 destroy(const struct xt_match *match, void *matchinfo)
 101 {
 102         nf_ct_l3proto_module_put(match->family);
 103 }
 104
 105 static struct xt_match xt_helper_match[] = {
 106         {
 107                 .name           = "helper",
 108                 .family         = AF_INET,
 109                 .checkentry     = check,
 110                 .match          = match,
 111                 .destroy        = destroy,
 112                 .matchsize      = sizeof(struct xt_helper_info),
 113                 .me             = THIS_MODULE,
 114         },
 115         {
 116                 .name           = "helper",
 117                 .family         = AF_INET6,
 118                 .checkentry     = check,
 119                 .match          = match,
 120                 .destroy        = destroy,
 121                 .matchsize      = sizeof(struct xt_helper_info),
 122                 .me             = THIS_MODULE,
 123         },
 124 };
 125
 126 static int __init xt_helper_init(void)
 127 {
 128         return xt_register_matches(xt_helper_match,
 129                                    ARRAY_SIZE(xt_helper_match));
 130 }
 131
 132 static void __exit xt_helper_fini(void)
 133 {
 134         xt_unregister_matches(xt_helper_match, ARRAY_SIZE(xt_helper_match));
 135 }
 136
 137 module_init(xt_helper_init);
 138 module_exit(xt_helper_fini);
 139