mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
![Thomas Gleixner](/assets/img/avatar_default.png)
Based on 2 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details you should have received a copy of the gnu general public license along with this program if not see http www gnu org licenses this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details [based] [from] [clk] [highbank] [c] you should have received a copy of the gnu general public license along with this program if not see http www gnu org licenses extracted by the scancode license scanner the SPDX license identifier GPL-2.0-or-later has been chosen to replace the boilerplate/reference in 355 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org> Reviewed-by: Jilayne Lovejoy <opensource@jilayne.com> Reviewed-by: Steve Winslow <swinslow@gmail.com> Reviewed-by: Allison Randal <allison@lohutok.net> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190519154041.837383322@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
206 lines
5.1 KiB
C
206 lines
5.1 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* xt_connmark - Netfilter module to operate on connection marks
|
|
*
|
|
* Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
|
|
* by Henrik Nordstrom <hno@marasystems.com>
|
|
* Copyright © CC Computer Consultants GmbH, 2007 - 2008
|
|
* Jan Engelhardt <jengelh@medozas.de>
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/skbuff.h>
|
|
#include <net/netfilter/nf_conntrack.h>
|
|
#include <net/netfilter/nf_conntrack_ecache.h>
|
|
#include <linux/netfilter/x_tables.h>
|
|
#include <linux/netfilter/xt_connmark.h>
|
|
|
|
MODULE_AUTHOR("Henrik Nordstrom <hno@marasystems.com>");
|
|
MODULE_DESCRIPTION("Xtables: connection mark operations");
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_ALIAS("ipt_CONNMARK");
|
|
MODULE_ALIAS("ip6t_CONNMARK");
|
|
MODULE_ALIAS("ipt_connmark");
|
|
MODULE_ALIAS("ip6t_connmark");
|
|
|
|
static unsigned int
|
|
connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info)
|
|
{
|
|
enum ip_conntrack_info ctinfo;
|
|
u_int32_t new_targetmark;
|
|
struct nf_conn *ct;
|
|
u_int32_t newmark;
|
|
|
|
ct = nf_ct_get(skb, &ctinfo);
|
|
if (ct == NULL)
|
|
return XT_CONTINUE;
|
|
|
|
switch (info->mode) {
|
|
case XT_CONNMARK_SET:
|
|
newmark = (ct->mark & ~info->ctmask) ^ info->ctmark;
|
|
if (info->shift_dir == D_SHIFT_RIGHT)
|
|
newmark >>= info->shift_bits;
|
|
else
|
|
newmark <<= info->shift_bits;
|
|
|
|
if (ct->mark != newmark) {
|
|
ct->mark = newmark;
|
|
nf_conntrack_event_cache(IPCT_MARK, ct);
|
|
}
|
|
break;
|
|
case XT_CONNMARK_SAVE:
|
|
new_targetmark = (skb->mark & info->nfmask);
|
|
if (info->shift_dir == D_SHIFT_RIGHT)
|
|
new_targetmark >>= info->shift_bits;
|
|
else
|
|
new_targetmark <<= info->shift_bits;
|
|
|
|
newmark = (ct->mark & ~info->ctmask) ^
|
|
new_targetmark;
|
|
if (ct->mark != newmark) {
|
|
ct->mark = newmark;
|
|
nf_conntrack_event_cache(IPCT_MARK, ct);
|
|
}
|
|
break;
|
|
case XT_CONNMARK_RESTORE:
|
|
new_targetmark = (ct->mark & info->ctmask);
|
|
if (info->shift_dir == D_SHIFT_RIGHT)
|
|
new_targetmark >>= info->shift_bits;
|
|
else
|
|
new_targetmark <<= info->shift_bits;
|
|
|
|
newmark = (skb->mark & ~info->nfmask) ^
|
|
new_targetmark;
|
|
skb->mark = newmark;
|
|
break;
|
|
}
|
|
return XT_CONTINUE;
|
|
}
|
|
|
|
static unsigned int
|
|
connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
|
|
{
|
|
const struct xt_connmark_tginfo1 *info = par->targinfo;
|
|
const struct xt_connmark_tginfo2 info2 = {
|
|
.ctmark = info->ctmark,
|
|
.ctmask = info->ctmask,
|
|
.nfmask = info->nfmask,
|
|
.mode = info->mode,
|
|
};
|
|
|
|
return connmark_tg_shift(skb, &info2);
|
|
}
|
|
|
|
static unsigned int
|
|
connmark_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
|
|
{
|
|
const struct xt_connmark_tginfo2 *info = par->targinfo;
|
|
|
|
return connmark_tg_shift(skb, info);
|
|
}
|
|
|
|
static int connmark_tg_check(const struct xt_tgchk_param *par)
|
|
{
|
|
int ret;
|
|
|
|
ret = nf_ct_netns_get(par->net, par->family);
|
|
if (ret < 0)
|
|
pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
|
|
par->family);
|
|
return ret;
|
|
}
|
|
|
|
static void connmark_tg_destroy(const struct xt_tgdtor_param *par)
|
|
{
|
|
nf_ct_netns_put(par->net, par->family);
|
|
}
|
|
|
|
static bool
|
|
connmark_mt(const struct sk_buff *skb, struct xt_action_param *par)
|
|
{
|
|
const struct xt_connmark_mtinfo1 *info = par->matchinfo;
|
|
enum ip_conntrack_info ctinfo;
|
|
const struct nf_conn *ct;
|
|
|
|
ct = nf_ct_get(skb, &ctinfo);
|
|
if (ct == NULL)
|
|
return false;
|
|
|
|
return ((ct->mark & info->mask) == info->mark) ^ info->invert;
|
|
}
|
|
|
|
static int connmark_mt_check(const struct xt_mtchk_param *par)
|
|
{
|
|
int ret;
|
|
|
|
ret = nf_ct_netns_get(par->net, par->family);
|
|
if (ret < 0)
|
|
pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
|
|
par->family);
|
|
return ret;
|
|
}
|
|
|
|
static void connmark_mt_destroy(const struct xt_mtdtor_param *par)
|
|
{
|
|
nf_ct_netns_put(par->net, par->family);
|
|
}
|
|
|
|
static struct xt_target connmark_tg_reg[] __read_mostly = {
|
|
{
|
|
.name = "CONNMARK",
|
|
.revision = 1,
|
|
.family = NFPROTO_UNSPEC,
|
|
.checkentry = connmark_tg_check,
|
|
.target = connmark_tg,
|
|
.targetsize = sizeof(struct xt_connmark_tginfo1),
|
|
.destroy = connmark_tg_destroy,
|
|
.me = THIS_MODULE,
|
|
},
|
|
{
|
|
.name = "CONNMARK",
|
|
.revision = 2,
|
|
.family = NFPROTO_UNSPEC,
|
|
.checkentry = connmark_tg_check,
|
|
.target = connmark_tg_v2,
|
|
.targetsize = sizeof(struct xt_connmark_tginfo2),
|
|
.destroy = connmark_tg_destroy,
|
|
.me = THIS_MODULE,
|
|
}
|
|
};
|
|
|
|
static struct xt_match connmark_mt_reg __read_mostly = {
|
|
.name = "connmark",
|
|
.revision = 1,
|
|
.family = NFPROTO_UNSPEC,
|
|
.checkentry = connmark_mt_check,
|
|
.match = connmark_mt,
|
|
.matchsize = sizeof(struct xt_connmark_mtinfo1),
|
|
.destroy = connmark_mt_destroy,
|
|
.me = THIS_MODULE,
|
|
};
|
|
|
|
static int __init connmark_mt_init(void)
|
|
{
|
|
int ret;
|
|
|
|
ret = xt_register_targets(connmark_tg_reg,
|
|
ARRAY_SIZE(connmark_tg_reg));
|
|
if (ret < 0)
|
|
return ret;
|
|
ret = xt_register_match(&connmark_mt_reg);
|
|
if (ret < 0) {
|
|
xt_unregister_targets(connmark_tg_reg,
|
|
ARRAY_SIZE(connmark_tg_reg));
|
|
return ret;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static void __exit connmark_mt_exit(void)
|
|
{
|
|
xt_unregister_match(&connmark_mt_reg);
|
|
xt_unregister_targets(connmark_tg_reg, ARRAY_SIZE(connmark_tg_reg));
|
|
}
|
|
|
|
module_init(connmark_mt_init);
|
|
module_exit(connmark_mt_exit);
|