1/*
2 * (C) 2013 Astaro GmbH & Co KG
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 */
8
9#include <linux/module.h>
10#include <linux/skbuff.h>
11#include <net/netfilter/nf_conntrack.h>
12#include <net/netfilter/nf_conntrack_labels.h>
13#include <linux/netfilter/x_tables.h>
14
15MODULE_LICENSE("GPL");
16MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
17MODULE_DESCRIPTION("Xtables: add/match connection trackling labels");
18MODULE_ALIAS("ipt_connlabel");
19MODULE_ALIAS("ip6t_connlabel");
20
21static bool
22connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par)
23{
24	const struct xt_connlabel_mtinfo *info = par->matchinfo;
25	enum ip_conntrack_info ctinfo;
26	struct nf_conn *ct;
27	bool invert = info->options & XT_CONNLABEL_OP_INVERT;
28
29	ct = nf_ct_get(skb, &ctinfo);
30	if (ct == NULL || nf_ct_is_untracked(ct))
31		return invert;
32
33	if (info->options & XT_CONNLABEL_OP_SET)
34		return (nf_connlabel_set(ct, info->bit) == 0) ^ invert;
35
36	return nf_connlabel_match(ct, info->bit) ^ invert;
37}
38
39static int connlabel_mt_check(const struct xt_mtchk_param *par)
40{
41	const int options = XT_CONNLABEL_OP_INVERT |
42			    XT_CONNLABEL_OP_SET;
43	struct xt_connlabel_mtinfo *info = par->matchinfo;
44	int ret;
45	size_t words;
46
47	if (info->bit > XT_CONNLABEL_MAXBIT)
48		return -ERANGE;
49
50	if (info->options & ~options) {
51		pr_err("Unknown options in mask %x\n", info->options);
52		return -EINVAL;
53	}
54
55	ret = nf_ct_l3proto_try_module_get(par->family);
56	if (ret < 0) {
57		pr_info("cannot load conntrack support for proto=%u\n",
58							par->family);
59		return ret;
60	}
61
62	par->net->ct.labels_used++;
63	words = BITS_TO_LONGS(info->bit+1);
64	if (words > par->net->ct.label_words)
65		par->net->ct.label_words = words;
66
67	return ret;
68}
69
70static void connlabel_mt_destroy(const struct xt_mtdtor_param *par)
71{
72	par->net->ct.labels_used--;
73	if (par->net->ct.labels_used == 0)
74		par->net->ct.label_words = 0;
75	nf_ct_l3proto_module_put(par->family);
76}
77
78static struct xt_match connlabels_mt_reg __read_mostly = {
79	.name           = "connlabel",
80	.family         = NFPROTO_UNSPEC,
81	.checkentry     = connlabel_mt_check,
82	.match          = connlabel_mt,
83	.matchsize      = sizeof(struct xt_connlabel_mtinfo),
84	.destroy        = connlabel_mt_destroy,
85	.me             = THIS_MODULE,
86};
87
88static int __init connlabel_mt_init(void)
89{
90	return xt_register_match(&connlabels_mt_reg);
91}
92
93static void __exit connlabel_mt_exit(void)
94{
95	xt_unregister_match(&connlabels_mt_reg);
96}
97
98module_init(connlabel_mt_init);
99module_exit(connlabel_mt_exit);
100