1 /* iptables module to match on related connections */
3 * (C) 2001 Martin Josefsson <gandalf@wlug.westbo.se>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * 19 Mar 2002 Harald Welte <laforge@gnumonks.org>:
10 * - Port to newnat infrastructure
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
15 #include <linux/netfilter.h>
16 #if defined(CONFIG_IP_NF_CONNTRACK) || defined(CONFIG_IP_NF_CONNTRACK_MODULE)
17 #include <linux/netfilter_ipv4/ip_conntrack.h>
18 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
19 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
21 #include <net/netfilter/nf_conntrack.h>
22 #include <net/netfilter/nf_conntrack_core.h>
23 #include <net/netfilter/nf_conntrack_helper.h>
25 #include <linux/netfilter/x_tables.h>
26 #include <linux/netfilter/xt_helper.h>
27 #include <net/netfilter/nf_conntrack_compat.h>
29 MODULE_LICENSE("GPL");
30 MODULE_AUTHOR("Martin Josefsson <gandalf@netfilter.org>");
31 MODULE_DESCRIPTION("iptables helper match module");
32 MODULE_ALIAS("ipt_helper");
33 MODULE_ALIAS("ip6t_helper");
38 #define DEBUGP(format, args...)
41 #if defined(CONFIG_IP_NF_CONNTRACK) || defined(CONFIG_IP_NF_CONNTRACK_MODULE)
43 match(const struct sk_buff
*skb
,
44 const struct net_device
*in
,
45 const struct net_device
*out
,
46 const struct xt_match
*match
,
47 const void *matchinfo
,
52 const struct xt_helper_info
*info
= matchinfo
;
53 struct ip_conntrack
*ct
;
54 enum ip_conntrack_info ctinfo
;
55 int ret
= info
->invert
;
57 ct
= ip_conntrack_get((struct sk_buff
*)skb
, &ctinfo
);
59 DEBUGP("xt_helper: Eek! invalid conntrack?\n");
64 DEBUGP("xt_helper: conntrack %p has no master\n", ct
);
68 read_lock_bh(&ip_conntrack_lock
);
69 if (!ct
->master
->helper
) {
70 DEBUGP("xt_helper: master ct %p has no helper\n",
75 DEBUGP("master's name = %s , info->name = %s\n",
76 ct
->master
->helper
->name
, info
->name
);
78 if (info
->name
[0] == '\0')
81 ret
^= !strncmp(ct
->master
->helper
->name
, info
->name
,
82 strlen(ct
->master
->helper
->name
));
84 read_unlock_bh(&ip_conntrack_lock
);
88 #else /* CONFIG_IP_NF_CONNTRACK */
91 match(const struct sk_buff
*skb
,
92 const struct net_device
*in
,
93 const struct net_device
*out
,
94 const struct xt_match
*match
,
95 const void *matchinfo
,
100 const struct xt_helper_info
*info
= matchinfo
;
102 struct nf_conn_help
*master_help
;
103 enum ip_conntrack_info ctinfo
;
104 int ret
= info
->invert
;
106 ct
= nf_ct_get((struct sk_buff
*)skb
, &ctinfo
);
108 DEBUGP("xt_helper: Eek! invalid conntrack?\n");
113 DEBUGP("xt_helper: conntrack %p has no master\n", ct
);
117 read_lock_bh(&nf_conntrack_lock
);
118 master_help
= nfct_help(ct
->master
);
119 if (!master_help
|| !master_help
->helper
) {
120 DEBUGP("xt_helper: master ct %p has no helper\n",
125 DEBUGP("master's name = %s , info->name = %s\n",
126 ct
->master
->helper
->name
, info
->name
);
128 if (info
->name
[0] == '\0')
131 ret
^= !strncmp(master_help
->helper
->name
, info
->name
,
132 strlen(master_help
->helper
->name
));
134 read_unlock_bh(&nf_conntrack_lock
);
139 static int check(const char *tablename
,
141 const struct xt_match
*match
,
143 unsigned int hook_mask
)
145 struct xt_helper_info
*info
= matchinfo
;
147 if (nf_ct_l3proto_try_module_get(match
->family
) < 0) {
148 printk(KERN_WARNING
"can't load conntrack support for "
149 "proto=%d\n", match
->family
);
152 info
->name
[29] = '\0';
157 destroy(const struct xt_match
*match
, void *matchinfo
)
159 nf_ct_l3proto_module_put(match
->family
);
162 static struct xt_match xt_helper_match
[] = {
169 .matchsize
= sizeof(struct xt_helper_info
),
178 .matchsize
= sizeof(struct xt_helper_info
),
183 static int __init
xt_helper_init(void)
185 return xt_register_matches(xt_helper_match
,
186 ARRAY_SIZE(xt_helper_match
));
189 static void __exit
xt_helper_fini(void)
191 xt_unregister_matches(xt_helper_match
, ARRAY_SIZE(xt_helper_match
));
194 module_init(xt_helper_init
);
195 module_exit(xt_helper_fini
);