2 * xt_connmark - Netfilter module to operate on connection marks
4 * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
5 * by Henrik Nordstrom <hno@marasystems.com>
6 * Copyright © CC Computer Consultants GmbH, 2007 - 2008
7 * Jan Engelhardt <jengelh@medozas.de>
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
24 #include <linux/module.h>
25 #include <linux/skbuff.h>
26 #include <net/netfilter/nf_conntrack.h>
27 #include <net/netfilter/nf_conntrack_ecache.h>
28 #include <linux/netfilter/x_tables.h>
29 #include <linux/netfilter/xt_connmark.h>
31 MODULE_AUTHOR("Henrik Nordstrom <hno@marasystems.com>");
32 MODULE_DESCRIPTION("Xtables: connection mark operations");
33 MODULE_LICENSE("GPL");
34 MODULE_ALIAS("ipt_CONNMARK");
35 MODULE_ALIAS("ip6t_CONNMARK");
36 MODULE_ALIAS("ipt_connmark");
37 MODULE_ALIAS("ip6t_connmark");
40 connmark_tg(struct sk_buff
*skb
, const struct xt_target_param
*par
)
42 const struct xt_connmark_tginfo1
*info
= par
->targinfo
;
43 enum ip_conntrack_info ctinfo
;
47 ct
= nf_ct_get(skb
, &ctinfo
);
53 newmark
= (ct
->mark
& ~info
->ctmask
) ^ info
->ctmark
;
54 if (ct
->mark
!= newmark
) {
56 nf_conntrack_event_cache(IPCT_MARK
, ct
);
59 case XT_CONNMARK_SAVE
:
60 newmark
= (ct
->mark
& ~info
->ctmask
) ^
61 (skb
->mark
& info
->nfmask
);
62 if (ct
->mark
!= newmark
) {
64 nf_conntrack_event_cache(IPCT_MARK
, ct
);
67 case XT_CONNMARK_RESTORE
:
68 newmark
= (skb
->mark
& ~info
->nfmask
) ^
69 (ct
->mark
& info
->ctmask
);
77 static int connmark_tg_check(const struct xt_tgchk_param
*par
)
79 if (nf_ct_l3proto_try_module_get(par
->family
) < 0) {
80 pr_info("cannot load conntrack support for proto=%u\n",
87 static void connmark_tg_destroy(const struct xt_tgdtor_param
*par
)
89 nf_ct_l3proto_module_put(par
->family
);
93 connmark_mt(const struct sk_buff
*skb
, const struct xt_match_param
*par
)
95 const struct xt_connmark_mtinfo1
*info
= par
->matchinfo
;
96 enum ip_conntrack_info ctinfo
;
97 const struct nf_conn
*ct
;
99 ct
= nf_ct_get(skb
, &ctinfo
);
103 return ((ct
->mark
& info
->mask
) == info
->mark
) ^ info
->invert
;
106 static int connmark_mt_check(const struct xt_mtchk_param
*par
)
108 if (nf_ct_l3proto_try_module_get(par
->family
) < 0) {
109 pr_info("cannot load conntrack support for proto=%u\n",
116 static void connmark_mt_destroy(const struct xt_mtdtor_param
*par
)
118 nf_ct_l3proto_module_put(par
->family
);
121 static struct xt_target connmark_tg_reg __read_mostly
= {
124 .family
= NFPROTO_UNSPEC
,
125 .checkentry
= connmark_tg_check
,
126 .target
= connmark_tg
,
127 .targetsize
= sizeof(struct xt_connmark_tginfo1
),
128 .destroy
= connmark_tg_destroy
,
132 static struct xt_match connmark_mt_reg __read_mostly
= {
135 .family
= NFPROTO_UNSPEC
,
136 .checkentry
= connmark_mt_check
,
137 .match
= connmark_mt
,
138 .matchsize
= sizeof(struct xt_connmark_mtinfo1
),
139 .destroy
= connmark_mt_destroy
,
143 static int __init
connmark_mt_init(void)
147 ret
= xt_register_target(&connmark_tg_reg
);
150 ret
= xt_register_match(&connmark_mt_reg
);
152 xt_unregister_target(&connmark_tg_reg
);
158 static void __exit
connmark_mt_exit(void)
160 xt_unregister_match(&connmark_mt_reg
);
161 xt_unregister_target(&connmark_tg_reg
);
164 module_init(connmark_mt_init
);
165 module_exit(connmark_mt_exit
);