1 /* This kernel module is used to modify the connection mark values, or
2 * to optionally restore the skb nfmark from the connection mark
4 * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
5 * by Henrik Nordstrom <hno@marasystems.com>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 #include <linux/module.h>
22 #include <linux/skbuff.h>
24 #include <net/checksum.h>
26 MODULE_AUTHOR("Henrik Nordstrom <hno@marasytems.com>");
27 MODULE_DESCRIPTION("IP tables CONNMARK matching module");
28 MODULE_LICENSE("GPL");
29 MODULE_ALIAS("ipt_CONNMARK");
31 #include <linux/netfilter/x_tables.h>
32 #include <linux/netfilter/xt_CONNMARK.h>
33 #include <net/netfilter/nf_conntrack_ecache.h>
36 target(struct sk_buff
*skb
,
37 const struct net_device
*in
,
38 const struct net_device
*out
,
40 const struct xt_target
*target
,
43 const struct xt_connmark_target_info
*markinfo
= targinfo
;
45 enum ip_conntrack_info ctinfo
;
50 ct
= nf_ct_get(skb
, &ctinfo
);
52 switch(markinfo
->mode
) {
54 newmark
= (ct
->mark
& ~markinfo
->mask
) | markinfo
->mark
;
55 if (newmark
!= ct
->mark
) {
57 nf_conntrack_event_cache(IPCT_MARK
, skb
);
60 case XT_CONNMARK_SET_RETURN
:
61 // Set connmark and mark, apply mask to mark, do XT_RETURN - zzz
62 newmark
= ct
->mark
= markinfo
->mark
;
63 newmark
&= markinfo
->mask
;
65 if (newmark
!= mark
) {
69 case XT_CONNMARK_SAVE
:
70 newmark
= (ct
->mark
& ~markinfo
->mask
) |
71 (skb
->mark
& markinfo
->mask
);
72 if (ct
->mark
!= newmark
) {
74 nf_conntrack_event_cache(IPCT_MARK
, skb
);
77 case XT_CONNMARK_RESTORE
:
79 diff
= (ct
->mark
^ mark
) & markinfo
->mask
;
80 skb
->mark
= mark
^ diff
;
89 checkentry(const char *tablename
,
91 const struct xt_target
*target
,
93 unsigned int hook_mask
)
95 struct xt_connmark_target_info
*matchinfo
= targinfo
;
97 if (nf_ct_l3proto_try_module_get(target
->family
) < 0) {
98 printk(KERN_WARNING
"can't load conntrack support for "
99 "proto=%d\n", target
->family
);
102 if (matchinfo
->mode
== XT_CONNMARK_RESTORE
) {
103 if (strcmp(tablename
, "mangle") != 0) {
104 printk(KERN_WARNING
"CONNMARK: restore can only be "
105 "called from \"mangle\" table, not \"%s\"\n",
110 if (matchinfo
->mark
> 0xffffffff || matchinfo
->mask
> 0xffffffff) {
111 printk(KERN_WARNING
"CONNMARK: Only supports 32bit mark\n");
118 destroy(const struct xt_target
*target
, void *targinfo
)
120 nf_ct_l3proto_module_put(target
->family
);
124 struct compat_xt_connmark_target_info
{
125 compat_ulong_t mark
, mask
;
131 static void compat_from_user(void *dst
, void *src
)
133 struct compat_xt_connmark_target_info
*cm
= src
;
134 struct xt_connmark_target_info m
= {
139 memcpy(dst
, &m
, sizeof(m
));
142 static int compat_to_user(void __user
*dst
, void *src
)
144 struct xt_connmark_target_info
*m
= src
;
145 struct compat_xt_connmark_target_info cm
= {
150 return copy_to_user(dst
, &cm
, sizeof(cm
)) ? -EFAULT
: 0;
152 #endif /* CONFIG_COMPAT */
154 static struct xt_target xt_connmark_target
[] = {
158 .checkentry
= checkentry
,
161 .targetsize
= sizeof(struct xt_connmark_target_info
),
163 .compatsize
= sizeof(struct compat_xt_connmark_target_info
),
164 .compat_from_user
= compat_from_user
,
165 .compat_to_user
= compat_to_user
,
172 .checkentry
= checkentry
,
175 .targetsize
= sizeof(struct xt_connmark_target_info
),
180 static int __init
xt_connmark_init(void)
182 return xt_register_targets(xt_connmark_target
,
183 ARRAY_SIZE(xt_connmark_target
));
186 static void __exit
xt_connmark_fini(void)
188 xt_unregister_targets(xt_connmark_target
,
189 ARRAY_SIZE(xt_connmark_target
));
192 module_init(xt_connmark_init
);
193 module_exit(xt_connmark_fini
);