release/src/linux/linux/net/ipv4/netfilter/ipt_helper.c

   1 /*
   2  * iptables module to match on related connections
   3  *   (c) 2001 Martin Josefsson <gandalf@wlug.westbo.se>
   4  *
   5  * Released under the terms of GNU GPLv2.
   6  *
   7  *   19 Mar 2002 Harald Welte <laforge@gnumonks.org>:
   8  *               - Port to newnat infrastructure
   9  */
  10 #include <linux/module.h>
  11 #include <linux/skbuff.h>
  12 #include <linux/netfilter_ipv4/ip_conntrack.h>
  13 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
  14 #include <linux/netfilter_ipv4/ip_tables.h>
  15 #include <linux/netfilter_ipv4/ipt_helper.h>
  16
  17 MODULE_LICENSE("GPL");
  18
  19 #define DEBUGP(format, args...)
  20
  21 static int
  22 match(const struct sk_buff *skb,
  23       const struct net_device *in,
  24       const struct net_device *out,
  25       const void *matchinfo,
  26       int offset,
  27       const void *hdr,
  28       u_int16_t datalen,
  29       int *hotdrop)
  30 {
  31         const struct ipt_helper_info *info = matchinfo;
  32         struct ip_conntrack_expect *exp;
  33         struct ip_conntrack *ct;
  34         enum ip_conntrack_info ctinfo;
  35
  36         ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
  37         if (!ct) {
  38                 DEBUGP("ipt_helper: Eek! invalid conntrack?\n");
  39                 return 0;
  40         }
  41
  42         if (!ct->master) {
  43                 DEBUGP("ipt_helper: conntrack %p has no master\n", ct);
  44                 return 0;
  45         }
  46
  47         exp = ct->master;
  48         if (!exp->expectant) {
  49                 DEBUGP("ipt_helper: expectation %p without expectant !?!\n",
  50                         exp);
  51                 return 0;
  52         }
  53
  54         if (!exp->expectant->helper) {
  55                 DEBUGP("ipt_helper: master ct %p has no helper\n",
  56                         exp->expectant);
  57                 return 0;
  58         }
  59
  60         DEBUGP("master's name = %s , info->name = %s\n",
  61                 exp->expectant->helper->name, info->name);
  62
  63         return !strncmp(exp->expectant->helper->name, info->name,
  64                         strlen(exp->expectant->helper->name)) ^ info->invert;
  65 }
  66
  67 static int check(const char *tablename,
  68                  const struct ipt_ip *ip,
  69                  void *matchinfo,
  70                  unsigned int matchsize,
  71                  unsigned int hook_mask)
  72 {
  73         struct ipt_helper_info *info = matchinfo;
  74
  75         info->name[29] = '\0';
  76
  77         /* verify size */
  78         if (matchsize != IPT_ALIGN(sizeof(struct ipt_helper_info)))
  79                 return 0;
  80
  81         /* verify that we actually should match anything */
  82         if ( strlen(info->name) == 0 )
  83                 return 0;
  84
  85         return 1;
  86 }
  87
  88 static struct ipt_match helper_match
  89 = { { NULL, NULL }, "helper", &match, &check, NULL, THIS_MODULE };
  90
  91 static int __init init(void)
  92 {
  93         /* NULL if ip_conntrack not a module */
  94         if (ip_conntrack_module)
  95                 __MOD_INC_USE_COUNT(ip_conntrack_module);
  96         return ipt_register_match(&helper_match);
  97 }
  98
  99 static void __exit fini(void)
 100 {
 101         ipt_unregister_match(&helper_match);
 102         if (ip_conntrack_module)
 103                 __MOD_DEC_USE_COUNT(ip_conntrack_module);
 104 }
 105
 106 module_init(init);
 107 module_exit(fini);
 108