~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/xt_connlabel.c

Version: ~ [ linux-5.16-rc3 ] ~ [ linux-5.15.5 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.82 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.162 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.218 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.256 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.291 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.293 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * (C) 2013 Astaro GmbH & Co KG
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  */
  8 
  9 #include <linux/module.h>
 10 #include <linux/skbuff.h>
 11 #include <net/netfilter/nf_conntrack.h>
 12 #include <net/netfilter/nf_conntrack_labels.h>
 13 #include <linux/netfilter/x_tables.h>
 14 
 15 MODULE_LICENSE("GPL");
 16 MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
 17 MODULE_DESCRIPTION("Xtables: add/match connection trackling labels");
 18 MODULE_ALIAS("ipt_connlabel");
 19 MODULE_ALIAS("ip6t_connlabel");
 20 
 21 static bool
 22 connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par)
 23 {
 24         const struct xt_connlabel_mtinfo *info = par->matchinfo;
 25         enum ip_conntrack_info ctinfo;
 26         struct nf_conn *ct;
 27         bool invert = info->options & XT_CONNLABEL_OP_INVERT;
 28 
 29         ct = nf_ct_get(skb, &ctinfo);
 30         if (ct == NULL || nf_ct_is_untracked(ct))
 31                 return invert;
 32 
 33         if (info->options & XT_CONNLABEL_OP_SET)
 34                 return (nf_connlabel_set(ct, info->bit) == 0) ^ invert;
 35 
 36         return nf_connlabel_match(ct, info->bit) ^ invert;
 37 }
 38 
 39 static int connlabel_mt_check(const struct xt_mtchk_param *par)
 40 {
 41         const int options = XT_CONNLABEL_OP_INVERT |
 42                             XT_CONNLABEL_OP_SET;
 43         struct xt_connlabel_mtinfo *info = par->matchinfo;
 44         int ret;
 45         size_t words;
 46 
 47         if (info->bit > XT_CONNLABEL_MAXBIT)
 48                 return -ERANGE;
 49 
 50         if (info->options & ~options) {
 51                 pr_err("Unknown options in mask %x\n", info->options);
 52                 return -EINVAL;
 53         }
 54 
 55         ret = nf_ct_l3proto_try_module_get(par->family);
 56         if (ret < 0) {
 57                 pr_info("cannot load conntrack support for proto=%u\n",
 58                                                         par->family);
 59                 return ret;
 60         }
 61 
 62         par->net->ct.labels_used++;
 63         words = BITS_TO_LONGS(info->bit+1);
 64         if (words > par->net->ct.label_words)
 65                 par->net->ct.label_words = words;
 66 
 67         return ret;
 68 }
 69 
 70 static void connlabel_mt_destroy(const struct xt_mtdtor_param *par)
 71 {
 72         par->net->ct.labels_used--;
 73         if (par->net->ct.labels_used == 0)
 74                 par->net->ct.label_words = 0;
 75         nf_ct_l3proto_module_put(par->family);
 76 }
 77 
 78 static struct xt_match connlabels_mt_reg __read_mostly = {
 79         .name           = "connlabel",
 80         .family         = NFPROTO_UNSPEC,
 81         .checkentry     = connlabel_mt_check,
 82         .match          = connlabel_mt,
 83         .matchsize      = sizeof(struct xt_connlabel_mtinfo),
 84         .destroy        = connlabel_mt_destroy,
 85         .me             = THIS_MODULE,
 86 };
 87 
 88 static int __init connlabel_mt_init(void)
 89 {
 90         return xt_register_match(&connlabels_mt_reg);
 91 }
 92 
 93 static void __exit connlabel_mt_exit(void)
 94 {
 95         xt_unregister_match(&connlabels_mt_reg);
 96 }
 97 
 98 module_init(connlabel_mt_init);
 99 module_exit(connlabel_mt_exit);
100 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp