~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/xt_connmark.c

Version: ~ [ linux-5.19-rc8 ] ~ [ linux-5.18.14 ] ~ [ linux-5.17.15 ] ~ [ linux-5.16.20 ] ~ [ linux-5.15.57 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.133 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.207 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.253 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.289 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.324 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.302 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.9 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0-or-later
  2 /*
  3  *      xt_connmark - Netfilter module to operate on connection marks
  4  *
  5  *      Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
  6  *      by Henrik Nordstrom <hno@marasystems.com>
  7  *      Copyright © CC Computer Consultants GmbH, 2007 - 2008
  8  *      Jan Engelhardt <jengelh@medozas.de>
  9  */
 10 
 11 #include <linux/module.h>
 12 #include <linux/skbuff.h>
 13 #include <net/netfilter/nf_conntrack.h>
 14 #include <net/netfilter/nf_conntrack_ecache.h>
 15 #include <linux/netfilter/x_tables.h>
 16 #include <linux/netfilter/xt_connmark.h>
 17 
 18 MODULE_AUTHOR("Henrik Nordstrom <hno@marasystems.com>");
 19 MODULE_DESCRIPTION("Xtables: connection mark operations");
 20 MODULE_LICENSE("GPL");
 21 MODULE_ALIAS("ipt_CONNMARK");
 22 MODULE_ALIAS("ip6t_CONNMARK");
 23 MODULE_ALIAS("ipt_connmark");
 24 MODULE_ALIAS("ip6t_connmark");
 25 
 26 static unsigned int
 27 connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info)
 28 {
 29         enum ip_conntrack_info ctinfo;
 30         u_int32_t new_targetmark;
 31         struct nf_conn *ct;
 32         u_int32_t newmark;
 33 
 34         ct = nf_ct_get(skb, &ctinfo);
 35         if (ct == NULL)
 36                 return XT_CONTINUE;
 37 
 38         switch (info->mode) {
 39         case XT_CONNMARK_SET:
 40                 newmark = (ct->mark & ~info->ctmask) ^ info->ctmark;
 41                 if (info->shift_dir == D_SHIFT_RIGHT)
 42                         newmark >>= info->shift_bits;
 43                 else
 44                         newmark <<= info->shift_bits;
 45 
 46                 if (ct->mark != newmark) {
 47                         ct->mark = newmark;
 48                         nf_conntrack_event_cache(IPCT_MARK, ct);
 49                 }
 50                 break;
 51         case XT_CONNMARK_SAVE:
 52                 new_targetmark = (skb->mark & info->nfmask);
 53                 if (info->shift_dir == D_SHIFT_RIGHT)
 54                         new_targetmark >>= info->shift_bits;
 55                 else
 56                         new_targetmark <<= info->shift_bits;
 57 
 58                 newmark = (ct->mark & ~info->ctmask) ^
 59                           new_targetmark;
 60                 if (ct->mark != newmark) {
 61                         ct->mark = newmark;
 62                         nf_conntrack_event_cache(IPCT_MARK, ct);
 63                 }
 64                 break;
 65         case XT_CONNMARK_RESTORE:
 66                 new_targetmark = (ct->mark & info->ctmask);
 67                 if (info->shift_dir == D_SHIFT_RIGHT)
 68                         new_targetmark >>= info->shift_bits;
 69                 else
 70                         new_targetmark <<= info->shift_bits;
 71 
 72                 newmark = (skb->mark & ~info->nfmask) ^
 73                           new_targetmark;
 74                 skb->mark = newmark;
 75                 break;
 76         }
 77         return XT_CONTINUE;
 78 }
 79 
 80 static unsigned int
 81 connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
 82 {
 83         const struct xt_connmark_tginfo1 *info = par->targinfo;
 84         const struct xt_connmark_tginfo2 info2 = {
 85                 .ctmark = info->ctmark,
 86                 .ctmask = info->ctmask,
 87                 .nfmask = info->nfmask,
 88                 .mode   = info->mode,
 89         };
 90 
 91         return connmark_tg_shift(skb, &info2);
 92 }
 93 
 94 static unsigned int
 95 connmark_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
 96 {
 97         const struct xt_connmark_tginfo2 *info = par->targinfo;
 98 
 99         return connmark_tg_shift(skb, info);
100 }
101 
102 static int connmark_tg_check(const struct xt_tgchk_param *par)
103 {
104         int ret;
105 
106         ret = nf_ct_netns_get(par->net, par->family);
107         if (ret < 0)
108                 pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
109                                     par->family);
110         return ret;
111 }
112 
113 static void connmark_tg_destroy(const struct xt_tgdtor_param *par)
114 {
115         nf_ct_netns_put(par->net, par->family);
116 }
117 
118 static bool
119 connmark_mt(const struct sk_buff *skb, struct xt_action_param *par)
120 {
121         const struct xt_connmark_mtinfo1 *info = par->matchinfo;
122         enum ip_conntrack_info ctinfo;
123         const struct nf_conn *ct;
124 
125         ct = nf_ct_get(skb, &ctinfo);
126         if (ct == NULL)
127                 return false;
128 
129         return ((ct->mark & info->mask) == info->mark) ^ info->invert;
130 }
131 
132 static int connmark_mt_check(const struct xt_mtchk_param *par)
133 {
134         int ret;
135 
136         ret = nf_ct_netns_get(par->net, par->family);
137         if (ret < 0)
138                 pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
139                                     par->family);
140         return ret;
141 }
142 
143 static void connmark_mt_destroy(const struct xt_mtdtor_param *par)
144 {
145         nf_ct_netns_put(par->net, par->family);
146 }
147 
148 static struct xt_target connmark_tg_reg[] __read_mostly = {
149         {
150                 .name           = "CONNMARK",
151                 .revision       = 1,
152                 .family         = NFPROTO_UNSPEC,
153                 .checkentry     = connmark_tg_check,
154                 .target         = connmark_tg,
155                 .targetsize     = sizeof(struct xt_connmark_tginfo1),
156                 .destroy        = connmark_tg_destroy,
157                 .me             = THIS_MODULE,
158         },
159         {
160                 .name           = "CONNMARK",
161                 .revision       = 2,
162                 .family         = NFPROTO_UNSPEC,
163                 .checkentry     = connmark_tg_check,
164                 .target         = connmark_tg_v2,
165                 .targetsize     = sizeof(struct xt_connmark_tginfo2),
166                 .destroy        = connmark_tg_destroy,
167                 .me             = THIS_MODULE,
168         }
169 };
170 
171 static struct xt_match connmark_mt_reg __read_mostly = {
172         .name           = "connmark",
173         .revision       = 1,
174         .family         = NFPROTO_UNSPEC,
175         .checkentry     = connmark_mt_check,
176         .match          = connmark_mt,
177         .matchsize      = sizeof(struct xt_connmark_mtinfo1),
178         .destroy        = connmark_mt_destroy,
179         .me             = THIS_MODULE,
180 };
181 
182 static int __init connmark_mt_init(void)
183 {
184         int ret;
185 
186         ret = xt_register_targets(connmark_tg_reg,
187                                   ARRAY_SIZE(connmark_tg_reg));
188         if (ret < 0)
189                 return ret;
190         ret = xt_register_match(&connmark_mt_reg);
191         if (ret < 0) {
192                 xt_unregister_targets(connmark_tg_reg,
193                                       ARRAY_SIZE(connmark_tg_reg));
194                 return ret;
195         }
196         return 0;
197 }
198 
199 static void __exit connmark_mt_exit(void)
200 {
201         xt_unregister_match(&connmark_mt_reg);
202         xt_unregister_targets(connmark_tg_reg, ARRAY_SIZE(connmark_tg_reg));
203 }
204 
205 module_init(connmark_mt_init);
206 module_exit(connmark_mt_exit);
207 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp