Pull style into test branch
[linux-2.6] / net / netfilter / xt_helper.c
1 /* iptables module to match on related connections */
2 /*
3  * (C) 2001 Martin Josefsson <gandalf@wlug.westbo.se>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License version 2 as
7  * published by the Free Software Foundation.
8  *
9  *   19 Mar 2002 Harald Welte <laforge@gnumonks.org>:
10  *               - Port to newnat infrastructure
11  */
12
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
15 #include <linux/netfilter.h>
16 #if defined(CONFIG_IP_NF_CONNTRACK) || defined(CONFIG_IP_NF_CONNTRACK_MODULE)
17 #include <linux/netfilter_ipv4/ip_conntrack.h>
18 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
19 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
20 #else
21 #include <net/netfilter/nf_conntrack.h>
22 #include <net/netfilter/nf_conntrack_core.h>
23 #include <net/netfilter/nf_conntrack_helper.h>
24 #endif
25 #include <linux/netfilter/x_tables.h>
26 #include <linux/netfilter/xt_helper.h>
27 #include <net/netfilter/nf_conntrack_compat.h>
28
29 MODULE_LICENSE("GPL");
30 MODULE_AUTHOR("Martin Josefsson <gandalf@netfilter.org>");
31 MODULE_DESCRIPTION("iptables helper match module");
32 MODULE_ALIAS("ipt_helper");
33 MODULE_ALIAS("ip6t_helper");
34
35 #if 0
36 #define DEBUGP printk
37 #else
38 #define DEBUGP(format, args...)
39 #endif
40
41 #if defined(CONFIG_IP_NF_CONNTRACK) || defined(CONFIG_IP_NF_CONNTRACK_MODULE)
42 static int
43 match(const struct sk_buff *skb,
44       const struct net_device *in,
45       const struct net_device *out,
46       const struct xt_match *match,
47       const void *matchinfo,
48       int offset,
49       unsigned int protoff,
50       int *hotdrop)
51 {
52         const struct xt_helper_info *info = matchinfo;
53         struct ip_conntrack *ct;
54         enum ip_conntrack_info ctinfo;
55         int ret = info->invert;
56         
57         ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
58         if (!ct) {
59                 DEBUGP("xt_helper: Eek! invalid conntrack?\n");
60                 return ret;
61         }
62
63         if (!ct->master) {
64                 DEBUGP("xt_helper: conntrack %p has no master\n", ct);
65                 return ret;
66         }
67
68         read_lock_bh(&ip_conntrack_lock);
69         if (!ct->master->helper) {
70                 DEBUGP("xt_helper: master ct %p has no helper\n", 
71                         exp->expectant);
72                 goto out_unlock;
73         }
74
75         DEBUGP("master's name = %s , info->name = %s\n", 
76                 ct->master->helper->name, info->name);
77
78         if (info->name[0] == '\0')
79                 ret ^= 1;
80         else
81                 ret ^= !strncmp(ct->master->helper->name, info->name, 
82                                 strlen(ct->master->helper->name));
83 out_unlock:
84         read_unlock_bh(&ip_conntrack_lock);
85         return ret;
86 }
87
88 #else /* CONFIG_IP_NF_CONNTRACK */
89
90 static int
91 match(const struct sk_buff *skb,
92       const struct net_device *in,
93       const struct net_device *out,
94       const struct xt_match *match,
95       const void *matchinfo,
96       int offset,
97       unsigned int protoff,
98       int *hotdrop)
99 {
100         const struct xt_helper_info *info = matchinfo;
101         struct nf_conn *ct;
102         struct nf_conn_help *master_help;
103         enum ip_conntrack_info ctinfo;
104         int ret = info->invert;
105         
106         ct = nf_ct_get((struct sk_buff *)skb, &ctinfo);
107         if (!ct) {
108                 DEBUGP("xt_helper: Eek! invalid conntrack?\n");
109                 return ret;
110         }
111
112         if (!ct->master) {
113                 DEBUGP("xt_helper: conntrack %p has no master\n", ct);
114                 return ret;
115         }
116
117         read_lock_bh(&nf_conntrack_lock);
118         master_help = nfct_help(ct->master);
119         if (!master_help || !master_help->helper) {
120                 DEBUGP("xt_helper: master ct %p has no helper\n", 
121                         exp->expectant);
122                 goto out_unlock;
123         }
124
125         DEBUGP("master's name = %s , info->name = %s\n", 
126                 ct->master->helper->name, info->name);
127
128         if (info->name[0] == '\0')
129                 ret ^= 1;
130         else
131                 ret ^= !strncmp(master_help->helper->name, info->name,
132                                 strlen(master_help->helper->name));
133 out_unlock:
134         read_unlock_bh(&nf_conntrack_lock);
135         return ret;
136 }
137 #endif
138
139 static int check(const char *tablename,
140                  const void *inf,
141                  const struct xt_match *match,
142                  void *matchinfo,
143                  unsigned int hook_mask)
144 {
145         struct xt_helper_info *info = matchinfo;
146
147         if (nf_ct_l3proto_try_module_get(match->family) < 0) {
148                 printk(KERN_WARNING "can't load conntrack support for "
149                                     "proto=%d\n", match->family);
150                 return 0;
151         }
152         info->name[29] = '\0';
153         return 1;
154 }
155
156 static void
157 destroy(const struct xt_match *match, void *matchinfo)
158 {
159         nf_ct_l3proto_module_put(match->family);
160 }
161
162 static struct xt_match xt_helper_match[] = {
163         {
164                 .name           = "helper",
165                 .family         = AF_INET,
166                 .checkentry     = check,
167                 .match          = match,
168                 .destroy        = destroy,
169                 .matchsize      = sizeof(struct xt_helper_info),
170                 .me             = THIS_MODULE,
171         },
172         {
173                 .name           = "helper",
174                 .family         = AF_INET6,
175                 .checkentry     = check,
176                 .match          = match,
177                 .destroy        = destroy,
178                 .matchsize      = sizeof(struct xt_helper_info),
179                 .me             = THIS_MODULE,
180         },
181 };
182
183 static int __init xt_helper_init(void)
184 {
185         return xt_register_matches(xt_helper_match,
186                                    ARRAY_SIZE(xt_helper_match));
187 }
188
189 static void __exit xt_helper_fini(void)
190 {
191         xt_unregister_matches(xt_helper_match, ARRAY_SIZE(xt_helper_match));
192 }
193
194 module_init(xt_helper_init);
195 module_exit(xt_helper_fini);
196