cc41c84b7e
resurrect an old patch from Pablo Neira to remove the untracked objects. Currently, there are four possible states of an skb wrt. conntrack. 1. No conntrack attached, ct is NULL. 2. Normal (kmem cache allocated) ct attached. 3. a template (kmalloc'd), not in any hash tables at any point in time 4. the 'untracked' conntrack, a percpu nf_conn object, tagged via IPS_UNTRACKED_BIT in ct->status. Untracked is supposed to be identical to case 1. It exists only so users can check -m conntrack --ctstate UNTRACKED vs. -m conntrack --ctstate INVALID e.g. attempts to set connmark on INVALID or UNTRACKED conntracks is supposed to be a no-op. Thus currently we need to check ct == NULL || nf_ct_is_untracked(ct) in a lot of places in order to avoid altering untracked objects. The other consequence of the percpu untracked object is that all -j NOTRACK (and, later, kfree_skb of such skbs) result in an atomic op (inc/dec the untracked conntracks refcount). This adds a new kernel-private ctinfo state, IP_CT_UNTRACKED, to make the distinction instead. The (few) places that care about packet invalid (ct is NULL) vs. packet untracked now need to test ct == NULL vs. ctinfo == IP_CT_UNTRACKED, but all other places can omit the nf_ct_is_untracked() check. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
79 lines
2 KiB
C
79 lines
2 KiB
C
/* Kernel module to match connection tracking information. */
|
|
|
|
/* (C) 1999-2001 Paul `Rusty' Russell
|
|
* (C) 2002-2005 Netfilter Core Team <coreteam@netfilter.org>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/skbuff.h>
|
|
#include <net/netfilter/nf_conntrack.h>
|
|
#include <linux/netfilter/x_tables.h>
|
|
#include <linux/netfilter/xt_state.h>
|
|
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
|
|
MODULE_DESCRIPTION("ip[6]_tables connection tracking state match module");
|
|
MODULE_ALIAS("ipt_state");
|
|
MODULE_ALIAS("ip6t_state");
|
|
|
|
static bool
|
|
state_mt(const struct sk_buff *skb, struct xt_action_param *par)
|
|
{
|
|
const struct xt_state_info *sinfo = par->matchinfo;
|
|
enum ip_conntrack_info ctinfo;
|
|
unsigned int statebit;
|
|
struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
|
|
|
|
if (ct)
|
|
statebit = XT_STATE_BIT(ctinfo);
|
|
else if (ctinfo == IP_CT_UNTRACKED)
|
|
statebit = XT_STATE_UNTRACKED;
|
|
else
|
|
statebit = XT_STATE_INVALID;
|
|
|
|
return (sinfo->statemask & statebit);
|
|
}
|
|
|
|
static int state_mt_check(const struct xt_mtchk_param *par)
|
|
{
|
|
int ret;
|
|
|
|
ret = nf_ct_netns_get(par->net, par->family);
|
|
if (ret < 0)
|
|
pr_info("cannot load conntrack support for proto=%u\n",
|
|
par->family);
|
|
return ret;
|
|
}
|
|
|
|
static void state_mt_destroy(const struct xt_mtdtor_param *par)
|
|
{
|
|
nf_ct_netns_put(par->net, par->family);
|
|
}
|
|
|
|
static struct xt_match state_mt_reg __read_mostly = {
|
|
.name = "state",
|
|
.family = NFPROTO_UNSPEC,
|
|
.checkentry = state_mt_check,
|
|
.match = state_mt,
|
|
.destroy = state_mt_destroy,
|
|
.matchsize = sizeof(struct xt_state_info),
|
|
.me = THIS_MODULE,
|
|
};
|
|
|
|
static int __init state_mt_init(void)
|
|
{
|
|
return xt_register_match(&state_mt_reg);
|
|
}
|
|
|
|
static void __exit state_mt_exit(void)
|
|
{
|
|
xt_unregister_match(&state_mt_reg);
|
|
}
|
|
|
|
module_init(state_mt_init);
|
|
module_exit(state_mt_exit);
|