[NETFILTER]: xt_policy: remove dups in .family
[linux-2.6.git] / net / netfilter / xt_helper.c
1 /* iptables module to match on related connections */
2 /*
3  * (C) 2001 Martin Josefsson <gandalf@wlug.westbo.se>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License version 2 as
7  * published by the Free Software Foundation.
8  *
9  *   19 Mar 2002 Harald Welte <laforge@gnumonks.org>:
10  *               - Port to newnat infrastructure
11  */
12
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
15 #include <linux/netfilter.h>
16 #if defined(CONFIG_IP_NF_CONNTRACK) || defined(CONFIG_IP_NF_CONNTRACK_MODULE)
17 #include <linux/netfilter_ipv4/ip_conntrack.h>
18 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
19 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
20 #else
21 #include <net/netfilter/nf_conntrack.h>
22 #include <net/netfilter/nf_conntrack_core.h>
23 #include <net/netfilter/nf_conntrack_helper.h>
24 #endif
25 #include <linux/netfilter/x_tables.h>
26 #include <linux/netfilter/xt_helper.h>
27
28 MODULE_LICENSE("GPL");
29 MODULE_AUTHOR("Martin Josefsson <gandalf@netfilter.org>");
30 MODULE_DESCRIPTION("iptables helper match module");
31 MODULE_ALIAS("ipt_helper");
32 MODULE_ALIAS("ip6t_helper");
33
34 #if 0
35 #define DEBUGP printk
36 #else
37 #define DEBUGP(format, args...)
38 #endif
39
40 #if defined(CONFIG_IP_NF_CONNTRACK) || defined(CONFIG_IP_NF_CONNTRACK_MODULE)
41 static int
42 match(const struct sk_buff *skb,
43       const struct net_device *in,
44       const struct net_device *out,
45       const struct xt_match *match,
46       const void *matchinfo,
47       int offset,
48       unsigned int protoff,
49       int *hotdrop)
50 {
51         const struct xt_helper_info *info = matchinfo;
52         struct ip_conntrack *ct;
53         enum ip_conntrack_info ctinfo;
54         int ret = info->invert;
55         
56         ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
57         if (!ct) {
58                 DEBUGP("xt_helper: Eek! invalid conntrack?\n");
59                 return ret;
60         }
61
62         if (!ct->master) {
63                 DEBUGP("xt_helper: conntrack %p has no master\n", ct);
64                 return ret;
65         }
66
67         read_lock_bh(&ip_conntrack_lock);
68         if (!ct->master->helper) {
69                 DEBUGP("xt_helper: master ct %p has no helper\n", 
70                         exp->expectant);
71                 goto out_unlock;
72         }
73
74         DEBUGP("master's name = %s , info->name = %s\n", 
75                 ct->master->helper->name, info->name);
76
77         if (info->name[0] == '\0')
78                 ret ^= 1;
79         else
80                 ret ^= !strncmp(ct->master->helper->name, info->name, 
81                                 strlen(ct->master->helper->name));
82 out_unlock:
83         read_unlock_bh(&ip_conntrack_lock);
84         return ret;
85 }
86
87 #else /* CONFIG_IP_NF_CONNTRACK */
88
89 static int
90 match(const struct sk_buff *skb,
91       const struct net_device *in,
92       const struct net_device *out,
93       const struct xt_match *match,
94       const void *matchinfo,
95       int offset,
96       unsigned int protoff,
97       int *hotdrop)
98 {
99         const struct xt_helper_info *info = matchinfo;
100         struct nf_conn *ct;
101         struct nf_conn_help *master_help;
102         enum ip_conntrack_info ctinfo;
103         int ret = info->invert;
104         
105         ct = nf_ct_get((struct sk_buff *)skb, &ctinfo);
106         if (!ct) {
107                 DEBUGP("xt_helper: Eek! invalid conntrack?\n");
108                 return ret;
109         }
110
111         if (!ct->master) {
112                 DEBUGP("xt_helper: conntrack %p has no master\n", ct);
113                 return ret;
114         }
115
116         read_lock_bh(&nf_conntrack_lock);
117         master_help = nfct_help(ct->master);
118         if (!master_help || !master_help->helper) {
119                 DEBUGP("xt_helper: master ct %p has no helper\n", 
120                         exp->expectant);
121                 goto out_unlock;
122         }
123
124         DEBUGP("master's name = %s , info->name = %s\n", 
125                 ct->master->helper->name, info->name);
126
127         if (info->name[0] == '\0')
128                 ret ^= 1;
129         else
130                 ret ^= !strncmp(master_help->helper->name, info->name,
131                                 strlen(master_help->helper->name));
132 out_unlock:
133         read_unlock_bh(&nf_conntrack_lock);
134         return ret;
135 }
136 #endif
137
138 static int check(const char *tablename,
139                  const void *inf,
140                  const struct xt_match *match,
141                  void *matchinfo,
142                  unsigned int hook_mask)
143 {
144         struct xt_helper_info *info = matchinfo;
145
146 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
147         if (nf_ct_l3proto_try_module_get(match->family) < 0) {
148                 printk(KERN_WARNING "can't load nf_conntrack support for "
149                                     "proto=%d\n", match->family);
150                 return 0;
151         }
152 #endif
153         info->name[29] = '\0';
154         return 1;
155 }
156
157 static void
158 destroy(const struct xt_match *match, void *matchinfo)
159 {
160 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
161         nf_ct_l3proto_module_put(match->family);
162 #endif
163 }
164
165 static struct xt_match xt_helper_match[] = {
166         {
167                 .name           = "helper",
168                 .family         = AF_INET,
169                 .checkentry     = check,
170                 .match          = match,
171                 .destroy        = destroy,
172                 .matchsize      = sizeof(struct xt_helper_info),
173                 .me             = THIS_MODULE,
174         },
175         {
176                 .name           = "helper",
177                 .family         = AF_INET6,
178                 .checkentry     = check,
179                 .match          = match,
180                 .destroy        = destroy,
181                 .matchsize      = sizeof(struct xt_helper_info),
182                 .me             = THIS_MODULE,
183         },
184 };
185
186 static int __init xt_helper_init(void)
187 {
188         need_conntrack();
189         return xt_register_matches(xt_helper_match,
190                                    ARRAY_SIZE(xt_helper_match));
191 }
192
193 static void __exit xt_helper_fini(void)
194 {
195         xt_unregister_matches(xt_helper_match, ARRAY_SIZE(xt_helper_match));
196 }
197
198 module_init(xt_helper_init);
199 module_exit(xt_helper_fini);
200