Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 14abfa161d256c60f3ea6ba494704ac634b94f63

Authored by Eric Leblond
Committed by Pablo Neira Ayuso
1 parent dcd93ed4cd
Exists in smarc-imx_3.14.28_1.0.0_ga and in 1 other branch imx_3.14.28_1.0.0_ga

netfilter: xt_CT: fix error value in xt_ct_tg_check() 

If setting event mask fails then we were returning 0 for success.
This patch updates return code to -EINVAL in case of problem.

Signed-off-by: Eric Leblond <eric@regit.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Showing 1 changed file with 3 additions and 1 deletions Inline Diff

net/netfilter/xt_CT.c
Diff comments   View file @ 14abfa1
1 /* 1 /*
2 * Copyright (c) 2010 Patrick McHardy <kaber@trash.net> 2 * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
3 * 3 *
4 * This program is free software; you can redistribute it and/or modify 4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as 5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation. 6 * published by the Free Software Foundation.
7 */ 7 */
8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9 #include <linux/module.h> 9 #include <linux/module.h>
10 #include <linux/gfp.h> 10 #include <linux/gfp.h>
11 #include <linux/skbuff.h> 11 #include <linux/skbuff.h>
12 #include <linux/netfilter_ipv4/ip_tables.h> 12 #include <linux/netfilter_ipv4/ip_tables.h>
13 #include <linux/netfilter_ipv6/ip6_tables.h> 13 #include <linux/netfilter_ipv6/ip6_tables.h>
14 #include <linux/netfilter/x_tables.h> 14 #include <linux/netfilter/x_tables.h>
15 #include <linux/netfilter/xt_CT.h> 15 #include <linux/netfilter/xt_CT.h>
16 #include <net/netfilter/nf_conntrack.h> 16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_l4proto.h> 17 #include <net/netfilter/nf_conntrack_l4proto.h>
18 #include <net/netfilter/nf_conntrack_helper.h> 18 #include <net/netfilter/nf_conntrack_helper.h>
19 #include <net/netfilter/nf_conntrack_ecache.h> 19 #include <net/netfilter/nf_conntrack_ecache.h>
20 #include <net/netfilter/nf_conntrack_timeout.h> 20 #include <net/netfilter/nf_conntrack_timeout.h>
21 #include <net/netfilter/nf_conntrack_zones.h> 21 #include <net/netfilter/nf_conntrack_zones.h>
22 22
23 static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct) 23 static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
24 { 24 {
25 /* Previously seen (loopback)? Ignore. */ 25 /* Previously seen (loopback)? Ignore. */
26 if (skb->nfct != NULL) 26 if (skb->nfct != NULL)
27 return XT_CONTINUE; 27 return XT_CONTINUE;
28 28
29 /* special case the untracked ct : we want the percpu object */ 29 /* special case the untracked ct : we want the percpu object */
30 if (!ct) 30 if (!ct)
31 ct = nf_ct_untracked_get(); 31 ct = nf_ct_untracked_get();
32 atomic_inc(&ct->ct_general.use); 32 atomic_inc(&ct->ct_general.use);
33 skb->nfct = &ct->ct_general; 33 skb->nfct = &ct->ct_general;
34 skb->nfctinfo = IP_CT_NEW; 34 skb->nfctinfo = IP_CT_NEW;
35 35
36 return XT_CONTINUE; 36 return XT_CONTINUE;
37 } 37 }
38 38
39 static unsigned int xt_ct_target_v0(struct sk_buff *skb, 39 static unsigned int xt_ct_target_v0(struct sk_buff *skb,
40 const struct xt_action_param *par) 40 const struct xt_action_param *par)
41 { 41 {
42 const struct xt_ct_target_info *info = par->targinfo; 42 const struct xt_ct_target_info *info = par->targinfo;
43 struct nf_conn *ct = info->ct; 43 struct nf_conn *ct = info->ct;
44 44
45 return xt_ct_target(skb, ct); 45 return xt_ct_target(skb, ct);
46 } 46 }
47 47
48 static unsigned int xt_ct_target_v1(struct sk_buff *skb, 48 static unsigned int xt_ct_target_v1(struct sk_buff *skb,
49 const struct xt_action_param *par) 49 const struct xt_action_param *par)
50 { 50 {
51 const struct xt_ct_target_info_v1 *info = par->targinfo; 51 const struct xt_ct_target_info_v1 *info = par->targinfo;
52 struct nf_conn *ct = info->ct; 52 struct nf_conn *ct = info->ct;
53 53
54 return xt_ct_target(skb, ct); 54 return xt_ct_target(skb, ct);
55 } 55 }
56 56
57 static u8 xt_ct_find_proto(const struct xt_tgchk_param *par) 57 static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
58 { 58 {
59 if (par->family == NFPROTO_IPV4) { 59 if (par->family == NFPROTO_IPV4) {
60 const struct ipt_entry *e = par->entryinfo; 60 const struct ipt_entry *e = par->entryinfo;
61 61
62 if (e->ip.invflags & IPT_INV_PROTO) 62 if (e->ip.invflags & IPT_INV_PROTO)
63 return 0; 63 return 0;
64 return e->ip.proto; 64 return e->ip.proto;
65 } else if (par->family == NFPROTO_IPV6) { 65 } else if (par->family == NFPROTO_IPV6) {
66 const struct ip6t_entry *e = par->entryinfo; 66 const struct ip6t_entry *e = par->entryinfo;
67 67
68 if (e->ipv6.invflags & IP6T_INV_PROTO) 68 if (e->ipv6.invflags & IP6T_INV_PROTO)
69 return 0; 69 return 0;
70 return e->ipv6.proto; 70 return e->ipv6.proto;
71 } else 71 } else
72 return 0; 72 return 0;
73 } 73 }
74 74
75 static int 75 static int
76 xt_ct_set_helper(struct nf_conn *ct, const char *helper_name, 76 xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
77 const struct xt_tgchk_param *par) 77 const struct xt_tgchk_param *par)
78 { 78 {
79 struct nf_conntrack_helper *helper; 79 struct nf_conntrack_helper *helper;
80 struct nf_conn_help *help; 80 struct nf_conn_help *help;
81 u8 proto; 81 u8 proto;
82 82
83 proto = xt_ct_find_proto(par); 83 proto = xt_ct_find_proto(par);
84 if (!proto) { 84 if (!proto) {
85 pr_info("You must specify a L4 protocol, and not use " 85 pr_info("You must specify a L4 protocol, and not use "
86 "inversions on it.\n"); 86 "inversions on it.\n");
87 return -ENOENT; 87 return -ENOENT;
88 } 88 }
89 89
90 helper = nf_conntrack_helper_try_module_get(helper_name, par->family, 90 helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
91 proto); 91 proto);
92 if (helper == NULL) { 92 if (helper == NULL) {
93 pr_info("No such helper \"%s\"\n", helper_name); 93 pr_info("No such helper \"%s\"\n", helper_name);
94 return -ENOENT; 94 return -ENOENT;
95 } 95 }
96 96
97 help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL); 97 help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
98 if (help == NULL) { 98 if (help == NULL) {
99 module_put(helper->me); 99 module_put(helper->me);
100 return -ENOMEM; 100 return -ENOMEM;
101 } 101 }
102 102
103 help->helper = helper; 103 help->helper = helper;
104 return 0; 104 return 0;
105 } 105 }
106 106
107 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 107 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
108 static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout) 108 static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
109 { 109 {
110 typeof(nf_ct_timeout_put_hook) timeout_put; 110 typeof(nf_ct_timeout_put_hook) timeout_put;
111 111
112 timeout_put = rcu_dereference(nf_ct_timeout_put_hook); 112 timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
113 if (timeout_put) 113 if (timeout_put)
114 timeout_put(timeout); 114 timeout_put(timeout);
115 } 115 }
116 #endif 116 #endif
117 117
118 static int 118 static int
119 xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par, 119 xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
120 const char *timeout_name) 120 const char *timeout_name)
121 { 121 {
122 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 122 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
123 typeof(nf_ct_timeout_find_get_hook) timeout_find_get; 123 typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
124 struct ctnl_timeout *timeout; 124 struct ctnl_timeout *timeout;
125 struct nf_conn_timeout *timeout_ext; 125 struct nf_conn_timeout *timeout_ext;
126 struct nf_conntrack_l4proto *l4proto; 126 struct nf_conntrack_l4proto *l4proto;
127 int ret = 0; 127 int ret = 0;
128 u8 proto; 128 u8 proto;
129 129
130 rcu_read_lock(); 130 rcu_read_lock();
131 timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook); 131 timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
132 if (timeout_find_get == NULL) { 132 if (timeout_find_get == NULL) {
133 ret = -ENOENT; 133 ret = -ENOENT;
134 pr_info("Timeout policy base is empty\n"); 134 pr_info("Timeout policy base is empty\n");
135 goto out; 135 goto out;
136 } 136 }
137 137
138 proto = xt_ct_find_proto(par); 138 proto = xt_ct_find_proto(par);
139 if (!proto) { 139 if (!proto) {
140 ret = -EINVAL; 140 ret = -EINVAL;
141 pr_info("You must specify a L4 protocol, and not use " 141 pr_info("You must specify a L4 protocol, and not use "
142 "inversions on it.\n"); 142 "inversions on it.\n");
143 goto out; 143 goto out;
144 } 144 }
145 145
146 timeout = timeout_find_get(timeout_name); 146 timeout = timeout_find_get(timeout_name);
147 if (timeout == NULL) { 147 if (timeout == NULL) {
148 ret = -ENOENT; 148 ret = -ENOENT;
149 pr_info("No such timeout policy \"%s\"\n", timeout_name); 149 pr_info("No such timeout policy \"%s\"\n", timeout_name);
150 goto out; 150 goto out;
151 } 151 }
152 152
153 if (timeout->l3num != par->family) { 153 if (timeout->l3num != par->family) {
154 ret = -EINVAL; 154 ret = -EINVAL;
155 pr_info("Timeout policy `%s' can only be used by L3 protocol " 155 pr_info("Timeout policy `%s' can only be used by L3 protocol "
156 "number %d\n", timeout_name, timeout->l3num); 156 "number %d\n", timeout_name, timeout->l3num);
157 goto err_put_timeout; 157 goto err_put_timeout;
158 } 158 }
159 /* Make sure the timeout policy matches any existing protocol tracker, 159 /* Make sure the timeout policy matches any existing protocol tracker,
160 * otherwise default to generic. 160 * otherwise default to generic.
161 */ 161 */
162 l4proto = __nf_ct_l4proto_find(par->family, proto); 162 l4proto = __nf_ct_l4proto_find(par->family, proto);
163 if (timeout->l4proto->l4proto != l4proto->l4proto) { 163 if (timeout->l4proto->l4proto != l4proto->l4proto) {
164 ret = -EINVAL; 164 ret = -EINVAL;
165 pr_info("Timeout policy `%s' can only be used by L4 protocol " 165 pr_info("Timeout policy `%s' can only be used by L4 protocol "
166 "number %d\n", 166 "number %d\n",
167 timeout_name, timeout->l4proto->l4proto); 167 timeout_name, timeout->l4proto->l4proto);
168 goto err_put_timeout; 168 goto err_put_timeout;
169 } 169 }
170 timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC); 170 timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
171 if (timeout_ext == NULL) 171 if (timeout_ext == NULL)
172 ret = -ENOMEM; 172 ret = -ENOMEM;
173 173
174 err_put_timeout: 174 err_put_timeout:
175 __xt_ct_tg_timeout_put(timeout); 175 __xt_ct_tg_timeout_put(timeout);
176 out: 176 out:
177 rcu_read_unlock(); 177 rcu_read_unlock();
178 return ret; 178 return ret;
179 #else 179 #else
180 return -EOPNOTSUPP; 180 return -EOPNOTSUPP;
181 #endif 181 #endif
182 } 182 }
183 183
184 static int xt_ct_tg_check(const struct xt_tgchk_param *par, 184 static int xt_ct_tg_check(const struct xt_tgchk_param *par,
185 struct xt_ct_target_info_v1 *info) 185 struct xt_ct_target_info_v1 *info)
186 { 186 {
187 struct nf_conntrack_tuple t; 187 struct nf_conntrack_tuple t;
188 struct nf_conn *ct; 188 struct nf_conn *ct;
189 int ret = -EOPNOTSUPP; 189 int ret = -EOPNOTSUPP;
190 190
191 if (info->flags & XT_CT_NOTRACK) { 191 if (info->flags & XT_CT_NOTRACK) {
192 ct = NULL; 192 ct = NULL;
193 goto out; 193 goto out;
194 } 194 }
195 195
196 #ifndef CONFIG_NF_CONNTRACK_ZONES 196 #ifndef CONFIG_NF_CONNTRACK_ZONES
197 if (info->zone) 197 if (info->zone)
198 goto err1; 198 goto err1;
199 #endif 199 #endif
200 200
201 ret = nf_ct_l3proto_try_module_get(par->family); 201 ret = nf_ct_l3proto_try_module_get(par->family);
202 if (ret < 0) 202 if (ret < 0)
203 goto err1; 203 goto err1;
204 204
205 memset(&t, 0, sizeof(t)); 205 memset(&t, 0, sizeof(t));
206 ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL); 206 ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
207 ret = PTR_ERR(ct); 207 ret = PTR_ERR(ct);
208 if (IS_ERR(ct)) 208 if (IS_ERR(ct))
209 goto err2; 209 goto err2;
210 210
211 ret = 0; 211 ret = 0;
212 if ((info->ct_events || info->exp_events) && 212 if ((info->ct_events || info->exp_events) &&
213 !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events, 213 !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
214 GFP_KERNEL)) 214 GFP_KERNEL)) {
215 ret = -EINVAL;
215 goto err3; 216 goto err3;
217 }
216 218
217 if (info->helper[0]) { 219 if (info->helper[0]) {
218 ret = xt_ct_set_helper(ct, info->helper, par); 220 ret = xt_ct_set_helper(ct, info->helper, par);
219 if (ret < 0) 221 if (ret < 0)
220 goto err3; 222 goto err3;
221 } 223 }
222 224
223 if (info->timeout[0]) { 225 if (info->timeout[0]) {
224 ret = xt_ct_set_timeout(ct, par, info->timeout); 226 ret = xt_ct_set_timeout(ct, par, info->timeout);
225 if (ret < 0) 227 if (ret < 0)
226 goto err3; 228 goto err3;
227 } 229 }
228 230
229 __set_bit(IPS_TEMPLATE_BIT, &ct->status); 231 __set_bit(IPS_TEMPLATE_BIT, &ct->status);
230 __set_bit(IPS_CONFIRMED_BIT, &ct->status); 232 __set_bit(IPS_CONFIRMED_BIT, &ct->status);
231 233
232 /* Overload tuple linked list to put us in template list. */ 234 /* Overload tuple linked list to put us in template list. */
233 hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode, 235 hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
234 &par->net->ct.tmpl); 236 &par->net->ct.tmpl);
235 out: 237 out:
236 info->ct = ct; 238 info->ct = ct;
237 return 0; 239 return 0;
238 240
239 err3: 241 err3:
240 nf_conntrack_free(ct); 242 nf_conntrack_free(ct);
241 err2: 243 err2:
242 nf_ct_l3proto_module_put(par->family); 244 nf_ct_l3proto_module_put(par->family);
243 err1: 245 err1:
244 return ret; 246 return ret;
245 } 247 }
246 248
247 static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par) 249 static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
248 { 250 {
249 struct xt_ct_target_info *info = par->targinfo; 251 struct xt_ct_target_info *info = par->targinfo;
250 struct xt_ct_target_info_v1 info_v1 = { 252 struct xt_ct_target_info_v1 info_v1 = {
251 .flags = info->flags, 253 .flags = info->flags,
252 .zone = info->zone, 254 .zone = info->zone,
253 .ct_events = info->ct_events, 255 .ct_events = info->ct_events,
254 .exp_events = info->exp_events, 256 .exp_events = info->exp_events,
255 }; 257 };
256 int ret; 258 int ret;
257 259
258 if (info->flags & ~XT_CT_NOTRACK) 260 if (info->flags & ~XT_CT_NOTRACK)
259 return -EINVAL; 261 return -EINVAL;
260 262
261 memcpy(info_v1.helper, info->helper, sizeof(info->helper)); 263 memcpy(info_v1.helper, info->helper, sizeof(info->helper));
262 264
263 ret = xt_ct_tg_check(par, &info_v1); 265 ret = xt_ct_tg_check(par, &info_v1);
264 if (ret < 0) 266 if (ret < 0)
265 return ret; 267 return ret;
266 268
267 info->ct = info_v1.ct; 269 info->ct = info_v1.ct;
268 270
269 return ret; 271 return ret;
270 } 272 }
271 273
272 static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par) 274 static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
273 { 275 {
274 struct xt_ct_target_info_v1 *info = par->targinfo; 276 struct xt_ct_target_info_v1 *info = par->targinfo;
275 277
276 if (info->flags & ~XT_CT_NOTRACK) 278 if (info->flags & ~XT_CT_NOTRACK)
277 return -EINVAL; 279 return -EINVAL;
278 280
279 return xt_ct_tg_check(par, par->targinfo); 281 return xt_ct_tg_check(par, par->targinfo);
280 } 282 }
281 283
282 static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par) 284 static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)
283 { 285 {
284 struct xt_ct_target_info_v1 *info = par->targinfo; 286 struct xt_ct_target_info_v1 *info = par->targinfo;
285 287
286 if (info->flags & ~XT_CT_MASK) 288 if (info->flags & ~XT_CT_MASK)
287 return -EINVAL; 289 return -EINVAL;
288 290
289 return xt_ct_tg_check(par, par->targinfo); 291 return xt_ct_tg_check(par, par->targinfo);
290 } 292 }
291 293
292 static void xt_ct_destroy_timeout(struct nf_conn *ct) 294 static void xt_ct_destroy_timeout(struct nf_conn *ct)
293 { 295 {
294 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 296 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
295 struct nf_conn_timeout *timeout_ext; 297 struct nf_conn_timeout *timeout_ext;
296 typeof(nf_ct_timeout_put_hook) timeout_put; 298 typeof(nf_ct_timeout_put_hook) timeout_put;
297 299
298 rcu_read_lock(); 300 rcu_read_lock();
299 timeout_put = rcu_dereference(nf_ct_timeout_put_hook); 301 timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
300 302
301 if (timeout_put) { 303 if (timeout_put) {
302 timeout_ext = nf_ct_timeout_find(ct); 304 timeout_ext = nf_ct_timeout_find(ct);
303 if (timeout_ext) 305 if (timeout_ext)
304 timeout_put(timeout_ext->timeout); 306 timeout_put(timeout_ext->timeout);
305 } 307 }
306 rcu_read_unlock(); 308 rcu_read_unlock();
307 #endif 309 #endif
308 } 310 }
309 311
310 static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par, 312 static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
311 struct xt_ct_target_info_v1 *info) 313 struct xt_ct_target_info_v1 *info)
312 { 314 {
313 struct nf_conn *ct = info->ct; 315 struct nf_conn *ct = info->ct;
314 struct nf_conn_help *help; 316 struct nf_conn_help *help;
315 317
316 if (ct && !nf_ct_is_untracked(ct)) { 318 if (ct && !nf_ct_is_untracked(ct)) {
317 help = nfct_help(ct); 319 help = nfct_help(ct);
318 if (help) 320 if (help)
319 module_put(help->helper->me); 321 module_put(help->helper->me);
320 322
321 nf_ct_l3proto_module_put(par->family); 323 nf_ct_l3proto_module_put(par->family);
322 324
323 xt_ct_destroy_timeout(ct); 325 xt_ct_destroy_timeout(ct);
324 nf_ct_put(info->ct); 326 nf_ct_put(info->ct);
325 } 327 }
326 } 328 }
327 329
328 static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par) 330 static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
329 { 331 {
330 struct xt_ct_target_info *info = par->targinfo; 332 struct xt_ct_target_info *info = par->targinfo;
331 struct xt_ct_target_info_v1 info_v1 = { 333 struct xt_ct_target_info_v1 info_v1 = {
332 .flags = info->flags, 334 .flags = info->flags,
333 .zone = info->zone, 335 .zone = info->zone,
334 .ct_events = info->ct_events, 336 .ct_events = info->ct_events,
335 .exp_events = info->exp_events, 337 .exp_events = info->exp_events,
336 .ct = info->ct, 338 .ct = info->ct,
337 }; 339 };
338 memcpy(info_v1.helper, info->helper, sizeof(info->helper)); 340 memcpy(info_v1.helper, info->helper, sizeof(info->helper));
339 341
340 xt_ct_tg_destroy(par, &info_v1); 342 xt_ct_tg_destroy(par, &info_v1);
341 } 343 }
342 344
343 static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par) 345 static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
344 { 346 {
345 xt_ct_tg_destroy(par, par->targinfo); 347 xt_ct_tg_destroy(par, par->targinfo);
346 } 348 }
347 349
348 static struct xt_target xt_ct_tg_reg[] __read_mostly = { 350 static struct xt_target xt_ct_tg_reg[] __read_mostly = {
349 { 351 {
350 .name = "CT", 352 .name = "CT",
351 .family = NFPROTO_UNSPEC, 353 .family = NFPROTO_UNSPEC,
352 .targetsize = sizeof(struct xt_ct_target_info), 354 .targetsize = sizeof(struct xt_ct_target_info),
353 .checkentry = xt_ct_tg_check_v0, 355 .checkentry = xt_ct_tg_check_v0,
354 .destroy = xt_ct_tg_destroy_v0, 356 .destroy = xt_ct_tg_destroy_v0,
355 .target = xt_ct_target_v0, 357 .target = xt_ct_target_v0,
356 .table = "raw", 358 .table = "raw",
357 .me = THIS_MODULE, 359 .me = THIS_MODULE,
358 }, 360 },
359 { 361 {
360 .name = "CT", 362 .name = "CT",
361 .family = NFPROTO_UNSPEC, 363 .family = NFPROTO_UNSPEC,
362 .revision = 1, 364 .revision = 1,
363 .targetsize = sizeof(struct xt_ct_target_info_v1), 365 .targetsize = sizeof(struct xt_ct_target_info_v1),
364 .checkentry = xt_ct_tg_check_v1, 366 .checkentry = xt_ct_tg_check_v1,
365 .destroy = xt_ct_tg_destroy_v1, 367 .destroy = xt_ct_tg_destroy_v1,
366 .target = xt_ct_target_v1, 368 .target = xt_ct_target_v1,
367 .table = "raw", 369 .table = "raw",
368 .me = THIS_MODULE, 370 .me = THIS_MODULE,
369 }, 371 },
370 { 372 {
371 .name = "CT", 373 .name = "CT",
372 .family = NFPROTO_UNSPEC, 374 .family = NFPROTO_UNSPEC,
373 .revision = 2, 375 .revision = 2,
374 .targetsize = sizeof(struct xt_ct_target_info_v1), 376 .targetsize = sizeof(struct xt_ct_target_info_v1),
375 .checkentry = xt_ct_tg_check_v2, 377 .checkentry = xt_ct_tg_check_v2,
376 .destroy = xt_ct_tg_destroy_v1, 378 .destroy = xt_ct_tg_destroy_v1,
377 .target = xt_ct_target_v1, 379 .target = xt_ct_target_v1,
378 .table = "raw", 380 .table = "raw",
379 .me = THIS_MODULE, 381 .me = THIS_MODULE,
380 }, 382 },
381 }; 383 };
382 384
383 static unsigned int 385 static unsigned int
384 notrack_tg(struct sk_buff *skb, const struct xt_action_param *par) 386 notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
385 { 387 {
386 /* Previously seen (loopback)? Ignore. */ 388 /* Previously seen (loopback)? Ignore. */
387 if (skb->nfct != NULL) 389 if (skb->nfct != NULL)
388 return XT_CONTINUE; 390 return XT_CONTINUE;
389 391
390 skb->nfct = &nf_ct_untracked_get()->ct_general; 392 skb->nfct = &nf_ct_untracked_get()->ct_general;
391 skb->nfctinfo = IP_CT_NEW; 393 skb->nfctinfo = IP_CT_NEW;
392 nf_conntrack_get(skb->nfct); 394 nf_conntrack_get(skb->nfct);
393 395
394 return XT_CONTINUE; 396 return XT_CONTINUE;
395 } 397 }
396 398
397 static int notrack_chk(const struct xt_tgchk_param *par) 399 static int notrack_chk(const struct xt_tgchk_param *par)
398 { 400 {
399 if (!par->net->xt.notrack_deprecated_warning) { 401 if (!par->net->xt.notrack_deprecated_warning) {
400 pr_info("netfilter: NOTRACK target is deprecated, " 402 pr_info("netfilter: NOTRACK target is deprecated, "
401 "use CT instead or upgrade iptables\n"); 403 "use CT instead or upgrade iptables\n");
402 par->net->xt.notrack_deprecated_warning = true; 404 par->net->xt.notrack_deprecated_warning = true;
403 } 405 }
404 return 0; 406 return 0;
405 } 407 }
406 408
407 static struct xt_target notrack_tg_reg __read_mostly = { 409 static struct xt_target notrack_tg_reg __read_mostly = {
408 .name = "NOTRACK", 410 .name = "NOTRACK",
409 .revision = 0, 411 .revision = 0,
410 .family = NFPROTO_UNSPEC, 412 .family = NFPROTO_UNSPEC,
411 .checkentry = notrack_chk, 413 .checkentry = notrack_chk,
412 .target = notrack_tg, 414 .target = notrack_tg,
413 .table = "raw", 415 .table = "raw",
414 .me = THIS_MODULE, 416 .me = THIS_MODULE,
415 }; 417 };
416 418
417 static int __init xt_ct_tg_init(void) 419 static int __init xt_ct_tg_init(void)
418 { 420 {
419 int ret; 421 int ret;
420 422
421 ret = xt_register_target(&notrack_tg_reg); 423 ret = xt_register_target(&notrack_tg_reg);
422 if (ret < 0) 424 if (ret < 0)
423 return ret; 425 return ret;
424 426
425 ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg)); 427 ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
426 if (ret < 0) { 428 if (ret < 0) {
427 xt_unregister_target(&notrack_tg_reg); 429 xt_unregister_target(&notrack_tg_reg);
428 return ret; 430 return ret;
429 } 431 }
430 return 0; 432 return 0;
431 } 433 }
432 434
433 static void __exit xt_ct_tg_exit(void) 435 static void __exit xt_ct_tg_exit(void)
434 { 436 {
435 xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg)); 437 xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
436 xt_unregister_target(&notrack_tg_reg); 438 xt_unregister_target(&notrack_tg_reg);
437 } 439 }
438 440
439 module_init(xt_ct_tg_init); 441 module_init(xt_ct_tg_init);
440 module_exit(xt_ct_tg_exit); 442 module_exit(xt_ct_tg_exit);
441 443
442 MODULE_LICENSE("GPL"); 444 MODULE_LICENSE("GPL");
443 MODULE_DESCRIPTION("Xtables: connection tracking target"); 445 MODULE_DESCRIPTION("Xtables: connection tracking target");
444 MODULE_ALIAS("ipt_CT"); 446 MODULE_ALIAS("ipt_CT");
445 MODULE_ALIAS("ip6t_CT"); 447 MODULE_ALIAS("ip6t_CT");
446 MODULE_ALIAS("ipt_NOTRACK"); 448 MODULE_ALIAS("ipt_NOTRACK");
447 MODULE_ALIAS("ip6t_NOTRACK"); 449 MODULE_ALIAS("ip6t_NOTRACK");
448 450