[thirdparty/linux.git] / net / netfilter / xt_conntrack.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 *	xt_conntrack - Netfilter module to match connection tracking
 *	information. (Superset of Rusty's minimalistic state match.)
 *
 *	(C) 2001  Marc Boucher (marc@mbsi.ca).
 *	(C) 2006-2012 Patrick McHardy <kaber@trash.net>
 *	Copyright © CC Computer Consultants GmbH, 2007 - 2008
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/ipv6.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_conntrack.h>
#include <net/netfilter/nf_conntrack.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
MODULE_DESCRIPTION("Xtables: connection tracking state match");
MODULE_ALIAS("ipt_conntrack");
MODULE_ALIAS("ip6t_conntrack");

static bool
conntrack_addrcmp(const union nf_inet_addr *kaddr,
                  const union nf_inet_addr *uaddr,
                  const union nf_inet_addr *umask, unsigned int l3proto)
{
	if (l3proto == NFPROTO_IPV4)
		return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0;
	else if (l3proto == NFPROTO_IPV6)
		return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6,
		       &uaddr->in6) == 0;
	else
		return false;
}

static inline bool
conntrack_mt_origsrc(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
	       &info->origsrc_addr, &info->origsrc_mask, family);
}

static inline bool
conntrack_mt_origdst(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
	       &info->origdst_addr, &info->origdst_mask, family);
}

static inline bool
conntrack_mt_replsrc(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3,
	       &info->replsrc_addr, &info->replsrc_mask, family);
}

static inline bool
conntrack_mt_repldst(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3,
	       &info->repldst_addr, &info->repldst_mask, family);
}

static inline bool
ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info,
                    const struct nf_conn *ct)
{
	const struct nf_conntrack_tuple *tuple;

	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
	    (nf_ct_protonum(ct) == info->l4proto) ^
	    !(info->invert_flags & XT_CONNTRACK_PROTO))
		return false;

	/* Shortcut to match all recognized protocols by using ->src.all. */
	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	    (tuple->src.u.all == info->origsrc_port) ^
	    !(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	    (tuple->dst.u.all == info->origdst_port) ^
	    !(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
		return false;

	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;

	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	    (tuple->src.u.all == info->replsrc_port) ^
	    !(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	    (tuple->dst.u.all == info->repldst_port) ^
	    !(info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
		return false;

	return true;
}

static inline bool
port_match(u16 min, u16 max, u16 port, bool invert)
{
	return (port >= min && port <= max) ^ invert;
}

static inline bool
ct_proto_port_check_v3(const struct xt_conntrack_mtinfo3 *info,
		       const struct nf_conn *ct)
{
	const struct nf_conntrack_tuple *tuple;

	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
	    (nf_ct_protonum(ct) == info->l4proto) ^
	    !(info->invert_flags & XT_CONNTRACK_PROTO))
		return false;

	/* Shortcut to match all recognized protocols by using ->src.all. */
	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	    !port_match(info->origsrc_port, info->origsrc_port_high,
			ntohs(tuple->src.u.all),
			info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	    !port_match(info->origdst_port, info->origdst_port_high,
			ntohs(tuple->dst.u.all),
			info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
		return false;

	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;

	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	    !port_match(info->replsrc_port, info->replsrc_port_high,
			ntohs(tuple->src.u.all),
			info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	    !port_match(info->repldst_port, info->repldst_port_high,
			ntohs(tuple->dst.u.all),
			info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
		return false;

	return true;
}

static bool
conntrack_mt(const struct sk_buff *skb, struct xt_action_param *par,
             u16 state_mask, u16 status_mask)
{
	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
	enum ip_conntrack_info ctinfo;
	const struct nf_conn *ct;
	unsigned int statebit;

	ct = nf_ct_get(skb, &ctinfo);

	if (ct)
		statebit = XT_CONNTRACK_STATE_BIT(ctinfo);
	else if (ctinfo == IP_CT_UNTRACKED)
		statebit = XT_CONNTRACK_STATE_UNTRACKED;
	else
		statebit = XT_CONNTRACK_STATE_INVALID;

	if (info->match_flags & XT_CONNTRACK_STATE) {
		if (ct != NULL) {
			if (test_bit(IPS_SRC_NAT_BIT, &ct->status))
				statebit |= XT_CONNTRACK_STATE_SNAT;
			if (test_bit(IPS_DST_NAT_BIT, &ct->status))
				statebit |= XT_CONNTRACK_STATE_DNAT;
		}
		if (!!(state_mask & statebit) ^
		    !(info->invert_flags & XT_CONNTRACK_STATE))
			return false;
	}

	if (ct == NULL)
		return info->match_flags & XT_CONNTRACK_STATE;
	if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
	    (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
	    !(info->invert_flags & XT_CONNTRACK_DIRECTION))
		return false;

	if (info->match_flags & XT_CONNTRACK_ORIGSRC)
		if (conntrack_mt_origsrc(ct, info, xt_family(par)) ^
		    !(info->invert_flags & XT_CONNTRACK_ORIGSRC))
			return false;

	if (info->match_flags & XT_CONNTRACK_ORIGDST)
		if (conntrack_mt_origdst(ct, info, xt_family(par)) ^
		    !(info->invert_flags & XT_CONNTRACK_ORIGDST))
			return false;

	if (info->match_flags & XT_CONNTRACK_REPLSRC)
		if (conntrack_mt_replsrc(ct, info, xt_family(par)) ^
		    !(info->invert_flags & XT_CONNTRACK_REPLSRC))
			return false;

	if (info->match_flags & XT_CONNTRACK_REPLDST)
		if (conntrack_mt_repldst(ct, info, xt_family(par)) ^
		    !(info->invert_flags & XT_CONNTRACK_REPLDST))
			return false;

	if (par->match->revision != 3) {
		if (!ct_proto_port_check(info, ct))
			return false;
	} else {
		if (!ct_proto_port_check_v3(par->matchinfo, ct))
			return false;
	}

	if ((info->match_flags & XT_CONNTRACK_STATUS) &&
	    (!!(status_mask & ct->status) ^
	    !(info->invert_flags & XT_CONNTRACK_STATUS)))
		return false;

	if (info->match_flags & XT_CONNTRACK_EXPIRES) {
		unsigned long expires = nf_ct_expires(ct) / HZ;

		if ((expires >= info->expires_min &&
		    expires <= info->expires_max) ^
		    !(info->invert_flags & XT_CONNTRACK_EXPIRES))
			return false;
	}
	return true;
}

static bool
conntrack_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_conntrack_mtinfo1 *info = par->matchinfo;

	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
}

static bool
conntrack_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;

	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
}

static bool
conntrack_mt_v3(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_conntrack_mtinfo3 *info = par->matchinfo;

	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
}

static int conntrack_mt_check(const struct xt_mtchk_param *par)
{
	int ret;

	ret = nf_ct_netns_get(par->net, par->family);
	if (ret < 0)
		pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
				    par->family);
	return ret;
}

static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
{
	nf_ct_netns_put(par->net, par->family);
}

static struct xt_match conntrack_mt_reg[] __read_mostly = {
	{
		.name       = "conntrack",
		.revision   = 1,
		.family     = NFPROTO_UNSPEC,
		.matchsize  = sizeof(struct xt_conntrack_mtinfo1),
		.match      = conntrack_mt_v1,
		.checkentry = conntrack_mt_check,
		.destroy    = conntrack_mt_destroy,
		.me         = THIS_MODULE,
	},
	{
		.name       = "conntrack",
		.revision   = 2,
		.family     = NFPROTO_UNSPEC,
		.matchsize  = sizeof(struct xt_conntrack_mtinfo2),
		.match      = conntrack_mt_v2,
		.checkentry = conntrack_mt_check,
		.destroy    = conntrack_mt_destroy,
		.me         = THIS_MODULE,
	},
	{
		.name       = "conntrack",
		.revision   = 3,
		.family     = NFPROTO_UNSPEC,
		.matchsize  = sizeof(struct xt_conntrack_mtinfo3),
		.match      = conntrack_mt_v3,
		.checkentry = conntrack_mt_check,
		.destroy    = conntrack_mt_destroy,
		.me         = THIS_MODULE,
	},
};

static int __init conntrack_mt_init(void)
{
	return xt_register_matches(conntrack_mt_reg,
	       ARRAY_SIZE(conntrack_mt_reg));
}

static void __exit conntrack_mt_exit(void)
{
	xt_unregister_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg));
}

module_init(conntrack_mt_init);
module_exit(conntrack_mt_exit);
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
64eb12f9 JE	2	/*
	3	* xt_conntrack - Netfilter module to match connection tracking
	4	* information. (Superset of Rusty's minimalistic state match.)
1da177e4	5	*
64eb12f9	6	* (C) 2001 Marc Boucher (marc@mbsi.ca).
f229f6ce	7	* (C) 2006-2012 Patrick McHardy <kaber@trash.net>
64eb12f9	8	* Copyright © CC Computer Consultants GmbH, 2007 - 2008
1da177e4	9	*/
8bee4bad	10	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
1da177e4 LT	11	#include <linux/module.h>
1da177e4 LT	12	#include <linux/skbuff.h>
64eb12f9	13	#include <net/ipv6.h>
2e4e6a17 HW	14	#include <linux/netfilter/x_tables.h>
2e4e6a17 HW	15	#include <linux/netfilter/xt_conntrack.h>
587aa641	16	#include <net/netfilter/nf_conntrack.h>
1da177e4 LT	17
	18	MODULE_LICENSE("GPL");
	19	MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
9e05ec4b	20	MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
2ae15b64	21	MODULE_DESCRIPTION("Xtables: connection tracking state match");
2e4e6a17	22	MODULE_ALIAS("ipt_conntrack");
64eb12f9	23	MODULE_ALIAS("ip6t_conntrack");
1da177e4	24
64eb12f9 JE	25	static bool
	26	conntrack_addrcmp(const union nf_inet_addr *kaddr,
	27	const union nf_inet_addr *uaddr,
	28	const union nf_inet_addr *umask, unsigned int l3proto)
	29	{
ee999d8b	30	if (l3proto == NFPROTO_IPV4)
6556874d	31	return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0;
ee999d8b	32	else if (l3proto == NFPROTO_IPV6)
64eb12f9 JE	33	return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6,
	34	&uaddr->in6) == 0;
	35	else
	36	return false;
	37	}
	38
	39	static inline bool
	40	conntrack_mt_origsrc(const struct nf_conn *ct,
d6d3f08b	41	const struct xt_conntrack_mtinfo2 *info,
76108cea	42	u_int8_t family)
64eb12f9 JE	43	{
	44	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
	45	&info->origsrc_addr, &info->origsrc_mask, family);
	46	}
	47
	48	static inline bool
	49	conntrack_mt_origdst(const struct nf_conn *ct,
d6d3f08b	50	const struct xt_conntrack_mtinfo2 *info,
76108cea	51	u_int8_t family)
64eb12f9 JE	52	{
	53	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
	54	&info->origdst_addr, &info->origdst_mask, family);
	55	}
	56
	57	static inline bool
	58	conntrack_mt_replsrc(const struct nf_conn *ct,
d6d3f08b	59	const struct xt_conntrack_mtinfo2 *info,
76108cea	60	u_int8_t family)
64eb12f9 JE	61	{
	62	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3,
	63	&info->replsrc_addr, &info->replsrc_mask, family);
	64	}
	65
	66	static inline bool
	67	conntrack_mt_repldst(const struct nf_conn *ct,
d6d3f08b	68	const struct xt_conntrack_mtinfo2 *info,
76108cea	69	u_int8_t family)
64eb12f9 JE	70	{
	71	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3,
	72	&info->repldst_addr, &info->repldst_mask, family);
	73	}
	74
b4164998	75	static inline bool
d6d3f08b	76	ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info,
b4164998 JE	77	const struct nf_conn *ct)
	78	{
	79	const struct nf_conntrack_tuple *tuple;
	80
	81	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	82	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
5e8fbe2a	83	(nf_ct_protonum(ct) == info->l4proto) ^
b4164998 JE	84	!(info->invert_flags & XT_CONNTRACK_PROTO))
	85	return false;
	86
	87	/* Shortcut to match all recognized protocols by using ->src.all. */
	88	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	89	(tuple->src.u.all == info->origsrc_port) ^
	90	!(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
	91	return false;
	92
	93	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	94	(tuple->dst.u.all == info->origdst_port) ^
	95	!(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
	96	return false;
	97
	98	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
	99
	100	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	101	(tuple->src.u.all == info->replsrc_port) ^
	102	!(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
	103	return false;
	104
	105	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	106	(tuple->dst.u.all == info->repldst_port) ^
	107	!(info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
	108	return false;
	109
	110	return true;
	111	}
	112
b017900a PM	113	static inline bool
	114	port_match(u16 min, u16 max, u16 port, bool invert)
	115	{
	116	return (port >= min && port <= max) ^ invert;
	117	}
	118
	119	static inline bool
	120	ct_proto_port_check_v3(const struct xt_conntrack_mtinfo3 *info,
	121	const struct nf_conn *ct)
	122	{
	123	const struct nf_conntrack_tuple *tuple;
	124
	125	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	126	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
	127	(nf_ct_protonum(ct) == info->l4proto) ^
	128	!(info->invert_flags & XT_CONNTRACK_PROTO))
	129	return false;
	130
	131	/* Shortcut to match all recognized protocols by using ->src.all. */
	132	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	133	!port_match(info->origsrc_port, info->origsrc_port_high,
	134	ntohs(tuple->src.u.all),
	135	info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
	136	return false;
	137
	138	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	139	!port_match(info->origdst_port, info->origdst_port_high,
	140	ntohs(tuple->dst.u.all),
	141	info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
	142	return false;
	143
	144	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
	145
	146	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	147	!port_match(info->replsrc_port, info->replsrc_port_high,
	148	ntohs(tuple->src.u.all),
	149	info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
	150	return false;
	151
	152	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	153	!port_match(info->repldst_port, info->repldst_port_high,
	154	ntohs(tuple->dst.u.all),
	155	info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
	156	return false;
	157
	158	return true;
	159	}
	160
64eb12f9	161	static bool
62fc8051	162	conntrack_mt(const struct sk_buff skb, struct xt_action_param par,
3a042929	163	u16 state_mask, u16 status_mask)
64eb12f9	164	{
d6d3f08b	165	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
64eb12f9 JE	166	enum ip_conntrack_info ctinfo;
	167	const struct nf_conn *ct;
	168	unsigned int statebit;
	169
	170	ct = nf_ct_get(skb, &ctinfo);
	171
cc41c84b FW	172	if (ct)
	173	statebit = XT_CONNTRACK_STATE_BIT(ctinfo);
	174	else if (ctinfo == IP_CT_UNTRACKED)
	175	statebit = XT_CONNTRACK_STATE_UNTRACKED;
	176	else
64eb12f9 JE	177	statebit = XT_CONNTRACK_STATE_INVALID;
	178
	179	if (info->match_flags & XT_CONNTRACK_STATE) {
	180	if (ct != NULL) {
	181	if (test_bit(IPS_SRC_NAT_BIT, &ct->status))
	182	statebit \|= XT_CONNTRACK_STATE_SNAT;
	183	if (test_bit(IPS_DST_NAT_BIT, &ct->status))
	184	statebit \|= XT_CONNTRACK_STATE_DNAT;
	185	}
3a042929	186	if (!!(state_mask & statebit) ^
64eb12f9 JE	187	!(info->invert_flags & XT_CONNTRACK_STATE))
	188	return false;
	189	}
	190
	191	if (ct == NULL)
	192	return info->match_flags & XT_CONNTRACK_STATE;
b4164998 JE	193	if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
b4164998 JE	194	(CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
96120d86	195	!(info->invert_flags & XT_CONNTRACK_DIRECTION))
64eb12f9 JE	196	return false;
	197
	198	if (info->match_flags & XT_CONNTRACK_ORIGSRC)
613dbd95	199	if (conntrack_mt_origsrc(ct, info, xt_family(par)) ^
64eb12f9 JE	200	!(info->invert_flags & XT_CONNTRACK_ORIGSRC))
	201	return false;
	202
	203	if (info->match_flags & XT_CONNTRACK_ORIGDST)
613dbd95	204	if (conntrack_mt_origdst(ct, info, xt_family(par)) ^
64eb12f9 JE	205	!(info->invert_flags & XT_CONNTRACK_ORIGDST))
	206	return false;
	207
	208	if (info->match_flags & XT_CONNTRACK_REPLSRC)
613dbd95	209	if (conntrack_mt_replsrc(ct, info, xt_family(par)) ^
64eb12f9 JE	210	!(info->invert_flags & XT_CONNTRACK_REPLSRC))
	211	return false;
	212
	213	if (info->match_flags & XT_CONNTRACK_REPLDST)
613dbd95	214	if (conntrack_mt_repldst(ct, info, xt_family(par)) ^
64eb12f9 JE	215	!(info->invert_flags & XT_CONNTRACK_REPLDST))
	216	return false;
	217
b017900a PM	218	if (par->match->revision != 3) {
	219	if (!ct_proto_port_check(info, ct))
	220	return false;
	221	} else {
	222	if (!ct_proto_port_check_v3(par->matchinfo, ct))
	223	return false;
	224	}
b4164998	225
64eb12f9	226	if ((info->match_flags & XT_CONNTRACK_STATUS) &&
3a042929	227	(!!(status_mask & ct->status) ^
64eb12f9 JE	228	!(info->invert_flags & XT_CONNTRACK_STATUS)))
	229	return false;
	230
	231	if (info->match_flags & XT_CONNTRACK_EXPIRES) {
d0b35b93	232	unsigned long expires = nf_ct_expires(ct) / HZ;
64eb12f9	233
64eb12f9 JE	234	if ((expires >= info->expires_min &&
	235	expires <= info->expires_max) ^
	236	!(info->invert_flags & XT_CONNTRACK_EXPIRES))
	237	return false;
	238	}
	239	return true;
	240	}
	241
d6d3f08b	242	static bool
62fc8051	243	conntrack_mt_v1(const struct sk_buff skb, struct xt_action_param par)
d6d3f08b	244	{
3a042929	245	const struct xt_conntrack_mtinfo1 *info = par->matchinfo;
d6d3f08b	246
3a042929 FW	247	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
	248	}
	249
	250	static bool
62fc8051	251	conntrack_mt_v2(const struct sk_buff skb, struct xt_action_param par)
3a042929 FW	252	{
	253	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
	254
	255	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
d6d3f08b JE	256	}
d6d3f08b JE	257
b017900a PM	258	static bool
	259	conntrack_mt_v3(const struct sk_buff skb, struct xt_action_param par)
	260	{
	261	const struct xt_conntrack_mtinfo3 *info = par->matchinfo;
	262
	263	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
	264	}
	265
b0f38452	266	static int conntrack_mt_check(const struct xt_mtchk_param *par)
b9f78f9f	267	{
4a5a5c73 JE	268	int ret;
4a5a5c73 JE	269
ecb2421b	270	ret = nf_ct_netns_get(par->net, par->family);
f95c74e3	271	if (ret < 0)
b2606644 FW	272	pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
b2606644 FW	273	par->family);
f95c74e3	274	return ret;
b9f78f9f PNA	275	}
b9f78f9f PNA	276
6be3d859	277	static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
b9f78f9f	278	{
ecb2421b	279	nf_ct_netns_put(par->net, par->family);
b9f78f9f PNA	280	}
b9f78f9f PNA	281
64eb12f9	282	static struct xt_match conntrack_mt_reg[] __read_mostly = {
64eb12f9 JE	283	{
	284	.name = "conntrack",
	285	.revision = 1,
92f3b2b1	286	.family = NFPROTO_UNSPEC,
64eb12f9	287	.matchsize = sizeof(struct xt_conntrack_mtinfo1),
d6d3f08b	288	.match = conntrack_mt_v1,
3a042929 FW	289	.checkentry = conntrack_mt_check,
3a042929 FW	290	.destroy = conntrack_mt_destroy,
d6d3f08b JE	291	.me = THIS_MODULE,
	292	},
	293	{
	294	.name = "conntrack",
	295	.revision = 2,
	296	.family = NFPROTO_UNSPEC,
	297	.matchsize = sizeof(struct xt_conntrack_mtinfo2),
3a042929	298	.match = conntrack_mt_v2,
64eb12f9 JE	299	.checkentry = conntrack_mt_check,
	300	.destroy = conntrack_mt_destroy,
	301	.me = THIS_MODULE,
	302	},
b017900a PM	303	{
	304	.name = "conntrack",
	305	.revision = 3,
	306	.family = NFPROTO_UNSPEC,
	307	.matchsize = sizeof(struct xt_conntrack_mtinfo3),
	308	.match = conntrack_mt_v3,
	309	.checkentry = conntrack_mt_check,
	310	.destroy = conntrack_mt_destroy,
	311	.me = THIS_MODULE,
	312	},
1da177e4 LT	313	};
1da177e4 LT	314
d3c5ee6d	315	static int __init conntrack_mt_init(void)
1da177e4	316	{
64eb12f9 JE	317	return xt_register_matches(conntrack_mt_reg,
64eb12f9 JE	318	ARRAY_SIZE(conntrack_mt_reg));
1da177e4 LT	319	}
1da177e4 LT	320
d3c5ee6d	321	static void __exit conntrack_mt_exit(void)
1da177e4	322	{
64eb12f9	323	xt_unregister_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg));
1da177e4 LT	324	}
1da177e4 LT	325
d3c5ee6d JE	326	module_init(conntrack_mt_init);
d3c5ee6d JE	327	module_exit(conntrack_mt_exit);