Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0dc8c76029f4675c2345eefd947f123e64de1aae
Commit:     0dc8c76029f4675c2345eefd947f123e64de1aae
Parent:     8b6f3f62fea7b85fce8f7d12aabba7b191bf60d2
Author:     Jan Engelhardt <[EMAIL PROTECTED]>
AuthorDate: Mon Jan 14 23:38:34 2008 -0800
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Mon Jan 28 15:02:20 2008 -0800

    [NETFILTER]: xt_CONNMARK target, revision 1
    
    Introduces the xt_CONNMARK target revision 1. It uses fixed types, and
    also uses the more expressive XOR logic. Futhermore, it allows to
    selectively pick bits from both the ctmark and the nfmark in the SAVE
    and RESTORE operations.
    
    Signed-off-by: Jan Engelhardt <[EMAIL PROTECTED]>
    Signed-off-by: Patrick McHardy <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
---
 include/linux/netfilter/xt_CONNMARK.h |    5 ++
 net/netfilter/xt_CONNMARK.c           |  117 +++++++++++++++++++++++++++------
 2 files changed, 102 insertions(+), 20 deletions(-)

diff --git a/include/linux/netfilter/xt_CONNMARK.h 
b/include/linux/netfilter/xt_CONNMARK.h
index 9f74468..4e58ba4 100644
--- a/include/linux/netfilter/xt_CONNMARK.h
+++ b/include/linux/netfilter/xt_CONNMARK.h
@@ -22,4 +22,9 @@ struct xt_connmark_target_info {
        u_int8_t mode;
 };
 
+struct xt_connmark_tginfo1 {
+       u_int32_t ctmark, ctmask, nfmask;
+       u_int8_t mode;
+};
+
 #endif /*_XT_CONNMARK_H_target*/
diff --git a/net/netfilter/xt_CONNMARK.c b/net/netfilter/xt_CONNMARK.c
index ec2eb34..b9bd772 100644
--- a/net/netfilter/xt_CONNMARK.c
+++ b/net/netfilter/xt_CONNMARK.c
@@ -1,8 +1,10 @@
-/* This kernel module is used to modify the connection mark values, or
- * to optionally restore the skb nfmark from the connection mark
+/*
+ *     xt_CONNMARK - Netfilter module to modify the connection mark values
  *
- * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
- * by Henrik Nordstrom <[EMAIL PROTECTED]>
+ *     Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
+ *     by Henrik Nordstrom <[EMAIL PROTECTED]>
+ *     Copyright © CC Computer Consultants GmbH, 2007 - 2008
+ *     Jan Engelhardt <[EMAIL PROTECTED]>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -34,9 +36,9 @@ MODULE_ALIAS("ip6t_CONNMARK");
 #include <net/netfilter/nf_conntrack_ecache.h>
 
 static unsigned int
-connmark_tg(struct sk_buff *skb, const struct net_device *in,
-            const struct net_device *out, unsigned int hooknum,
-            const struct xt_target *target, const void *targinfo)
+connmark_tg_v0(struct sk_buff *skb, const struct net_device *in,
+               const struct net_device *out, unsigned int hooknum,
+               const struct xt_target *target, const void *targinfo)
 {
        const struct xt_connmark_target_info *markinfo = targinfo;
        struct nf_conn *ct;
@@ -74,10 +76,50 @@ connmark_tg(struct sk_buff *skb, const struct net_device 
*in,
        return XT_CONTINUE;
 }
 
+static unsigned int
+connmark_tg(struct sk_buff *skb, const struct net_device *in,
+            const struct net_device *out, unsigned int hooknum,
+            const struct xt_target *target, const void *targinfo)
+{
+       const struct xt_connmark_tginfo1 *info = targinfo;
+       enum ip_conntrack_info ctinfo;
+       struct nf_conn *ct;
+       u_int32_t newmark;
+
+       ct = nf_ct_get(skb, &ctinfo);
+       if (ct == NULL)
+               return XT_CONTINUE;
+
+       switch (info->mode) {
+       case XT_CONNMARK_SET:
+               newmark = (ct->mark & ~info->ctmask) ^ info->ctmark;
+               if (ct->mark != newmark) {
+                       ct->mark = newmark;
+                       nf_conntrack_event_cache(IPCT_MARK, skb);
+               }
+               break;
+       case XT_CONNMARK_SAVE:
+               newmark = (ct->mark & ~info->ctmask) ^
+                         (skb->mark & info->nfmask);
+               if (ct->mark != newmark) {
+                       ct->mark = newmark;
+                       nf_conntrack_event_cache(IPCT_MARK, skb);
+               }
+               break;
+       case XT_CONNMARK_RESTORE:
+               newmark = (skb->mark & ~info->nfmask) ^
+                         (ct->mark & info->ctmask);
+               skb->mark = newmark;
+               break;
+       }
+
+       return XT_CONTINUE;
+}
+
 static bool
-connmark_tg_check(const char *tablename, const void *entry,
-                  const struct xt_target *target, void *targinfo,
-                  unsigned int hook_mask)
+connmark_tg_check_v0(const char *tablename, const void *entry,
+                     const struct xt_target *target, void *targinfo,
+                     unsigned int hook_mask)
 {
        const struct xt_connmark_target_info *matchinfo = targinfo;
 
@@ -101,6 +143,19 @@ connmark_tg_check(const char *tablename, const void *entry,
        return true;
 }
 
+static bool
+connmark_tg_check(const char *tablename, const void *entry,
+                  const struct xt_target *target, void *targinfo,
+                  unsigned int hook_mask)
+{
+       if (nf_ct_l3proto_try_module_get(target->family) < 0) {
+               printk(KERN_WARNING "cannot load conntrack support for "
+                      "proto=%u\n", target->family);
+               return false;
+       }
+       return true;
+}
+
 static void
 connmark_tg_destroy(const struct xt_target *target, void *targinfo)
 {
@@ -115,7 +170,7 @@ struct compat_xt_connmark_target_info {
        u_int16_t       __pad2;
 };
 
-static void connmark_tg_compat_from_user(void *dst, void *src)
+static void connmark_tg_compat_from_user_v0(void *dst, void *src)
 {
        const struct compat_xt_connmark_target_info *cm = src;
        struct xt_connmark_target_info m = {
@@ -126,7 +181,7 @@ static void connmark_tg_compat_from_user(void *dst, void 
*src)
        memcpy(dst, &m, sizeof(m));
 }
 
-static int connmark_tg_compat_to_user(void __user *dst, void *src)
+static int connmark_tg_compat_to_user_v0(void __user *dst, void *src)
 {
        const struct xt_connmark_target_info *m = src;
        struct compat_xt_connmark_target_info cm = {
@@ -141,32 +196,54 @@ static int connmark_tg_compat_to_user(void __user *dst, 
void *src)
 static struct xt_target connmark_tg_reg[] __read_mostly = {
        {
                .name           = "CONNMARK",
+               .revision       = 0,
                .family         = AF_INET,
-               .checkentry     = connmark_tg_check,
+               .checkentry     = connmark_tg_check_v0,
                .destroy        = connmark_tg_destroy,
-               .target         = connmark_tg,
+               .target         = connmark_tg_v0,
                .targetsize     = sizeof(struct xt_connmark_target_info),
 #ifdef CONFIG_COMPAT
                .compatsize     = sizeof(struct compat_xt_connmark_target_info),
-               .compat_from_user = connmark_tg_compat_from_user,
-               .compat_to_user = connmark_tg_compat_to_user,
+               .compat_from_user = connmark_tg_compat_from_user_v0,
+               .compat_to_user = connmark_tg_compat_to_user_v0,
 #endif
                .me             = THIS_MODULE
        },
        {
                .name           = "CONNMARK",
+               .revision       = 0,
                .family         = AF_INET6,
-               .checkentry     = connmark_tg_check,
+               .checkentry     = connmark_tg_check_v0,
                .destroy        = connmark_tg_destroy,
-               .target         = connmark_tg,
+               .target         = connmark_tg_v0,
                .targetsize     = sizeof(struct xt_connmark_target_info),
 #ifdef CONFIG_COMPAT
                .compatsize     = sizeof(struct compat_xt_connmark_target_info),
-               .compat_from_user = connmark_tg_compat_from_user,
-               .compat_to_user = connmark_tg_compat_to_user,
+               .compat_from_user = connmark_tg_compat_from_user_v0,
+               .compat_to_user = connmark_tg_compat_to_user_v0,
 #endif
                .me             = THIS_MODULE
        },
+       {
+               .name           = "CONNMARK",
+               .revision       = 1,
+               .family         = AF_INET,
+               .checkentry     = connmark_tg_check,
+               .target         = connmark_tg,
+               .targetsize     = sizeof(struct xt_connmark_tginfo1),
+               .destroy        = connmark_tg_destroy,
+               .me             = THIS_MODULE,
+       },
+       {
+               .name           = "CONNMARK",
+               .revision       = 1,
+               .family         = AF_INET6,
+               .checkentry     = connmark_tg_check,
+               .target         = connmark_tg,
+               .targetsize     = sizeof(struct xt_connmark_tginfo1),
+               .destroy        = connmark_tg_destroy,
+               .me             = THIS_MODULE,
+       },
 };
 
 static int __init connmark_tg_init(void)
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to