[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / netfilter / xt_conntrack.c

/*
 *	xt_conntrack - Netfilter module to match connection tracking
 *	information. (Superset of Rusty's minimalistic state match.)
 *
 *	(C) 2001  Marc Boucher (marc@mbsi.ca).
 *	(C) 2006-2012 Patrick McHardy <kaber@trash.net>
 *	Copyright © CC Computer Consultants GmbH, 2007 - 2008
 *
 *	This program is free software; you can redistribute it and/or modify
 *	it under the terms of the GNU General Public License version 2 as
 *	published by the Free Software Foundation.
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/ipv6.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_conntrack.h>
#include <net/netfilter/nf_conntrack.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
MODULE_DESCRIPTION("Xtables: connection tracking state match");
MODULE_ALIAS("ipt_conntrack");
MODULE_ALIAS("ip6t_conntrack");

static bool
conntrack_addrcmp(const union nf_inet_addr *kaddr,
                  const union nf_inet_addr *uaddr,
                  const union nf_inet_addr *umask, unsigned int l3proto)
{
	if (l3proto == NFPROTO_IPV4)
		return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0;
	else if (l3proto == NFPROTO_IPV6)
		return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6,
		       &uaddr->in6) == 0;
	else
		return false;
}

static inline bool
conntrack_mt_origsrc(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
	       &info->origsrc_addr, &info->origsrc_mask, family);
}

static inline bool
conntrack_mt_origdst(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
	       &info->origdst_addr, &info->origdst_mask, family);
}

static inline bool
conntrack_mt_replsrc(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3,
	       &info->replsrc_addr, &info->replsrc_mask, family);
}

static inline bool
conntrack_mt_repldst(const struct nf_conn *ct,
                     const struct xt_conntrack_mtinfo2 *info,
		     u_int8_t family)
{
	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3,
	       &info->repldst_addr, &info->repldst_mask, family);
}

static inline bool
ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info,
                    const struct nf_conn *ct)
{
	const struct nf_conntrack_tuple *tuple;

	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
	    (nf_ct_protonum(ct) == info->l4proto) ^
	    !(info->invert_flags & XT_CONNTRACK_PROTO))
		return false;

	/* Shortcut to match all recognized protocols by using ->src.all. */
	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	    (tuple->src.u.all == info->origsrc_port) ^
	    !(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	    (tuple->dst.u.all == info->origdst_port) ^
	    !(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
		return false;

	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;

	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	    (tuple->src.u.all == info->replsrc_port) ^
	    !(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	    (tuple->dst.u.all == info->repldst_port) ^
	    !(info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
		return false;

	return true;
}

static inline bool
port_match(u16 min, u16 max, u16 port, bool invert)
{
	return (port >= min && port <= max) ^ invert;
}

static inline bool
ct_proto_port_check_v3(const struct xt_conntrack_mtinfo3 *info,
		       const struct nf_conn *ct)
{
	const struct nf_conntrack_tuple *tuple;

	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
	    (nf_ct_protonum(ct) == info->l4proto) ^
	    !(info->invert_flags & XT_CONNTRACK_PROTO))
		return false;

	/* Shortcut to match all recognized protocols by using ->src.all. */
	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	    !port_match(info->origsrc_port, info->origsrc_port_high,
			ntohs(tuple->src.u.all),
			info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	    !port_match(info->origdst_port, info->origdst_port_high,
			ntohs(tuple->dst.u.all),
			info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
		return false;

	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;

	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	    !port_match(info->replsrc_port, info->replsrc_port_high,
			ntohs(tuple->src.u.all),
			info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
		return false;

	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	    !port_match(info->repldst_port, info->repldst_port_high,
			ntohs(tuple->dst.u.all),
			info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
		return false;

	return true;
}

static bool
conntrack_mt(const struct sk_buff *skb, struct xt_action_param *par,
             u16 state_mask, u16 status_mask)
{
	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
	enum ip_conntrack_info ctinfo;
	const struct nf_conn *ct;
	unsigned int statebit;

	ct = nf_ct_get(skb, &ctinfo);

	if (ct) {
		if (nf_ct_is_untracked(ct))
			statebit = XT_CONNTRACK_STATE_UNTRACKED;
		else
			statebit = XT_CONNTRACK_STATE_BIT(ctinfo);
	} else
		statebit = XT_CONNTRACK_STATE_INVALID;

	if (info->match_flags & XT_CONNTRACK_STATE) {
		if (ct != NULL) {
			if (test_bit(IPS_SRC_NAT_BIT, &ct->status))
				statebit |= XT_CONNTRACK_STATE_SNAT;
			if (test_bit(IPS_DST_NAT_BIT, &ct->status))
				statebit |= XT_CONNTRACK_STATE_DNAT;
		}
		if (!!(state_mask & statebit) ^
		    !(info->invert_flags & XT_CONNTRACK_STATE))
			return false;
	}

	if (ct == NULL)
		return info->match_flags & XT_CONNTRACK_STATE;
	if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
	    (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
	    !(info->invert_flags & XT_CONNTRACK_DIRECTION))
		return false;

	if (info->match_flags & XT_CONNTRACK_ORIGSRC)
		if (conntrack_mt_origsrc(ct, info, par->family) ^
		    !(info->invert_flags & XT_CONNTRACK_ORIGSRC))
			return false;

	if (info->match_flags & XT_CONNTRACK_ORIGDST)
		if (conntrack_mt_origdst(ct, info, par->family) ^
		    !(info->invert_flags & XT_CONNTRACK_ORIGDST))
			return false;

	if (info->match_flags & XT_CONNTRACK_REPLSRC)
		if (conntrack_mt_replsrc(ct, info, par->family) ^
		    !(info->invert_flags & XT_CONNTRACK_REPLSRC))
			return false;

	if (info->match_flags & XT_CONNTRACK_REPLDST)
		if (conntrack_mt_repldst(ct, info, par->family) ^
		    !(info->invert_flags & XT_CONNTRACK_REPLDST))
			return false;

	if (par->match->revision != 3) {
		if (!ct_proto_port_check(info, ct))
			return false;
	} else {
		if (!ct_proto_port_check_v3(par->matchinfo, ct))
			return false;
	}

	if ((info->match_flags & XT_CONNTRACK_STATUS) &&
	    (!!(status_mask & ct->status) ^
	    !(info->invert_flags & XT_CONNTRACK_STATUS)))
		return false;

	if (info->match_flags & XT_CONNTRACK_EXPIRES) {
		unsigned long expires = 0;

		if (timer_pending(&ct->timeout))
			expires = (ct->timeout.expires - jiffies) / HZ;
		if ((expires >= info->expires_min &&
		    expires <= info->expires_max) ^
		    !(info->invert_flags & XT_CONNTRACK_EXPIRES))
			return false;
	}
	return true;
}

static bool
conntrack_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_conntrack_mtinfo1 *info = par->matchinfo;

	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
}

static bool
conntrack_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;

	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
}

static bool
conntrack_mt_v3(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_conntrack_mtinfo3 *info = par->matchinfo;

	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
}

static int conntrack_mt_check(const struct xt_mtchk_param *par)
{
	int ret;

	ret = nf_ct_l3proto_try_module_get(par->family);
	if (ret < 0)
		pr_info("cannot load conntrack support for proto=%u\n",
			par->family);
	return ret;
}

static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
{
	nf_ct_l3proto_module_put(par->family);
}

static struct xt_match conntrack_mt_reg[] __read_mostly = {
	{
		.name       = "conntrack",
		.revision   = 1,
		.family     = NFPROTO_UNSPEC,
		.matchsize  = sizeof(struct xt_conntrack_mtinfo1),
		.match      = conntrack_mt_v1,
		.checkentry = conntrack_mt_check,
		.destroy    = conntrack_mt_destroy,
		.me         = THIS_MODULE,
	},
	{
		.name       = "conntrack",
		.revision   = 2,
		.family     = NFPROTO_UNSPEC,
		.matchsize  = sizeof(struct xt_conntrack_mtinfo2),
		.match      = conntrack_mt_v2,
		.checkentry = conntrack_mt_check,
		.destroy    = conntrack_mt_destroy,
		.me         = THIS_MODULE,
	},
	{
		.name       = "conntrack",
		.revision   = 3,
		.family     = NFPROTO_UNSPEC,
		.matchsize  = sizeof(struct xt_conntrack_mtinfo3),
		.match      = conntrack_mt_v3,
		.checkentry = conntrack_mt_check,
		.destroy    = conntrack_mt_destroy,
		.me         = THIS_MODULE,
	},
};

static int __init conntrack_mt_init(void)
{
	return xt_register_matches(conntrack_mt_reg,
	       ARRAY_SIZE(conntrack_mt_reg));
}

static void __exit conntrack_mt_exit(void)
{
	xt_unregister_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg));
}

module_init(conntrack_mt_init);
module_exit(conntrack_mt_exit);
Commit	Line	Data
64eb12f9 JE	1	/*
	2	* xt_conntrack - Netfilter module to match connection tracking
	3	* information. (Superset of Rusty's minimalistic state match.)
1da177e4	4	*
64eb12f9	5	* (C) 2001 Marc Boucher (marc@mbsi.ca).
f229f6ce	6	* (C) 2006-2012 Patrick McHardy <kaber@trash.net>
64eb12f9	7	* Copyright © CC Computer Consultants GmbH, 2007 - 2008
1da177e4	8	*
64eb12f9 JE	9	* This program is free software; you can redistribute it and/or modify
	10	* it under the terms of the GNU General Public License version 2 as
	11	* published by the Free Software Foundation.
1da177e4	12	*/
8bee4bad	13	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
1da177e4 LT	14	#include <linux/module.h>
1da177e4 LT	15	#include <linux/skbuff.h>
64eb12f9	16	#include <net/ipv6.h>
2e4e6a17 HW	17	#include <linux/netfilter/x_tables.h>
2e4e6a17 HW	18	#include <linux/netfilter/xt_conntrack.h>
587aa641	19	#include <net/netfilter/nf_conntrack.h>
1da177e4 LT	20
	21	MODULE_LICENSE("GPL");
	22	MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
9e05ec4b	23	MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
2ae15b64	24	MODULE_DESCRIPTION("Xtables: connection tracking state match");
2e4e6a17	25	MODULE_ALIAS("ipt_conntrack");
64eb12f9	26	MODULE_ALIAS("ip6t_conntrack");
1da177e4	27
64eb12f9 JE	28	static bool
	29	conntrack_addrcmp(const union nf_inet_addr *kaddr,
	30	const union nf_inet_addr *uaddr,
	31	const union nf_inet_addr *umask, unsigned int l3proto)
	32	{
ee999d8b	33	if (l3proto == NFPROTO_IPV4)
6556874d	34	return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0;
ee999d8b	35	else if (l3proto == NFPROTO_IPV6)
64eb12f9 JE	36	return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6,
	37	&uaddr->in6) == 0;
	38	else
	39	return false;
	40	}
	41
	42	static inline bool
	43	conntrack_mt_origsrc(const struct nf_conn *ct,
d6d3f08b	44	const struct xt_conntrack_mtinfo2 *info,
76108cea	45	u_int8_t family)
64eb12f9 JE	46	{
	47	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
	48	&info->origsrc_addr, &info->origsrc_mask, family);
	49	}
	50
	51	static inline bool
	52	conntrack_mt_origdst(const struct nf_conn *ct,
d6d3f08b	53	const struct xt_conntrack_mtinfo2 *info,
76108cea	54	u_int8_t family)
64eb12f9 JE	55	{
	56	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
	57	&info->origdst_addr, &info->origdst_mask, family);
	58	}
	59
	60	static inline bool
	61	conntrack_mt_replsrc(const struct nf_conn *ct,
d6d3f08b	62	const struct xt_conntrack_mtinfo2 *info,
76108cea	63	u_int8_t family)
64eb12f9 JE	64	{
	65	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3,
	66	&info->replsrc_addr, &info->replsrc_mask, family);
	67	}
	68
	69	static inline bool
	70	conntrack_mt_repldst(const struct nf_conn *ct,
d6d3f08b	71	const struct xt_conntrack_mtinfo2 *info,
76108cea	72	u_int8_t family)
64eb12f9 JE	73	{
	74	return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3,
	75	&info->repldst_addr, &info->repldst_mask, family);
	76	}
	77
b4164998	78	static inline bool
d6d3f08b	79	ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info,
b4164998 JE	80	const struct nf_conn *ct)
	81	{
	82	const struct nf_conntrack_tuple *tuple;
	83
	84	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	85	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
5e8fbe2a	86	(nf_ct_protonum(ct) == info->l4proto) ^
b4164998 JE	87	!(info->invert_flags & XT_CONNTRACK_PROTO))
	88	return false;
	89
	90	/* Shortcut to match all recognized protocols by using ->src.all. */
	91	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	92	(tuple->src.u.all == info->origsrc_port) ^
	93	!(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
	94	return false;
	95
	96	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	97	(tuple->dst.u.all == info->origdst_port) ^
	98	!(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
	99	return false;
	100
	101	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
	102
	103	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	104	(tuple->src.u.all == info->replsrc_port) ^
	105	!(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
	106	return false;
	107
	108	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	109	(tuple->dst.u.all == info->repldst_port) ^
	110	!(info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
	111	return false;
	112
	113	return true;
	114	}
	115
b017900a PM	116	static inline bool
	117	port_match(u16 min, u16 max, u16 port, bool invert)
	118	{
	119	return (port >= min && port <= max) ^ invert;
	120	}
	121
	122	static inline bool
	123	ct_proto_port_check_v3(const struct xt_conntrack_mtinfo3 *info,
	124	const struct nf_conn *ct)
	125	{
	126	const struct nf_conntrack_tuple *tuple;
	127
	128	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
	129	if ((info->match_flags & XT_CONNTRACK_PROTO) &&
	130	(nf_ct_protonum(ct) == info->l4proto) ^
	131	!(info->invert_flags & XT_CONNTRACK_PROTO))
	132	return false;
	133
	134	/* Shortcut to match all recognized protocols by using ->src.all. */
	135	if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
	136	!port_match(info->origsrc_port, info->origsrc_port_high,
	137	ntohs(tuple->src.u.all),
	138	info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
	139	return false;
	140
	141	if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
	142	!port_match(info->origdst_port, info->origdst_port_high,
	143	ntohs(tuple->dst.u.all),
	144	info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
	145	return false;
	146
	147	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
	148
	149	if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
	150	!port_match(info->replsrc_port, info->replsrc_port_high,
	151	ntohs(tuple->src.u.all),
	152	info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
	153	return false;
	154
	155	if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
	156	!port_match(info->repldst_port, info->repldst_port_high,
	157	ntohs(tuple->dst.u.all),
	158	info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
	159	return false;
	160
	161	return true;
	162	}
	163
64eb12f9	164	static bool
62fc8051	165	conntrack_mt(const struct sk_buff skb, struct xt_action_param par,
3a042929	166	u16 state_mask, u16 status_mask)
64eb12f9	167	{
d6d3f08b	168	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
64eb12f9 JE	169	enum ip_conntrack_info ctinfo;
	170	const struct nf_conn *ct;
	171	unsigned int statebit;
	172
	173	ct = nf_ct_get(skb, &ctinfo);
	174
5bfddbd4 ED	175	if (ct) {
	176	if (nf_ct_is_untracked(ct))
	177	statebit = XT_CONNTRACK_STATE_UNTRACKED;
	178	else
	179	statebit = XT_CONNTRACK_STATE_BIT(ctinfo);
	180	} else
64eb12f9 JE	181	statebit = XT_CONNTRACK_STATE_INVALID;
	182
	183	if (info->match_flags & XT_CONNTRACK_STATE) {
	184	if (ct != NULL) {
	185	if (test_bit(IPS_SRC_NAT_BIT, &ct->status))
	186	statebit \|= XT_CONNTRACK_STATE_SNAT;
	187	if (test_bit(IPS_DST_NAT_BIT, &ct->status))
	188	statebit \|= XT_CONNTRACK_STATE_DNAT;
	189	}
3a042929	190	if (!!(state_mask & statebit) ^
64eb12f9 JE	191	!(info->invert_flags & XT_CONNTRACK_STATE))
	192	return false;
	193	}
	194
	195	if (ct == NULL)
	196	return info->match_flags & XT_CONNTRACK_STATE;
b4164998 JE	197	if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
b4164998 JE	198	(CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
96120d86	199	!(info->invert_flags & XT_CONNTRACK_DIRECTION))
64eb12f9 JE	200	return false;
	201
	202	if (info->match_flags & XT_CONNTRACK_ORIGSRC)
92f3b2b1	203	if (conntrack_mt_origsrc(ct, info, par->family) ^
64eb12f9 JE	204	!(info->invert_flags & XT_CONNTRACK_ORIGSRC))
	205	return false;
	206
	207	if (info->match_flags & XT_CONNTRACK_ORIGDST)
92f3b2b1	208	if (conntrack_mt_origdst(ct, info, par->family) ^
64eb12f9 JE	209	!(info->invert_flags & XT_CONNTRACK_ORIGDST))
	210	return false;
	211
	212	if (info->match_flags & XT_CONNTRACK_REPLSRC)
92f3b2b1	213	if (conntrack_mt_replsrc(ct, info, par->family) ^
64eb12f9 JE	214	!(info->invert_flags & XT_CONNTRACK_REPLSRC))
	215	return false;
	216
	217	if (info->match_flags & XT_CONNTRACK_REPLDST)
92f3b2b1	218	if (conntrack_mt_repldst(ct, info, par->family) ^
64eb12f9 JE	219	!(info->invert_flags & XT_CONNTRACK_REPLDST))
	220	return false;
	221
b017900a PM	222	if (par->match->revision != 3) {
	223	if (!ct_proto_port_check(info, ct))
	224	return false;
	225	} else {
	226	if (!ct_proto_port_check_v3(par->matchinfo, ct))
	227	return false;
	228	}
b4164998	229
64eb12f9	230	if ((info->match_flags & XT_CONNTRACK_STATUS) &&
3a042929	231	(!!(status_mask & ct->status) ^
64eb12f9 JE	232	!(info->invert_flags & XT_CONNTRACK_STATUS)))
	233	return false;
	234
	235	if (info->match_flags & XT_CONNTRACK_EXPIRES) {
	236	unsigned long expires = 0;
	237
	238	if (timer_pending(&ct->timeout))
	239	expires = (ct->timeout.expires - jiffies) / HZ;
	240	if ((expires >= info->expires_min &&
	241	expires <= info->expires_max) ^
	242	!(info->invert_flags & XT_CONNTRACK_EXPIRES))
	243	return false;
	244	}
	245	return true;
	246	}
	247
d6d3f08b	248	static bool
62fc8051	249	conntrack_mt_v1(const struct sk_buff skb, struct xt_action_param par)
d6d3f08b	250	{
3a042929	251	const struct xt_conntrack_mtinfo1 *info = par->matchinfo;
d6d3f08b	252
3a042929 FW	253	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
	254	}
	255
	256	static bool
62fc8051	257	conntrack_mt_v2(const struct sk_buff skb, struct xt_action_param par)
3a042929 FW	258	{
	259	const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
	260
	261	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
d6d3f08b JE	262	}
d6d3f08b JE	263
b017900a PM	264	static bool
	265	conntrack_mt_v3(const struct sk_buff skb, struct xt_action_param par)
	266	{
	267	const struct xt_conntrack_mtinfo3 *info = par->matchinfo;
	268
	269	return conntrack_mt(skb, par, info->state_mask, info->status_mask);
	270	}
	271
b0f38452	272	static int conntrack_mt_check(const struct xt_mtchk_param *par)
b9f78f9f	273	{
4a5a5c73 JE	274	int ret;
	275
	276	ret = nf_ct_l3proto_try_module_get(par->family);
f95c74e3	277	if (ret < 0)
8bee4bad JE	278	pr_info("cannot load conntrack support for proto=%u\n",
8bee4bad JE	279	par->family);
f95c74e3	280	return ret;
b9f78f9f PNA	281	}
b9f78f9f PNA	282
6be3d859	283	static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
b9f78f9f	284	{
92f3b2b1	285	nf_ct_l3proto_module_put(par->family);
b9f78f9f PNA	286	}
b9f78f9f PNA	287
64eb12f9	288	static struct xt_match conntrack_mt_reg[] __read_mostly = {
64eb12f9 JE	289	{
	290	.name = "conntrack",
	291	.revision = 1,
92f3b2b1	292	.family = NFPROTO_UNSPEC,
64eb12f9	293	.matchsize = sizeof(struct xt_conntrack_mtinfo1),
d6d3f08b	294	.match = conntrack_mt_v1,
3a042929 FW	295	.checkentry = conntrack_mt_check,
3a042929 FW	296	.destroy = conntrack_mt_destroy,
d6d3f08b JE	297	.me = THIS_MODULE,
	298	},
	299	{
	300	.name = "conntrack",
	301	.revision = 2,
	302	.family = NFPROTO_UNSPEC,
	303	.matchsize = sizeof(struct xt_conntrack_mtinfo2),
3a042929	304	.match = conntrack_mt_v2,
64eb12f9 JE	305	.checkentry = conntrack_mt_check,
	306	.destroy = conntrack_mt_destroy,
	307	.me = THIS_MODULE,
	308	},
b017900a PM	309	{
	310	.name = "conntrack",
	311	.revision = 3,
	312	.family = NFPROTO_UNSPEC,
	313	.matchsize = sizeof(struct xt_conntrack_mtinfo3),
	314	.match = conntrack_mt_v3,
	315	.checkentry = conntrack_mt_check,
	316	.destroy = conntrack_mt_destroy,
	317	.me = THIS_MODULE,
	318	},
1da177e4 LT	319	};
1da177e4 LT	320
d3c5ee6d	321	static int __init conntrack_mt_init(void)
1da177e4	322	{
64eb12f9 JE	323	return xt_register_matches(conntrack_mt_reg,
64eb12f9 JE	324	ARRAY_SIZE(conntrack_mt_reg));
1da177e4 LT	325	}
1da177e4 LT	326
d3c5ee6d	327	static void __exit conntrack_mt_exit(void)
1da177e4	328	{
64eb12f9	329	xt_unregister_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg));
1da177e4 LT	330	}
1da177e4 LT	331
d3c5ee6d JE	332	module_init(conntrack_mt_init);
d3c5ee6d JE	333	module_exit(conntrack_mt_exit);