diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-03-15 13:38:36 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-03-15 17:42:59 +0100 |
| commit | be414e5c3c6c094427714d8fffa153a99a8d5031 (patch) | |
| tree | 866efcd75016b92106bb517f267f1dc30aac5aea /src | |
| parent | 90104da9632e80f14bdde7ca5545405a0145c8d9 (diff) | |
conntrack: pass cmd to filter nat, mark and network functions
Pass the command object to the nat, mark and IP address userspace
filters.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/conntrack.c | 21 |
1 files changed, 11 insertions, 10 deletions
diff --git a/src/conntrack.c b/src/conntrack.c index 79053b7..152063e 100644 --- a/src/conntrack.c +++ b/src/conntrack.c @@ -1490,20 +1490,21 @@ filter_label(const struct nf_conntrack *ct, const struct ct_tmpl *tmpl) return 0; } -static int -filter_mark(const struct nf_conntrack *ct, const struct ct_tmpl *tmpl) +static int filter_mark(const struct ct_cmd *cmd, const struct nf_conntrack *ct) { + const struct ct_tmpl *tmpl = &cmd->tmpl; + if ((options & CT_OPT_MARK) && !mark_cmp(&tmpl->mark, ct)) return 1; return 0; } -static int -filter_nat(const struct nf_conntrack *obj, const struct nf_conntrack *ct) +static int filter_nat(const struct ct_cmd *cmd, const struct nf_conntrack *ct) { int check_srcnat = options & CT_OPT_SRC_NAT ? 1 : 0; int check_dstnat = options & CT_OPT_DST_NAT ? 1 : 0; + struct nf_conntrack *obj = cmd->tmpl.ct; int has_srcnat = 0, has_dstnat = 0; uint32_t ip; uint16_t port; @@ -1625,7 +1626,7 @@ nfct_filter_network_direction(const struct nf_conntrack *ct, enum ct_direction d } static int -filter_network(const struct nf_conntrack *ct) +filter_network(const struct ct_cmd *cmd, const struct nf_conntrack *ct) { if (options & CT_OPT_MASK_SRC) { if (nfct_filter_network_direction(ct, DIR_SRC)) @@ -1645,10 +1646,10 @@ nfct_filter(struct ct_cmd *cmd, struct nf_conntrack *ct, { struct nf_conntrack *obj = cmd->tmpl.ct; - if (filter_nat(obj, ct) || - filter_mark(ct, tmpl) || + if (filter_nat(cmd, ct) || + filter_mark(cmd, ct) || filter_label(ct, tmpl) || - filter_network(ct)) + filter_network(cmd, ct)) return 1; if (options & CT_COMPARISON && @@ -2142,9 +2143,9 @@ static int update_cb(enum nf_conntrack_msg_type type, struct nf_conntrack *obj = cmd->tmpl.ct, *tmp; int res; - if (filter_nat(obj, ct) || + if (filter_nat(cmd, ct) || filter_label(ct, cur_tmpl) || - filter_network(ct)) + filter_network(cmd, ct)) return NFCT_CB_CONTINUE; if (nfct_attr_is_set(obj, ATTR_ID) && nfct_attr_is_set(ct, ATTR_ID) && |