[deliverable/linux.git] / net / ipv4 / netfilter / ipt_ecn.c

/* IP tables module for matching the value of the IPv4 and TCP ECN bits
 *
 * ipt_ecn.c,v 1.3 2002/05/29 15:09:00 laforge Exp
 *
 * (C) 2002 by Harald Welte <laforge@gnumonks.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/in.h>
#include <linux/ip.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/tcp.h>

#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ipt_ecn.h>

MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("iptables ECN matching module");
MODULE_LICENSE("GPL");

static inline int match_ip(const struct sk_buff *skb,
			   const struct ipt_ecn_info *einfo)
{
	return ((skb->nh.iph->tos&IPT_ECN_IP_MASK) == einfo->ip_ect);
}

static inline int match_tcp(const struct sk_buff *skb,
			    const struct ipt_ecn_info *einfo,
			    int *hotdrop)
{
	struct tcphdr _tcph, *th;

	/* In practice, TCP match does this, so can't fail.  But let's
	 * be good citizens.
	 */
	th = skb_header_pointer(skb, skb->nh.iph->ihl * 4,
				sizeof(_tcph), &_tcph);
	if (th == NULL) {
		*hotdrop = 0;
		return 0;
	}

	if (einfo->operation & IPT_ECN_OP_MATCH_ECE) {
		if (einfo->invert & IPT_ECN_OP_MATCH_ECE) {
			if (th->ece == 1)
				return 0;
		} else {
			if (th->ece == 0)
				return 0;
		}
	}

	if (einfo->operation & IPT_ECN_OP_MATCH_CWR) {
		if (einfo->invert & IPT_ECN_OP_MATCH_CWR) {
			if (th->cwr == 1)
				return 0;
		} else {
			if (th->cwr == 0)
				return 0;
		}
	}

	return 1;
}

static int match(const struct sk_buff *skb,
		 const struct net_device *in, const struct net_device *out,
		 const struct xt_match *match, const void *matchinfo,
		 int offset, unsigned int protoff, int *hotdrop)
{
	const struct ipt_ecn_info *info = matchinfo;

	if (info->operation & IPT_ECN_OP_MATCH_IP)
		if (!match_ip(skb, info))
			return 0;

	if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) {
		if (skb->nh.iph->protocol != IPPROTO_TCP)
			return 0;
		if (!match_tcp(skb, info, hotdrop))
			return 0;
	}

	return 1;
}

static int checkentry(const char *tablename, const void *ip_void,
		      const struct xt_match *match,
		      void *matchinfo, unsigned int hook_mask)
{
	const struct ipt_ecn_info *info = matchinfo;
	const struct ipt_ip *ip = ip_void;

	if (info->operation & IPT_ECN_OP_MATCH_MASK)
		return 0;

	if (info->invert & IPT_ECN_OP_MATCH_MASK)
		return 0;

	if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)
	    && ip->proto != IPPROTO_TCP) {
		printk(KERN_WARNING "ipt_ecn: can't match TCP bits in rule for"
		       " non-tcp packets\n");
		return 0;
	}

	return 1;
}

static struct xt_match ecn_match = {
	.name		= "ecn",
	.family		= AF_INET,
	.match		= match,
	.matchsize	= sizeof(struct ipt_ecn_info),
	.checkentry	= checkentry,
	.me		= THIS_MODULE,
};

static int __init ipt_ecn_init(void)
{
	return xt_register_match(&ecn_match);
}

static void __exit ipt_ecn_fini(void)
{
	xt_unregister_match(&ecn_match);
}

module_init(ipt_ecn_init);
module_exit(ipt_ecn_fini);
Commit	Line	Data
1da177e4 LT	1	/* IP tables module for matching the value of the IPv4 and TCP ECN bits
	2	*
	3	* ipt_ecn.c,v 1.3 2002/05/29 15:09:00 laforge Exp
	4	*
	5	* (C) 2002 by Harald Welte <laforge@gnumonks.org>
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
	10	*/
	11
6709dbbb JE	12	#include <linux/in.h>
6709dbbb JE	13	#include <linux/ip.h>
1da177e4 LT	14	#include <linux/module.h>
	15	#include <linux/skbuff.h>
	16	#include <linux/tcp.h>
	17
6709dbbb	18	#include <linux/netfilter/x_tables.h>
1da177e4 LT	19	#include <linux/netfilter_ipv4/ip_tables.h>
	20	#include <linux/netfilter_ipv4/ipt_ecn.h>
	21
	22	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
	23	MODULE_DESCRIPTION("iptables ECN matching module");
	24	MODULE_LICENSE("GPL");
	25
	26	static inline int match_ip(const struct sk_buff *skb,
	27	const struct ipt_ecn_info *einfo)
	28	{
	29	return ((skb->nh.iph->tos&IPT_ECN_IP_MASK) == einfo->ip_ect);
	30	}
	31
	32	static inline int match_tcp(const struct sk_buff *skb,
	33	const struct ipt_ecn_info *einfo,
	34	int *hotdrop)
	35	{
	36	struct tcphdr _tcph, *th;
	37
	38	/* In practice, TCP match does this, so can't fail. But let's
	39	* be good citizens.
	40	*/
	41	th = skb_header_pointer(skb, skb->nh.iph->ihl * 4,
	42	sizeof(_tcph), &_tcph);
	43	if (th == NULL) {
	44	*hotdrop = 0;
	45	return 0;
	46	}
	47
	48	if (einfo->operation & IPT_ECN_OP_MATCH_ECE) {
	49	if (einfo->invert & IPT_ECN_OP_MATCH_ECE) {
	50	if (th->ece == 1)
	51	return 0;
	52	} else {
	53	if (th->ece == 0)
	54	return 0;
	55	}
	56	}
	57
	58	if (einfo->operation & IPT_ECN_OP_MATCH_CWR) {
	59	if (einfo->invert & IPT_ECN_OP_MATCH_CWR) {
	60	if (th->cwr == 1)
	61	return 0;
	62	} else {
	63	if (th->cwr == 0)
	64	return 0;
	65	}
	66	}
	67
	68	return 1;
	69	}
	70
c4986734 PM	71	static int match(const struct sk_buff *skb,
	72	const struct net_device in, const struct net_device out,
	73	const struct xt_match match, const void matchinfo,
2e4e6a17	74	int offset, unsigned int protoff, int *hotdrop)
1da177e4 LT	75	{
	76	const struct ipt_ecn_info *info = matchinfo;
	77
	78	if (info->operation & IPT_ECN_OP_MATCH_IP)
	79	if (!match_ip(skb, info))
	80	return 0;
	81
	82	if (info->operation & (IPT_ECN_OP_MATCH_ECE\|IPT_ECN_OP_MATCH_CWR)) {
	83	if (skb->nh.iph->protocol != IPPROTO_TCP)
	84	return 0;
	85	if (!match_tcp(skb, info, hotdrop))
	86	return 0;
	87	}
	88
	89	return 1;
	90	}
	91
2e4e6a17	92	static int checkentry(const char tablename, const void ip_void,
c4986734	93	const struct xt_match *match,
efa74165	94	void *matchinfo, unsigned int hook_mask)
1da177e4 LT	95	{
1da177e4 LT	96	const struct ipt_ecn_info *info = matchinfo;
2e4e6a17	97	const struct ipt_ip *ip = ip_void;
1da177e4	98
1da177e4 LT	99	if (info->operation & IPT_ECN_OP_MATCH_MASK)
	100	return 0;
	101
	102	if (info->invert & IPT_ECN_OP_MATCH_MASK)
	103	return 0;
	104
	105	if (info->operation & (IPT_ECN_OP_MATCH_ECE\|IPT_ECN_OP_MATCH_CWR)
	106	&& ip->proto != IPPROTO_TCP) {
	107	printk(KERN_WARNING "ipt_ecn: can't match TCP bits in rule for"
	108	" non-tcp packets\n");
	109	return 0;
	110	}
	111
	112	return 1;
	113	}
	114
6709dbbb	115	static struct xt_match ecn_match = {
1da177e4	116	.name = "ecn",
6709dbbb	117	.family = AF_INET,
1d5cd909 PM	118	.match = match,
	119	.matchsize = sizeof(struct ipt_ecn_info),
	120	.checkentry = checkentry,
1da177e4 LT	121	.me = THIS_MODULE,
	122	};
	123
65b4b4e8	124	static int __init ipt_ecn_init(void)
1da177e4	125	{
6709dbbb	126	return xt_register_match(&ecn_match);
1da177e4 LT	127	}
1da177e4 LT	128
65b4b4e8	129	static void __exit ipt_ecn_fini(void)
1da177e4	130	{
6709dbbb	131	xt_unregister_match(&ecn_match);
1da177e4 LT	132	}
1da177e4 LT	133
65b4b4e8 AM	134	module_init(ipt_ecn_init);
65b4b4e8 AM	135	module_exit(ipt_ecn_fini);