[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / ipv4 / netfilter / ipt_ecn.c

/* IP tables module for matching the value of the IPv4 and TCP ECN bits
 *
 * (C) 2002 by Harald Welte <laforge@gnumonks.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/in.h>
#include <linux/ip.h>
#include <net/ip.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/tcp.h>

#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ipt_ecn.h>

MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match for IPv4");
MODULE_LICENSE("GPL");

static inline bool match_ip(const struct sk_buff *skb,
			    const struct ipt_ecn_info *einfo)
{
	return (ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect;
}

static inline bool match_tcp(const struct sk_buff *skb,
			     const struct ipt_ecn_info *einfo,
			     bool *hotdrop)
{
	struct tcphdr _tcph;
	const struct tcphdr *th;

	/* In practice, TCP match does this, so can't fail.  But let's
	 * be good citizens.
	 */
	th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
	if (th == NULL) {
		*hotdrop = false;
		return false;
	}

	if (einfo->operation & IPT_ECN_OP_MATCH_ECE) {
		if (einfo->invert & IPT_ECN_OP_MATCH_ECE) {
			if (th->ece == 1)
				return false;
		} else {
			if (th->ece == 0)
				return false;
		}
	}

	if (einfo->operation & IPT_ECN_OP_MATCH_CWR) {
		if (einfo->invert & IPT_ECN_OP_MATCH_CWR) {
			if (th->cwr == 1)
				return false;
		} else {
			if (th->cwr == 0)
				return false;
		}
	}

	return true;
}

static bool ecn_mt(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct ipt_ecn_info *info = par->matchinfo;

	if (info->operation & IPT_ECN_OP_MATCH_IP)
		if (!match_ip(skb, info))
			return false;

	if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) {
		if (ip_hdr(skb)->protocol != IPPROTO_TCP)
			return false;
		if (!match_tcp(skb, info, par->hotdrop))
			return false;
	}

	return true;
}

static int ecn_mt_check(const struct xt_mtchk_param *par)
{
	const struct ipt_ecn_info *info = par->matchinfo;
	const struct ipt_ip *ip = par->entryinfo;

	if (info->operation & IPT_ECN_OP_MATCH_MASK)
		return false;

	if (info->invert & IPT_ECN_OP_MATCH_MASK)
		return false;

	if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR) &&
	    ip->proto != IPPROTO_TCP) {
		pr_info("cannot match TCP bits in rule for non-tcp packets\n");
		return false;
	}

	return true;
}

static struct xt_match ecn_mt_reg __read_mostly = {
	.name		= "ecn",
	.family		= NFPROTO_IPV4,
	.match		= ecn_mt,
	.matchsize	= sizeof(struct ipt_ecn_info),
	.checkentry	= ecn_mt_check,
	.me		= THIS_MODULE,
};

static int __init ecn_mt_init(void)
{
	return xt_register_match(&ecn_mt_reg);
}

static void __exit ecn_mt_exit(void)
{
	xt_unregister_match(&ecn_mt_reg);
}

module_init(ecn_mt_init);
module_exit(ecn_mt_exit);
Commit	Line	Data
1da177e4 LT	1	/* IP tables module for matching the value of the IPv4 and TCP ECN bits
1da177e4 LT	2	*
1da177e4 LT	3	* (C) 2002 by Harald Welte <laforge@gnumonks.org>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation.
	8	*/
ff67e4e4	9	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
6709dbbb JE	10	#include <linux/in.h>
6709dbbb JE	11	#include <linux/ip.h>
c9bdd4b5	12	#include <net/ip.h>
1da177e4 LT	13	#include <linux/module.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/tcp.h>
	16
6709dbbb	17	#include <linux/netfilter/x_tables.h>
1da177e4 LT	18	#include <linux/netfilter_ipv4/ip_tables.h>
	19	#include <linux/netfilter_ipv4/ipt_ecn.h>
	20
	21	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
2ae15b64	22	MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match for IPv4");
1da177e4 LT	23	MODULE_LICENSE("GPL");
1da177e4 LT	24
1d93a9cb JE	25	static inline bool match_ip(const struct sk_buff *skb,
1d93a9cb JE	26	const struct ipt_ecn_info *einfo)
1da177e4	27	{
eddc9ec5	28	return (ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect;
1da177e4 LT	29	}
1da177e4 LT	30
1d93a9cb JE	31	static inline bool match_tcp(const struct sk_buff *skb,
	32	const struct ipt_ecn_info *einfo,
	33	bool *hotdrop)
1da177e4	34	{
a47362a2 JE	35	struct tcphdr _tcph;
a47362a2 JE	36	const struct tcphdr *th;
1da177e4 LT	37
	38	/* In practice, TCP match does this, so can't fail. But let's
	39	* be good citizens.
	40	*/
c9bdd4b5	41	th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
1da177e4	42	if (th == NULL) {
cff533ac	43	*hotdrop = false;
1d93a9cb	44	return false;
1da177e4 LT	45	}
	46
	47	if (einfo->operation & IPT_ECN_OP_MATCH_ECE) {
	48	if (einfo->invert & IPT_ECN_OP_MATCH_ECE) {
	49	if (th->ece == 1)
1d93a9cb	50	return false;
1da177e4 LT	51	} else {
1da177e4 LT	52	if (th->ece == 0)
1d93a9cb	53	return false;
1da177e4 LT	54	}
	55	}
	56
	57	if (einfo->operation & IPT_ECN_OP_MATCH_CWR) {
	58	if (einfo->invert & IPT_ECN_OP_MATCH_CWR) {
	59	if (th->cwr == 1)
1d93a9cb	60	return false;
1da177e4 LT	61	} else {
1da177e4 LT	62	if (th->cwr == 0)
1d93a9cb	63	return false;
1da177e4 LT	64	}
	65	}
	66
1d93a9cb	67	return true;
1da177e4 LT	68	}
1da177e4 LT	69
f7108a20	70	static bool ecn_mt(const struct sk_buff skb, const struct xt_match_param par)
1da177e4	71	{
f7108a20	72	const struct ipt_ecn_info *info = par->matchinfo;
1da177e4 LT	73
	74	if (info->operation & IPT_ECN_OP_MATCH_IP)
	75	if (!match_ip(skb, info))
1d93a9cb	76	return false;
1da177e4 LT	77
1da177e4 LT	78	if (info->operation & (IPT_ECN_OP_MATCH_ECE\|IPT_ECN_OP_MATCH_CWR)) {
eddc9ec5	79	if (ip_hdr(skb)->protocol != IPPROTO_TCP)
1d93a9cb	80	return false;
f7108a20	81	if (!match_tcp(skb, info, par->hotdrop))
1d93a9cb	82	return false;
1da177e4 LT	83	}
1da177e4 LT	84
1d93a9cb	85	return true;
1da177e4 LT	86	}
1da177e4 LT	87
b0f38452	88	static int ecn_mt_check(const struct xt_mtchk_param *par)
1da177e4	89	{
9b4fce7a JE	90	const struct ipt_ecn_info *info = par->matchinfo;
9b4fce7a JE	91	const struct ipt_ip *ip = par->entryinfo;
1da177e4	92
1da177e4	93	if (info->operation & IPT_ECN_OP_MATCH_MASK)
ccb79bdc	94	return false;
1da177e4 LT	95
1da177e4 LT	96	if (info->invert & IPT_ECN_OP_MATCH_MASK)
ccb79bdc	97	return false;
1da177e4	98
3666ed1c JP	99	if (info->operation & (IPT_ECN_OP_MATCH_ECE\|IPT_ECN_OP_MATCH_CWR) &&
3666ed1c JP	100	ip->proto != IPPROTO_TCP) {
ff67e4e4	101	pr_info("cannot match TCP bits in rule for non-tcp packets\n");
ccb79bdc	102	return false;
1da177e4 LT	103	}
1da177e4 LT	104
ccb79bdc	105	return true;
1da177e4 LT	106	}
1da177e4 LT	107
d3c5ee6d	108	static struct xt_match ecn_mt_reg __read_mostly = {
1da177e4	109	.name = "ecn",
ee999d8b	110	.family = NFPROTO_IPV4,
d3c5ee6d	111	.match = ecn_mt,
1d5cd909	112	.matchsize = sizeof(struct ipt_ecn_info),
d3c5ee6d	113	.checkentry = ecn_mt_check,
1da177e4 LT	114	.me = THIS_MODULE,
	115	};
	116
d3c5ee6d	117	static int __init ecn_mt_init(void)
1da177e4	118	{
d3c5ee6d	119	return xt_register_match(&ecn_mt_reg);
1da177e4 LT	120	}
1da177e4 LT	121
d3c5ee6d	122	static void __exit ecn_mt_exit(void)
1da177e4	123	{
d3c5ee6d	124	xt_unregister_match(&ecn_mt_reg);
1da177e4 LT	125	}
1da177e4 LT	126
d3c5ee6d JE	127	module_init(ecn_mt_init);
d3c5ee6d JE	128	module_exit(ecn_mt_exit);