1 /* 2 * Xtables module for matching the value of the IPv4/IPv6 and TCP ECN bits 3 * 4 * (C) 2002 by Harald Welte <laforge@gnumonks.org> 5 * (C) 2011 Patrick McHardy <kaber@trash.net> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 12 #include <linux/in.h> 13 #include <linux/ip.h> 14 #include <net/ip.h> 15 #include <linux/module.h> 16 #include <linux/skbuff.h> 17 #include <linux/tcp.h> 18 19 #include <linux/netfilter/x_tables.h> 20 #include <linux/netfilter/xt_ecn.h> 21 #include <linux/netfilter_ipv4/ip_tables.h> 22 #include <linux/netfilter_ipv6/ip6_tables.h> 23 24 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); 25 MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match"); 26 MODULE_LICENSE("GPL"); 27 MODULE_ALIAS("ipt_ecn"); 28 MODULE_ALIAS("ip6t_ecn"); 29 30 static bool match_tcp(const struct sk_buff *skb, struct xt_action_param *par) 31 { 32 const struct xt_ecn_info *einfo = par->matchinfo; 33 struct tcphdr _tcph; 34 const struct tcphdr *th; 35 36 /* In practice, TCP match does this, so can't fail. But let's 37 * be good citizens. 38 */ 39 th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph); 40 if (th == NULL) 41 return false; 42 43 if (einfo->operation & XT_ECN_OP_MATCH_ECE) { 44 if (einfo->invert & XT_ECN_OP_MATCH_ECE) { 45 if (th->ece == 1) 46 return false; 47 } else { 48 if (th->ece == 0) 49 return false; 50 } 51 } 52 53 if (einfo->operation & XT_ECN_OP_MATCH_CWR) { 54 if (einfo->invert & XT_ECN_OP_MATCH_CWR) { 55 if (th->cwr == 1) 56 return false; 57 } else { 58 if (th->cwr == 0) 59 return false; 60 } 61 } 62 63 return true; 64 } 65 66 static inline bool match_ip(const struct sk_buff *skb, 67 const struct xt_ecn_info *einfo) 68 { 69 return ((ip_hdr(skb)->tos & XT_ECN_IP_MASK) == einfo->ip_ect) ^ 70 !!(einfo->invert & XT_ECN_OP_MATCH_IP); 71 } 72 73 static bool ecn_mt4(const struct sk_buff *skb, struct xt_action_param *par) 74 { 75 const struct xt_ecn_info *info = par->matchinfo; 76 77 if (info->operation & XT_ECN_OP_MATCH_IP && !match_ip(skb, info)) 78 return false; 79 80 if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) && 81 !match_tcp(skb, par)) 82 return false; 83 84 return true; 85 } 86 87 static int ecn_mt_check4(const struct xt_mtchk_param *par) 88 { 89 const struct xt_ecn_info *info = par->matchinfo; 90 const struct ipt_ip *ip = par->entryinfo; 91 92 if (info->operation & XT_ECN_OP_MATCH_MASK) 93 return -EINVAL; 94 95 if (info->invert & XT_ECN_OP_MATCH_MASK) 96 return -EINVAL; 97 98 if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) && 99 (ip->proto != IPPROTO_TCP || ip->invflags & IPT_INV_PROTO)) { 100 pr_info("cannot match TCP bits in rule for non-tcp packets\n"); 101 return -EINVAL; 102 } 103 104 return 0; 105 } 106 107 static inline bool match_ipv6(const struct sk_buff *skb, 108 const struct xt_ecn_info *einfo) 109 { 110 return (((ipv6_hdr(skb)->flow_lbl[0] >> 4) & XT_ECN_IP_MASK) == 111 einfo->ip_ect) ^ 112 !!(einfo->invert & XT_ECN_OP_MATCH_IP); 113 } 114 115 static bool ecn_mt6(const struct sk_buff *skb, struct xt_action_param *par) 116 { 117 const struct xt_ecn_info *info = par->matchinfo; 118 119 if (info->operation & XT_ECN_OP_MATCH_IP && !match_ipv6(skb, info)) 120 return false; 121 122 if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) && 123 !match_tcp(skb, par)) 124 return false; 125 126 return true; 127 } 128 129 static int ecn_mt_check6(const struct xt_mtchk_param *par) 130 { 131 const struct xt_ecn_info *info = par->matchinfo; 132 const struct ip6t_ip6 *ip = par->entryinfo; 133 134 if (info->operation & XT_ECN_OP_MATCH_MASK) 135 return -EINVAL; 136 137 if (info->invert & XT_ECN_OP_MATCH_MASK) 138 return -EINVAL; 139 140 if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) && 141 (ip->proto != IPPROTO_TCP || ip->invflags & IP6T_INV_PROTO)) { 142 pr_info("cannot match TCP bits in rule for non-tcp packets\n"); 143 return -EINVAL; 144 } 145 146 return 0; 147 } 148 149 static struct xt_match ecn_mt_reg[] __read_mostly = { 150 { 151 .name = "ecn", 152 .family = NFPROTO_IPV4, 153 .match = ecn_mt4, 154 .matchsize = sizeof(struct xt_ecn_info), 155 .checkentry = ecn_mt_check4, 156 .me = THIS_MODULE, 157 }, 158 { 159 .name = "ecn", 160 .family = NFPROTO_IPV6, 161 .match = ecn_mt6, 162 .matchsize = sizeof(struct xt_ecn_info), 163 .checkentry = ecn_mt_check6, 164 .me = THIS_MODULE, 165 }, 166 }; 167 168 static int __init ecn_mt_init(void) 169 { 170 return xt_register_matches(ecn_mt_reg, ARRAY_SIZE(ecn_mt_reg)); 171 } 172 173 static void __exit ecn_mt_exit(void) 174 { 175 xt_unregister_matches(ecn_mt_reg, ARRAY_SIZE(ecn_mt_reg)); 176 } 177 178 module_init(ecn_mt_init); 179 module_exit(ecn_mt_exit); 180