1 /* Shared library add-on to iptables for ECN, $Version$
3 * (C) 2002 by Harald Welte <laforge@gnumonks.org>
5 * This program is distributed under the terms of GNU GPL v2, 1991
7 * libipt_ECN.c borrowed heavily from libipt_DSCP.c
9 * $Id: libipt_ECN.c 3507 2004-12-28 13:11:59Z /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=rusty/emailAddress=rusty@netfilter.org $
17 #include <linux/netfilter_ipv4/ip_tables.h>
18 #include <linux/netfilter_ipv4/ipt_ECN.h>
20 static void init(struct ipt_entry_target *t, unsigned int *nfcache)
24 static void help(void)
27 "ECN target v%s options\n"
28 " --ecn-tcp-remove Remove all ECN bits from TCP header\n",
33 "ECN target v%s EXPERIMENTAL options (use with extreme care!)\n"
34 " --ecn-ip-ect Set the IPv4 ECT codepoint (0 to 3)\n"
35 " --ecn-tcp-cwr Set the IPv4 CWR bit (0 or 1)\n"
36 " --ecn-tcp-ece Set the IPv4 ECE bit (0 or 1)\n",
40 static struct option opts[] = {
41 { "ecn-tcp-remove", 0, 0, 'F' },
42 { "ecn-tcp-cwr", 1, 0, 'G' },
43 { "ecn-tcp-ece", 1, 0, 'H' },
44 { "ecn-ip-ect", 1, 0, '9' },
49 parse(int c, char **argv, int invert, unsigned int *flags,
50 const struct ipt_entry *entry,
51 struct ipt_entry_target **target)
54 struct ipt_ECN_info *einfo
55 = (struct ipt_ECN_info *)(*target)->data;
60 exit_error(PARAMETER_PROBLEM,
61 "ECN target: Only use --ecn-tcp-remove ONCE!");
62 einfo->operation = IPT_ECN_OP_SET_ECE | IPT_ECN_OP_SET_CWR;
63 einfo->proto.tcp.ece = 0;
64 einfo->proto.tcp.cwr = 0;
68 if (*flags & IPT_ECN_OP_SET_CWR)
69 exit_error(PARAMETER_PROBLEM,
70 "ECN target: Only use --ecn-tcp-cwr ONCE!");
71 if (string_to_number(optarg, 0, 1, &result))
72 exit_error(PARAMETER_PROBLEM,
73 "ECN target: Value out of range");
74 einfo->operation |= IPT_ECN_OP_SET_CWR;
75 einfo->proto.tcp.cwr = result;
76 *flags |= IPT_ECN_OP_SET_CWR;
79 if (*flags & IPT_ECN_OP_SET_ECE)
80 exit_error(PARAMETER_PROBLEM,
81 "ECN target: Only use --ecn-tcp-ece ONCE!");
82 if (string_to_number(optarg, 0, 1, &result))
83 exit_error(PARAMETER_PROBLEM,
84 "ECN target: Value out of range");
85 einfo->operation |= IPT_ECN_OP_SET_ECE;
86 einfo->proto.tcp.ece = result;
87 *flags |= IPT_ECN_OP_SET_ECE;
90 if (*flags & IPT_ECN_OP_SET_IP)
91 exit_error(PARAMETER_PROBLEM,
92 "ECN target: Only use --ecn-ip-ect ONCE!");
93 if (string_to_number(optarg, 0, 3, &result))
94 exit_error(PARAMETER_PROBLEM,
95 "ECN target: Value out of range");
96 einfo->operation |= IPT_ECN_OP_SET_IP;
97 einfo->ip_ect = result;
98 *flags |= IPT_ECN_OP_SET_IP;
108 final_check(unsigned int flags)
111 exit_error(PARAMETER_PROBLEM,
112 "ECN target: Parameter --ecn-tcp-remove is required");
115 /* Prints out the targinfo. */
117 print(const struct ipt_ip *ip,
118 const struct ipt_entry_target *target,
121 const struct ipt_ECN_info *einfo =
122 (const struct ipt_ECN_info *)target->data;
126 if (einfo->operation == (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR)
127 && einfo->proto.tcp.ece == 0
128 && einfo->proto.tcp.cwr == 0)
129 printf("TCP remove ");
131 if (einfo->operation & IPT_ECN_OP_SET_ECE)
132 printf("ECE=%u ", einfo->proto.tcp.ece);
134 if (einfo->operation & IPT_ECN_OP_SET_CWR)
135 printf("CWR=%u ", einfo->proto.tcp.cwr);
137 if (einfo->operation & IPT_ECN_OP_SET_IP)
138 printf("ECT codepoint=%u ", einfo->ip_ect);
142 /* Saves the union ipt_targinfo in parsable form to stdout. */
144 save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
146 const struct ipt_ECN_info *einfo =
147 (const struct ipt_ECN_info *)target->data;
149 if (einfo->operation == (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR)
150 && einfo->proto.tcp.ece == 0
151 && einfo->proto.tcp.cwr == 0)
152 printf("--ecn-tcp-remove ");
155 if (einfo->operation & IPT_ECN_OP_SET_ECE)
156 printf("--ecn-tcp-ece %d ", einfo->proto.tcp.ece);
158 if (einfo->operation & IPT_ECN_OP_SET_CWR)
159 printf("--ecn-tcp-cwr %d ", einfo->proto.tcp.cwr);
161 if (einfo->operation & IPT_ECN_OP_SET_IP)
162 printf("--ecn-ip-ect %d ", einfo->ip_ect);
167 struct iptables_target ecn = {
170 .version = IPTABLES_VERSION,
171 .size = IPT_ALIGN(sizeof(struct ipt_ECN_info)),
172 .userspacesize = IPT_ALIGN(sizeof(struct ipt_ECN_info)),
176 .final_check = &final_check,
184 register_target(&ecn);