1 /* IP tables module for matching the value of the IPv4 and TCP ECN bits
3 * ipt_ecn.c,v 1.3 2002/05/29 15:09:00 laforge Exp
5 * (C) 2002 by Harald Welte <laforge@gnumonks.org>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #include <linux/module.h>
13 #include <linux/skbuff.h>
14 #include <linux/tcp.h>
16 #include <linux/netfilter_ipv4/ip_tables.h>
17 #include <linux/netfilter_ipv4/ipt_ecn.h>
19 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
20 MODULE_DESCRIPTION("iptables ECN matching module");
21 MODULE_LICENSE("GPL");
23 static inline int match_ip(const struct sk_buff *skb,
24 const struct ipt_ecn_info *einfo)
26 return ((skb->nh.iph->tos&IPT_ECN_IP_MASK) == einfo->ip_ect);
29 static inline int match_tcp(const struct sk_buff *skb,
30 const struct ipt_ecn_info *einfo,
35 /* In practice, TCP match does this, so can't fail. But let's
37 if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &tcph, sizeof(tcph)) < 0) {
42 if (einfo->operation & IPT_ECN_OP_MATCH_ECE) {
43 if (einfo->invert & IPT_ECN_OP_MATCH_ECE) {
52 if (einfo->operation & IPT_ECN_OP_MATCH_CWR) {
53 if (einfo->invert & IPT_ECN_OP_MATCH_CWR) {
65 static int match(const struct sk_buff *skb, const struct net_device *in,
66 const struct net_device *out, const void *matchinfo,
67 int offset, int *hotdrop)
69 const struct ipt_ecn_info *info = matchinfo;
71 if (info->operation & IPT_ECN_OP_MATCH_IP)
72 if (!match_ip(skb, info))
75 if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) {
76 if (skb->nh.iph->protocol != IPPROTO_TCP)
78 if (!match_tcp(skb, info, hotdrop))
85 static int checkentry(const char *tablename, const struct ipt_ip *ip,
86 void *matchinfo, unsigned int matchsize,
87 unsigned int hook_mask)
89 const struct ipt_ecn_info *info = matchinfo;
91 if (matchsize != IPT_ALIGN(sizeof(struct ipt_ecn_info)))
94 if (info->operation & IPT_ECN_OP_MATCH_MASK)
97 if (info->invert & IPT_ECN_OP_MATCH_MASK)
100 if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)
101 && ip->proto != IPPROTO_TCP) {
102 printk(KERN_WARNING "ipt_ecn: can't match TCP bits in rule for"
103 " non-tcp packets\n");
110 static struct ipt_match ecn_match = {
113 .checkentry = &checkentry,
117 static int __init init(void)
119 return ipt_register_match(&ecn_match);
122 static void __exit fini(void)
124 ipt_unregister_match(&ecn_match);