|
Packit |
7b22a4 |
/* Shared library add-on to iptables for ECN matching
|
|
Packit |
7b22a4 |
*
|
|
Packit |
7b22a4 |
* (C) 2002 by Harald Welte <laforge@netfilter.org>
|
|
Packit |
7b22a4 |
* (C) 2011 by Patrick McHardy <kaber@trash.net>
|
|
Packit |
7b22a4 |
*
|
|
Packit |
7b22a4 |
* This program is distributed under the terms of GNU GPL v2, 1991
|
|
Packit |
7b22a4 |
*
|
|
Packit |
7b22a4 |
* libipt_ecn.c borrowed heavily from libipt_dscp.c
|
|
Packit |
7b22a4 |
*
|
|
Packit |
7b22a4 |
*/
|
|
Packit |
7b22a4 |
#include <stdio.h>
|
|
Packit |
7b22a4 |
#include <xtables.h>
|
|
Packit |
7b22a4 |
#include <linux/netfilter/xt_ecn.h>
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
enum {
|
|
Packit |
7b22a4 |
O_ECN_TCP_CWR = 0,
|
|
Packit |
7b22a4 |
O_ECN_TCP_ECE,
|
|
Packit |
7b22a4 |
O_ECN_IP_ECT,
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void ecn_help(void)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
printf(
|
|
Packit |
7b22a4 |
"ECN match options\n"
|
|
Packit |
7b22a4 |
"[!] --ecn-tcp-cwr Match CWR bit of TCP header\n"
|
|
Packit |
7b22a4 |
"[!] --ecn-tcp-ece Match ECE bit of TCP header\n"
|
|
Packit |
7b22a4 |
"[!] --ecn-ip-ect [0..3] Match ECN codepoint in IPv4/IPv6 header\n");
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static const struct xt_option_entry ecn_opts[] = {
|
|
Packit |
7b22a4 |
{.name = "ecn-tcp-cwr", .id = O_ECN_TCP_CWR, .type = XTTYPE_NONE,
|
|
Packit |
7b22a4 |
.flags = XTOPT_INVERT},
|
|
Packit |
7b22a4 |
{.name = "ecn-tcp-ece", .id = O_ECN_TCP_ECE, .type = XTTYPE_NONE,
|
|
Packit |
7b22a4 |
.flags = XTOPT_INVERT},
|
|
Packit |
7b22a4 |
{.name = "ecn-ip-ect", .id = O_ECN_IP_ECT, .type = XTTYPE_UINT8,
|
|
Packit |
7b22a4 |
.min = 0, .max = 3, .flags = XTOPT_INVERT},
|
|
Packit |
7b22a4 |
XTOPT_TABLEEND,
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void ecn_parse(struct xt_option_call *cb)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct xt_ecn_info *einfo = cb->data;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
xtables_option_parse(cb);
|
|
Packit |
7b22a4 |
switch (cb->entry->id) {
|
|
Packit |
7b22a4 |
case O_ECN_TCP_CWR:
|
|
Packit |
7b22a4 |
einfo->operation |= XT_ECN_OP_MATCH_CWR;
|
|
Packit |
7b22a4 |
if (cb->invert)
|
|
Packit |
7b22a4 |
einfo->invert |= XT_ECN_OP_MATCH_CWR;
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case O_ECN_TCP_ECE:
|
|
Packit |
7b22a4 |
einfo->operation |= XT_ECN_OP_MATCH_ECE;
|
|
Packit |
7b22a4 |
if (cb->invert)
|
|
Packit |
7b22a4 |
einfo->invert |= XT_ECN_OP_MATCH_ECE;
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case O_ECN_IP_ECT:
|
|
Packit |
7b22a4 |
if (cb->invert)
|
|
Packit |
7b22a4 |
einfo->invert |= XT_ECN_OP_MATCH_IP;
|
|
Packit |
7b22a4 |
einfo->operation |= XT_ECN_OP_MATCH_IP;
|
|
Packit |
7b22a4 |
einfo->ip_ect = cb->val.u8;
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void ecn_check(struct xt_fcheck_call *cb)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
if (cb->xflags == 0)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"ECN match: some option required");
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void ecn_print(const void *ip, const struct xt_entry_match *match,
|
|
Packit |
7b22a4 |
int numeric)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const struct xt_ecn_info *einfo =
|
|
Packit |
7b22a4 |
(const struct xt_ecn_info *)match->data;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
printf(" ECN match");
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (einfo->operation & XT_ECN_OP_MATCH_ECE) {
|
|
Packit |
7b22a4 |
printf(" %sECE",
|
|
Packit |
7b22a4 |
(einfo->invert & XT_ECN_OP_MATCH_ECE) ? "!" : "");
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (einfo->operation & XT_ECN_OP_MATCH_CWR) {
|
|
Packit |
7b22a4 |
printf(" %sCWR",
|
|
Packit |
7b22a4 |
(einfo->invert & XT_ECN_OP_MATCH_CWR) ? "!" : "");
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (einfo->operation & XT_ECN_OP_MATCH_IP) {
|
|
Packit |
7b22a4 |
printf(" %sECT=%d",
|
|
Packit |
7b22a4 |
(einfo->invert & XT_ECN_OP_MATCH_IP) ? "!" : "",
|
|
Packit |
7b22a4 |
einfo->ip_ect);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void ecn_save(const void *ip, const struct xt_entry_match *match)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const struct xt_ecn_info *einfo =
|
|
Packit |
7b22a4 |
(const struct xt_ecn_info *)match->data;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (einfo->operation & XT_ECN_OP_MATCH_ECE) {
|
|
Packit |
7b22a4 |
if (einfo->invert & XT_ECN_OP_MATCH_ECE)
|
|
Packit |
7b22a4 |
printf(" !");
|
|
Packit |
7b22a4 |
printf(" --ecn-tcp-ece");
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (einfo->operation & XT_ECN_OP_MATCH_CWR) {
|
|
Packit |
7b22a4 |
if (einfo->invert & XT_ECN_OP_MATCH_CWR)
|
|
Packit |
7b22a4 |
printf(" !");
|
|
Packit |
7b22a4 |
printf(" --ecn-tcp-cwr");
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (einfo->operation & XT_ECN_OP_MATCH_IP) {
|
|
Packit |
7b22a4 |
if (einfo->invert & XT_ECN_OP_MATCH_IP)
|
|
Packit |
7b22a4 |
printf(" !");
|
|
Packit |
7b22a4 |
printf(" --ecn-ip-ect %d", einfo->ip_ect);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int ecn_xlate(struct xt_xlate *xl,
|
|
Packit |
7b22a4 |
const struct xt_xlate_mt_params *params)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const struct xt_ecn_info *einfo =
|
|
Packit |
7b22a4 |
(const struct xt_ecn_info *)params->match->data;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (einfo->operation & XT_ECN_OP_MATCH_ECE) {
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "tcp flags ");
|
|
Packit |
7b22a4 |
if (einfo->invert)
|
|
Packit |
7b22a4 |
xt_xlate_add(xl,"!= ");
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "ecn");
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (einfo->operation & XT_ECN_OP_MATCH_CWR) {
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "tcp flags ");
|
|
Packit |
7b22a4 |
if (einfo->invert)
|
|
Packit |
7b22a4 |
xt_xlate_add(xl,"!= ");
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "cwr");
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (einfo->operation & XT_ECN_OP_MATCH_IP) {
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "ip ecn ");
|
|
Packit |
7b22a4 |
if (einfo->invert)
|
|
Packit |
7b22a4 |
xt_xlate_add(xl,"!= ");
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
switch (einfo->ip_ect) {
|
|
Packit |
7b22a4 |
case 0:
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "not-ect");
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case 1:
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "ect1");
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case 2:
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "ect0");
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case 3:
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "ce");
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
return 1;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static struct xtables_match ecn_mt_reg = {
|
|
Packit |
7b22a4 |
.name = "ecn",
|
|
Packit |
7b22a4 |
.version = XTABLES_VERSION,
|
|
Packit |
7b22a4 |
.family = NFPROTO_UNSPEC,
|
|
Packit |
7b22a4 |
.size = XT_ALIGN(sizeof(struct xt_ecn_info)),
|
|
Packit |
7b22a4 |
.userspacesize = XT_ALIGN(sizeof(struct xt_ecn_info)),
|
|
Packit |
7b22a4 |
.help = ecn_help,
|
|
Packit |
7b22a4 |
.print = ecn_print,
|
|
Packit |
7b22a4 |
.save = ecn_save,
|
|
Packit |
7b22a4 |
.x6_parse = ecn_parse,
|
|
Packit |
7b22a4 |
.x6_fcheck = ecn_check,
|
|
Packit |
7b22a4 |
.x6_options = ecn_opts,
|
|
Packit |
7b22a4 |
.xlate = ecn_xlate,
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
void _init(void)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
xtables_register_match(&ecn_mt_reg);
|
|
Packit |
7b22a4 |
}
|