net/netfilter/xt_ecn.c

   1 /*
   2  * Xtables module for matching the value of the IPv4/IPv6 and TCP ECN bits
   3  *
   4  * (C) 2002 by Harald Welte <laforge@gnumonks.org>
   5  * (C) 2011 Patrick McHardy <kaber@trash.net>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  12 #include <linux/in.h>
  13 #include <linux/ip.h>
  14 #include <net/ip.h>
  15 #include <linux/module.h>
  16 #include <linux/skbuff.h>
  17 #include <linux/tcp.h>
  18
  19 #include <linux/netfilter/x_tables.h>
  20 #include <linux/netfilter/xt_ecn.h>
  21 #include <linux/netfilter_ipv4/ip_tables.h>
  22 #include <linux/netfilter_ipv6/ip6_tables.h>
  23
  24 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
  25 MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match");
  26 MODULE_LICENSE("GPL");
  27 MODULE_ALIAS("ipt_ecn");
  28 MODULE_ALIAS("ip6t_ecn");
  29
  30 static bool match_tcp(const struct sk_buff *skb, struct xt_action_param *par)
  31 {
  32         const struct xt_ecn_info *einfo = par->matchinfo;
  33         struct tcphdr _tcph;
  34         const struct tcphdr *th;
  35
  36         /* In practice, TCP match does this, so can't fail.  But let's
  37          * be good citizens.
  38          */
  39         th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
  40         if (th == NULL) {
  41                 return false;
  42         }
  43
  44         if (einfo->operation & XT_ECN_OP_MATCH_ECE) {
  45                 if (einfo->invert & XT_ECN_OP_MATCH_ECE) {
  46                         if (th->ece == 1)
  47                                 return false;
  48                 } else {
  49                         if (th->ece == 0)
  50                                 return false;
  51                 }
  52         }
  53
  54         if (einfo->operation & XT_ECN_OP_MATCH_CWR) {
  55                 if (einfo->invert & XT_ECN_OP_MATCH_CWR) {
  56                         if (th->cwr == 1)
  57                                 return false;
  58                 } else {
  59                         if (th->cwr == 0)
  60                                 return false;
  61                 }
  62         }
  63
  64         return true;
  65 }
  66
  67 static inline bool match_ip(const struct sk_buff *skb,
  68                             const struct xt_ecn_info *einfo)
  69 {
  70         return ((ip_hdr(skb)->tos & XT_ECN_IP_MASK) == einfo->ip_ect) ^
  71                !!(einfo->invert & XT_ECN_OP_MATCH_IP);
  72 }
  73
  74 static bool ecn_mt4(const struct sk_buff *skb, struct xt_action_param *par)
  75 {
  76         const struct xt_ecn_info *info = par->matchinfo;
  77
  78         if (info->operation & XT_ECN_OP_MATCH_IP)
  79                 if (!match_ip(skb, info))
  80                         return false;
  81
  82         if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR)) {
  83                 if (!match_tcp(skb, par))
  84                         return false;
  85         }
  86
  87         return true;
  88 }
  89
  90 static int ecn_mt_check4(const struct xt_mtchk_param *par)
  91 {
  92         const struct xt_ecn_info *info = par->matchinfo;
  93         const struct ipt_ip *ip = par->entryinfo;
  94
  95         if (info->operation & XT_ECN_OP_MATCH_MASK)
  96                 return -EINVAL;
  97
  98         if (info->invert & XT_ECN_OP_MATCH_MASK)
  99                 return -EINVAL;
 100
 101         if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
 102             (ip->proto != IPPROTO_TCP || ip->invflags & IPT_INV_PROTO)) {
 103                 pr_info("cannot match TCP bits in rule for non-tcp packets\n");
 104                 return -EINVAL;
 105         }
 106
 107         return 0;
 108 }
 109
 110 static inline bool match_ipv6(const struct sk_buff *skb,
 111                               const struct xt_ecn_info *einfo)
 112 {
 113         return (((ipv6_hdr(skb)->flow_lbl[0] >> 4) & XT_ECN_IP_MASK) ==
 114                 einfo->ip_ect) ^
 115                !!(einfo->invert & XT_ECN_OP_MATCH_IP);
 116 }
 117
 118 static bool ecn_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 119 {
 120         const struct xt_ecn_info *info = par->matchinfo;
 121
 122         if (info->operation & XT_ECN_OP_MATCH_IP && !match_ipv6(skb, info))
 123                 return false;
 124
 125         if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
 126             !match_tcp(skb, par))
 127                 return false;
 128
 129         return true;
 130 }
 131
 132 static int ecn_mt_check6(const struct xt_mtchk_param *par)
 133 {
 134         const struct xt_ecn_info *info = par->matchinfo;
 135         const struct ip6t_ip6 *ip = par->entryinfo;
 136
 137         if (info->operation & XT_ECN_OP_MATCH_MASK)
 138                 return -EINVAL;
 139
 140         if (info->invert & XT_ECN_OP_MATCH_MASK)
 141                 return -EINVAL;
 142
 143         if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
 144             (ip->proto != IPPROTO_TCP || ip->invflags & IP6T_INV_PROTO)) {
 145                 pr_info("cannot match TCP bits in rule for non-tcp packets\n");
 146                 return -EINVAL;
 147         }
 148
 149         return 0;
 150 }
 151
 152 static struct xt_match ecn_mt_reg[] __read_mostly = {
 153         {
 154                 .name           = "ecn",
 155                 .family         = NFPROTO_IPV4,
 156                 .match          = ecn_mt4,
 157                 .matchsize      = sizeof(struct xt_ecn_info),
 158                 .checkentry     = ecn_mt_check4,
 159                 .me             = THIS_MODULE,
 160         },
 161         {
 162                 .name           = "ecn",
 163                 .family         = NFPROTO_IPV6,
 164                 .match          = ecn_mt6,
 165                 .matchsize      = sizeof(struct xt_ecn_info),
 166                 .checkentry     = ecn_mt_check6,
 167                 .me             = THIS_MODULE,
 168         },
 169 };
 170
 171 static int __init ecn_mt_init(void)
 172 {
 173         return xt_register_matches(ecn_mt_reg, ARRAY_SIZE(ecn_mt_reg));
 174 }
 175
 176 static void __exit ecn_mt_exit(void)
 177 {
 178         xt_unregister_matches(ecn_mt_reg, ARRAY_SIZE(ecn_mt_reg));
 179 }
 180
 181 module_init(ecn_mt_init);
 182 module_exit(ecn_mt_exit);