xt_ecn.c 4.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Xtables module for matching the value of the IPv4/IPv6 and TCP ECN bits
  4. *
  5. * (C) 2002 by Harald Welte <laforge@gnumonks.org>
  6. * (C) 2011 Patrick McHardy <kaber@trash.net>
  7. */
  8. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  9. #include <linux/in.h>
  10. #include <linux/ip.h>
  11. #include <net/ip.h>
  12. #include <linux/module.h>
  13. #include <linux/skbuff.h>
  14. #include <linux/tcp.h>
  15. #include <linux/netfilter/x_tables.h>
  16. #include <linux/netfilter/xt_ecn.h>
  17. #include <linux/netfilter_ipv4/ip_tables.h>
  18. #include <linux/netfilter_ipv6/ip6_tables.h>
  19. MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
  20. MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match");
  21. MODULE_LICENSE("GPL");
  22. MODULE_ALIAS("ipt_ecn");
  23. MODULE_ALIAS("ip6t_ecn");
  24. static bool match_tcp(const struct sk_buff *skb, struct xt_action_param *par)
  25. {
  26. const struct xt_ecn_info *einfo = par->matchinfo;
  27. struct tcphdr _tcph;
  28. const struct tcphdr *th;
  29. /* In practice, TCP match does this, so can't fail. But let's
  30. * be good citizens.
  31. */
  32. th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
  33. if (th == NULL)
  34. return false;
  35. if (einfo->operation & XT_ECN_OP_MATCH_ECE) {
  36. if (einfo->invert & XT_ECN_OP_MATCH_ECE) {
  37. if (th->ece == 1)
  38. return false;
  39. } else {
  40. if (th->ece == 0)
  41. return false;
  42. }
  43. }
  44. if (einfo->operation & XT_ECN_OP_MATCH_CWR) {
  45. if (einfo->invert & XT_ECN_OP_MATCH_CWR) {
  46. if (th->cwr == 1)
  47. return false;
  48. } else {
  49. if (th->cwr == 0)
  50. return false;
  51. }
  52. }
  53. return true;
  54. }
  55. static inline bool match_ip(const struct sk_buff *skb,
  56. const struct xt_ecn_info *einfo)
  57. {
  58. return ((ip_hdr(skb)->tos & XT_ECN_IP_MASK) == einfo->ip_ect) ^
  59. !!(einfo->invert & XT_ECN_OP_MATCH_IP);
  60. }
  61. static bool ecn_mt4(const struct sk_buff *skb, struct xt_action_param *par)
  62. {
  63. const struct xt_ecn_info *info = par->matchinfo;
  64. if (info->operation & XT_ECN_OP_MATCH_IP && !match_ip(skb, info))
  65. return false;
  66. if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
  67. !match_tcp(skb, par))
  68. return false;
  69. return true;
  70. }
  71. static int ecn_mt_check4(const struct xt_mtchk_param *par)
  72. {
  73. const struct xt_ecn_info *info = par->matchinfo;
  74. const struct ipt_ip *ip = par->entryinfo;
  75. if (info->operation & XT_ECN_OP_MATCH_MASK)
  76. return -EINVAL;
  77. if (info->invert & XT_ECN_OP_MATCH_MASK)
  78. return -EINVAL;
  79. if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
  80. (ip->proto != IPPROTO_TCP || ip->invflags & IPT_INV_PROTO)) {
  81. pr_info_ratelimited("cannot match TCP bits for non-tcp packets\n");
  82. return -EINVAL;
  83. }
  84. return 0;
  85. }
  86. static inline bool match_ipv6(const struct sk_buff *skb,
  87. const struct xt_ecn_info *einfo)
  88. {
  89. return (((ipv6_hdr(skb)->flow_lbl[0] >> 4) & XT_ECN_IP_MASK) ==
  90. einfo->ip_ect) ^
  91. !!(einfo->invert & XT_ECN_OP_MATCH_IP);
  92. }
  93. static bool ecn_mt6(const struct sk_buff *skb, struct xt_action_param *par)
  94. {
  95. const struct xt_ecn_info *info = par->matchinfo;
  96. if (info->operation & XT_ECN_OP_MATCH_IP && !match_ipv6(skb, info))
  97. return false;
  98. if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
  99. !match_tcp(skb, par))
  100. return false;
  101. return true;
  102. }
  103. static int ecn_mt_check6(const struct xt_mtchk_param *par)
  104. {
  105. const struct xt_ecn_info *info = par->matchinfo;
  106. const struct ip6t_ip6 *ip = par->entryinfo;
  107. if (info->operation & XT_ECN_OP_MATCH_MASK)
  108. return -EINVAL;
  109. if (info->invert & XT_ECN_OP_MATCH_MASK)
  110. return -EINVAL;
  111. if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
  112. (ip->proto != IPPROTO_TCP || ip->invflags & IP6T_INV_PROTO)) {
  113. pr_info_ratelimited("cannot match TCP bits for non-tcp packets\n");
  114. return -EINVAL;
  115. }
  116. return 0;
  117. }
  118. static struct xt_match ecn_mt_reg[] __read_mostly = {
  119. {
  120. .name = "ecn",
  121. .family = NFPROTO_IPV4,
  122. .match = ecn_mt4,
  123. .matchsize = sizeof(struct xt_ecn_info),
  124. .checkentry = ecn_mt_check4,
  125. .me = THIS_MODULE,
  126. },
  127. {
  128. .name = "ecn",
  129. .family = NFPROTO_IPV6,
  130. .match = ecn_mt6,
  131. .matchsize = sizeof(struct xt_ecn_info),
  132. .checkentry = ecn_mt_check6,
  133. .me = THIS_MODULE,
  134. },
  135. };
  136. static int __init ecn_mt_init(void)
  137. {
  138. return xt_register_matches(ecn_mt_reg, ARRAY_SIZE(ecn_mt_reg));
  139. }
  140. static void __exit ecn_mt_exit(void)
  141. {
  142. xt_unregister_matches(ecn_mt_reg, ARRAY_SIZE(ecn_mt_reg));
  143. }
  144. module_init(ecn_mt_init);
  145. module_exit(ecn_mt_exit);