From d446a8202c81d95f91b1682fc67e7fadd9a31389 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 9 Jun 2011 21:03:07 +0200 Subject: netfilter: xtables: move ipt_ecn to xt_ecn Prepare the ECN match for augmentation by an IPv6 counterpart. Since no symbol dependencies to ipv6.ko are added, having a single ecn match module is the more so welcome. Signed-off-by: Jan Engelhardt Signed-off-by: Pablo Neira Ayuso --- net/netfilter/xt_ecn.c | 128 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 128 insertions(+) create mode 100644 net/netfilter/xt_ecn.c (limited to 'net/netfilter/xt_ecn.c') diff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c new file mode 100644 index 000000000000..2c198f5e3efb --- /dev/null +++ b/net/netfilter/xt_ecn.c @@ -0,0 +1,128 @@ +/* IP tables module for matching the value of the IPv4 and TCP ECN bits + * + * (C) 2002 by Harald Welte + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt +#include +#include +#include +#include +#include +#include + +#include +#include +#include + +MODULE_AUTHOR("Harald Welte "); +MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match for IPv4"); +MODULE_LICENSE("GPL"); +MODULE_ALIAS("ipt_ecn"); + +static inline bool match_ip(const struct sk_buff *skb, + const struct ipt_ecn_info *einfo) +{ + return ((ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect) ^ + !!(einfo->invert & IPT_ECN_OP_MATCH_IP); +} + +static inline bool match_tcp(const struct sk_buff *skb, + const struct ipt_ecn_info *einfo, + bool *hotdrop) +{ + struct tcphdr _tcph; + const struct tcphdr *th; + + /* In practice, TCP match does this, so can't fail. But let's + * be good citizens. + */ + th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph); + if (th == NULL) { + *hotdrop = false; + return false; + } + + if (einfo->operation & IPT_ECN_OP_MATCH_ECE) { + if (einfo->invert & IPT_ECN_OP_MATCH_ECE) { + if (th->ece == 1) + return false; + } else { + if (th->ece == 0) + return false; + } + } + + if (einfo->operation & IPT_ECN_OP_MATCH_CWR) { + if (einfo->invert & IPT_ECN_OP_MATCH_CWR) { + if (th->cwr == 1) + return false; + } else { + if (th->cwr == 0) + return false; + } + } + + return true; +} + +static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par) +{ + const struct ipt_ecn_info *info = par->matchinfo; + + if (info->operation & IPT_ECN_OP_MATCH_IP) + if (!match_ip(skb, info)) + return false; + + if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) { + if (!match_tcp(skb, info, &par->hotdrop)) + return false; + } + + return true; +} + +static int ecn_mt_check(const struct xt_mtchk_param *par) +{ + const struct ipt_ecn_info *info = par->matchinfo; + const struct ipt_ip *ip = par->entryinfo; + + if (info->operation & IPT_ECN_OP_MATCH_MASK) + return -EINVAL; + + if (info->invert & IPT_ECN_OP_MATCH_MASK) + return -EINVAL; + + if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR) && + (ip->proto != IPPROTO_TCP || ip->invflags & IPT_INV_PROTO)) { + pr_info("cannot match TCP bits in rule for non-tcp packets\n"); + return -EINVAL; + } + + return 0; +} + +static struct xt_match ecn_mt_reg __read_mostly = { + .name = "ecn", + .family = NFPROTO_IPV4, + .match = ecn_mt, + .matchsize = sizeof(struct ipt_ecn_info), + .checkentry = ecn_mt_check, + .me = THIS_MODULE, +}; + +static int __init ecn_mt_init(void) +{ + return xt_register_match(&ecn_mt_reg); +} + +static void __exit ecn_mt_exit(void) +{ + xt_unregister_match(&ecn_mt_reg); +} + +module_init(ecn_mt_init); +module_exit(ecn_mt_exit); -- cgit v1.2.3-70-g09d2 From a4c6f9d3636db538025f9622c008192a0835cc23 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 9 Jun 2011 21:15:37 +0200 Subject: netfilter: xtables: give xt_ecn its own name Use the new macro and struct names in xt_ecn.h, and put the old definitions into a definition-forwarding ipt_ecn.h. Signed-off-by: Jan Engelhardt Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter/xt_ecn.h | 12 ++++++------ include/linux/netfilter_ipv4/ipt_ecn.h | 11 ++++++++++- net/netfilter/xt_ecn.c | 34 +++++++++++++++++----------------- 3 files changed, 33 insertions(+), 24 deletions(-) (limited to 'net/netfilter/xt_ecn.c') diff --git a/include/linux/netfilter/xt_ecn.h b/include/linux/netfilter/xt_ecn.h index 065c1a537e5d..7158fca364f2 100644 --- a/include/linux/netfilter/xt_ecn.h +++ b/include/linux/netfilter/xt_ecn.h @@ -12,16 +12,16 @@ #include #include -#define IPT_ECN_IP_MASK (~XT_DSCP_MASK) +#define XT_ECN_IP_MASK (~XT_DSCP_MASK) -#define IPT_ECN_OP_MATCH_IP 0x01 -#define IPT_ECN_OP_MATCH_ECE 0x10 -#define IPT_ECN_OP_MATCH_CWR 0x20 +#define XT_ECN_OP_MATCH_IP 0x01 +#define XT_ECN_OP_MATCH_ECE 0x10 +#define XT_ECN_OP_MATCH_CWR 0x20 -#define IPT_ECN_OP_MATCH_MASK 0xce +#define XT_ECN_OP_MATCH_MASK 0xce /* match info */ -struct ipt_ecn_info { +struct xt_ecn_info { __u8 operation; __u8 invert; __u8 ip_ect; diff --git a/include/linux/netfilter_ipv4/ipt_ecn.h b/include/linux/netfilter_ipv4/ipt_ecn.h index b1124ec76190..0e0c063dbf60 100644 --- a/include/linux/netfilter_ipv4/ipt_ecn.h +++ b/include/linux/netfilter_ipv4/ipt_ecn.h @@ -2,5 +2,14 @@ #define _IPT_ECN_H #include +#define ipt_ecn_info xt_ecn_info -#endif /* _IPT_ECN_H */ +enum { + IPT_ECN_IP_MASK = XT_ECN_IP_MASK, + IPT_ECN_OP_MATCH_IP = XT_ECN_OP_MATCH_IP, + IPT_ECN_OP_MATCH_ECE = XT_ECN_OP_MATCH_ECE, + IPT_ECN_OP_MATCH_CWR = XT_ECN_OP_MATCH_CWR, + IPT_ECN_OP_MATCH_MASK = XT_ECN_OP_MATCH_MASK, +}; + +#endif /* IPT_ECN_H */ diff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c index 2c198f5e3efb..3ebb3dcace65 100644 --- a/net/netfilter/xt_ecn.c +++ b/net/netfilter/xt_ecn.c @@ -15,8 +15,8 @@ #include #include +#include #include -#include MODULE_AUTHOR("Harald Welte "); MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match for IPv4"); @@ -24,14 +24,14 @@ MODULE_LICENSE("GPL"); MODULE_ALIAS("ipt_ecn"); static inline bool match_ip(const struct sk_buff *skb, - const struct ipt_ecn_info *einfo) + const struct xt_ecn_info *einfo) { - return ((ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect) ^ - !!(einfo->invert & IPT_ECN_OP_MATCH_IP); + return ((ip_hdr(skb)->tos & XT_ECN_IP_MASK) == einfo->ip_ect) ^ + !!(einfo->invert & XT_ECN_OP_MATCH_IP); } static inline bool match_tcp(const struct sk_buff *skb, - const struct ipt_ecn_info *einfo, + const struct xt_ecn_info *einfo, bool *hotdrop) { struct tcphdr _tcph; @@ -46,8 +46,8 @@ static inline bool match_tcp(const struct sk_buff *skb, return false; } - if (einfo->operation & IPT_ECN_OP_MATCH_ECE) { - if (einfo->invert & IPT_ECN_OP_MATCH_ECE) { + if (einfo->operation & XT_ECN_OP_MATCH_ECE) { + if (einfo->invert & XT_ECN_OP_MATCH_ECE) { if (th->ece == 1) return false; } else { @@ -56,8 +56,8 @@ static inline bool match_tcp(const struct sk_buff *skb, } } - if (einfo->operation & IPT_ECN_OP_MATCH_CWR) { - if (einfo->invert & IPT_ECN_OP_MATCH_CWR) { + if (einfo->operation & XT_ECN_OP_MATCH_CWR) { + if (einfo->invert & XT_ECN_OP_MATCH_CWR) { if (th->cwr == 1) return false; } else { @@ -71,13 +71,13 @@ static inline bool match_tcp(const struct sk_buff *skb, static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par) { - const struct ipt_ecn_info *info = par->matchinfo; + const struct xt_ecn_info *info = par->matchinfo; - if (info->operation & IPT_ECN_OP_MATCH_IP) + if (info->operation & XT_ECN_OP_MATCH_IP) if (!match_ip(skb, info)) return false; - if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) { + if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR)) { if (!match_tcp(skb, info, &par->hotdrop)) return false; } @@ -87,16 +87,16 @@ static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par) static int ecn_mt_check(const struct xt_mtchk_param *par) { - const struct ipt_ecn_info *info = par->matchinfo; + const struct xt_ecn_info *info = par->matchinfo; const struct ipt_ip *ip = par->entryinfo; - if (info->operation & IPT_ECN_OP_MATCH_MASK) + if (info->operation & XT_ECN_OP_MATCH_MASK) return -EINVAL; - if (info->invert & IPT_ECN_OP_MATCH_MASK) + if (info->invert & XT_ECN_OP_MATCH_MASK) return -EINVAL; - if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR) && + if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) && (ip->proto != IPPROTO_TCP || ip->invflags & IPT_INV_PROTO)) { pr_info("cannot match TCP bits in rule for non-tcp packets\n"); return -EINVAL; @@ -109,7 +109,7 @@ static struct xt_match ecn_mt_reg __read_mostly = { .name = "ecn", .family = NFPROTO_IPV4, .match = ecn_mt, - .matchsize = sizeof(struct ipt_ecn_info), + .matchsize = sizeof(struct xt_ecn_info), .checkentry = ecn_mt_check, .me = THIS_MODULE, }; -- cgit v1.2.3-70-g09d2 From af0d29cd2a732f70882e6122b9f9df8b0d84515e Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Thu, 9 Jun 2011 15:20:27 +0200 Subject: netfilter: xtables: add an IPv6 capable version of the ECN match References: http://www.spinics.net/lists/netfilter-devel/msg18875.html Augment xt_ecn by facilities to match on IPv6 packets' DSCP/TOS field similar to how it is already done for the IPv4 packet field. Signed-off-by: Jan Engelhardt Signed-off-by: Pablo Neira Ayuso --- net/netfilter/xt_ecn.c | 106 +++++++++++++++++++++++++++++++++++++------------ 1 file changed, 80 insertions(+), 26 deletions(-) (limited to 'net/netfilter/xt_ecn.c') diff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c index 3ebb3dcace65..6ccc35d6cb11 100644 --- a/net/netfilter/xt_ecn.c +++ b/net/netfilter/xt_ecn.c @@ -1,6 +1,8 @@ -/* IP tables module for matching the value of the IPv4 and TCP ECN bits +/* + * Xtables module for matching the value of the IPv4/IPv6 and TCP ECN bits * * (C) 2002 by Harald Welte + * (C) 2011 Patrick McHardy * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as @@ -17,32 +19,25 @@ #include #include #include +#include MODULE_AUTHOR("Harald Welte "); -MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match for IPv4"); +MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match"); MODULE_LICENSE("GPL"); MODULE_ALIAS("ipt_ecn"); +MODULE_ALIAS("ip6t_ecn"); -static inline bool match_ip(const struct sk_buff *skb, - const struct xt_ecn_info *einfo) -{ - return ((ip_hdr(skb)->tos & XT_ECN_IP_MASK) == einfo->ip_ect) ^ - !!(einfo->invert & XT_ECN_OP_MATCH_IP); -} - -static inline bool match_tcp(const struct sk_buff *skb, - const struct xt_ecn_info *einfo, - bool *hotdrop) +static bool match_tcp(const struct sk_buff *skb, struct xt_action_param *par) { + const struct xt_ecn_info *einfo = par->matchinfo; struct tcphdr _tcph; const struct tcphdr *th; /* In practice, TCP match does this, so can't fail. But let's * be good citizens. */ - th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph); + th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph); if (th == NULL) { - *hotdrop = false; return false; } @@ -69,7 +64,14 @@ static inline bool match_tcp(const struct sk_buff *skb, return true; } -static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par) +static inline bool match_ip(const struct sk_buff *skb, + const struct xt_ecn_info *einfo) +{ + return ((ip_hdr(skb)->tos & XT_ECN_IP_MASK) == einfo->ip_ect) ^ + !!(einfo->invert & XT_ECN_OP_MATCH_IP); +} + +static bool ecn_mt4(const struct sk_buff *skb, struct xt_action_param *par) { const struct xt_ecn_info *info = par->matchinfo; @@ -78,14 +80,14 @@ static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par) return false; if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR)) { - if (!match_tcp(skb, info, &par->hotdrop)) + if (!match_tcp(skb, par)) return false; } return true; } -static int ecn_mt_check(const struct xt_mtchk_param *par) +static int ecn_mt_check4(const struct xt_mtchk_param *par) { const struct xt_ecn_info *info = par->matchinfo; const struct ipt_ip *ip = par->entryinfo; @@ -105,23 +107,75 @@ static int ecn_mt_check(const struct xt_mtchk_param *par) return 0; } -static struct xt_match ecn_mt_reg __read_mostly = { - .name = "ecn", - .family = NFPROTO_IPV4, - .match = ecn_mt, - .matchsize = sizeof(struct xt_ecn_info), - .checkentry = ecn_mt_check, - .me = THIS_MODULE, +static inline bool match_ipv6(const struct sk_buff *skb, + const struct xt_ecn_info *einfo) +{ + return (((ipv6_hdr(skb)->flow_lbl[0] >> 4) & XT_ECN_IP_MASK) == + einfo->ip_ect) ^ + !!(einfo->invert & XT_ECN_OP_MATCH_IP); +} + +static bool ecn_mt6(const struct sk_buff *skb, struct xt_action_param *par) +{ + const struct xt_ecn_info *info = par->matchinfo; + + if (info->operation & XT_ECN_OP_MATCH_IP && !match_ipv6(skb, info)) + return false; + + if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) && + !match_tcp(skb, par)) + return false; + + return true; +} + +static int ecn_mt_check6(const struct xt_mtchk_param *par) +{ + const struct xt_ecn_info *info = par->matchinfo; + const struct ip6t_ip6 *ip = par->entryinfo; + + if (info->operation & XT_ECN_OP_MATCH_MASK) + return -EINVAL; + + if (info->invert & XT_ECN_OP_MATCH_MASK) + return -EINVAL; + + if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) && + (ip->proto != IPPROTO_TCP || ip->invflags & IP6T_INV_PROTO)) { + pr_info("cannot match TCP bits in rule for non-tcp packets\n"); + return -EINVAL; + } + + return 0; +} + +static struct xt_match ecn_mt_reg[] __read_mostly = { + { + .name = "ecn", + .family = NFPROTO_IPV4, + .match = ecn_mt4, + .matchsize = sizeof(struct xt_ecn_info), + .checkentry = ecn_mt_check4, + .me = THIS_MODULE, + }, + { + .name = "ecn", + .family = NFPROTO_IPV6, + .match = ecn_mt6, + .matchsize = sizeof(struct xt_ecn_info), + .checkentry = ecn_mt_check6, + .me = THIS_MODULE, + }, }; static int __init ecn_mt_init(void) { - return xt_register_match(&ecn_mt_reg); + return xt_register_matches(ecn_mt_reg, ARRAY_SIZE(ecn_mt_reg)); } static void __exit ecn_mt_exit(void) { - xt_unregister_match(&ecn_mt_reg); + xt_unregister_matches(ecn_mt_reg, ARRAY_SIZE(ecn_mt_reg)); } module_init(ecn_mt_init); -- cgit v1.2.3-70-g09d2 From 42c344a3bc6bb2eb4c0bef98d24d53adda255154 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 9 Jun 2011 22:16:50 +0200 Subject: netfilter: xtables: collapse conditions in xt_ecn One simplification of an if clause. Signed-off-by: Jan Engelhardt Signed-off-by: Pablo Neira Ayuso --- net/netfilter/xt_ecn.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) (limited to 'net/netfilter/xt_ecn.c') diff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c index 6ccc35d6cb11..3c831a8efebc 100644 --- a/net/netfilter/xt_ecn.c +++ b/net/netfilter/xt_ecn.c @@ -37,9 +37,8 @@ static bool match_tcp(const struct sk_buff *skb, struct xt_action_param *par) * be good citizens. */ th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph); - if (th == NULL) { + if (th == NULL) return false; - } if (einfo->operation & XT_ECN_OP_MATCH_ECE) { if (einfo->invert & XT_ECN_OP_MATCH_ECE) { @@ -75,14 +74,12 @@ static bool ecn_mt4(const struct sk_buff *skb, struct xt_action_param *par) { const struct xt_ecn_info *info = par->matchinfo; - if (info->operation & XT_ECN_OP_MATCH_IP) - if (!match_ip(skb, info)) - return false; + if (info->operation & XT_ECN_OP_MATCH_IP && !match_ip(skb, info)) + return false; - if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR)) { - if (!match_tcp(skb, par)) - return false; - } + if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) && + !match_tcp(skb, par)) + return false; return true; } -- cgit v1.2.3-70-g09d2