diff options
| -rw-r--r-- | include/linux/netfilter/xt_ecn.h | 12 | ||||
| -rw-r--r-- | include/linux/netfilter_ipv4/ipt_ecn.h | 11 | ||||
| -rw-r--r-- | net/netfilter/xt_ecn.c | 34 |
3 files changed, 33 insertions, 24 deletions
diff --git a/include/linux/netfilter/xt_ecn.h b/include/linux/netfilter/xt_ecn.h index 065c1a537e5d..7158fca364f2 100644 --- a/include/linux/netfilter/xt_ecn.h +++ b/include/linux/netfilter/xt_ecn.h @@ -12,16 +12,16 @@ #include <linux/types.h> #include <linux/netfilter/xt_dscp.h> -#define IPT_ECN_IP_MASK (~XT_DSCP_MASK) +#define XT_ECN_IP_MASK (~XT_DSCP_MASK) -#define IPT_ECN_OP_MATCH_IP 0x01 -#define IPT_ECN_OP_MATCH_ECE 0x10 -#define IPT_ECN_OP_MATCH_CWR 0x20 +#define XT_ECN_OP_MATCH_IP 0x01 +#define XT_ECN_OP_MATCH_ECE 0x10 +#define XT_ECN_OP_MATCH_CWR 0x20 -#define IPT_ECN_OP_MATCH_MASK 0xce +#define XT_ECN_OP_MATCH_MASK 0xce /* match info */ -struct ipt_ecn_info { +struct xt_ecn_info { __u8 operation; __u8 invert; __u8 ip_ect; diff --git a/include/linux/netfilter_ipv4/ipt_ecn.h b/include/linux/netfilter_ipv4/ipt_ecn.h index b1124ec76190..0e0c063dbf60 100644 --- a/include/linux/netfilter_ipv4/ipt_ecn.h +++ b/include/linux/netfilter_ipv4/ipt_ecn.h @@ -2,5 +2,14 @@ #define _IPT_ECN_H #include <linux/netfilter/xt_ecn.h> +#define ipt_ecn_info xt_ecn_info -#endif /* _IPT_ECN_H */ +enum { + IPT_ECN_IP_MASK = XT_ECN_IP_MASK, + IPT_ECN_OP_MATCH_IP = XT_ECN_OP_MATCH_IP, + IPT_ECN_OP_MATCH_ECE = XT_ECN_OP_MATCH_ECE, + IPT_ECN_OP_MATCH_CWR = XT_ECN_OP_MATCH_CWR, + IPT_ECN_OP_MATCH_MASK = XT_ECN_OP_MATCH_MASK, +}; + +#endif /* IPT_ECN_H */ diff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c index 2c198f5e3efb..3ebb3dcace65 100644 --- a/net/netfilter/xt_ecn.c +++ b/net/netfilter/xt_ecn.c @@ -15,8 +15,8 @@ #include <linux/tcp.h> #include <linux/netfilter/x_tables.h> +#include <linux/netfilter/xt_ecn.h> #include <linux/netfilter_ipv4/ip_tables.h> -#include <linux/netfilter_ipv4/ipt_ecn.h> MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match for IPv4"); @@ -24,14 +24,14 @@ MODULE_LICENSE("GPL"); MODULE_ALIAS("ipt_ecn"); static inline bool match_ip(const struct sk_buff *skb, - const struct ipt_ecn_info *einfo) + const struct xt_ecn_info *einfo) { - return ((ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect) ^ - !!(einfo->invert & IPT_ECN_OP_MATCH_IP); + return ((ip_hdr(skb)->tos & XT_ECN_IP_MASK) == einfo->ip_ect) ^ + !!(einfo->invert & XT_ECN_OP_MATCH_IP); } static inline bool match_tcp(const struct sk_buff *skb, - const struct ipt_ecn_info *einfo, + const struct xt_ecn_info *einfo, bool *hotdrop) { struct tcphdr _tcph; @@ -46,8 +46,8 @@ static inline bool match_tcp(const struct sk_buff *skb, return false; } - if (einfo->operation & IPT_ECN_OP_MATCH_ECE) { - if (einfo->invert & IPT_ECN_OP_MATCH_ECE) { + if (einfo->operation & XT_ECN_OP_MATCH_ECE) { + if (einfo->invert & XT_ECN_OP_MATCH_ECE) { if (th->ece == 1) return false; } else { @@ -56,8 +56,8 @@ static inline bool match_tcp(const struct sk_buff *skb, } } - if (einfo->operation & IPT_ECN_OP_MATCH_CWR) { - if (einfo->invert & IPT_ECN_OP_MATCH_CWR) { + if (einfo->operation & XT_ECN_OP_MATCH_CWR) { + if (einfo->invert & XT_ECN_OP_MATCH_CWR) { if (th->cwr == 1) return false; } else { @@ -71,13 +71,13 @@ static inline bool match_tcp(const struct sk_buff *skb, static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par) { - const struct ipt_ecn_info *info = par->matchinfo; + const struct xt_ecn_info *info = par->matchinfo; - if (info->operation & IPT_ECN_OP_MATCH_IP) + if (info->operation & XT_ECN_OP_MATCH_IP) if (!match_ip(skb, info)) return false; - if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) { + if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR)) { if (!match_tcp(skb, info, &par->hotdrop)) return false; } @@ -87,16 +87,16 @@ static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par) static int ecn_mt_check(const struct xt_mtchk_param *par) { - const struct ipt_ecn_info *info = par->matchinfo; + const struct xt_ecn_info *info = par->matchinfo; const struct ipt_ip *ip = par->entryinfo; - if (info->operation & IPT_ECN_OP_MATCH_MASK) + if (info->operation & XT_ECN_OP_MATCH_MASK) return -EINVAL; - if (info->invert & IPT_ECN_OP_MATCH_MASK) + if (info->invert & XT_ECN_OP_MATCH_MASK) return -EINVAL; - if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR) && + if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) && (ip->proto != IPPROTO_TCP || ip->invflags & IPT_INV_PROTO)) { pr_info("cannot match TCP bits in rule for non-tcp packets\n"); return -EINVAL; @@ -109,7 +109,7 @@ static struct xt_match ecn_mt_reg __read_mostly = { .name = "ecn", .family = NFPROTO_IPV4, .match = ecn_mt, - .matchsize = sizeof(struct ipt_ecn_info), + .matchsize = sizeof(struct xt_ecn_info), .checkentry = ecn_mt_check, .me = THIS_MODULE, }; |