PageRenderTime 57ms CodeModel.GetById 23ms RepoModel.GetById 1ms app.codeStats 0ms

/iptables-2.6/107-libxt_ecn.patch

http://wl500g.googlecode.com/
Patch | 432 lines | 431 code | 1 blank | 0 comment | 0 complexity | 7d7615db5edd1c75aea96c8cda270e92 MD5 | raw file
Possible License(s): GPL-2.0 
    

  1. extensions: add IPv6 capable ECN match extension
    2. 

  2. 

  3. diff -urNBp iptables/extensions/libipt_ecn.c iptables.ecn/extensions/libipt_ecn.c
    4. 

  4. --- iptables/extensions/libipt_ecn.c	2009-04-06 15:09:17.000000000 +0400
    5. 

  5. +++ /dev/null
    6. 

  6. @@ -1,160 +0,0 @@
    7. 

  7. -/* Shared library add-on to iptables for ECN matching
    8. 

  8. - *
    9. 

  9. - * (C) 2002 by Harald Welte <laforge@gnumonks.org>
    10. 

  10. - *
    11. 

  11. - * This program is distributed under the terms of GNU GPL v2, 1991
    12. 

  12. - *
    13. 

  13. - * libipt_ecn.c borrowed heavily from libipt_dscp.c
    14. 

  14. - *
    15. 

  15. - */
    16. 

  16. -#include <stdio.h>
    17. 

  17. -#include <string.h>
    18. 

  18. -#include <stdlib.h>
    19. 

  19. -#include <getopt.h>
    20. 

  20. -
    21. 

  21. -#include <xtables.h>
    22. 

  22. -#include <linux/netfilter_ipv4/ipt_ecn.h>
    23. 

  23. -
    24. 

  24. -static void ecn_help(void)
    25. 

  25. -{
    26. 

  26. -	printf(
    27. 

  27. -"ECN match options\n"
    28. 

  28. -"[!] --ecn-tcp-cwr 		Match CWR bit of TCP header\n"
    29. 

  29. -"[!] --ecn-tcp-ece		Match ECE bit of TCP header\n"
    30. 

  30. -"[!] --ecn-ip-ect [0..3]	Match ECN codepoint in IPv4 header\n");
    31. 

  31. -}
    32. 

  32. -
    33. 

  33. -static const struct option ecn_opts[] = {
    34. 

  34. -	{ .name = "ecn-tcp-cwr", .has_arg = 0, .val = 'F' },
    35. 

  35. -	{ .name = "ecn-tcp-ece", .has_arg = 0, .val = 'G' },
    36. 

  36. -	{ .name = "ecn-ip-ect",  .has_arg = 1, .val = 'H' },
    37. 

  37. -	{ .name = NULL }
    38. 

  38. -};
    39. 

  39. -
    40. 

  40. -static int ecn_parse(int c, char **argv, int invert, unsigned int *flags,
    41. 

  41. -                     const void *entry, struct xt_entry_match **match)
    42. 

  42. -{
    43. 

  43. -	unsigned int result;
    44. 

  44. -	struct ipt_ecn_info *einfo
    45. 

  45. -		= (struct ipt_ecn_info *)(*match)->data;
    46. 

  46. -
    47. 

  47. -	switch (c) {
    48. 

  48. -	case 'F':
    49. 

  49. -		if (*flags & IPT_ECN_OP_MATCH_CWR)
    50. 

  50. -			xtables_error(PARAMETER_PROBLEM,
    51. 

  51. -			           "ECN match: can only use parameter ONCE!");
    52. 

  52. -		xtables_check_inverse(optarg, &invert, &optind, 0);
    53. 

  53. -		einfo->operation |= IPT_ECN_OP_MATCH_CWR;
    54. 

  54. -		if (invert)
    55. 

  55. -			einfo->invert |= IPT_ECN_OP_MATCH_CWR;
    56. 

  56. -		*flags |= IPT_ECN_OP_MATCH_CWR;
    57. 

  57. -		break;
    58. 

  58. -
    59. 

  59. -	case 'G':
    60. 

  60. -		if (*flags & IPT_ECN_OP_MATCH_ECE)
    61. 

  61. -			xtables_error(PARAMETER_PROBLEM,
    62. 

  62. -				   "ECN match: can only use parameter ONCE!");
    63. 

  63. -		xtables_check_inverse(optarg, &invert, &optind, 0);
    64. 

  64. -		einfo->operation |= IPT_ECN_OP_MATCH_ECE;
    65. 

  65. -		if (invert)
    66. 

  66. -			einfo->invert |= IPT_ECN_OP_MATCH_ECE;
    67. 

  67. -		*flags |= IPT_ECN_OP_MATCH_ECE;
    68. 

  68. -		break;
    69. 

  69. -
    70. 

  70. -	case 'H':
    71. 

  71. -		if (*flags & IPT_ECN_OP_MATCH_IP)
    72. 

  72. -			xtables_error(PARAMETER_PROBLEM,
    73. 

  73. -				   "ECN match: can only use parameter ONCE!");
    74. 

  74. -		xtables_check_inverse(optarg, &invert, &optind, 0);
    75. 

  75. -		if (invert)
    76. 

  76. -			einfo->invert |= IPT_ECN_OP_MATCH_IP;
    77. 

  77. -		*flags |= IPT_ECN_OP_MATCH_IP;
    78. 

  78. -		einfo->operation |= IPT_ECN_OP_MATCH_IP;
    79. 

  79. -		if (!xtables_strtoui(optarg, NULL, &result, 0, 3))
    80. 

  80. -			xtables_error(PARAMETER_PROBLEM,
    81. 

  81. -				   "ECN match: Value out of range");
    82. 

  82. -		einfo->ip_ect = result;
    83. 

  83. -		break;
    84. 

  84. -	default:
    85. 

  85. -		return 0;
    86. 

  86. -	}
    87. 

  87. -
    88. 

  88. -	return 1;
    89. 

  89. -}
    90. 

  90. -
    91. 

  91. -static void ecn_check(unsigned int flags)
    92. 

  92. -{
    93. 

  93. -	if (!flags)
    94. 

  94. -		xtables_error(PARAMETER_PROBLEM,
    95. 

  95. -		           "ECN match: some option required");
    96. 

  96. -}
    97. 

  97. -
    98. 

  98. -static void ecn_print(const void *ip, const struct xt_entry_match *match,
    99. 

  99. -                      int numeric)
    100. 

  100. -{
    101. 

  101. -	const struct ipt_ecn_info *einfo =
    102. 

  102. -		(const struct ipt_ecn_info *)match->data;
    103. 

  103. -
    104. 

  104. -	printf("ECN match ");
    105. 

  105. -
    106. 

  106. -	if (einfo->operation & IPT_ECN_OP_MATCH_ECE) {
    107. 

  107. -		if (einfo->invert & IPT_ECN_OP_MATCH_ECE)
    108. 

  108. -			fputc('!', stdout);
    109. 

  109. -		printf("ECE ");
    110. 

  110. -	}
    111. 

  111. -
    112. 

  112. -	if (einfo->operation & IPT_ECN_OP_MATCH_CWR) {
    113. 

  113. -		if (einfo->invert & IPT_ECN_OP_MATCH_CWR)
    114. 

  114. -			fputc('!', stdout);
    115. 

  115. -		printf("CWR ");
    116. 

  116. -	}
    117. 

  117. -
    118. 

  118. -	if (einfo->operation & IPT_ECN_OP_MATCH_IP) {
    119. 

  119. -		if (einfo->invert & IPT_ECN_OP_MATCH_IP)
    120. 

  120. -			fputc('!', stdout);
    121. 

  121. -		printf("ECT=%d ", einfo->ip_ect);
    122. 

  122. -	}
    123. 

  123. -}
    124. 

  124. -
    125. 

  125. -static void ecn_save(const void *ip, const struct xt_entry_match *match)
    126. 

  126. -{
    127. 

  127. -	const struct ipt_ecn_info *einfo =
    128. 

  128. -		(const struct ipt_ecn_info *)match->data;
    129. 

  129. -	
    130. 

  130. -	if (einfo->operation & IPT_ECN_OP_MATCH_ECE) {
    131. 

  131. -		if (einfo->invert & IPT_ECN_OP_MATCH_ECE)
    132. 

  132. -			printf("! ");
    133. 

  133. -		printf("--ecn-tcp-ece ");
    134. 

  134. -	}
    135. 

  135. -
    136. 

  136. -	if (einfo->operation & IPT_ECN_OP_MATCH_CWR) {
    137. 

  137. -		if (einfo->invert & IPT_ECN_OP_MATCH_CWR)
    138. 

  138. -			printf("! ");
    139. 

  139. -		printf("--ecn-tcp-cwr ");
    140. 

  140. -	}
    141. 

  141. -
    142. 

  142. -	if (einfo->operation & IPT_ECN_OP_MATCH_IP) {
    143. 

  143. -		if (einfo->invert & IPT_ECN_OP_MATCH_IP)
    144. 

  144. -			printf("! ");
    145. 

  145. -		printf("--ecn-ip-ect %d", einfo->ip_ect);
    146. 

  146. -	}
    147. 

  147. -}
    148. 

  148. -
    149. 

  149. -static struct xtables_match ecn_mt_reg = {
    150. 

  150. -    .name          = "ecn",
    151. 

  151. -    .version       = XTABLES_VERSION,
    152. 

  152. -    .family        = NFPROTO_IPV4,
    153. 

  153. -    .size          = XT_ALIGN(sizeof(struct ipt_ecn_info)),
    154. 

  154. -    .userspacesize = XT_ALIGN(sizeof(struct ipt_ecn_info)),
    155. 

  155. -    .help          = ecn_help,
    156. 

  156. -    .parse         = ecn_parse,
    157. 

  157. -    .final_check   = ecn_check,
    158. 

  158. -    .print         = ecn_print,
    159. 

  159. -    .save          = ecn_save,
    160. 

  160. -    .extra_opts    = ecn_opts,
    161. 

  161. -};
    162. 

  162. -
    163. 

  163. -void _init(void)
    164. 

  164. -{
    165. 

  165. -	xtables_register_match(&ecn_mt_reg);
    166. 

  166. -}
    167. 

  167. diff -urNBp iptables/extensions/libipt_ecn.man iptables.ecn/extensions/libipt_ecn.man
    168. 

  168. --- iptables/extensions/libipt_ecn.man	2009-04-06 15:09:17.000000000 +0400
    169. 

  169. +++ /dev/null
    170. 

  170. @@ -1,11 +0,0 @@
    171. 

  171. -This allows you to match the ECN bits of the IPv4 and TCP header.  ECN is the Explicit Congestion Notification mechanism as specified in RFC3168
    172. 

  172. -.TP
    173. 

  173. -[\fB!\fP] \fB\-\-ecn\-tcp\-cwr\fP
    174. 

  174. -This matches if the TCP ECN CWR (Congestion Window Received) bit is set.
    175. 

  175. -.TP
    176. 

  176. -[\fB!\fP] \fB\-\-ecn\-tcp\-ece\fP
    177. 

  177. -This matches if the TCP ECN ECE (ECN Echo) bit is set.
    178. 

  178. -.TP
    179. 

  179. -[\fB!\fP] \fB\-\-ecn\-ip\-ect\fP \fInum\fP
    180. 

  180. -This matches a particular IPv4 ECT (ECN-Capable Transport). You have to specify
    181. 

  181. -a number between `0' and `3'.
    182. 

  182. diff -urNBp iptables/extensions/libxt_ecn.c iptables.ecn/extensions/libxt_ecn.c
    183. 

  183. --- /dev/null
    184. 

  184. +++ iptables.ecn/extensions/libxt_ecn.c	2012-03-13 14:48:03.000000000 +0400
    185. 

  185. @@ -0,0 +1,158 @@
    186. 

  186. +/* Shared library add-on to iptables for ECN matching
    187. 

  187. + *
    188. 

  188. + * (C) 2002 by Harald Welte <laforge@gnumonks.org>
    189. 

  189. + *
    190. 

  190. + * This program is distributed under the terms of GNU GPL v2, 1991
    191. 

  191. + *
    192. 

  192. + * libipt_ecn.c borrowed heavily from libipt_dscp.c
    193. 

  193. + *
    194. 

  194. + */
    195. 

  195. +#include <stdio.h>
    196. 

  196. +#include <string.h>
    197. 

  197. +#include <stdlib.h>
    198. 

  198. +#include <getopt.h>
    199. 

  199. +
    200. 

  200. +#include <xtables.h>
    201. 

  201. +#include <linux/netfilter/xt_ecn.h>
    202. 

  202. +
    203. 

  203. +static void ecn_help(void)
    204. 

  204. +{
    205. 

  205. +	printf(
    206. 

  206. +"ECN match options\n"
    207. 

  207. +"[!] --ecn-tcp-cwr 		Match CWR bit of TCP header\n"
    208. 

  208. +"[!] --ecn-tcp-ece		Match ECE bit of TCP header\n"
    209. 

  209. +"[!] --ecn-ip-ect [0..3]	Match ECN codepoint in IPv4/IPv6 header\n");
    210. 

  210. +}
    211. 

  211. +
    212. 

  212. +static const struct option ecn_opts[] = {
    213. 

  213. +	{ .name = "ecn-tcp-cwr", .has_arg = 0, .val = 'F' },
    214. 

  214. +	{ .name = "ecn-tcp-ece", .has_arg = 0, .val = 'G' },
    215. 

  215. +	{ .name = "ecn-ip-ect",  .has_arg = 1, .val = 'H' },
    216. 

  216. +	{ .name = NULL }
    217. 

  217. +};
    218. 

  218. +
    219. 

  219. +static int ecn_parse(int c, char **argv, int invert, unsigned int *flags,
    220. 

  220. +                     const void *entry, struct xt_entry_match **match)
    221. 

  221. +{
    222. 

  222. +	unsigned int result;
    223. 

  223. +	struct xt_ecn_info *einfo
    224. 

  224. +		= (struct xt_ecn_info *)(*match)->data;
    225. 

  225. +
    226. 

  226. +	switch (c) {
    227. 

  227. +	case 'F':
    228. 

  228. +		if (*flags & XT_ECN_OP_MATCH_CWR)
    229. 

  229. +			xtables_error(PARAMETER_PROBLEM,
    230. 

  230. +			           "ECN match: can only use parameter ONCE!");
    231. 

  231. +		xtables_check_inverse(optarg, &invert, &optind, 0);
    232. 

  232. +		einfo->operation |= XT_ECN_OP_MATCH_CWR;
    233. 

  233. +		if (invert)
    234. 

  234. +			einfo->invert |= XT_ECN_OP_MATCH_CWR;
    235. 

  235. +		*flags |= XT_ECN_OP_MATCH_CWR;
    236. 

  236. +		break;
    237. 

  237. +
    238. 

  238. +	case 'G':
    239. 

  239. +		if (*flags & XT_ECN_OP_MATCH_ECE)
    240. 

  240. +			xtables_error(PARAMETER_PROBLEM,
    241. 

  241. +				   "ECN match: can only use parameter ONCE!");
    242. 

  242. +		xtables_check_inverse(optarg, &invert, &optind, 0);
    243. 

  243. +		einfo->operation |= XT_ECN_OP_MATCH_ECE;
    244. 

  244. +		if (invert)
    245. 

  245. +			einfo->invert |= XT_ECN_OP_MATCH_ECE;
    246. 

  246. +		*flags |= XT_ECN_OP_MATCH_ECE;
    247. 

  247. +		break;
    248. 

  248. +
    249. 

  249. +	case 'H':
    250. 

  250. +		if (*flags & XT_ECN_OP_MATCH_IP)
    251. 

  251. +			xtables_error(PARAMETER_PROBLEM,
    252. 

  252. +				   "ECN match: can only use parameter ONCE!");
    253. 

  253. +		xtables_check_inverse(optarg, &invert, &optind, 0);
    254. 

  254. +		if (invert)
    255. 

  255. +			einfo->invert |= XT_ECN_OP_MATCH_IP;
    256. 

  256. +		*flags |= XT_ECN_OP_MATCH_IP;
    257. 

  257. +		einfo->operation |= XT_ECN_OP_MATCH_IP;
    258. 

  258. +		if (!xtables_strtoui(optarg, NULL, &result, 0, 3))
    259. 

  259. +			xtables_error(PARAMETER_PROBLEM,
    260. 

  260. +				   "ECN match: Value out of range");
    261. 

  261. +		einfo->ip_ect = result;
    262. 

  262. +		break;
    263. 

  263. +	default:
    264. 

  264. +		return 0;
    265. 

  265. +	}
    266. 

  266. +
    267. 

  267. +	return 1;
    268. 

  268. +}
    269. 

  269. +
    270. 

  270. +static void ecn_check(unsigned int flags)
    271. 

  271. +{
    272. 

  272. +	if (!flags)
    273. 

  273. +		xtables_error(PARAMETER_PROBLEM,
    274. 

  274. +		           "ECN match: some option required");
    275. 

  275. +}
    276. 

  276. +
    277. 

  277. +static void ecn_print(const void *ip, const struct xt_entry_match *match,
    278. 

  278. +                      int numeric)
    279. 

  279. +{
    280. 

  280. +	const struct xt_ecn_info *einfo =
    281. 

  281. +		(const struct xt_ecn_info *)match->data;
    282. 

  282. +
    283. 

  283. +	printf(" ECN match ");
    284. 

  284. +
    285. 

  285. +	if (einfo->operation & XT_ECN_OP_MATCH_ECE) {
    286. 

  286. +		printf(" %sECE",
    287. 

  287. +		       (einfo->invert & XT_ECN_OP_MATCH_ECE) ? "!" : "");
    288. 

  288. +	}
    289. 

  289. +
    290. 

  290. +	if (einfo->operation & XT_ECN_OP_MATCH_CWR) {
    291. 

  291. +		printf(" %sCWR",
    292. 

  292. +		       (einfo->invert & XT_ECN_OP_MATCH_CWR) ? "!" : "");
    293. 

  293. +	}
    294. 

  294. +
    295. 

  295. +	if (einfo->operation & XT_ECN_OP_MATCH_IP) {
    296. 

  296. +		printf(" %sECT=%d",
    297. 

  297. +		       (einfo->invert & XT_ECN_OP_MATCH_IP) ? "!" : "",
    298. 

  298. +		       einfo->ip_ect);
    299. 

  299. +	}
    300. 

  300. +}
    301. 

  301. +
    302. 

  302. +static void ecn_save(const void *ip, const struct xt_entry_match *match)
    303. 

  303. +{
    304. 

  304. +	const struct xt_ecn_info *einfo =
    305. 

  305. +		(const struct xt_ecn_info *)match->data;
    306. 

  306. +	
    307. 

  307. +	if (einfo->operation & XT_ECN_OP_MATCH_ECE) {
    308. 

  308. +		if (einfo->invert & XT_ECN_OP_MATCH_ECE)
    309. 

  309. +			printf("! ");
    310. 

  310. +		printf("--ecn-tcp-ece ");
    311. 

  311. +	}
    312. 

  312. +
    313. 

  313. +	if (einfo->operation & XT_ECN_OP_MATCH_CWR) {
    314. 

  314. +		if (einfo->invert & XT_ECN_OP_MATCH_CWR)
    315. 

  315. +			printf("! ");
    316. 

  316. +		printf("--ecn-tcp-cwr ");
    317. 

  317. +	}
    318. 

  318. +
    319. 

  319. +	if (einfo->operation & XT_ECN_OP_MATCH_IP) {
    320. 

  320. +		if (einfo->invert & XT_ECN_OP_MATCH_IP)
    321. 

  321. +			printf("! ");
    322. 

  322. +		printf("--ecn-ip-ect %d", einfo->ip_ect);
    323. 

  323. +	}
    324. 

  324. +}
    325. 

  325. +
    326. 

  326. +static struct xtables_match ecn_mt_reg = {
    327. 

  327. +    .name          = "ecn",
    328. 

  328. +    .version       = XTABLES_VERSION,
    329. 

  329. +    .family        = NFPROTO_UNSPEC,
    330. 

  330. +    .size          = XT_ALIGN(sizeof(struct xt_ecn_info)),
    331. 

  331. +    .userspacesize = XT_ALIGN(sizeof(struct xt_ecn_info)),
    332. 

  332. +    .help          = ecn_help,
    333. 

  333. +    .parse         = ecn_parse,
    334. 

  334. +    .final_check   = ecn_check,
    335. 

  335. +    .print         = ecn_print,
    336. 

  336. +    .save          = ecn_save,
    337. 

  337. +    .extra_opts    = ecn_opts,
    338. 

  338. +};
    339. 

  339. +
    340. 

  340. +void _init(void)
    341. 

  341. +{
    342. 

  342. +	xtables_register_match(&ecn_mt_reg);
    343. 

  343. +}
    344. 

  344. diff -urNBp iptables/extensions/libxt_ecn.man iptables.ecn/extensions/libxt_ecn.man
    345. 

  345. --- /dev/null
    346. 

  346. +++ iptables.ecn/extensions/libxt_ecn.man	2012-03-13 14:40:11.000000000 +0400
    347. 

  347. @@ -0,0 +1,11 @@
    348. 

  348. +This allows you to match the ECN bits of the IPv4/IPv6 and TCP header.  ECN is the Explicit Congestion Notification mechanism as specified in RFC3168
    349. 

  349. +.TP
    350. 

  350. +[\fB!\fP] \fB\-\-ecn\-tcp\-cwr\fP
    351. 

  351. +This matches if the TCP ECN CWR (Congestion Window Received) bit is set.
    352. 

  352. +.TP
    353. 

  353. +[\fB!\fP] \fB\-\-ecn\-tcp\-ece\fP
    354. 

  354. +This matches if the TCP ECN ECE (ECN Echo) bit is set.
    355. 

  355. +.TP
    356. 

  356. +[\fB!\fP] \fB\-\-ecn\-ip\-ect\fP \fInum\fP
    357. 

  357. +This matches a particular IPv4/IPv6 ECT (ECN-Capable Transport). You have to specify
    358. 

  358. +a number between `0' and `3'.
    359. 

  359. diff -urNBp iptables/include/linux/netfilter/xt_ecn.h iptables.ecn/include/linux/netfilter/xt_ecn.h
    360. 

  360. --- /dev/null
    361. 

  361. +++ iptables.ecn/include/linux/netfilter/xt_ecn.h	2012-03-13 14:40:11.000000000 +0400
    362. 

  362. @@ -0,0 +1,33 @@
    363. 

  363. +/* iptables module for matching the ECN header in IPv4 and TCP header
    364. 

  364. + *
    365. 

  365. + * (C) 2002 Harald Welte <laforge@netfilter.org>
    366. 

  366. + *
    367. 

  367. + * This software is distributed under GNU GPL v2, 1991
    368. 

  368. +*/
    369. 

  369. +#ifndef _XT_ECN_H
    370. 

  370. +#define _XT_ECN_H
    371. 

  371. +
    372. 

  372. +#include <linux/types.h>
    373. 

  373. +#include <linux/netfilter/xt_dscp.h>
    374. 

  374. +
    375. 

  375. +#define XT_ECN_IP_MASK	(~XT_DSCP_MASK)
    376. 

  376. +
    377. 

  377. +#define XT_ECN_OP_MATCH_IP	0x01
    378. 

  378. +#define XT_ECN_OP_MATCH_ECE	0x10
    379. 

  379. +#define XT_ECN_OP_MATCH_CWR	0x20
    380. 

  380. +
    381. 

  381. +#define XT_ECN_OP_MATCH_MASK	0xce
    382. 

  382. +
    383. 

  383. +/* match info */
    384. 

  384. +struct xt_ecn_info {
    385. 

  385. +	__u8 operation;
    386. 

  386. +	__u8 invert;
    387. 

  387. +	__u8 ip_ect;
    388. 

  388. +	union {
    389. 

  389. +		struct {
    390. 

  390. +			__u8 ect;
    391. 

  391. +		} tcp;
    392. 

  392. +	} proto;
    393. 

  393. +};
    394. 

  394. +
    395. 

  395. +#endif /* _XT_ECN_H */
    396. 

  396. diff -urNBp iptables/include/linux/netfilter_ipv4/ipt_ecn.h iptables.ecn/include/linux/netfilter_ipv4/ipt_ecn.h
    397. 

  397. --- iptables/include/linux/netfilter_ipv4/ipt_ecn.h	2009-04-06 15:09:17.000000000 +0400
    398. 

  398. +++ /dev/null
    399. 

  399. @@ -1,33 +0,0 @@
    400. 

  400. -/* iptables module for matching the ECN header in IPv4 and TCP header
    401. 

  401. - *
    402. 

  402. - * (C) 2002 Harald Welte <laforge@gnumonks.org>
    403. 

  403. - *
    404. 

  404. - * This software is distributed under GNU GPL v2, 1991
    405. 

  405. - * 
    406. 

  406. - * ipt_ecn.h,v 1.4 2002/08/05 19:39:00 laforge Exp
    407. 

  407. -*/
    408. 

  408. -#ifndef _IPT_ECN_H
    409. 

  409. -#define _IPT_ECN_H
    410. 

  410. -#include <linux/netfilter_ipv4/ipt_dscp.h>
    411. 

  411. -
    412. 

  412. -#define IPT_ECN_IP_MASK	(~IPT_DSCP_MASK)
    413. 

  413. -
    414. 

  414. -#define IPT_ECN_OP_MATCH_IP	0x01
    415. 

  415. -#define IPT_ECN_OP_MATCH_ECE	0x10
    416. 

  416. -#define IPT_ECN_OP_MATCH_CWR	0x20
    417. 

  417. -
    418. 

  418. -#define IPT_ECN_OP_MATCH_MASK	0xce
    419. 

  419. -
    420. 

  420. -/* match info */
    421. 

  421. -struct ipt_ecn_info {
    422. 

  422. -	u_int8_t operation;
    423. 

  423. -	u_int8_t invert;
    424. 

  424. -	u_int8_t ip_ect;
    425. 

  425. -	union {
    426. 

  426. -		struct {
    427. 

  427. -			u_int8_t ect;
    428. 

  428. -		} tcp;
    429. 

  429. -	} proto;
    430. 

  430. -};
    431. 

  431. -
    432. 

  432. -#endif /* _IPT_ECN_H */
    433. 

  433.