1/* IP tables module for matching the value of the IPv4/IPv6 DSCP field 2 * 3 * (C) 2002 by Harald Welte <laforge@netfilter.org> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 */ 9#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 10#include <linux/module.h> 11#include <linux/skbuff.h> 12#include <linux/ip.h> 13#include <linux/ipv6.h> 14#include <net/dsfield.h> 15 16#include <linux/netfilter/x_tables.h> 17#include <linux/netfilter/xt_dscp.h> 18 19MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); 20MODULE_DESCRIPTION("Xtables: DSCP/TOS field match"); 21MODULE_LICENSE("GPL"); 22MODULE_ALIAS("ipt_dscp"); 23MODULE_ALIAS("ip6t_dscp"); 24MODULE_ALIAS("ipt_tos"); 25MODULE_ALIAS("ip6t_tos"); 26 27static bool 28dscp_mt(const struct sk_buff *skb, struct xt_action_param *par) 29{ 30 const struct xt_dscp_info *info = par->matchinfo; 31 u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT; 32 33 return (dscp == info->dscp) ^ !!info->invert; 34} 35 36static bool 37dscp_mt6(const struct sk_buff *skb, struct xt_action_param *par) 38{ 39 const struct xt_dscp_info *info = par->matchinfo; 40 u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT; 41 42 return (dscp == info->dscp) ^ !!info->invert; 43} 44 45static int dscp_mt_check(const struct xt_mtchk_param *par) 46{ 47 const struct xt_dscp_info *info = par->matchinfo; 48 49 if (info->dscp > XT_DSCP_MAX) { 50 pr_info("dscp %x out of range\n", info->dscp); 51 return -EDOM; 52 } 53 54 return 0; 55} 56 57static bool tos_mt(const struct sk_buff *skb, struct xt_action_param *par) 58{ 59 const struct xt_tos_match_info *info = par->matchinfo; 60 61 if (par->family == NFPROTO_IPV4) 62 return ((ip_hdr(skb)->tos & info->tos_mask) == 63 info->tos_value) ^ !!info->invert; 64 else 65 return ((ipv6_get_dsfield(ipv6_hdr(skb)) & info->tos_mask) == 66 info->tos_value) ^ !!info->invert; 67} 68 69static struct xt_match dscp_mt_reg[] __read_mostly = { 70 { 71 .name = "dscp", 72 .family = NFPROTO_IPV4, 73 .checkentry = dscp_mt_check, 74 .match = dscp_mt, 75 .matchsize = sizeof(struct xt_dscp_info), 76 .me = THIS_MODULE, 77 }, 78 { 79 .name = "dscp", 80 .family = NFPROTO_IPV6, 81 .checkentry = dscp_mt_check, 82 .match = dscp_mt6, 83 .matchsize = sizeof(struct xt_dscp_info), 84 .me = THIS_MODULE, 85 }, 86 { 87 .name = "tos", 88 .revision = 1, 89 .family = NFPROTO_IPV4, 90 .match = tos_mt, 91 .matchsize = sizeof(struct xt_tos_match_info), 92 .me = THIS_MODULE, 93 }, 94 { 95 .name = "tos", 96 .revision = 1, 97 .family = NFPROTO_IPV6, 98 .match = tos_mt, 99 .matchsize = sizeof(struct xt_tos_match_info), 100 .me = THIS_MODULE, 101 }, 102}; 103 104static int __init dscp_mt_init(void) 105{ 106 return xt_register_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg)); 107} 108 109static void __exit dscp_mt_exit(void) 110{ 111 xt_unregister_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg)); 112} 113 114module_init(dscp_mt_init); 115module_exit(dscp_mt_exit); 116