1 /* IP tables module for matching the value of the IPv4/IPv6 DSCP field 2 * 3 * (C) 2002 by Harald Welte <laforge@netfilter.org> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 */ 9 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 10 #include <linux/module.h> 11 #include <linux/skbuff.h> 12 #include <linux/ip.h> 13 #include <linux/ipv6.h> 14 #include <net/dsfield.h> 15 16 #include <linux/netfilter/x_tables.h> 17 #include <linux/netfilter/xt_dscp.h> 18 19 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); 20 MODULE_DESCRIPTION("Xtables: DSCP/TOS field match"); 21 MODULE_LICENSE("GPL"); 22 MODULE_ALIAS("ipt_dscp"); 23 MODULE_ALIAS("ip6t_dscp"); 24 MODULE_ALIAS("ipt_tos"); 25 MODULE_ALIAS("ip6t_tos"); 26 27 static bool 28 dscp_mt(const struct sk_buff *skb, struct xt_action_param *par) 29 { 30 const struct xt_dscp_info *info = par->matchinfo; 31 u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT; 32 33 return (dscp == info->dscp) ^ !!info->invert; 34 } 35 36 static bool 37 dscp_mt6(const struct sk_buff *skb, struct xt_action_param *par) 38 { 39 const struct xt_dscp_info *info = par->matchinfo; 40 u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT; 41 42 return (dscp == info->dscp) ^ !!info->invert; 43 } 44 45 static int dscp_mt_check(const struct xt_mtchk_param *par) 46 { 47 const struct xt_dscp_info *info = par->matchinfo; 48 49 if (info->dscp > XT_DSCP_MAX) 50 return -EDOM; 51 52 return 0; 53 } 54 55 static bool tos_mt(const struct sk_buff *skb, struct xt_action_param *par) 56 { 57 const struct xt_tos_match_info *info = par->matchinfo; 58 59 if (xt_family(par) == NFPROTO_IPV4) 60 return ((ip_hdr(skb)->tos & info->tos_mask) == 61 info->tos_value) ^ !!info->invert; 62 else 63 return ((ipv6_get_dsfield(ipv6_hdr(skb)) & info->tos_mask) == 64 info->tos_value) ^ !!info->invert; 65 } 66 67 static struct xt_match dscp_mt_reg[] __read_mostly = { 68 { 69 .name = "dscp", 70 .family = NFPROTO_IPV4, 71 .checkentry = dscp_mt_check, 72 .match = dscp_mt, 73 .matchsize = sizeof(struct xt_dscp_info), 74 .me = THIS_MODULE, 75 }, 76 { 77 .name = "dscp", 78 .family = NFPROTO_IPV6, 79 .checkentry = dscp_mt_check, 80 .match = dscp_mt6, 81 .matchsize = sizeof(struct xt_dscp_info), 82 .me = THIS_MODULE, 83 }, 84 { 85 .name = "tos", 86 .revision = 1, 87 .family = NFPROTO_IPV4, 88 .match = tos_mt, 89 .matchsize = sizeof(struct xt_tos_match_info), 90 .me = THIS_MODULE, 91 }, 92 { 93 .name = "tos", 94 .revision = 1, 95 .family = NFPROTO_IPV6, 96 .match = tos_mt, 97 .matchsize = sizeof(struct xt_tos_match_info), 98 .me = THIS_MODULE, 99 }, 100 }; 101 102 static int __init dscp_mt_init(void) 103 { 104 return xt_register_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg)); 105 } 106 107 static void __exit dscp_mt_exit(void) 108 { 109 xt_unregister_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg)); 110 } 111 112 module_init(dscp_mt_init); 113 module_exit(dscp_mt_exit); 114