1 /* IP tables module for matching the value of the IPv4/IPv6 DSCP field 2 * 3 * (C) 2002 by Harald Welte <laforge@netfilter.org> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 */ 9 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 10 #include <linux/module.h> 11 #include <linux/skbuff.h> 12 #include <linux/ip.h> 13 #include <linux/ipv6.h> 14 #include <net/dsfield.h> 15 16 #include <linux/netfilter/x_tables.h> 17 #include <linux/netfilter/xt_dscp.h> 18 19 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); 20 MODULE_DESCRIPTION("Xtables: DSCP/TOS field match"); 21 MODULE_LICENSE("GPL"); 22 MODULE_ALIAS("ipt_dscp"); 23 MODULE_ALIAS("ip6t_dscp"); 24 MODULE_ALIAS("ipt_tos"); 25 MODULE_ALIAS("ip6t_tos"); 26 27 static bool 28 dscp_mt(const struct sk_buff *skb, struct xt_action_param *par) 29 { 30 const struct xt_dscp_info *info = par->matchinfo; 31 u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT; 32 33 return (dscp == info->dscp) ^ !!info->invert; 34 } 35 36 static bool 37 dscp_mt6(const struct sk_buff *skb, struct xt_action_param *par) 38 { 39 const struct xt_dscp_info *info = par->matchinfo; 40 u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT; 41 42 return (dscp == info->dscp) ^ !!info->invert; 43 } 44 45 static int dscp_mt_check(const struct xt_mtchk_param *par) 46 { 47 const struct xt_dscp_info *info = par->matchinfo; 48 49 if (info->dscp > XT_DSCP_MAX) { 50 pr_info("dscp %x out of range\n", info->dscp); 51 return -EDOM; 52 } 53 54 return 0; 55 } 56 57 static bool tos_mt(const struct sk_buff *skb, struct xt_action_param *par) 58 { 59 const struct xt_tos_match_info *info = par->matchinfo; 60 61 if (par->family == NFPROTO_IPV4) 62 return ((ip_hdr(skb)->tos & info->tos_mask) == 63 info->tos_value) ^ !!info->invert; 64 else 65 return ((ipv6_get_dsfield(ipv6_hdr(skb)) & info->tos_mask) == 66 info->tos_value) ^ !!info->invert; 67 } 68 69 static struct xt_match dscp_mt_reg[] __read_mostly = { 70 { 71 .name = "dscp", 72 .family = NFPROTO_IPV4, 73 .checkentry = dscp_mt_check, 74 .match = dscp_mt, 75 .matchsize = sizeof(struct xt_dscp_info), 76 .me = THIS_MODULE, 77 }, 78 { 79 .name = "dscp", 80 .family = NFPROTO_IPV6, 81 .checkentry = dscp_mt_check, 82 .match = dscp_mt6, 83 .matchsize = sizeof(struct xt_dscp_info), 84 .me = THIS_MODULE, 85 }, 86 { 87 .name = "tos", 88 .revision = 1, 89 .family = NFPROTO_IPV4, 90 .match = tos_mt, 91 .matchsize = sizeof(struct xt_tos_match_info), 92 .me = THIS_MODULE, 93 }, 94 { 95 .name = "tos", 96 .revision = 1, 97 .family = NFPROTO_IPV6, 98 .match = tos_mt, 99 .matchsize = sizeof(struct xt_tos_match_info), 100 .me = THIS_MODULE, 101 }, 102 }; 103 104 static int __init dscp_mt_init(void) 105 { 106 return xt_register_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg)); 107 } 108 109 static void __exit dscp_mt_exit(void) 110 { 111 xt_unregister_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg)); 112 } 113 114 module_init(dscp_mt_init); 115 module_exit(dscp_mt_exit); 116