Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f1095ab5 authored by Jan Engelhardt's avatar Jan Engelhardt Committed by David S. Miller
Browse files

[NETFILTER]: IPv6 capable xt_tos v1 match 



Extends the xt_dscp match by xt_tos v1 to add support for selectively
matching any bit in the IPv4 TOS and IPv6 Priority fields. (ipt_tos
and xt_dscp only accepted a limited range of possible values.)

Signed-off-by: default avatarJan Engelhardt <jengelh@computergmbh.de>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c9fd4968

include/linux/netfilter/xt_dscp.h

+6 −0
Original line number Diff line number Diff line
@@ -20,4 +20,10 @@ struct xt_dscp_info { 
	u_int8_t invert;

};



struct xt_tos_match_info {

	u_int8_t tos_mask;

	u_int8_t tos_value;

	u_int8_t invert;

};



#endif /* _XT_DSCP_H */

net/netfilter/xt_dscp.c

+32 −0
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ MODULE_LICENSE("GPL"); 
MODULE_ALIAS("ipt_dscp");

MODULE_ALIAS("ip6t_dscp");

MODULE_ALIAS("ipt_tos");

MODULE_ALIAS("ip6t_tos");



static bool

dscp_mt(const struct sk_buff *skb, const struct net_device *in,
@@ -72,6 +73,21 @@ static bool tos_mt_v0(const struct sk_buff *skb, const struct net_device *in, 
	return (ip_hdr(skb)->tos == info->tos) ^ info->invert;

}



static bool tos_mt(const struct sk_buff *skb, const struct net_device *in,

                   const struct net_device *out, const struct xt_match *match,

                   const void *matchinfo, int offset, unsigned int protoff,

                   bool *hotdrop)

{

	const struct xt_tos_match_info *info = matchinfo;



	if (match->family == AF_INET)

		return ((ip_hdr(skb)->tos & info->tos_mask) ==

		       info->tos_value) ^ !!info->invert;

	else

		return ((ipv6_get_dsfield(ipv6_hdr(skb)) & info->tos_mask) ==

		       info->tos_value) ^ !!info->invert;

}



static struct xt_match dscp_mt_reg[] __read_mostly = {

	{

		.name		= "dscp",
@@ -97,6 +113,22 @@ static struct xt_match dscp_mt_reg[] __read_mostly = { 
		.matchsize	= sizeof(struct ipt_tos_info),

		.me		= THIS_MODULE,

	},

	{

		.name		= "tos",

		.revision	= 1,

		.family		= AF_INET,

		.match		= tos_mt,

		.matchsize	= sizeof(struct xt_tos_match_info),

		.me		= THIS_MODULE,

	},

	{

		.name		= "tos",

		.revision	= 1,

		.family		= AF_INET6,

		.match		= tos_mt,

		.matchsize	= sizeof(struct xt_tos_match_info),

		.me		= THIS_MODULE,

	},

};



static int __init dscp_mt_init(void)