[deliverable/linux.git] / net / netfilter / xt_dscp.c

/* IP tables module for matching the value of the IPv4/IPv6 DSCP field
 *
 * (C) 2002 by Harald Welte <laforge@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <net/dsfield.h>

#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_dscp.h>
#include <linux/netfilter_ipv4/ipt_tos.h>

MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("Xtables: DSCP/TOS field match");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_dscp");
MODULE_ALIAS("ip6t_dscp");
MODULE_ALIAS("ipt_tos");
MODULE_ALIAS("ip6t_tos");

static bool
dscp_mt(const struct sk_buff *skb, const struct net_device *in,
        const struct net_device *out, const struct xt_match *match,
        const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{
	const struct xt_dscp_info *info = matchinfo;
	u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT;

	return (dscp == info->dscp) ^ !!info->invert;
}

static bool
dscp_mt6(const struct sk_buff *skb, const struct net_device *in,
         const struct net_device *out, const struct xt_match *match,
         const void *matchinfo, int offset, unsigned int protoff,
         bool *hotdrop)
{
	const struct xt_dscp_info *info = matchinfo;
	u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT;

	return (dscp == info->dscp) ^ !!info->invert;
}

static bool
dscp_mt_check(const char *tablename, const void *info,
              const struct xt_match *match, void *matchinfo,
              unsigned int hook_mask)
{
	const u_int8_t dscp = ((struct xt_dscp_info *)matchinfo)->dscp;

	if (dscp > XT_DSCP_MAX) {
		printk(KERN_ERR "xt_dscp: dscp %x out of range\n", dscp);
		return false;
	}

	return true;
}

static bool tos_mt_v0(const struct sk_buff *skb, const struct net_device *in,
                      const struct net_device *out,
                      const struct xt_match *match, const void *matchinfo,
                      int offset, unsigned int protoff, bool *hotdrop)
{
	const struct ipt_tos_info *info = matchinfo;

	return (ip_hdr(skb)->tos == info->tos) ^ info->invert;
}

static bool tos_mt(const struct sk_buff *skb, const struct net_device *in,
                   const struct net_device *out, const struct xt_match *match,
                   const void *matchinfo, int offset, unsigned int protoff,
                   bool *hotdrop)
{
	const struct xt_tos_match_info *info = matchinfo;

	if (match->family == AF_INET)
		return ((ip_hdr(skb)->tos & info->tos_mask) ==
		       info->tos_value) ^ !!info->invert;
	else
		return ((ipv6_get_dsfield(ipv6_hdr(skb)) & info->tos_mask) ==
		       info->tos_value) ^ !!info->invert;
}

static struct xt_match dscp_mt_reg[] __read_mostly = {
	{
		.name		= "dscp",
		.family		= AF_INET,
		.checkentry	= dscp_mt_check,
		.match		= dscp_mt,
		.matchsize	= sizeof(struct xt_dscp_info),
		.me		= THIS_MODULE,
	},
	{
		.name		= "dscp",
		.family		= AF_INET6,
		.checkentry	= dscp_mt_check,
		.match		= dscp_mt6,
		.matchsize	= sizeof(struct xt_dscp_info),
		.me		= THIS_MODULE,
	},
	{
		.name		= "tos",
		.revision	= 0,
		.family		= AF_INET,
		.match		= tos_mt_v0,
		.matchsize	= sizeof(struct ipt_tos_info),
		.me		= THIS_MODULE,
	},
	{
		.name		= "tos",
		.revision	= 1,
		.family		= AF_INET,
		.match		= tos_mt,
		.matchsize	= sizeof(struct xt_tos_match_info),
		.me		= THIS_MODULE,
	},
	{
		.name		= "tos",
		.revision	= 1,
		.family		= AF_INET6,
		.match		= tos_mt,
		.matchsize	= sizeof(struct xt_tos_match_info),
		.me		= THIS_MODULE,
	},
};

static int __init dscp_mt_init(void)
{
	return xt_register_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg));
}

static void __exit dscp_mt_exit(void)
{
	xt_unregister_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg));
}

module_init(dscp_mt_init);
module_exit(dscp_mt_exit);
Commit	Line	Data
9ba16276	1	/* IP tables module for matching the value of the IPv4/IPv6 DSCP field
9ba16276 YK	2	*
	3	* (C) 2002 by Harald Welte <laforge@netfilter.org>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation.
	8	*/
	9
	10	#include <linux/module.h>
	11	#include <linux/skbuff.h>
	12	#include <linux/ip.h>
	13	#include <linux/ipv6.h>
	14	#include <net/dsfield.h>
	15
9ba16276	16	#include <linux/netfilter/x_tables.h>
c3b33e6a JE	17	#include <linux/netfilter/xt_dscp.h>
c3b33e6a JE	18	#include <linux/netfilter_ipv4/ipt_tos.h>
9ba16276 YK	19
9ba16276 YK	20	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
2ae15b64	21	MODULE_DESCRIPTION("Xtables: DSCP/TOS field match");
9ba16276 YK	22	MODULE_LICENSE("GPL");
	23	MODULE_ALIAS("ipt_dscp");
	24	MODULE_ALIAS("ip6t_dscp");
c3b33e6a	25	MODULE_ALIAS("ipt_tos");
f1095ab5	26	MODULE_ALIAS("ip6t_tos");
9ba16276	27
d3c5ee6d JE	28	static bool
	29	dscp_mt(const struct sk_buff skb, const struct net_device in,
	30	const struct net_device out, const struct xt_match match,
	31	const void matchinfo, int offset, unsigned int protoff, bool hotdrop)
1d93a9cb JE	32	{
	33	const struct xt_dscp_info *info = matchinfo;
	34	u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT;
	35
	36	return (dscp == info->dscp) ^ !!info->invert;
	37	}
	38
d3c5ee6d JE	39	static bool
	40	dscp_mt6(const struct sk_buff skb, const struct net_device in,
	41	const struct net_device out, const struct xt_match match,
	42	const void *matchinfo, int offset, unsigned int protoff,
	43	bool *hotdrop)
9ba16276 YK	44	{
9ba16276 YK	45	const struct xt_dscp_info *info = matchinfo;
0660e03f	46	u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT;
9ba16276 YK	47
	48	return (dscp == info->dscp) ^ !!info->invert;
	49	}
	50
d3c5ee6d JE	51	static bool
	52	dscp_mt_check(const char tablename, const void info,
	53	const struct xt_match match, void matchinfo,
	54	unsigned int hook_mask)
9ba16276 YK	55	{
	56	const u_int8_t dscp = ((struct xt_dscp_info *)matchinfo)->dscp;
	57
	58	if (dscp > XT_DSCP_MAX) {
	59	printk(KERN_ERR "xt_dscp: dscp %x out of range\n", dscp);
ccb79bdc	60	return false;
9ba16276 YK	61	}
9ba16276 YK	62
ccb79bdc	63	return true;
9ba16276 YK	64	}
9ba16276 YK	65
c3b33e6a JE	66	static bool tos_mt_v0(const struct sk_buff skb, const struct net_device in,
	67	const struct net_device *out,
	68	const struct xt_match match, const void matchinfo,
	69	int offset, unsigned int protoff, bool *hotdrop)
	70	{
	71	const struct ipt_tos_info *info = matchinfo;
	72
	73	return (ip_hdr(skb)->tos == info->tos) ^ info->invert;
	74	}
	75
f1095ab5 JE	76	static bool tos_mt(const struct sk_buff skb, const struct net_device in,
	77	const struct net_device out, const struct xt_match match,
	78	const void *matchinfo, int offset, unsigned int protoff,
	79	bool *hotdrop)
	80	{
	81	const struct xt_tos_match_info *info = matchinfo;
	82
	83	if (match->family == AF_INET)
	84	return ((ip_hdr(skb)->tos & info->tos_mask) ==
	85	info->tos_value) ^ !!info->invert;
	86	else
	87	return ((ipv6_get_dsfield(ipv6_hdr(skb)) & info->tos_mask) ==
	88	info->tos_value) ^ !!info->invert;
	89	}
	90
d3c5ee6d	91	static struct xt_match dscp_mt_reg[] __read_mostly = {
4470bbc7 PM	92	{
	93	.name = "dscp",
	94	.family = AF_INET,
d3c5ee6d JE	95	.checkentry = dscp_mt_check,
d3c5ee6d JE	96	.match = dscp_mt,
4470bbc7 PM	97	.matchsize = sizeof(struct xt_dscp_info),
	98	.me = THIS_MODULE,
	99	},
	100	{
	101	.name = "dscp",
	102	.family = AF_INET6,
d3c5ee6d JE	103	.checkentry = dscp_mt_check,
d3c5ee6d JE	104	.match = dscp_mt6,
4470bbc7 PM	105	.matchsize = sizeof(struct xt_dscp_info),
	106	.me = THIS_MODULE,
	107	},
c3b33e6a JE	108	{
	109	.name = "tos",
	110	.revision = 0,
	111	.family = AF_INET,
	112	.match = tos_mt_v0,
	113	.matchsize = sizeof(struct ipt_tos_info),
	114	.me = THIS_MODULE,
	115	},
f1095ab5 JE	116	{
	117	.name = "tos",
	118	.revision = 1,
	119	.family = AF_INET,
	120	.match = tos_mt,
	121	.matchsize = sizeof(struct xt_tos_match_info),
	122	.me = THIS_MODULE,
	123	},
	124	{
	125	.name = "tos",
	126	.revision = 1,
	127	.family = AF_INET6,
	128	.match = tos_mt,
	129	.matchsize = sizeof(struct xt_tos_match_info),
	130	.me = THIS_MODULE,
	131	},
9ba16276 YK	132	};
9ba16276 YK	133
d3c5ee6d	134	static int __init dscp_mt_init(void)
9ba16276	135	{
d3c5ee6d	136	return xt_register_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg));
9ba16276 YK	137	}
9ba16276 YK	138
d3c5ee6d	139	static void __exit dscp_mt_exit(void)
9ba16276	140	{
d3c5ee6d	141	xt_unregister_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg));
9ba16276 YK	142	}
9ba16276 YK	143
d3c5ee6d JE	144	module_init(dscp_mt_init);
d3c5ee6d JE	145	module_exit(dscp_mt_exit);