Merge branch 'for-2.6.28' of git://linux-nfs.org/~bfields/linux
[linux-2.6] / net / netfilter / xt_dscp.c
1 /* IP tables module for matching the value of the IPv4/IPv6 DSCP field
2  *
3  * (C) 2002 by Harald Welte <laforge@netfilter.org>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License version 2 as
7  * published by the Free Software Foundation.
8  */
9
10 #include <linux/module.h>
11 #include <linux/skbuff.h>
12 #include <linux/ip.h>
13 #include <linux/ipv6.h>
14 #include <net/dsfield.h>
15
16 #include <linux/netfilter/x_tables.h>
17 #include <linux/netfilter/xt_dscp.h>
18 #include <linux/netfilter_ipv4/ipt_tos.h>
19
20 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
21 MODULE_DESCRIPTION("Xtables: DSCP/TOS field match");
22 MODULE_LICENSE("GPL");
23 MODULE_ALIAS("ipt_dscp");
24 MODULE_ALIAS("ip6t_dscp");
25 MODULE_ALIAS("ipt_tos");
26 MODULE_ALIAS("ip6t_tos");
27
28 static bool
29 dscp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
30 {
31         const struct xt_dscp_info *info = par->matchinfo;
32         u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT;
33
34         return (dscp == info->dscp) ^ !!info->invert;
35 }
36
37 static bool
38 dscp_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
39 {
40         const struct xt_dscp_info *info = par->matchinfo;
41         u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT;
42
43         return (dscp == info->dscp) ^ !!info->invert;
44 }
45
46 static bool dscp_mt_check(const struct xt_mtchk_param *par)
47 {
48         const struct xt_dscp_info *info = par->matchinfo;
49
50         if (info->dscp > XT_DSCP_MAX) {
51                 printk(KERN_ERR "xt_dscp: dscp %x out of range\n", info->dscp);
52                 return false;
53         }
54
55         return true;
56 }
57
58 static bool
59 tos_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
60 {
61         const struct ipt_tos_info *info = par->matchinfo;
62
63         return (ip_hdr(skb)->tos == info->tos) ^ info->invert;
64 }
65
66 static bool tos_mt(const struct sk_buff *skb, const struct xt_match_param *par)
67 {
68         const struct xt_tos_match_info *info = par->matchinfo;
69
70         if (par->match->family == NFPROTO_IPV4)
71                 return ((ip_hdr(skb)->tos & info->tos_mask) ==
72                        info->tos_value) ^ !!info->invert;
73         else
74                 return ((ipv6_get_dsfield(ipv6_hdr(skb)) & info->tos_mask) ==
75                        info->tos_value) ^ !!info->invert;
76 }
77
78 static struct xt_match dscp_mt_reg[] __read_mostly = {
79         {
80                 .name           = "dscp",
81                 .family         = NFPROTO_IPV4,
82                 .checkentry     = dscp_mt_check,
83                 .match          = dscp_mt,
84                 .matchsize      = sizeof(struct xt_dscp_info),
85                 .me             = THIS_MODULE,
86         },
87         {
88                 .name           = "dscp",
89                 .family         = NFPROTO_IPV6,
90                 .checkentry     = dscp_mt_check,
91                 .match          = dscp_mt6,
92                 .matchsize      = sizeof(struct xt_dscp_info),
93                 .me             = THIS_MODULE,
94         },
95         {
96                 .name           = "tos",
97                 .revision       = 0,
98                 .family         = NFPROTO_IPV4,
99                 .match          = tos_mt_v0,
100                 .matchsize      = sizeof(struct ipt_tos_info),
101                 .me             = THIS_MODULE,
102         },
103         {
104                 .name           = "tos",
105                 .revision       = 1,
106                 .family         = NFPROTO_IPV4,
107                 .match          = tos_mt,
108                 .matchsize      = sizeof(struct xt_tos_match_info),
109                 .me             = THIS_MODULE,
110         },
111         {
112                 .name           = "tos",
113                 .revision       = 1,
114                 .family         = NFPROTO_IPV6,
115                 .match          = tos_mt,
116                 .matchsize      = sizeof(struct xt_tos_match_info),
117                 .me             = THIS_MODULE,
118         },
119 };
120
121 static int __init dscp_mt_init(void)
122 {
123         return xt_register_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg));
124 }
125
126 static void __exit dscp_mt_exit(void)
127 {
128         xt_unregister_matches(dscp_mt_reg, ARRAY_SIZE(dscp_mt_reg));
129 }
130
131 module_init(dscp_mt_init);
132 module_exit(dscp_mt_exit);