From 16fcc85c283537ea00357e2ca4bbb561c03bc65b Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 11 May 2016 00:21:24 +0200 Subject: src: add dscp support This supports both IPv4: # nft --debug=netlink add rule filter forward ip dscp cs1 counter ip filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x000000fc ) ^ 0x00000000 ] [ cmp neq reg 1 0x00000080 ] [ counter pkts 0 bytes 0 ] And also IPv6, note that in this case we take two bytes from the payload: # nft --debug=netlink add rule ip6 filter input ip6 dscp cs4 counter ip6 filter input [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x0000c00f ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000008 ] [ counter pkts 0 bytes 0 ] Given the DSCP is split in two bytes, the less significant nibble of the first byte and the two most significant 2 bits of the second byte. The 8 bit traffic class in RFC2460 after the version field are used for DSCP (6 bit) and ECN (2 bit). Support for ECN comes in a follow up patch. Signed-off-by: Pablo Neira Ayuso --- src/scanner.l | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/scanner.l') diff --git a/src/scanner.l b/src/scanner.l index 60b61a5a..275beaa1 100644 --- a/src/scanner.l +++ b/src/scanner.l @@ -362,7 +362,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) "ip" { return IP; } "version" { return HDRVERSION; } "hdrlength" { return HDRLENGTH; } -"tos" { return TOS; } +"dscp" { return DSCP; } "length" { return LENGTH; } "frag-off" { return FRAG_OFF; } "ttl" { return TTL; } -- cgit v1.2.3