From 161fb8ad126d8f330c8f59a4a1b5885d26477664 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 17 Nov 2022 16:10:14 +0100 Subject: extensions: TOS: Fix v1 xlate callback Translation entirely ignored tos_mask field. Fixes: b669e18489709 ("extensions: libxt_TOS: Add translation to nft") Signed-off-by: Phil Sutter --- extensions/libxt_TOS.txlate | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'extensions/libxt_TOS.txlate') diff --git a/extensions/libxt_TOS.txlate b/extensions/libxt_TOS.txlate index 0952310e..9c126742 100644 --- a/extensions/libxt_TOS.txlate +++ b/extensions/libxt_TOS.txlate @@ -14,10 +14,13 @@ ip6tables-translate -A INPUT -j TOS --set-tos Normal-Service nft add rule ip6 filter INPUT counter ip6 dscp set 0x00 ip6tables-translate -A INPUT -j TOS --and-tos 0x12 -nft add rule ip6 filter INPUT counter ip6 dscp set 0x00 +nft add rule ip6 filter INPUT counter ip6 dscp set ip6 dscp and 0x04 ip6tables-translate -A INPUT -j TOS --or-tos 0x12 -nft add rule ip6 filter INPUT counter ip6 dscp set 0x04 +nft add rule ip6 filter INPUT counter ip6 dscp set ip6 dscp or 0x04 ip6tables-translate -A INPUT -j TOS --xor-tos 0x12 -nft add rule ip6 filter INPUT counter ip6 dscp set 0x04 +nft add rule ip6 filter INPUT counter ip6 dscp set ip6 dscp xor 0x04 + +ip6tables-translate -A INPUT -j TOS --set-tos 0x12/0x34 +nft add rule ip6 filter INPUT counter ip6 dscp set ip6 dscp and 0x32 xor 0x04 -- cgit v1.2.3