diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-05-11 00:21:24 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-05-11 23:01:31 +0200 |
commit | 16fcc85c283537ea00357e2ca4bbb561c03bc65b (patch) | |
tree | 8ab5e756ee08dca26a10c3977679e5423e786d56 /doc/nft.xml | |
parent | 7fbbeb1f0db7718fbfedea4e50f69a54d1bfda70 (diff) |
src: add dscp support
This supports both IPv4:
# nft --debug=netlink add rule filter forward ip dscp cs1 counter
ip filter forward
[ payload load 1b @ network header + 1 => reg 1 ]
[ bitwise reg 1 = (reg=1 & 0x000000fc ) ^ 0x00000000 ]
[ cmp neq reg 1 0x00000080 ]
[ counter pkts 0 bytes 0 ]
And also IPv6, note that in this case we take two bytes from the payload:
# nft --debug=netlink add rule ip6 filter input ip6 dscp cs4 counter
ip6 filter input
[ payload load 2b @ network header + 0 => reg 1 ]
[ bitwise reg 1 = (reg=1 & 0x0000c00f ) ^ 0x00000000 ]
[ cmp eq reg 1 0x00000008 ]
[ counter pkts 0 bytes 0 ]
Given the DSCP is split in two bytes, the less significant nibble
of the first byte and the two most significant 2 bits of the second
byte.
The 8 bit traffic class in RFC2460 after the version field are used for
DSCP (6 bit) and ECN (2 bit). Support for ECN comes in a follow up
patch.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'doc/nft.xml')
-rw-r--r-- | doc/nft.xml | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/doc/nft.xml b/doc/nft.xml index 19b56075..a2770bfa 100644 --- a/doc/nft.xml +++ b/doc/nft.xml @@ -1393,9 +1393,9 @@ filter output oif eth0 <entry>integer (4 bit) FIXME scaling</entry> </row> <row> - <entry>tos</entry> - <entry>Type Of Service</entry> - <entry>FIXME</entry> + <entry>dscp</entry> + <entry>Differentiated Services Code Point</entry> + <entry>integer (6 bit)</entry> </row> <row> <entry>length</entry> @@ -1477,6 +1477,11 @@ filter output oif eth0 <entry></entry> </row> <row> + <entry>dscp</entry> + <entry>Differentiated Services Code Point</entry> + <entry>integer (6 bit)</entry> + </row> + <row> <entry>flowlabel</entry> <entry>Flow label</entry> <entry>integer (20 bit)</entry> |