From araujo@FreeBSD.org  Tue Feb 26 14:39:50 2008
Return-Path: <araujo@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id AB8661065671
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 26 Feb 2008 14:39:50 +0000 (UTC)
	(envelope-from araujo@FreeBSD.org)
Received: from mail.intelbras.com.br (mail.intelbras.com.br [201.24.77.45])
	by mx1.freebsd.org (Postfix) with ESMTP id 3939913C45E
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 26 Feb 2008 14:39:49 +0000 (UTC)
	(envelope-from araujo@FreeBSD.org)
Received: from localhost (localhost.intelbras.com.br [127.0.0.1])
	by mail.intelbras.com.br (Postfix) with ESMTP id D9DF72DA503
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 26 Feb 2008 11:39:43 -0300 (BRT)
Received: from mail.intelbras.com.br ([127.0.0.1])
	by localhost (copernicus.intelbras.com.br [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id Pn6SW3NI3WQb for <FreeBSD-gnats-submit@freebsd.org>;
	Tue, 26 Feb 2008 11:39:43 -0300 (BRT)
Received: from island.freebsd.org (unknown [192.168.130.1])
	by mail.intelbras.com.br (Postfix) with ESMTP id 7F8122DA4F5
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 26 Feb 2008 11:39:43 -0300 (BRT)
Message-Id: <1204036783.38664@island.freebsd.org>
Date: Tue, 26 Feb 2008 11:39:43 -0300
From: "Marcelo Araujo" <araujo@FreeBSD.org>
To: "FreeBSD gnats submit" <FreeBSD-gnats-submit@freebsd.org>
Subject: [ipfw] [patch] add support to ToS IP PRECEDENCE fields
X-Send-Pr-Version: gtk-send-pr 0.4.8 
X-GNATS-Notify:

>Number:         121122
>Category:       kern
>Synopsis:       [ipfw] [patch] add support to ToS IP PRECEDENCE fields
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    melifaro
>State:          patched
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          update
>Submitter-Id:   current-users
>Arrival-Date:   Tue Feb 26 14:40:01 UTC 2008
>Closed-Date:    
>Last-Modified:  Sat May 18 05:50:01 UTC 2013
>Originator:     Marcelo Araujo
>Release:        FreeBSD 7.0-PRERELEASE i386
>Organization:
FreeBSD 
>Environment:


System: FreeBSD 7.0-PRERELEASE #10: Mon Feb 25 08:41:00 BRT 2008
    araujo@island.freebsd.org:/usr/obj/usr/src/sys/ISLAND



>Description:


The patch add some features described in:
- RFC 0791
- RFC 1122
- RFC 1349
- http://www3.tools.ietf.org/html/draft-xiao-tcp-prec-01

You can change the IP PRECEDENCE fields within ToS header, you can also check packages that have this mark within your network, some benefits are relevant, you can classifies many type of packages and prioritize it in your network.

1 - Set some type of IP PRECEDENCE inside a package:

ipfw add 10 iptospre flashover ip from any to any

2 - You can check packages within your network that have the IP PRECEDENCE fields:

ipfw add 11 count ip from any to any iptospre flashover

The patch is based in PR kern/102471,
novel@ thanks for your help.

References:
http://code.google.com/p/exports/wiki/ToSWorkAround



>How-To-Repeat:





>Fix:


--- ipfw-ToS8bits.diff begins here ---
Index: sbin/ipfw/ipfw2.c
===================================================================
RCS file: /home/ncvs/src/sbin/ipfw/ipfw2.c,v
retrieving revision 1.117
diff -u -r1.117 ipfw2.c
--- sbin/ipfw/ipfw2.c	24 Feb 2008 15:37:45 -0000	1.117
+++ sbin/ipfw/ipfw2.c	26 Feb 2008 14:37:20 -0000
@@ -177,6 +177,18 @@
 	{ NULL,	0 }
 };
 
+static struct _s_x f_iptospre[] = {
+	{ "netcontrol",		IPTOSPRE_NETCONTROL},
+	{ "intercontrol",	IPTOSPRE_INTERCONTROL},
+	{ "criticecp",		IPTOSPRE_CRITICECP},
+	{ "flashover",		IPTOSPRE_FLASHOVER},
+	{ "flash",			IPTOSPRE_FLASH},
+	{ "immediate",		IPTOSPRE_IMMEDIATE},
+	{ "priority",		IPTOSPRE_PRIORITY},
+	{ "routine",		IPTOSPRE_ROUTINE},
+	{ NULL, 0}
+};
+
 static struct _s_x f_iptos[] = {
 	{ "lowdelay",	IPTOS_LOWDELAY},
 	{ "throughput",	IPTOS_THROUGHPUT},
@@ -282,6 +294,7 @@
 	TOK_IPLEN,
 	TOK_IPID,
 	TOK_IPPRECEDENCE,
+	TOK_IPTOSPRE,
 	TOK_IPTOS,
 	TOK_IPTTL,
 	TOK_IPVER,
@@ -317,6 +330,7 @@
 	TOK_GRED,
 	TOK_DROPTAIL,
 	TOK_PROTO,
+	TOK_SETIPTOSPRE,
 	TOK_WEIGHT,
 	TOK_IP,
 	TOK_IF,
@@ -411,6 +425,7 @@
 	{ "unreach6",		TOK_UNREACH6 },
 	{ "unreach",		TOK_UNREACH },
 	{ "check-state",	TOK_CHECKSTATE },
+	{ "iptospre",		TOK_SETIPTOSPRE },
 	{ "//",			TOK_COMMENT },
 	{ "nat",                TOK_NAT },
 	{ NULL, 0 }	/* terminator */
@@ -449,6 +464,7 @@
 	{ "ipid",		TOK_IPID },
 	{ "ipprecedence",	TOK_IPPRECEDENCE },
 	{ "iptos",		TOK_IPTOS },
+	{ "iptospre",	TOK_IPTOSPRE },
 	{ "ipttl",		TOK_IPTTL },
 	{ "ipversion",		TOK_IPVER },
 	{ "ipver",		TOK_IPVER },
@@ -1599,6 +1615,10 @@
 		    }
 			break;
 
+		case O_SETIPTOSPRE:
+			printf("iptospre %s", match_value(f_iptospre, cmd->arg1));
+			break;
+
 		case O_LOG: /* O_LOG is printed last */
 			logptr = (ipfw_insn_log *)cmd;
 			break;
@@ -1910,6 +1930,10 @@
 				printf(" established");
 				break;
 
+			case O_IPTOSPRE:
+				printf(" iptospre %s", match_value(f_iptospre, cmd->arg1));
+				break;
+
 			case O_TCPDATALEN:
 				if (F_LEN(cmd) == 1)
 				    printf(" tcpdatalen %u", cmd->arg1 );
@@ -2712,7 +2736,7 @@
 "RULE-BODY:	check-state [PARAMS] | ACTION [PARAMS] ADDR [OPTION_LIST]\n"
 "ACTION:	check-state | allow | count | deny | unreach{,6} CODE |\n"
 "               skipto N | {divert|tee} PORT | forward ADDR |\n"
-"               pipe N | queue N | nat N\n"
+"               pipe N | queue N | iptospre CODE | nat N\n"
 "PARAMS: 	[log [logamount LOGLIMIT]] [altq QUEUE_NAME]\n"
 "ADDR:		[ MAC dst src ether_type ] \n"
 "		[ ip from IPADDR [ PORT ] to IPADDR [ PORTLIST ] ]\n"
@@ -2725,6 +2749,7 @@
 "OPTION:	bridged | diverted | diverted-loopback | diverted-output |\n"
 "	{dst-ip|src-ip} IPADDR | {dst-ip6|src-ip6|dst-ipv6|src-ipv6} IP6ADDR |\n"
 "	{dst-port|src-port} LIST |\n"
+"	iptospre CODE | {dst-ip|src-ip} IPADDR |\n"
 "	estab | frag | {gid|uid} N | icmptypes LIST | in | out | ipid LIST |\n"
 "	iplen LIST | ipoptions SPEC | ipprecedence | ipsec | iptos SPEC |\n"
 "	ipttl LIST | ipversion VER | keep-state | layer2 | limit ... |\n"
@@ -4848,6 +4873,12 @@
 		action->opcode = O_COUNT;
 		break;
 
+	case TOK_SETIPTOSPRE:
+		NEED1("need iptospre arg\n");
+		fill_flags(action, O_SETIPTOSPRE, f_iptospre, *av);
+		ac--; av++;
+		break;
+
 	case TOK_NAT:
  		action->opcode = O_NAT;
  		action->len = F_INSN_SIZE(ipfw_insn_nat);
@@ -5334,6 +5365,12 @@
 			ac--; av++;
 			break;
 
+		case TOK_IPTOSPRE:
+			NEED1("missing argument for iptospre");
+			fill_flags(cmd, O_IPTOSPRE, f_iptospre, *av);
+			ac--; av++;
+			break;
+
 		case TOK_IPTOS:
 			NEED1("missing argument for iptos");
 			fill_flags(cmd, O_IPTOS, f_iptos, *av);
Index: sys/netinet/ip_fw.h
===================================================================
RCS file: /home/ncvs/src/sys/netinet/ip_fw.h,v
retrieving revision 1.111
diff -u -r1.111 ip_fw.h
--- sys/netinet/ip_fw.h	25 Jan 2008 14:38:27 -0000	1.111
+++ sys/netinet/ip_fw.h	26 Feb 2008 14:37:21 -0000
@@ -161,6 +161,9 @@
 	O_TAG,   		/* arg1=tag number */
 	O_TAGGED,		/* arg1=tag number */
 
+	O_SETIPTOSPRE,	/* Add ToS PRECEDENCE support. */
+	O_IPTOSPRE,		/* Add ToS PRECEDENCE support. */
+
 	O_LAST_OPCODE		/* not an opcode!		*/
 };
 
@@ -510,6 +513,16 @@
 #define	IP_FW_IPOPT_RR		0x04
 #define	IP_FW_IPOPT_TS		0x08
 
+/* Definitions for IP ToS PRECEDENCE. */ 
+#define	IPTOSPRE_NETCONTROL		224	/* bin = 111 dec = 224 hex = 0xe0 */
+#define	IPTOSPRE_INTERCONTROL		192	/* bin = 110 dec = 192 hex = 0xc0 */
+#define	IPTOSPRE_CRITICECP		160	/* bin = 101 dec = 160 hex = 0xa0 */
+#define	IPTOSPRE_FLASHOVER		128	/* bin = 100 dec = 128 hex = 0x80 */
+#define	IPTOSPRE_FLASH			96	/* bin = 011 dec = 96  hex = 0x60 */
+#define	IPTOSPRE_IMMEDIATE		64	/* bin = 010 dec = 64  hex = 0x40 */
+#define	IPTOSPRE_PRIORITY			32	/* bin = 001 dec = 32  hex = 0x20 */
+#define	IPTOSPRE_ROUTINE			0	/* bin = 000 dec = 0   hex = 0x00 */
+
 /*
  * Definitions for TCP option names.
  */
@@ -626,5 +639,22 @@
 extern	ip_fw_chk_t	*ip_fw_chk_ptr;
 #define	IPFW_LOADED	(ip_fw_chk_ptr != NULL)
 
+/* Some novel@ code. */
+#define ADJUST_CHECKSUM(acc, cksum) \
+		do { \
+				acc += cksum; \
+				if (acc < 0) { \
+					acc = -acc; \
+					acc = (acc >> 16) + (acc & 0xffff); \
+					acc += acc >> 16; \
+					cksum = (u_short) ~acc; \
+				} else { \
+					acc = (acc >> 16) + (acc & 0xffff); \
+					acc += acc >> 16; \
+					cksum = (u_short) acc; \
+				} \
+		} while (0)
+/* Some novel@ code. */
+
 #endif /* _KERNEL */
 #endif /* _IPFW2_H */
Index: sys/netinet/ip_fw2.c
===================================================================
RCS file: /home/ncvs/src/sys/netinet/ip_fw2.c,v
retrieving revision 1.181
diff -u -r1.181 ip_fw2.c
--- sys/netinet/ip_fw2.c	24 Feb 2008 15:37:45 -0000	1.181
+++ sys/netinet/ip_fw2.c	26 Feb 2008 14:37:25 -0000
@@ -177,6 +177,21 @@
 
 extern int ipfw_chg_hook(SYSCTL_HANDLER_ARGS);
 
+/* some @novel code. */
+static __inline int
+twowords(void *p) {
+	uint8_t *c = p;
+#if BYTE_ORDER == LITTLE_ENDIAN
+	uint16_t s1 = ((uint16_t)c[1] << 8) + (uint16_t)c[0];
+	uint16_t s2 = ((uint16_t)c[3] << 8) + (uint16_t)c[2];
+#else
+	uint16_t s1 = ((uint16_t)c[0] << 8) + (uint16_t)c[1];
+	uint16_t s2 = ((uint16_t)c[2] << 8) + (uint16_t)c[3];
+#endif
+	return (s1 + s2);
+}
+/* some @novel code. */
+
 #ifdef SYSCTL_NODE
 SYSCTL_NODE(_net_inet_ip, OID_AUTO, fw, CTLFLAG_RW, 0, "Firewall");
 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, enable,
@@ -2700,6 +2715,7 @@
 	for (; f; f = f->next) {
 		ipfw_insn *cmd;
 		uint32_t tablearg = 0;
+		int accumulate; /* Novel@ code. */
 		int l, cmdlen, skip_or; /* skip rest of OR block */
 
 again:
@@ -3006,6 +3022,11 @@
 				    flags_match(cmd, ip->ip_tos));
 				break;
 
+			case O_IPTOSPRE:
+				match = (is_ipv4 &&
+				    flags_match(cmd, ip->ip_tos));
+					break;
+
 			case O_TCPDATALEN:
 				if (proto == IPPROTO_TCP && offset == 0) {
 				    struct tcphdr *tcp;
@@ -3322,6 +3343,18 @@
 				match = 1;
 				break;
 
+			/* Insert within IP ToS PRECEDENCE field. */
+			case O_SETIPTOSPRE:
+				accumulate = twowords(&ip->ip_tos);
+				ip->ip_tos= cmd->arg1;
+				accumulate -= twowords(&ip->ip_tos);
+				ADJUST_CHECKSUM(accumulate, ip->ip_sum);
+				f->pcnt++; /* update stats */
+				f->bcnt += pktlen;
+				f->timestamp = time_second;
+				goto next_rule;
+			/* Insert within IP ToS PRECEDENCE field. */
+
 			case O_PROBE_STATE:
 			case O_CHECK_STATE:
 				/*
@@ -4119,6 +4152,7 @@
 		case O_FRAG:
 		case O_DIVERTED:
 		case O_IPOPT:
+		case O_IPTOSPRE:
 		case O_IPTOS:
 		case O_IPPRECEDENCE:
 		case O_IPVER:
@@ -4142,6 +4176,10 @@
 				goto bad_size;
 			break;
 
+		case O_SETIPTOSPRE:
+			have_action = 1;
+			break;
+
 		case O_UID:
 		case O_GID:
 		case O_JAIL:
--- ipfw-ToS8bits.diff ends here ---



>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-ipfw 
Responsible-Changed-By: araujo 
Responsible-Changed-When: Tue Feb 26 19:08:49 UTC 2008 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=121122 
Responsible-Changed-From-To: freebsd-ipfw->melifaro 
Responsible-Changed-By: melifaro 
Responsible-Changed-When: Thu Mar 14 13:48:37 UTC 2013 
Responsible-Changed-Why:  
Take. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=121122 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/121122: commit references a PR
Date: Wed, 20 Mar 2013 10:35:43 +0000 (UTC)

 Author: melifaro
 Date: Wed Mar 20 10:35:33 2013
 New Revision: 248552
 URL: http://svnweb.freebsd.org/changeset/base/248552
 
 Log:
   Add ipfw support for setting/matching DiffServ codepoints (DSCP).
   
   Setting DSCP support is done via O_SETDSCP which works for both
   IPv4 and IPv6 packets. Fast checksum recalculation (RFC 1624) is done for IPv4.
   Dscp can be specified by name (AFXY, CSX, BE, EF), by value
   (0..63) or via tablearg.
   
   Matching DSCP is done via another opcode (O_DSCP) which accepts several
   classes at once (af11,af22,be). Classes are stored in bitmask (2 u32 words).
   
   Many people made their variants of this patch, the ones I'm aware of are
   (in alphabetic order):
   
   Dmitrii Tejblum
   Marcelo Araujo
   Roman Bogorodskiy (novel)
   Sergey Matveichuk (sem)
   Sergey Ryabin
   
   PR:		kern/102471, kern/121122
   MFC after:	2 weeks
 
 Modified:
   head/sbin/ipfw/ipfw.8
   head/sbin/ipfw/ipfw2.c
   head/sbin/ipfw/ipfw2.h
   head/sys/netinet/ip_fw.h
   head/sys/netpfil/ipfw/ip_fw2.c
   head/sys/netpfil/ipfw/ip_fw_log.c
   head/sys/netpfil/ipfw/ip_fw_sockopt.c
 
 Modified: head/sbin/ipfw/ipfw.8
 ==============================================================================
 --- head/sbin/ipfw/ipfw.8	Wed Mar 20 09:56:20 2013	(r248551)
 +++ head/sbin/ipfw/ipfw.8	Wed Mar 20 10:35:33 2013	(r248552)
 @@ -960,6 +960,61 @@ It is possible to use the
  keyword with setfib.
  If the tablearg value is not within the compiled range of fibs,
  the packet's fib is set to 0.
 +.It Cm setdscp Ar DSCP | number | tablearg
 +Set specified DiffServ codepoint for an IPv4/IPv6 packet.
 +Processing continues at the next rule.
 +Supported values are:
 +.Pp
 +.Cm CS0
 +.Pq Dv 000000 ,
 +.Cm CS1
 +.Pq Dv 001000 ,
 +.Cm CS2
 +.Pq Dv 010000 ,
 +.Cm CS3
 +.Pq Dv 011000 ,
 +.Cm CS4
 +.Pq Dv 100000 ,
 +.Cm CS5
 +.Pq Dv 101000 ,
 +.Cm CS6
 +.Pq Dv 110000 ,
 +.Cm CS7
 +.Pq Dv 111000 ,
 +.Cm AF11
 +.Pq Dv 001010 ,
 +.Cm AF12
 +.Pq Dv 001100 ,
 +.Cm AF13
 +.Pq Dv 001110 ,
 +.Cm AF21
 +.Pq Dv 010010 ,
 +.Cm AF22
 +.Pq Dv 010100 ,
 +.Cm AF23
 +.Pq Dv 010110 ,
 +.Cm AF31
 +.Pq Dv 011010 ,
 +.Cm AF32
 +.Pq Dv 011100 ,
 +.Cm AF33
 +.Pq Dv 011110 ,
 +.Cm AF41
 +.Pq Dv 100010 ,
 +.Cm AF42
 +.Pq Dv 100100 ,
 +.Cm AF43
 +.Pq Dv 100110 ,
 +.Cm EF
 +.Pq Dv 101110 ,
 +.Cm BE
 +.Pq Dv 000000 .
 +Additionally, DSCP value can be specified by number (0..64).
 +It is also possible to use the
 +.Cm tablearg
 +keyword with setdscp.
 +If the tablearg value is not within the 0..64 range, lower 6 bits of supplied
 +value are used.
  .It Cm reass
  Queue and reassemble IP fragments.
  If the packet is not fragmented, counters are updated and
 @@ -1454,6 +1509,17 @@ The supported IP types of service are:
  The absence of a particular type may be denoted
  with a
  .Ql \&! .
 +.It Cm dscp spec Ns Op , Ns Ar spec
 +Matches IPv4/IPv6 packets whose
 +.Cm DS
 +field value is contained in
 +.Ar spec
 +mask.
 +Multiple values can be specified via 
 +the comma separated list.
 +Value can be one of keywords used in
 +.Cm setdscp
 +action or exact number.
  .It Cm ipttl Ar ttl-list
  Matches IPv4 packets whose time to live is included in
  .Ar ttl-list ,
 @@ -2976,6 +3042,23 @@ configured on
  but coming in on
  .Li fxp1
  would be dropped.
 +.Pp
 +The
 +.Cm setdscp
 +option could be used to (re)mark user traffic,
 +by adding the following to the appropriate place in ruleset:
 +.Pp
 +.Dl "ipfw add setdscp be ip from any to any dscp af11,af21"
 +.Pp
 +This rule drops all incoming packets that appear to be coming from another
 +directly connected system but on the wrong interface.
 +For example, a packet with a source address of
 +.Li 192.168.0.0/24 ,
 +configured on
 +.Li fxp0 ,
 +but coming in on
 +.Li fxp1
 +would be dropped.
  .Ss DYNAMIC RULES
  In order to protect a site from flood attacks involving fake
  TCP packets, it is safer to use dynamic rules:
 
 Modified: head/sbin/ipfw/ipfw2.c
 ==============================================================================
 --- head/sbin/ipfw/ipfw2.c	Wed Mar 20 09:56:20 2013	(r248551)
 +++ head/sbin/ipfw/ipfw2.c	Wed Mar 20 10:35:33 2013	(r248552)
 @@ -167,6 +167,32 @@ static struct _s_x f_iptos[] = {
  	{ NULL,	0 }
  };
  
 +static struct _s_x f_ipdscp[] = {
 +	{ "af11", IPTOS_DSCP_AF11 >> 2 },	/* 001010 */
 +	{ "af12", IPTOS_DSCP_AF12 >> 2 },	/* 001100 */
 +	{ "af13", IPTOS_DSCP_AF13 >> 2 },	/* 001110 */
 +	{ "af21", IPTOS_DSCP_AF21 >> 2 },	/* 010010 */
 +	{ "af22", IPTOS_DSCP_AF22 >> 2 },	/* 010100 */
 +	{ "af23", IPTOS_DSCP_AF23 >> 2 },	/* 010110 */
 +	{ "af31", IPTOS_DSCP_AF31 >> 2 },	/* 011010 */
 +	{ "af32", IPTOS_DSCP_AF32 >> 2 },	/* 011100 */
 +	{ "af33", IPTOS_DSCP_AF33 >> 2 },	/* 011110 */
 +	{ "af41", IPTOS_DSCP_AF41 >> 2 },	/* 100010 */
 +	{ "af42", IPTOS_DSCP_AF42 >> 2 },	/* 100100 */
 +	{ "af43", IPTOS_DSCP_AF43 >> 2 },	/* 100110 */
 +	{ "be", IPTOS_DSCP_CS0 >> 2 }, 	/* 000000 */
 +	{ "ef", IPTOS_DSCP_EF >> 2 },	/* 101110 */
 +	{ "cs0", IPTOS_DSCP_CS0 >> 2 },	/* 000000 */
 +	{ "cs1", IPTOS_DSCP_CS1 >> 2 },	/* 001000 */
 +	{ "cs2", IPTOS_DSCP_CS2 >> 2 },	/* 010000 */
 +	{ "cs3", IPTOS_DSCP_CS3 >> 2 },	/* 011000 */
 +	{ "cs4", IPTOS_DSCP_CS4 >> 2 },	/* 100000 */
 +	{ "cs5", IPTOS_DSCP_CS5 >> 2 },	/* 101000 */
 +	{ "cs6", IPTOS_DSCP_CS6 >> 2 },	/* 110000 */
 +	{ "cs7", IPTOS_DSCP_CS7 >> 2 },	/* 100000 */
 +	{ NULL, 0 }
 +};
 +
  static struct _s_x limit_masks[] = {
  	{"all",		DYN_SRC_ADDR|DYN_SRC_PORT|DYN_DST_ADDR|DYN_DST_PORT},
  	{"src-addr",	DYN_SRC_ADDR},
 @@ -237,6 +263,7 @@ static struct _s_x rule_actions[] = {
  	{ "nat",		TOK_NAT },
  	{ "reass",		TOK_REASS },
  	{ "setfib",		TOK_SETFIB },
 +	{ "setdscp",		TOK_SETDSCP },
  	{ "call",		TOK_CALL },
  	{ "return",		TOK_RETURN },
  	{ NULL, 0 }	/* terminator */
 @@ -714,6 +741,51 @@ fill_newports(ipfw_insn_u16 *cmd, char *
  	return (i);
  }
  
 +/*
 + * Fill the body of the command with the list of DiffServ codepoints.
 + */
 +static void
 +fill_dscp(ipfw_insn *cmd, char *av, int cblen)
 +{
 +	uint32_t *low, *high;
 +	char *s = av, *a;
 +	int code;
 +
 +	cmd->opcode = O_DSCP;
 +	cmd->len |= F_INSN_SIZE(ipfw_insn_u32) + 1;
 +
 +	CHECK_CMDLEN;
 +
 +	low = (uint32_t *)(cmd + 1);
 +	high = low + 1;
 +
 +	*low = 0;
 +	*high = 0;
 +
 +	while (s != NULL) {
 +		a = strchr(s, ',');
 +
 +		if (a != NULL)
 +			*a++ = '\0';
 +
 +		if (isalpha(*s)) {
 +			if ((code = match_token(f_ipdscp, s)) == -1)
 +				errx(EX_DATAERR, "Unknown DSCP code");
 +		} else {
 +			code = strtoul(s, NULL, 10);
 +			if (code < 0 || code > 63)
 +				errx(EX_DATAERR, "Invalid DSCP value");
 +		}
 +
 +		if (code > 32)
 +			*high |= 1 << (code - 32);
 +		else
 +			*low |= 1 << code;
 +
 +		s = a;
 +	}
 +}
 +
  static struct _s_x icmpcodes[] = {
        { "net",			ICMP_UNREACH_NET },
        { "host",			ICMP_UNREACH_HOST },
 @@ -972,6 +1044,32 @@ print_icmptypes(ipfw_insn_u32 *cmd)
  	}
  }
  
 +static void
 +print_dscp(ipfw_insn_u32 *cmd)
 +{
 +	int i, c;
 +	uint32_t *v;
 +	char sep= ' ';
 +	const char *code;
 +
 +	printf(" dscp");
 +	i = 0;
 +	c = 0;
 +	v = cmd->d;
 +	while (i < 64) {
 +		if (*v & (1 << i)) {
 +			if ((code = match_value(f_ipdscp, i)) != NULL)
 +				printf("%c%s", sep, code);
 +			else
 +				printf("%c%d", sep, i);
 +			sep = ',';
 +		}
 +
 +		if ((++i % 32) == 0)
 +			v++;
 +	}
 +}
 +
  /*
   * show_ipfw() prints the body of an ipfw rule.
   * Because the standard rule has at least proto src_ip dst_ip, we use
 @@ -1205,6 +1303,17 @@ show_ipfw(struct ip_fw *rule, int pcwidt
  			PRINT_UINT_ARG("setfib ", cmd->arg1);
   			break;
  
 +		case O_SETDSCP:
 +		    {
 +			const char *code;
 +
 +			if ((code = match_value(f_ipdscp, cmd->arg1)) != NULL)
 +				printf("setdscp %s", code);
 +			else
 +				PRINT_UINT_ARG("setdscp ", cmd->arg1);
 +		    }
 + 			break;
 +
  		case O_REASS:
  			printf("reass");
  			break;
 @@ -1500,6 +1609,10 @@ show_ipfw(struct ip_fw *rule, int pcwidt
  				printf(" ipprecedence %u", (cmd->arg1) >> 5 );
  				break;
  
 +			case O_DSCP:
 +				print_dscp((ipfw_insn_u32 *)cmd);
 +	 			break;
 +
  			case O_IPLEN:
  				if (F_LEN(cmd) == 1)
  				    printf(" iplen %u", cmd->arg1 );
 @@ -3036,6 +3149,24 @@ chkarg:
  		break;
  	    }
  
 +	case TOK_SETDSCP:
 +	    {
 +		int code;
 +
 +		action->opcode = O_SETDSCP;
 +		NEED1("missing DSCP code");
 +		if (_substrcmp(*av, "tablearg") == 0) {
 +			action->arg1 = IP_FW_TABLEARG;
 +		} else if (isalpha(*av[0])) {
 +			if ((code = match_token(f_ipdscp, *av)) == -1)
 +				errx(EX_DATAERR, "Unknown DSCP code");
 +			action->arg1 = code;
 +		} else
 +		        action->arg1 = strtoul(*av, NULL, 10);
 +		av++;
 +		break;
 +	    }
 +
  	case TOK_REASS:
  		action->opcode = O_REASS;
  		break;
 @@ -3448,6 +3579,12 @@ read_options:
  			av++;
  			break;
  
 +		case TOK_DSCP:
 +			NEED1("missing DSCP code");
 +			fill_dscp(cmd, *av, cblen);
 +			av++;
 +			break;
 +
  		case TOK_IPOPTS:
  			NEED1("missing argument for ipoptions");
  			fill_flags(cmd, O_IPOPT, f_ipopts, *av);
 
 Modified: head/sbin/ipfw/ipfw2.h
 ==============================================================================
 --- head/sbin/ipfw/ipfw2.h	Wed Mar 20 09:56:20 2013	(r248551)
 +++ head/sbin/ipfw/ipfw2.h	Wed Mar 20 10:35:33 2013	(r248552)
 @@ -203,6 +203,7 @@ enum tokens {
  	TOK_SETFIB,
  	TOK_LOOKUP,
  	TOK_SOCKARG,
 +	TOK_SETDSCP,
  };
  /*
   * the following macro returns an error message if we run out of
 
 Modified: head/sys/netinet/ip_fw.h
 ==============================================================================
 --- head/sys/netinet/ip_fw.h	Wed Mar 20 09:56:20 2013	(r248551)
 +++ head/sys/netinet/ip_fw.h	Wed Mar 20 10:35:33 2013	(r248552)
 @@ -218,6 +218,9 @@ enum ipfw_opcodes {		/* arguments (4 byt
  
  	O_FORWARD_IP6,		/* fwd sockaddr_in6             */
  
 +	O_DSCP,			/* 2 u32 = DSCP mask */
 +	O_SETDSCP,		/* arg1=DSCP value */
 +
  	O_LAST_OPCODE		/* not an opcode!		*/
  };
  
 
 Modified: head/sys/netpfil/ipfw/ip_fw2.c
 ==============================================================================
 --- head/sys/netpfil/ipfw/ip_fw2.c	Wed Mar 20 09:56:20 2013	(r248551)
 +++ head/sys/netpfil/ipfw/ip_fw2.c	Wed Mar 20 10:35:33 2013	(r248552)
 @@ -1624,6 +1624,32 @@ do {								\
  				    flags_match(cmd, ip->ip_tos));
  				break;
  
 +			case O_DSCP:
 +			    {
 +				uint32_t *p;
 +				uint16_t x;
 +
 +				p = ((ipfw_insn_u32 *)cmd)->d;
 +
 +				if (is_ipv4)
 +					x = ip->ip_tos >> 2;
 +				else if (is_ipv6) {
 +					uint8_t *v;
 +					v = &((struct ip6_hdr *)ip)->ip6_vfc;
 +					x = (*v & 0x0F) << 2;
 +					v++;
 +					x |= *v >> 6;
 +				} else
 +					break;
 +
 +				/* DSCP bitmask is stored as low_u32 high_u32 */
 +				if (x > 32)
 +					match = *(p + 1) & (1 << (x - 32));
 +				else
 +					match = *p & (1 << x);
 +			    }
 +				break;
 +
  			case O_TCPDATALEN:
  				if (proto == IPPROTO_TCP && offset == 0) {
  				    struct tcphdr *tcp;
 @@ -2353,6 +2379,32 @@ do {								\
  				break;
  		        }
  
 +			case O_SETDSCP: {
 +				uint16_t code;
 +
 +				code = IP_FW_ARG_TABLEARG(cmd->arg1) & 0x3F;
 +				l = 0;		/* exit inner loop */
 +				if (is_ipv4) {
 +					uint16_t a;
 +
 +					a = ip->ip_tos;
 +					ip->ip_tos = (code << 2) | (ip->ip_tos & 0x03);
 +					a += ntohs(ip->ip_sum) - ip->ip_tos;
 +					ip->ip_sum = htons(a);
 +				} else if (is_ipv6) {
 +					uint8_t *v;
 +
 +					v = &((struct ip6_hdr *)ip)->ip6_vfc;
 +					*v = (*v & 0xF0) | (code >> 2);
 +					v++;
 +					*v = (*v & 0x3F) | ((code & 0x03) << 6);
 +				} else
 +					break;
 +
 +				IPFW_INC_RULE_COUNTER(f, pktlen);
 +				break;
 +			}
 +
  			case O_NAT:
   				if (!IPFW_NAT_LOADED) {
  				    retval = IP_FW_DENY;
 
 Modified: head/sys/netpfil/ipfw/ip_fw_log.c
 ==============================================================================
 --- head/sys/netpfil/ipfw/ip_fw_log.c	Wed Mar 20 09:56:20 2013	(r248551)
 +++ head/sys/netpfil/ipfw/ip_fw_log.c	Wed Mar 20 10:35:33 2013	(r248552)
 @@ -292,10 +292,8 @@ ipfw_log(struct ip_fw *f, u_int hlen, st
  				altq->qid);
  			cmd += F_LEN(cmd);
  		}
 -		if (cmd->opcode == O_PROB)
 -			cmd += F_LEN(cmd);
 -
 -		if (cmd->opcode == O_TAG)
 +		if (cmd->opcode == O_PROB || cmd->opcode == O_TAG ||
 +		    cmd->opcode == O_SETDSCP)
  			cmd += F_LEN(cmd);
  
  		action = action2;
 
 Modified: head/sys/netpfil/ipfw/ip_fw_sockopt.c
 ==============================================================================
 --- head/sys/netpfil/ipfw/ip_fw_sockopt.c	Wed Mar 20 09:56:20 2013	(r248551)
 +++ head/sys/netpfil/ipfw/ip_fw_sockopt.c	Wed Mar 20 10:35:33 2013	(r248552)
 @@ -671,6 +671,10 @@ check_ipfw_struct(struct ip_fw *rule, in
  		case O_IPID:
  		case O_IPTTL:
  		case O_IPLEN:
 +		case O_DSCP:
 +			if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) + 1)
 +				goto bad_size;
 +			break;
  		case O_TCPDATALEN:
  		case O_TCPWIN:
  		case O_TAGGED:
 @@ -738,6 +742,7 @@ check_ipfw_struct(struct ip_fw *rule, in
  		case O_ACCEPT:
  		case O_DENY:
  		case O_REJECT:
 +		case O_SETDSCP:
  #ifdef INET6
  		case O_UNREACH6:
  #endif
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->patched 
State-Changed-By: melifaro 
State-Changed-When: Thu Mar 21 15:54:02 UTC 2013 
State-Changed-Why:  
ipfw dscp set/match options were committed to -head. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=121122 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/121122: commit references a PR
Date: Sat, 18 May 2013 05:48:55 +0000 (UTC)

 Author: melifaro
 Date: Sat May 18 05:48:46 2013
 New Revision: 250762
 URL: http://svnweb.freebsd.org/changeset/base/250762
 
 Log:
   MFC r248552, r248971
   
   Add ipfw support for setting/matching DiffServ codepoints (DSCP).
   
   Setting DSCP support is done via O_SETDSCP which works for both
   IPv4 and IPv6 packets. Fast checksum recalculation (RFC 1624) is done for IPv4.
   Dscp can be specified by name (AFXY, CSX, BE, EF), by value
   (0..63) or via tablearg.
   
   Matching DSCP is done via another opcode (O_DSCP) which accepts several
   classes at once (af11,af22,be). Classes are stored in bitmask (2 u32 words).
   
   Many people made their variants of this patch, the ones I'm aware of are
   (in alphabetic order):
   
   Dmitrii Tejblum
   Marcelo Araujo
   Roman Bogorodskiy (novel)
   Sergey Matveichuk (sem)
   Sergey Ryabin
   
   PR:		kern/102471, kern/121122
   
   Fix ipfw rule validation partially broken by r248552.
 
 Modified:
   stable/9/sbin/ipfw/ipfw.8
   stable/9/sbin/ipfw/ipfw2.c
   stable/9/sbin/ipfw/ipfw2.h
   stable/9/sys/netinet/ip_fw.h
   stable/9/sys/netpfil/ipfw/ip_fw2.c
   stable/9/sys/netpfil/ipfw/ip_fw_log.c
   stable/9/sys/netpfil/ipfw/ip_fw_sockopt.c
 Directory Properties:
   stable/9/sbin/   (props changed)
   stable/9/sbin/ipfw/   (props changed)
   stable/9/sys/   (props changed)
 
 Modified: stable/9/sbin/ipfw/ipfw.8
 ==============================================================================
 --- stable/9/sbin/ipfw/ipfw.8	Sat May 18 05:40:59 2013	(r250761)
 +++ stable/9/sbin/ipfw/ipfw.8	Sat May 18 05:48:46 2013	(r250762)
 @@ -948,6 +948,61 @@ Processing continues at the next rule.
  It is possible to use the
  .Cm tablearg
  keyword with a setfib. If tablearg value is not within compiled FIB range packet fib is set to 0.
 +.It Cm setdscp Ar DSCP | number | tablearg
 +Set specified DiffServ codepoint for an IPv4/IPv6 packet.
 +Processing continues at the next rule.
 +Supported values are:
 +.Pp
 +.Cm CS0
 +.Pq Dv 000000 ,
 +.Cm CS1
 +.Pq Dv 001000 ,
 +.Cm CS2
 +.Pq Dv 010000 ,
 +.Cm CS3
 +.Pq Dv 011000 ,
 +.Cm CS4
 +.Pq Dv 100000 ,
 +.Cm CS5
 +.Pq Dv 101000 ,
 +.Cm CS6
 +.Pq Dv 110000 ,
 +.Cm CS7
 +.Pq Dv 111000 ,
 +.Cm AF11
 +.Pq Dv 001010 ,
 +.Cm AF12
 +.Pq Dv 001100 ,
 +.Cm AF13
 +.Pq Dv 001110 ,
 +.Cm AF21
 +.Pq Dv 010010 ,
 +.Cm AF22
 +.Pq Dv 010100 ,
 +.Cm AF23
 +.Pq Dv 010110 ,
 +.Cm AF31
 +.Pq Dv 011010 ,
 +.Cm AF32
 +.Pq Dv 011100 ,
 +.Cm AF33
 +.Pq Dv 011110 ,
 +.Cm AF41
 +.Pq Dv 100010 ,
 +.Cm AF42
 +.Pq Dv 100100 ,
 +.Cm AF43
 +.Pq Dv 100110 ,
 +.Cm EF
 +.Pq Dv 101110 ,
 +.Cm BE
 +.Pq Dv 000000 .
 +Additionally, DSCP value can be specified by number (0..64).
 +It is also possible to use the
 +.Cm tablearg
 +keyword with setdscp.
 +If the tablearg value is not within the 0..64 range, lower 6 bits of supplied
 +value are used.
  .It Cm reass
  Queue and reassemble ip fragments.
  If the packet is not fragmented, counters are updated and processing continues with the next rule.
 @@ -1436,6 +1491,17 @@ The supported IP types of service are:
  The absence of a particular type may be denoted
  with a
  .Ql \&! .
 +.It Cm dscp spec Ns Op , Ns Ar spec
 +Matches IPv4/IPv6 packets whose
 +.Cm DS
 +field value is contained in
 +.Ar spec
 +mask.
 +Multiple values can be specified via 
 +the comma separated list.
 +Value can be one of keywords used in
 +.Cm setdscp
 +action or exact number.
  .It Cm ipttl Ar ttl-list
  Matches IPv4 packets whose time to live is included in
  .Ar ttl-list ,
 @@ -2944,6 +3010,23 @@ configured on
  but coming in on
  .Li fxp1
  would be dropped.
 +.Pp
 +The
 +.Cm setdscp
 +option could be used to (re)mark user traffic,
 +by adding the following to the appropriate place in ruleset:
 +.Pp
 +.Dl "ipfw add setdscp be ip from any to any dscp af11,af21"
 +.Pp
 +This rule drops all incoming packets that appear to be coming from another
 +directly connected system but on the wrong interface.
 +For example, a packet with a source address of
 +.Li 192.168.0.0/24 ,
 +configured on
 +.Li fxp0 ,
 +but coming in on
 +.Li fxp1
 +would be dropped.
  .Ss DYNAMIC RULES
  In order to protect a site from flood attacks involving fake
  TCP packets, it is safer to use dynamic rules:
 
 Modified: stable/9/sbin/ipfw/ipfw2.c
 ==============================================================================
 --- stable/9/sbin/ipfw/ipfw2.c	Sat May 18 05:40:59 2013	(r250761)
 +++ stable/9/sbin/ipfw/ipfw2.c	Sat May 18 05:48:46 2013	(r250762)
 @@ -167,6 +167,32 @@ static struct _s_x f_iptos[] = {
  	{ NULL,	0 }
  };
  
 +static struct _s_x f_ipdscp[] = {
 +	{ "af11", IPTOS_DSCP_AF11 >> 2 },	/* 001010 */
 +	{ "af12", IPTOS_DSCP_AF12 >> 2 },	/* 001100 */
 +	{ "af13", IPTOS_DSCP_AF13 >> 2 },	/* 001110 */
 +	{ "af21", IPTOS_DSCP_AF21 >> 2 },	/* 010010 */
 +	{ "af22", IPTOS_DSCP_AF22 >> 2 },	/* 010100 */
 +	{ "af23", IPTOS_DSCP_AF23 >> 2 },	/* 010110 */
 +	{ "af31", IPTOS_DSCP_AF31 >> 2 },	/* 011010 */
 +	{ "af32", IPTOS_DSCP_AF32 >> 2 },	/* 011100 */
 +	{ "af33", IPTOS_DSCP_AF33 >> 2 },	/* 011110 */
 +	{ "af41", IPTOS_DSCP_AF41 >> 2 },	/* 100010 */
 +	{ "af42", IPTOS_DSCP_AF42 >> 2 },	/* 100100 */
 +	{ "af43", IPTOS_DSCP_AF43 >> 2 },	/* 100110 */
 +	{ "be", IPTOS_DSCP_CS0 >> 2 }, 	/* 000000 */
 +	{ "ef", IPTOS_DSCP_EF >> 2 },	/* 101110 */
 +	{ "cs0", IPTOS_DSCP_CS0 >> 2 },	/* 000000 */
 +	{ "cs1", IPTOS_DSCP_CS1 >> 2 },	/* 001000 */
 +	{ "cs2", IPTOS_DSCP_CS2 >> 2 },	/* 010000 */
 +	{ "cs3", IPTOS_DSCP_CS3 >> 2 },	/* 011000 */
 +	{ "cs4", IPTOS_DSCP_CS4 >> 2 },	/* 100000 */
 +	{ "cs5", IPTOS_DSCP_CS5 >> 2 },	/* 101000 */
 +	{ "cs6", IPTOS_DSCP_CS6 >> 2 },	/* 110000 */
 +	{ "cs7", IPTOS_DSCP_CS7 >> 2 },	/* 100000 */
 +	{ NULL, 0 }
 +};
 +
  static struct _s_x limit_masks[] = {
  	{"all",		DYN_SRC_ADDR|DYN_SRC_PORT|DYN_DST_ADDR|DYN_DST_PORT},
  	{"src-addr",	DYN_SRC_ADDR},
 @@ -237,6 +263,7 @@ static struct _s_x rule_actions[] = {
  	{ "nat",		TOK_NAT },
  	{ "reass",		TOK_REASS },
  	{ "setfib",		TOK_SETFIB },
 +	{ "setdscp",		TOK_SETDSCP },
  	{ "call",		TOK_CALL },
  	{ "return",		TOK_RETURN },
  	{ NULL, 0 }	/* terminator */
 @@ -714,6 +741,51 @@ fill_newports(ipfw_insn_u16 *cmd, char *
  	return (i);
  }
  
 +/*
 + * Fill the body of the command with the list of DiffServ codepoints.
 + */
 +static void
 +fill_dscp(ipfw_insn *cmd, char *av, int cblen)
 +{
 +	uint32_t *low, *high;
 +	char *s = av, *a;
 +	int code;
 +
 +	cmd->opcode = O_DSCP;
 +	cmd->len |= F_INSN_SIZE(ipfw_insn_u32) + 1;
 +
 +	CHECK_CMDLEN;
 +
 +	low = (uint32_t *)(cmd + 1);
 +	high = low + 1;
 +
 +	*low = 0;
 +	*high = 0;
 +
 +	while (s != NULL) {
 +		a = strchr(s, ',');
 +
 +		if (a != NULL)
 +			*a++ = '\0';
 +
 +		if (isalpha(*s)) {
 +			if ((code = match_token(f_ipdscp, s)) == -1)
 +				errx(EX_DATAERR, "Unknown DSCP code");
 +		} else {
 +			code = strtoul(s, NULL, 10);
 +			if (code < 0 || code > 63)
 +				errx(EX_DATAERR, "Invalid DSCP value");
 +		}
 +
 +		if (code > 32)
 +			*high |= 1 << (code - 32);
 +		else
 +			*low |= 1 << code;
 +
 +		s = a;
 +	}
 +}
 +
  static struct _s_x icmpcodes[] = {
        { "net",			ICMP_UNREACH_NET },
        { "host",			ICMP_UNREACH_HOST },
 @@ -972,6 +1044,32 @@ print_icmptypes(ipfw_insn_u32 *cmd)
  	}
  }
  
 +static void
 +print_dscp(ipfw_insn_u32 *cmd)
 +{
 +	int i, c;
 +	uint32_t *v;
 +	char sep= ' ';
 +	const char *code;
 +
 +	printf(" dscp");
 +	i = 0;
 +	c = 0;
 +	v = cmd->d;
 +	while (i < 64) {
 +		if (*v & (1 << i)) {
 +			if ((code = match_value(f_ipdscp, i)) != NULL)
 +				printf("%c%s", sep, code);
 +			else
 +				printf("%c%d", sep, i);
 +			sep = ',';
 +		}
 +
 +		if ((++i % 32) == 0)
 +			v++;
 +	}
 +}
 +
  /*
   * show_ipfw() prints the body of an ipfw rule.
   * Because the standard rule has at least proto src_ip dst_ip, we use
 @@ -1204,6 +1302,17 @@ show_ipfw(struct ip_fw *rule, int pcwidt
  			PRINT_UINT_ARG("setfib ", cmd->arg1);
   			break;
  
 +		case O_SETDSCP:
 +		    {
 +			const char *code;
 +
 +			if ((code = match_value(f_ipdscp, cmd->arg1)) != NULL)
 +				printf("setdscp %s", code);
 +			else
 +				PRINT_UINT_ARG("setdscp ", cmd->arg1);
 +		    }
 + 			break;
 +
  		case O_REASS:
  			printf("reass");
  			break;
 @@ -1499,6 +1608,10 @@ show_ipfw(struct ip_fw *rule, int pcwidt
  				printf(" ipprecedence %u", (cmd->arg1) >> 5 );
  				break;
  
 +			case O_DSCP:
 +				print_dscp((ipfw_insn_u32 *)cmd);
 +	 			break;
 +
  			case O_IPLEN:
  				if (F_LEN(cmd) == 1)
  				    printf(" iplen %u", cmd->arg1 );
 @@ -3035,6 +3148,24 @@ chkarg:
  		break;
  	    }
  
 +	case TOK_SETDSCP:
 +	    {
 +		int code;
 +
 +		action->opcode = O_SETDSCP;
 +		NEED1("missing DSCP code");
 +		if (_substrcmp(*av, "tablearg") == 0) {
 +			action->arg1 = IP_FW_TABLEARG;
 +		} else if (isalpha(*av[0])) {
 +			if ((code = match_token(f_ipdscp, *av)) == -1)
 +				errx(EX_DATAERR, "Unknown DSCP code");
 +			action->arg1 = code;
 +		} else
 +		        action->arg1 = strtoul(*av, NULL, 10);
 +		av++;
 +		break;
 +	    }
 +
  	case TOK_REASS:
  		action->opcode = O_REASS;
  		break;
 @@ -3447,6 +3578,12 @@ read_options:
  			av++;
  			break;
  
 +		case TOK_DSCP:
 +			NEED1("missing DSCP code");
 +			fill_dscp(cmd, *av, cblen);
 +			av++;
 +			break;
 +
  		case TOK_IPOPTS:
  			NEED1("missing argument for ipoptions");
  			fill_flags(cmd, O_IPOPT, f_ipopts, *av);
 
 Modified: stable/9/sbin/ipfw/ipfw2.h
 ==============================================================================
 --- stable/9/sbin/ipfw/ipfw2.h	Sat May 18 05:40:59 2013	(r250761)
 +++ stable/9/sbin/ipfw/ipfw2.h	Sat May 18 05:48:46 2013	(r250762)
 @@ -203,6 +203,7 @@ enum tokens {
  	TOK_SETFIB,
  	TOK_LOOKUP,
  	TOK_SOCKARG,
 +	TOK_SETDSCP,
  };
  /*
   * the following macro returns an error message if we run out of
 
 Modified: stable/9/sys/netinet/ip_fw.h
 ==============================================================================
 --- stable/9/sys/netinet/ip_fw.h	Sat May 18 05:40:59 2013	(r250761)
 +++ stable/9/sys/netinet/ip_fw.h	Sat May 18 05:48:46 2013	(r250762)
 @@ -218,6 +218,9 @@ enum ipfw_opcodes {		/* arguments (4 byt
  
  	O_FORWARD_IP6,		/* fwd sockaddr_in6             */
  
 +	O_DSCP,			/* 2 u32 = DSCP mask */
 +	O_SETDSCP,		/* arg1=DSCP value */
 +
  	O_LAST_OPCODE		/* not an opcode!		*/
  };
  
 
 Modified: stable/9/sys/netpfil/ipfw/ip_fw2.c
 ==============================================================================
 --- stable/9/sys/netpfil/ipfw/ip_fw2.c	Sat May 18 05:40:59 2013	(r250761)
 +++ stable/9/sys/netpfil/ipfw/ip_fw2.c	Sat May 18 05:48:46 2013	(r250762)
 @@ -1658,6 +1658,32 @@ do {								\
  				    flags_match(cmd, ip->ip_tos));
  				break;
  
 +			case O_DSCP:
 +			    {
 +				uint32_t *p;
 +				uint16_t x;
 +
 +				p = ((ipfw_insn_u32 *)cmd)->d;
 +
 +				if (is_ipv4)
 +					x = ip->ip_tos >> 2;
 +				else if (is_ipv6) {
 +					uint8_t *v;
 +					v = &((struct ip6_hdr *)ip)->ip6_vfc;
 +					x = (*v & 0x0F) << 2;
 +					v++;
 +					x |= *v >> 6;
 +				} else
 +					break;
 +
 +				/* DSCP bitmask is stored as low_u32 high_u32 */
 +				if (x > 32)
 +					match = *(p + 1) & (1 << (x - 32));
 +				else
 +					match = *p & (1 << x);
 +			    }
 +				break;
 +
  			case O_TCPDATALEN:
  				if (proto == IPPROTO_TCP && offset == 0) {
  				    struct tcphdr *tcp;
 @@ -2340,6 +2366,32 @@ do {								\
  				break;
  		        }
  
 +			case O_SETDSCP: {
 +				uint16_t code;
 +
 +				code = IP_FW_ARG_TABLEARG(cmd->arg1) & 0x3F;
 +				l = 0;		/* exit inner loop */
 +				if (is_ipv4) {
 +					uint16_t a;
 +
 +					a = ip->ip_tos;
 +					ip->ip_tos = (code << 2) | (ip->ip_tos & 0x03);
 +					a += ntohs(ip->ip_sum) - ip->ip_tos;
 +					ip->ip_sum = htons(a);
 +				} else if (is_ipv6) {
 +					uint8_t *v;
 +
 +					v = &((struct ip6_hdr *)ip)->ip6_vfc;
 +					*v = (*v & 0xF0) | (code >> 2);
 +					v++;
 +					*v = (*v & 0x3F) | ((code & 0x03) << 6);
 +				} else
 +					break;
 +
 +				IPFW_INC_RULE_COUNTER(f, pktlen);
 +				break;
 +			}
 +
  			case O_NAT:
   				if (!IPFW_NAT_LOADED) {
  				    retval = IP_FW_DENY;
 
 Modified: stable/9/sys/netpfil/ipfw/ip_fw_log.c
 ==============================================================================
 --- stable/9/sys/netpfil/ipfw/ip_fw_log.c	Sat May 18 05:40:59 2013	(r250761)
 +++ stable/9/sys/netpfil/ipfw/ip_fw_log.c	Sat May 18 05:48:46 2013	(r250762)
 @@ -209,10 +209,8 @@ ipfw_log(struct ip_fw *f, u_int hlen, st
  				altq->qid);
  			cmd += F_LEN(cmd);
  		}
 -		if (cmd->opcode == O_PROB)
 -			cmd += F_LEN(cmd);
 -
 -		if (cmd->opcode == O_TAG)
 +		if (cmd->opcode == O_PROB || cmd->opcode == O_TAG ||
 +		    cmd->opcode == O_SETDSCP)
  			cmd += F_LEN(cmd);
  
  		action = action2;
 
 Modified: stable/9/sys/netpfil/ipfw/ip_fw_sockopt.c
 ==============================================================================
 --- stable/9/sys/netpfil/ipfw/ip_fw_sockopt.c	Sat May 18 05:40:59 2013	(r250761)
 +++ stable/9/sys/netpfil/ipfw/ip_fw_sockopt.c	Sat May 18 05:48:46 2013	(r250762)
 @@ -681,6 +681,11 @@ check_ipfw_struct(struct ip_fw *rule, in
  				goto bad_size;
  			break;
  
 +		case O_DSCP:
 +			if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) + 1)
 +				goto bad_size;
 +			break;
 +
  		case O_MAC_TYPE:
  		case O_IP_SRCPORT:
  		case O_IP_DSTPORT: /* XXX artificial limit, 30 port pairs */
 @@ -741,6 +746,7 @@ check_ipfw_struct(struct ip_fw *rule, in
  		case O_ACCEPT:
  		case O_DENY:
  		case O_REJECT:
 +		case O_SETDSCP:
  #ifdef INET6
  		case O_UNREACH6:
  #endif
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
>Unformatted:
