]>
Commit | Line | Data |
---|---|---|
44880002 PS |
1 | .TH "Generic packet editor action in tc" 8 "12 Jan 2015" "iproute2" "Linux" |
2 | ||
3 | .SH NAME | |
4 | pedit - generic packet editor action | |
5 | .SH SYNOPSIS | |
6 | .in +8 | |
7 | .ti -8 | |
7c71a40c AV |
8 | .BR tc " ... " "action pedit [ex] munge " { |
9 | .IR RAW_OP " | " LAYERED_OP " | " EXTENDED_LAYERED_OP " } [ " CONTROL " ]" | |
44880002 PS |
10 | |
11 | .ti -8 | |
12 | .IR RAW_OP " := " | |
13 | .BI offset " OFFSET" | |
14 | .RB "{ " u8 " | " u16 " | " u32 " } [" | |
15 | .IR AT_SPEC " ] " CMD_SPEC | |
16 | ||
17 | .ti -8 | |
18 | .IR AT_SPEC " := " | |
19 | .BI at " AT " offmask " MASK " shift " SHIFT" | |
20 | ||
21 | .ti -8 | |
22 | .IR LAYERED_OP " := { " | |
23 | .BI ip " IPHDR_FIELD" | |
24 | | | |
7c71a40c AV |
25 | .BI ip " BEYOND_IPHDR_FIELD" |
26 | .RI } " CMD_SPEC" | |
27 | ||
28 | .ti -8 | |
29 | .IR EXTENDED_LAYERED_OP " := { " | |
3cd5149e AV |
30 | .BI eth " ETHHDR_FIELD" |
31 | | | |
7c71a40c | 32 | .BI ip " IPHDR_FIELD" |
8d193d96 AV |
33 | | |
34 | .BI ip " EX_IPHDR_FIELD" | |
2c6eb12a | 35 | | |
f3e1b244 AV |
36 | .BI ip6 " IP6HDR_FIELD" |
37 | | | |
2c6eb12a | 38 | .BI tcp " TCPHDR_FIELD" |
3d2a7781 OG |
39 | | |
40 | .BI udp " UDPHDR_FIELD" | |
44880002 PS |
41 | .RI } " CMD_SPEC" |
42 | ||
3cd5149e AV |
43 | .ti -8 |
44 | .IR ETHHDR_FIELD " := { " | |
45 | .BR src " | " dst " | " type " }" | |
46 | ||
44880002 PS |
47 | .ti -8 |
48 | .IR IPHDR_FIELD " := { " | |
49 | .BR src " | " dst " | " tos " | " dsfield " | " ihl " | " protocol " |" | |
7c71a40c AV |
50 | .BR precedence " | " nofrag " | " firstfrag " | " ce " | " df " }" |
51 | ||
52 | .ti -8 | |
53 | .IR BEYOND_IPHDR_FIELD " := { " | |
54 | .BR dport " | " sport " | " icmp_type " | " icmp_code " }" | |
44880002 | 55 | |
8d193d96 AV |
56 | .ti -8 |
57 | .IR EX_IPHDR_FIELD " := { " | |
58 | .BR ttl " }" | |
59 | ||
f3e1b244 AV |
60 | |
61 | .ti -8 | |
62 | .IR IP6HDR_FIELD " := { " | |
63 | .BR src " | " dst " | " flow_lbl " | " payload_len " | " nexthdr " |" | |
64 | .BR hoplimit " }" | |
65 | ||
2c6eb12a AV |
66 | .ti -8 |
67 | .IR TCPHDR_FIELD " := { " | |
68 | .BR sport " | " dport " | " flags " }" | |
69 | ||
3d2a7781 OG |
70 | .ti -8 |
71 | .IR UDPHDR_FIELD " := { " | |
72 | .BR sport " | " dport " }" | |
73 | ||
44880002 PS |
74 | .ti -8 |
75 | .IR CMD_SPEC " := {" | |
76 | .BR clear " | " invert " | " set | |
77 | .IR VAL " | " | |
c05ddaf9 AV |
78 | .BR add |
79 | .IR VAL " | " | |
44880002 PS |
80 | .BR preserve " } [ " retain |
81 | .IR RVAL " ]" | |
82 | ||
83 | .ti -8 | |
1672f421 | 84 | .IR CONTROL " := {" |
44880002 PS |
85 | .BR reclassify " | " pipe " | " drop " | " shot " | " continue " | " pass " }" |
86 | .SH DESCRIPTION | |
87 | The | |
88 | .B pedit | |
89 | action can be used to change arbitrary packet data. The location of data to | |
90 | change can either be specified by giving an offset and size as in | |
91 | .IR RAW_OP , | |
92 | or for header values by naming the header and field to edit the size is then | |
93 | chosen automatically based on the header field size. Currently this is supported | |
94 | only for IPv4 headers. | |
95 | .SH OPTIONS | |
96 | .TP | |
7c71a40c AV |
97 | .B ex |
98 | Use extended pedit. | |
99 | .I EXTENDED_LAYERED_OP | |
c05ddaf9 AV |
100 | and the add |
101 | .I CMD_SPEC | |
102 | are allowed only in this mode. | |
7c71a40c | 103 | .TP |
44880002 PS |
104 | .BI offset " OFFSET " "\fR{ \fBu32 \fR| \fBu16 \fR| \fBu8 \fR}" |
105 | Specify the offset at which to change data. | |
106 | .I OFFSET | |
107 | is a signed integer, it's base is automatically chosen (e.g. hex if prefixed by | |
108 | .B 0x | |
109 | or octal if prefixed by | |
110 | .BR 0 ). | |
111 | The second argument specifies the length of data to change, that is four bytes | |
112 | .RB ( u32 ), | |
113 | two bytes | |
114 | .RB ( u16 ) | |
115 | or a single byte | |
116 | .RB ( u8 ). | |
117 | .TP | |
118 | .BI at " AT " offmask " MASK " shift " SHIFT" | |
119 | This is an optional part of | |
120 | .IR RAW_OP | |
121 | which allows to have a variable | |
122 | .I OFFSET | |
123 | depending on packet data at offset | |
124 | .IR AT , | |
125 | which is binary ANDed with | |
126 | .I MASK | |
127 | and right-shifted by | |
128 | .I SHIFT | |
129 | before adding it to | |
130 | .IR OFFSET . | |
131 | .TP | |
3cd5149e AV |
132 | .BI eth " ETHHDR_FIELD" |
133 | Change an ETH header field. The supported keywords for | |
134 | .I ETHHDR_FIELD | |
135 | are: | |
136 | .RS | |
137 | .TP | |
138 | .B src | |
139 | .TQ | |
140 | .B dst | |
141 | Source or destination MAC address in the standard format: XX:XX:XX:XX:XX:XX | |
142 | .TP | |
143 | .B type | |
144 | Ether-type in numeric value | |
145 | .RE | |
146 | .TP | |
44880002 PS |
147 | .BI ip " IPHDR_FIELD" |
148 | Change an IPv4 header field. The supported keywords for | |
149 | .I IPHDR_FIELD | |
150 | are: | |
151 | .RS | |
152 | .TP | |
153 | .B src | |
154 | .TQ | |
155 | .B dst | |
156 | Source or destination IP address, a four-byte value. | |
157 | .TP | |
158 | .B tos | |
159 | .TQ | |
160 | .B dsfield | |
161 | .TQ | |
162 | .B precedence | |
163 | Type Of Service field, an eight-bit value. | |
164 | .TP | |
165 | .B ihl | |
166 | Change the IP Header Length field, a four-bit value. | |
167 | .TP | |
168 | .B protocol | |
169 | Next-layer Protocol field, an eight-bit value. | |
170 | .TP | |
171 | .B nofrag | |
172 | .TQ | |
173 | .B firstfrag | |
174 | .TQ | |
175 | .B ce | |
176 | .TQ | |
177 | .B df | |
178 | .TQ | |
179 | .B mf | |
180 | Change IP header flags. Note that the value to pass to the | |
181 | .B set | |
182 | command is not just a bit value, but the full byte including the flags field. | |
183 | Though only the relevant bits of that value are respected, the rest ignored. | |
7c71a40c AV |
184 | .RE |
185 | .TP | |
186 | .BI ip " BEYOND_IPHDR_FIELD" | |
187 | Supported only for non-extended layered op. It is passed to the kernel as | |
188 | offsets relative to the beginning of the IP header and assumes the IP header is | |
189 | of minimum size (20 bytes). The supported keywords for | |
190 | .I BEYOND_IPHDR_FIELD | |
191 | are: | |
192 | .RS | |
44880002 PS |
193 | .TP |
194 | .B dport | |
195 | .TQ | |
196 | .B sport | |
197 | Destination or source port numbers, a 16-bit value. Indeed, IPv4 headers don't | |
198 | contain this information. Instead, this will set an offset which suits at least | |
199 | TCP and UDP if the IP header is of minimum size (20 bytes). If not, this will do | |
200 | unexpected things. | |
201 | .TP | |
202 | .B icmp_type | |
203 | .TQ | |
204 | .B icmp_code | |
205 | Again, this allows to change data past the actual IP header itself. It assumes | |
206 | an ICMP header is present immediately following the (minimal sized) IP header. | |
207 | If it is not or the latter is bigger than the minimum of 20 bytes, this will do | |
208 | unexpected things. These fields are eight-bit values. | |
209 | .RE | |
210 | .TP | |
8d193d96 AV |
211 | .BI ip " EX_IPHDR_FIELD" |
212 | Supported only when | |
213 | .I ex | |
214 | is used. The supported keywords for | |
215 | .I EX_IPHDR_FIELD | |
216 | are: | |
217 | .RS | |
218 | .TP | |
219 | .B ttl | |
220 | .RE | |
221 | .TP | |
f3e1b244 AV |
222 | .BI ip6 " IP6HDR_FIELD" |
223 | The supported keywords for | |
224 | .I IP6HDR_FIELD | |
225 | are: | |
226 | .RS | |
227 | .TP | |
228 | .B src | |
229 | .TQ | |
230 | .B dst | |
231 | .TQ | |
232 | .B flow_lbl | |
233 | .TQ | |
234 | .B payload_len | |
235 | .TQ | |
236 | .B nexthdr | |
237 | .TQ | |
238 | .B hoplimit | |
239 | .RE | |
240 | .TP | |
2c6eb12a AV |
241 | .BI tcp " TCPHDR_FIELD" |
242 | The supported keywords for | |
243 | .I TCPHDR_FIELD | |
244 | are: | |
245 | .RS | |
246 | .TP | |
247 | .B sport | |
248 | .TQ | |
249 | .B dport | |
250 | Source or destination TCP port number, a 16-bit value. | |
251 | .TP | |
252 | .B flags | |
253 | .RE | |
254 | .TP | |
3d2a7781 OG |
255 | .BI udp " UDPHDR_FIELD" |
256 | The supported keywords for | |
257 | .I UDPHDR_FIELD | |
258 | are: | |
259 | .RS | |
260 | .TP | |
261 | .B sport | |
262 | .TQ | |
263 | .B dport | |
264 | Source or destination TCP port number, a 16-bit value. | |
265 | .RE | |
266 | .TP | |
44880002 PS |
267 | .B clear |
268 | Clear the addressed data (i.e., set it to zero). | |
269 | .TP | |
270 | .B invert | |
271 | Swap every bit in the addressed data. | |
272 | .TP | |
273 | .BI set " VAL" | |
274 | Set the addressed data to a specific value. The size of | |
275 | .I VAL | |
276 | is defined by either one of the | |
277 | .BR u32 ", " u16 " or " u8 | |
278 | keywords in | |
279 | .IR RAW_OP , | |
280 | or the size of the addressed header field in | |
281 | .IR LAYERED_OP . | |
282 | .TP | |
c05ddaf9 AV |
283 | .BI add " VAL" |
284 | Add the addressed data by a specific value. The size of | |
285 | .I VAL | |
286 | is defined by the size of the addressed header field in | |
287 | .IR EXTENDED_LAYERED_OP . | |
288 | This operation is supported only for extended layered op. | |
289 | .TP | |
44880002 PS |
290 | .B preserve |
291 | Keep the addressed data as is. | |
292 | .TP | |
293 | .BI retain " RVAL" | |
294 | This optional extra part of | |
295 | .I CMD_SPEC | |
cdca1918 AV |
296 | allows to exclude bits from being changed. Supported only for 32 bits fields |
297 | or smaller. | |
44880002 | 298 | .TP |
1672f421 | 299 | .I CONTROL |
44880002 PS |
300 | The following keywords allow to control how the tree of qdisc, classes, |
301 | filters and actions is further traversed after this action. | |
302 | .RS | |
303 | .TP | |
304 | .B reclassify | |
305 | Restart with the first filter in the current list. | |
306 | .TP | |
307 | .B pipe | |
308 | Continue with the next action attached to the same filter. | |
309 | .TP | |
310 | .B drop | |
311 | .TQ | |
312 | .B shot | |
313 | Drop the packet. | |
314 | .TP | |
315 | .B continue | |
316 | Continue classification with the next filter in line. | |
317 | .TP | |
318 | .B pass | |
319 | Finish classification process and return to calling qdisc for further packet | |
320 | processing. This is the default. | |
321 | .RE | |
322 | .SH EXAMPLES | |
323 | Being able to edit packet data, one could do all kinds of things, such as e.g. | |
324 | implementing port redirection. Certainly not the most useful application, but | |
325 | as an example it should do: | |
326 | ||
327 | First, qdiscs need to be set up to attach filters to. For the receive path, a simple | |
328 | .B ingress | |
329 | qdisc will do, for transmit path a classful qdisc | |
330 | .RB ( HTB | |
331 | in this case) is necessary: | |
332 | ||
333 | .RS | |
334 | .EX | |
335 | tc qdisc replace dev eth0 root handle 1: htb | |
336 | tc qdisc add dev eth0 ingress handle ffff: | |
337 | .EE | |
338 | .RE | |
339 | ||
340 | Finally, a filter with | |
341 | .B pedit | |
342 | action can be added for each direction. In this case, | |
343 | .B u32 | |
344 | is used matching on the port number to redirect from, while | |
345 | .B pedit | |
346 | then does the actual rewriting: | |
347 | ||
348 | .RS | |
349 | .EX | |
350 | tc filter add dev eth0 parent 1: u32 \\ | |
351 | match ip dport 23 0xffff \\ | |
352 | action pedit pedit munge ip dport set 22 | |
353 | tc filter add dev eth0 parent ffff: u32 \\ | |
354 | match ip sport 22 0xffff \\ | |
355 | action pedit pedit munge ip sport set 23 | |
7c71a40c AV |
356 | tc filter add dev eth0 parent ffff: u32 \\ |
357 | match ip sport 22 0xffff \\ | |
358 | action pedit ex munge ip dst set 192.168.1.199 | |
f3e1b244 AV |
359 | tc filter add dev eth0 parent ffff: u32 \\ |
360 | match ip sport 22 0xffff \\ | |
361 | action pedit ex munge ip6 dst set fe80::dacb:8aff:fec7:320e | |
3cd5149e AV |
362 | tc filter add dev eth0 parent ffff: u32 \\ |
363 | match ip sport 22 0xffff \\ | |
364 | action pedit ex munge eth dst set 11:22:33:44:55:66 | |
2c6eb12a AV |
365 | tc filter add dev eth0 parent ffff: u32 \\ |
366 | match ip dport 23 0xffff \\ | |
367 | action pedit ex munge tcp dport set 22 | |
44880002 PS |
368 | .EE |
369 | .RE | |
370 | .SH SEE ALSO | |
371 | .BR tc (8), | |
372 | .BR tc-htb (8), | |
373 | .BR tc-u32 (8) |