On Tue, Mar 28, 2017 at 9:22 PM, Florian Westphal <fw@xxxxxxxxx> wrote: > Gargi Sharma <gs051095@xxxxxxxxx> wrote: >> Add translation for TOS to nftables. >> >> Examples: >> >> $ iptables-translate -t mangle -A PREROUTING -p TCP --dport 22 -j TOS --set-tos 0x10 >> nft add rule ip mangle PREROUTING tcp dport 22 counter --set-tos 0x10/0xff >> >> $ iptables-translate -A PREROUTING -t mangle -p tcp --sport ftp-data -j TOS --set-tos 0x02/0x10 >> nft add rule ip mangle PREROUTING tcp sport 20 counter --set-tos 0x02/0x10 > > You did not test this :-/ > Sorry! I realised this after sending this patch. > nft add rule ip mangle PREROUTING tcp sport 20 counter --set-tos 0x02/0x10 > nft: unrecognized option '--set-tos' > > besides, there is no TOS support in nftables. > Please look at xt_DSCP.c and the xlate function there. > >From what I gather, the first 6 bits are used for DSCP and the last 2 for ecn. Should I write both dscp and ecn equivalent for the TOS specified? Thanks, Gargi > You could rewrite -j TOS iptables rules to their corresponding dscp > eqivalent in some cases at least. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
