# tc-ematch

## NAME



           ematch - extended matches for use with "basic", "cgroup"  or
           "flow" filters
    


## SYNOPSIS



           **tc filter add .. basic match** EXPR **.. flowid ..**
    
           _EXPR_ := _TERM_ [ { **and | or**} _EXPR_ ]
    
           _TERM_ := [ **not**] { _MATCH_ | '(' _EXPR_ ')' }
    
           _MATCH_ := _module_ '(' _ARGS_ ')'
    
           _ARGS_ := _ARG1 ARG2_ ..
    


## MATCHES



       **cmp**
           Simple comparison ematch: arithmetic compare of packet data to a
           given value.
    
           _cmp_( _ALIGN_ at _OFFSET_ [ _ATTRS_ ] { _eq_ | _lt_ | _gt_ } _VALUE_ )
    
           _ALIGN_ := { _u8_ | _u16_ | _u32_ }
    
           _ATTRS_ := [ layer _LAYER_ ] [ mask _MASK_ ] [ trans ]
    
           _LAYER_ := { _link_ | _network_ | _transport_ | _0..2_ }
    
       **meta**
           Metadata ematch
    
           _meta_( _OBJECT_ { _eq_ | _lt_ |_gt_ } _OBJECT_ )
    
           _OBJECT_ := { _META_ID_ |  _VALUE_ }
    
           _META_ID_ := _id_ [ shift _SHIFT_ ] [ mask _MASK_ ]
    
           meta attributes:
    
                  **random** 32 bit random value
    
                  **loadavg_1** Load average in last 5 minutes
    
                  **nf_mark** Netfilter mark
    
                  **vlan** Vlan tag
    
                  **sk_rcvbuf** Receive buffer size
    
                  **sk_snd_queue** Send queue length
    
           A full list of meta attributes can be obtained via
    
           # tc filter add dev eth1 basic match 'meta(list)'
    
       **nbyte**
           match packet data byte sequence
    
           _nbyte_( _NEEDLE_ at _OFFSET_ [ layer _LAYER_ ] )
    
           _NEEDLE_ := { _string_ | _c-escape-sequence_  }
    
           _OFFSET_ := _int_
    
           _LAYER_ := { _link_ | _network_ | _transport_ | _0..2_ }
    
       **u32**
           u32 ematch
    
           _u32_( _ALIGN VALUE MASK_ at [ nexthdr+ ] _OFFSET_ )
    
           _ALIGN_ := { _u8_ | _u16_ | _u32_ }
    
       **ipset**
           test packet against ipset membership
    
           _ipset_( _SETNAME FLAGS_ )
    
           _SETNAME_ := _string_
    
           _FLAGS_ := { _FLAG_ [, _FLAGS_] }
    
           The flag options are the same as those used by the iptables "set"
           match.
    
           When using the ipset ematch with the "ip_set_hash:net,iface" set
           type, the interface can be queried using "src,dst (source ip
           address, outgoing interface) or "src,src" (source ip address,
           incoming interface) syntax.
    
       **ipt**
           test packet against xtables matches
    
           _ipt_( _[-6] -m MATCH_NAME FLAGS_ )
    
           _MATCH_NAME_ := _string_
    
           _FLAGS_ := { _FLAG_ [, _FLAGS_] }
    
           The flag options are the same as those used by the xtable match
           used.
    
       **canid**
           ematch rule to match CAN frames
    
           _canid_( _IDLIST_ )
    
           _IDLIST_ :=  _IDSPEC_[_IDLIST_]
    
           _IDSPEC_ := { ’sff’ _CANID_ | ’eff’ _CANID_ }
    
           _CANID_ := _ID_[_:MASK_]
    
           _ID_ , _MASK_ := hexadecimal number (i.e. 0x123)
    


## CAVEATS



           The ematch syntax uses '(' and ')' to group expressions. All
           braces need to be escaped properly to prevent shell commandline
           from interpreting these directly.
    
           When using the ipset ematch with the "ifb" device, the outgoing
           device will be the ifb device itself, e.g. "ifb0".  The original
           interface (i.e. the device the packet arrived on) is treated as
           the incoming interface.
    


## EXAMPLE & USAGE



           # tc filter add .. basic match ...
    
           # 'cmp(u16 at 3 layer 2 mask 0xff00 gt 20)'
    
           # 'meta(nfmark gt 24)' and 'meta(tcindex mask 0xf0 eq 0xf0)'
    
           # 'nbyte("ababa" at 12 layer 1)'
    
           # 'u32(u16 0x1122 0xffff at nexthdr+4)'
    
           Check if packet source ip address is member of set named **bulk** :
    
           # 'ipset(bulk src)'
    
           Check if packet source ip and the interface the packet arrived on
           is member of "hash:net,iface" set named **interactive** :
    
           # 'ipset(interactive src,src)'
    
           Check if packet matches an IPSec state with reqid 1:
    
           # 'ipt(-m policy --dir in --pol ipsec --reqid 1)'
    


* * *