1 From 69b427fb5e1211c1110ce63be62b70504d04b0ff Mon Sep 17 00:00:00 2001
2 From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
3 Date: Sat, 23 Mar 2019 10:21:03 +0000
4 Subject: [PATCH] savedscp
6 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
8 extensions/libxt_CONNMARK.c | 68 ++++++++++++++++++++++++++-
9 include/linux/netfilter/xt_connmark.h | 3 +-
10 2 files changed, 69 insertions(+), 2 deletions(-)
12 --- a/extensions/libxt_CONNMARK.c
13 +++ b/extensions/libxt_CONNMARK.c
20 #include <linux/netfilter/xt_CONNMARK.h>
22 @@ -49,6 +50,7 @@ enum {
27 F_SET_MARK = 1 << O_SET_MARK,
28 F_SAVE_MARK = 1 << O_SAVE_MARK,
29 F_RESTORE_MARK = 1 << O_RESTORE_MARK,
30 @@ -61,8 +63,10 @@ enum {
31 F_CTMASK = 1 << O_CTMASK,
32 F_NFMASK = 1 << O_NFMASK,
34 + F_SAVEDSCP_MARK = 1 << O_SAVEDSCP_MARK,
35 F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
36 - F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
37 + F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK |
41 static const char *const xt_connmark_shift_ops[] = {
42 @@ -75,6 +79,7 @@ static void CONNMARK_help(void)
44 "CONNMARK target options:\n"
45 " --set-mark value[/mask] Set conntrack mark value\n"
46 +" --savedscp-mark dscpmask/statemask Save DSCP to conntrack mark value\n"
47 " --save-mark [--mask mask] Save the packet nfmark in the connection\n"
48 " --restore-mark [--mask mask] Restore saved nfmark value\n");
50 @@ -83,6 +88,8 @@ static void CONNMARK_help(void)
51 static const struct xt_option_entry CONNMARK_opts[] = {
52 {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
54 + {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
56 {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE,
58 {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE,
59 @@ -98,6 +105,8 @@ static const struct xt_option_entry conn
61 {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
63 + {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
65 {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
67 {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
68 @@ -124,6 +133,8 @@ static const struct xt_option_entry conn
70 {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
72 + {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
74 {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
76 {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
77 @@ -158,6 +169,7 @@ static void connmark_tg_help(void)
78 " --restore-mark [--ctmask mask] [--nfmask mask]\n"
79 " Copy nfmark to ctmark using masks\n"
80 " --set-mark value[/mask] Set conntrack mark value\n"
81 +" --savedscp-mark value/mask Save DSCP to conntrack mark value\n"
82 " --save-mark [--mask mask] Save the packet nfmark in the connection\n"
83 " --restore-mark [--mask mask] Restore saved nfmark value\n"
84 " --and-mark value Binary AND the ctmark with bits\n"
85 @@ -210,6 +222,11 @@ static void CONNMARK_parse(struct xt_opt
86 markinfo->mark = cb->val.mark;
87 markinfo->mask = cb->val.mask;
89 + case O_SAVEDSCP_MARK:
90 + markinfo->mode = XT_CONNMARK_SAVEDSCP;
91 + markinfo->mark = cb->val.mark;
92 + markinfo->mask = cb->val.mask;
95 markinfo->mode = XT_CONNMARK_SAVE;
97 @@ -238,6 +255,19 @@ static void connmark_tg_parse(struct xt_
98 info->ctmark = cb->val.mark;
99 info->ctmask = cb->val.mark | cb->val.mask;
101 + case O_SAVEDSCP_MARK:
102 + info->mode = XT_CONNMARK_SAVEDSCP;
103 + info->ctmark = cb->val.mark;
104 + info->ctmask = cb->val.mask;
105 + info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0;
106 + /* need 6 contiguous bits */
107 + if ((0x3f & (info->ctmark >> info->nfmask)) != 0x3f)
108 + xtables_error(PARAMETER_PROBLEM,
109 + "CONNMARK savedscp: insufficient contiguous dscpmask bits");
110 + if (info->ctmark & info->ctmask)
111 + xtables_error(PARAMETER_PROBLEM,
112 + "CONNMARK savedscp: dscpmask/statemask bits overlap");
115 info->mode = XT_CONNMARK_SET;
117 @@ -283,6 +313,19 @@ static void connmark_tg_parse_v2(struct
118 info->ctmark = cb->val.mark;
119 info->ctmask = cb->val.mark | cb->val.mask;
121 + case O_SAVEDSCP_MARK:
122 + info->mode = XT_CONNMARK_SAVEDSCP;
123 + info->ctmark = cb->val.mark;
124 + info->ctmask = cb->val.mask;
125 + info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0;
126 + /* need 6 contiguous bits */
127 + if ((0x3f & (info->ctmark >> info->shift_bits)) != 0x3f)
128 + xtables_error(PARAMETER_PROBLEM,
129 + "CONNMARK savedscp: insufficient contiguous dscpmask bits");
130 + if (info->ctmark & info->ctmask)
131 + xtables_error(PARAMETER_PROBLEM,
132 + "CONNMARK savedscp: dscpmask/statemask bits overlap");
135 info->mode = XT_CONNMARK_SET;
137 @@ -351,6 +394,11 @@ static void CONNMARK_print(const void *i
138 print_mark(markinfo->mark);
139 print_mask("/", markinfo->mask);
141 + case XT_CONNMARK_SAVEDSCP:
142 + printf(" CONNMARK savedscp ");
143 + print_mark(markinfo->mark);
144 + print_mask("/", markinfo->mask);
146 case XT_CONNMARK_SAVE:
147 printf(" CONNMARK save ");
148 print_mask("mask ", markinfo->mask);
149 @@ -386,6 +434,10 @@ connmark_tg_print(const void *ip, const
150 printf(" CONNMARK xset 0x%x/0x%x",
151 info->ctmark, info->ctmask);
153 + case XT_CONNMARK_SAVEDSCP:
154 + printf(" CONNMARK DSCP set 0x%x/0x%x",
155 + info->ctmark, info->ctmask);
157 case XT_CONNMARK_SAVE:
158 if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
159 printf(" CONNMARK save");
160 @@ -433,6 +485,10 @@ connmark_tg_print_v2(const void *ip, con
161 printf(" CONNMARK xset 0x%x/0x%x",
162 info->ctmark, info->ctmask);
164 + case XT_CONNMARK_SAVEDSCP:
165 + printf(" CONNMARK DSCP xset 0x%x/0x%x",
166 + info->ctmark, info->ctmask);
168 case XT_CONNMARK_SAVE:
169 if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
170 printf(" CONNMARK save");
171 @@ -474,6 +530,11 @@ static void CONNMARK_save(const void *ip
172 print_mark(markinfo->mark);
173 print_mask("/", markinfo->mask);
175 + case XT_CONNMARK_SAVEDSCP:
176 + printf(" --savedscp-mark ");
177 + print_mark(markinfo->mark);
178 + print_mask("/", markinfo->mask);
180 case XT_CONNMARK_SAVE:
181 printf(" --save-mark ");
182 print_mask("--mask ", markinfo->mask);
183 @@ -505,6 +566,9 @@ connmark_tg_save(const void *ip, const s
184 case XT_CONNMARK_SET:
185 printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
187 + case XT_CONNMARK_SAVEDSCP:
188 + printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
190 case XT_CONNMARK_SAVE:
191 printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
192 info->nfmask, info->ctmask);
193 @@ -529,6 +593,9 @@ connmark_tg_save_v2(const void *ip, cons
194 case XT_CONNMARK_SET:
195 printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
197 + case XT_CONNMARK_SAVEDSCP:
198 + printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
200 case XT_CONNMARK_SAVE:
201 printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
202 info->nfmask, info->ctmask);
203 --- a/include/linux/netfilter/xt_connmark.h
204 +++ b/include/linux/netfilter/xt_connmark.h
209 - XT_CONNMARK_RESTORE
210 + XT_CONNMARK_RESTORE,
211 + XT_CONNMARK_SAVEDSCP
214 struct xt_connmark_tginfo1 {