1 From 69b427fb5e1211c1110ce63be62b70504d04b0ff Mon Sep 17 00:00:00 2001
2 From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
3 Date: Sat, 23 Mar 2019 10:21:03 +0000
4 Subject: [PATCH] savedscp
6 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
8 extensions/libxt_CONNMARK.c | 68 ++++++++++++++++++++++++++-
9 include/linux/netfilter/xt_connmark.h | 3 +-
10 2 files changed, 69 insertions(+), 2 deletions(-)
12 --- a/extensions/libxt_CONNMARK.c
13 +++ b/extensions/libxt_CONNMARK.c
14 @@ -49,6 +49,7 @@ enum {
19 F_SET_MARK = 1 << O_SET_MARK,
20 F_SAVE_MARK = 1 << O_SAVE_MARK,
21 F_RESTORE_MARK = 1 << O_RESTORE_MARK,
22 @@ -61,8 +62,10 @@ enum {
23 F_CTMASK = 1 << O_CTMASK,
24 F_NFMASK = 1 << O_NFMASK,
26 + F_SAVEDSCP_MARK = 1 << O_SAVEDSCP_MARK,
27 F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
28 - F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
29 + F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK |
33 static const char *const xt_connmark_shift_ops[] = {
34 @@ -75,6 +78,7 @@ static void CONNMARK_help(void)
36 "CONNMARK target options:\n"
37 " --set-mark value[/mask] Set conntrack mark value\n"
38 +" --savedscp-mark dscpmask/statemask Save DSCP to conntrack mark value\n"
39 " --save-mark [--mask mask] Save the packet nfmark in the connection\n"
40 " --restore-mark [--mask mask] Restore saved nfmark value\n");
42 @@ -83,6 +87,8 @@ static void CONNMARK_help(void)
43 static const struct xt_option_entry CONNMARK_opts[] = {
44 {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
46 + {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
48 {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE,
50 {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE,
51 @@ -98,6 +104,8 @@ static const struct xt_option_entry conn
53 {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
55 + {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
57 {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
59 {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
60 @@ -124,6 +132,8 @@ static const struct xt_option_entry conn
62 {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
64 + {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
66 {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
68 {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
69 @@ -158,6 +168,7 @@ static void connmark_tg_help(void)
70 " --restore-mark [--ctmask mask] [--nfmask mask]\n"
71 " Copy nfmark to ctmark using masks\n"
72 " --set-mark value[/mask] Set conntrack mark value\n"
73 +" --savedscp-mark value/mask Save DSCP to conntrack mark value\n"
74 " --save-mark [--mask mask] Save the packet nfmark in the connection\n"
75 " --restore-mark [--mask mask] Restore saved nfmark value\n"
76 " --and-mark value Binary AND the ctmark with bits\n"
77 @@ -210,6 +221,11 @@ static void CONNMARK_parse(struct xt_opt
78 markinfo->mark = cb->val.mark;
79 markinfo->mask = cb->val.mask;
81 + case O_SAVEDSCP_MARK:
82 + markinfo->mode = XT_CONNMARK_SAVEDSCP;
83 + markinfo->mark = cb->val.mark;
84 + markinfo->mask = cb->val.mask;
87 markinfo->mode = XT_CONNMARK_SAVE;
89 @@ -238,6 +254,19 @@ static void connmark_tg_parse(struct xt_
90 info->ctmark = cb->val.mark;
91 info->ctmask = cb->val.mark | cb->val.mask;
93 + case O_SAVEDSCP_MARK:
94 + info->mode = XT_CONNMARK_SAVEDSCP;
95 + info->ctmark = cb->val.mark;
96 + info->ctmask = cb->val.mask;
97 + info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0;
98 + /* need 6 contiguous bits */
99 + if ((0x3f & (info->ctmark >> info->nfmask)) != 0x3f)
100 + xtables_error(PARAMETER_PROBLEM,
101 + "CONNMARK savedscp: insufficient contiguous dscpmask bits");
102 + if (info->ctmark & info->ctmask)
103 + xtables_error(PARAMETER_PROBLEM,
104 + "CONNMARK savedscp: dscpmask/statemask bits overlap");
107 info->mode = XT_CONNMARK_SET;
109 @@ -283,6 +312,19 @@ static void connmark_tg_parse_v2(struct
110 info->ctmark = cb->val.mark;
111 info->ctmask = cb->val.mark | cb->val.mask;
113 + case O_SAVEDSCP_MARK:
114 + info->mode = XT_CONNMARK_SAVEDSCP;
115 + info->ctmark = cb->val.mark;
116 + info->ctmask = cb->val.mask;
117 + info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0;
118 + /* need 6 contiguous bits */
119 + if ((0x3f & (info->ctmark >> info->shift_bits)) != 0x3f)
120 + xtables_error(PARAMETER_PROBLEM,
121 + "CONNMARK savedscp: insufficient contiguous dscpmask bits");
122 + if (info->ctmark & info->ctmask)
123 + xtables_error(PARAMETER_PROBLEM,
124 + "CONNMARK savedscp: dscpmask/statemask bits overlap");
127 info->mode = XT_CONNMARK_SET;
129 @@ -351,6 +393,11 @@ static void CONNMARK_print(const void *i
130 print_mark(markinfo->mark);
131 print_mask("/", markinfo->mask);
133 + case XT_CONNMARK_SAVEDSCP:
134 + printf(" CONNMARK savedscp ");
135 + print_mark(markinfo->mark);
136 + print_mask("/", markinfo->mask);
138 case XT_CONNMARK_SAVE:
139 printf(" CONNMARK save ");
140 print_mask("mask ", markinfo->mask);
141 @@ -386,6 +433,10 @@ connmark_tg_print(const void *ip, const
142 printf(" CONNMARK xset 0x%x/0x%x",
143 info->ctmark, info->ctmask);
145 + case XT_CONNMARK_SAVEDSCP:
146 + printf(" CONNMARK DSCP set 0x%x/0x%x",
147 + info->ctmark, info->ctmask);
149 case XT_CONNMARK_SAVE:
150 if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
151 printf(" CONNMARK save");
152 @@ -433,6 +484,10 @@ connmark_tg_print_v2(const void *ip, con
153 printf(" CONNMARK xset 0x%x/0x%x",
154 info->ctmark, info->ctmask);
156 + case XT_CONNMARK_SAVEDSCP:
157 + printf(" CONNMARK DSCP xset 0x%x/0x%x",
158 + info->ctmark, info->ctmask);
160 case XT_CONNMARK_SAVE:
161 if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
162 printf(" CONNMARK save");
163 @@ -474,6 +529,11 @@ static void CONNMARK_save(const void *ip
164 print_mark(markinfo->mark);
165 print_mask("/", markinfo->mask);
167 + case XT_CONNMARK_SAVEDSCP:
168 + printf(" --savedscp-mark ");
169 + print_mark(markinfo->mark);
170 + print_mask("/", markinfo->mask);
172 case XT_CONNMARK_SAVE:
173 printf(" --save-mark ");
174 print_mask("--mask ", markinfo->mask);
175 @@ -505,6 +565,9 @@ connmark_tg_save(const void *ip, const s
176 case XT_CONNMARK_SET:
177 printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
179 + case XT_CONNMARK_SAVEDSCP:
180 + printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
182 case XT_CONNMARK_SAVE:
183 printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
184 info->nfmask, info->ctmask);
185 @@ -529,6 +592,9 @@ connmark_tg_save_v2(const void *ip, cons
186 case XT_CONNMARK_SET:
187 printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
189 + case XT_CONNMARK_SAVEDSCP:
190 + printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
192 case XT_CONNMARK_SAVE:
193 printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
194 info->nfmask, info->ctmask);
195 --- a/include/linux/netfilter/xt_connmark.h
196 +++ b/include/linux/netfilter/xt_connmark.h
201 - XT_CONNMARK_RESTORE
202 + XT_CONNMARK_RESTORE,
203 + XT_CONNMARK_SAVEDSCP
206 struct xt_connmark_tginfo1 {