target/linux/generic/hack-5.4/645-netfilter-connmark-introduce-set-dscpmark.patch

   1 From eda40b8c8c82e0f2789d6bc8bf63846dce2e8f32 Mon Sep 17 00:00:00 2001
   2 From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
   3 Date: Sat, 23 Mar 2019 09:29:49 +0000
   4 Subject: [PATCH] netfilter: connmark: introduce set-dscpmark
   5
   6 set-dscpmark is a method of storing the DSCP of an ip packet into
   7 conntrack mark.  In combination with a suitable tc filter action
   8 (act_ctinfo) DSCP values are able to be stored in the mark on egress and
   9 restored on ingress across links that otherwise alter or bleach DSCP.
  10
  11 This is useful for qdiscs such as CAKE which are able to shape according
  12 to policies based on DSCP.
  13
  14 Ingress classification is traditionally a challenging task since
  15 iptables rules haven't yet run and tc filter/eBPF programs are pre-NAT
  16 lookups, hence are unable to see internal IPv4 addresses as used on the
  17 typical home masquerading gateway.
  18
  19 x_tables CONNMARK set-dscpmark target solves the problem of storing the
  20 DSCP to the conntrack mark in a way suitable for the new act_ctinfo tc
  21 action to restore.
  22
  23 The set-dscpmark option accepts 2 parameters, a 32bit 'dscpmask' and a
  24 32bit 'statemask'.  The dscp mask must be 6 contiguous bits and
  25 represents the area where the DSCP will be stored in the connmark.  The
  26 state mask is a minimum 1 bit length mask that must not overlap with the
  27 dscpmask.  It represents a flag which is set when the DSCP has been
  28 stored in the conntrack mark. This is useful to implement a 'one shot'
  29 iptables based classification where the 'complicated' iptables rules are
  30 only run once to classify the connection on initial (egress) packet and
  31 subsequent packets are all marked/restored with the same DSCP.  A state
  32 mask of zero disables the setting of a status bit/s.
  33
  34 example syntax with a suitably modified iptables user space application:
  35
  36 iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --set-dscpmark 0xfc000000/0x01000000
  37
  38 Would store the DSCP in the top 6 bits of the 32bit mark field, and use
  39 the LSB of the top byte as the 'DSCP has been stored' marker.
  40
  41 |----0xFC----conntrack mark----000000---|
  42 | Bits 31-26 | bit 25 | bit24 |~~~ Bit 0|
  43 | DSCP       | unused | flag  |unused   |
  44 |-----------------------0x01---000000---|
  45       ^                   ^
  46       |                   |
  47       ---|             Conditional flag
  48          |             set this when dscp
  49 |-ip diffserv-|        stored in mark
  50 | 6 bits      |
  51 |-------------|
  52
  53 an identically configured tc action to restore looks like:
  54
  55 tc filter show dev eth0 ingress
  56 filter parent ffff: protocol all pref 10 u32 chain 0
  57 filter parent ffff: protocol all pref 10 u32 chain 0 fh 800: ht divisor 1
  58 filter parent ffff: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1: not_in_hw
  59   match 00000000/00000000 at 0
  60         action order 1: ctinfo zone 0 pipe
  61          index 2 ref 1 bind 1 dscp 0xfc000000/0x1000000
  62
  63         action order 2: mirred (Egress Redirect to device ifb4eth0) stolen
  64         index 1 ref 1 bind 1
  65
  66 |----0xFC----conntrack mark----000000---|
  67 | Bits 31-26 | bit 25 | bit24 |~~~ Bit 0|
  68 | DSCP       | unused | flag  |unused   |
  69 |-----------------------0x01---000000---|
  70       |                   |
  71       |                   |
  72       ---|             Conditional flag
  73          v             only restore if set
  74 |-ip diffserv-|
  75 | 6 bits      |
  76 |-------------|
  77
  78 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
  79 ---
  80  include/uapi/linux/netfilter/xt_connmark.h | 10 ++++
  81  net/netfilter/xt_connmark.c                | 55 ++++++++++++++++++----
  82  2 files changed, 57 insertions(+), 8 deletions(-)
  83
  84 --- a/include/uapi/linux/netfilter/xt_connmark.h
  85 +++ b/include/uapi/linux/netfilter/xt_connmark.h
  86 @@ -20,6 +20,11 @@ enum {
  87  };
  88
  89  enum {
  90 +       XT_CONNMARK_VALUE =     (1 << 0),
  91 +       XT_CONNMARK_DSCP =      (1 << 1)
  92 +};
  93 +
  94 +enum {
  95         D_SHIFT_LEFT = 0,
  96         D_SHIFT_RIGHT,
  97  };
  98 @@ -34,6 +39,11 @@ struct xt_connmark_tginfo2 {
  99         __u8 shift_dir, shift_bits, mode;
 100  };
 101
 102 +struct xt_connmark_tginfo3 {
 103 +       __u32 ctmark, ctmask, nfmask;
 104 +       __u8 shift_dir, shift_bits, mode, func;
 105 +};
 106 +
 107  struct xt_connmark_mtinfo1 {
 108         __u32 mark, mask;
 109         __u8 invert;
 110 --- a/net/netfilter/xt_connmark.c
 111 +++ b/net/netfilter/xt_connmark.c
 112 @@ -24,12 +24,13 @@ MODULE_ALIAS("ipt_connmark");
 113  MODULE_ALIAS("ip6t_connmark");
 114
 115  static unsigned int
 116 -connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info)
 117 +connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo3 *info)
 118  {
 119         enum ip_conntrack_info ctinfo;
 120         u_int32_t new_targetmark;
 121         struct nf_conn *ct;
 122         u_int32_t newmark;
 123 +       u_int8_t dscp;
 124
 125         ct = nf_ct_get(skb, &ctinfo);
 126         if (ct == NULL)
 127 @@ -37,12 +38,24 @@ connmark_tg_shift(struct sk_buff *skb, c
 128
 129         switch (info->mode) {
 130         case XT_CONNMARK_SET:
 131 -               newmark = (ct->mark & ~info->ctmask) ^ info->ctmark;
 132 -               if (info->shift_dir == D_SHIFT_RIGHT)
 133 -                       newmark >>= info->shift_bits;
 134 -               else
 135 -                       newmark <<= info->shift_bits;
 136 +               newmark = ct->mark;
 137 +               if (info->func & XT_CONNMARK_VALUE) {
 138 +                       newmark = (newmark & ~info->ctmask) ^ info->ctmark;
 139 +                       if (info->shift_dir == D_SHIFT_RIGHT)
 140 +                               newmark >>= info->shift_bits;
 141 +                       else
 142 +                               newmark <<= info->shift_bits;
 143 +               } else if (info->func & XT_CONNMARK_DSCP) {
 144 +                       if (skb->protocol == htons(ETH_P_IP))
 145 +                               dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2;
 146 +                       else if (skb->protocol == htons(ETH_P_IPV6))
 147 +                               dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2;
 148 +                       else    /* protocol doesn't have diffserv */
 149 +                               break;
 150
 151 +                       newmark = (newmark & ~info->ctmark) |
 152 +                                 (info->ctmask | (dscp << info->shift_bits));
 153 +               }
 154                 if (ct->mark != newmark) {
 155                         ct->mark = newmark;
 156                         nf_conntrack_event_cache(IPCT_MARK, ct);
 157 @@ -81,20 +94,36 @@ static unsigned int
 158  connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
 159  {
 160         const struct xt_connmark_tginfo1 *info = par->targinfo;
 161 -       const struct xt_connmark_tginfo2 info2 = {
 162 +       const struct xt_connmark_tginfo3 info3 = {
 163                 .ctmark = info->ctmark,
 164                 .ctmask = info->ctmask,
 165                 .nfmask = info->nfmask,
 166                 .mode   = info->mode,
 167 +               .func   = XT_CONNMARK_VALUE
 168         };
 169
 170 -       return connmark_tg_shift(skb, &info2);
 171 +       return connmark_tg_shift(skb, &info3);
 172  }
 173
 174  static unsigned int
 175  connmark_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
 176  {
 177         const struct xt_connmark_tginfo2 *info = par->targinfo;
 178 +       const struct xt_connmark_tginfo3 info3 = {
 179 +               .ctmark = info->ctmark,
 180 +               .ctmask = info->ctmask,
 181 +               .nfmask = info->nfmask,
 182 +               .mode   = info->mode,
 183 +               .func   = XT_CONNMARK_VALUE
 184 +       };
 185 +
 186 +       return connmark_tg_shift(skb, &info3);
 187 +}
 188 +
 189 +static unsigned int
 190 +connmark_tg_v3(struct sk_buff *skb, const struct xt_action_param *par)
 191 +{
 192 +       const struct xt_connmark_tginfo3 *info = par->targinfo;
 193
 194         return connmark_tg_shift(skb, info);
 195  }
 196 @@ -165,6 +194,16 @@ static struct xt_target connmark_tg_reg[
 197                 .targetsize     = sizeof(struct xt_connmark_tginfo2),
 198                 .destroy        = connmark_tg_destroy,
 199                 .me             = THIS_MODULE,
 200 +       },
 201 +       {
 202 +               .name           = "CONNMARK",
 203 +               .revision       = 3,
 204 +               .family         = NFPROTO_UNSPEC,
 205 +               .checkentry     = connmark_tg_check,
 206 +               .target         = connmark_tg_v3,
 207 +               .targetsize     = sizeof(struct xt_connmark_tginfo3),
 208 +               .destroy        = connmark_tg_destroy,
 209 +               .me             = THIS_MODULE,
 210         }
 211  };
 212