From 1aad1d17ed8bee2a22d235980a6c80b6dc1b74e0 Mon Sep 17 00:00:00 2001 From: Kevin Darbyshire-Bryant Date: Wed, 5 Jun 2019 18:31:04 +0100 Subject: [PATCH] iptables: add connmark savedscp support iptables: connmark - add savedscp option Naive user space front end to xt_connmark 'savedscp' option. e.g. iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --savedscp-mark 0xfc000000/0x01000000 Will save DSCP into the top 6 bits and OR 0x01 (ie set) the least significant bit of most significant byte. Signed-off-by: Kevin Darbyshire-Bryant --- package/network/utils/iptables/Makefile | 2 +- .../patches/010-add-savedscp-support.patch | 206 ++++++++++++++++++ 2 files changed, 207 insertions(+), 1 deletion(-) create mode 100644 package/network/utils/iptables/patches/010-add-savedscp-support.patch diff --git a/package/network/utils/iptables/Makefile b/package/network/utils/iptables/Makefile index dd761f3443..7e8e6f7eaa 100644 --- a/package/network/utils/iptables/Makefile +++ b/package/network/utils/iptables/Makefile @@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk PKG_NAME:=iptables PKG_VERSION:=1.8.3 -PKG_RELEASE:=1 +PKG_RELEASE:=2 PKG_SOURCE_URL:=https://netfilter.org/projects/iptables/files PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 diff --git a/package/network/utils/iptables/patches/010-add-savedscp-support.patch b/package/network/utils/iptables/patches/010-add-savedscp-support.patch new file mode 100644 index 0000000000..cc1efcee01 --- /dev/null +++ b/package/network/utils/iptables/patches/010-add-savedscp-support.patch @@ -0,0 +1,206 @@ +From 69b427fb5e1211c1110ce63be62b70504d04b0ff Mon Sep 17 00:00:00 2001 +From: Kevin Darbyshire-Bryant +Date: Sat, 23 Mar 2019 10:21:03 +0000 +Subject: [PATCH] savedscp + +Signed-off-by: Kevin Darbyshire-Bryant +--- + extensions/libxt_CONNMARK.c | 68 ++++++++++++++++++++++++++- + include/linux/netfilter/xt_connmark.h | 3 +- + 2 files changed, 69 insertions(+), 2 deletions(-) + +--- a/extensions/libxt_CONNMARK.c ++++ b/extensions/libxt_CONNMARK.c +@@ -49,6 +49,7 @@ enum { + O_CTMASK, + O_NFMASK, + O_MASK, ++ O_SAVEDSCP_MARK, + F_SET_MARK = 1 << O_SET_MARK, + F_SAVE_MARK = 1 << O_SAVE_MARK, + F_RESTORE_MARK = 1 << O_RESTORE_MARK, +@@ -61,8 +62,10 @@ enum { + F_CTMASK = 1 << O_CTMASK, + F_NFMASK = 1 << O_NFMASK, + F_MASK = 1 << O_MASK, ++ F_SAVEDSCP_MARK = 1 << O_SAVEDSCP_MARK, + F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK | +- F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK, ++ F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK | ++ F_SAVEDSCP_MARK, + }; + + static const char *const xt_connmark_shift_ops[] = { +@@ -75,6 +78,7 @@ static void CONNMARK_help(void) + printf( + "CONNMARK target options:\n" + " --set-mark value[/mask] Set conntrack mark value\n" ++" --savedscp-mark dscpmask/statemask Save DSCP to conntrack mark value\n" + " --save-mark [--mask mask] Save the packet nfmark in the connection\n" + " --restore-mark [--mask mask] Restore saved nfmark value\n"); + } +@@ -83,6 +87,8 @@ static void CONNMARK_help(void) + static const struct xt_option_entry CONNMARK_opts[] = { + {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, + .excl = F_OP_ANY}, ++ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32, ++ .excl = F_OP_ANY}, + {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE, + .excl = F_OP_ANY}, + {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE, +@@ -98,6 +104,8 @@ static const struct xt_option_entry conn + .excl = F_OP_ANY}, + {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, + .excl = F_OP_ANY}, ++ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32, ++ .excl = F_OP_ANY}, + {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32, + .excl = F_OP_ANY}, + {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32, +@@ -124,6 +132,8 @@ static const struct xt_option_entry conn + .excl = F_OP_ANY}, + {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, + .excl = F_OP_ANY}, ++ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32, ++ .excl = F_OP_ANY}, + {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32, + .excl = F_OP_ANY}, + {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32, +@@ -158,6 +168,7 @@ static void connmark_tg_help(void) + " --restore-mark [--ctmask mask] [--nfmask mask]\n" + " Copy nfmark to ctmark using masks\n" + " --set-mark value[/mask] Set conntrack mark value\n" ++" --savedscp-mark value/mask Save DSCP to conntrack mark value\n" + " --save-mark [--mask mask] Save the packet nfmark in the connection\n" + " --restore-mark [--mask mask] Restore saved nfmark value\n" + " --and-mark value Binary AND the ctmark with bits\n" +@@ -210,6 +221,11 @@ static void CONNMARK_parse(struct xt_opt + markinfo->mark = cb->val.mark; + markinfo->mask = cb->val.mask; + break; ++ case O_SAVEDSCP_MARK: ++ markinfo->mode = XT_CONNMARK_SAVEDSCP; ++ markinfo->mark = cb->val.mark; ++ markinfo->mask = cb->val.mask; ++ break; + case O_SAVE_MARK: + markinfo->mode = XT_CONNMARK_SAVE; + break; +@@ -238,6 +254,19 @@ static void connmark_tg_parse(struct xt_ + info->ctmark = cb->val.mark; + info->ctmask = cb->val.mark | cb->val.mask; + break; ++ case O_SAVEDSCP_MARK: ++ info->mode = XT_CONNMARK_SAVEDSCP; ++ info->ctmark = cb->val.mark; ++ info->ctmask = cb->val.mask; ++ info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0; ++ /* need 6 contiguous bits */ ++ if ((0x3f & (info->ctmark >> info->nfmask)) != 0x3f) ++ xtables_error(PARAMETER_PROBLEM, ++ "CONNMARK savedscp: insufficient contiguous dscpmask bits"); ++ if (info->ctmark & info->ctmask) ++ xtables_error(PARAMETER_PROBLEM, ++ "CONNMARK savedscp: dscpmask/statemask bits overlap"); ++ break; + case O_AND_MARK: + info->mode = XT_CONNMARK_SET; + info->ctmark = 0; +@@ -283,6 +312,19 @@ static void connmark_tg_parse_v2(struct + info->ctmark = cb->val.mark; + info->ctmask = cb->val.mark | cb->val.mask; + break; ++ case O_SAVEDSCP_MARK: ++ info->mode = XT_CONNMARK_SAVEDSCP; ++ info->ctmark = cb->val.mark; ++ info->ctmask = cb->val.mask; ++ info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0; ++ /* need 6 contiguous bits */ ++ if ((0x3f & (info->ctmark >> info->shift_bits)) != 0x3f) ++ xtables_error(PARAMETER_PROBLEM, ++ "CONNMARK savedscp: insufficient contiguous dscpmask bits"); ++ if (info->ctmark & info->ctmask) ++ xtables_error(PARAMETER_PROBLEM, ++ "CONNMARK savedscp: dscpmask/statemask bits overlap"); ++ break; + case O_AND_MARK: + info->mode = XT_CONNMARK_SET; + info->ctmark = 0; +@@ -351,6 +393,11 @@ static void CONNMARK_print(const void *i + print_mark(markinfo->mark); + print_mask("/", markinfo->mask); + break; ++ case XT_CONNMARK_SAVEDSCP: ++ printf(" CONNMARK savedscp "); ++ print_mark(markinfo->mark); ++ print_mask("/", markinfo->mask); ++ break; + case XT_CONNMARK_SAVE: + printf(" CONNMARK save "); + print_mask("mask ", markinfo->mask); +@@ -386,6 +433,10 @@ connmark_tg_print(const void *ip, const + printf(" CONNMARK xset 0x%x/0x%x", + info->ctmark, info->ctmask); + break; ++ case XT_CONNMARK_SAVEDSCP: ++ printf(" CONNMARK DSCP set 0x%x/0x%x", ++ info->ctmark, info->ctmask); ++ break; + case XT_CONNMARK_SAVE: + if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX) + printf(" CONNMARK save"); +@@ -433,6 +484,10 @@ connmark_tg_print_v2(const void *ip, con + printf(" CONNMARK xset 0x%x/0x%x", + info->ctmark, info->ctmask); + break; ++ case XT_CONNMARK_SAVEDSCP: ++ printf(" CONNMARK DSCP xset 0x%x/0x%x", ++ info->ctmark, info->ctmask); ++ break; + case XT_CONNMARK_SAVE: + if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX) + printf(" CONNMARK save"); +@@ -474,6 +529,11 @@ static void CONNMARK_save(const void *ip + print_mark(markinfo->mark); + print_mask("/", markinfo->mask); + break; ++ case XT_CONNMARK_SAVEDSCP: ++ printf(" --savedscp-mark "); ++ print_mark(markinfo->mark); ++ print_mask("/", markinfo->mask); ++ break; + case XT_CONNMARK_SAVE: + printf(" --save-mark "); + print_mask("--mask ", markinfo->mask); +@@ -505,6 +565,9 @@ connmark_tg_save(const void *ip, const s + case XT_CONNMARK_SET: + printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask); + break; ++ case XT_CONNMARK_SAVEDSCP: ++ printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask); ++ break; + case XT_CONNMARK_SAVE: + printf(" --save-mark --nfmask 0x%x --ctmask 0x%x", + info->nfmask, info->ctmask); +@@ -529,6 +592,9 @@ connmark_tg_save_v2(const void *ip, cons + case XT_CONNMARK_SET: + printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask); + break; ++ case XT_CONNMARK_SAVEDSCP: ++ printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask); ++ break; + case XT_CONNMARK_SAVE: + printf(" --save-mark --nfmask 0x%x --ctmask 0x%x", + info->nfmask, info->ctmask); +--- a/include/linux/netfilter/xt_connmark.h ++++ b/include/linux/netfilter/xt_connmark.h +@@ -15,7 +15,8 @@ + enum { + XT_CONNMARK_SET = 0, + XT_CONNMARK_SAVE, +- XT_CONNMARK_RESTORE ++ XT_CONNMARK_RESTORE, ++ XT_CONNMARK_SAVEDSCP + }; + + struct xt_connmark_tginfo1 { -- 2.25.1