From e481df07fa6599e18a0570acb4dadabc56299b7b Mon Sep 17 00:00:00 2001 From: Kevin Darbyshire-Bryant Date: Tue, 3 Dec 2019 10:35:08 +0000 Subject: [PATCH] iptables: set-dscpmark follow upstreamimg attempt I'm having another attempt at trying to getting the 'store dscp into conntrack connmark' functionality into upstream kernel, since the restore function (act_ctinfo) has been accepted. The syntax has changed from 'savedscp' to 'set-dscpmark' since that conforms more closely with existing functionality. Signed-off-by: Kevin Darbyshire-Bryant --- package/network/utils/iproute2/Makefile | 2 +- .../patches/010-add-savedscp-support.patch | 214 -------- .../010-add-set-dscpmark-support.patch | 459 ++++++++++++++++++ 3 files changed, 460 insertions(+), 215 deletions(-) delete mode 100644 package/network/utils/iptables/patches/010-add-savedscp-support.patch create mode 100644 package/network/utils/iptables/patches/010-add-set-dscpmark-support.patch diff --git a/package/network/utils/iproute2/Makefile b/package/network/utils/iproute2/Makefile index d9aca960d6..d11a13facc 100644 --- a/package/network/utils/iproute2/Makefile +++ b/package/network/utils/iproute2/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=iproute2 PKG_VERSION:=5.4.0 -PKG_RELEASE:=1 +PKG_RELEASE:=2 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz PKG_SOURCE_URL:=@KERNEL/linux/utils/net/iproute2 diff --git a/package/network/utils/iptables/patches/010-add-savedscp-support.patch b/package/network/utils/iptables/patches/010-add-savedscp-support.patch deleted file mode 100644 index c85aa9ead2..0000000000 --- a/package/network/utils/iptables/patches/010-add-savedscp-support.patch +++ /dev/null @@ -1,214 +0,0 @@ -From 69b427fb5e1211c1110ce63be62b70504d04b0ff Mon Sep 17 00:00:00 2001 -From: Kevin Darbyshire-Bryant -Date: Sat, 23 Mar 2019 10:21:03 +0000 -Subject: [PATCH] savedscp - -Signed-off-by: Kevin Darbyshire-Bryant ---- - extensions/libxt_CONNMARK.c | 68 ++++++++++++++++++++++++++- - include/linux/netfilter/xt_connmark.h | 3 +- - 2 files changed, 69 insertions(+), 2 deletions(-) - ---- a/extensions/libxt_CONNMARK.c -+++ b/extensions/libxt_CONNMARK.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -49,6 +50,7 @@ enum { - O_CTMASK, - O_NFMASK, - O_MASK, -+ O_SAVEDSCP_MARK, - F_SET_MARK = 1 << O_SET_MARK, - F_SAVE_MARK = 1 << O_SAVE_MARK, - F_RESTORE_MARK = 1 << O_RESTORE_MARK, -@@ -61,8 +63,10 @@ enum { - F_CTMASK = 1 << O_CTMASK, - F_NFMASK = 1 << O_NFMASK, - F_MASK = 1 << O_MASK, -+ F_SAVEDSCP_MARK = 1 << O_SAVEDSCP_MARK, - F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK | -- F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK, -+ F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK | -+ F_SAVEDSCP_MARK, - }; - - static const char *const xt_connmark_shift_ops[] = { -@@ -75,6 +79,7 @@ static void CONNMARK_help(void) - printf( - "CONNMARK target options:\n" - " --set-mark value[/mask] Set conntrack mark value\n" -+" --savedscp-mark dscpmask/statemask Save DSCP to conntrack mark value\n" - " --save-mark [--mask mask] Save the packet nfmark in the connection\n" - " --restore-mark [--mask mask] Restore saved nfmark value\n"); - } -@@ -83,6 +88,8 @@ static void CONNMARK_help(void) - static const struct xt_option_entry CONNMARK_opts[] = { - {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, - .excl = F_OP_ANY}, -+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32, -+ .excl = F_OP_ANY}, - {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE, - .excl = F_OP_ANY}, - {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE, -@@ -98,6 +105,8 @@ static const struct xt_option_entry conn - .excl = F_OP_ANY}, - {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, - .excl = F_OP_ANY}, -+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32, -+ .excl = F_OP_ANY}, - {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32, - .excl = F_OP_ANY}, - {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32, -@@ -124,6 +133,8 @@ static const struct xt_option_entry conn - .excl = F_OP_ANY}, - {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, - .excl = F_OP_ANY}, -+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32, -+ .excl = F_OP_ANY}, - {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32, - .excl = F_OP_ANY}, - {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32, -@@ -158,6 +169,7 @@ static void connmark_tg_help(void) - " --restore-mark [--ctmask mask] [--nfmask mask]\n" - " Copy nfmark to ctmark using masks\n" - " --set-mark value[/mask] Set conntrack mark value\n" -+" --savedscp-mark value/mask Save DSCP to conntrack mark value\n" - " --save-mark [--mask mask] Save the packet nfmark in the connection\n" - " --restore-mark [--mask mask] Restore saved nfmark value\n" - " --and-mark value Binary AND the ctmark with bits\n" -@@ -210,6 +222,11 @@ static void CONNMARK_parse(struct xt_opt - markinfo->mark = cb->val.mark; - markinfo->mask = cb->val.mask; - break; -+ case O_SAVEDSCP_MARK: -+ markinfo->mode = XT_CONNMARK_SAVEDSCP; -+ markinfo->mark = cb->val.mark; -+ markinfo->mask = cb->val.mask; -+ break; - case O_SAVE_MARK: - markinfo->mode = XT_CONNMARK_SAVE; - break; -@@ -238,6 +255,19 @@ static void connmark_tg_parse(struct xt_ - info->ctmark = cb->val.mark; - info->ctmask = cb->val.mark | cb->val.mask; - break; -+ case O_SAVEDSCP_MARK: -+ info->mode = XT_CONNMARK_SAVEDSCP; -+ info->ctmark = cb->val.mark; -+ info->ctmask = cb->val.mask; -+ info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0; -+ /* need 6 contiguous bits */ -+ if ((0x3f & (info->ctmark >> info->nfmask)) != 0x3f) -+ xtables_error(PARAMETER_PROBLEM, -+ "CONNMARK savedscp: insufficient contiguous dscpmask bits"); -+ if (info->ctmark & info->ctmask) -+ xtables_error(PARAMETER_PROBLEM, -+ "CONNMARK savedscp: dscpmask/statemask bits overlap"); -+ break; - case O_AND_MARK: - info->mode = XT_CONNMARK_SET; - info->ctmark = 0; -@@ -283,6 +313,19 @@ static void connmark_tg_parse_v2(struct - info->ctmark = cb->val.mark; - info->ctmask = cb->val.mark | cb->val.mask; - break; -+ case O_SAVEDSCP_MARK: -+ info->mode = XT_CONNMARK_SAVEDSCP; -+ info->ctmark = cb->val.mark; -+ info->ctmask = cb->val.mask; -+ info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0; -+ /* need 6 contiguous bits */ -+ if ((0x3f & (info->ctmark >> info->shift_bits)) != 0x3f) -+ xtables_error(PARAMETER_PROBLEM, -+ "CONNMARK savedscp: insufficient contiguous dscpmask bits"); -+ if (info->ctmark & info->ctmask) -+ xtables_error(PARAMETER_PROBLEM, -+ "CONNMARK savedscp: dscpmask/statemask bits overlap"); -+ break; - case O_AND_MARK: - info->mode = XT_CONNMARK_SET; - info->ctmark = 0; -@@ -351,6 +394,11 @@ static void CONNMARK_print(const void *i - print_mark(markinfo->mark); - print_mask("/", markinfo->mask); - break; -+ case XT_CONNMARK_SAVEDSCP: -+ printf(" CONNMARK savedscp "); -+ print_mark(markinfo->mark); -+ print_mask("/", markinfo->mask); -+ break; - case XT_CONNMARK_SAVE: - printf(" CONNMARK save "); - print_mask("mask ", markinfo->mask); -@@ -386,6 +434,10 @@ connmark_tg_print(const void *ip, const - printf(" CONNMARK xset 0x%x/0x%x", - info->ctmark, info->ctmask); - break; -+ case XT_CONNMARK_SAVEDSCP: -+ printf(" CONNMARK DSCP set 0x%x/0x%x", -+ info->ctmark, info->ctmask); -+ break; - case XT_CONNMARK_SAVE: - if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX) - printf(" CONNMARK save"); -@@ -433,6 +485,10 @@ connmark_tg_print_v2(const void *ip, con - printf(" CONNMARK xset 0x%x/0x%x", - info->ctmark, info->ctmask); - break; -+ case XT_CONNMARK_SAVEDSCP: -+ printf(" CONNMARK DSCP xset 0x%x/0x%x", -+ info->ctmark, info->ctmask); -+ break; - case XT_CONNMARK_SAVE: - if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX) - printf(" CONNMARK save"); -@@ -474,6 +530,11 @@ static void CONNMARK_save(const void *ip - print_mark(markinfo->mark); - print_mask("/", markinfo->mask); - break; -+ case XT_CONNMARK_SAVEDSCP: -+ printf(" --savedscp-mark "); -+ print_mark(markinfo->mark); -+ print_mask("/", markinfo->mask); -+ break; - case XT_CONNMARK_SAVE: - printf(" --save-mark "); - print_mask("--mask ", markinfo->mask); -@@ -505,6 +566,9 @@ connmark_tg_save(const void *ip, const s - case XT_CONNMARK_SET: - printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask); - break; -+ case XT_CONNMARK_SAVEDSCP: -+ printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask); -+ break; - case XT_CONNMARK_SAVE: - printf(" --save-mark --nfmask 0x%x --ctmask 0x%x", - info->nfmask, info->ctmask); -@@ -529,6 +593,9 @@ connmark_tg_save_v2(const void *ip, cons - case XT_CONNMARK_SET: - printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask); - break; -+ case XT_CONNMARK_SAVEDSCP: -+ printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask); -+ break; - case XT_CONNMARK_SAVE: - printf(" --save-mark --nfmask 0x%x --ctmask 0x%x", - info->nfmask, info->ctmask); ---- a/include/linux/netfilter/xt_connmark.h -+++ b/include/linux/netfilter/xt_connmark.h -@@ -15,7 +15,8 @@ - enum { - XT_CONNMARK_SET = 0, - XT_CONNMARK_SAVE, -- XT_CONNMARK_RESTORE -+ XT_CONNMARK_RESTORE, -+ XT_CONNMARK_SAVEDSCP - }; - - struct xt_connmark_tginfo1 { diff --git a/package/network/utils/iptables/patches/010-add-set-dscpmark-support.patch b/package/network/utils/iptables/patches/010-add-set-dscpmark-support.patch new file mode 100644 index 0000000000..fb6978e6f7 --- /dev/null +++ b/package/network/utils/iptables/patches/010-add-set-dscpmark-support.patch @@ -0,0 +1,459 @@ +From 74267bacce0c43e5038b0377cb7c08f1ad9d50a3 Mon Sep 17 00:00:00 2001 +From: Kevin Darbyshire-Bryant +Date: Sat, 23 Mar 2019 10:21:03 +0000 +Subject: [PATCH] iptables: connmark - add set-dscpmark option for openwrt + +Naive user space front end to xt_connmark 'setdscp' option. + +iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --set-dscpmark 0xfc000000/0x01000000 + +This version has a hack to support a backport to 4.14 + +Signed-off-by: Kevin Darbyshire-Bryant +--- + extensions/libxt_CONNMARK.c | 315 +++++++++++++++++++++++++- + include/linux/netfilter/xt_connmark.h | 10 + + 2 files changed, 324 insertions(+), 1 deletion(-) + +diff --git a/extensions/libxt_CONNMARK.c b/extensions/libxt_CONNMARK.c +index 21e10913..c777b110 100644 +--- a/extensions/libxt_CONNMARK.c ++++ b/extensions/libxt_CONNMARK.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -49,6 +50,7 @@ enum { + O_CTMASK, + O_NFMASK, + O_MASK, ++ O_DSCP_MARK, + F_SET_MARK = 1 << O_SET_MARK, + F_SAVE_MARK = 1 << O_SAVE_MARK, + F_RESTORE_MARK = 1 << O_RESTORE_MARK, +@@ -61,8 +63,10 @@ enum { + F_CTMASK = 1 << O_CTMASK, + F_NFMASK = 1 << O_NFMASK, + F_MASK = 1 << O_MASK, ++ F_DSCP_MARK = 1 << O_DSCP_MARK, + F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK | +- F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK, ++ F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK | ++ F_DSCP_MARK, + }; + + static const char *const xt_connmark_shift_ops[] = { +@@ -114,6 +118,8 @@ static const struct xt_option_entry connmark_tg_opts[] = { + .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, nfmask)}, + {.name = "mask", .id = O_MASK, .type = XTTYPE_UINT32, + .excl = F_CTMASK | F_NFMASK}, ++ {.name = "set-dscpmark", .id = O_DSCP_MARK, .type = XTTYPE_MARKMASK32, ++ .excl = F_OP_ANY}, + XTOPT_TABLEEND, + }; + #undef s +@@ -148,6 +154,38 @@ static const struct xt_option_entry connmark_tg_opts_v2[] = { + }; + #undef s + ++#define s struct xt_connmark_tginfo3 ++static const struct xt_option_entry connmark_tg_opts_v3[] = { ++ {.name = "set-xmark", .id = O_SET_XMARK, .type = XTTYPE_MARKMASK32, ++ .excl = F_OP_ANY}, ++ {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, ++ .excl = F_OP_ANY}, ++ {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32, ++ .excl = F_OP_ANY}, ++ {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32, ++ .excl = F_OP_ANY}, ++ {.name = "xor-mark", .id = O_XOR_MARK, .type = XTTYPE_UINT32, ++ .excl = F_OP_ANY}, ++ {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE, ++ .excl = F_OP_ANY}, ++ {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE, ++ .excl = F_OP_ANY}, ++ {.name = "left-shift-mark", .id = O_LEFT_SHIFT_MARK, .type = XTTYPE_UINT8, ++ .min = 0, .max = 32}, ++ {.name = "right-shift-mark", .id = O_RIGHT_SHIFT_MARK, .type = XTTYPE_UINT8, ++ .min = 0, .max = 32}, ++ {.name = "ctmask", .id = O_CTMASK, .type = XTTYPE_UINT32, ++ .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, ctmask)}, ++ {.name = "nfmask", .id = O_NFMASK, .type = XTTYPE_UINT32, ++ .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, nfmask)}, ++ {.name = "mask", .id = O_MASK, .type = XTTYPE_UINT32, ++ .excl = F_CTMASK | F_NFMASK}, ++ {.name = "set-dscpmark", .id = O_DSCP_MARK, .type = XTTYPE_MARKMASK32, ++ .excl = F_OP_ANY}, ++ XTOPT_TABLEEND, ++}; ++#undef s ++ + static void connmark_tg_help(void) + { + printf( +@@ -175,6 +213,15 @@ static void connmark_tg_help_v2(void) + ); + } + ++static void connmark_tg_help_v3(void) ++{ ++ connmark_tg_help_v2(); ++ printf( ++" --set-dscpmark value/mask Save DSCP to conntrack mark value\n" ++); ++} ++ ++ + static void connmark_tg_init(struct xt_entry_target *target) + { + struct xt_connmark_tginfo1 *info = (void *)target->data; +@@ -199,6 +246,16 @@ static void connmark_tg_init_v2(struct xt_entry_target *target) + info->shift_bits = 0; + } + ++static void connmark_tg_init_v3(struct xt_entry_target *target) ++{ ++ struct xt_connmark_tginfo3 *info; ++ ++ connmark_tg_init_v2(target); ++ info = (void *)target->data; ++ ++ info->func = 0; ++} ++ + static void CONNMARK_parse(struct xt_option_call *cb) + { + struct xt_connmark_target_info *markinfo = cb->data; +@@ -253,6 +310,23 @@ static void connmark_tg_parse(struct xt_option_call *cb) + info->ctmark = cb->val.u32; + info->ctmask = 0; + break; ++ case O_DSCP_MARK: ++/* we sneaky sneaky this. nfmask isn't used by the set mark functionality ++ * and by default is set to uint32max. We can use the top bit as a flag ++ * that we're in DSCP_MARK submode of SET_MARK, if set then it's normal ++ * if unset then we're in DSCP_MARK ++ */ ++ info->mode = XT_CONNMARK_SET; ++ info->ctmark = cb->val.mark; ++ info->ctmask = cb->val.mask; ++ info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0; ++ /* need 6 contiguous bits */ ++ if ((~0 & (info->ctmark >> info->nfmask)) != 0x3f) ++ xtables_error(PARAMETER_PROBLEM, ++ "CONNMARK set-dscpmark: need 6 contiguous dscpmask bits"); ++ if (info->ctmark & info->ctmask) ++ xtables_error(PARAMETER_PROBLEM, ++ "CONNMARK set-dscpmark: dscpmask/statemask bits overlap"); + case O_SAVE_MARK: + info->mode = XT_CONNMARK_SAVE; + break; +@@ -320,6 +394,78 @@ static void connmark_tg_parse_v2(struct xt_option_call *cb) + } + } + ++static void connmark_tg_parse_v3(struct xt_option_call *cb) ++{ ++ struct xt_connmark_tginfo3 *info = cb->data; ++ ++ xtables_option_parse(cb); ++ switch (cb->entry->id) { ++ case O_SET_XMARK: ++ info->mode = XT_CONNMARK_SET; ++ info->func = XT_CONNMARK_VALUE; ++ info->ctmark = cb->val.mark; ++ info->ctmask = cb->val.mask; ++ break; ++ case O_SET_MARK: ++ info->mode = XT_CONNMARK_SET; ++ info->func = XT_CONNMARK_VALUE; ++ info->ctmark = cb->val.mark; ++ info->ctmask = cb->val.mark | cb->val.mask; ++ break; ++ case O_AND_MARK: ++ info->mode = XT_CONNMARK_SET; ++ info->func = XT_CONNMARK_VALUE; ++ info->ctmark = 0; ++ info->ctmask = ~cb->val.u32; ++ break; ++ case O_OR_MARK: ++ info->mode = XT_CONNMARK_SET; ++ info->func = XT_CONNMARK_VALUE; ++ info->ctmark = cb->val.u32; ++ info->ctmask = cb->val.u32; ++ break; ++ case O_XOR_MARK: ++ info->mode = XT_CONNMARK_SET; ++ info->func = XT_CONNMARK_VALUE; ++ info->ctmark = cb->val.u32; ++ info->ctmask = 0; ++ break; ++ case O_DSCP_MARK: ++ info->mode = XT_CONNMARK_SET; ++ info->func = XT_CONNMARK_DSCP; ++ info->ctmark = cb->val.mark; ++ info->ctmask = cb->val.mask; ++ info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0; ++ /* need 6 contiguous bits */ ++ if ((~0 & (info->ctmark >> info->shift_bits)) != 0x3f) ++ xtables_error(PARAMETER_PROBLEM, ++ "CONNMARK set-dscpmark: need 6 contiguous dscpmask bits"); ++ if (info->ctmark & info->ctmask) ++ xtables_error(PARAMETER_PROBLEM, ++ "CONNMARK set-dscpmark: dscpmask/statemask bits overlap"); ++ break; ++ case O_SAVE_MARK: ++ info->mode = XT_CONNMARK_SAVE; ++ break; ++ case O_RESTORE_MARK: ++ info->mode = XT_CONNMARK_RESTORE; ++ break; ++ case O_MASK: ++ info->nfmask = info->ctmask = cb->val.u32; ++ break; ++ case O_LEFT_SHIFT_MARK: ++ info->shift_dir = D_SHIFT_LEFT; ++ info->shift_bits = cb->val.u8; ++ break; ++ case O_RIGHT_SHIFT_MARK: ++ info->shift_dir = D_SHIFT_RIGHT; ++ info->shift_bits = cb->val.u8; ++ break; ++ default: ++ break; ++ } ++} ++ + static void connmark_tg_check(struct xt_fcheck_call *cb) + { + if (!(cb->xflags & F_OP_ANY)) +@@ -463,6 +609,65 @@ connmark_tg_print_v2(const void *ip, const struct xt_entry_target *target, + } + } + ++static void ++connmark_tg_print_v3(const void *ip, const struct xt_entry_target *target, ++ int numeric) ++{ ++ const struct xt_connmark_tginfo3 *info = (const void *)target->data; ++ const char *shift_op = xt_connmark_shift_ops[info->shift_dir]; ++ ++ switch (info->mode) { ++ case XT_CONNMARK_SET: ++ if (info->func & XT_CONNMARK_DSCP) { ++ printf(" CONNMARK DSCP 0x%x/0x%x", ++ info->ctmark, info->ctmask); ++ } ++ if (info->func & XT_CONNMARK_VALUE) { ++ if (info->ctmark == 0) ++ printf(" CONNMARK and 0x%x", ++ (unsigned int)(uint32_t)~info->ctmask); ++ else if (info->ctmark == info->ctmask) ++ printf(" CONNMARK or 0x%x", info->ctmark); ++ else if (info->ctmask == 0) ++ printf(" CONNMARK xor 0x%x", info->ctmark); ++ else if (info->ctmask == 0xFFFFFFFFU) ++ printf(" CONNMARK set 0x%x", info->ctmark); ++ else ++ printf(" CONNMARK xset 0x%x/0x%x", ++ info->ctmark, info->ctmask); ++ } ++ break; ++ case XT_CONNMARK_SAVE: ++ if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX) ++ printf(" CONNMARK save"); ++ else if (info->nfmask == info->ctmask) ++ printf(" CONNMARK save mask 0x%x", info->nfmask); ++ else ++ printf(" CONNMARK save nfmask 0x%x ctmask ~0x%x", ++ info->nfmask, info->ctmask); ++ break; ++ case XT_CONNMARK_RESTORE: ++ if (info->ctmask == UINT32_MAX && info->nfmask == UINT32_MAX) ++ printf(" CONNMARK restore"); ++ else if (info->ctmask == info->nfmask) ++ printf(" CONNMARK restore mask 0x%x", info->ctmask); ++ else ++ printf(" CONNMARK restore ctmask 0x%x nfmask ~0x%x", ++ info->ctmask, info->nfmask); ++ break; ++ ++ default: ++ printf(" ERROR: UNKNOWN CONNMARK MODE"); ++ break; ++ } ++ ++ if (info->mode <= XT_CONNMARK_RESTORE && ++ !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) && ++ info->shift_bits != 0) { ++ printf(" %s %u", shift_op, info->shift_bits); ++ } ++} ++ + static void CONNMARK_save(const void *ip, const struct xt_entry_target *target) + { + const struct xt_connmark_target_info *markinfo = +@@ -548,6 +753,38 @@ connmark_tg_save_v2(const void *ip, const struct xt_entry_target *target) + } + } + ++static void ++connmark_tg_save_v3(const void *ip, const struct xt_entry_target *target) ++{ ++ const struct xt_connmark_tginfo3 *info = (const void *)target->data; ++ const char *shift_op = xt_connmark_shift_ops[info->shift_dir]; ++ ++ switch (info->mode) { ++ case XT_CONNMARK_SET: ++ if (info->func & XT_CONNMARK_VALUE) ++ printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask); ++ if (info->func & XT_CONNMARK_DSCP) ++ printf(" --set-dscpmark 0x%x/0x%x", info->ctmark, info->ctmask); ++ break; ++ case XT_CONNMARK_SAVE: ++ printf(" --save-mark --nfmask 0x%x --ctmask 0x%x", ++ info->nfmask, info->ctmask); ++ break; ++ case XT_CONNMARK_RESTORE: ++ printf(" --restore-mark --nfmask 0x%x --ctmask 0x%x", ++ info->nfmask, info->ctmask); ++ break; ++ default: ++ printf(" ERROR: UNKNOWN CONNMARK MODE"); ++ break; ++ } ++ if (info->mode <= XT_CONNMARK_RESTORE && ++ !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) && ++ info->shift_bits != 0) { ++ printf(" --%s %u", shift_op, info->shift_bits); ++ } ++} ++ + static int connmark_tg_xlate(struct xt_xlate *xl, + const struct xt_xlate_tg_params *params) + { +@@ -639,6 +876,66 @@ static int connmark_tg_xlate_v2(struct xt_xlate *xl, + + return 1; + } ++ ++static int connmark_tg_xlate_v3(struct xt_xlate *xl, ++ const struct xt_xlate_tg_params *params) ++{ ++ const struct xt_connmark_tginfo3 *info = ++ (const void *)params->target->data; ++ const char *shift_op = xt_connmark_shift_ops[info->shift_dir]; ++ ++ switch (info->mode) { ++ case XT_CONNMARK_SET: ++ xt_xlate_add(xl, "ct mark set "); ++ if (info->func & XT_CONNMARK_VALUE) { ++ if (info->ctmask == 0xFFFFFFFFU) ++ xt_xlate_add(xl, "0x%x ", info->ctmark); ++ else if (info->ctmark == 0) ++ xt_xlate_add(xl, "ct mark and 0x%x", ~info->ctmask); ++ else if (info->ctmark == info->ctmask) ++ xt_xlate_add(xl, "ct mark or 0x%x", ++ info->ctmark); ++ else if (info->ctmask == 0) ++ xt_xlate_add(xl, "ct mark xor 0x%x", ++ info->ctmark); ++ else ++ xt_xlate_add(xl, "ct mark xor 0x%x and 0x%x", ++ info->ctmark, ~info->ctmask); ++ } ++ if (info->func & XT_CONNMARK_DSCP) { ++/* FIXME the nftables syntax would go here if only we knew what it was */ ++ xt_xlate_add(xl, "ct mark set typeof(ct mark) ip dscp " ++ "<< %u or 0x%x", info->shift_bits, ++ info->ctmask); ++ } ++ break; ++ case XT_CONNMARK_SAVE: ++ xt_xlate_add(xl, "ct mark set mark"); ++ if (!(info->nfmask == UINT32_MAX && ++ info->ctmask == UINT32_MAX)) { ++ if (info->nfmask == info->ctmask) ++ xt_xlate_add(xl, " and 0x%x", info->nfmask); ++ } ++ break; ++ case XT_CONNMARK_RESTORE: ++ xt_xlate_add(xl, "meta mark set ct mark"); ++ if (!(info->nfmask == UINT32_MAX && ++ info->ctmask == UINT32_MAX)) { ++ if (info->nfmask == info->ctmask) ++ xt_xlate_add(xl, " and 0x%x", info->nfmask); ++ } ++ break; ++ } ++ ++ if (info->mode <= XT_CONNMARK_RESTORE && ++ !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) && ++ info->shift_bits != 0) { ++ xt_xlate_add(xl, " %s %u", shift_op, info->shift_bits); ++ } ++ ++ return 1; ++} ++ + static struct xtables_target connmark_tg_reg[] = { + { + .family = NFPROTO_UNSPEC, +@@ -687,6 +984,22 @@ static struct xtables_target connmark_tg_reg[] = { + .x6_options = connmark_tg_opts_v2, + .xlate = connmark_tg_xlate_v2, + }, ++ { ++ .version = XTABLES_VERSION, ++ .name = "CONNMARK", ++ .revision = 3, ++ .family = NFPROTO_UNSPEC, ++ .size = XT_ALIGN(sizeof(struct xt_connmark_tginfo3)), ++ .userspacesize = XT_ALIGN(sizeof(struct xt_connmark_tginfo3)), ++ .help = connmark_tg_help_v3, ++ .init = connmark_tg_init_v3, ++ .print = connmark_tg_print_v3, ++ .save = connmark_tg_save_v3, ++ .x6_parse = connmark_tg_parse_v3, ++ .x6_fcheck = connmark_tg_check, ++ .x6_options = connmark_tg_opts_v3, ++ .xlate = connmark_tg_xlate_v3, ++ }, + }; + + void _init(void) +diff --git a/include/linux/netfilter/xt_connmark.h b/include/linux/netfilter/xt_connmark.h +index bbf2acc9..1d8e721c 100644 +--- a/include/linux/netfilter/xt_connmark.h ++++ b/include/linux/netfilter/xt_connmark.h +@@ -18,6 +18,11 @@ enum { + XT_CONNMARK_RESTORE + }; + ++enum { ++ XT_CONNMARK_VALUE = (1 << 0), ++ XT_CONNMARK_DSCP = (1 << 1) ++}; ++ + struct xt_connmark_tginfo1 { + __u32 ctmark, ctmask, nfmask; + __u8 mode; +@@ -28,6 +33,11 @@ struct xt_connmark_tginfo2 { + __u8 shift_dir, shift_bits, mode; + }; + ++struct xt_connmark_tginfo3 { ++ __u32 ctmark, ctmask, nfmask; ++ __u8 shift_dir, shift_bits, mode, func; ++}; ++ + struct xt_connmark_mtinfo1 { + __u32 mark, mask; + __u8 invert; +-- +2.21.0 (Apple Git-122.2) + -- 2.25.1