package/network/utils/iptables/patches/010-add-savedscp-support.patch

   1 From 69b427fb5e1211c1110ce63be62b70504d04b0ff Mon Sep 17 00:00:00 2001
   2 From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
   3 Date: Sat, 23 Mar 2019 10:21:03 +0000
   4 Subject: [PATCH] savedscp
   5
   6 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
   7 ---
   8  extensions/libxt_CONNMARK.c           | 68 ++++++++++++++++++++++++++-
   9  include/linux/netfilter/xt_connmark.h |  3 +-
  10  2 files changed, 69 insertions(+), 2 deletions(-)
  11
  12 --- a/extensions/libxt_CONNMARK.c
  13 +++ b/extensions/libxt_CONNMARK.c
  14 @@ -49,6 +49,7 @@ enum {
  15         O_CTMASK,
  16         O_NFMASK,
  17         O_MASK,
  18 +       O_SAVEDSCP_MARK,
  19         F_SET_MARK         = 1 << O_SET_MARK,
  20         F_SAVE_MARK        = 1 << O_SAVE_MARK,
  21         F_RESTORE_MARK     = 1 << O_RESTORE_MARK,
  22 @@ -61,8 +62,10 @@ enum {
  23         F_CTMASK           = 1 << O_CTMASK,
  24         F_NFMASK           = 1 << O_NFMASK,
  25         F_MASK             = 1 << O_MASK,
  26 +       F_SAVEDSCP_MARK    = 1 << O_SAVEDSCP_MARK,
  27         F_OP_ANY           = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
  28 -                            F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
  29 +                            F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK |
  30 +                            F_SAVEDSCP_MARK,
  31  };
  32
  33  static const char *const xt_connmark_shift_ops[] = {
  34 @@ -75,6 +78,7 @@ static void CONNMARK_help(void)
  35         printf(
  36  "CONNMARK target options:\n"
  37  "  --set-mark value[/mask]       Set conntrack mark value\n"
  38 +"  --savedscp-mark dscpmask/statemask    Save DSCP to conntrack mark value\n"
  39  "  --save-mark [--mask mask]     Save the packet nfmark in the connection\n"
  40  "  --restore-mark [--mask mask]  Restore saved nfmark value\n");
  41  }
  42 @@ -83,6 +87,8 @@ static void CONNMARK_help(void)
  43  static const struct xt_option_entry CONNMARK_opts[] = {
  44         {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
  45          .excl = F_OP_ANY},
  46 +       {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
  47 +        .excl = F_OP_ANY},
  48         {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE,
  49          .excl = F_OP_ANY},
  50         {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE,
  51 @@ -98,6 +104,8 @@ static const struct xt_option_entry conn
  52          .excl = F_OP_ANY},
  53         {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
  54          .excl = F_OP_ANY},
  55 +       {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
  56 +        .excl = F_OP_ANY},
  57         {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
  58          .excl = F_OP_ANY},
  59         {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
  60 @@ -124,6 +132,8 @@ static const struct xt_option_entry conn
  61          .excl = F_OP_ANY},
  62         {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
  63          .excl = F_OP_ANY},
  64 +       {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
  65 +        .excl = F_OP_ANY},
  66         {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
  67          .excl = F_OP_ANY},
  68         {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
  69 @@ -158,6 +168,7 @@ static void connmark_tg_help(void)
  70  "  --restore-mark [--ctmask mask] [--nfmask mask]\n"
  71  "                                Copy nfmark to ctmark using masks\n"
  72  "  --set-mark value[/mask]       Set conntrack mark value\n"
  73 +"  --savedscp-mark value/mask    Save DSCP to conntrack mark value\n"
  74  "  --save-mark [--mask mask]     Save the packet nfmark in the connection\n"
  75  "  --restore-mark [--mask mask]  Restore saved nfmark value\n"
  76  "  --and-mark value              Binary AND the ctmark with bits\n"
  77 @@ -210,6 +221,11 @@ static void CONNMARK_parse(struct xt_opt
  78                 markinfo->mark = cb->val.mark;
  79                 markinfo->mask = cb->val.mask;
  80                 break;
  81 +       case O_SAVEDSCP_MARK:
  82 +               markinfo->mode = XT_CONNMARK_SAVEDSCP;
  83 +               markinfo->mark = cb->val.mark;
  84 +               markinfo->mask = cb->val.mask;
  85 +               break;
  86         case O_SAVE_MARK:
  87                 markinfo->mode = XT_CONNMARK_SAVE;
  88                 break;
  89 @@ -238,6 +254,19 @@ static void connmark_tg_parse(struct xt_
  90                 info->ctmark = cb->val.mark;
  91                 info->ctmask = cb->val.mark | cb->val.mask;
  92                 break;
  93 +       case O_SAVEDSCP_MARK:
  94 +               info->mode   = XT_CONNMARK_SAVEDSCP;
  95 +               info->ctmark = cb->val.mark;
  96 +               info->ctmask = cb->val.mask;
  97 +               info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0;
  98 +               /* need 6 contiguous bits */
  99 +               if ((0x3f & (info->ctmark >> info->nfmask)) != 0x3f)
 100 +                       xtables_error(PARAMETER_PROBLEM,
 101 +                               "CONNMARK savedscp: insufficient contiguous dscpmask bits");
 102 +               if (info->ctmark & info->ctmask)
 103 +                       xtables_error(PARAMETER_PROBLEM,
 104 +                               "CONNMARK savedscp: dscpmask/statemask bits overlap");
 105 +               break;
 106         case O_AND_MARK:
 107                 info->mode   = XT_CONNMARK_SET;
 108                 info->ctmark = 0;
 109 @@ -283,6 +312,19 @@ static void connmark_tg_parse_v2(struct
 110                 info->ctmark = cb->val.mark;
 111                 info->ctmask = cb->val.mark | cb->val.mask;
 112                 break;
 113 +       case O_SAVEDSCP_MARK:
 114 +               info->mode   = XT_CONNMARK_SAVEDSCP;
 115 +               info->ctmark = cb->val.mark;
 116 +               info->ctmask = cb->val.mask;
 117 +               info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0;
 118 +               /* need 6 contiguous bits */
 119 +               if ((0x3f & (info->ctmark >> info->shift_bits)) != 0x3f)
 120 +                       xtables_error(PARAMETER_PROBLEM,
 121 +                               "CONNMARK savedscp: insufficient contiguous dscpmask bits");
 122 +               if (info->ctmark & info->ctmask)
 123 +                       xtables_error(PARAMETER_PROBLEM,
 124 +                               "CONNMARK savedscp: dscpmask/statemask bits overlap");
 125 +               break;
 126         case O_AND_MARK:
 127                 info->mode   = XT_CONNMARK_SET;
 128                 info->ctmark = 0;
 129 @@ -351,6 +393,11 @@ static void CONNMARK_print(const void *i
 130             print_mark(markinfo->mark);
 131             print_mask("/", markinfo->mask);
 132             break;
 133 +       case XT_CONNMARK_SAVEDSCP:
 134 +           printf(" CONNMARK savedscp ");
 135 +           print_mark(markinfo->mark);
 136 +           print_mask("/", markinfo->mask);
 137 +           break;
 138         case XT_CONNMARK_SAVE:
 139             printf(" CONNMARK save ");
 140             print_mask("mask ", markinfo->mask);
 141 @@ -386,6 +433,10 @@ connmark_tg_print(const void *ip, const
 142                         printf(" CONNMARK xset 0x%x/0x%x",
 143                                info->ctmark, info->ctmask);
 144                 break;
 145 +       case XT_CONNMARK_SAVEDSCP:
 146 +               printf(" CONNMARK DSCP set 0x%x/0x%x",
 147 +                      info->ctmark, info->ctmask);
 148 +               break;
 149         case XT_CONNMARK_SAVE:
 150                 if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
 151                         printf(" CONNMARK save");
 152 @@ -433,6 +484,10 @@ connmark_tg_print_v2(const void *ip, con
 153                         printf(" CONNMARK xset 0x%x/0x%x",
 154                                info->ctmark, info->ctmask);
 155                 break;
 156 +       case XT_CONNMARK_SAVEDSCP:
 157 +               printf(" CONNMARK DSCP xset 0x%x/0x%x",
 158 +                      info->ctmark, info->ctmask);
 159 +               break;
 160         case XT_CONNMARK_SAVE:
 161                 if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
 162                         printf(" CONNMARK save");
 163 @@ -474,6 +529,11 @@ static void CONNMARK_save(const void *ip
 164             print_mark(markinfo->mark);
 165             print_mask("/", markinfo->mask);
 166             break;
 167 +       case XT_CONNMARK_SAVEDSCP:
 168 +           printf(" --savedscp-mark ");
 169 +           print_mark(markinfo->mark);
 170 +           print_mask("/", markinfo->mask);
 171 +           break;
 172         case XT_CONNMARK_SAVE:
 173             printf(" --save-mark ");
 174             print_mask("--mask ", markinfo->mask);
 175 @@ -505,6 +565,9 @@ connmark_tg_save(const void *ip, const s
 176         case XT_CONNMARK_SET:
 177                 printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
 178                 break;
 179 +       case XT_CONNMARK_SAVEDSCP:
 180 +               printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
 181 +               break;
 182         case XT_CONNMARK_SAVE:
 183                 printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
 184                        info->nfmask, info->ctmask);
 185 @@ -529,6 +592,9 @@ connmark_tg_save_v2(const void *ip, cons
 186         case XT_CONNMARK_SET:
 187                 printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
 188                 break;
 189 +       case XT_CONNMARK_SAVEDSCP:
 190 +               printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
 191 +               break;
 192         case XT_CONNMARK_SAVE:
 193                 printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
 194                        info->nfmask, info->ctmask);
 195 --- a/include/linux/netfilter/xt_connmark.h
 196 +++ b/include/linux/netfilter/xt_connmark.h
 197 @@ -15,7 +15,8 @@
 198  enum {
 199         XT_CONNMARK_SET = 0,
 200         XT_CONNMARK_SAVE,
 201 -       XT_CONNMARK_RESTORE
 202 +       XT_CONNMARK_RESTORE,
 203 +       XT_CONNMARK_SAVEDSCP
 204  };
 205
 206  struct xt_connmark_tginfo1 {