package/network/utils/iptables/patches/010-add-set-dscpmark-support.patch

   1 From 74267bacce0c43e5038b0377cb7c08f1ad9d50a3 Mon Sep 17 00:00:00 2001
   2 From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
   3 Date: Sat, 23 Mar 2019 10:21:03 +0000
   4 Subject: [PATCH] iptables: connmark - add set-dscpmark option for openwrt
   5
   6 Naive user space front end to xt_connmark 'setdscp' option.
   7
   8 iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --set-dscpmark 0xfc000000/0x01000000
   9
  10 This version has a hack to support a backport to 4.14
  11
  12 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
  13 ---
  14  extensions/libxt_CONNMARK.c           | 315 +++++++++++++++++++++++++-
  15  include/linux/netfilter/xt_connmark.h |  10 +
  16  2 files changed, 324 insertions(+), 1 deletion(-)
  17
  18 diff --git a/extensions/libxt_CONNMARK.c b/extensions/libxt_CONNMARK.c
  19 index 21e10913..c777b110 100644
  20 --- a/extensions/libxt_CONNMARK.c
  21 +++ b/extensions/libxt_CONNMARK.c
  22 @@ -22,6 +22,7 @@
  23  #include <stdbool.h>
  24  #include <stdint.h>
  25  #include <stdio.h>
  26 +#include <strings.h>
  27  #include <xtables.h>
  28  #include <linux/netfilter/xt_CONNMARK.h>
  29
  30 @@ -49,6 +50,7 @@ enum {
  31         O_CTMASK,
  32         O_NFMASK,
  33         O_MASK,
  34 +       O_DSCP_MARK,
  35         F_SET_MARK         = 1 << O_SET_MARK,
  36         F_SAVE_MARK        = 1 << O_SAVE_MARK,
  37         F_RESTORE_MARK     = 1 << O_RESTORE_MARK,
  38 @@ -61,8 +63,10 @@ enum {
  39         F_CTMASK           = 1 << O_CTMASK,
  40         F_NFMASK           = 1 << O_NFMASK,
  41         F_MASK             = 1 << O_MASK,
  42 +       F_DSCP_MARK        = 1 << O_DSCP_MARK,
  43         F_OP_ANY           = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
  44 -                            F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
  45 +                            F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK |
  46 +                            F_DSCP_MARK,
  47  };
  48
  49  static const char *const xt_connmark_shift_ops[] = {
  50 @@ -114,6 +118,8 @@ static const struct xt_option_entry connmark_tg_opts[] = {
  51          .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, nfmask)},
  52         {.name = "mask", .id = O_MASK, .type = XTTYPE_UINT32,
  53          .excl = F_CTMASK | F_NFMASK},
  54 +       {.name = "set-dscpmark", .id = O_DSCP_MARK, .type = XTTYPE_MARKMASK32,
  55 +        .excl = F_OP_ANY},
  56         XTOPT_TABLEEND,
  57  };
  58  #undef s
  59 @@ -148,6 +154,38 @@ static const struct xt_option_entry connmark_tg_opts_v2[] = {
  60  };
  61  #undef s
  62
  63 +#define s struct xt_connmark_tginfo3
  64 +static const struct xt_option_entry connmark_tg_opts_v3[] = {
  65 +       {.name = "set-xmark", .id = O_SET_XMARK, .type = XTTYPE_MARKMASK32,
  66 +        .excl = F_OP_ANY},
  67 +       {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
  68 +        .excl = F_OP_ANY},
  69 +       {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
  70 +        .excl = F_OP_ANY},
  71 +       {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
  72 +        .excl = F_OP_ANY},
  73 +       {.name = "xor-mark", .id = O_XOR_MARK, .type = XTTYPE_UINT32,
  74 +        .excl = F_OP_ANY},
  75 +       {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE,
  76 +        .excl = F_OP_ANY},
  77 +       {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE,
  78 +        .excl = F_OP_ANY},
  79 +       {.name = "left-shift-mark", .id = O_LEFT_SHIFT_MARK, .type = XTTYPE_UINT8,
  80 +        .min = 0, .max = 32},
  81 +       {.name = "right-shift-mark", .id = O_RIGHT_SHIFT_MARK, .type = XTTYPE_UINT8,
  82 +        .min = 0, .max = 32},
  83 +       {.name = "ctmask", .id = O_CTMASK, .type = XTTYPE_UINT32,
  84 +        .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, ctmask)},
  85 +       {.name = "nfmask", .id = O_NFMASK, .type = XTTYPE_UINT32,
  86 +        .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, nfmask)},
  87 +       {.name = "mask", .id = O_MASK, .type = XTTYPE_UINT32,
  88 +        .excl = F_CTMASK | F_NFMASK},
  89 +       {.name = "set-dscpmark", .id = O_DSCP_MARK, .type = XTTYPE_MARKMASK32,
  90 +        .excl = F_OP_ANY},
  91 +       XTOPT_TABLEEND,
  92 +};
  93 +#undef s
  94 +
  95  static void connmark_tg_help(void)
  96  {
  97         printf(
  98 @@ -175,6 +213,15 @@ static void connmark_tg_help_v2(void)
  99  );
 100  }
 101
 102 +static void connmark_tg_help_v3(void)
 103 +{
 104 +       connmark_tg_help_v2();
 105 +       printf(
 106 +"  --set-dscpmark value/mask        Save DSCP to conntrack mark value\n"
 107 +);
 108 +}
 109 +
 110 +
 111  static void connmark_tg_init(struct xt_entry_target *target)
 112  {
 113         struct xt_connmark_tginfo1 *info = (void *)target->data;
 114 @@ -199,6 +246,16 @@ static void connmark_tg_init_v2(struct xt_entry_target *target)
 115         info->shift_bits = 0;
 116  }
 117
 118 +static void connmark_tg_init_v3(struct xt_entry_target *target)
 119 +{
 120 +       struct xt_connmark_tginfo3 *info;
 121 +
 122 +       connmark_tg_init_v2(target);
 123 +       info = (void *)target->data;
 124 +
 125 +       info->func = 0;
 126 +}
 127 +
 128  static void CONNMARK_parse(struct xt_option_call *cb)
 129  {
 130         struct xt_connmark_target_info *markinfo = cb->data;
 131 @@ -253,6 +310,23 @@ static void connmark_tg_parse(struct xt_option_call *cb)
 132                 info->ctmark = cb->val.u32;
 133                 info->ctmask = 0;
 134                 break;
 135 +       case O_DSCP_MARK:
 136 +/* we sneaky sneaky this.  nfmask isn't used by the set mark functionality
 137 + * and by default is set to uint32max.  We can use the top bit as a flag
 138 + * that we're in DSCP_MARK submode of SET_MARK, if set then it's normal
 139 + * if unset then we're in DSCP_MARK
 140 + */
 141 +               info->mode   = XT_CONNMARK_SET;
 142 +               info->ctmark = cb->val.mark;
 143 +               info->ctmask = cb->val.mask;
 144 +               info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0;
 145 +               /* need 6 contiguous bits */
 146 +               if ((~0 & (info->ctmark >> info->nfmask)) != 0x3f)
 147 +                       xtables_error(PARAMETER_PROBLEM,
 148 +                               "CONNMARK set-dscpmark: need 6 contiguous dscpmask bits");
 149 +               if (info->ctmark & info->ctmask)
 150 +                       xtables_error(PARAMETER_PROBLEM,
 151 +                               "CONNMARK set-dscpmark: dscpmask/statemask bits overlap");
 152         case O_SAVE_MARK:
 153                 info->mode = XT_CONNMARK_SAVE;
 154                 break;
 155 @@ -320,6 +394,78 @@ static void connmark_tg_parse_v2(struct xt_option_call *cb)
 156         }
 157  }
 158
 159 +static void connmark_tg_parse_v3(struct xt_option_call *cb)
 160 +{
 161 +       struct xt_connmark_tginfo3 *info = cb->data;
 162 +
 163 +       xtables_option_parse(cb);
 164 +       switch (cb->entry->id) {
 165 +       case O_SET_XMARK:
 166 +               info->mode   = XT_CONNMARK_SET;
 167 +               info->func   = XT_CONNMARK_VALUE;
 168 +               info->ctmark = cb->val.mark;
 169 +               info->ctmask = cb->val.mask;
 170 +               break;
 171 +       case O_SET_MARK:
 172 +               info->mode   = XT_CONNMARK_SET;
 173 +               info->func   = XT_CONNMARK_VALUE;
 174 +               info->ctmark = cb->val.mark;
 175 +               info->ctmask = cb->val.mark | cb->val.mask;
 176 +               break;
 177 +       case O_AND_MARK:
 178 +               info->mode   = XT_CONNMARK_SET;
 179 +               info->func   = XT_CONNMARK_VALUE;
 180 +               info->ctmark = 0;
 181 +               info->ctmask = ~cb->val.u32;
 182 +               break;
 183 +       case O_OR_MARK:
 184 +               info->mode   = XT_CONNMARK_SET;
 185 +               info->func   = XT_CONNMARK_VALUE;
 186 +               info->ctmark = cb->val.u32;
 187 +               info->ctmask = cb->val.u32;
 188 +               break;
 189 +       case O_XOR_MARK:
 190 +               info->mode   = XT_CONNMARK_SET;
 191 +               info->func   = XT_CONNMARK_VALUE;
 192 +               info->ctmark = cb->val.u32;
 193 +               info->ctmask = 0;
 194 +               break;
 195 +       case O_DSCP_MARK:
 196 +               info->mode   = XT_CONNMARK_SET;
 197 +               info->func   = XT_CONNMARK_DSCP;
 198 +               info->ctmark = cb->val.mark;
 199 +               info->ctmask = cb->val.mask;
 200 +               info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0;
 201 +               /* need 6 contiguous bits */
 202 +               if ((~0 & (info->ctmark >> info->shift_bits)) != 0x3f)
 203 +                       xtables_error(PARAMETER_PROBLEM,
 204 +                               "CONNMARK set-dscpmark: need 6 contiguous dscpmask bits");
 205 +               if (info->ctmark & info->ctmask)
 206 +                       xtables_error(PARAMETER_PROBLEM,
 207 +                               "CONNMARK set-dscpmark: dscpmask/statemask bits overlap");
 208 +               break;
 209 +       case O_SAVE_MARK:
 210 +               info->mode = XT_CONNMARK_SAVE;
 211 +               break;
 212 +       case O_RESTORE_MARK:
 213 +               info->mode = XT_CONNMARK_RESTORE;
 214 +               break;
 215 +       case O_MASK:
 216 +               info->nfmask = info->ctmask = cb->val.u32;
 217 +               break;
 218 +       case O_LEFT_SHIFT_MARK:
 219 +               info->shift_dir = D_SHIFT_LEFT;
 220 +               info->shift_bits = cb->val.u8;
 221 +               break;
 222 +       case O_RIGHT_SHIFT_MARK:
 223 +               info->shift_dir = D_SHIFT_RIGHT;
 224 +               info->shift_bits = cb->val.u8;
 225 +               break;
 226 +       default:
 227 +               break;
 228 +       }
 229 +}
 230 +
 231  static void connmark_tg_check(struct xt_fcheck_call *cb)
 232  {
 233         if (!(cb->xflags & F_OP_ANY))
 234 @@ -463,6 +609,65 @@ connmark_tg_print_v2(const void *ip, const struct xt_entry_target *target,
 235         }
 236  }
 237
 238 +static void
 239 +connmark_tg_print_v3(const void *ip, const struct xt_entry_target *target,
 240 +                  int numeric)
 241 +{
 242 +       const struct xt_connmark_tginfo3 *info = (const void *)target->data;
 243 +       const char *shift_op = xt_connmark_shift_ops[info->shift_dir];
 244 +
 245 +       switch (info->mode) {
 246 +       case XT_CONNMARK_SET:
 247 +               if (info->func & XT_CONNMARK_DSCP) {
 248 +                       printf(" CONNMARK DSCP 0x%x/0x%x",
 249 +                              info->ctmark, info->ctmask);
 250 +               }
 251 +               if (info->func & XT_CONNMARK_VALUE) {
 252 +                       if (info->ctmark == 0)
 253 +                               printf(" CONNMARK and 0x%x",
 254 +                                      (unsigned int)(uint32_t)~info->ctmask);
 255 +                       else if (info->ctmark == info->ctmask)
 256 +                               printf(" CONNMARK or 0x%x", info->ctmark);
 257 +                       else if (info->ctmask == 0)
 258 +                               printf(" CONNMARK xor 0x%x", info->ctmark);
 259 +                       else if (info->ctmask == 0xFFFFFFFFU)
 260 +                               printf(" CONNMARK set 0x%x", info->ctmark);
 261 +                       else
 262 +                               printf(" CONNMARK xset 0x%x/0x%x",
 263 +                                      info->ctmark, info->ctmask);
 264 +               }
 265 +               break;
 266 +       case XT_CONNMARK_SAVE:
 267 +               if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
 268 +                       printf(" CONNMARK save");
 269 +               else if (info->nfmask == info->ctmask)
 270 +                       printf(" CONNMARK save mask 0x%x", info->nfmask);
 271 +               else
 272 +                       printf(" CONNMARK save nfmask 0x%x ctmask ~0x%x",
 273 +                              info->nfmask, info->ctmask);
 274 +               break;
 275 +       case XT_CONNMARK_RESTORE:
 276 +               if (info->ctmask == UINT32_MAX && info->nfmask == UINT32_MAX)
 277 +                       printf(" CONNMARK restore");
 278 +               else if (info->ctmask == info->nfmask)
 279 +                       printf(" CONNMARK restore mask 0x%x", info->ctmask);
 280 +               else
 281 +                       printf(" CONNMARK restore ctmask 0x%x nfmask ~0x%x",
 282 +                              info->ctmask, info->nfmask);
 283 +               break;
 284 +
 285 +       default:
 286 +               printf(" ERROR: UNKNOWN CONNMARK MODE");
 287 +               break;
 288 +       }
 289 +
 290 +       if (info->mode <= XT_CONNMARK_RESTORE &&
 291 +           !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) &&
 292 +           info->shift_bits != 0) {
 293 +               printf(" %s %u", shift_op, info->shift_bits);
 294 +       }
 295 +}
 296 +
 297  static void CONNMARK_save(const void *ip, const struct xt_entry_target *target)
 298  {
 299         const struct xt_connmark_target_info *markinfo =
 300 @@ -548,6 +753,38 @@ connmark_tg_save_v2(const void *ip, const struct xt_entry_target *target)
 301         }
 302  }
 303
 304 +static void
 305 +connmark_tg_save_v3(const void *ip, const struct xt_entry_target *target)
 306 +{
 307 +       const struct xt_connmark_tginfo3 *info = (const void *)target->data;
 308 +       const char *shift_op = xt_connmark_shift_ops[info->shift_dir];
 309 +
 310 +       switch (info->mode) {
 311 +       case XT_CONNMARK_SET:
 312 +               if (info->func & XT_CONNMARK_VALUE)
 313 +                       printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
 314 +               if (info->func & XT_CONNMARK_DSCP)
 315 +                       printf(" --set-dscpmark 0x%x/0x%x", info->ctmark, info->ctmask);
 316 +               break;
 317 +       case XT_CONNMARK_SAVE:
 318 +               printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
 319 +                      info->nfmask, info->ctmask);
 320 +               break;
 321 +       case XT_CONNMARK_RESTORE:
 322 +               printf(" --restore-mark --nfmask 0x%x --ctmask 0x%x",
 323 +                      info->nfmask, info->ctmask);
 324 +               break;
 325 +       default:
 326 +               printf(" ERROR: UNKNOWN CONNMARK MODE");
 327 +               break;
 328 +       }
 329 +       if (info->mode <= XT_CONNMARK_RESTORE &&
 330 +           !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) &&
 331 +           info->shift_bits != 0) {
 332 +               printf(" --%s %u", shift_op, info->shift_bits);
 333 +       }
 334 +}
 335 +
 336  static int connmark_tg_xlate(struct xt_xlate *xl,
 337                              const struct xt_xlate_tg_params *params)
 338  {
 339 @@ -639,6 +876,66 @@ static int connmark_tg_xlate_v2(struct xt_xlate *xl,
 340
 341         return 1;
 342  }
 343 +
 344 +static int connmark_tg_xlate_v3(struct xt_xlate *xl,
 345 +                            const struct xt_xlate_tg_params *params)
 346 +{
 347 +       const struct xt_connmark_tginfo3 *info =
 348 +               (const void *)params->target->data;
 349 +       const char *shift_op = xt_connmark_shift_ops[info->shift_dir];
 350 +
 351 +       switch (info->mode) {
 352 +       case XT_CONNMARK_SET:
 353 +               xt_xlate_add(xl, "ct mark set ");
 354 +               if (info->func & XT_CONNMARK_VALUE) {
 355 +                       if (info->ctmask == 0xFFFFFFFFU)
 356 +                               xt_xlate_add(xl, "0x%x ", info->ctmark);
 357 +                       else if (info->ctmark == 0)
 358 +                               xt_xlate_add(xl, "ct mark and 0x%x", ~info->ctmask);
 359 +                       else if (info->ctmark == info->ctmask)
 360 +                               xt_xlate_add(xl, "ct mark or 0x%x",
 361 +                                            info->ctmark);
 362 +                       else if (info->ctmask == 0)
 363 +                               xt_xlate_add(xl, "ct mark xor 0x%x",
 364 +                                            info->ctmark);
 365 +                       else
 366 +                               xt_xlate_add(xl, "ct mark xor 0x%x and 0x%x",
 367 +                                            info->ctmark, ~info->ctmask);
 368 +               }
 369 +               if (info->func & XT_CONNMARK_DSCP) {
 370 +/* FIXME the nftables syntax would go here if only we knew what it was */
 371 +                       xt_xlate_add(xl, "ct mark set typeof(ct mark) ip dscp "
 372 +                                        "<< %u or 0x%x", info->shift_bits,
 373 +                                            info->ctmask);
 374 +               }
 375 +               break;
 376 +       case XT_CONNMARK_SAVE:
 377 +               xt_xlate_add(xl, "ct mark set mark");
 378 +               if (!(info->nfmask == UINT32_MAX &&
 379 +                   info->ctmask == UINT32_MAX)) {
 380 +                       if (info->nfmask == info->ctmask)
 381 +                               xt_xlate_add(xl, " and 0x%x", info->nfmask);
 382 +               }
 383 +               break;
 384 +       case XT_CONNMARK_RESTORE:
 385 +               xt_xlate_add(xl, "meta mark set ct mark");
 386 +               if (!(info->nfmask == UINT32_MAX &&
 387 +                   info->ctmask == UINT32_MAX)) {
 388 +                       if (info->nfmask == info->ctmask)
 389 +                               xt_xlate_add(xl, " and 0x%x", info->nfmask);
 390 +               }
 391 +               break;
 392 +       }
 393 +
 394 +       if (info->mode <= XT_CONNMARK_RESTORE &&
 395 +           !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) &&
 396 +           info->shift_bits != 0) {
 397 +               xt_xlate_add(xl, " %s %u", shift_op, info->shift_bits);
 398 +       }
 399 +
 400 +       return 1;
 401 +}
 402 +
 403  static struct xtables_target connmark_tg_reg[] = {
 404         {
 405                 .family        = NFPROTO_UNSPEC,
 406 @@ -687,6 +984,22 @@ static struct xtables_target connmark_tg_reg[] = {
 407                 .x6_options    = connmark_tg_opts_v2,
 408                 .xlate         = connmark_tg_xlate_v2,
 409         },
 410 +       {
 411 +               .version       = XTABLES_VERSION,
 412 +               .name          = "CONNMARK",
 413 +               .revision      = 3,
 414 +               .family        = NFPROTO_UNSPEC,
 415 +               .size          = XT_ALIGN(sizeof(struct xt_connmark_tginfo3)),
 416 +               .userspacesize = XT_ALIGN(sizeof(struct xt_connmark_tginfo3)),
 417 +               .help          = connmark_tg_help_v3,
 418 +               .init          = connmark_tg_init_v3,
 419 +               .print         = connmark_tg_print_v3,
 420 +               .save          = connmark_tg_save_v3,
 421 +               .x6_parse      = connmark_tg_parse_v3,
 422 +               .x6_fcheck     = connmark_tg_check,
 423 +               .x6_options    = connmark_tg_opts_v3,
 424 +               .xlate         = connmark_tg_xlate_v3,
 425 +       },
 426  };
 427
 428  void _init(void)
 429 diff --git a/include/linux/netfilter/xt_connmark.h b/include/linux/netfilter/xt_connmark.h
 430 index bbf2acc9..1d8e721c 100644
 431 --- a/include/linux/netfilter/xt_connmark.h
 432 +++ b/include/linux/netfilter/xt_connmark.h
 433 @@ -18,6 +18,11 @@ enum {
 434         XT_CONNMARK_RESTORE
 435  };
 436
 437 +enum {
 438 +       XT_CONNMARK_VALUE       = (1 << 0),
 439 +       XT_CONNMARK_DSCP        = (1 << 1)
 440 +};
 441 +
 442  struct xt_connmark_tginfo1 {
 443         __u32 ctmark, ctmask, nfmask;
 444         __u8 mode;
 445 @@ -28,6 +33,11 @@ struct xt_connmark_tginfo2 {
 446         __u8 shift_dir, shift_bits, mode;
 447  };
 448
 449 +struct xt_connmark_tginfo3 {
 450 +       __u32 ctmark, ctmask, nfmask;
 451 +       __u8 shift_dir, shift_bits, mode, func;
 452 +};
 453 +
 454  struct xt_connmark_mtinfo1 {
 455         __u32 mark, mask;
 456         __u8 invert;
 457 --
 458 2.21.0 (Apple Git-122.2)
 459