package/network/utils/iptables/patches/010-add-savedscp-support.patch

   1 From 69b427fb5e1211c1110ce63be62b70504d04b0ff Mon Sep 17 00:00:00 2001
   2 From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
   3 Date: Sat, 23 Mar 2019 10:21:03 +0000
   4 Subject: [PATCH] savedscp
   5
   6 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
   7 ---
   8  extensions/libxt_CONNMARK.c           | 68 ++++++++++++++++++++++++++-
   9  include/linux/netfilter/xt_connmark.h |  3 +-
  10  2 files changed, 69 insertions(+), 2 deletions(-)
  11
  12 --- a/extensions/libxt_CONNMARK.c
  13 +++ b/extensions/libxt_CONNMARK.c
  14 @@ -22,6 +22,7 @@
  15  #include <stdbool.h>
  16  #include <stdint.h>
  17  #include <stdio.h>
  18 +#include <strings.h>
  19  #include <xtables.h>
  20  #include <linux/netfilter/xt_CONNMARK.h>
  21
  22 @@ -49,6 +50,7 @@ enum {
  23         O_CTMASK,
  24         O_NFMASK,
  25         O_MASK,
  26 +       O_SAVEDSCP_MARK,
  27         F_SET_MARK         = 1 << O_SET_MARK,
  28         F_SAVE_MARK        = 1 << O_SAVE_MARK,
  29         F_RESTORE_MARK     = 1 << O_RESTORE_MARK,
  30 @@ -61,8 +63,10 @@ enum {
  31         F_CTMASK           = 1 << O_CTMASK,
  32         F_NFMASK           = 1 << O_NFMASK,
  33         F_MASK             = 1 << O_MASK,
  34 +       F_SAVEDSCP_MARK    = 1 << O_SAVEDSCP_MARK,
  35         F_OP_ANY           = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
  36 -                            F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
  37 +                            F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK |
  38 +                            F_SAVEDSCP_MARK,
  39  };
  40
  41  static const char *const xt_connmark_shift_ops[] = {
  42 @@ -75,6 +79,7 @@ static void CONNMARK_help(void)
  43         printf(
  44  "CONNMARK target options:\n"
  45  "  --set-mark value[/mask]       Set conntrack mark value\n"
  46 +"  --savedscp-mark dscpmask/statemask    Save DSCP to conntrack mark value\n"
  47  "  --save-mark [--mask mask]     Save the packet nfmark in the connection\n"
  48  "  --restore-mark [--mask mask]  Restore saved nfmark value\n");
  49  }
  50 @@ -83,6 +88,8 @@ static void CONNMARK_help(void)
  51  static const struct xt_option_entry CONNMARK_opts[] = {
  52         {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
  53          .excl = F_OP_ANY},
  54 +       {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
  55 +        .excl = F_OP_ANY},
  56         {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE,
  57          .excl = F_OP_ANY},
  58         {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE,
  59 @@ -98,6 +105,8 @@ static const struct xt_option_entry conn
  60          .excl = F_OP_ANY},
  61         {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
  62          .excl = F_OP_ANY},
  63 +       {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
  64 +        .excl = F_OP_ANY},
  65         {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
  66          .excl = F_OP_ANY},
  67         {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
  68 @@ -124,6 +133,8 @@ static const struct xt_option_entry conn
  69          .excl = F_OP_ANY},
  70         {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
  71          .excl = F_OP_ANY},
  72 +       {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
  73 +        .excl = F_OP_ANY},
  74         {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
  75          .excl = F_OP_ANY},
  76         {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
  77 @@ -158,6 +169,7 @@ static void connmark_tg_help(void)
  78  "  --restore-mark [--ctmask mask] [--nfmask mask]\n"
  79  "                                Copy nfmark to ctmark using masks\n"
  80  "  --set-mark value[/mask]       Set conntrack mark value\n"
  81 +"  --savedscp-mark value/mask    Save DSCP to conntrack mark value\n"
  82  "  --save-mark [--mask mask]     Save the packet nfmark in the connection\n"
  83  "  --restore-mark [--mask mask]  Restore saved nfmark value\n"
  84  "  --and-mark value              Binary AND the ctmark with bits\n"
  85 @@ -210,6 +222,11 @@ static void CONNMARK_parse(struct xt_opt
  86                 markinfo->mark = cb->val.mark;
  87                 markinfo->mask = cb->val.mask;
  88                 break;
  89 +       case O_SAVEDSCP_MARK:
  90 +               markinfo->mode = XT_CONNMARK_SAVEDSCP;
  91 +               markinfo->mark = cb->val.mark;
  92 +               markinfo->mask = cb->val.mask;
  93 +               break;
  94         case O_SAVE_MARK:
  95                 markinfo->mode = XT_CONNMARK_SAVE;
  96                 break;
  97 @@ -238,6 +255,19 @@ static void connmark_tg_parse(struct xt_
  98                 info->ctmark = cb->val.mark;
  99                 info->ctmask = cb->val.mark | cb->val.mask;
 100                 break;
 101 +       case O_SAVEDSCP_MARK:
 102 +               info->mode   = XT_CONNMARK_SAVEDSCP;
 103 +               info->ctmark = cb->val.mark;
 104 +               info->ctmask = cb->val.mask;
 105 +               info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0;
 106 +               /* need 6 contiguous bits */
 107 +               if ((0x3f & (info->ctmark >> info->nfmask)) != 0x3f)
 108 +                       xtables_error(PARAMETER_PROBLEM,
 109 +                               "CONNMARK savedscp: insufficient contiguous dscpmask bits");
 110 +               if (info->ctmark & info->ctmask)
 111 +                       xtables_error(PARAMETER_PROBLEM,
 112 +                               "CONNMARK savedscp: dscpmask/statemask bits overlap");
 113 +               break;
 114         case O_AND_MARK:
 115                 info->mode   = XT_CONNMARK_SET;
 116                 info->ctmark = 0;
 117 @@ -283,6 +313,19 @@ static void connmark_tg_parse_v2(struct
 118                 info->ctmark = cb->val.mark;
 119                 info->ctmask = cb->val.mark | cb->val.mask;
 120                 break;
 121 +       case O_SAVEDSCP_MARK:
 122 +               info->mode   = XT_CONNMARK_SAVEDSCP;
 123 +               info->ctmark = cb->val.mark;
 124 +               info->ctmask = cb->val.mask;
 125 +               info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0;
 126 +               /* need 6 contiguous bits */
 127 +               if ((0x3f & (info->ctmark >> info->shift_bits)) != 0x3f)
 128 +                       xtables_error(PARAMETER_PROBLEM,
 129 +                               "CONNMARK savedscp: insufficient contiguous dscpmask bits");
 130 +               if (info->ctmark & info->ctmask)
 131 +                       xtables_error(PARAMETER_PROBLEM,
 132 +                               "CONNMARK savedscp: dscpmask/statemask bits overlap");
 133 +               break;
 134         case O_AND_MARK:
 135                 info->mode   = XT_CONNMARK_SET;
 136                 info->ctmark = 0;
 137 @@ -351,6 +394,11 @@ static void CONNMARK_print(const void *i
 138             print_mark(markinfo->mark);
 139             print_mask("/", markinfo->mask);
 140             break;
 141 +       case XT_CONNMARK_SAVEDSCP:
 142 +           printf(" CONNMARK savedscp ");
 143 +           print_mark(markinfo->mark);
 144 +           print_mask("/", markinfo->mask);
 145 +           break;
 146         case XT_CONNMARK_SAVE:
 147             printf(" CONNMARK save ");
 148             print_mask("mask ", markinfo->mask);
 149 @@ -386,6 +434,10 @@ connmark_tg_print(const void *ip, const
 150                         printf(" CONNMARK xset 0x%x/0x%x",
 151                                info->ctmark, info->ctmask);
 152                 break;
 153 +       case XT_CONNMARK_SAVEDSCP:
 154 +               printf(" CONNMARK DSCP set 0x%x/0x%x",
 155 +                      info->ctmark, info->ctmask);
 156 +               break;
 157         case XT_CONNMARK_SAVE:
 158                 if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
 159                         printf(" CONNMARK save");
 160 @@ -433,6 +485,10 @@ connmark_tg_print_v2(const void *ip, con
 161                         printf(" CONNMARK xset 0x%x/0x%x",
 162                                info->ctmark, info->ctmask);
 163                 break;
 164 +       case XT_CONNMARK_SAVEDSCP:
 165 +               printf(" CONNMARK DSCP xset 0x%x/0x%x",
 166 +                      info->ctmark, info->ctmask);
 167 +               break;
 168         case XT_CONNMARK_SAVE:
 169                 if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
 170                         printf(" CONNMARK save");
 171 @@ -474,6 +530,11 @@ static void CONNMARK_save(const void *ip
 172             print_mark(markinfo->mark);
 173             print_mask("/", markinfo->mask);
 174             break;
 175 +       case XT_CONNMARK_SAVEDSCP:
 176 +           printf(" --savedscp-mark ");
 177 +           print_mark(markinfo->mark);
 178 +           print_mask("/", markinfo->mask);
 179 +           break;
 180         case XT_CONNMARK_SAVE:
 181             printf(" --save-mark ");
 182             print_mask("--mask ", markinfo->mask);
 183 @@ -505,6 +566,9 @@ connmark_tg_save(const void *ip, const s
 184         case XT_CONNMARK_SET:
 185                 printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
 186                 break;
 187 +       case XT_CONNMARK_SAVEDSCP:
 188 +               printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
 189 +               break;
 190         case XT_CONNMARK_SAVE:
 191                 printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
 192                        info->nfmask, info->ctmask);
 193 @@ -529,6 +593,9 @@ connmark_tg_save_v2(const void *ip, cons
 194         case XT_CONNMARK_SET:
 195                 printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
 196                 break;
 197 +       case XT_CONNMARK_SAVEDSCP:
 198 +               printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
 199 +               break;
 200         case XT_CONNMARK_SAVE:
 201                 printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
 202                        info->nfmask, info->ctmask);
 203 --- a/include/linux/netfilter/xt_connmark.h
 204 +++ b/include/linux/netfilter/xt_connmark.h
 205 @@ -15,7 +15,8 @@
 206  enum {
 207         XT_CONNMARK_SET = 0,
 208         XT_CONNMARK_SAVE,
 209 -       XT_CONNMARK_RESTORE
 210 +       XT_CONNMARK_RESTORE,
 211 +       XT_CONNMARK_SAVEDSCP
 212  };
 213
 214  struct xt_connmark_tginfo1 {