kernel: connmark set-dscpmark follow upstreamimg attempt

I'm having another attempt at trying to getting the 'store dscp into
conntrack connmark' functionality into upstream kernel, since the
restore function (act_ctinfo) has been accepted.

The syntax has changed from 'savedscp' to 'set-dscpmark' since that
conforms more closely with existing functionality.

4.14 backport is more of a hack since the structure versioning
mechanism isn't in place.

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

1 files changed, 0 insertions, 135 deletions

diff --git a/target/linux/generic/hack-4.19/645-netfilter-connmark-introduce-savedscp.patch b/target/linux/generic/hack-4.19/645-netfilter-connmark-introduce-savedscp.patch
deleted file mode 100644
index 0c4ef92c00..0000000000
--- a/target/linux/generic/hack-4.19/645-netfilter-connmark-introduce-savedscp.patch
+++ /dev/null
@@ -1,135 +0,0 @@
-From f171924dcf1d0b31fb7bd1cff113d7a1f7f05ec2 Mon Sep 17 00:00:00 2001
-From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
-Date: Sat, 23 Mar 2019 09:29:49 +0000
-Subject: [PATCH] netfilter: connmark: introduce savedscp
-
-savedscp is a method of storing the DSCP of an ip packet into conntrack
-mark.  In combination with a suitable tc filter action (act_ctinfo) DSCP
-values are able to be stored in the mark on egress and restored on
-ingress across links that otherwise alter or bleach DSCP.
-
-This is useful for qdiscs such as CAKE which are able to shape according
-to policies based on DSCP.
-
-Ingress classification is traditionally a challenging task since
-iptables rules haven't yet run and tc filter/eBPF programs are pre-NAT
-lookups, hence are unable to see internal IPv4 addresses as used on the
-typical home masquerading gateway.
-
-x_tables CONNMARK savedscp action solves the problem of storing the DSCP
-to the conntrack mark in a way suitable for the new act_ctinfo tc action
-to restore.
-
-The savedsp option accepts 2 parameters, a 32bit 'dscpmask' and a 32bit
-'statemask'.  The dscp mask must be a minimum of 6 contiguous bits and
-represents the area where the DSCP will be stored in the connmark.  The
-state mask is a minimum 1 bit length mask that must not overlap with the
-dscpmask.  It represents a flag which is set when the DSCP has been
-stored in the conntrack mark. This is useful to implement a 'one shot'
-iptables based classification where the 'complicated' iptables rules are
-only run once to classify the connection on initial (egress) packet and
-subsequent packets are all marked/restored with the same DSCP.  A state
-mask of zero disables the setting of a status bit/s.
-
-example syntax with a suitably modified iptables user space application:
-
-iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --savedscp-mark 0xfc000000/0x01000000
-
-Would store the DSCP in the top 6 bits of the 32bit mark field, and use
-the LSB of the top byte as the 'DSCP has been stored' marker.
-
-|----0xFC----conntrack mark----000000---|
-| Bits 31-26 | bit 25 | bit24 |~~~ Bit 0|
-| DSCP       | unused | flag  |unused   |
-|-----------------------0x01---000000---|
-      ^                   ^
-      |                   |
-      ---|             Conditional flag
-         |             set this when dscp
-|-ip diffserv-|        stored in mark
-| 6 bits      |
-|-------------|
-
-an identically configured tc action to restore looks like:
-
-tc filter show dev eth0 ingress
-filter parent ffff: protocol all pref 10 u32 chain 0
-filter parent ffff: protocol all pref 10 u32 chain 0 fh 800: ht divisor 1
-filter parent ffff: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:1 not_in_hw
-  match 00000000/00000000 at 0
-	action order 1: ctinfo zone 0 pipe
-	 index 2 ref 1 bind 1 dscp 0xfc000000/0x1000000
-
-	action order 2: mirred (Egress Redirect to device ifb4eth0) stolen
-	index 1 ref 1 bind 1
-
-|----0xFC----conntrack mark----000000---|
-| Bits 31-26 | bit 25 | bit24 |~~~ Bit 0|
-| DSCP       | unused | flag  |unused   |
-|-----------------------0x01---000000---|
-      |                   |
-      |                   |
-      ---|             Conditional flag
-         v             only restore if set
-|-ip diffserv-|
-| 6 bits      |
-|-------------|
-
-Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
----
- include/uapi/linux/netfilter/xt_connmark.h |  3 ++-
- net/netfilter/xt_connmark.c                | 17 +++++++++++++++++
- 2 files changed, 19 insertions(+), 1 deletion(-)
-
---- a/include/uapi/linux/netfilter/xt_connmark.h
-+++ b/include/uapi/linux/netfilter/xt_connmark.h
-@@ -16,7 +16,8 @@
- enum {
- 	XT_CONNMARK_SET = 0,
- 	XT_CONNMARK_SAVE,
--	XT_CONNMARK_RESTORE
-+	XT_CONNMARK_RESTORE,
-+	XT_CONNMARK_SAVEDSCP
- };
- 
- enum {
---- a/net/netfilter/xt_connmark.c
-+++ b/net/netfilter/xt_connmark.c
-@@ -42,6 +42,7 @@ connmark_tg_shift(struct sk_buff *skb, c
- 	u_int32_t new_targetmark;
- 	struct nf_conn *ct;
- 	u_int32_t newmark;
-+	u_int8_t dscp;
- 
- 	ct = nf_ct_get(skb, &ctinfo);
- 	if (ct == NULL)
-@@ -74,6 +75,21 @@ connmark_tg_shift(struct sk_buff *skb, c
- 			nf_conntrack_event_cache(IPCT_MARK, ct);
- 		}
- 		break;
-+	case XT_CONNMARK_SAVEDSCP:
-+		if (skb->protocol == htons(ETH_P_IP))
-+			dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2;
-+		else if (skb->protocol == htons(ETH_P_IPV6))
-+			dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2;
-+		else	/* protocol doesn't have diffserv */
-+			break;
-+
-+		newmark = (ct->mark & ~info->ctmark) |
-+			  (info->ctmask | (dscp << info->shift_bits));
-+		if (ct->mark != newmark) {
-+			ct->mark = newmark;
-+			nf_conntrack_event_cache(IPCT_MARK, ct);
-+		}
-+		break;
- 	case XT_CONNMARK_RESTORE:
- 		new_targetmark = (ct->mark & info->ctmask);
- 		if (info->shift_dir == D_SHIFT_RIGHT)
-@@ -86,6 +102,7 @@ connmark_tg_shift(struct sk_buff *skb, c
- 		skb->mark = newmark;
- 		break;
- 	}
-+out:
- 	return XT_CONTINUE;
- }
-