diff options
| -rw-r--r-- | target/linux/generic/hack-4.14/645-netfilter-connmark-introduce-savedscp.patch | 107 | ||||
| -rw-r--r-- | target/linux/generic/hack-4.19/645-netfilter-connmark-introduce-savedscp.patch | 135 |
2 files changed, 242 insertions, 0 deletions
diff --git a/target/linux/generic/hack-4.14/645-netfilter-connmark-introduce-savedscp.patch b/target/linux/generic/hack-4.14/645-netfilter-connmark-introduce-savedscp.patch new file mode 100644 index 0000000000..1681ed5db8 --- /dev/null +++ b/target/linux/generic/hack-4.14/645-netfilter-connmark-introduce-savedscp.patch @@ -0,0 +1,107 @@ +From 5a4d7714faa28c03e85d696fba82716fbda5c432 Mon Sep 17 00:00:00 2001 +From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> +Date: Sat, 23 Mar 2019 09:29:49 +0000 +Subject: [PATCH] netfilter: connmark: introduce savedscp + +savedscp is a method of storing the DSCP of an ip packet into conntrack +mark. In combination with a suitable tc filter action (conndscp but may +end up being integrated into connmark) DSCP values are able to be stored +on egress and restored on ingress across links that otherwise alter or +bleach DSCP. + +This is useful for qdiscs such as CAKE which are able to shape according +to policies based on DSCP. + +Ingress classification is traditionally a challenging task since +iptables rules haven't yet run and tc filter/eBPF programs are pre-NAT +lookups, hence are unable to see internal IPv4 addresses as used on the +typical home masquerading gateway. + +The ingress problem is solved by the tc filter, but the tc people didn't +like the idea of tc setting conntrack mark values, though they are ok +with reading conntrack values and hence restoring DSCP from conntrack +marks. + +x_tables CONNMARK with the new savedscp action solves the problem of +storing the DSCP to the conntrack mark. + +It accepts 2 parameters. The mark is a 32bit value with usually one 1 +bit set. This bit is set when savedscp saves the DSCP to the mark. +This is useful to implement a 'one shot' +iptables based classification where the 'complicated' iptables rules are +only run once to classify the connection on initial (egress) packet and +subsequent packets are all marked/restored with the same DSCP. A mark +of zero disables the setting of a status bit/s. + +The mask is a 32bit value of at least 6 contiguous bits and represents +the area where the DSCP will be stored. + +e.g. + +iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --savedscp-mark 0xfc000000/0x01000000 + +Would store the DSCP in the top 6 bits of the 32bit mark field, and use +the LSB of the top byte as the 'DSCP has been stored' marker. + +Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> +--- + include/uapi/linux/netfilter/xt_connmark.h | 3 ++- + net/netfilter/xt_connmark.c | 21 ++++++++++++++++++++- + 2 files changed, 22 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/netfilter/xt_connmark.h b/include/uapi/linux/netfilter/xt_connmark.h +index 408a9654f05c..e63ad3c89b92 100644 +--- a/include/uapi/linux/netfilter/xt_connmark.h ++++ b/include/uapi/linux/netfilter/xt_connmark.h +@@ -16,7 +16,8 @@ + enum { + XT_CONNMARK_SET = 0, + XT_CONNMARK_SAVE, +- XT_CONNMARK_RESTORE ++ XT_CONNMARK_RESTORE, ++ XT_CONNMARK_SAVEDSCP + }; + + struct xt_connmark_tginfo1 { +diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c +index ec377cc6a369..aa5bcea8f9ba 100644 +--- a/net/netfilter/xt_connmark.c ++++ b/net/netfilter/xt_connmark.c +@@ -42,6 +42,7 @@ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par) + enum ip_conntrack_info ctinfo; + struct nf_conn *ct; + u_int32_t newmark; ++ u_int8_t dscp, maskshift; + + ct = nf_ct_get(skb, &ctinfo); + if (ct == NULL) +@@ -57,7 +58,25 @@ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par) + break; + case XT_CONNMARK_SAVE: + newmark = (ct->mark & ~info->ctmask) ^ +- (skb->mark & info->nfmask); ++ (skb->mark & info->nfmask); ++ if (ct->mark != newmark) { ++ ct->mark = newmark; ++ nf_conntrack_event_cache(IPCT_MARK, ct); ++ } ++ break; ++ case XT_CONNMARK_SAVEDSCP: ++ if (skb->protocol == htons(ETH_P_IP)) ++ dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2; ++ else if (skb->protocol == htons(ETH_P_IPV6)) ++ dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2; ++ else /* protocol doesn't have diffserv */ ++ break; ++ ++ /* nfmask contains the mask shift value */ ++ maskshift = info->nfmask & 0x1f; ++ newmark = (ct->mark & ~info->ctmark) | ++ (info->ctmask | (dscp << maskshift)); ++ + if (ct->mark != newmark) { + ct->mark = newmark; + nf_conntrack_event_cache(IPCT_MARK, ct); +-- +2.20.1 (Apple Git-117) + diff --git a/target/linux/generic/hack-4.19/645-netfilter-connmark-introduce-savedscp.patch b/target/linux/generic/hack-4.19/645-netfilter-connmark-introduce-savedscp.patch new file mode 100644 index 0000000000..0c4ef92c00 --- /dev/null +++ b/target/linux/generic/hack-4.19/645-netfilter-connmark-introduce-savedscp.patch @@ -0,0 +1,135 @@ +From f171924dcf1d0b31fb7bd1cff113d7a1f7f05ec2 Mon Sep 17 00:00:00 2001 +From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> +Date: Sat, 23 Mar 2019 09:29:49 +0000 +Subject: [PATCH] netfilter: connmark: introduce savedscp + +savedscp is a method of storing the DSCP of an ip packet into conntrack +mark. In combination with a suitable tc filter action (act_ctinfo) DSCP +values are able to be stored in the mark on egress and restored on +ingress across links that otherwise alter or bleach DSCP. + +This is useful for qdiscs such as CAKE which are able to shape according +to policies based on DSCP. + +Ingress classification is traditionally a challenging task since +iptables rules haven't yet run and tc filter/eBPF programs are pre-NAT +lookups, hence are unable to see internal IPv4 addresses as used on the +typical home masquerading gateway. + +x_tables CONNMARK savedscp action solves the problem of storing the DSCP +to the conntrack mark in a way suitable for the new act_ctinfo tc action +to restore. + +The savedsp option accepts 2 parameters, a 32bit 'dscpmask' and a 32bit +'statemask'. The dscp mask must be a minimum of 6 contiguous bits and +represents the area where the DSCP will be stored in the connmark. The +state mask is a minimum 1 bit length mask that must not overlap with the +dscpmask. It represents a flag which is set when the DSCP has been +stored in the conntrack mark. This is useful to implement a 'one shot' +iptables based classification where the 'complicated' iptables rules are +only run once to classify the connection on initial (egress) packet and +subsequent packets are all marked/restored with the same DSCP. A state +mask of zero disables the setting of a status bit/s. + +example syntax with a suitably modified iptables user space application: + +iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --savedscp-mark 0xfc000000/0x01000000 + +Would store the DSCP in the top 6 bits of the 32bit mark field, and use +the LSB of the top byte as the 'DSCP has been stored' marker. + +|----0xFC----conntrack mark----000000---| +| Bits 31-26 | bit 25 | bit24 |~~~ Bit 0| +| DSCP | unused | flag |unused | +|-----------------------0x01---000000---| + ^ ^ + | | + ---| Conditional flag + | set this when dscp +|-ip diffserv-| stored in mark +| 6 bits | +|-------------| + +an identically configured tc action to restore looks like: + +tc filter show dev eth0 ingress +filter parent ffff: protocol all pref 10 u32 chain 0 +filter parent ffff: protocol all pref 10 u32 chain 0 fh 800: ht divisor 1 +filter parent ffff: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:1 not_in_hw + match 00000000/00000000 at 0 + action order 1: ctinfo zone 0 pipe + index 2 ref 1 bind 1 dscp 0xfc000000/0x1000000 + + action order 2: mirred (Egress Redirect to device ifb4eth0) stolen + index 1 ref 1 bind 1 + +|----0xFC----conntrack mark----000000---| +| Bits 31-26 | bit 25 | bit24 |~~~ Bit 0| +| DSCP | unused | flag |unused | +|-----------------------0x01---000000---| + | | + | | + ---| Conditional flag + v only restore if set +|-ip diffserv-| +| 6 bits | +|-------------| + +Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> +--- + include/uapi/linux/netfilter/xt_connmark.h | 3 ++- + net/netfilter/xt_connmark.c | 17 +++++++++++++++++ + 2 files changed, 19 insertions(+), 1 deletion(-) + +--- a/include/uapi/linux/netfilter/xt_connmark.h ++++ b/include/uapi/linux/netfilter/xt_connmark.h +@@ -16,7 +16,8 @@ + enum { + XT_CONNMARK_SET = 0, + XT_CONNMARK_SAVE, +- XT_CONNMARK_RESTORE ++ XT_CONNMARK_RESTORE, ++ XT_CONNMARK_SAVEDSCP + }; + + enum { +--- a/net/netfilter/xt_connmark.c ++++ b/net/netfilter/xt_connmark.c +@@ -42,6 +42,7 @@ connmark_tg_shift(struct sk_buff *skb, c + u_int32_t new_targetmark; + struct nf_conn *ct; + u_int32_t newmark; ++ u_int8_t dscp; + + ct = nf_ct_get(skb, &ctinfo); + if (ct == NULL) +@@ -74,6 +75,21 @@ connmark_tg_shift(struct sk_buff *skb, c + nf_conntrack_event_cache(IPCT_MARK, ct); + } + break; ++ case XT_CONNMARK_SAVEDSCP: ++ if (skb->protocol == htons(ETH_P_IP)) ++ dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2; ++ else if (skb->protocol == htons(ETH_P_IPV6)) ++ dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2; ++ else /* protocol doesn't have diffserv */ ++ break; ++ ++ newmark = (ct->mark & ~info->ctmark) | ++ (info->ctmask | (dscp << info->shift_bits)); ++ if (ct->mark != newmark) { ++ ct->mark = newmark; ++ nf_conntrack_event_cache(IPCT_MARK, ct); ++ } ++ break; + case XT_CONNMARK_RESTORE: + new_targetmark = (ct->mark & info->ctmask); + if (info->shift_dir == D_SHIFT_RIGHT) +@@ -86,6 +102,7 @@ connmark_tg_shift(struct sk_buff *skb, c + skb->mark = newmark; + break; + } ++out: + return XT_CONTINUE; + } + |