1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
|
From 69b427fb5e1211c1110ce63be62b70504d04b0ff Mon Sep 17 00:00:00 2001
From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Date: Sat, 23 Mar 2019 10:21:03 +0000
Subject: [PATCH] savedscp
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
---
extensions/libxt_CONNMARK.c | 68 ++++++++++++++++++++++++++-
include/linux/netfilter/xt_connmark.h | 3 +-
2 files changed, 69 insertions(+), 2 deletions(-)
--- a/extensions/libxt_CONNMARK.c
+++ b/extensions/libxt_CONNMARK.c
@@ -22,6 +22,7 @@
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
+#include <strings.h>
#include <xtables.h>
#include <linux/netfilter/xt_CONNMARK.h>
@@ -49,6 +50,7 @@ enum {
O_CTMASK,
O_NFMASK,
O_MASK,
+ O_SAVEDSCP_MARK,
F_SET_MARK = 1 << O_SET_MARK,
F_SAVE_MARK = 1 << O_SAVE_MARK,
F_RESTORE_MARK = 1 << O_RESTORE_MARK,
@@ -61,8 +63,10 @@ enum {
F_CTMASK = 1 << O_CTMASK,
F_NFMASK = 1 << O_NFMASK,
F_MASK = 1 << O_MASK,
+ F_SAVEDSCP_MARK = 1 << O_SAVEDSCP_MARK,
F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
- F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
+ F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK |
+ F_SAVEDSCP_MARK,
};
static const char *const xt_connmark_shift_ops[] = {
@@ -75,6 +79,7 @@ static void CONNMARK_help(void)
printf(
"CONNMARK target options:\n"
" --set-mark value[/mask] Set conntrack mark value\n"
+" --savedscp-mark dscpmask/statemask Save DSCP to conntrack mark value\n"
" --save-mark [--mask mask] Save the packet nfmark in the connection\n"
" --restore-mark [--mask mask] Restore saved nfmark value\n");
}
@@ -83,6 +88,8 @@ static void CONNMARK_help(void)
static const struct xt_option_entry CONNMARK_opts[] = {
{.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
.excl = F_OP_ANY},
+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
+ .excl = F_OP_ANY},
{.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE,
.excl = F_OP_ANY},
{.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE,
@@ -98,6 +105,8 @@ static const struct xt_option_entry conn
.excl = F_OP_ANY},
{.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
.excl = F_OP_ANY},
+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
+ .excl = F_OP_ANY},
{.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
.excl = F_OP_ANY},
{.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
@@ -124,6 +133,8 @@ static const struct xt_option_entry conn
.excl = F_OP_ANY},
{.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
.excl = F_OP_ANY},
+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
+ .excl = F_OP_ANY},
{.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
.excl = F_OP_ANY},
{.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
@@ -158,6 +169,7 @@ static void connmark_tg_help(void)
" --restore-mark [--ctmask mask] [--nfmask mask]\n"
" Copy nfmark to ctmark using masks\n"
" --set-mark value[/mask] Set conntrack mark value\n"
+" --savedscp-mark value/mask Save DSCP to conntrack mark value\n"
" --save-mark [--mask mask] Save the packet nfmark in the connection\n"
" --restore-mark [--mask mask] Restore saved nfmark value\n"
" --and-mark value Binary AND the ctmark with bits\n"
@@ -210,6 +222,11 @@ static void CONNMARK_parse(struct xt_opt
markinfo->mark = cb->val.mark;
markinfo->mask = cb->val.mask;
break;
+ case O_SAVEDSCP_MARK:
+ markinfo->mode = XT_CONNMARK_SAVEDSCP;
+ markinfo->mark = cb->val.mark;
+ markinfo->mask = cb->val.mask;
+ break;
case O_SAVE_MARK:
markinfo->mode = XT_CONNMARK_SAVE;
break;
@@ -238,6 +255,19 @@ static void connmark_tg_parse(struct xt_
info->ctmark = cb->val.mark;
info->ctmask = cb->val.mark | cb->val.mask;
break;
+ case O_SAVEDSCP_MARK:
+ info->mode = XT_CONNMARK_SAVEDSCP;
+ info->ctmark = cb->val.mark;
+ info->ctmask = cb->val.mask;
+ info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0;
+ /* need 6 contiguous bits */
+ if ((0x3f & (info->ctmark >> info->nfmask)) != 0x3f)
+ xtables_error(PARAMETER_PROBLEM,
+ "CONNMARK savedscp: insufficient contiguous dscpmask bits");
+ if (info->ctmark & info->ctmask)
+ xtables_error(PARAMETER_PROBLEM,
+ "CONNMARK savedscp: dscpmask/statemask bits overlap");
+ break;
case O_AND_MARK:
info->mode = XT_CONNMARK_SET;
info->ctmark = 0;
@@ -283,6 +313,19 @@ static void connmark_tg_parse_v2(struct
info->ctmark = cb->val.mark;
info->ctmask = cb->val.mark | cb->val.mask;
break;
+ case O_SAVEDSCP_MARK:
+ info->mode = XT_CONNMARK_SAVEDSCP;
+ info->ctmark = cb->val.mark;
+ info->ctmask = cb->val.mask;
+ info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0;
+ /* need 6 contiguous bits */
+ if ((0x3f & (info->ctmark >> info->shift_bits)) != 0x3f)
+ xtables_error(PARAMETER_PROBLEM,
+ "CONNMARK savedscp: insufficient contiguous dscpmask bits");
+ if (info->ctmark & info->ctmask)
+ xtables_error(PARAMETER_PROBLEM,
+ "CONNMARK savedscp: dscpmask/statemask bits overlap");
+ break;
case O_AND_MARK:
info->mode = XT_CONNMARK_SET;
info->ctmark = 0;
@@ -351,6 +394,11 @@ static void CONNMARK_print(const void *i
print_mark(markinfo->mark);
print_mask("/", markinfo->mask);
break;
+ case XT_CONNMARK_SAVEDSCP:
+ printf(" CONNMARK savedscp ");
+ print_mark(markinfo->mark);
+ print_mask("/", markinfo->mask);
+ break;
case XT_CONNMARK_SAVE:
printf(" CONNMARK save ");
print_mask("mask ", markinfo->mask);
@@ -386,6 +434,10 @@ connmark_tg_print(const void *ip, const
printf(" CONNMARK xset 0x%x/0x%x",
info->ctmark, info->ctmask);
break;
+ case XT_CONNMARK_SAVEDSCP:
+ printf(" CONNMARK DSCP set 0x%x/0x%x",
+ info->ctmark, info->ctmask);
+ break;
case XT_CONNMARK_SAVE:
if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
printf(" CONNMARK save");
@@ -433,6 +485,10 @@ connmark_tg_print_v2(const void *ip, con
printf(" CONNMARK xset 0x%x/0x%x",
info->ctmark, info->ctmask);
break;
+ case XT_CONNMARK_SAVEDSCP:
+ printf(" CONNMARK DSCP xset 0x%x/0x%x",
+ info->ctmark, info->ctmask);
+ break;
case XT_CONNMARK_SAVE:
if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
printf(" CONNMARK save");
@@ -474,6 +530,11 @@ static void CONNMARK_save(const void *ip
print_mark(markinfo->mark);
print_mask("/", markinfo->mask);
break;
+ case XT_CONNMARK_SAVEDSCP:
+ printf(" --savedscp-mark ");
+ print_mark(markinfo->mark);
+ print_mask("/", markinfo->mask);
+ break;
case XT_CONNMARK_SAVE:
printf(" --save-mark ");
print_mask("--mask ", markinfo->mask);
@@ -505,6 +566,9 @@ connmark_tg_save(const void *ip, const s
case XT_CONNMARK_SET:
printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
break;
+ case XT_CONNMARK_SAVEDSCP:
+ printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
+ break;
case XT_CONNMARK_SAVE:
printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
info->nfmask, info->ctmask);
@@ -529,6 +593,9 @@ connmark_tg_save_v2(const void *ip, cons
case XT_CONNMARK_SET:
printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
break;
+ case XT_CONNMARK_SAVEDSCP:
+ printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
+ break;
case XT_CONNMARK_SAVE:
printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
info->nfmask, info->ctmask);
--- a/include/linux/netfilter/xt_connmark.h
+++ b/include/linux/netfilter/xt_connmark.h
@@ -15,7 +15,8 @@
enum {
XT_CONNMARK_SET = 0,
XT_CONNMARK_SAVE,
- XT_CONNMARK_RESTORE
+ XT_CONNMARK_RESTORE,
+ XT_CONNMARK_SAVEDSCP
};
struct xt_connmark_tginfo1 {
|
