iptables: add connmark savedscp support

iptables: connmark - add savedscp option

Naive user space front end to xt_connmark 'savedscp' option.

e.g.

iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --savedscp-mark 0xfc000000/0x01000000

Will save DSCP into the top 6 bits and OR 0x01 (ie set) the least
significant bit of most significant byte.

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

diff --git a/package/network/utils/iptables/Makefile b/package/network/utils/iptables/Makefile
index dd761f3443197d51e079544a76b8c85614cf463e..7e8e6f7eaad8cb61c8e6b0eb39b8d9a089bb2b7f 100644 (file)
--- a/package/network/utils/iptables/Makefile
+++ b/package/network/utils/iptables/Makefile
@@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=iptables
 PKG_VERSION:=1.8.3
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE_URL:=https://netfilter.org/projects/iptables/files
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2

diff --git a/package/network/utils/iptables/patches/010-add-savedscp-support.patch b/package/network/utils/iptables/patches/010-add-savedscp-support.patch
new file mode 100644 (file)
index 0000000..cc1efce
--- /dev/null
+++ b/package/network/utils/iptables/patches/010-add-savedscp-support.patch
@@ -0,0 +1,206 @@
+From 69b427fb5e1211c1110ce63be62b70504d04b0ff Mon Sep 17 00:00:00 2001
+From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Date: Sat, 23 Mar 2019 10:21:03 +0000
+Subject: [PATCH] savedscp
+
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ extensions/libxt_CONNMARK.c           | 68 ++++++++++++++++++++++++++-
+ include/linux/netfilter/xt_connmark.h |  3 +-
+ 2 files changed, 69 insertions(+), 2 deletions(-)
+
+--- a/extensions/libxt_CONNMARK.c
++++ b/extensions/libxt_CONNMARK.c
+@@ -49,6 +49,7 @@ enum {
+       O_CTMASK,
+       O_NFMASK,
+       O_MASK,
++      O_SAVEDSCP_MARK,
+       F_SET_MARK         = 1 << O_SET_MARK,
+       F_SAVE_MARK        = 1 << O_SAVE_MARK,
+       F_RESTORE_MARK     = 1 << O_RESTORE_MARK,
+@@ -61,8 +62,10 @@ enum {
+       F_CTMASK           = 1 << O_CTMASK,
+       F_NFMASK           = 1 << O_NFMASK,
+       F_MASK             = 1 << O_MASK,
++      F_SAVEDSCP_MARK    = 1 << O_SAVEDSCP_MARK,
+       F_OP_ANY           = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
+-                           F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
++                           F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK |
++                           F_SAVEDSCP_MARK,
+ };
+ 
+ static const char *const xt_connmark_shift_ops[] = {
+@@ -75,6 +78,7 @@ static void CONNMARK_help(void)
+       printf(
+ "CONNMARK target options:\n"
+ "  --set-mark value[/mask]       Set conntrack mark value\n"
++"  --savedscp-mark dscpmask/statemask    Save DSCP to conntrack mark value\n"
+ "  --save-mark [--mask mask]     Save the packet nfmark in the connection\n"
+ "  --restore-mark [--mask mask]  Restore saved nfmark value\n");
+ }
+@@ -83,6 +87,8 @@ static void CONNMARK_help(void)
+ static const struct xt_option_entry CONNMARK_opts[] = {
+       {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
+        .excl = F_OP_ANY},
++      {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
++       .excl = F_OP_ANY},
+       {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE,
+        .excl = F_OP_ANY},
+       {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE,
+@@ -98,6 +104,8 @@ static const struct xt_option_entry conn
+        .excl = F_OP_ANY},
+       {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
+        .excl = F_OP_ANY},
++      {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
++       .excl = F_OP_ANY},
+       {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
+        .excl = F_OP_ANY},
+       {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
+@@ -124,6 +132,8 @@ static const struct xt_option_entry conn
+        .excl = F_OP_ANY},
+       {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
+        .excl = F_OP_ANY},
++      {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
++       .excl = F_OP_ANY},
+       {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
+        .excl = F_OP_ANY},
+       {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
+@@ -158,6 +168,7 @@ static void connmark_tg_help(void)
+ "  --restore-mark [--ctmask mask] [--nfmask mask]\n"
+ "                                Copy nfmark to ctmark using masks\n"
+ "  --set-mark value[/mask]       Set conntrack mark value\n"
++"  --savedscp-mark value/mask    Save DSCP to conntrack mark value\n"
+ "  --save-mark [--mask mask]     Save the packet nfmark in the connection\n"
+ "  --restore-mark [--mask mask]  Restore saved nfmark value\n"
+ "  --and-mark value              Binary AND the ctmark with bits\n"
+@@ -210,6 +221,11 @@ static void CONNMARK_parse(struct xt_opt
+               markinfo->mark = cb->val.mark;
+               markinfo->mask = cb->val.mask;
+               break;
++      case O_SAVEDSCP_MARK:
++              markinfo->mode = XT_CONNMARK_SAVEDSCP;
++              markinfo->mark = cb->val.mark;
++              markinfo->mask = cb->val.mask;
++              break;
+       case O_SAVE_MARK:
+               markinfo->mode = XT_CONNMARK_SAVE;
+               break;
+@@ -238,6 +254,19 @@ static void connmark_tg_parse(struct xt_
+               info->ctmark = cb->val.mark;
+               info->ctmask = cb->val.mark | cb->val.mask;
+               break;
++      case O_SAVEDSCP_MARK:
++              info->mode   = XT_CONNMARK_SAVEDSCP;
++              info->ctmark = cb->val.mark;
++              info->ctmask = cb->val.mask;
++              info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0;
++              /* need 6 contiguous bits */
++              if ((0x3f & (info->ctmark >> info->nfmask)) != 0x3f)
++                      xtables_error(PARAMETER_PROBLEM,
++                              "CONNMARK savedscp: insufficient contiguous dscpmask bits");
++              if (info->ctmark & info->ctmask)
++                      xtables_error(PARAMETER_PROBLEM,
++                              "CONNMARK savedscp: dscpmask/statemask bits overlap");
++              break;
+       case O_AND_MARK:
+               info->mode   = XT_CONNMARK_SET;
+               info->ctmark = 0;
+@@ -283,6 +312,19 @@ static void connmark_tg_parse_v2(struct
+               info->ctmark = cb->val.mark;
+               info->ctmask = cb->val.mark | cb->val.mask;
+               break;
++      case O_SAVEDSCP_MARK:
++              info->mode   = XT_CONNMARK_SAVEDSCP;
++              info->ctmark = cb->val.mark;
++              info->ctmask = cb->val.mask;
++              info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0;
++              /* need 6 contiguous bits */
++              if ((0x3f & (info->ctmark >> info->shift_bits)) != 0x3f)
++                      xtables_error(PARAMETER_PROBLEM,
++                              "CONNMARK savedscp: insufficient contiguous dscpmask bits");
++              if (info->ctmark & info->ctmask)
++                      xtables_error(PARAMETER_PROBLEM,
++                              "CONNMARK savedscp: dscpmask/statemask bits overlap");
++              break;
+       case O_AND_MARK:
+               info->mode   = XT_CONNMARK_SET;
+               info->ctmark = 0;
+@@ -351,6 +393,11 @@ static void CONNMARK_print(const void *i
+           print_mark(markinfo->mark);
+           print_mask("/", markinfo->mask);
+           break;
++      case XT_CONNMARK_SAVEDSCP:
++          printf(" CONNMARK savedscp ");
++          print_mark(markinfo->mark);
++          print_mask("/", markinfo->mask);
++          break;
+       case XT_CONNMARK_SAVE:
+           printf(" CONNMARK save ");
+           print_mask("mask ", markinfo->mask);
+@@ -386,6 +433,10 @@ connmark_tg_print(const void *ip, const
+                       printf(" CONNMARK xset 0x%x/0x%x",
+                              info->ctmark, info->ctmask);
+               break;
++      case XT_CONNMARK_SAVEDSCP:
++              printf(" CONNMARK DSCP set 0x%x/0x%x",
++                     info->ctmark, info->ctmask);
++              break;
+       case XT_CONNMARK_SAVE:
+               if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
+                       printf(" CONNMARK save");
+@@ -433,6 +484,10 @@ connmark_tg_print_v2(const void *ip, con
+                       printf(" CONNMARK xset 0x%x/0x%x",
+                              info->ctmark, info->ctmask);
+               break;
++      case XT_CONNMARK_SAVEDSCP:
++              printf(" CONNMARK DSCP xset 0x%x/0x%x",
++                     info->ctmark, info->ctmask);
++              break;
+       case XT_CONNMARK_SAVE:
+               if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
+                       printf(" CONNMARK save");
+@@ -474,6 +529,11 @@ static void CONNMARK_save(const void *ip
+           print_mark(markinfo->mark);
+           print_mask("/", markinfo->mask);
+           break;
++      case XT_CONNMARK_SAVEDSCP:
++          printf(" --savedscp-mark ");
++          print_mark(markinfo->mark);
++          print_mask("/", markinfo->mask);
++          break;
+       case XT_CONNMARK_SAVE:
+           printf(" --save-mark ");
+           print_mask("--mask ", markinfo->mask);
+@@ -505,6 +565,9 @@ connmark_tg_save(const void *ip, const s
+       case XT_CONNMARK_SET:
+               printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
+               break;
++      case XT_CONNMARK_SAVEDSCP:
++              printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
++              break;
+       case XT_CONNMARK_SAVE:
+               printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
+                      info->nfmask, info->ctmask);
+@@ -529,6 +592,9 @@ connmark_tg_save_v2(const void *ip, cons
+       case XT_CONNMARK_SET:
+               printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
+               break;
++      case XT_CONNMARK_SAVEDSCP:
++              printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
++              break;
+       case XT_CONNMARK_SAVE:
+               printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
+                      info->nfmask, info->ctmask);
+--- a/include/linux/netfilter/xt_connmark.h
++++ b/include/linux/netfilter/xt_connmark.h
+@@ -15,7 +15,8 @@
+ enum {
+       XT_CONNMARK_SET = 0,
+       XT_CONNMARK_SAVE,
+-      XT_CONNMARK_RESTORE
++      XT_CONNMARK_RESTORE,
++      XT_CONNMARK_SAVEDSCP
+ };
+ 
+ struct xt_connmark_tginfo1 {