From a1cfe0dcbb242ab440af6801e223ebde540ed90f Mon Sep 17 00:00:00 2001 From: Kevin Darbyshire-Bryant Date: Tue, 3 Dec 2019 14:00:05 +0000 Subject: [PATCH] kernel: connmark set-dscpmark follow upstreamimg attempt I'm having another attempt at trying to getting the 'store dscp into conntrack connmark' functionality into upstream kernel, since the restore function (act_ctinfo) has been accepted. The syntax has changed from 'savedscp' to 'set-dscpmark' since that conforms more closely with existing functionality. 4.14 backport is more of a hack since the structure versioning mechanism isn't in place. Signed-off-by: Kevin Darbyshire-Bryant --- ...etfilter-connmark-introduce-savedscp.patch | 100 --------- ...ter-connmark-introduce-set-dscpmark.patch} | 112 +++++---- ...lter-connmark-introduce-set-dscpmark.patch | 212 ++++++++++++++++++ 3 files changed, 265 insertions(+), 159 deletions(-) delete mode 100644 target/linux/generic/hack-4.14/645-netfilter-connmark-introduce-savedscp.patch rename target/linux/generic/{hack-4.19/645-netfilter-connmark-introduce-savedscp.patch => hack-4.14/645-netfilter-connmark-introduce-set-dscpmark.patch} (54%) create mode 100644 target/linux/generic/hack-4.19/645-netfilter-connmark-introduce-set-dscpmark.patch diff --git a/target/linux/generic/hack-4.14/645-netfilter-connmark-introduce-savedscp.patch b/target/linux/generic/hack-4.14/645-netfilter-connmark-introduce-savedscp.patch deleted file mode 100644 index 5217eca582..0000000000 --- a/target/linux/generic/hack-4.14/645-netfilter-connmark-introduce-savedscp.patch +++ /dev/null @@ -1,100 +0,0 @@ -From 5a4d7714faa28c03e85d696fba82716fbda5c432 Mon Sep 17 00:00:00 2001 -From: Kevin Darbyshire-Bryant -Date: Sat, 23 Mar 2019 09:29:49 +0000 -Subject: [PATCH] netfilter: connmark: introduce savedscp - -savedscp is a method of storing the DSCP of an ip packet into conntrack -mark. In combination with a suitable tc filter action (conndscp but may -end up being integrated into connmark) DSCP values are able to be stored -on egress and restored on ingress across links that otherwise alter or -bleach DSCP. - -This is useful for qdiscs such as CAKE which are able to shape according -to policies based on DSCP. - -Ingress classification is traditionally a challenging task since -iptables rules haven't yet run and tc filter/eBPF programs are pre-NAT -lookups, hence are unable to see internal IPv4 addresses as used on the -typical home masquerading gateway. - -The ingress problem is solved by the tc filter, but the tc people didn't -like the idea of tc setting conntrack mark values, though they are ok -with reading conntrack values and hence restoring DSCP from conntrack -marks. - -x_tables CONNMARK with the new savedscp action solves the problem of -storing the DSCP to the conntrack mark. - -It accepts 2 parameters. The mark is a 32bit value with usually one 1 -bit set. This bit is set when savedscp saves the DSCP to the mark. -This is useful to implement a 'one shot' -iptables based classification where the 'complicated' iptables rules are -only run once to classify the connection on initial (egress) packet and -subsequent packets are all marked/restored with the same DSCP. A mark -of zero disables the setting of a status bit/s. - -The mask is a 32bit value of at least 6 contiguous bits and represents -the area where the DSCP will be stored. - -e.g. - -iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --savedscp-mark 0xfc000000/0x01000000 - -Would store the DSCP in the top 6 bits of the 32bit mark field, and use -the LSB of the top byte as the 'DSCP has been stored' marker. - -Signed-off-by: Kevin Darbyshire-Bryant ---- - include/uapi/linux/netfilter/xt_connmark.h | 3 ++- - net/netfilter/xt_connmark.c | 21 ++++++++++++++++++++- - 2 files changed, 22 insertions(+), 2 deletions(-) - ---- a/include/uapi/linux/netfilter/xt_connmark.h -+++ b/include/uapi/linux/netfilter/xt_connmark.h -@@ -16,7 +16,8 @@ - enum { - XT_CONNMARK_SET = 0, - XT_CONNMARK_SAVE, -- XT_CONNMARK_RESTORE -+ XT_CONNMARK_RESTORE, -+ XT_CONNMARK_SAVEDSCP - }; - - struct xt_connmark_tginfo1 { ---- a/net/netfilter/xt_connmark.c -+++ b/net/netfilter/xt_connmark.c -@@ -42,6 +42,7 @@ connmark_tg(struct sk_buff *skb, const s - enum ip_conntrack_info ctinfo; - struct nf_conn *ct; - u_int32_t newmark; -+ u_int8_t dscp, maskshift; - - ct = nf_ct_get(skb, &ctinfo); - if (ct == NULL) -@@ -57,7 +58,25 @@ connmark_tg(struct sk_buff *skb, const s - break; - case XT_CONNMARK_SAVE: - newmark = (ct->mark & ~info->ctmask) ^ -- (skb->mark & info->nfmask); -+ (skb->mark & info->nfmask); -+ if (ct->mark != newmark) { -+ ct->mark = newmark; -+ nf_conntrack_event_cache(IPCT_MARK, ct); -+ } -+ break; -+ case XT_CONNMARK_SAVEDSCP: -+ if (skb->protocol == htons(ETH_P_IP)) -+ dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2; -+ else if (skb->protocol == htons(ETH_P_IPV6)) -+ dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2; -+ else /* protocol doesn't have diffserv */ -+ break; -+ -+ /* nfmask contains the mask shift value */ -+ maskshift = info->nfmask & 0x1f; -+ newmark = (ct->mark & ~info->ctmark) | -+ (info->ctmask | (dscp << maskshift)); -+ - if (ct->mark != newmark) { - ct->mark = newmark; - nf_conntrack_event_cache(IPCT_MARK, ct); diff --git a/target/linux/generic/hack-4.19/645-netfilter-connmark-introduce-savedscp.patch b/target/linux/generic/hack-4.14/645-netfilter-connmark-introduce-set-dscpmark.patch similarity index 54% rename from target/linux/generic/hack-4.19/645-netfilter-connmark-introduce-savedscp.patch rename to target/linux/generic/hack-4.14/645-netfilter-connmark-introduce-set-dscpmark.patch index 0c4ef92c00..88c8c7f3ef 100644 --- a/target/linux/generic/hack-4.19/645-netfilter-connmark-introduce-savedscp.patch +++ b/target/linux/generic/hack-4.14/645-netfilter-connmark-introduce-set-dscpmark.patch @@ -1,12 +1,12 @@ -From f171924dcf1d0b31fb7bd1cff113d7a1f7f05ec2 Mon Sep 17 00:00:00 2001 +From f1627abea333781d3e2a61bac4c7fd4502395741 Mon Sep 17 00:00:00 2001 From: Kevin Darbyshire-Bryant Date: Sat, 23 Mar 2019 09:29:49 +0000 -Subject: [PATCH] netfilter: connmark: introduce savedscp +Subject: [PATCH] netfilter: connmark: introduce set-dscpmark -savedscp is a method of storing the DSCP of an ip packet into conntrack -mark. In combination with a suitable tc filter action (act_ctinfo) DSCP -values are able to be stored in the mark on egress and restored on -ingress across links that otherwise alter or bleach DSCP. +set-dscpmark is a method of storing the DSCP of an ip packet into +conntrack mark. In combination with a suitable tc filter action +(act_ctinfo) DSCP values are able to be stored in the mark on egress and +restored on ingress across links that otherwise alter or bleach DSCP. This is useful for qdiscs such as CAKE which are able to shape according to policies based on DSCP. @@ -16,12 +16,12 @@ iptables rules haven't yet run and tc filter/eBPF programs are pre-NAT lookups, hence are unable to see internal IPv4 addresses as used on the typical home masquerading gateway. -x_tables CONNMARK savedscp action solves the problem of storing the DSCP -to the conntrack mark in a way suitable for the new act_ctinfo tc action -to restore. +x_tables CONNMARK set-dscpmark target solves the problem of storing the +DSCP to the conntrack mark in a way suitable for the new act_ctinfo tc +action to restore. -The savedsp option accepts 2 parameters, a 32bit 'dscpmask' and a 32bit -'statemask'. The dscp mask must be a minimum of 6 contiguous bits and +The set-dscpmark option accepts 2 parameters, a 32bit 'dscpmask' and a +32bit 'statemask'. The dscp mask must be 6 contiguous bits and represents the area where the DSCP will be stored in the connmark. The state mask is a minimum 1 bit length mask that must not overlap with the dscpmask. It represents a flag which is set when the DSCP has been @@ -33,7 +33,7 @@ mask of zero disables the setting of a status bit/s. example syntax with a suitably modified iptables user space application: -iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --savedscp-mark 0xfc000000/0x01000000 +iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --set-dscpmark 0xfc000000/0x01000000 Would store the DSCP in the top 6 bits of the 32bit mark field, and use the LSB of the top byte as the 'DSCP has been stored' marker. @@ -55,7 +55,7 @@ an identically configured tc action to restore looks like: tc filter show dev eth0 ingress filter parent ffff: protocol all pref 10 u32 chain 0 filter parent ffff: protocol all pref 10 u32 chain 0 fh 800: ht divisor 1 -filter parent ffff: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:1 not_in_hw +filter parent ffff: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1: not_in_hw match 00000000/00000000 at 0 action order 1: ctinfo zone 0 pipe index 2 ref 1 bind 1 dscp 0xfc000000/0x1000000 @@ -77,59 +77,53 @@ filter parent ffff: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key Signed-off-by: Kevin Darbyshire-Bryant --- - include/uapi/linux/netfilter/xt_connmark.h | 3 ++- - net/netfilter/xt_connmark.c | 17 +++++++++++++++++ - 2 files changed, 19 insertions(+), 1 deletion(-) - ---- a/include/uapi/linux/netfilter/xt_connmark.h -+++ b/include/uapi/linux/netfilter/xt_connmark.h -@@ -16,7 +16,8 @@ - enum { - XT_CONNMARK_SET = 0, - XT_CONNMARK_SAVE, -- XT_CONNMARK_RESTORE -+ XT_CONNMARK_RESTORE, -+ XT_CONNMARK_SAVEDSCP - }; - - enum { + net/netfilter/xt_connmark.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c +index ec377cc6a369..823d925b3aaf 100644 --- a/net/netfilter/xt_connmark.c +++ b/net/netfilter/xt_connmark.c -@@ -42,6 +42,7 @@ connmark_tg_shift(struct sk_buff *skb, c - u_int32_t new_targetmark; +@@ -42,6 +42,7 @@ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par) + enum ip_conntrack_info ctinfo; struct nf_conn *ct; u_int32_t newmark; -+ u_int8_t dscp; ++ u_int8_t dscp, maskshift; ct = nf_ct_get(skb, &ctinfo); if (ct == NULL) -@@ -74,6 +75,21 @@ connmark_tg_shift(struct sk_buff *skb, c - nf_conntrack_event_cache(IPCT_MARK, ct); - } - break; -+ case XT_CONNMARK_SAVEDSCP: -+ if (skb->protocol == htons(ETH_P_IP)) -+ dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2; -+ else if (skb->protocol == htons(ETH_P_IPV6)) -+ dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2; -+ else /* protocol doesn't have diffserv */ -+ break; +@@ -49,7 +50,21 @@ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par) + + switch (info->mode) { + case XT_CONNMARK_SET: +- newmark = (ct->mark & ~info->ctmask) ^ info->ctmark; ++ if (info->nfmask & 0x80000000) { ++ newmark = (ct->mark & ~info->ctmask) ^ info->ctmark; ++ } else { ++ if (skb->protocol == htons(ETH_P_IP)) ++ dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2; ++ else if (skb->protocol == htons(ETH_P_IPV6)) ++ dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2; ++ else /* protocol doesn't have diffserv */ ++ break; + -+ newmark = (ct->mark & ~info->ctmark) | -+ (info->ctmask | (dscp << info->shift_bits)); -+ if (ct->mark != newmark) { -+ ct->mark = newmark; -+ nf_conntrack_event_cache(IPCT_MARK, ct); ++ /* nfmask contains the mask shift value */ ++ maskshift = info->nfmask & 0x1f; ++ newmark = (ct->mark & ~info->ctmark) | ++ (info->ctmask | (dscp << maskshift)); + } -+ break; - case XT_CONNMARK_RESTORE: - new_targetmark = (ct->mark & info->ctmask); - if (info->shift_dir == D_SHIFT_RIGHT) -@@ -86,6 +102,7 @@ connmark_tg_shift(struct sk_buff *skb, c - skb->mark = newmark; + if (ct->mark != newmark) { + ct->mark = newmark; + nf_conntrack_event_cache(IPCT_MARK, ct); +@@ -57,7 +72,7 @@ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par) break; - } -+out: - return XT_CONTINUE; - } - + case XT_CONNMARK_SAVE: + newmark = (ct->mark & ~info->ctmask) ^ +- (skb->mark & info->nfmask); ++ (skb->mark & info->nfmask); + if (ct->mark != newmark) { + ct->mark = newmark; + nf_conntrack_event_cache(IPCT_MARK, ct); +-- +2.21.0 (Apple Git-122.2) + diff --git a/target/linux/generic/hack-4.19/645-netfilter-connmark-introduce-set-dscpmark.patch b/target/linux/generic/hack-4.19/645-netfilter-connmark-introduce-set-dscpmark.patch new file mode 100644 index 0000000000..a4f246d112 --- /dev/null +++ b/target/linux/generic/hack-4.19/645-netfilter-connmark-introduce-set-dscpmark.patch @@ -0,0 +1,212 @@ +From eda40b8c8c82e0f2789d6bc8bf63846dce2e8f32 Mon Sep 17 00:00:00 2001 +From: Kevin Darbyshire-Bryant +Date: Sat, 23 Mar 2019 09:29:49 +0000 +Subject: [PATCH] netfilter: connmark: introduce set-dscpmark + +set-dscpmark is a method of storing the DSCP of an ip packet into +conntrack mark. In combination with a suitable tc filter action +(act_ctinfo) DSCP values are able to be stored in the mark on egress and +restored on ingress across links that otherwise alter or bleach DSCP. + +This is useful for qdiscs such as CAKE which are able to shape according +to policies based on DSCP. + +Ingress classification is traditionally a challenging task since +iptables rules haven't yet run and tc filter/eBPF programs are pre-NAT +lookups, hence are unable to see internal IPv4 addresses as used on the +typical home masquerading gateway. + +x_tables CONNMARK set-dscpmark target solves the problem of storing the +DSCP to the conntrack mark in a way suitable for the new act_ctinfo tc +action to restore. + +The set-dscpmark option accepts 2 parameters, a 32bit 'dscpmask' and a +32bit 'statemask'. The dscp mask must be 6 contiguous bits and +represents the area where the DSCP will be stored in the connmark. The +state mask is a minimum 1 bit length mask that must not overlap with the +dscpmask. It represents a flag which is set when the DSCP has been +stored in the conntrack mark. This is useful to implement a 'one shot' +iptables based classification where the 'complicated' iptables rules are +only run once to classify the connection on initial (egress) packet and +subsequent packets are all marked/restored with the same DSCP. A state +mask of zero disables the setting of a status bit/s. + +example syntax with a suitably modified iptables user space application: + +iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --set-dscpmark 0xfc000000/0x01000000 + +Would store the DSCP in the top 6 bits of the 32bit mark field, and use +the LSB of the top byte as the 'DSCP has been stored' marker. + +|----0xFC----conntrack mark----000000---| +| Bits 31-26 | bit 25 | bit24 |~~~ Bit 0| +| DSCP | unused | flag |unused | +|-----------------------0x01---000000---| + ^ ^ + | | + ---| Conditional flag + | set this when dscp +|-ip diffserv-| stored in mark +| 6 bits | +|-------------| + +an identically configured tc action to restore looks like: + +tc filter show dev eth0 ingress +filter parent ffff: protocol all pref 10 u32 chain 0 +filter parent ffff: protocol all pref 10 u32 chain 0 fh 800: ht divisor 1 +filter parent ffff: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1: not_in_hw + match 00000000/00000000 at 0 + action order 1: ctinfo zone 0 pipe + index 2 ref 1 bind 1 dscp 0xfc000000/0x1000000 + + action order 2: mirred (Egress Redirect to device ifb4eth0) stolen + index 1 ref 1 bind 1 + +|----0xFC----conntrack mark----000000---| +| Bits 31-26 | bit 25 | bit24 |~~~ Bit 0| +| DSCP | unused | flag |unused | +|-----------------------0x01---000000---| + | | + | | + ---| Conditional flag + v only restore if set +|-ip diffserv-| +| 6 bits | +|-------------| + +Signed-off-by: Kevin Darbyshire-Bryant +--- + include/uapi/linux/netfilter/xt_connmark.h | 10 ++++ + net/netfilter/xt_connmark.c | 55 ++++++++++++++++++---- + 2 files changed, 57 insertions(+), 8 deletions(-) + +--- a/include/uapi/linux/netfilter/xt_connmark.h ++++ b/include/uapi/linux/netfilter/xt_connmark.h +@@ -20,6 +20,11 @@ enum { + }; + + enum { ++ XT_CONNMARK_VALUE = BIT(0), ++ XT_CONNMARK_DSCP = BIT(1) ++}; ++ ++enum { + D_SHIFT_LEFT = 0, + D_SHIFT_RIGHT, + }; +@@ -34,6 +39,11 @@ struct xt_connmark_tginfo2 { + __u8 shift_dir, shift_bits, mode; + }; + ++struct xt_connmark_tginfo3 { ++ __u32 ctmark, ctmask, nfmask; ++ __u8 shift_dir, shift_bits, mode, func; ++}; ++ + struct xt_connmark_mtinfo1 { + __u32 mark, mask; + __u8 invert; +--- a/net/netfilter/xt_connmark.c ++++ b/net/netfilter/xt_connmark.c +@@ -36,12 +36,13 @@ MODULE_ALIAS("ipt_connmark"); + MODULE_ALIAS("ip6t_connmark"); + + static unsigned int +-connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info) ++connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo3 *info) + { + enum ip_conntrack_info ctinfo; + u_int32_t new_targetmark; + struct nf_conn *ct; + u_int32_t newmark; ++ u_int8_t dscp; + + ct = nf_ct_get(skb, &ctinfo); + if (ct == NULL) +@@ -49,12 +50,24 @@ connmark_tg_shift(struct sk_buff *skb, c + + switch (info->mode) { + case XT_CONNMARK_SET: +- newmark = (ct->mark & ~info->ctmask) ^ info->ctmark; +- if (info->shift_dir == D_SHIFT_RIGHT) +- newmark >>= info->shift_bits; +- else +- newmark <<= info->shift_bits; ++ newmark = ct->mark; ++ if (info->func & XT_CONNMARK_VALUE) { ++ newmark = (newmark & ~info->ctmask) ^ info->ctmark; ++ if (info->shift_dir == D_SHIFT_RIGHT) ++ newmark >>= info->shift_bits; ++ else ++ newmark <<= info->shift_bits; ++ } else if (info->func & XT_CONNMARK_DSCP) { ++ if (skb->protocol == htons(ETH_P_IP)) ++ dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2; ++ else if (skb->protocol == htons(ETH_P_IPV6)) ++ dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2; ++ else /* protocol doesn't have diffserv */ ++ break; + ++ newmark = (newmark & ~info->ctmark) | ++ (info->ctmask | (dscp << info->shift_bits)); ++ } + if (ct->mark != newmark) { + ct->mark = newmark; + nf_conntrack_event_cache(IPCT_MARK, ct); +@@ -93,20 +106,36 @@ static unsigned int + connmark_tg(struct sk_buff *skb, const struct xt_action_param *par) + { + const struct xt_connmark_tginfo1 *info = par->targinfo; +- const struct xt_connmark_tginfo2 info2 = { ++ const struct xt_connmark_tginfo3 info3 = { + .ctmark = info->ctmark, + .ctmask = info->ctmask, + .nfmask = info->nfmask, + .mode = info->mode, ++ .func = XT_CONNMARK_VALUE + }; + +- return connmark_tg_shift(skb, &info2); ++ return connmark_tg_shift(skb, &info3); + } + + static unsigned int + connmark_tg_v2(struct sk_buff *skb, const struct xt_action_param *par) + { + const struct xt_connmark_tginfo2 *info = par->targinfo; ++ const struct xt_connmark_tginfo3 info3 = { ++ .ctmark = info->ctmark, ++ .ctmask = info->ctmask, ++ .nfmask = info->nfmask, ++ .mode = info->mode, ++ .func = XT_CONNMARK_VALUE ++ }; ++ ++ return connmark_tg_shift(skb, &info3); ++} ++ ++static unsigned int ++connmark_tg_v3(struct sk_buff *skb, const struct xt_action_param *par) ++{ ++ const struct xt_connmark_tginfo3 *info = par->targinfo; + + return connmark_tg_shift(skb, info); + } +@@ -177,6 +206,16 @@ static struct xt_target connmark_tg_reg[ + .targetsize = sizeof(struct xt_connmark_tginfo2), + .destroy = connmark_tg_destroy, + .me = THIS_MODULE, ++ }, ++ { ++ .name = "CONNMARK", ++ .revision = 3, ++ .family = NFPROTO_UNSPEC, ++ .checkentry = connmark_tg_check, ++ .target = connmark_tg_v3, ++ .targetsize = sizeof(struct xt_connmark_tginfo3), ++ .destroy = connmark_tg_destroy, ++ .me = THIS_MODULE, + } + }; + -- 2.30.2