From: Kevin 'ldir' Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
To: Kevin 'ldir' Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Cc: "netfilter-devel@vger.kernel.org"
<netfilter-devel@vger.kernel.org>,
"pablo@netfilter.org" <pablo@netfilter.org>
Subject: [RFC nf-next 2/2] iptables: connmark - add savedscp option
Date: Tue, 9 Apr 2019 14:23:48 +0000 [thread overview]
Message-ID: <20190409142333.68403-3-ldir@darbyshire-bryant.me.uk> (raw)
In-Reply-To: <20190409142333.68403-1-ldir@darbyshire-bryant.me.uk>
Naive user space front end to xt_connmark 'savedscp' option.
e.g.
iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --savedscp-mark 0xfc000000/0x01000000
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
---
extensions/libxt_CONNMARK.c | 68 ++++++++++++++++++++++++++-
include/linux/netfilter/xt_connmark.h | 3 +-
2 files changed, 69 insertions(+), 2 deletions(-)
diff --git a/extensions/libxt_CONNMARK.c b/extensions/libxt_CONNMARK.c
index 21e10913..2dbd7a4a 100644
--- a/extensions/libxt_CONNMARK.c
+++ b/extensions/libxt_CONNMARK.c
@@ -49,6 +49,7 @@ enum {
O_CTMASK,
O_NFMASK,
O_MASK,
+ O_SAVEDSCP_MARK,
F_SET_MARK = 1 << O_SET_MARK,
F_SAVE_MARK = 1 << O_SAVE_MARK,
F_RESTORE_MARK = 1 << O_RESTORE_MARK,
@@ -61,8 +62,10 @@ enum {
F_CTMASK = 1 << O_CTMASK,
F_NFMASK = 1 << O_NFMASK,
F_MASK = 1 << O_MASK,
+ F_SAVEDSCP_MARK = 1 << O_SAVEDSCP_MARK,
F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
- F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
+ F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK |
+ F_SAVEDSCP_MARK,
};
static const char *const xt_connmark_shift_ops[] = {
@@ -75,6 +78,7 @@ static void CONNMARK_help(void)
printf(
"CONNMARK target options:\n"
" --set-mark value[/mask] Set conntrack mark value\n"
+" --savedscp-mark dscpmask/statemask Save DSCP to conntrack mark value\n"
" --save-mark [--mask mask] Save the packet nfmark in the connection\n"
" --restore-mark [--mask mask] Restore saved nfmark value\n");
}
@@ -83,6 +87,8 @@ static void CONNMARK_help(void)
static const struct xt_option_entry CONNMARK_opts[] = {
{.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
.excl = F_OP_ANY},
+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
+ .excl = F_OP_ANY},
{.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE,
.excl = F_OP_ANY},
{.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE,
@@ -98,6 +104,8 @@ static const struct xt_option_entry connmark_tg_opts[] = {
.excl = F_OP_ANY},
{.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
.excl = F_OP_ANY},
+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
+ .excl = F_OP_ANY},
{.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
.excl = F_OP_ANY},
{.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
@@ -124,6 +132,8 @@ static const struct xt_option_entry connmark_tg_opts_v2[] = {
.excl = F_OP_ANY},
{.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
.excl = F_OP_ANY},
+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
+ .excl = F_OP_ANY},
{.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
.excl = F_OP_ANY},
{.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
@@ -158,6 +168,7 @@ static void connmark_tg_help(void)
" --restore-mark [--ctmask mask] [--nfmask mask]\n"
" Copy nfmark to ctmark using masks\n"
" --set-mark value[/mask] Set conntrack mark value\n"
+" --savedscp-mark value/mask Save DSCP to conntrack mark value\n"
" --save-mark [--mask mask] Save the packet nfmark in the connection\n"
" --restore-mark [--mask mask] Restore saved nfmark value\n"
" --and-mark value Binary AND the ctmark with bits\n"
@@ -210,6 +221,11 @@ static void CONNMARK_parse(struct xt_option_call *cb)
markinfo->mark = cb->val.mark;
markinfo->mask = cb->val.mask;
break;
+ case O_SAVEDSCP_MARK:
+ markinfo->mode = XT_CONNMARK_SAVEDSCP;
+ markinfo->mark = cb->val.mark;
+ markinfo->mask = cb->val.mask;
+ break;
case O_SAVE_MARK:
markinfo->mode = XT_CONNMARK_SAVE;
break;
@@ -238,6 +254,19 @@ static void connmark_tg_parse(struct xt_option_call *cb)
info->ctmark = cb->val.mark;
info->ctmask = cb->val.mark | cb->val.mask;
break;
+ case O_SAVEDSCP_MARK:
+ info->mode = XT_CONNMARK_SAVEDSCP;
+ info->ctmark = cb->val.mark;
+ info->ctmask = cb->val.mask;
+ info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0;
+ /* need 6 contiguous bits */
+ if ((0x3f & (info->ctmark >> info->nfmask)) != 0x3f)
+ xtables_error(PARAMETER_PROBLEM,
+ "CONNMARK savedscp: insufficient contiguous dscpmask bits");
+ if (info->ctmark & info->ctmask)
+ xtables_error(PARAMETER_PROBLEM,
+ "CONNMARK savedscp: dscpmask/statemask bits overlap");
+ break;
case O_AND_MARK:
info->mode = XT_CONNMARK_SET;
info->ctmark = 0;
@@ -283,6 +312,19 @@ static void connmark_tg_parse_v2(struct xt_option_call *cb)
info->ctmark = cb->val.mark;
info->ctmask = cb->val.mark | cb->val.mask;
break;
+ case O_SAVEDSCP_MARK:
+ info->mode = XT_CONNMARK_SAVEDSCP;
+ info->ctmark = cb->val.mark;
+ info->ctmask = cb->val.mask;
+ info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0;
+ /* need 6 contiguous bits */
+ if ((0x3f & (info->ctmark >> info->shift_bits)) != 0x3f)
+ xtables_error(PARAMETER_PROBLEM,
+ "CONNMARK savedscp: insufficient contiguous dscpmask bits");
+ if (info->ctmark & info->ctmask)
+ xtables_error(PARAMETER_PROBLEM,
+ "CONNMARK savedscp: dscpmask/statemask bits overlap");
+ break;
case O_AND_MARK:
info->mode = XT_CONNMARK_SET;
info->ctmark = 0;
@@ -351,6 +393,11 @@ static void CONNMARK_print(const void *ip,
print_mark(markinfo->mark);
print_mask("/", markinfo->mask);
break;
+ case XT_CONNMARK_SAVEDSCP:
+ printf(" CONNMARK savedscp ");
+ print_mark(markinfo->mark);
+ print_mask("/", markinfo->mask);
+ break;
case XT_CONNMARK_SAVE:
printf(" CONNMARK save ");
print_mask("mask ", markinfo->mask);
@@ -386,6 +433,10 @@ connmark_tg_print(const void *ip, const struct xt_entry_target *target,
printf(" CONNMARK xset 0x%x/0x%x",
info->ctmark, info->ctmask);
break;
+ case XT_CONNMARK_SAVEDSCP:
+ printf(" CONNMARK DSCP set 0x%x/0x%x",
+ info->ctmark, info->ctmask);
+ break;
case XT_CONNMARK_SAVE:
if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
printf(" CONNMARK save");
@@ -433,6 +484,10 @@ connmark_tg_print_v2(const void *ip, const struct xt_entry_target *target,
printf(" CONNMARK xset 0x%x/0x%x",
info->ctmark, info->ctmask);
break;
+ case XT_CONNMARK_SAVEDSCP:
+ printf(" CONNMARK DSCP xset 0x%x/0x%x",
+ info->ctmark, info->ctmask);
+ break;
case XT_CONNMARK_SAVE:
if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
printf(" CONNMARK save");
@@ -474,6 +529,11 @@ static void CONNMARK_save(const void *ip, const struct xt_entry_target *target)
print_mark(markinfo->mark);
print_mask("/", markinfo->mask);
break;
+ case XT_CONNMARK_SAVEDSCP:
+ printf(" --savedscp-mark ");
+ print_mark(markinfo->mark);
+ print_mask("/", markinfo->mask);
+ break;
case XT_CONNMARK_SAVE:
printf(" --save-mark ");
print_mask("--mask ", markinfo->mask);
@@ -505,6 +565,9 @@ connmark_tg_save(const void *ip, const struct xt_entry_target *target)
case XT_CONNMARK_SET:
printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
break;
+ case XT_CONNMARK_SAVEDSCP:
+ printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
+ break;
case XT_CONNMARK_SAVE:
printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
info->nfmask, info->ctmask);
@@ -529,6 +592,9 @@ connmark_tg_save_v2(const void *ip, const struct xt_entry_target *target)
case XT_CONNMARK_SET:
printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
break;
+ case XT_CONNMARK_SAVEDSCP:
+ printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
+ break;
case XT_CONNMARK_SAVE:
printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
info->nfmask, info->ctmask);
diff --git a/include/linux/netfilter/xt_connmark.h b/include/linux/netfilter/xt_connmark.h
index bbf2acc9..cf526101 100644
--- a/include/linux/netfilter/xt_connmark.h
+++ b/include/linux/netfilter/xt_connmark.h
@@ -15,7 +15,8 @@
enum {
XT_CONNMARK_SET = 0,
XT_CONNMARK_SAVE,
- XT_CONNMARK_RESTORE
+ XT_CONNMARK_RESTORE,
+ XT_CONNMARK_SAVEDSCP
};
struct xt_connmark_tginfo1 {
--
2.20.1 (Apple Git-117)
next prev parent reply other threads:[~2019-04-09 14:23 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-24 14:23 [RFC PATCH 0/1] netfilter: xt_connmark: add savedscp-mark action Kevin 'ldir' Darbyshire-Bryant
2019-03-24 14:23 ` [PATCH 1/1] netfilter: connmark: introduce savedscp Kevin 'ldir' Darbyshire-Bryant
2019-04-08 22:39 ` Pablo Neira Ayuso
2019-04-08 23:16 ` Kevin 'ldir' Darbyshire-Bryant
2019-04-09 14:23 ` [RFC nf-next v2 0/2] xt_connmark: add savedscp-mark action Kevin 'ldir' Darbyshire-Bryant
2019-04-09 14:23 ` [RFC nf-next v2 1/2] netfilter: connmark: introduce savedscp Kevin 'ldir' Darbyshire-Bryant
2019-04-30 12:29 ` Pablo Neira Ayuso
2019-04-30 20:40 ` Kevin 'ldir' Darbyshire-Bryant
2019-04-09 14:23 ` Kevin 'ldir' Darbyshire-Bryant [this message]
2019-12-03 16:06 ` [PATCH 0/1] netfilter: connmark: introduce set-dscpmark Kevin Darbyshire-Bryant
2019-12-03 16:06 ` [PATCH 1/1] " Kevin Darbyshire-Bryant
2019-12-09 23:57 ` Kevin 'ldir' Darbyshire-Bryant
2019-12-05 8:56 ` [PATCH 0/1] " Jeremy Sowden
2019-12-05 9:46 ` Kevin 'ldir' Darbyshire-Bryant
2019-12-06 8:54 ` Jeremy Sowden
2019-12-05 10:49 ` Florian Westphal
2019-12-05 22:00 ` Jeremy Sowden
2019-12-09 21:42 ` [RFC PATCH nf-next] netfilter: conntrack: add support for storing DiffServ code-point as CT mark Jeremy Sowden
2019-12-09 21:42 ` [RFC PATCH nftables] Add "ct dscpmark" conntrack statement Jeremy Sowden
2019-12-09 22:47 ` [RFC PATCH nf-next] netfilter: conntrack: add support for storing DiffServ code-point as CT mark Florian Westphal
2019-12-09 23:23 ` Jeremy Sowden
2019-12-10 1:25 ` Florian Westphal
2019-12-10 11:01 ` Jeremy Sowden
2019-12-10 11:32 ` Florian Westphal
2019-12-10 19:52 ` Jeremy Sowden
2019-12-11 13:01 ` [PATCH nf-next v2] netfilter: connmark: introduce set-dscpmark Kevin Darbyshire-Bryant
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190409142333.68403-3-ldir@darbyshire-bryant.me.uk \
--to=ldir@darbyshire-bryant.me.uk \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).