Naive user space front end to xt_connmark 'savedscp' option. e.g.
iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --savedscp-mark 0xfc000000/0x01000000 Signed-off-by: Kevin Darbyshire-Bryant <[email protected]> --- extensions/libxt_CONNMARK.c | 68 ++++++++++++++++++++++++++- include/linux/netfilter/xt_connmark.h | 3 +- 2 files changed, 69 insertions(+), 2 deletions(-) diff --git a/extensions/libxt_CONNMARK.c b/extensions/libxt_CONNMARK.c index 21e10913..2dbd7a4a 100644 --- a/extensions/libxt_CONNMARK.c +++ b/extensions/libxt_CONNMARK.c @@ -49,6 +49,7 @@ enum { O_CTMASK, O_NFMASK, O_MASK, + O_SAVEDSCP_MARK, F_SET_MARK = 1 << O_SET_MARK, F_SAVE_MARK = 1 << O_SAVE_MARK, F_RESTORE_MARK = 1 << O_RESTORE_MARK, @@ -61,8 +62,10 @@ enum { F_CTMASK = 1 << O_CTMASK, F_NFMASK = 1 << O_NFMASK, F_MASK = 1 << O_MASK, + F_SAVEDSCP_MARK = 1 << O_SAVEDSCP_MARK, F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK | - F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK, + F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK | + F_SAVEDSCP_MARK, }; static const char *const xt_connmark_shift_ops[] = { @@ -75,6 +78,7 @@ static void CONNMARK_help(void) printf( "CONNMARK target options:\n" " --set-mark value[/mask] Set conntrack mark value\n" +" --savedscp-mark dscpmask/statemask Save DSCP to conntrack mark value\n" " --save-mark [--mask mask] Save the packet nfmark in the connection\n" " --restore-mark [--mask mask] Restore saved nfmark value\n"); } @@ -83,6 +87,8 @@ static void CONNMARK_help(void) static const struct xt_option_entry CONNMARK_opts[] = { {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, .excl = F_OP_ANY}, + {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32, + .excl = F_OP_ANY}, {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE, .excl = F_OP_ANY}, {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE, @@ -98,6 +104,8 @@ static const struct xt_option_entry connmark_tg_opts[] = { .excl = F_OP_ANY}, {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, .excl = F_OP_ANY}, + {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32, + .excl = F_OP_ANY}, {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32, .excl = F_OP_ANY}, {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32, @@ -124,6 +132,8 @@ static const struct xt_option_entry connmark_tg_opts_v2[] = { .excl = F_OP_ANY}, {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, .excl = F_OP_ANY}, + {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32, + .excl = F_OP_ANY}, {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32, .excl = F_OP_ANY}, {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32, @@ -158,6 +168,7 @@ static void connmark_tg_help(void) " --restore-mark [--ctmask mask] [--nfmask mask]\n" " Copy nfmark to ctmark using masks\n" " --set-mark value[/mask] Set conntrack mark value\n" +" --savedscp-mark value/mask Save DSCP to conntrack mark value\n" " --save-mark [--mask mask] Save the packet nfmark in the connection\n" " --restore-mark [--mask mask] Restore saved nfmark value\n" " --and-mark value Binary AND the ctmark with bits\n" @@ -210,6 +221,11 @@ static void CONNMARK_parse(struct xt_option_call *cb) markinfo->mark = cb->val.mark; markinfo->mask = cb->val.mask; break; + case O_SAVEDSCP_MARK: + markinfo->mode = XT_CONNMARK_SAVEDSCP; + markinfo->mark = cb->val.mark; + markinfo->mask = cb->val.mask; + break; case O_SAVE_MARK: markinfo->mode = XT_CONNMARK_SAVE; break; @@ -238,6 +254,19 @@ static void connmark_tg_parse(struct xt_option_call *cb) info->ctmark = cb->val.mark; info->ctmask = cb->val.mark | cb->val.mask; break; + case O_SAVEDSCP_MARK: + info->mode = XT_CONNMARK_SAVEDSCP; + info->ctmark = cb->val.mark; + info->ctmask = cb->val.mask; + info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0; + /* need 6 contiguous bits */ + if ((0x3f & (info->ctmark >> info->nfmask)) != 0x3f) + xtables_error(PARAMETER_PROBLEM, + "CONNMARK savedscp: insufficient contiguous dscpmask bits"); + if (info->ctmark & info->ctmask) + xtables_error(PARAMETER_PROBLEM, + "CONNMARK savedscp: dscpmask/statemask bits overlap"); + break; case O_AND_MARK: info->mode = XT_CONNMARK_SET; info->ctmark = 0; @@ -283,6 +312,19 @@ static void connmark_tg_parse_v2(struct xt_option_call *cb) info->ctmark = cb->val.mark; info->ctmask = cb->val.mark | cb->val.mask; break; + case O_SAVEDSCP_MARK: + info->mode = XT_CONNMARK_SAVEDSCP; + info->ctmark = cb->val.mark; + info->ctmask = cb->val.mask; + info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0; + /* need 6 contiguous bits */ + if ((0x3f & (info->ctmark >> info->shift_bits)) != 0x3f) + xtables_error(PARAMETER_PROBLEM, + "CONNMARK savedscp: insufficient contiguous dscpmask bits"); + if (info->ctmark & info->ctmask) + xtables_error(PARAMETER_PROBLEM, + "CONNMARK savedscp: dscpmask/statemask bits overlap"); + break; case O_AND_MARK: info->mode = XT_CONNMARK_SET; info->ctmark = 0; @@ -351,6 +393,11 @@ static void CONNMARK_print(const void *ip, print_mark(markinfo->mark); print_mask("/", markinfo->mask); break; + case XT_CONNMARK_SAVEDSCP: + printf(" CONNMARK savedscp "); + print_mark(markinfo->mark); + print_mask("/", markinfo->mask); + break; case XT_CONNMARK_SAVE: printf(" CONNMARK save "); print_mask("mask ", markinfo->mask); @@ -386,6 +433,10 @@ connmark_tg_print(const void *ip, const struct xt_entry_target *target, printf(" CONNMARK xset 0x%x/0x%x", info->ctmark, info->ctmask); break; + case XT_CONNMARK_SAVEDSCP: + printf(" CONNMARK DSCP set 0x%x/0x%x", + info->ctmark, info->ctmask); + break; case XT_CONNMARK_SAVE: if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX) printf(" CONNMARK save"); @@ -433,6 +484,10 @@ connmark_tg_print_v2(const void *ip, const struct xt_entry_target *target, printf(" CONNMARK xset 0x%x/0x%x", info->ctmark, info->ctmask); break; + case XT_CONNMARK_SAVEDSCP: + printf(" CONNMARK DSCP xset 0x%x/0x%x", + info->ctmark, info->ctmask); + break; case XT_CONNMARK_SAVE: if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX) printf(" CONNMARK save"); @@ -474,6 +529,11 @@ static void CONNMARK_save(const void *ip, const struct xt_entry_target *target) print_mark(markinfo->mark); print_mask("/", markinfo->mask); break; + case XT_CONNMARK_SAVEDSCP: + printf(" --savedscp-mark "); + print_mark(markinfo->mark); + print_mask("/", markinfo->mask); + break; case XT_CONNMARK_SAVE: printf(" --save-mark "); print_mask("--mask ", markinfo->mask); @@ -505,6 +565,9 @@ connmark_tg_save(const void *ip, const struct xt_entry_target *target) case XT_CONNMARK_SET: printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask); break; + case XT_CONNMARK_SAVEDSCP: + printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask); + break; case XT_CONNMARK_SAVE: printf(" --save-mark --nfmask 0x%x --ctmask 0x%x", info->nfmask, info->ctmask); @@ -529,6 +592,9 @@ connmark_tg_save_v2(const void *ip, const struct xt_entry_target *target) case XT_CONNMARK_SET: printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask); break; + case XT_CONNMARK_SAVEDSCP: + printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask); + break; case XT_CONNMARK_SAVE: printf(" --save-mark --nfmask 0x%x --ctmask 0x%x", info->nfmask, info->ctmask); diff --git a/include/linux/netfilter/xt_connmark.h b/include/linux/netfilter/xt_connmark.h index bbf2acc9..cf526101 100644 --- a/include/linux/netfilter/xt_connmark.h +++ b/include/linux/netfilter/xt_connmark.h @@ -15,7 +15,8 @@ enum { XT_CONNMARK_SET = 0, XT_CONNMARK_SAVE, - XT_CONNMARK_RESTORE + XT_CONNMARK_RESTORE, + XT_CONNMARK_SAVEDSCP }; struct xt_connmark_tginfo1 { -- 2.20.1 (Apple Git-117)
