Re: [PATCH] libxt_CONNMARK: Support bit-shifting for --restore,set and save-mark

2018-04-12 Thread Jack Ma 
Hi Florian & Pablo,

The pointer casting from

(struct xt_connmark_tginfo2 *) to (const struct xt_connmark_tginfo1 *) cause 
the significance to be lost...

Sorry this is a silly mistake I made.. Already got patches addressing the 
issue. Plan to send out for review next week..

Regards,
Jack--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH] libxt_CONNMARK: Support bit-shifting for --restore,set and save-mark

2018-04-08 Thread Jack Ma 
This patch adds a new feature to iptables that allow bitshifting for
--restore,set and save-mark operations. This allows existing logic
operators (and, or and xor) and mask to co-operate with new bitshift
operations.

The intention is to provide uses with more fexible uses of skb->mark
and ct->mark. For example, users can save extra bits in skb->mark:
skb->mark = ct->mark << 8;

Reviewed-by: Florian Westphal 
Signed-off-by: Jack Ma 
---
 extensions/libxt_CONNMARK.c   | 161 +++---
 include/linux/netfilter/xt_connmark.h |   5 ++
 2 files changed, 154 insertions(+), 12 deletions(-)

diff --git a/extensions/libxt_CONNMARK.c b/extensions/libxt_CONNMARK.c
index 94984cdc..3551b594 100644
--- a/extensions/libxt_CONNMARK.c
+++ b/extensions/libxt_CONNMARK.c
@@ -28,34 +28,48 @@
 struct xt_connmark_target_info {
unsigned long mark;
unsigned long mask;
+   uint8_t shift_dir;
+   uint8_t shift_bits;
uint8_t mode;
 };
 
 enum {
+   D_SHIFT_LEFT = 0,
+   D_SHIFT_RIGHT,
+};
+
+enum {
O_SET_MARK = 0,
O_SAVE_MARK,
O_RESTORE_MARK,
O_AND_MARK,
O_OR_MARK,
O_XOR_MARK,
+   O_LEFT_SHIFT_MARK,
+   O_RIGHT_SHIFT_MARK,
O_SET_XMARK,
O_CTMASK,
O_NFMASK,
O_MASK,
-   F_SET_MARK = 1 << O_SET_MARK,
-   F_SAVE_MARK= 1 << O_SAVE_MARK,
-   F_RESTORE_MARK = 1 << O_RESTORE_MARK,
-   F_AND_MARK = 1 << O_AND_MARK,
-   F_OR_MARK  = 1 << O_OR_MARK,
-   F_XOR_MARK = 1 << O_XOR_MARK,
-   F_SET_XMARK= 1 << O_SET_XMARK,
-   F_CTMASK   = 1 << O_CTMASK,
-   F_NFMASK   = 1 << O_NFMASK,
-   F_MASK = 1 << O_MASK,
-   F_OP_ANY   = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
-F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
+   F_SET_MARK = 1 << O_SET_MARK,
+   F_SAVE_MARK= 1 << O_SAVE_MARK,
+   F_RESTORE_MARK = 1 << O_RESTORE_MARK,
+   F_AND_MARK = 1 << O_AND_MARK,
+   F_OR_MARK  = 1 << O_OR_MARK,
+   F_XOR_MARK = 1 << O_XOR_MARK,
+   F_LEFT_SHIFT_MARK  = 1 << O_LEFT_SHIFT_MARK,
+   F_RIGHT_SHIFT_MARK = 1 << O_RIGHT_SHIFT_MARK,
+   F_SET_XMARK= 1 << O_SET_XMARK,
+   F_CTMASK   = 1 << O_CTMASK,
+   F_NFMASK   = 1 << O_NFMASK,
+   F_MASK = 1 << O_MASK,
+   F_OP_ANY   = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
+F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
 };
 
+static const char *const xt_connmark_shift_ops[] =
+  { "left-shift", "right-shift" };
+
 static void CONNMARK_help(void)
 {
printf(
@@ -104,6 +118,34 @@ static const struct xt_option_entry connmark_tg_opts[] = {
 };
 #undef s
 
+#define s struct xt_connmark_tginfo2
+static const struct xt_option_entry connmark_tg_opts_v2[] = {
+   {.name = "set-xmark", .id = O_SET_XMARK, .type = XTTYPE_MARKMASK32,
+.excl = F_OP_ANY},
+   {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
+.excl = F_OP_ANY},
+   {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
+.excl = F_OP_ANY},
+   {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
+.excl = F_OP_ANY},
+   {.name = "xor-mark", .id = O_XOR_MARK, .type = XTTYPE_UINT32,
+.excl = F_OP_ANY},
+   {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE,
+.excl = F_OP_ANY},
+   {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE,
+.excl = F_OP_ANY},
+   {.name = "left-shift-mark", .id = O_LEFT_SHIFT_MARK, .type = 
XTTYPE_UINT8},
+   {.name = "right-shift-mark", .id = O_RIGHT_SHIFT_MARK, .type = 
XTTYPE_UINT8},
+   {.name = "ctmask", .id = O_CTMASK, .type = XTTYPE_UINT32,
+.excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, ctmask)},
+   {.name = "nfmask", .id = O_NFMASK, .type = XTTYPE_UINT32,
+.excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, nfmask)},
+   {.name = "mask", .id = O_MASK, .type = XTTYPE_UINT32,
+.excl = F_CTMASK | F_NFMASK},
+   XTOPT_TABLEEND,
+};
+#undef s
+
 static void connmark_tg_help(void)
 {
printf(
@@ -122,6 +164,15 @@ static void connmark_tg_help(void)
 );
 }
 
+static void connmark_tg_help_v2(void)
+{
+   connmark_tg_help();
+   printf(
+"  --left-shift-mark value   Left shift the ctmark with bits\n"
+"  --right-shift-mark value  Right shift the ctmark with bits\n"
+);
+}
+
 static void connmark_tg_init(struct xt_entry_target *target)
 {
struct xt_connmark_tginfo1 *info = (void *)target->data;
@@ -134,6 +185,18 @@ static void connmark_tg_init(struct xt_entry_target 
*target)
info->nfmask = UINT32_MAX;
 }
 
+static void connmark_tg_init_v2(struct xt_entry_target *target)
+{
+   struct xt_connmark_tginfo2 *info;
+
+   connmark_tg_init(target);
+   inf

Re: [PATCH] libxt_CONNMARK: Support bit-shifting for --restore,set and save-mark

2018-04-08 Thread Jack Ma 

diff: Fixed a small typo error in connmark_tg_parse_v2--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH] libxt_CONNMARK: Support bit-shifting for --restore,set and save-mark

2018-03-18 Thread Jack Ma 
This patch adds a new feature to iptables that allow bitshifting for
--restore,set and save-mark operations. This allows existing logic
operators (and, or and xor) and mask to co-operate with new bitshift
operations.

The intention is to provide uses with more fexible uses of skb->mark
and ct->mark. For example, users can save extra bits in skb->mark:
skb->mark = ct->mark << 8;

Reviewed-by: Florian Westphal 
Signed-off-by: Jack Ma 
---
 extensions/libxt_CONNMARK.c   | 161 +++---
 include/linux/netfilter/xt_connmark.h |   5 ++
 2 files changed, 154 insertions(+), 12 deletions(-)

diff --git a/extensions/libxt_CONNMARK.c b/extensions/libxt_CONNMARK.c
index 94984cdc..331fdc78 100644
--- a/extensions/libxt_CONNMARK.c
+++ b/extensions/libxt_CONNMARK.c
@@ -28,34 +28,48 @@
 struct xt_connmark_target_info {
unsigned long mark;
unsigned long mask;
+   uint8_t shift_dir;
+   uint8_t shift_bits;
uint8_t mode;
 };
 
 enum {
+   D_SHIFT_LEFT = 0,
+   D_SHIFT_RIGHT,
+};
+
+enum {
O_SET_MARK = 0,
O_SAVE_MARK,
O_RESTORE_MARK,
O_AND_MARK,
O_OR_MARK,
O_XOR_MARK,
+   O_LEFT_SHIFT_MARK,
+   O_RIGHT_SHIFT_MARK,
O_SET_XMARK,
O_CTMASK,
O_NFMASK,
O_MASK,
-   F_SET_MARK = 1 << O_SET_MARK,
-   F_SAVE_MARK= 1 << O_SAVE_MARK,
-   F_RESTORE_MARK = 1 << O_RESTORE_MARK,
-   F_AND_MARK = 1 << O_AND_MARK,
-   F_OR_MARK  = 1 << O_OR_MARK,
-   F_XOR_MARK = 1 << O_XOR_MARK,
-   F_SET_XMARK= 1 << O_SET_XMARK,
-   F_CTMASK   = 1 << O_CTMASK,
-   F_NFMASK   = 1 << O_NFMASK,
-   F_MASK = 1 << O_MASK,
-   F_OP_ANY   = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
-F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
+   F_SET_MARK = 1 << O_SET_MARK,
+   F_SAVE_MARK= 1 << O_SAVE_MARK,
+   F_RESTORE_MARK = 1 << O_RESTORE_MARK,
+   F_AND_MARK = 1 << O_AND_MARK,
+   F_OR_MARK  = 1 << O_OR_MARK,
+   F_XOR_MARK = 1 << O_XOR_MARK,
+   F_LEFT_SHIFT_MARK  = 1 << O_LEFT_SHIFT_MARK,
+   F_RIGHT_SHIFT_MARK = 1 << O_RIGHT_SHIFT_MARK,
+   F_SET_XMARK= 1 << O_SET_XMARK,
+   F_CTMASK   = 1 << O_CTMASK,
+   F_NFMASK   = 1 << O_NFMASK,
+   F_MASK = 1 << O_MASK,
+   F_OP_ANY   = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
+F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
 };
 
+static const char *const xt_connmark_shift_ops[] =
+  { "left-shift", "right-shift" };
+
 static void CONNMARK_help(void)
 {
printf(
@@ -104,6 +118,34 @@ static const struct xt_option_entry connmark_tg_opts[] = {
 };
 #undef s
 
+#define s struct xt_connmark_tginfo2
+static const struct xt_option_entry connmark_tg_opts_v2[] = {
+   {.name = "set-xmark", .id = O_SET_XMARK, .type = XTTYPE_MARKMASK32,
+.excl = F_OP_ANY},
+   {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
+.excl = F_OP_ANY},
+   {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
+.excl = F_OP_ANY},
+   {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
+.excl = F_OP_ANY},
+   {.name = "xor-mark", .id = O_XOR_MARK, .type = XTTYPE_UINT32,
+.excl = F_OP_ANY},
+   {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE,
+.excl = F_OP_ANY},
+   {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE,
+.excl = F_OP_ANY},
+   {.name = "left-shift-mark", .id = O_LEFT_SHIFT_MARK, .type = 
XTTYPE_UINT8},
+   {.name = "right-shift-mark", .id = O_RIGHT_SHIFT_MARK, .type = 
XTTYPE_UINT8},
+   {.name = "ctmask", .id = O_CTMASK, .type = XTTYPE_UINT32,
+.excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, ctmask)},
+   {.name = "nfmask", .id = O_NFMASK, .type = XTTYPE_UINT32,
+.excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, nfmask)},
+   {.name = "mask", .id = O_MASK, .type = XTTYPE_UINT32,
+.excl = F_CTMASK | F_NFMASK},
+   XTOPT_TABLEEND,
+};
+#undef s
+
 static void connmark_tg_help(void)
 {
printf(
@@ -122,6 +164,15 @@ static void connmark_tg_help(void)
 );
 }
 
+static void connmark_tg_help_v2(void)
+{
+   connmark_tg_help();
+   printf(
+"  --left-shift-mark value   Left shift the ctmark with bits\n"
+"  --right-shift-mark value  Right shift the ctmark with bits\n"
+);
+}
+
 static void connmark_tg_init(struct xt_entry_target *target)
 {
struct xt_connmark_tginfo1 *info = (void *)target->data;
@@ -134,6 +185,18 @@ static void connmark_tg_init(struct xt_entry_target 
*target)
info->nfmask = UINT32_MAX;
 }
 
+static void connmark_tg_init_v2(struct xt_entry_target *target)
+{
+   struct xt_connmark_tginfo2 *info;
+
+   connmark_tg_init(target);
+   inf