From af04207aa32d88f7b2604134c00d97915cae04c1 Mon Sep 17 00:00:00 2001 From: Kevin Darbyshire-Bryant Date: Sat, 23 Mar 2019 09:29:49 +0000 Subject: [PATCH] xt_connmark savedscp Signed-off-by: Kevin Darbyshire-Bryant --- include/uapi/linux/netfilter/xt_connmark.h | 3 +- net/netfilter/xt_connmark.c | 34 +++++++++++++++++++++- 2 files changed, 35 insertions(+), 2 deletions(-) diff --git a/include/uapi/linux/netfilter/xt_connmark.h b/include/uapi/linux/netfilter/xt_connmark.h index 408a9654f05c..e63ad3c89b92 100644 --- a/include/uapi/linux/netfilter/xt_connmark.h +++ b/include/uapi/linux/netfilter/xt_connmark.h @@ -16,7 +16,8 @@ enum { XT_CONNMARK_SET = 0, XT_CONNMARK_SAVE, - XT_CONNMARK_RESTORE + XT_CONNMARK_RESTORE, + XT_CONNMARK_SAVEDSCP }; struct xt_connmark_tginfo1 { diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c index ec377cc6a369..73004a111055 100644 --- a/net/netfilter/xt_connmark.c +++ b/net/netfilter/xt_connmark.c @@ -42,6 +42,7 @@ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par) enum ip_conntrack_info ctinfo; struct nf_conn *ct; u_int32_t newmark; + u8 dscp, maskshift; ct = nf_ct_get(skb, &ctinfo); if (ct == NULL) @@ -57,7 +58,37 @@ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par) break; case XT_CONNMARK_SAVE: newmark = (ct->mark & ~info->ctmask) ^ - (skb->mark & info->nfmask); + (skb->mark & info->nfmask); + if (ct->mark != newmark) { + ct->mark = newmark; + nf_conntrack_event_cache(IPCT_MARK, ct); + } + break; + case XT_CONNMARK_SAVEDSCP: + if (!info->ctmask) + goto out; + + if (skb->protocol == htons(ETH_P_IP)) { + if (skb->len < sizeof(struct iphdr)) + goto out; + + dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2; + + } else if (skb->protocol == htons(ETH_P_IPV6)) { + if (skb->len < sizeof(struct ipv6hdr)) + goto out; + + dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2; + + } else { /* protocol doesn't have diffserv - get out! */ + goto out; + } + + /* nfmask contains the mask shift value */ + maskshift = info->nfmask & 0x1f; + newmark = (ct->mark & ~info->ctmask) ^ + (info->ctmark | (dscp << maskshift)); + if (ct->mark != newmark) { ct->mark = newmark; nf_conntrack_event_cache(IPCT_MARK, ct); @@ -70,6 +101,7 @@ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par) break; } +out: return XT_CONTINUE; } -- 2.17.2 (Apple Git-113)