| Message ID | 20190409142333.68403-2-ldir@darbyshire-bryant.me.uk |
|---|---|
| State | RFC |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | xt_connmark: add savedscp-mark action | expand |
On Tue, Apr 09, 2019 at 02:23:46PM +0000, Kevin 'ldir' Darbyshire-Bryant wrote: > diff --git a/include/uapi/linux/netfilter/xt_connmark.h b/include/uapi/linux/netfilter/xt_connmark.h > index 1aa5c955ee1e..24272cac2d37 100644 > --- a/include/uapi/linux/netfilter/xt_connmark.h > +++ b/include/uapi/linux/netfilter/xt_connmark.h > @@ -16,7 +16,8 @@ > enum { > XT_CONNMARK_SET = 0, > XT_CONNMARK_SAVE, > - XT_CONNMARK_RESTORE > + XT_CONNMARK_RESTORE, > + XT_CONNMARK_SAVEDSCP I'd prefer you implement this in nftables, more comments below. > }; > > enum { > diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c > index 29c38aa7f726..6c63cf476342 100644 > --- a/net/netfilter/xt_connmark.c > +++ b/net/netfilter/xt_connmark.c > @@ -42,6 +42,7 @@ connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info) > u_int32_t new_targetmark; > struct nf_conn *ct; > u_int32_t newmark; > + u8 dscp; > > ct = nf_ct_get(skb, &ctinfo); > if (ct == NULL) > @@ -74,6 +75,34 @@ connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info) > nf_conntrack_event_cache(IPCT_MARK, ct); > } > break; > + case XT_CONNMARK_SAVEDSCP: Could you add a new revision and a new flag field for this? so it just adds the dscp to the mark as you need. > + if (!info->ctmark) > + goto out; > + > + if (skb->protocol == htons(ETH_P_IP)) { > + if (skb->len < sizeof(struct iphdr)) > + goto out; > + > + dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2; > + > + } else if (skb->protocol == htons(ETH_P_IPV6)) { > + if (skb->len < sizeof(struct ipv6hdr)) > + goto out; This is already guaranteed to have a valid IP header in place, no need for this check. > + > + dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2; > + > + } else { /* protocol doesn't have diffserv - get out! */ > + goto out; > + } > + > + newmark = (ct->mark & ~info->ctmark) ^ > + (info->ctmask | (dscp << info->shift_bits)); > + > + if (ct->mark != newmark) { > + ct->mark = newmark; > + nf_conntrack_event_cache(IPCT_MARK, ct); > + } > + break; > case XT_CONNMARK_RESTORE: > new_targetmark = (ct->mark & info->ctmask); > if (info->shift_dir == D_SHIFT_RIGHT) > @@ -86,6 +115,7 @@ connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info) > skb->mark = newmark; > break; > } > +out: > return XT_CONTINUE; > } > > -- > 2.20.1 (Apple Git-117) >
Hi Pablo, Thanks for review. Some answers inline > On 30 Apr 2019, at 13:29, Pablo Neira Ayuso <pablo@netfilter.org> wrote: > > On Tue, Apr 09, 2019 at 02:23:46PM +0000, Kevin 'ldir' Darbyshire-Bryant wrote: >> diff --git a/include/uapi/linux/netfilter/xt_connmark.h b/include/uapi/linux/netfilter/xt_connmark.h >> index 1aa5c955ee1e..24272cac2d37 100644 >> --- a/include/uapi/linux/netfilter/xt_connmark.h >> +++ b/include/uapi/linux/netfilter/xt_connmark.h >> @@ -16,7 +16,8 @@ >> enum { >> XT_CONNMARK_SET = 0, >> XT_CONNMARK_SAVE, >> - XT_CONNMARK_RESTORE >> + XT_CONNMARK_RESTORE, >> + XT_CONNMARK_SAVEDSCP > > I'd prefer you implement this in nftables, more comments below. I will look into this. nftables is new to me. > >> }; >> >> enum { >> diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c >> index 29c38aa7f726..6c63cf476342 100644 >> --- a/net/netfilter/xt_connmark.c >> +++ b/net/netfilter/xt_connmark.c >> @@ -42,6 +42,7 @@ connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info) >> u_int32_t new_targetmark; >> struct nf_conn *ct; >> u_int32_t newmark; >> + u8 dscp; >> >> ct = nf_ct_get(skb, &ctinfo); >> if (ct == NULL) >> @@ -74,6 +75,34 @@ connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info) >> nf_conntrack_event_cache(IPCT_MARK, ct); >> } >> break; >> + case XT_CONNMARK_SAVEDSCP: > > Could you add a new revision and a new flag field for this? so it just > adds the dscp to the mark as you need. Not sure I understand this. Do you mean make it part of XT_CONNMARK_SAVE and have something like ‘info->dscpmask’? If (!info->dscpmask) do dscp stuff else do the original routine? > >> + if (!info->ctmark) >> + goto out; >> + >> + if (skb->protocol == htons(ETH_P_IP)) { >> + if (skb->len < sizeof(struct iphdr)) >> + goto out; >> + >> + dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2; >> + >> + } else if (skb->protocol == htons(ETH_P_IPV6)) { >> + if (skb->len < sizeof(struct ipv6hdr)) >> + goto out; > > This is already guaranteed to have a valid IP header in place, no need > for this check. Ok, thanks - removing code is easy (and faster) :-) Once again thanks for your review & time. > >> + >> + dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2; >> + >> + } else { /* protocol doesn't have diffserv - get out! */ >> + goto out; >> + } >> + >> + newmark = (ct->mark & ~info->ctmark) ^ >> + (info->ctmask | (dscp << info->shift_bits)); >> + >> + if (ct->mark != newmark) { >> + ct->mark = newmark; >> + nf_conntrack_event_cache(IPCT_MARK, ct); >> + } >> + break; >> case XT_CONNMARK_RESTORE: >> new_targetmark = (ct->mark & info->ctmask); >> if (info->shift_dir == D_SHIFT_RIGHT) >> @@ -86,6 +115,7 @@ connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info) >> skb->mark = newmark; >> break; >> } >> +out: >> return XT_CONTINUE; >> } >> >> -- >> 2.20.1 (Apple Git-117) >> Cheers, Kevin D-B gpg: 012C ACB2 28C6 C53E 9775 9123 B3A2 389B 9DE2 334A
diff --git a/include/uapi/linux/netfilter/xt_connmark.h b/include/uapi/linux/netfilter/xt_connmark.h index 1aa5c955ee1e..24272cac2d37 100644 --- a/include/uapi/linux/netfilter/xt_connmark.h +++ b/include/uapi/linux/netfilter/xt_connmark.h @@ -16,7 +16,8 @@ enum { XT_CONNMARK_SET = 0, XT_CONNMARK_SAVE, - XT_CONNMARK_RESTORE + XT_CONNMARK_RESTORE, + XT_CONNMARK_SAVEDSCP }; enum { diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c index 29c38aa7f726..6c63cf476342 100644 --- a/net/netfilter/xt_connmark.c +++ b/net/netfilter/xt_connmark.c @@ -42,6 +42,7 @@ connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info) u_int32_t new_targetmark; struct nf_conn *ct; u_int32_t newmark; + u8 dscp; ct = nf_ct_get(skb, &ctinfo); if (ct == NULL) @@ -74,6 +75,34 @@ connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info) nf_conntrack_event_cache(IPCT_MARK, ct); } break; + case XT_CONNMARK_SAVEDSCP: + if (!info->ctmark) + goto out; + + if (skb->protocol == htons(ETH_P_IP)) { + if (skb->len < sizeof(struct iphdr)) + goto out; + + dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2; + + } else if (skb->protocol == htons(ETH_P_IPV6)) { + if (skb->len < sizeof(struct ipv6hdr)) + goto out; + + dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2; + + } else { /* protocol doesn't have diffserv - get out! */ + goto out; + } + + newmark = (ct->mark & ~info->ctmark) ^ + (info->ctmask | (dscp << info->shift_bits)); + + if (ct->mark != newmark) { + ct->mark = newmark; + nf_conntrack_event_cache(IPCT_MARK, ct); + } + break; case XT_CONNMARK_RESTORE: new_targetmark = (ct->mark & info->ctmask); if (info->shift_dir == D_SHIFT_RIGHT) @@ -86,6 +115,7 @@ connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info) skb->mark = newmark; break; } +out: return XT_CONTINUE; }
savedscp is a method of storing the DSCP of an ip packet into conntrack mark. In combination with a suitable tc filter action (act_ctinfo) DSCP values are able to be stored in the mark on egress and restored on ingress across links that otherwise alter or bleach DSCP. This is useful for qdiscs such as CAKE which are able to shape according to policies based on DSCP. Ingress classification is traditionally a challenging task since iptables rules haven't yet run and tc filter/eBPF programs are pre-NAT lookups, hence are unable to see internal IPv4 addresses as used on the typical home masquerading gateway. x_tables CONNMARK savedscp action solves the problem of storing the DSCP to the conntrack mark in a way suitable for the new act_ctinfo tc action to restore. The savedsp option accepts 2 parameters, a 32bit 'dscpmask' and a 32bit 'statemask'. The dscp mask must be a minimum of 6 contiguous bits and represents the area where the DSCP will be stored in the connmark. The state mask is a minimum 1 bit length mask that must not overlap with the dscpmask. It represents a flag which is set when the DSCP has been stored in the conntrack mark. This is useful to implement a 'one shot' iptables based classification where the 'complicated' iptables rules are only run once to classify the connection on initial (egress) packet and subsequent packets are all marked/restored with the same DSCP. A state mask of zero disables the setting of a status bit/s. example syntax with a suitably modified iptables user space application: iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --savedscp-mark 0xfc000000/0x01000000 Would store the DSCP in the top 6 bits of the 32bit mark field, and use the LSB of the top byte as the 'DSCP has been stored' marker. |----0xFC----conntrack mark----000000---| | Bits 31-26 | bit 25 | bit24 |~~~ Bit 0| | DSCP | unused | flag |unused | |-----------------------0x01---000000---| ^ ^ | | ---| Conditional flag | set this when dscp |-ip diffserv-| stored in mark | 6 bits | |-------------| an identically configured tc action to restore looks like: tc filter show dev eth0 ingress filter parent ffff: protocol all pref 10 u32 chain 0 filter parent ffff: protocol all pref 10 u32 chain 0 fh 800: ht divisor 1 filter parent ffff: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:1 not_in_hw match 00000000/00000000 at 0 action order 1: ctinfo zone 0 pipe index 2 ref 1 bind 1 dscp 0xfc000000/0x1000000 action order 2: mirred (Egress Redirect to device ifb4eth0) stolen index 1 ref 1 bind 1 |----0xFC----conntrack mark----000000---| | Bits 31-26 | bit 25 | bit24 |~~~ Bit 0| | DSCP | unused | flag |unused | |-----------------------0x01---000000---| | | | | ---| Conditional flag v only restore if set |-ip diffserv-| | 6 bits | |-------------| Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> --- v2 - reword commit message swap the dscpmask/statemask order so it matches the tc action order this also matches the value[/mask] convention in that dscpmask is non optional whereas the statemask is optional. include/uapi/linux/netfilter/xt_connmark.h | 3 ++- net/netfilter/xt_connmark.c | 30 ++++++++++++++++++++++ 2 files changed, 32 insertions(+), 1 deletion(-)