@@ -105,7 +105,11 @@ struct nf_conn {
#if defined(CONFIG_NF_CONNTRACK_MARK)
u_int32_t mark;
-#endif
+
+#ifdef CONFIG_NET_SCHED
+ u_int16_t tc_index;
+#endif /* CONFIG_NET_SCHED */
+#endif /* CONFIG_NF_CONNTRACK_MARK */
#ifdef CONFIG_NF_CONNTRACK_SECMARK
u_int32_t secmark;
@@ -22,6 +22,7 @@ header-y += xt_CHECKSUM.h
header-y += xt_CLASSIFY.h
header-y += xt_CONNMARK.h
header-y += xt_CONNSECMARK.h
+header-y += xt_CONNTCINDEX.h
header-y += xt_CT.h
header-y += xt_DSCP.h
header-y += xt_HMARK.h
@@ -33,6 +34,7 @@ header-y += xt_NFLOG.h
header-y += xt_NFQUEUE.h
header-y += xt_RATEEST.h
header-y += xt_SECMARK.h
+header-y += xt_TCINDEX.h
header-y += xt_TCPMSS.h
header-y += xt_TCPOPTSTRIP.h
header-y += xt_TEE.h
@@ -46,6 +48,7 @@ header-y += xt_connbytes.h
header-y += xt_connlabel.h
header-y += xt_connlimit.h
header-y += xt_connmark.h
+header-y += xt_conntcindex.h
header-y += xt_conntrack.h
header-y += xt_cpu.h
header-y += xt_dccp.h
@@ -81,6 +84,7 @@ header-y += xt_socket.h
header-y += xt_state.h
header-y += xt_statistic.h
header-y += xt_string.h
+header-y += xt_tcindex.h
header-y += xt_tcpmss.h
header-y += xt_tcpudp.h
header-y += xt_time.h
@@ -107,6 +107,7 @@ enum ip_conntrack_events {
IPCT_NATSEQADJ = IPCT_SEQADJ,
IPCT_SECMARK, /* new security mark has been set */
IPCT_LABEL, /* new connlabel has been set */
+ IPCT_TCINDEX, /* new tc_index has been set */
};
enum ip_conntrack_expect_events {
@@ -53,6 +53,7 @@ enum ctattr_type {
CTA_MARK_MASK,
CTA_LABELS,
CTA_LABELS_MASK,
+ CTA_TC_INDEX,
__CTA_MAX
};
#define CTA_MAX (__CTA_MAX - 1)
new file mode 100644
@@ -0,0 +1,6 @@
+#ifndef _XT_CONNTCINDEX_H_target
+#define _XT_CONNTCINDEX_H_target
+
+#include <linux/netfilter/xt_conntcindex.h>
+
+#endif /*_XT_CONNTCINDEX_H_target*/
new file mode 100644
@@ -0,0 +1,6 @@
+#ifndef _XT_TCINDEX_H_target
+#define _XT_TCINDEX_H_target
+
+#include <linux/netfilter/xt_tcindex.h>
+
+#endif /*_XT_TCINDEX_H_target */
new file mode 100644
@@ -0,0 +1,31 @@
+#ifndef _XT_CONNTCINDEX_H
+#define _XT_CONNTCINDEX_H
+
+#include <linux/types.h>
+
+/* Copyright (C) 2015 Allied Telesis Labs NZ
+ * by Luuk Paulussen <luuk.paulussen@alliedtelesis.co.nz>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+enum {
+ XT_CONNTCINDEX_SET = 0,
+ XT_CONNTCINDEX_SAVE,
+ XT_CONNTCINDEX_RESTORE
+};
+
+struct xt_conntcindex_tginfo1 {
+ __u16 ctmark, ctmask, nfmask;
+ __u8 mode;
+};
+
+struct xt_conntcindex_mtinfo1 {
+ __u16 mark, mask;
+ __u8 invert;
+};
+
+#endif /*_XT_CONNTCINDEX_H*/
new file mode 100644
@@ -0,0 +1,15 @@
+#ifndef _XT_TCINDEX_H
+#define _XT_TCINDEX_H
+
+#include <linux/types.h>
+
+struct xt_tcindex_tginfo1 {
+ __u16 mark, mask;
+};
+
+struct xt_tcindex_mtinfo1 {
+ __u16 mark, mask;
+ __u8 invert;
+};
+
+#endif /*_XT_TCINDEX_H*/
@@ -603,6 +603,36 @@ config NETFILTER_XT_CONNMARK
ctmark), similarly to the packet mark (nfmark). Using this
target and match, you can set and match on this mark.
+config NETFILTER_XT_TCINDEX
+ tristate 'tc_index mark target and match support'
+ depends on NETFILTER_ADVANCED
+ depends on NET_SCHED
+ default n
+ ---help---
+ This option adds the "TCINDEX" target and "tcindex" match.
+
+ tcindex matching allows you to match packets based on the "tc_index" value
+ in the packet.
+ The target allows you to create rules in the "mangle" table which alter
+ the tc_index field associated with the packet.
+
+ This is an alternative to setting the tc_index field based on the priority
+ fields of the incoming traffic. In traffic control, this mark can be matched
+ using the tcindex filter.
+
+config NETFILTER_XT_CONNTCINDEX
+ tristate 'ct tc_index mark target and match support'
+ depends on NF_CONNTRACK
+ depends on NF_CONNTRACK_MARK
+ depends on NETFILTER_ADVANCED
+ depends on NET_SCHED
+ default n
+ ---help---
+ This option adds the "CONNTCINDEX" target and "conntcindex" match.
+
+ Using this target and match, you can set and match on the tc_index mark in the
+ connection. This can also be saved/restored to the packet tc_index mark.
+
config NETFILTER_XT_SET
tristate 'set target and match support'
depends on IP_SET
@@ -96,6 +96,8 @@ obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
# combos
obj-$(CONFIG_NETFILTER_XT_MARK) += xt_mark.o
obj-$(CONFIG_NETFILTER_XT_CONNMARK) += xt_connmark.o
+obj-$(CONFIG_NETFILTER_XT_TCINDEX) += xt_tcindex.o
+obj-$(CONFIG_NETFILTER_XT_CONNTCINDEX) += xt_conntcindex.o
obj-$(CONFIG_NETFILTER_XT_SET) += xt_set.o
obj-$(CONFIG_NETFILTER_XT_NAT) += xt_nat.o
@@ -314,6 +314,21 @@ nla_put_failure:
#define ctnetlink_dump_mark(a, b) (0)
#endif
+#if defined CONFIG_NET_SCHED && defined CONFIG_NF_CONNTRACK_MARK
+static inline int
+ctnetlink_dump_tcindex(struct sk_buff *skb, const struct nf_conn *ct)
+{
+ if (nla_put_be16(skb, CTA_TC_INDEX, htonl(ct->tc_index)))
+ goto nla_put_failure;
+ return 0;
+
+nla_put_failure:
+ return -1;
+}
+#else
+#define ctnetlink_dump_tcindex(a, b) (0)
+#endif
+
#ifdef CONFIG_NF_CONNTRACK_SECMARK
static inline int
ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
@@ -521,6 +536,7 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
ctnetlink_dump_protoinfo(skb, ct) < 0 ||
ctnetlink_dump_helpinfo(skb, ct) < 0 ||
ctnetlink_dump_mark(skb, ct) < 0 ||
+ ctnetlink_dump_tcindex(skb, ct) < 0 ||
ctnetlink_dump_secctx(skb, ct) < 0 ||
ctnetlink_dump_labels(skb, ct) < 0 ||
ctnetlink_dump_id(skb, ct) < 0 ||
@@ -749,7 +765,13 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
if ((events & (1 << IPCT_MARK) || ct->mark)
&& ctnetlink_dump_mark(skb, ct) < 0)
goto nla_put_failure;
-#endif
+
+#ifdef CONFIG_NET_SCHED
+ if ((events & (1 << IPCT_TCINDEX) || ct->tc_index) &&
+ ctnetlink_dump_tcindex(skb, ct) < 0)
+ goto nla_put_failure;
+#endif /* CONFIG_NET_SCHED */
+#endif /* CONFIG_NF_CONNTRACK_MARK */
rcu_read_unlock();
nlmsg_end(skb, nlh);
@@ -1092,6 +1114,7 @@ static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {
.len = NF_CT_LABELS_MAX_SIZE },
[CTA_LABELS_MASK] = { .type = NLA_BINARY,
.len = NF_CT_LABELS_MAX_SIZE },
+ [CTA_TC_INDEX] = { .type = NLA_U16 },
};
static int ctnetlink_flush_conntrack(struct net *net,
@@ -1697,7 +1720,12 @@ ctnetlink_change_conntrack(struct nf_conn *ct,
#if defined(CONFIG_NF_CONNTRACK_MARK)
if (cda[CTA_MARK])
ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
-#endif
+#ifdef CONFIG_NET_SCHED
+ if (cda[CTA_TC_INDEX])
+ ct->tc_index = ntohs(nla_get_be16(cda[CTA_TC_INDEX]));
+#endif /* CONFIG_NET_SCHED */
+#endif /* CONFIG_NF_CONNTRACK_MARK */
+
if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) {
err = ctnetlink_change_seq_adj(ct, cda);
@@ -1824,7 +1852,11 @@ ctnetlink_create_conntrack(struct net *net,
#if defined(CONFIG_NF_CONNTRACK_MARK)
if (cda[CTA_MARK])
ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
-#endif
+#ifdef CONFIG_NET_SCHED
+ if (cda[CTA_TC_INDEX])
+ ct->tc_index = ntohs(nla_get_be16(cda[CTA_TC_INDEX]));
+#endif /* CONFIG_NET_SCHED */
+#endif /* CONFIG_NF_CONNTRACK_MARK */
/* setup master conntrack: this is a confirmed expectation */
if (cda[CTA_TUPLE_MASTER]) {
new file mode 100644
@@ -0,0 +1,165 @@
+/*
+ * xt_conntcindex - Netfilter module to operate on connection tc_index marks
+ *
+ * Copyright (C) 2015 Allied Telesis Labs NZ
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ *
+ * Heavily based on xt_connmark.c
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_ecache.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_conntcindex.h>
+
+MODULE_AUTHOR("Luuk Paulussen <luuk.paulussen@alliedtelesis.co.nz>");
+MODULE_DESCRIPTION("Xtables: connection tc_index mark operations");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_CONNTCINDEX");
+MODULE_ALIAS("ip6t_CONNTCINDEX");
+MODULE_ALIAS("ipt_conntcindex");
+MODULE_ALIAS("ip6t_conntcindex");
+
+static unsigned int
+conntcindex_tg(struct sk_buff *skb, const struct xt_action_param *par)
+{
+ const struct xt_conntcindex_tginfo1 *info = par->targinfo;
+ enum ip_conntrack_info ctinfo;
+ struct nf_conn *ct;
+ u32 newmark;
+
+ ct = nf_ct_get(skb, &ctinfo);
+ if (!ct)
+ return XT_CONTINUE;
+
+ switch (info->mode) {
+ case XT_CONNTCINDEX_SET:
+ newmark = (ct->tc_index & ~info->ctmask) ^ info->ctmark;
+ if (ct->tc_index != newmark) {
+ ct->tc_index = newmark;
+ nf_conntrack_event_cache(IPCT_TCINDEX, ct);
+ }
+ break;
+ case XT_CONNTCINDEX_SAVE:
+ newmark = (ct->tc_index & ~info->ctmask) ^
+ (skb->tc_index & info->nfmask);
+ if (ct->tc_index != newmark) {
+ ct->tc_index = newmark;
+ nf_conntrack_event_cache(IPCT_TCINDEX, ct);
+ }
+ break;
+ case XT_CONNTCINDEX_RESTORE:
+ newmark = (skb->tc_index & ~info->nfmask) ^
+ (ct->tc_index & info->ctmask);
+ skb->tc_index = newmark;
+ break;
+ }
+
+ return XT_CONTINUE;
+}
+
+static int conntcindex_tg_check(const struct xt_tgchk_param *par)
+{
+ int ret;
+
+ ret = nf_ct_l3proto_try_module_get(par->family);
+ if (ret < 0)
+ pr_info("cannot load conntrack support for proto=%u\n",
+ par->family);
+ return ret;
+}
+
+static void conntcindex_tg_destroy(const struct xt_tgdtor_param *par)
+{
+ nf_ct_l3proto_module_put(par->family);
+}
+
+static bool
+conntcindex_mt(const struct sk_buff *skb, struct xt_action_param *par)
+{
+ const struct xt_conntcindex_mtinfo1 *info = par->matchinfo;
+ enum ip_conntrack_info ctinfo;
+ const struct nf_conn *ct;
+
+ ct = nf_ct_get(skb, &ctinfo);
+ if (!ct)
+ return false;
+
+ return ((ct->tc_index & info->mask) == info->mark) ^ info->invert;
+}
+
+static int conntcindex_mt_check(const struct xt_mtchk_param *par)
+{
+ int ret;
+
+ ret = nf_ct_l3proto_try_module_get(par->family);
+ if (ret < 0)
+ pr_info("cannot load conntrack support for proto=%u\n",
+ par->family);
+ return ret;
+}
+
+static void conntcindex_mt_destroy(const struct xt_mtdtor_param *par)
+{
+ nf_ct_l3proto_module_put(par->family);
+}
+
+static struct xt_target conntcindex_tg_reg __read_mostly = {
+ .name = "CONNTCINDEX",
+ .revision = 1,
+ .family = NFPROTO_UNSPEC,
+ .checkentry = conntcindex_tg_check,
+ .target = conntcindex_tg,
+ .targetsize = sizeof(struct xt_conntcindex_tginfo1),
+ .destroy = conntcindex_tg_destroy,
+ .me = THIS_MODULE,
+};
+
+static struct xt_match conntcindex_mt_reg __read_mostly = {
+ .name = "conntcindex",
+ .revision = 1,
+ .family = NFPROTO_UNSPEC,
+ .checkentry = conntcindex_mt_check,
+ .match = conntcindex_mt,
+ .matchsize = sizeof(struct xt_conntcindex_mtinfo1),
+ .destroy = conntcindex_mt_destroy,
+ .me = THIS_MODULE,
+};
+
+static int __init conntcindex_mt_init(void)
+{
+ int ret;
+
+ ret = xt_register_target(&conntcindex_tg_reg);
+ if (ret < 0)
+ return ret;
+ ret = xt_register_match(&conntcindex_mt_reg);
+ if (ret < 0) {
+ xt_unregister_target(&conntcindex_tg_reg);
+ return ret;
+ }
+ return 0;
+}
+
+static void __exit conntcindex_mt_exit(void)
+{
+ xt_unregister_match(&conntcindex_mt_reg);
+ xt_unregister_target(&conntcindex_tg_reg);
+}
+
+module_init(conntcindex_mt_init);
+module_exit(conntcindex_mt_exit);
new file mode 100644
@@ -0,0 +1,84 @@
+/*
+ * xt_tcindex - Netfilter module to match/tag on tc_index mark value
+ *
+ * (C) 2015 Allied Telesis Labs NZ.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Heavily based on xt_mark.c
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+
+#include <linux/netfilter/xt_tcindex.h>
+#include <linux/netfilter/x_tables.h>
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Luuk Paulussen <luuk.paulussen@alliedtelesis.co.nz>");
+MODULE_DESCRIPTION("Xtables: packet tc_index mark operations");
+MODULE_ALIAS("ipt_tcindex");
+MODULE_ALIAS("ip6t_tcindex");
+MODULE_ALIAS("ipt_TCINDEX");
+MODULE_ALIAS("ip6t_TCINDEX");
+
+static unsigned int
+tcindex_tg(struct sk_buff *skb, const struct xt_action_param *par)
+{
+ const struct xt_tcindex_tginfo1 *info = par->targinfo;
+
+ skb->tc_index = (skb->tc_index & ~info->mask) ^ info->mark;
+ return XT_CONTINUE;
+}
+
+static bool
+tcindex_mt(const struct sk_buff *skb, struct xt_action_param *par)
+{
+ const struct xt_tcindex_mtinfo1 *info = par->matchinfo;
+
+ return ((skb->tc_index & info->mask) == info->mark) ^ info->invert;
+}
+
+static struct xt_target tcindex_tg_reg __read_mostly = {
+ .name = "TCINDEX",
+ .revision = 1,
+ .family = NFPROTO_UNSPEC,
+ .target = tcindex_tg,
+ .targetsize = sizeof(struct xt_tcindex_tginfo1),
+ .me = THIS_MODULE,
+};
+
+static struct xt_match tcindex_mt_reg __read_mostly = {
+ .name = "tcindex",
+ .revision = 1,
+ .family = NFPROTO_UNSPEC,
+ .match = tcindex_mt,
+ .matchsize = sizeof(struct xt_tcindex_mtinfo1),
+ .me = THIS_MODULE,
+};
+
+static int __init tcindex_mt_init(void)
+{
+ int ret;
+
+ ret = xt_register_target(&tcindex_tg_reg);
+ if (ret < 0)
+ return ret;
+ ret = xt_register_match(&tcindex_mt_reg);
+ if (ret < 0) {
+ xt_unregister_target(&tcindex_tg_reg);
+ return ret;
+ }
+ return 0;
+}
+
+static void __exit tcindex_mt_exit(void)
+{
+ xt_unregister_match(&tcindex_mt_reg);
+ xt_unregister_target(&tcindex_tg_reg);
+}
+
+module_init(tcindex_mt_init);
+module_exit(tcindex_mt_exit);