From patchwork Sun Apr 15 23:37:09 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jack Ma X-Patchwork-Id: 898355 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=alliedtelesis.co.nz Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=alliedtelesis.co.nz header.i=@alliedtelesis.co.nz header.b="Ni2Adg1Z"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40PSbl0KgZz9s0b for ; Mon, 16 Apr 2018 09:37:22 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751931AbeDOXhV (ORCPT ); Sun, 15 Apr 2018 19:37:21 -0400 Received: from gate2.alliedtelesis.co.nz ([202.36.163.20]:46003 "EHLO gate2.alliedtelesis.co.nz" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751799AbeDOXhU (ORCPT ); Sun, 15 Apr 2018 19:37:20 -0400 Received: from mmarshal3.atlnz.lc (mmarshal3.atlnz.lc [10.32.18.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by gate2.alliedtelesis.co.nz (Postfix) with ESMTPS id 6EA018364E; Mon, 16 Apr 2018 11:37:18 +1200 (NZST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alliedtelesis.co.nz; s=mail; t=1523835438; bh=xJ/0m2HSJf8rkSz8L2EuQVDx92F48sWa9mIMUQnoknw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Ni2Adg1Zqp3BbJADsAo1jGa6NwETT9Y/87bXB1ll+jQzwS+nHC1T1nwZJNJnppnGf A72VkHlG0moxKjloLL7UmRo3sosbrLM5MpsC8Sgi2yxH+434m1y15SYMVBByXV3AJ0 CtfoQChzh60fIoFTErZD0T6C/e0bH882zQRx6f/A= Received: from smtp (Not Verified[10.32.16.33]) by mmarshal3.atlnz.lc with Trustwave SEG (v7, 5, 8, 10121) id ; Mon, 16 Apr 2018 11:37:17 +1200 Received: from jackm-dl.ws.atlnz.lc (jackm-dl.ws.atlnz.lc [10.33.21.13]) by smtp (Postfix) with ESMTP id 598D213ED1C; Mon, 16 Apr 2018 11:37:16 +1200 (NZST) Received: by jackm-dl.ws.atlnz.lc (Postfix, from userid 1748) id 1BFFAA3D3C; Mon, 16 Apr 2018 11:37:16 +1200 (NZST) From: Jack Ma To: netfilter-devel@vger.kernel.org Cc: fw@strlen.de, pablo@netfilter.org, Jack Ma Subject: [PATCH v3] libxt_CONNMARK: Support bit-shifting for --restore, set and save-mark Date: Mon, 16 Apr 2018 11:37:09 +1200 Message-Id: <20180415233709.5939-1-jack.ma@alliedtelesis.co.nz> X-Mailer: git-send-email 2.13.0 In-Reply-To: <20180409004333.5597-1-jack.ma@alliedtelesis.co.nz> References: <20180409004333.5597-1-jack.ma@alliedtelesis.co.nz> Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org This patch adds a new feature to iptables that allow bitshifting for --restore,set and save-mark operations. This allows existing logic operators (and, or and xor) and mask to co-operate with new bitshift operations. The intention is to provide uses with more fexible uses of skb->mark and ct->mark. For example, users can save extra bits in skb->mark: skb->mark = ct->mark << 8; Reviewed-by: Florian Westphal Signed-off-by: Jack Ma --- extensions/libxt_CONNMARK.c | 286 ++++++++++++++++++++++++++++++++-- include/linux/netfilter/xt_connmark.h | 5 + 2 files changed, 279 insertions(+), 12 deletions(-) diff --git a/extensions/libxt_CONNMARK.c b/extensions/libxt_CONNMARK.c index 94984cdc..499c0b61 100644 --- a/extensions/libxt_CONNMARK.c +++ b/extensions/libxt_CONNMARK.c @@ -32,30 +32,42 @@ struct xt_connmark_target_info { }; enum { + D_SHIFT_LEFT = 0, + D_SHIFT_RIGHT, +}; + +enum { O_SET_MARK = 0, O_SAVE_MARK, O_RESTORE_MARK, O_AND_MARK, O_OR_MARK, O_XOR_MARK, + O_LEFT_SHIFT_MARK, + O_RIGHT_SHIFT_MARK, O_SET_XMARK, O_CTMASK, O_NFMASK, O_MASK, - F_SET_MARK = 1 << O_SET_MARK, - F_SAVE_MARK = 1 << O_SAVE_MARK, - F_RESTORE_MARK = 1 << O_RESTORE_MARK, - F_AND_MARK = 1 << O_AND_MARK, - F_OR_MARK = 1 << O_OR_MARK, - F_XOR_MARK = 1 << O_XOR_MARK, - F_SET_XMARK = 1 << O_SET_XMARK, - F_CTMASK = 1 << O_CTMASK, - F_NFMASK = 1 << O_NFMASK, - F_MASK = 1 << O_MASK, - F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK | - F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK, + F_SET_MARK = 1 << O_SET_MARK, + F_SAVE_MARK = 1 << O_SAVE_MARK, + F_RESTORE_MARK = 1 << O_RESTORE_MARK, + F_AND_MARK = 1 << O_AND_MARK, + F_OR_MARK = 1 << O_OR_MARK, + F_XOR_MARK = 1 << O_XOR_MARK, + F_LEFT_SHIFT_MARK = 1 << O_LEFT_SHIFT_MARK, + F_RIGHT_SHIFT_MARK = 1 << O_RIGHT_SHIFT_MARK, + F_SET_XMARK = 1 << O_SET_XMARK, + F_CTMASK = 1 << O_CTMASK, + F_NFMASK = 1 << O_NFMASK, + F_MASK = 1 << O_MASK, + F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK | + F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK, }; +static const char *const xt_connmark_shift_ops[] = + { "left-shift-mark", "right-shift-mark" }; + static void CONNMARK_help(void) { printf( @@ -104,6 +116,36 @@ static const struct xt_option_entry connmark_tg_opts[] = { }; #undef s +#define s struct xt_connmark_tginfo2 +static const struct xt_option_entry connmark_tg_opts_v2[] = { + {.name = "set-xmark", .id = O_SET_XMARK, .type = XTTYPE_MARKMASK32, + .excl = F_OP_ANY}, + {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, + .excl = F_OP_ANY}, + {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32, + .excl = F_OP_ANY}, + {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32, + .excl = F_OP_ANY}, + {.name = "xor-mark", .id = O_XOR_MARK, .type = XTTYPE_UINT32, + .excl = F_OP_ANY}, + {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE, + .excl = F_OP_ANY}, + {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE, + .excl = F_OP_ANY}, + {.name = "left-shift-mark", .id = O_LEFT_SHIFT_MARK, .type = XTTYPE_UINT8, + .min = 0, .max = 32}, + {.name = "right-shift-mark", .id = O_RIGHT_SHIFT_MARK, .type = XTTYPE_UINT8, + .min = 0, .max = 32}, + {.name = "ctmask", .id = O_CTMASK, .type = XTTYPE_UINT32, + .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, ctmask)}, + {.name = "nfmask", .id = O_NFMASK, .type = XTTYPE_UINT32, + .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, nfmask)}, + {.name = "mask", .id = O_MASK, .type = XTTYPE_UINT32, + .excl = F_CTMASK | F_NFMASK}, + XTOPT_TABLEEND, +}; +#undef s + static void connmark_tg_help(void) { printf( @@ -122,6 +164,15 @@ static void connmark_tg_help(void) ); } +static void connmark_tg_help_v2(void) +{ + connmark_tg_help(); + printf( +" --left-shift-mark value Left shift the ctmark with bits\n" +" --right-shift-mark value Right shift the ctmark with bits\n" +); +} + static void connmark_tg_init(struct xt_entry_target *target) { struct xt_connmark_tginfo1 *info = (void *)target->data; @@ -134,6 +185,18 @@ static void connmark_tg_init(struct xt_entry_target *target) info->nfmask = UINT32_MAX; } +static void connmark_tg_init_v2(struct xt_entry_target *target) +{ + struct xt_connmark_tginfo2 *info; + + connmark_tg_init(target); + info = (void *)target->data; + + /* Left shift by zero bit by default. */ + info->shift_dir = D_SHIFT_LEFT; + info->shift_bits = 0; +} + static void CONNMARK_parse(struct xt_option_call *cb) { struct xt_connmark_target_info *markinfo = cb->data; @@ -197,6 +260,62 @@ static void connmark_tg_parse(struct xt_option_call *cb) case O_MASK: info->nfmask = info->ctmask = cb->val.u32; break; + default: + break; + } +} + +static void connmark_tg_parse_v2(struct xt_option_call *cb) +{ + struct xt_connmark_tginfo2 *info = cb->data; + struct xt_connmark_tginfo1 *info1 = cb->data; + + xtables_option_parse(cb); + switch (cb->entry->id) { + case O_SET_XMARK: + info->mode = XT_CONNMARK_SET; + info->ctmark = cb->val.mark; + info->ctmask = cb->val.mask; + break; + case O_SET_MARK: + info->mode = XT_CONNMARK_SET; + info->ctmark = cb->val.mark; + info->ctmask = cb->val.mark | cb->val.mask; + break; + case O_AND_MARK: + info->mode = XT_CONNMARK_SET; + info->ctmark = 0; + info->ctmask = ~cb->val.u32; + break; + case O_OR_MARK: + info->mode = XT_CONNMARK_SET; + info->ctmark = cb->val.u32; + info->ctmask = cb->val.u32; + break; + case O_XOR_MARK: + info->mode = XT_CONNMARK_SET; + info->ctmark = cb->val.u32; + info->ctmask = 0; + break; + case O_SAVE_MARK: + info->mode = XT_CONNMARK_SAVE; + break; + case O_RESTORE_MARK: + info->mode = XT_CONNMARK_RESTORE; + break; + case O_MASK: + info->nfmask = info->ctmask = cb->val.u32; + break; + case O_LEFT_SHIFT_MARK: + info->shift_dir = D_SHIFT_LEFT; + info->shift_bits = cb->val.u8; + break; + case O_RIGHT_SHIFT_MARK: + info->shift_dir = D_SHIFT_RIGHT; + info->shift_bits = cb->val.u8; + break; + default: + break; } } @@ -291,6 +410,57 @@ connmark_tg_print(const void *ip, const struct xt_entry_target *target, } } +static void +connmark_tg_print_v2(const void *ip, const struct xt_entry_target *target, + int numeric) +{ + const struct xt_connmark_tginfo2 *info = (const void *)target->data; + const char *shift_op = xt_connmark_shift_ops[info->shift_dir]; + + switch (info->mode) { + case XT_CONNMARK_SET: + if (info->ctmark == 0) + printf(" CONNMARK and 0x%x", + (unsigned int)(uint32_t)~info->ctmask); + else if (info->ctmark == info->ctmask) + printf(" CONNMARK or 0x%x", info->ctmark); + else if (info->ctmask == 0) + printf(" CONNMARK xor 0x%x", info->ctmark); + else if (info->ctmask == 0xFFFFFFFFU) + printf(" CONNMARK set 0x%x", info->ctmark); + else + printf(" CONNMARK xset 0x%x/0x%x", + info->ctmark, info->ctmask); + break; + case XT_CONNMARK_SAVE: + if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX) + printf(" CONNMARK save"); + else if (info->nfmask == info->ctmask) + printf(" CONNMARK save mask 0x%x", info->nfmask); + else + printf(" CONNMARK save nfmask 0x%x ctmask ~0x%x", + info->nfmask, info->ctmask); + break; + case XT_CONNMARK_RESTORE: + if (info->ctmask == UINT32_MAX && info->nfmask == UINT32_MAX) + printf(" CONNMARK restore"); + else if (info->ctmask == info->nfmask) + printf(" CONNMARK restore mask 0x%x", info->ctmask); + else + printf(" CONNMARK restore ctmask 0x%x nfmask ~0x%x", + info->ctmask, info->nfmask); + break; + + default: + printf(" ERROR: UNKNOWN CONNMARK MODE"); + break; + } + + if (info->mode <= XT_CONNMARK_RESTORE) { + printf(" %s %d",shift_op, info->shift_bits); + } +} + static void CONNMARK_save(const void *ip, const struct xt_entry_target *target) { const struct xt_connmark_target_info *markinfo = @@ -347,6 +517,34 @@ connmark_tg_save(const void *ip, const struct xt_entry_target *target) } } +static void +connmark_tg_save_v2(const void *ip, const struct xt_entry_target *target) +{ + const struct xt_connmark_tginfo2 *info = (const void *)target->data; + const char *shift_op = xt_connmark_shift_ops[info->shift_dir]; + + switch (info->mode) { + case XT_CONNMARK_SET: + printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask); + break; + case XT_CONNMARK_SAVE: + printf(" --save-mark --nfmask 0x%x --ctmask 0x%x", + info->nfmask, info->ctmask); + break; + case XT_CONNMARK_RESTORE: + printf(" --restore-mark --nfmask 0x%x --ctmask 0x%x", + info->nfmask, info->ctmask); + break; + default: + printf(" ERROR: UNKNOWN CONNMARK MODE"); + break; + } + + if (info->mode <= XT_CONNMARK_RESTORE) { + printf(" --%s %d",shift_op, info->shift_bits); + } +} + static int connmark_tg_xlate(struct xt_xlate *xl, const struct xt_xlate_tg_params *params) { @@ -389,6 +587,54 @@ static int connmark_tg_xlate(struct xt_xlate *xl, return 1; } +static int connmark_tg_xlate_v2(struct xt_xlate *xl, + const struct xt_xlate_tg_params *params) +{ + const struct xt_connmark_tginfo2 *info = + (const void *)params->target->data; + const char *shift_op = xt_connmark_shift_ops[info->shift_dir]; + + switch (info->mode) { + case XT_CONNMARK_SET: + xt_xlate_add(xl, "ct mark set "); + if (info->ctmark == 0) + xt_xlate_add(xl, "ct mark and 0x%x", ~info->ctmask); + else if (info->ctmark == info->ctmask) + xt_xlate_add(xl, "ct mark or 0x%x", + info->ctmark); + else if (info->ctmask == 0) + xt_xlate_add(xl, "ct mark xor 0x%x", + info->ctmark); + else if (info->ctmask == 0xFFFFFFFFU) + xt_xlate_add(xl, "0x%x ", info->ctmark); + else + xt_xlate_add(xl, "ct mark xor 0x%x and 0x%x", + info->ctmark, ~info->ctmask); + break; + case XT_CONNMARK_SAVE: + xt_xlate_add(xl, "ct mark set mark"); + if (!(info->nfmask == UINT32_MAX && + info->ctmask == UINT32_MAX)) { + if (info->nfmask == info->ctmask) + xt_xlate_add(xl, " and 0x%x", info->nfmask); + } + break; + case XT_CONNMARK_RESTORE: + xt_xlate_add(xl, "meta mark set ct mark"); + if (!(info->nfmask == UINT32_MAX && + info->ctmask == UINT32_MAX)) { + if (info->nfmask == info->ctmask) + xt_xlate_add(xl, " and 0x%x", info->nfmask); + } + break; + } + + if (info->mode <= XT_CONNMARK_RESTORE) { + xt_xlate_add(xl, " %s %d", shift_op, info->shift_bits); + } + + return 1; +} static struct xtables_target connmark_tg_reg[] = { { .family = NFPROTO_UNSPEC, @@ -421,6 +667,22 @@ static struct xtables_target connmark_tg_reg[] = { .x6_options = connmark_tg_opts, .xlate = connmark_tg_xlate, }, + { + .version = XTABLES_VERSION, + .name = "CONNMARK", + .revision = 2, + .family = NFPROTO_UNSPEC, + .size = XT_ALIGN(sizeof(struct xt_connmark_tginfo2)), + .userspacesize = XT_ALIGN(sizeof(struct xt_connmark_tginfo2)), + .help = connmark_tg_help_v2, + .init = connmark_tg_init_v2, + .print = connmark_tg_print_v2, + .save = connmark_tg_save_v2, + .x6_parse = connmark_tg_parse_v2, + .x6_fcheck = connmark_tg_check, + .x6_options = connmark_tg_opts_v2, + .xlate = connmark_tg_xlate_v2, + }, }; void _init(void) diff --git a/include/linux/netfilter/xt_connmark.h b/include/linux/netfilter/xt_connmark.h index efc17a83..bbf2acc9 100644 --- a/include/linux/netfilter/xt_connmark.h +++ b/include/linux/netfilter/xt_connmark.h @@ -23,6 +23,11 @@ struct xt_connmark_tginfo1 { __u8 mode; }; +struct xt_connmark_tginfo2 { + __u32 ctmark, ctmask, nfmask; + __u8 shift_dir, shift_bits, mode; +}; + struct xt_connmark_mtinfo1 { __u32 mark, mask; __u8 invert;