@@ -61,6 +61,7 @@ ct mark set 0x11;ok;ct mark set 0x00000011
ct mark set mark;ok;ct mark set meta mark
ct mark set (meta mark | 0x10) << 8;ok;ct mark set (meta mark | 0x00000010) << 8
ct mark set mark map { 1 : 10, 2 : 20, 3 : 30 };ok;ct mark set meta mark map { 0x00000003 : 0x0000001e, 0x00000002 : 0x00000014, 0x00000001 : 0x0000000a}
+ct mark set ct mark and 0xffff0000 or meta mark and 0xffff;ok;ct mark set ct mark & 0xffff0000 | meta mark & 0x0000ffff
ct mark set {0x11333, 0x11};fail
ct zone set {123, 127};fail
@@ -817,6 +817,43 @@
}
]
+# ct mark set ct mark and 0xffff0000 or meta mark and 0xffff
+[
+ {
+ "mangle": {
+ "key": {
+ "ct": {
+ "key": "mark"
+ }
+ },
+ "value": {
+ "|": [
+ {
+ "&": [
+ {
+ "ct": {
+ "key": "mark"
+ }
+ },
+ 4294901760
+ ]
+ },
+ {
+ "&": [
+ {
+ "meta": {
+ "key": "mark"
+ }
+ },
+ 65535
+ ]
+ }
+ ]
+ }
+ }
+ }
+]
+
# ct expiration 30s
[
{
@@ -336,6 +336,15 @@ ip test-ip4 output
[ lookup reg 1 set __map%d dreg 1 ]
[ ct set mark with reg 1 ]
+# ct mark set ct mark and 0xffff0000 or meta mark and 0xffff
+ip
+ [ ct load mark => reg 1 ]
+ [ bitwise reg 1 = ( reg 1 & 0xffff0000 ) ^ 0x00000000 ]
+ [ meta load mark => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0x0000ffff ) ^ 0x00000000 ]
+ [ bitwise reg 1 = ( reg 1 | reg 2 ) ]
+ [ ct set mark with reg 1 ]
+
# ct original bytes > 100000
ip test-ip4 output
[ ct load bytes => reg 1 , dir original ]
@@ -25,3 +25,5 @@ meta mark set ct mark >> 8;ok
meta mark . tcp dport { 0x0000000a-0x00000014 . 80-90, 0x00100000-0x00100123 . 100-120 };ok
ip saddr . meta mark { 1.2.3.4 . 0x00000100 , 1.2.3.6-1.2.3.8 . 0x00000200-0x00000300 };ok
ip saddr . meta mark { 1.2.3.4 . 0x00000100 , 5.6.7.8 . 0x00000200 };ok
+
+meta mark set ct mark and 0xffff0000 or meta mark and 0xffff;ok;meta mark set ct mark & 0xffff0000 | meta mark & 0x0000ffff
@@ -236,6 +236,43 @@
}
]
+# meta mark set ct mark and 0xffff0000 or meta mark and 0xffff
+[
+ {
+ "mangle": {
+ "key": {
+ "meta": {
+ "key": "mark"
+ }
+ },
+ "value": {
+ "|": [
+ {
+ "&": [
+ {
+ "ct": {
+ "key": "mark"
+ }
+ },
+ 4294901760
+ ]
+ },
+ {
+ "&": [
+ {
+ "meta": {
+ "key": "mark"
+ }
+ },
+ 65535
+ ]
+ }
+ ]
+ }
+ }
+ }
+]
+
# meta protocol ip udp dport 67
[
{
@@ -80,6 +80,15 @@ inet test-inet input
[ bitwise reg 1 = ( reg 1 >> 0x00000008 ) ]
[ meta set mark with reg 1 ]
+# meta mark set ct mark and 0xffff0000 or meta mark and 0xffff
+inet test-inet input
+ [ ct load mark => reg 1 ]
+ [ bitwise reg 1 = ( reg 1 & 0xffff0000 ) ^ 0x00000000 ]
+ [ meta load mark => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0x0000ffff ) ^ 0x00000000 ]
+ [ bitwise reg 1 = ( reg 1 | reg 2 ) ]
+ [ meta set mark with reg 1 ]
+
# meta protocol ip udp dport 67
inet test-inet input
[ meta load protocol => reg 1 ]
@@ -34,3 +34,4 @@ ct mark set ip dscp & 0x0f << 1;ok;ct mark set ip dscp & af33
ct mark set ip dscp & 0x0f << 2;ok;ct mark set ip dscp & 0x3c
ct mark set ip dscp | 0x04;ok
ct mark set ip dscp | 1 << 20;ok;ct mark set ip dscp | 0x100000
+ct mark set ct mark | ip dscp | 0x200 counter;ok;ct mark set ct mark | ip dscp | 0x00000200 counter
@@ -479,3 +479,39 @@
}
}
]
+
+# ct mark set ct mark | ip dscp | 0x200 counter
+[
+ {
+ "mangle": {
+ "key": {
+ "ct": {
+ "key": "mark"
+ }
+ },
+ "value": {
+ "|": [
+ {
+ "|": [
+ {
+ "ct": {
+ "key": "mark"
+ }
+ },
+ {
+ "payload": {
+ "field": "dscp",
+ "protocol": "ip"
+ }
+ }
+ ]
+ },
+ 512
+ ]
+ }
+ }
+ },
+ {
+ "counter": null
+ }
+]
@@ -134,3 +134,14 @@ ip test-ip4 output
[ bitwise reg 1 = ( reg 1 >> 0x00000002 ) ]
[ bitwise reg 1 = ( reg 1 & 0xffefffff ) ^ 0x00100000 ]
[ ct set mark with reg 1 ]
+
+# ct mark set ct mark | ip dscp | 0x200 counter
+ip test-ip4 output
+ [ ct load mark => reg 1 ]
+ [ payload load 1b @ network header + 1 => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0x000000fc ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 >> 0x00000002 ) ]
+ [ bitwise reg 1 = ( reg 1 | reg 2 ) ]
+ [ bitwise reg 1 = ( reg 1 & 0xfffffdff ) ^ 0x00000200 ]
+ [ ct set mark with reg 1 ]
+ [ counter pkts 0 bytes 0 ]
@@ -124,6 +124,8 @@ iif "lo" ip protocol set 1;ok
iif "lo" ip dscp set af23;ok
iif "lo" ip dscp set cs0;ok
+iif "lo" ip dscp set (meta mark & 0xfc000000) >> 26;ok
+iif "lo" ip dscp set ip dscp & 0xc;ok;iif "lo" ip dscp set ip dscp & af12
ip saddr . ip daddr { 192.0.2.1 . 10.0.0.1-10.0.0.2 };ok
ip saddr . ip daddr vmap { 192.168.5.1-192.168.5.128 . 192.168.6.1-192.168.6.128 : accept };ok
@@ -1596,6 +1596,82 @@
}
]
+# iif "lo" ip dscp set (meta mark & 0xfc000000) >> 26
+[
+ {
+ "match": {
+ "left": {
+ "meta": {
+ "key": "iif"
+ }
+ },
+ "op": "==",
+ "right": "lo"
+ }
+ },
+ {
+ "mangle": {
+ "key": {
+ "payload": {
+ "field": "dscp",
+ "protocol": "ip"
+ }
+ },
+ "value": {
+ ">>": [
+ {
+ "&": [
+ {
+ "meta": {
+ "key": "mark"
+ }
+ },
+ 4227858432
+ ]
+ },
+ 26
+ ]
+ }
+ }
+ }
+]
+
+# iif "lo" ip dscp set ip dscp & 0xc
+[
+ {
+ "match": {
+ "left": {
+ "meta": {
+ "key": "iif"
+ }
+ },
+ "op": "==",
+ "right": "lo"
+ }
+ },
+ {
+ "mangle": {
+ "key": {
+ "payload": {
+ "field": "dscp",
+ "protocol": "ip"
+ }
+ },
+ "value": {
+ "&": [
+ {
+ "payload": {
+ "field": "dscp",
+ "protocol": "ip"
+ }
+ },
+ "af12"
+ ]
+ }
+ }
+ }
+]
+
# ip saddr . ip daddr { 192.0.2.1 . 10.0.0.1-10.0.0.2 }
[
{
@@ -1684,4 +1760,3 @@
}
}
]
-
@@ -490,6 +490,34 @@ ip test-ip4 input
[ bitwise reg 1 = ( reg 1 & 0x000003ff ) ^ 0x00000000 ]
[ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
+# iif "lo" ip dscp set (meta mark & 0xfc000000) >> 26
+ip test-ip4 input
+ [ meta load iif => reg 1 ]
+ [ cmp eq reg 1 0x00000001 ]
+ [ payload load 2b @ network header + 0 => reg 1 ]
+ [ bitwise reg 1 = ( reg 1 & 0x000003ff ) ^ 0x00000000 ]
+ [ meta load mark => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0xfc000000 ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 >> 0x0000001a ) ]
+ [ bitwise reg 2 = ( reg 2 << 0x00000002 ) ]
+ [ byteorder reg 2 = hton(reg 2, 4, 4) ]
+ [ bitwise reg 1 = ( reg 1 ^ reg 2 ) ]
+ [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
+
+# iif "lo" ip dscp set ip dscp & 0xc
+ip test-ip4 input
+ [ meta load iif => reg 1 ]
+ [ cmp eq reg 1 0x00000001 ]
+ [ payload load 2b @ network header + 0 => reg 1 ]
+ [ bitwise reg 1 = ( reg 1 & 0x000003ff ) ^ 0x00000000 ]
+ [ payload load 1b @ network header + 1 => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0x000000fc ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 >> 0x00000002 ) ]
+ [ bitwise reg 2 = ( reg 2 & 0x0000000c ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 << 0x00000002 ) ]
+ [ bitwise reg 1 = ( reg 1 ^ reg 2 ) ]
+ [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
+
# iif "lo" ip ttl set 23
ip test-ip4 input
[ meta load iif => reg 1 ]
@@ -662,6 +662,38 @@ bridge test-bridge input
[ bitwise reg 1 = ( reg 1 & 0x000003ff ) ^ 0x00000000 ]
[ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
+# iif "lo" ip dscp set (meta mark & 0xfc000000) >> 26
+bridge test-bridge input
+ [ meta load iif => reg 1 ]
+ [ cmp eq reg 1 0x00000001 ]
+ [ meta load protocol => reg 1 ]
+ [ cmp eq reg 1 0x00000008 ]
+ [ payload load 2b @ network header + 0 => reg 1 ]
+ [ bitwise reg 1 = ( reg 1 & 0x000003ff ) ^ 0x00000000 ]
+ [ meta load mark => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0xfc000000 ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 >> 0x0000001a ) ]
+ [ bitwise reg 2 = ( reg 2 << 0x00000002 ) ]
+ [ byteorder reg 2 = hton(reg 2, 4, 4) ]
+ [ bitwise reg 1 = ( reg 1 ^ reg 2 ) ]
+ [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
+
+# iif "lo" ip dscp set ip dscp & 0xc
+bridge test-bridge input
+ [ meta load iif => reg 1 ]
+ [ cmp eq reg 1 0x00000001 ]
+ [ meta load protocol => reg 1 ]
+ [ cmp eq reg 1 0x00000008 ]
+ [ payload load 2b @ network header + 0 => reg 1 ]
+ [ bitwise reg 1 = ( reg 1 & 0x000003ff ) ^ 0x00000000 ]
+ [ payload load 1b @ network header + 1 => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0x000000fc ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 >> 0x00000002 ) ]
+ [ bitwise reg 2 = ( reg 2 & 0x0000000c ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 << 0x00000002 ) ]
+ [ bitwise reg 1 = ( reg 1 ^ reg 2 ) ]
+ [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
+
# ip saddr . ip daddr { 192.0.2.1 . 10.0.0.1-10.0.0.2 }
__set%d test-bridge 87 size 1
__set%d test-bridge 0
@@ -642,6 +642,38 @@ inet test-inet input
[ bitwise reg 1 = ( reg 1 & 0x000003ff ) ^ 0x00000000 ]
[ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
+# iif "lo" ip dscp set (meta mark & 0xfc000000) >> 26
+inet test-inet input
+ [ meta load iif => reg 1 ]
+ [ cmp eq reg 1 0x00000001 ]
+ [ meta load nfproto => reg 1 ]
+ [ cmp eq reg 1 0x00000002 ]
+ [ payload load 2b @ network header + 0 => reg 1 ]
+ [ bitwise reg 1 = ( reg 1 & 0x000003ff ) ^ 0x00000000 ]
+ [ meta load mark => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0xfc000000 ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 >> 0x0000001a ) ]
+ [ bitwise reg 2 = ( reg 2 << 0x00000002 ) ]
+ [ byteorder reg 2 = hton(reg 2, 4, 4) ]
+ [ bitwise reg 1 = ( reg 1 ^ reg 2 ) ]
+ [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
+
+# iif "lo" ip dscp set ip dscp & 0xc
+inet test-inet input
+ [ meta load iif => reg 1 ]
+ [ cmp eq reg 1 0x00000001 ]
+ [ meta load nfproto => reg 1 ]
+ [ cmp eq reg 1 0x00000002 ]
+ [ payload load 2b @ network header + 0 => reg 1 ]
+ [ bitwise reg 1 = ( reg 1 & 0x000003ff ) ^ 0x00000000 ]
+ [ payload load 1b @ network header + 1 => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0x000000fc ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 >> 0x00000002 ) ]
+ [ bitwise reg 2 = ( reg 2 & 0x0000000c ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 << 0x00000002 ) ]
+ [ bitwise reg 1 = ( reg 1 ^ reg 2 ) ]
+ [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
+
# iif "lo" ip ttl set 23
inet test-inet input
[ meta load iif => reg 1 ]
@@ -642,6 +642,38 @@ netdev test-netdev ingress
[ bitwise reg 1 = ( reg 1 & 0x000003ff ) ^ 0x00000000 ]
[ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
+# iif "lo" ip dscp set (meta mark & 0xfc000000) >> 26
+netdev test-netdev ingress
+ [ meta load iif => reg 1 ]
+ [ cmp eq reg 1 0x00000001 ]
+ [ meta load protocol => reg 1 ]
+ [ cmp eq reg 1 0x00000008 ]
+ [ payload load 2b @ network header + 0 => reg 1 ]
+ [ bitwise reg 1 = ( reg 1 & 0x000003ff ) ^ 0x00000000 ]
+ [ meta load mark => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0xfc000000 ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 >> 0x0000001a ) ]
+ [ bitwise reg 2 = ( reg 2 << 0x00000002 ) ]
+ [ byteorder reg 2 = hton(reg 2, 4, 4) ]
+ [ bitwise reg 1 = ( reg 1 ^ reg 2 ) ]
+ [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
+
+# iif "lo" ip dscp set ip dscp & 0xc
+netdev test-netdev ingress
+ [ meta load iif => reg 1 ]
+ [ cmp eq reg 1 0x00000001 ]
+ [ meta load protocol => reg 1 ]
+ [ cmp eq reg 1 0x00000008 ]
+ [ payload load 2b @ network header + 0 => reg 1 ]
+ [ bitwise reg 1 = ( reg 1 & 0x000003ff ) ^ 0x00000000 ]
+ [ payload load 1b @ network header + 1 => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0x000000fc ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 >> 0x00000002 ) ]
+ [ bitwise reg 2 = ( reg 2 & 0x0000000c ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 << 0x00000002 ) ]
+ [ bitwise reg 1 = ( reg 1 ^ reg 2 ) ]
+ [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
+
# iif "lo" ip ttl set 23
netdev test-netdev ingress
[ meta load iif => reg 1 ]
@@ -7,3 +7,4 @@ ct mark set ip6 dscp << 26 | 0x10;ok
ct mark set ip6 dscp | 0x04;ok
ct mark set ip6 dscp | 0xff000000;ok
ct mark set ip6 dscp & 0x0f << 2;ok;ct mark set ip6 dscp & 0x3c
+ct mark set ct mark | ip6 dscp | 0x200 counter;ok;ct mark set ct mark | ip6 dscp | 0x00000200 counter
@@ -291,3 +291,39 @@
}
}
]
+
+# ct mark set ct mark | ip6 dscp | 0x200 counter
+[
+ {
+ "mangle": {
+ "key": {
+ "ct": {
+ "key": "mark"
+ }
+ },
+ "value": {
+ "|": [
+ {
+ "|": [
+ {
+ "ct": {
+ "key": "mark"
+ }
+ },
+ {
+ "payload": {
+ "field": "dscp",
+ "protocol": "ip6"
+ }
+ }
+ ]
+ },
+ 512
+ ]
+ }
+ }
+ },
+ {
+ "counter": null
+ }
+]
@@ -44,3 +44,15 @@ ip6 test-ip6 output
[ byteorder reg 1 = ntoh(reg 1, 2, 1) ]
[ bitwise reg 1 = ( reg 1 & 0x0000003c ) ^ 0x00000000 ]
[ ct set mark with reg 1 ]
+
+# ct mark set ct mark | ip6 dscp | 0x200 counter
+ip6 test-ip6 output
+ [ ct load mark => reg 1 ]
+ [ payload load 2b @ network header + 0 => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0x0000c00f ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 >> 0x00000006 ) ]
+ [ byteorder reg 2 = ntoh(reg 2, 2, 1) ]
+ [ bitwise reg 1 = ( reg 1 | reg 2 ) ]
+ [ bitwise reg 1 = ( reg 1 & 0xfffffdff ) ^ 0x00000200 ]
+ [ ct set mark with reg 1 ]
+ [ counter pkts 0 bytes 0 ]
@@ -141,6 +141,8 @@ iif "lo" ip6 daddr set ::1;ok
iif "lo" ip6 hoplimit set 1;ok
iif "lo" ip6 dscp set af42;ok
iif "lo" ip6 dscp set 63;ok;iif "lo" ip6 dscp set 0x3f
+iif "lo" ip6 dscp set (ct mark & 0xfc000000) >> 26;ok
+iif "lo" ip6 dscp set ip6 dscp & 0xc;ok;iif "lo" ip6 dscp set ip6 dscp & 0x0c
iif "lo" ip6 ecn set ect0;ok
iif "lo" ip6 ecn set ce;ok
@@ -1437,6 +1437,82 @@
}
]
+# iif "lo" ip6 dscp set (ct mark & 0xfc000000) >> 26
+[
+ {
+ "match": {
+ "left": {
+ "meta": {
+ "key": "iif"
+ }
+ },
+ "op": "==",
+ "right": "lo"
+ }
+ },
+ {
+ "mangle": {
+ "key": {
+ "payload": {
+ "field": "dscp",
+ "protocol": "ip6"
+ }
+ },
+ "value": {
+ ">>": [
+ {
+ "&": [
+ {
+ "ct": {
+ "key": "mark"
+ }
+ },
+ 4227858432
+ ]
+ },
+ 26
+ ]
+ }
+ }
+ }
+]
+
+# iif "lo" ip6 dscp set ip6 dscp & 0xc
+[
+ {
+ "match": {
+ "left": {
+ "meta": {
+ "key": "iif"
+ }
+ },
+ "op": "==",
+ "right": "lo"
+ }
+ },
+ {
+ "mangle": {
+ "key": {
+ "payload": {
+ "field": "dscp",
+ "protocol": "ip6"
+ }
+ },
+ "value": {
+ "&": [
+ {
+ "payload": {
+ "field": "dscp",
+ "protocol": "ip6"
+ }
+ },
+ 12
+ ]
+ }
+ }
+ }
+]
+
# iif "lo" ip6 ecn set ect0
[
{
@@ -589,6 +589,42 @@ inet test-inet input
[ bitwise reg 1 = ( reg 1 & 0x00003ff0 ) ^ 0x0000c00f ]
[ payload write reg 1 => 2b @ network header + 0 csum_type 0 csum_off 0 csum_flags 0x0 ]
+# iif "lo" ip6 dscp set (ct mark & 0xfc000000) >> 26
+inet test-inet input
+ [ meta load iif => reg 1 ]
+ [ cmp eq reg 1 0x00000001 ]
+ [ meta load nfproto => reg 1 ]
+ [ cmp eq reg 1 0x0000000a ]
+ [ payload load 2b @ network header + 0 => reg 1 ]
+ [ bitwise reg 1 = ( reg 1 & 0x00003ff0 ) ^ 0x00000000 ]
+ [ ct load mark => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0xfc000000 ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 >> 0x0000001a ) ]
+ [ bitwise reg 2 = ( reg 2 << 0x00000006 ) ]
+ [ byteorder reg 2 = hton(reg 2, 4, 4) ]
+ [ bitwise reg 1 = ( reg 1 ^ reg 2 ) ]
+ [ payload write reg 1 => 2b @ network header + 0 csum_type 0 csum_off 0 csum_flags 0x0 ]
+
+# iif "lo" ip6 dscp set ip6 dscp & 0xc
+inet test-inet input
+ [ meta load iif => reg 1 ]
+ [ cmp eq reg 1 0x00000001 ]
+ [ meta load nfproto => reg 1 ]
+ [ cmp eq reg 1 0x0000000a ]
+ [ payload load 2b @ network header + 0 => reg 1 ]
+ [ bitwise reg 1 = ( reg 1 & 0x00003ff0 ) ^ 0x00000000 ]
+ [ payload load 2b @ network header + 0 => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0x0000c00f ) ^ 0x00000000 ]
+ [ byteorder reg 2 = ntoh(reg 2, 2, 1) ]
+ [ bitwise reg 2 = ( reg 2 >> 0x00000006 ) ]
+ [ byteorder reg 2 = hton(reg 2, 2, 1) ]
+ [ bitwise reg 2 = ( reg 2 & 0x00000c00 ) ^ 0x00000000 ]
+ [ byteorder reg 2 = ntoh(reg 2, 2, 1) ]
+ [ bitwise reg 2 = ( reg 2 << 0x00000006 ) ]
+ [ byteorder reg 2 = hton(reg 2, 2, 1) ]
+ [ bitwise reg 1 = ( reg 1 ^ reg 2 ) ]
+ [ payload write reg 1 => 2b @ network header + 0 csum_type 0 csum_off 0 csum_flags 0x0 ]
+
# iif "lo" ip6 ecn set ect0
inet test-inet input
[ meta load iif => reg 1 ]
@@ -439,6 +439,38 @@ ip6 test-ip6 input
[ bitwise reg 1 = ( reg 1 & 0x00003ff0 ) ^ 0x0000c00f ]
[ payload write reg 1 => 2b @ network header + 0 csum_type 0 csum_off 0 csum_flags 0x0 ]
+# iif "lo" ip6 dscp set (ct mark & 0xfc000000) >> 26
+ip6 test-ip6 input
+ [ meta load iif => reg 1 ]
+ [ cmp eq reg 1 0x00000001 ]
+ [ payload load 2b @ network header + 0 => reg 1 ]
+ [ bitwise reg 1 = ( reg 1 & 0x00003ff0 ) ^ 0x00000000 ]
+ [ ct load mark => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0xfc000000 ) ^ 0x00000000 ]
+ [ bitwise reg 2 = ( reg 2 >> 0x0000001a ) ]
+ [ bitwise reg 2 = ( reg 2 << 0x00000006 ) ]
+ [ byteorder reg 2 = hton(reg 2, 4, 4) ]
+ [ bitwise reg 1 = ( reg 1 ^ reg 2 ) ]
+ [ payload write reg 1 => 2b @ network header + 0 csum_type 0 csum_off 0 csum_flags 0x0 ]
+
+# iif "lo" ip6 dscp set ip6 dscp & 0xc
+ip6 test-ip6 input
+ [ meta load iif => reg 1 ]
+ [ cmp eq reg 1 0x00000001 ]
+ [ payload load 2b @ network header + 0 => reg 1 ]
+ [ bitwise reg 1 = ( reg 1 & 0x00003ff0 ) ^ 0x00000000 ]
+ [ payload load 2b @ network header + 0 => reg 2 ]
+ [ bitwise reg 2 = ( reg 2 & 0x0000c00f ) ^ 0x00000000 ]
+ [ byteorder reg 2 = ntoh(reg 2, 2, 1) ]
+ [ bitwise reg 2 = ( reg 2 >> 0x00000006 ) ]
+ [ byteorder reg 2 = hton(reg 2, 2, 1) ]
+ [ bitwise reg 2 = ( reg 2 & 0x00000c00 ) ^ 0x00000000 ]
+ [ byteorder reg 2 = ntoh(reg 2, 2, 1) ]
+ [ bitwise reg 2 = ( reg 2 << 0x00000006 ) ]
+ [ byteorder reg 2 = hton(reg 2, 2, 1) ]
+ [ bitwise reg 1 = ( reg 1 ^ reg 2 ) ]
+ [ payload write reg 1 => 2b @ network header + 0 csum_type 0 csum_off 0 csum_flags 0x0 ]
+
# iif "lo" ip6 ecn set ect0
ip6 test-ip6 input
[ meta load iif => reg 1 ]
new file mode 100755
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+RULESET="
+ add table t
+ add chain t c { type filter hook output priority filter; }
+ add rule t c ct mark set ct mark and 0xffff0000 or meta mark and 0xffff
+"
+
+$NFT -f - <<< "$RULESET"
new file mode 100755
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+RULESET="
+ add table t
+ add chain t c { type filter hook input priority filter; }
+ add rule t c meta mark set ct mark and 0xffff0000 or meta mark and 0xffff
+"
+
+$NFT -f - <<< "$RULESET"
new file mode 100755
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+RULESET="
+ add table ip6 t
+ add chain ip6 t c { type filter hook output priority filter; }
+ add rule ip6 t c ct mark set ct mark and 0xffff0000 or meta mark and 0xffff
+"
+
+$NFT -f - <<< "$RULESET"
new file mode 100755
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+RULESET="
+ add table ip6 t
+ add chain ip6 t c { type filter hook input priority filter; }
+ add rule ip6 t c meta mark set ct mark and 0xffff0000 or meta mark and 0xffff
+"
+
+$NFT -f - <<< "$RULESET"
new file mode 100755
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+RULESET="
+ add table t
+ add chain t c { type filter hook output priority filter; }
+ add rule t c ip dscp set (ct mark & 0xfc000000) >> 26
+"
+
+$NFT -f - <<< "$RULESET"
new file mode 100755
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+RULESET="
+ add table t
+ add chain t c { type filter hook output priority filter; }
+ add rule t c ip dscp set ip dscp and 0xc
+"
+
+$NFT -f - <<< "$RULESET"
new file mode 100755
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+RULESET="
+ add table t
+ add chain t c { type filter hook output priority filter; }
+ add rule t c ct mark set ct mark | ip dscp | 0x200 counter
+"
+
+$NFT -f - <<< "$RULESET"
new file mode 100755
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+RULESET="
+ add table ip6 t
+ add chain ip6 t c { type filter hook output priority filter; }
+ add rule ip6 t c ip6 dscp set (ct mark & 0xfc000000) >> 26
+"
+
+$NFT -f - <<< "$RULESET"
new file mode 100755
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+RULESET="
+ add table ip6 t
+ add chain ip6 t c { type filter hook output priority filter; }
+ add rule ip6 t c ip6 dscp set ip6 dscp and 0xc
+"
+
+$NFT -f - <<< "$RULESET"
new file mode 100755
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+RULESET="
+ add table ip6 t
+ add chain ip6 t c { type filter hook output priority filter; }
+ add rule ip6 t c ct mark set ct mark | ip6 dscp | 0x200 counter
+"
+
+$NFT -f - <<< "$RULESET"
new file mode 100644
@@ -0,0 +1,6 @@
+table ip t {
+ chain c {
+ type filter hook output priority filter; policy accept;
+ ct mark set ct mark & 0xffff0000 | meta mark & 0x0000ffff
+ }
+}
new file mode 100644
@@ -0,0 +1,6 @@
+table ip t {
+ chain c {
+ type filter hook input priority filter; policy accept;
+ meta mark set ct mark & 0xffff0000 | meta mark & 0x0000ffff
+ }
+}
new file mode 100644
@@ -0,0 +1,6 @@
+table ip6 t {
+ chain c {
+ type filter hook output priority filter; policy accept;
+ ct mark set ct mark & 0xffff0000 | meta mark & 0x0000ffff
+ }
+}
new file mode 100644
@@ -0,0 +1,6 @@
+table ip6 t {
+ chain c {
+ type filter hook input priority filter; policy accept;
+ meta mark set ct mark & 0xffff0000 | meta mark & 0x0000ffff
+ }
+}
new file mode 100644
@@ -0,0 +1,6 @@
+table ip t {
+ chain c {
+ type filter hook output priority filter; policy accept;
+ ip dscp set (ct mark & 0xfc000000) >> 26
+ }
+}
new file mode 100644
@@ -0,0 +1,6 @@
+table ip t {
+ chain c {
+ type filter hook output priority filter; policy accept;
+ ip dscp set ip dscp & af12
+ }
+}
new file mode 100644
@@ -0,0 +1,6 @@
+table ip t {
+ chain c {
+ type filter hook output priority filter; policy accept;
+ ct mark set ct mark | ip dscp | 0x00000200 counter packets 0 bytes 0
+ }
+}
new file mode 100644
@@ -0,0 +1,6 @@
+table ip6 t {
+ chain c {
+ type filter hook output priority filter; policy accept;
+ ip6 dscp set (ct mark & 0xfc000000) >> 26
+ }
+}
new file mode 100644
@@ -0,0 +1,6 @@
+table ip6 t {
+ chain c {
+ type filter hook output priority filter; policy accept;
+ ip6 dscp set ip6 dscp & 0x0c
+ }
+}
new file mode 100644
@@ -0,0 +1,6 @@
+table ip6 t {
+ chain c {
+ type filter hook output priority filter; policy accept;
+ ct mark set ct mark | ip6 dscp | 0x00000200 counter packets 0 bytes 0
+ }
+}
Add tests to validate setting marks and payloads with statement arguments that include binops with variable RHS operands. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> --- tests/py/any/ct.t | 1 + tests/py/any/ct.t.json | 37 +++++++++ tests/py/any/ct.t.payload | 9 +++ tests/py/inet/meta.t | 2 + tests/py/inet/meta.t.json | 37 +++++++++ tests/py/inet/meta.t.payload | 9 +++ tests/py/ip/ct.t | 1 + tests/py/ip/ct.t.json | 36 +++++++++ tests/py/ip/ct.t.payload | 11 +++ tests/py/ip/ip.t | 2 + tests/py/ip/ip.t.json | 77 ++++++++++++++++++- tests/py/ip/ip.t.payload | 28 +++++++ tests/py/ip/ip.t.payload.bridge | 32 ++++++++ tests/py/ip/ip.t.payload.inet | 32 ++++++++ tests/py/ip/ip.t.payload.netdev | 32 ++++++++ tests/py/ip6/ct.t | 1 + tests/py/ip6/ct.t.json | 36 +++++++++ tests/py/ip6/ct.t.payload | 12 +++ tests/py/ip6/ip6.t | 2 + tests/py/ip6/ip6.t.json | 76 ++++++++++++++++++ tests/py/ip6/ip6.t.payload.inet | 36 +++++++++ tests/py/ip6/ip6.t.payload.ip6 | 32 ++++++++ .../shell/testcases/bitwise/0040mark_binop_10 | 11 +++ .../shell/testcases/bitwise/0040mark_binop_11 | 11 +++ .../shell/testcases/bitwise/0040mark_binop_12 | 11 +++ .../shell/testcases/bitwise/0040mark_binop_13 | 11 +++ .../testcases/bitwise/0044payload_binop_0 | 11 +++ .../testcases/bitwise/0044payload_binop_1 | 11 +++ .../testcases/bitwise/0044payload_binop_2 | 11 +++ .../testcases/bitwise/0044payload_binop_3 | 11 +++ .../testcases/bitwise/0044payload_binop_4 | 11 +++ .../testcases/bitwise/0044payload_binop_5 | 11 +++ .../bitwise/dumps/0040mark_binop_10.nft | 6 ++ .../bitwise/dumps/0040mark_binop_11.nft | 6 ++ .../bitwise/dumps/0040mark_binop_12.nft | 6 ++ .../bitwise/dumps/0040mark_binop_13.nft | 6 ++ .../bitwise/dumps/0044payload_binop_0.nft | 6 ++ .../bitwise/dumps/0044payload_binop_1.nft | 6 ++ .../bitwise/dumps/0044payload_binop_2.nft | 6 ++ .../bitwise/dumps/0044payload_binop_3.nft | 6 ++ .../bitwise/dumps/0044payload_binop_4.nft | 6 ++ .../bitwise/dumps/0044payload_binop_5.nft | 6 ++ 42 files changed, 710 insertions(+), 1 deletion(-) create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_10 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_11 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_12 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_13 create mode 100755 tests/shell/testcases/bitwise/0044payload_binop_0 create mode 100755 tests/shell/testcases/bitwise/0044payload_binop_1 create mode 100755 tests/shell/testcases/bitwise/0044payload_binop_2 create mode 100755 tests/shell/testcases/bitwise/0044payload_binop_3 create mode 100755 tests/shell/testcases/bitwise/0044payload_binop_4 create mode 100755 tests/shell/testcases/bitwise/0044payload_binop_5 create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_10.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_11.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_12.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_13.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0044payload_binop_0.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0044payload_binop_1.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0044payload_binop_2.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0044payload_binop_3.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0044payload_binop_4.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0044payload_binop_5.nft