openwrt/target/linux/generic/backport-4.14
Kevin Darbyshire-Bryant b8a72dfd28 kernel: backport act_ctinfo
ctinfo is a new tc filter action module.  It is designed to restore
information contained in firewall conntrack marks to other packet fields
and is typically used on packet ingress paths.  At present it has two
independent sub-functions or operating modes, DSCP restoration mode &
skb mark restoration mode.

The DSCP restore mode:

This mode copies DSCP values that have been placed in the firewall
conntrack mark back into the IPv4/v6 diffserv fields of relevant
packets.

The DSCP restoration is intended for use and has been found useful for
restoring ingress classifications based on egress classifications across
links that bleach or otherwise change DSCP, typically home ISP Internet
links.  Restoring DSCP on ingress on the WAN link allows qdiscs such as
but by no means limited to CAKE to shape inbound packets according to
policies that are easier to set & mark on egress.

Ingress classification is traditionally a challenging task since
iptables rules haven't yet run and tc filter/eBPF programs are pre-NAT
lookups, hence are unable to see internal IPv4 addresses as used on the
typical home masquerading gateway.  Thus marking the connection in some
manner on egress for later restoration of classification on ingress is
easier to implement.

Parameters related to DSCP restore mode:

dscpmask - a 32 bit mask of 6 contiguous bits and indicate bits of the
conntrack mark field contain the DSCP value to be restored.

statemask - a 32 bit mask of (usually) 1 bit length, outside the area
specified by dscpmask.  This represents a conditional operation flag
whereby the DSCP is only restored if the flag is set.  This is useful to
implement a 'one shot' iptables based classification where the
'complicated' iptables rules are only run once to classify the
connection on initial (egress) packet and subsequent packets are all
marked/restored with the same DSCP.  A mask of zero disables the
conditional behaviour ie. the conntrack mark DSCP bits are always
restored to the ip diffserv field (assuming the conntrack entry is found
& the skb is an ipv4/ipv6 type)

e.g. dscpmask 0xfc000000 statemask 0x01000000

|----0xFC----conntrack mark----000000---|
| Bits 31-26 | bit 25 | bit24 |~~~ Bit 0|
| DSCP       | unused | flag  |unused   |
|-----------------------0x01---000000---|
      |                   |
      |                   |
      ---|             Conditional flag
         v             only restore if set
|-ip diffserv-|
| 6 bits      |
|-------------|

The skb mark restore mode (cpmark):

This mode copies the firewall conntrack mark to the skb's mark field.
It is completely the functional equivalent of the existing act_connmark
action with the additional feature of being able to apply a mask to the
restored value.

Parameters related to skb mark restore mode:

mask - a 32 bit mask applied to the firewall conntrack mark to mask out
bits unwanted for restoration.  This can be useful where the conntrack
mark is being used for different purposes by different applications.  If
not specified and by default the whole mark field is copied (i.e.
default mask of 0xffffffff)

e.g. mask 0x00ffffff to mask out the top 8 bits being used by the
aforementioned DSCP restore mode.

|----0x00----conntrack mark----ffffff---|
| Bits 31-24 |                          |
| DSCP & flag|      some value here     |
|---------------------------------------|
			|
			|
			v
|------------skb mark-------------------|
|            |                          |
|  zeroed    |                          |
|---------------------------------------|

Overall parameters:

zone - conntrack zone

control - action related control (reclassify | pipe | drop | continue |
ok | goto chain <CHAIN_INDEX>)

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Make suitable adjustments for backporting to 4.14 & 4.19
and add to SCHED_MODULES_FILTER

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
2019-06-06 15:41:07 +01:00
..
010-Kbuild-don-t-hardcode-path-to-awk-in-scripts-ld-vers.patch
011-kbuild-export-SUBARCH.patch kernel: bump 4.14 to 4.14.48 2018-06-05 22:54:00 +03:00
012-kbuild-add-macro-for-controlling-warnings-to-linux-c.patch kernel: bump 4.14 to 4.14.97 2019-02-01 11:41:00 +01:00
013-disable-Wattribute-alias-warning-for-SYSCALL_DEFINEx.patch kernel: backport fixes for GCC 8 errors in syscall definitions 2018-07-22 17:16:30 +02:00
020-backport_netfilter_rtcache.patch
025-tcp-allow-drivers-to-tweak-TSQ-logic.patch kernel: bump 4.14 to 4.14.96 2019-01-28 18:17:32 +01:00
030-USB-serial-option-fix-dwm-158-3g-modem-interface.patch kernel: bump 4.14 to 4.14.110 2019-04-08 12:07:28 +02:00
030-v4.17-0001-usb-dwc2-add-support-for-host-mode-external-vbus-sup.patch kernel: bump 4.14 to 4.14.67 2018-08-28 23:05:39 +02:00
030-v4.17-0002-usb-dwc2-dwc2_vbus_supply_init-fix-error-check.patch kernel: bump 4.14 to 4.14.67 2018-08-28 23:05:39 +02:00
040-v4.17-0001-mtd-move-code-adding-master-MTD-out-of-mtd_add_devic.patch kernel: backport patches simplifying mtd_device_parse_register code 2018-02-19 16:01:44 +01:00
040-v4.17-0002-mtd-get-rid-of-the-mtd_add_device_partitions.patch kernel: backport patches simplifying mtd_device_parse_register code 2018-02-19 16:01:44 +01:00
041-v4.17-0001-mtd-partitions-add-of_match_table-parser-matching-fo.patch kernel: use accepted mtd patchset adding support for "compatible" string 2018-04-09 07:16:48 +02:00
041-v4.17-0002-mtd-rename-ofpart-parser-to-fixed-partitions-as-it-f.patch kernel: use accepted mtd patchset adding support for "compatible" string 2018-04-09 07:16:48 +02:00
041-v4.17-0003-mtd-ofpart-add-of_match_table-with-fixed-partitions.patch kernel: use accepted mtd patchset adding support for "compatible" string 2018-04-09 07:16:48 +02:00
042-v4.18-0001-mtd-move-code-adding-registering-partitions-to-the-p.patch kernel: backport mtd patch for minor partitioning cleanup 2018-05-12 23:14:07 +02:00
043-v4.18-mtd-bcm47xxpart-improve-handling-TRX-partition-size.patch kernel: use accepted version of bcm47xxpart fix commit 2018-05-12 23:53:44 +02:00
044-v4.18-mtd-bcm47xxpart-add-of_match_table-with-a-new-DT-bin.patch kernel: backport mtd patches with Broadcom of_match_table-s 2018-07-27 15:55:01 +02:00
045-v4.19-mtd-parsers-trx-add-of_match_table-with-the-new-DT-b.patch kernel: backport mtd patches with Broadcom of_match_table-s 2018-07-27 15:55:01 +02:00
046-v4.19-mtd-partitions-use-DT-info-for-parsing-partitions-wi.patch kernel: backport mtd support for subpartitions in DT 2018-07-27 22:16:24 +02:00
047-v4.21-mtd-keep-original-flags-for-every-struct-mtd_info.patch kernel: backport 2 mtd partitioning fixes 2018-12-03 10:34:12 +01:00
048-v4.21-mtd-improve-calculating-partition-boundaries-when-ch.patch kernel: backport 2 mtd partitioning fixes 2018-12-03 10:34:12 +01:00
071-v4.15-0001-net-bgmac-enable-master-mode-for-BCM54210E-and-B5021.patch
076-v4.15-0001-net-phy-broadcom-support-new-device-flag-for-setting.patch
080-v5.1-0001-bcma-keep-a-direct-pointer-to-the-struct-device.patch kernel: backport bcma patches that improve printing functions 2019-01-10 16:47:43 +01:00
080-v5.1-0002-bcma-use-dev_-printing-functions.patch kernel: backport bcma patches that improve printing functions 2019-01-10 16:47:43 +01:00
085-v4.16-0001-i2c-gpio-Enable-working-over-slow-can_sleep-GPIOs.patch kernel: backport i2c-gpio working over slow can_sleep GPIOs 2018-09-10 09:28:55 +02:00
090-net-bridge-add-support-for-port-isolation.patch kernel: replace bridge port isolate hack with upstream patch backport on 4.14 2018-07-11 20:59:05 +02:00
095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch kernel: N_BADCLASS: fix macro to actually work - class e support 2019-01-19 20:45:49 +00:00
101-arm-cns3xxx-use-actual-size-reads-for-PCIe.patch kernel: bump 4.14 to 4.14.93 2019-01-14 02:20:40 +02:00
270-batman-adv-Let-packet.h-include-its-headers-directly.patch kernel: backport flow dissector batman-adv support 2019-03-16 19:59:02 +01:00
271-batman-adv-Remove-usage-of-BIT-x-in-packet.h.patch kernel: backport flow dissector batman-adv support 2019-03-16 19:59:02 +01:00
272-batman-adv-Remove-kernel-fixed-width-types-in-packet.patch kernel: backport flow dissector batman-adv support 2019-03-16 19:59:02 +01:00
273-batman-adv-Convert-packet.h-to-uapi-header.patch kernel: backport flow dissector batman-adv support 2019-03-16 19:59:02 +01:00
274-flow_dissector-Parse-batman-adv-unicast-headers.patch kernel: backport flow dissector batman-adv support 2019-03-16 19:59:02 +01:00
289-v4.16-netfilter-add-defines-for-arp-decnet-max-hooks.patch kernel: fix build of nftables 2018-09-22 23:59:10 +02:00
290-v4.16-netfilter-core-make-nf_unregister_net_hooks-simple-w.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
291-v4.16-netfilter-core-remove-synchronize_net-call-if-nfqueu.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
292-v4.16-netfilter-core-free-hooks-with-call_rcu.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch kernel: bump 4.14 to 4.14.118 2019-05-13 19:17:41 +02:00
294-v4.16-netfilter-reduce-hook-array-sizes-to-what-is-needed.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
295-v4.16-netfilter-don-t-allocate-space-for-decnet-hooks-unle.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
297-v4.16-netfilter-core-pass-hook-number-family-and-device-to.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
298-v4.16-netfilter-core-add-nf_remove_net_hook.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
298-v4.16-netfilter-core-pass-family-as-parameter-to-nf_remove.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
299-v4.16-netfilter-core-support-for-NFPROTO_INET-hook-registr.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
300-v4.16-netfilter-nf_tables-explicit-nft_set_pktinfo-call-fr.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
301-v4.16-netfilter-core-only-allow-one-nat-hook-per-hook-poin.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
302-v4.16-netfilter-nf_tables_inet-don-t-use-multihook-infrast.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
303-v4.16-netfilter-nf_tables-remove-multihook-chains-and-fami.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
304-v4.16-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch kernel: bump 4.14 to 4.14.104 2019-03-05 13:19:43 +01:00
305-v4.16-netfilter-move-checksum_partial-indirection-to-struc.patch kernel: bump 4.14 to 4.14.104 2019-03-05 13:19:43 +01:00
306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch kernel: bump 4.14 to 4.14.104 2019-03-05 13:19:43 +01:00
307-v4.16-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch kernel: bump 4.14 to 4.14.104 2019-03-05 13:19:43 +01:00
308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch kernel: bump 4.14 to 4.14.104 2019-03-05 13:19:43 +01:00
309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch kernel: bump 4.14 to 4.14.104 2019-03-05 13:19:43 +01:00
310-v4.16-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch kernel: bump 4.14 to 4.14.104 2019-03-05 13:19:43 +01:00
311-v4.16-netfilter-nf_tables_arp-don-t-set-forward-chain.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
312-v4.16-netfilter-nf_tables-remove-hooks-from-family-definit.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
313-v4.16-netfilter-remove-defensive-check-on-malformed-packet.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
314-v4.16-netfilter-meta-secpath-support.patch kernel: bump 4.14 to 4.14.54 2018-07-11 16:02:24 +02:00
315-v4.15-netfilter-conntrack-move-nf_ct_netns_-get-put-to-cor.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
320-v4.16-netfilter-nf_conntrack-add-IPS_OFFLOAD-status-bit.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
321-v4.16-netfilter-nf_tables-add-flow-table-netlink-frontend.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
322-v4.16-netfilter-add-generic-flow-table-infrastructure.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
323-v4.16-netfilter-flow-table-support-for-IPv4.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
324-v4.16-netfilter-flow-table-support-for-IPv6.patch kernel: bump 4.14 to 4.14.114 2019-05-02 12:59:26 +02:00
325-v4.16-netfilter-flow-table-support-for-the-mixed-IPv4-IPv6.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
326-v4.16-netfilter-nf_tables-flow-offload-expression.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
327-v4.16-netfilter-nf_tables-remove-nhooks-field-from-struct-.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
328-v4.16-netfilter-nf_tables-fix-a-typo-in-nf_tables_getflowt.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
329-v4.16-netfilter-improve-flow-table-Kconfig-dependencies.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
330-v4.16-netfilter-nf_tables-remove-flag-field-from-struct-nf.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
331-v4.16-netfilter-nf_tables-no-need-for-struct-nft_af_info-t.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
332-v4.16-netfilter-nf_tables-remove-struct-nft_af_info-parame.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
334-v4.15-netfilter-nf_tables-fix-potential-NULL-ptr-deref-in-.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
335-v4.16-netfilter-nf_tables-add-single-table-list-for-all-fa.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
336-v4.15-netfilter-exit_net-cleanup-check-added.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
337-v4.16-netfilter-nf_tables-get-rid-of-pernet-families.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
338-v4.16-netfilter-nf_tables-get-rid-of-struct-nft_af_info-ab.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
339-v4.16-netfilter-nft_flow_offload-wait-for-garbage-collecto.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
340-v4.16-netfilter-nft_flow_offload-no-need-to-flush-entries-.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
341-v4.16-netfilter-nft_flow_offload-move-flowtable-cleanup-ro.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
342-v4.16-netfilter-nf_tables-fix-flowtable-free.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
343-netfilter-nft_flow_offload-handle-netdevice-events-f.patch kernel: backport netfilter NAT offload support to 4.14 2018-02-21 20:12:42 +01:00
344-v4.16-netfilter-nf_tables-allocate-handle-and-delete-objec.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
345-v4.16-netfilter-nf_flow_offload-fix-use-after-free-and-a-r.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
346-v4.16-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
347-v4.16-netfilter-remove-duplicated-include.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
348-v4.18-netfilter-nf_flow_table-use-IP_CT_DIR_-values-for-FL.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
349-v4.18-netfilter-nf_flow_table-clean-up-flow_offload_alloc.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
350-v4.18-ipv6-make-ip6_dst_mtu_forward-inline.patch kernel: bump 4.14 to 4.14.114 2019-05-02 12:59:26 +02:00
351-v4.18-netfilter-nf_flow_table-cache-mtu-in-struct-flow_off.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
352-v4.18-netfilter-nf_flow_table-rename-nf_flow_table.c-to-nf.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
353-v4.18-netfilter-nf_flow_table-move-ipv4-offload-hook-code-.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
354-v4.18-netfilter-nf_flow_table-move-ip-header-check-out-of-.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
355-v4.18-netfilter-nf_flow_table-move-ipv6-offload-hook-code-.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
356-v4.18-netfilter-nf_flow_table-relax-mixed-ipv4-ipv6-flowta.patch kernel: generic: Fix nftables inet table breakage 2018-09-22 21:20:55 +02:00
357-v4.18-netfilter-nf_flow_table-move-init-code-to-nf_flow_ta.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
358-v4.18-netfilter-nf_flow_table-fix-priv-pointer-for-netdev-.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
359-v4.18-netfilter-nf_flow_table-track-flow-tables-in-nf_flow.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
360-v4.18-netfilter-nf_flow_table-make-flow_offload_dead-inlin.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
361-v4.18-netfilter-nf_flow_table-add-a-new-flow-state-for-tea.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
362-v4.18-netfilter-nf_flow_table-in-flow_offload_lookup-skip-.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
363-v4.18-netfilter-nf_flow_table-add-support-for-sending-flow.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
364-v4.18-netfilter-nf_flow_table-tear-down-TCP-flows-if-RST-o.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
365-v4.16-netfilter-nf_flow_table-fix-checksum-when-handling-D.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
366-netfilter-nf_flow_table-clean-up-and-fix-dst-handlin.patch kernel: netfilter: fix dst entries in flowtable offload 2018-03-23 20:56:34 +01:00
367-v4.18-netfilter-nf_flow_table-add-missing-condition-for-TC.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
368-v4.18-netfilter-nf_flow_table-fix-offloading-connections-w.patch kernel: mark source kernel for netfilter backports 2018-05-08 09:42:07 +02:00
369-v4.18-netfilter-nf_flow_table-attach-dst-to-skbs.patch kernel: backport patch to fix dst handling for offloaded connections 2018-06-05 10:18:58 +02:00
370-netfilter-nf_flow_table-fix-offloaded-connection-tim.patch kernel: bump 4.14 to 4.14.120 2019-05-21 09:45:15 +02:00
371-netfilter-nf_flow_table-fix-up-ct-state-of-flows-aft.patch kernel: fix conntrack fixup of offloaded flows on timeout 2018-06-14 11:25:24 +02:00
380-v5.3-net-sched-Introduce-act_ctinfo-action.patch kernel: backport act_ctinfo 2019-06-06 15:41:07 +01:00
400-v4.16-leds-trigger-Introduce-a-NETDEV-trigger.patch kernel: Replace ledtrig-netdev with upstream backport 2018-12-15 12:50:06 +01:00
401-v5.2-leds-trigger-netdev-fix-refcnt-leak-on-interface-ren.patch kernel: fix refcnt leak in LED netdev trigger on interface rename 2019-03-05 23:10:09 +01:00
420-enable-CONFIG_MMC_SDHCI_IO_ACCESSORS.patch kernel: bump 4.14 to 4.14.97 2019-02-01 11:41:00 +01:00
500-v4.20-ubifs-Fix-default-compression-selection-in-ubifs.patch kernel: backport upstream ubifs default compression selection fix 2019-04-04 11:19:33 +02:00
950-tty-serial-exar-generalize-rs485-setup.patch kernel: move and replace accepted patch 2019-04-11 19:21:55 +02:00