|
@@ -109,7 +109,7 @@ Signed-off-by: Kevin Darbyshire-Bryant <[email protected]>
|
|
__u8 invert;
|
|
__u8 invert;
|
|
--- a/net/netfilter/xt_connmark.c
|
|
--- a/net/netfilter/xt_connmark.c
|
|
+++ b/net/netfilter/xt_connmark.c
|
|
+++ b/net/netfilter/xt_connmark.c
|
|
-@@ -24,12 +24,13 @@ MODULE_ALIAS("ipt_connmark");
|
|
|
|
|
|
+@@ -24,13 +24,13 @@ MODULE_ALIAS("ipt_connmark");
|
|
MODULE_ALIAS("ip6t_connmark");
|
|
MODULE_ALIAS("ip6t_connmark");
|
|
|
|
|
|
static unsigned int
|
|
static unsigned int
|
|
@@ -120,20 +120,22 @@ Signed-off-by: Kevin Darbyshire-Bryant <[email protected]>
|
|
u_int32_t new_targetmark;
|
|
u_int32_t new_targetmark;
|
|
struct nf_conn *ct;
|
|
struct nf_conn *ct;
|
|
u_int32_t newmark;
|
|
u_int32_t newmark;
|
|
|
|
+- u_int32_t oldmark;
|
|
+ u_int8_t dscp;
|
|
+ u_int8_t dscp;
|
|
|
|
|
|
ct = nf_ct_get(skb, &ctinfo);
|
|
ct = nf_ct_get(skb, &ctinfo);
|
|
if (ct == NULL)
|
|
if (ct == NULL)
|
|
-@@ -37,12 +38,24 @@ connmark_tg_shift(struct sk_buff *skb, c
|
|
|
|
|
|
+@@ -38,13 +38,24 @@ connmark_tg_shift(struct sk_buff *skb, c
|
|
|
|
|
|
switch (info->mode) {
|
|
switch (info->mode) {
|
|
case XT_CONNMARK_SET:
|
|
case XT_CONNMARK_SET:
|
|
-- newmark = (ct->mark & ~info->ctmask) ^ info->ctmark;
|
|
|
|
|
|
+- oldmark = READ_ONCE(ct->mark);
|
|
|
|
+- newmark = (oldmark & ~info->ctmask) ^ info->ctmark;
|
|
- if (info->shift_dir == D_SHIFT_RIGHT)
|
|
- if (info->shift_dir == D_SHIFT_RIGHT)
|
|
- newmark >>= info->shift_bits;
|
|
- newmark >>= info->shift_bits;
|
|
- else
|
|
- else
|
|
- newmark <<= info->shift_bits;
|
|
- newmark <<= info->shift_bits;
|
|
-+ newmark = ct->mark;
|
|
|
|
|
|
++ newmark = READ_ONCE(ct->mark);
|
|
+ if (info->func & XT_CONNMARK_VALUE) {
|
|
+ if (info->func & XT_CONNMARK_VALUE) {
|
|
+ newmark = (newmark & ~info->ctmask) ^ info->ctmark;
|
|
+ newmark = (newmark & ~info->ctmask) ^ info->ctmark;
|
|
+ if (info->shift_dir == D_SHIFT_RIGHT)
|
|
+ if (info->shift_dir == D_SHIFT_RIGHT)
|
|
@@ -151,10 +153,10 @@ Signed-off-by: Kevin Darbyshire-Bryant <[email protected]>
|
|
+ newmark = (newmark & ~info->ctmark) |
|
|
+ newmark = (newmark & ~info->ctmark) |
|
|
+ (info->ctmask | (dscp << info->shift_bits));
|
|
+ (info->ctmask | (dscp << info->shift_bits));
|
|
+ }
|
|
+ }
|
|
- if (ct->mark != newmark) {
|
|
|
|
- ct->mark = newmark;
|
|
|
|
|
|
+ if (READ_ONCE(ct->mark) != newmark) {
|
|
|
|
+ WRITE_ONCE(ct->mark, newmark);
|
|
nf_conntrack_event_cache(IPCT_MARK, ct);
|
|
nf_conntrack_event_cache(IPCT_MARK, ct);
|
|
-@@ -81,20 +94,36 @@ static unsigned int
|
|
|
|
|
|
+@@ -83,20 +94,36 @@ static unsigned int
|
|
connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
|
|
connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
|
|
{
|
|
{
|
|
const struct xt_connmark_tginfo1 *info = par->targinfo;
|
|
const struct xt_connmark_tginfo1 *info = par->targinfo;
|
|
@@ -193,7 +195,7 @@ Signed-off-by: Kevin Darbyshire-Bryant <[email protected]>
|
|
|
|
|
|
return connmark_tg_shift(skb, info);
|
|
return connmark_tg_shift(skb, info);
|
|
}
|
|
}
|
|
-@@ -165,6 +194,16 @@ static struct xt_target connmark_tg_reg[
|
|
|
|
|
|
+@@ -167,6 +194,16 @@ static struct xt_target connmark_tg_reg[
|
|
.targetsize = sizeof(struct xt_connmark_tginfo2),
|
|
.targetsize = sizeof(struct xt_connmark_tginfo2),
|
|
.destroy = connmark_tg_destroy,
|
|
.destroy = connmark_tg_destroy,
|
|
.me = THIS_MODULE,
|
|
.me = THIS_MODULE,
|