* @tail: Tail pointer
* @end: End pointer
* @destructor: Destruct function
- * @nfmark: Can be used for communication between hooks
+ * @mark: Generic packet mark
* @nfct: Associated connection, if any
* @ipvs_property: skbuff is owned by ipvs
* @nfctinfo: Relationship of this skb to the connection
#ifdef CONFIG_BRIDGE_NETFILTER
struct nf_bridge_info *nf_bridge;
#endif
- __u32 nfmark;
#endif /* CONFIG_NETFILTER */
#ifdef CONFIG_NET_SCHED
__u16 tc_index; /* traffic control index */
__u32 secmark;
#endif
+ __u32 mark;
/* These elements must be at the end, see alloc_skb() for details. */
unsigned int truesize;
int action = info->target & -16;
if (action == MARK_SET_VALUE)
- (*pskb)->nfmark = info->mark;
+ (*pskb)->mark = info->mark;
else if (action == MARK_OR_VALUE)
- (*pskb)->nfmark |= info->mark;
+ (*pskb)->mark |= info->mark;
else if (action == MARK_AND_VALUE)
- (*pskb)->nfmark &= info->mark;
+ (*pskb)->mark &= info->mark;
else
- (*pskb)->nfmark ^= info->mark;
+ (*pskb)->mark ^= info->mark;
return info->target | -16;
}
struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
if (info->bitmask & EBT_MARK_OR)
- return !(!!(skb->nfmark & info->mask) ^ info->invert);
- return !(((skb->nfmark & info->mask) == info->mark) ^ info->invert);
+ return !(!!(skb->mark & info->mask) ^ info->invert);
+ return !(((skb->mark & info->mask) == info->mark) ^ info->invert);
}
static int ebt_mark_check(const char *tablename, unsigned int hookmask,
if (ub->qlen == 1)
skb_set_timestamp(ub->skb, &pm->stamp);
pm->data_len = copy_len;
- pm->mark = skb->nfmark;
+ pm->mark = skb->mark;
pm->hook = hooknr;
if (uloginfo->prefix != NULL)
strcpy(pm->prefix, uloginfo->prefix);
#endif
C(protocol);
n->destructor = NULL;
+ C(mark);
#ifdef CONFIG_NETFILTER
- C(nfmark);
C(nfct);
nf_conntrack_get(skb->nfct);
C(nfctinfo);
new->pkt_type = old->pkt_type;
new->tstamp = old->tstamp;
new->destructor = NULL;
+ new->mark = old->mark;
#ifdef CONFIG_NETFILTER
- new->nfmark = old->nfmark;
new->nfct = old->nfct;
nf_conntrack_get(old->nfct);
new->nfctinfo = old->nfctinfo;
.saddr = cb->src,
.scope = RT_SCOPE_UNIVERSE,
#ifdef CONFIG_DECNET_ROUTE_FWMARK
- .fwmark = skb->nfmark
+ .fwmark = skb->mark
#endif
} },
.iif = skb->dev->ifindex };
(rt->fl.fld_dst == cb->dst) &&
(rt->fl.oif == 0) &&
#ifdef CONFIG_DECNET_ROUTE_FWMARK
- (rt->fl.fld_fwmark == skb->nfmark) &&
+ (rt->fl.fld_fwmark == skb->mark) &&
#endif
(rt->fl.iif == cb->iif)) {
rt->u.dst.lastuse = jiffies;
dst_release(to->dst);
to->dst = dst_clone(from->dst);
to->dev = from->dev;
+ to->mark = from->mark;
/* Copy the flags to each fragment. */
IPCB(to)->flags = IPCB(from)->flags;
to->tc_index = from->tc_index;
#endif
#ifdef CONFIG_NETFILTER
- to->nfmark = from->nfmark;
/* Connection association is same as pre-frag packet */
nf_conntrack_put(to->nfct);
to->nfct = from->nfct;
}
if (th->syn &&
- (svc = ip_vs_service_get(skb->nfmark, skb->nh.iph->protocol,
+ (svc = ip_vs_service_get(skb->mark, skb->nh.iph->protocol,
skb->nh.iph->daddr, th->dest))) {
if (ip_vs_todrop()) {
/*
return 0;
}
- if ((svc = ip_vs_service_get(skb->nfmark, skb->nh.iph->protocol,
+ if ((svc = ip_vs_service_get(skb->mark, skb->nh.iph->protocol,
skb->nh.iph->daddr, uh->dest))) {
if (ip_vs_todrop()) {
/*
fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
fl.oif = (*pskb)->sk ? (*pskb)->sk->sk_bound_dev_if : 0;
#ifdef CONFIG_IP_ROUTE_FWMARK
- fl.nl_u.ip4_u.fwmark = (*pskb)->nfmark;
+ fl.nl_u.ip4_u.fwmark = (*pskb)->mark;
#endif
if (ip_route_output_key(&rt, &fl) != 0)
return -1;
pmsg->data_len = data_len;
pmsg->timestamp_sec = entry->skb->tstamp.off_sec;
pmsg->timestamp_usec = entry->skb->tstamp.off_usec;
- pmsg->mark = entry->skb->nfmark;
+ pmsg->mark = entry->skb->mark;
pmsg->hook = entry->info->hook;
pmsg->hw_protocol = entry->skb->protocol;
/* This packet will not be the same as the other: clear nf fields */
nf_reset(nskb);
- nskb->nfmark = 0;
+ nskb->mark = 0;
skb_init_secmark(nskb);
tcph = (struct tcphdr *)((u_int32_t*)nskb->nh.iph + nskb->nh.iph->ihl);
pm->data_len = copy_len;
pm->timestamp_sec = skb->tstamp.off_sec;
pm->timestamp_usec = skb->tstamp.off_usec;
- pm->mark = skb->nfmark;
+ pm->mark = skb->mark;
pm->hook = hooknum;
if (prefix != NULL)
strncpy(pm->prefix, prefix, sizeof(pm->prefix));
unsigned int ret;
u_int8_t tos;
__be32 saddr, daddr;
- unsigned long nfmark;
+ u_int32_t mark;
/* root is playing with raw sockets. */
if ((*pskb)->len < sizeof(struct iphdr)
}
/* Save things which could affect route */
- nfmark = (*pskb)->nfmark;
+ mark = (*pskb)->mark;
saddr = (*pskb)->nh.iph->saddr;
daddr = (*pskb)->nh.iph->daddr;
tos = (*pskb)->nh.iph->tos;
&& ((*pskb)->nh.iph->saddr != saddr
|| (*pskb)->nh.iph->daddr != daddr
#ifdef CONFIG_IP_ROUTE_FWMARK
- || (*pskb)->nfmark != nfmark
+ || (*pskb)->mark != mark
#endif
|| (*pskb)->nh.iph->tos != tos))
if (ip_route_me_harder(pskb, RTN_UNSPEC))
rth->rt_dst = daddr;
rth->fl.fl4_tos = tos;
#ifdef CONFIG_IP_ROUTE_FWMARK
- rth->fl.fl4_fwmark= skb->nfmark;
+ rth->fl.fl4_fwmark= skb->mark;
#endif
rth->fl.fl4_src = saddr;
rth->rt_src = saddr;
rth->rt_dst = daddr;
rth->fl.fl4_tos = tos;
#ifdef CONFIG_IP_ROUTE_FWMARK
- rth->fl.fl4_fwmark= skb->nfmark;
+ rth->fl.fl4_fwmark= skb->mark;
#endif
rth->fl.fl4_src = saddr;
rth->rt_src = saddr;
.tos = tos,
.scope = RT_SCOPE_UNIVERSE,
#ifdef CONFIG_IP_ROUTE_FWMARK
- .fwmark = skb->nfmark
+ .fwmark = skb->mark
#endif
} },
.iif = dev->ifindex };
rth->rt_dst = daddr;
rth->fl.fl4_tos = tos;
#ifdef CONFIG_IP_ROUTE_FWMARK
- rth->fl.fl4_fwmark= skb->nfmark;
+ rth->fl.fl4_fwmark= skb->mark;
#endif
rth->fl.fl4_src = saddr;
rth->rt_src = saddr;
rth->fl.iif == iif &&
rth->fl.oif == 0 &&
#ifdef CONFIG_IP_ROUTE_FWMARK
- rth->fl.fl4_fwmark == skb->nfmark &&
+ rth->fl.fl4_fwmark == skb->mark &&
#endif
rth->fl.fl4_tos == tos) {
rth->u.dst.lastuse = jiffies;
dst_release(to->dst);
to->dst = dst_clone(from->dst);
to->dev = from->dev;
+ to->mark = from->mark;
#ifdef CONFIG_NET_SCHED
to->tc_index = from->tc_index;
#endif
#ifdef CONFIG_NETFILTER
- to->nfmark = from->nfmark;
/* Connection association is same as pre-frag packet */
nf_conntrack_put(to->nfct);
to->nfct = from->nfct;
pmsg->data_len = data_len;
pmsg->timestamp_sec = entry->skb->tstamp.off_sec;
pmsg->timestamp_usec = entry->skb->tstamp.off_usec;
- pmsg->mark = entry->skb->nfmark;
+ pmsg->mark = entry->skb->mark;
pmsg->hook = entry->info->hook;
pmsg->hw_protocol = entry->skb->protocol;
int (*okfn)(struct sk_buff *))
{
- unsigned long nfmark;
unsigned int ret;
struct in6_addr saddr, daddr;
u_int8_t hop_limit;
- u_int32_t flowlabel;
+ u_int32_t flowlabel, mark;
#if 0
/* root is playing with raw sockets. */
}
#endif
- /* save source/dest address, nfmark, hoplimit, flowlabel, priority, */
+ /* save source/dest address, mark, hoplimit, flowlabel, priority, */
memcpy(&saddr, &(*pskb)->nh.ipv6h->saddr, sizeof(saddr));
memcpy(&daddr, &(*pskb)->nh.ipv6h->daddr, sizeof(daddr));
- nfmark = (*pskb)->nfmark;
+ mark = (*pskb)->mark;
hop_limit = (*pskb)->nh.ipv6h->hop_limit;
/* flowlabel and prio (includes version, which shouldn't change either */
if (ret != NF_DROP && ret != NF_STOLEN
&& (memcmp(&(*pskb)->nh.ipv6h->saddr, &saddr, sizeof(saddr))
|| memcmp(&(*pskb)->nh.ipv6h->daddr, &daddr, sizeof(daddr))
- || (*pskb)->nfmark != nfmark
+ || (*pskb)->mark != mark
|| (*pskb)->nh.ipv6h->hop_limit != hop_limit))
return ip6_route_me_harder(*pskb) == 0 ? ret : NF_DROP;
.daddr = iph->daddr,
.saddr = iph->saddr,
#ifdef CONFIG_IPV6_ROUTE_FWMARK
- .fwmark = skb->nfmark,
+ .fwmark = skb->mark,
#endif
.flowlabel = (* (__be32 *) iph)&IPV6_FLOWINFO_MASK,
},
#endif
}
- if (skb->nfmark) {
- tmp_uint = htonl(skb->nfmark);
+ if (skb->mark) {
+ tmp_uint = htonl(skb->mark);
NFA_PUT(inst->skb, NFULA_MARK, sizeof(tmp_uint), &tmp_uint);
}
#endif
}
- if (entskb->nfmark) {
- tmp_uint = htonl(entskb->nfmark);
+ if (entskb->mark) {
+ tmp_uint = htonl(entskb->mark);
NFA_PUT(skb, NFQA_MARK, sizeof(u_int32_t), &tmp_uint);
}
}
if (nfqa[NFQA_MARK-1])
- entry->skb->nfmark = ntohl(*(__be32 *)
- NFA_DATA(nfqa[NFQA_MARK-1]));
+ entry->skb->mark = ntohl(*(__be32 *)
+ NFA_DATA(nfqa[NFQA_MARK-1]));
issue_verdict(entry, verdict);
instance_put(queue);
{
const struct xt_connmark_target_info *markinfo = targinfo;
u_int32_t diff;
- u_int32_t nfmark;
+ u_int32_t mark;
u_int32_t newmark;
u_int32_t ctinfo;
u_int32_t *ctmark = nf_ct_get_mark(*pskb, &ctinfo);
break;
case XT_CONNMARK_SAVE:
newmark = (*ctmark & ~markinfo->mask) |
- ((*pskb)->nfmark & markinfo->mask);
+ ((*pskb)->mark & markinfo->mask);
if (*ctmark != newmark) {
*ctmark = newmark;
#if defined(CONFIG_IP_NF_CONNTRACK) || defined(CONFIG_IP_NF_CONNTRACK_MODULE)
}
break;
case XT_CONNMARK_RESTORE:
- nfmark = (*pskb)->nfmark;
- diff = (*ctmark ^ nfmark) & markinfo->mask;
+ mark = (*pskb)->mark;
+ diff = (*ctmark ^ mark) & markinfo->mask;
if (diff != 0)
- (*pskb)->nfmark = nfmark ^ diff;
+ (*pskb)->mark = mark ^ diff;
break;
}
}
{
const struct xt_mark_target_info *markinfo = targinfo;
- if((*pskb)->nfmark != markinfo->mark)
- (*pskb)->nfmark = markinfo->mark;
+ if((*pskb)->mark != markinfo->mark)
+ (*pskb)->mark = markinfo->mark;
return XT_CONTINUE;
}
break;
case XT_MARK_AND:
- mark = (*pskb)->nfmark & markinfo->mark;
+ mark = (*pskb)->mark & markinfo->mark;
break;
case XT_MARK_OR:
- mark = (*pskb)->nfmark | markinfo->mark;
+ mark = (*pskb)->mark | markinfo->mark;
break;
}
- if((*pskb)->nfmark != mark)
- (*pskb)->nfmark = mark;
+ if((*pskb)->mark != mark)
+ (*pskb)->mark = mark;
return XT_CONTINUE;
}
{
const struct xt_mark_info *info = matchinfo;
- return ((skb->nfmark & info->mask) == info->mark) ^ info->invert;
+ return ((skb->mark & info->mask) == info->mark) ^ info->invert;
}
static int
config CLS_U32_MARK
bool "Netfilter marks support"
- depends on NET_CLS_U32 && NETFILTER
+ depends on NET_CLS_U32
---help---
Say Y here to be able to use netfilter marks as u32 key.
struct fw_head *head = (struct fw_head*)tp->root;
struct fw_filter *f;
int r;
-#ifdef CONFIG_NETFILTER
- u32 id = skb->nfmark & head->mask;
-#else
- u32 id = 0;
-#endif
+ u32 id = skb->mark & head->mask;
if (head != NULL) {
for (f=head->ht[fw_hash(id)]; f; f=f->next) {
#endif
#ifdef CONFIG_CLS_U32_MARK
- if ((skb->nfmark & n->mark.mask) != n->mark.val) {
+ if ((skb->mark & n->mark.mask) != n->mark.val) {
n = n->next;
goto next_knode;
} else {
* Netfilter
**************************************************************************/
-META_COLLECTOR(int_nfmark)
+META_COLLECTOR(int_mark)
{
-#ifdef CONFIG_NETFILTER
- dst->value = skb->nfmark;
-#else
- dst->value = 0;
-#endif
+ dst->value = skb->mark;
}
/**************************************************************************
[META_ID(PKTLEN)] = META_FUNC(int_pktlen),
[META_ID(DATALEN)] = META_FUNC(int_datalen),
[META_ID(MACLEN)] = META_FUNC(int_maclen),
- [META_ID(NFMARK)] = META_FUNC(int_nfmark),
+ [META_ID(NFMARK)] = META_FUNC(int_mark),
[META_ID(TCINDEX)] = META_FUNC(int_tcindex),
[META_ID(RTCLASSID)] = META_FUNC(int_rtclassid),
[META_ID(RTIIF)] = META_FUNC(int_rtiif),