netfilter: ipset: add hash:ip,mark data type to ipset

Introduce packet mark support with new ip,mark hash set. This includes
userspace and kernelspace code, hash:ip,mark set tests and man page
updates.

The intended use of ip,mark set is similar to the ip:port type, but for
protocols which don't use a predictable port number. Instead of port
number it matches a firewall mark determined by a layer 7 filtering
program like opendpi.

As well as allowing or blocking traffic it will also be used for
accounting packets and bytes sent for each protocol.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>

1 files changed, 6 insertions, 4 deletions

diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
index 0c7d01eae56c..4ac00d4aa87e 100644
--- a/include/linux/netfilter/ipset/ip_set.h
+++ b/include/linux/netfilter/ipset/ip_set.h
@@ -39,11 +39,13 @@ enum ip_set_feature {
         IPSET_TYPE_NAME = (1 << IPSET_TYPE_NAME_FLAG),
         IPSET_TYPE_IFACE_FLAG = 5,
         IPSET_TYPE_IFACE = (1 << IPSET_TYPE_IFACE_FLAG),
-        IPSET_TYPE_NOMATCH_FLAG = 6,
+        IPSET_TYPE_MARK_FLAG = 6,
+        IPSET_TYPE_MARK = (1 << IPSET_TYPE_MARK_FLAG),
+        IPSET_TYPE_NOMATCH_FLAG = 7,
         IPSET_TYPE_NOMATCH = (1 << IPSET_TYPE_NOMATCH_FLAG),
         /* Strictly speaking not a feature, but a flag for dumping:
          * this settype must be dumped last */
-        IPSET_DUMP_LAST_FLAG = 7,
+        IPSET_DUMP_LAST_FLAG = 8,
         IPSET_DUMP_LAST = (1 << IPSET_DUMP_LAST_FLAG),
 };
 
@@ -171,8 +173,6 @@ struct ip_set_type {
         char name[IPSET_MAXNAMELEN];
         /* Protocol version */
         u8 protocol;
-        /* Set features to control swapping */
-        u8 features;
         /* Set type dimension */
         u8 dimension;
         /*
@@ -182,6 +182,8 @@ struct ip_set_type {
         u8 family;
         /* Type revisions */
         u8 revision_min, revision_max;
+        /* Set features to control swapping */
+        u16 features;
 
         /* Create set */
         int (*create)(struct net *net, struct ip_set *set,