linux-kernel - Re: [PATCH] ip6_tunnel: Correct tos value in collect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <593FB700.6020701@iogearbox.net>
Date:   Tue, 13 Jun 2017 11:57:20 +0200
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Haishuang Yan <yanhaishuang@...s.chinamobile.com>,
        "David S. Miller" <davem@...emloft.net>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        James Morris <jmorris@...ei.org>,
        Patrick McHardy <kaber@...sh.net>
CC:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        peter.a.dawson@...ing.com, ast@...com
Subject: Re: [PATCH] ip6_tunnel: Correct tos value in collect_md mode

On 06/13/2017 09:55 AM, Haishuang Yan wrote:
> Same as ip_gre, geneve and vxlan, use key->tos as tos value.
>

Please also add Fixes tag and Cc original authors.

Fixes: 0e9a709560db ("ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets")

> Signed-off-by: Haishuang Yan <yanhaishuang@...s.chinamobile.com>
> ---
>   net/ipv6/ip6_tunnel.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
> index ef99d59..5f4aff5 100644
> --- a/net/ipv6/ip6_tunnel.c
> +++ b/net/ipv6/ip6_tunnel.c
> @@ -1249,7 +1249,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
>   		fl6.flowi6_proto = IPPROTO_IPIP;
>   		fl6.daddr = key->u.ipv6.dst;
>   		fl6.flowlabel = key->label;
> -		dsfield = ip6_tclass(key->label);
> +		dsfield = key->tos;

Not exactly the same as vxlan / geneve. They do use key->tos
indeed, but they also set fl6.flowlabel differently:

   [...]
   prio = info->key.tos;
   [...]
   fl6->flowlabel = ip6_make_flowinfo(RT_TOS(prio),
                                      info->key.label);
   [...]

But looks like the latter is done later in ip6_tnl_xmit() eventually
before the route lookup as per 5f733ee68f9a ("ip6_tunnel: fix traffic
class routing for tunnels") fix. However, you still might want to
mask key->tos with RT_TOS().

>   	} else {
>   		if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
>   			encap_limit = t->parms.encap_limit;
> @@ -1320,7 +1320,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
>   		fl6.flowi6_proto = IPPROTO_IPV6;
>   		fl6.daddr = key->u.ipv6.dst;
>   		fl6.flowlabel = key->label;
> -		dsfield = ip6_tclass(key->label);
> +		dsfield = key->tos;
>   	} else {
>   		offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
>   		/* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
>