linux-kernel - Re: [PATCH] ip6_tunnel: Correct tos value in collect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <594006A0.9020801@iogearbox.net>
Date:   Tue, 13 Jun 2017 17:37:04 +0200
From:   Daniel Borkmann <daniel@...earbox.net>
To:     严海双 <yanhaishuang@...s.chinamobile.com>
CC:     "David S. Miller" <davem@...emloft.net>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        James Morris <jmorris@...ei.org>,
        Patrick McHardy <kaber@...sh.net>, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, peter.a.dawson@...ing.com, ast@...com
Subject: Re: [PATCH] ip6_tunnel: Correct tos value in collect_md mode

On 06/13/2017 03:31 PM, 严海双 wrote:
>> On 13 Jun 2017, at 5:57 PM, Daniel Borkmann <daniel@...earbox.net> wrote:
>> On 06/13/2017 09:55 AM, Haishuang Yan wrote:
>>> Same as ip_gre, geneve and vxlan, use key->tos as tos value.
>>
>> Please also add Fixes tag and Cc original authors.
>>
>> Fixes: 0e9a709560db ("ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets”)
>
> Ok, I will add it, thanks
>
>>> Signed-off-by: Haishuang Yan <yanhaishuang@...s.chinamobile.com>
>>> ---
>>>   net/ipv6/ip6_tunnel.c | 4 ++--
>>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
>>> index ef99d59..5f4aff5 100644
>>> --- a/net/ipv6/ip6_tunnel.c
>>> +++ b/net/ipv6/ip6_tunnel.c
>>> @@ -1249,7 +1249,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
>>>   		fl6.flowi6_proto = IPPROTO_IPIP;
>>>   		fl6.daddr = key->u.ipv6.dst;
>>>   		fl6.flowlabel = key->label;
>>> -		dsfield = ip6_tclass(key->label);
>>> +		dsfield = key->tos;
>>
>> Not exactly the same as vxlan / geneve. They do use key->tos
>> indeed, but they also set fl6.flowlabel differently:
>>
>>   [...]
>>   prio = info->key.tos;
>>   [...]
>>   fl6->flowlabel = ip6_make_flowinfo(RT_TOS(prio),
>>                                      info->key.label);
>>   [...]
>>
>> But looks like the latter is done later in ip6_tnl_xmit() eventually
>> before the route lookup as per 5f733ee68f9a ("ip6_tunnel: fix traffic
>> class routing for tunnels") fix. However, you still might want to
>> mask key->tos with RT_TOS().
>
> Do you mean this way?

This one from my last comment: dsfield = RT_TOS(key->tos)