netdev - Re: [PATCH] allow DSCP values in ip rules

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 15 Nov 2018 17:59:59 +0300
From:   Pavel Balaev <mail@...d.so>
To:     netdev@...r.kernel.org
Subject: Re: [PATCH] allow DSCP values in ip rules

On Wed, Nov 14, 2018 at 05:30:37PM +0300, Pavel Balaev wrote:
> Hello, for now IP rules supports only old TOS values and we cannot use
> DSCP.
> 
> This patch adds support for DSCP values in IP rules:
> 
> $ ip r add default via 192.168.0.6 table test
> $ ip ru add tos 0x80 table test
> $ ip ru
> 0:	from all lookup local 
> 32764:	from all tos CS4 lookup test 
> 32766:	from all lookup main 
> 32767:	from all lookup default 
> $ ip r get fibmatch 8.8.8.9 tos 0x80
> default tos CS4 via 192.168.0.6 dev lan table test
> 
> Signed-off-by: Pavel Balaev <mail@...d.so>
> ---
>  net/ipv4/fib_rules.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
> index f8eb78d0..7a6c5bfe 100644
> --- a/net/ipv4/fib_rules.c
> +++ b/net/ipv4/fib_rules.c
> @@ -220,7 +220,7 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
>  	int err = -EINVAL;
>  	struct fib4_rule *rule4 = (struct fib4_rule *) rule;
>  
> -	if (frh->tos & ~IPTOS_TOS_MASK) {
> +	if (frh->tos & ~(IPTOS_TOS_MASK | IPTOS_PREC_MASK)) {
>  		NL_SET_ERR_MSG(extack, "Invalid tos");
>  		goto errout;
>  	}
> -- 
> 2.18.1
> 

In addition. This patch adds ability to set newer RFC2597 values. They
also presents in /etc/iproute2/rt_dsfield:

# Newer RFC2597 values
0x28	AF11
0x30	AF12
0x38	AF13
0x48	AF21
....

If one tries to apply this values with iproure2 (ip rule add tos 0x28
...) he will get error from netlink: "Invalid tos" for this moment.