netdev - Re: [Cake] [PATCH net] sch_cake: Interpret fwmark parameter as a bitmask

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 15 Mar 2019 22:29:02 +0100
From:   Toke Høiland-Jørgensen <toke@...hat.com>
To:     David Miller <davem@...emloft.net>
Cc:     netdev@...r.kernel.org, cake@...ts.bufferbloat.net, fuller@...f.de
Subject: Re: [Cake] [PATCH net] sch_cake: Interpret fwmark parameter as a bitmask

David Miller <davem@...emloft.net> writes:

> From: Toke Høiland-Jørgensen <toke@...hat.com>
> Date: Thu, 14 Mar 2019 23:08:22 +0100
>
>> We initially interpreted the fwmark parameter as a flag that simply turned
>> on the feature, using the whole skb->mark field as the index into the CAKE
>> tin_order array. However, it is quite common for different applications to
>> use different parts of the mask field for their own purposes, each using a
>> different mask.
>> 
>> Support this use of subsets of the mark by interpreting the TCA_CAKE_FWMARK
>> parameter as a bitmask to apply to the fwmark field when reading it. The
>> result will be right-shifted by the number of unset lower bits of the mask
>> before looking up the tin.
>> 
>> In the original commit message we also failed to credit Felix Resch with
>> originally suggesting the fwmark feature back in 2017; so the Suggested-By
>> in this commit covers the whole fwmark feature.
>> 
>> Fixes: 0b5c7efdfc6e ("sch_cake: Permit use of connmarks as tin classifiers")
>> Suggested-by: Felix Resch <fuller@...f.de>
>> Signed-off-by: Toke Høiland-Jørgensen <toke@...hat.com>
>
> You are lucky you decided to do this before a released kernel had this UAPI
> available.

Yeah; did realise we needed to make this change before a release, so
it's not entirely a coincidence that I sent this now :)

> Applied.

Thanks!

-Toke