netdev - Re: [PATCH net] selftests: forwarding: vxlan_bridge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 14 Feb 2020 11:54:09 +0100
From:   Petr Machata <petrm@...lanox.com>
To:     Hangbin Liu <liuhangbin@...il.com>
Cc:     Petr Machata <pmachata@...il.com>, netdev@...r.kernel.org,
        Ido Schimmel <idosch@...lanox.com>,
        "David S . Miller" <davem@...emloft.net>,
        Peter Dawson <petedaws@...il.com>,
        Daniel Borkmann <daniel@...earbox.net>
Subject: Re: [PATCH net] selftests: forwarding: vxlan_bridge_1d: fix tos value


Hangbin Liu <liuhangbin@...il.com> writes:

> On Thu, Feb 13, 2020 at 01:52:49PM +0100, Petr Machata wrote:
>> 
>> Hangbin Liu <liuhangbin@...il.com> writes:
>> 
>> > After commit 71130f29979c ("vxlan: fix tos value before xmit") we start
>> > strict vxlan xmit tos value by RT_TOS(), which limits the tos value less
>> 
>> I don't understand how it is OK to slice the TOS field like this. It
>> could contain a DSCP value, which will be mangled.
>
> Thanks for this remind. I re-checked the tos definition and found a summary
> from Peter Dawson[1].
>
> IPv4/6 Header:0 |0 1 2 3 |0 1 2 3 |0 1 2 3 |0 1 2 3 |
> RFC2460(IPv6)   |Version | Traffic Class   |        |
> RFC2474(IPv6)   |Version | DSCP        |ECN|        |
> RFC2474(IPv4)   |Version |  IHL   |    DSCP     |ECN|
> RFC1349(IPv4)   |Version |  IHL   | PREC |  TOS   |X|
> RFC791 (IPv4)   |Version |  IHL   |      TOS        |
>
> According to this I think our current IPTOS_TOS_MASK should be updated to 0xFC
> based on RFC2474. But I'm not sure if there will have compatibility issue.
> What do you think?

Looking at the various uses of RT_TOS, it looks like they tend to be
used in tunneling and routing code. I think that in both cases it makes
sense to convert to 0xfc. But I'm not ready to vouch for this :)

What is the problem that commit 71130f29979c aims to solve? It's not
clear to me from the commit message. What issues arise if the TOS is
copied as is?

>
>> >  	tc filter add dev v1 egress pref 77 prot ip \
>> > -		flower ip_tos 0x40 action pass
>> > -	vxlan_ping_test $h1 192.0.2.3 "-Q 0x40" v1 egress 77 10
>> > -	vxlan_ping_test $h1 192.0.2.3 "-Q 0x30" v1 egress 77 0
>> > +		flower ip_tos 0x11 action pass
>> > +	vxlan_ping_test $h1 192.0.2.3 "-Q 0x11" v1 egress 77 10
>> > +	vxlan_ping_test $h1 192.0.2.3 "-Q 0x12" v1 egress 77 0
>> 
>> 0x11 and 0x12 set the ECN bits, I think it would be better to avoid
>> that. It works just as well with 0x14 and 0x18.
>
> Thanks, I will update it.
>
> [1] https://lore.kernel.org/patchwork/patch/799698/#992992
>
> Regards
> Hangbin