netdev - Re: [PATCH net] selftests: forwarding: vxlan_bridge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 14 Feb 2020 10:53:09 +0800
From:   Hangbin Liu <liuhangbin@...il.com>
To:     Petr Machata <pmachata@...il.com>
Cc:     netdev@...r.kernel.org, Ido Schimmel <idosch@...lanox.com>,
        "David S . Miller" <davem@...emloft.net>,
        Peter Dawson <petedaws@...il.com>,
        Daniel Borkmann <daniel@...earbox.net>
Subject: Re: [PATCH net] selftests: forwarding: vxlan_bridge_1d: fix tos value

On Thu, Feb 13, 2020 at 01:52:49PM +0100, Petr Machata wrote:
> 
> Hangbin Liu <liuhangbin@...il.com> writes:
> 
> > After commit 71130f29979c ("vxlan: fix tos value before xmit") we start
> > strict vxlan xmit tos value by RT_TOS(), which limits the tos value less
> 
> I don't understand how it is OK to slice the TOS field like this. It
> could contain a DSCP value, which will be mangled.

Thanks for this remind. I re-checked the tos definition and found a summary
from Peter Dawson[1].

IPv4/6 Header:0 |0 1 2 3 |0 1 2 3 |0 1 2 3 |0 1 2 3 |
RFC2460(IPv6)   |Version | Traffic Class   |        |
RFC2474(IPv6)   |Version | DSCP        |ECN|        |
RFC2474(IPv4)   |Version |  IHL   |    DSCP     |ECN|
RFC1349(IPv4)   |Version |  IHL   | PREC |  TOS   |X|
RFC791 (IPv4)   |Version |  IHL   |      TOS        |

According to this I think our current IPTOS_TOS_MASK should be updated to 0xFC
based on RFC2474. But I'm not sure if there will have compatibility issue.

What do you think?

> >  	tc filter add dev v1 egress pref 77 prot ip \
> > -		flower ip_tos 0x40 action pass
> > -	vxlan_ping_test $h1 192.0.2.3 "-Q 0x40" v1 egress 77 10
> > -	vxlan_ping_test $h1 192.0.2.3 "-Q 0x30" v1 egress 77 0
> > +		flower ip_tos 0x11 action pass
> > +	vxlan_ping_test $h1 192.0.2.3 "-Q 0x11" v1 egress 77 10
> > +	vxlan_ping_test $h1 192.0.2.3 "-Q 0x12" v1 egress 77 0
> 
> 0x11 and 0x12 set the ECN bits, I think it would be better to avoid
> that. It works just as well with 0x14 and 0x18.

Thanks, I will update it.

[1] https://lore.kernel.org/patchwork/patch/799698/#992992

Regards
Hangbin