netdev - Re: [PATCH net-next] net: DSCP in IPv4 routing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 13 Nov 2020 10:02:25 +0100
From:   Guillaume Nault <gnault@...hat.com>
To:     Stephen Hemminger <stephen@...workplumber.org>
Cc:     Russell Strong <russell@...ong.id.au>, netdev@...r.kernel.org
Subject: Re: [PATCH net-next] net: DSCP in IPv4 routing

On Thu, Nov 12, 2020 at 07:36:56PM -0800, Stephen Hemminger wrote:
> On Fri, 13 Nov 2020 12:06:37 +1000
> Russell Strong <russell@...ong.id.au> wrote:
> 
> > diff --git a/include/uapi/linux/in_route.h
> > b/include/uapi/linux/in_route.h index 0cc2c23b47f8..db5d236b9c50 100644
> > --- a/include/uapi/linux/in_route.h
> > +++ b/include/uapi/linux/in_route.h
> > @@ -28,6 +28,6 @@
> >  
> >  #define RTCF_NAT	(RTCF_DNAT|RTCF_SNAT)
> >  
> > -#define RT_TOS(tos)	((tos)&IPTOS_TOS_MASK)
> > +#define RT_TOS(tos)	((tos)&IPTOS_DS_MASK)
> >  
> 
> Changing behavior of existing header files risks breaking applications.
> 
> > diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
> > index ce54a30c2ef1..1499105d1efd 100644
> > --- a/net/ipv4/fib_rules.c
> > +++ b/net/ipv4/fib_rules.c
> > @@ -229,7 +229,7 @@ static int fib4_rule_configure(struct fib_rule
> > *rule, struct sk_buff *skb, int err = -EINVAL;
> >  	struct fib4_rule *rule4 = (struct fib4_rule *) rule;
> >  
> > -	if (frh->tos & ~IPTOS_TOS_MASK) {
> > +	if (frh->tos & ~IPTOS_RT_MASK) {
> 
> This needs to be behind a sysctl and the default has to be to keep
> the old behavior

Can't we just define a new DSCP mask and replace the users of TOS one
by one? In most cases DSCP just makes the 3 highest bits available,
which souldn't change existing behaviours. We just need to pay
attention to the ECN bit that'd be masked out by DSCP but not by old
TOS. However, ECN has been supported for a long time, so most usages of
TOS already clear both ECN bits.

Let's not add a new sysctl if not necessary and, in any case, let's not
change macros blindly.