netdev - Re: [PATCH net-next v2 00/12] Unmask upper DSCP bits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a9603de2-3ff3-40aa-9bb1-2a02c2ed3e5e@kernel.org>
Date: Thu, 29 Aug 2024 18:55:23 -0700
From: David Ahern <dsahern@...nel.org>
To: Ido Schimmel <idosch@...dia.com>, netdev@...r.kernel.org
Cc: davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com,
 edumazet@...gle.com, gnault@...hat.com, ast@...nel.org,
 daniel@...earbox.net, martin.lau@...ux.dev, john.fastabend@...il.com,
 steffen.klassert@...unet.com, herbert@...dor.apana.org.au,
 bpf@...r.kernel.org
Subject: Re: [PATCH net-next v2 00/12] Unmask upper DSCP bits - part 2

On 8/28/24 12:54 AM, Ido Schimmel wrote:
> tl;dr - This patchset continues to unmask the upper DSCP bits in the
> IPv4 flow key in preparation for allowing IPv4 FIB rules to match on
> DSCP. No functional changes are expected. Part 1 was merged in commit
> ("Merge branch 'unmask-upper-dscp-bits-part-1'").
> 
> The TOS field in the IPv4 flow key ('flowi4_tos') is used during FIB
> lookup to match against the TOS selector in FIB rules and routes.
> 
> It is currently impossible for user space to configure FIB rules that
> match on the DSCP value as the upper DSCP bits are either masked in the
> various call sites that initialize the IPv4 flow key or along the path
> to the FIB core.
> 
> In preparation for adding a DSCP selector to IPv4 and IPv6 FIB rules, we
> need to make sure the entire DSCP value is present in the IPv4 flow key.
> This patchset continues to unmask the upper DSCP bits, but this time in
> the output route path.
> 
> Patches #1-#3 unmask the upper DSCP bits in the various places that
> invoke the core output route lookup functions directly.
> 
> Patches #4-#6 do the same in three helpers that are widely used in the
> output path to initialize the TOS field in the IPv4 flow key.
> 
> The rest of the patches continue to unmask these bits in call sites that
> invoke the following wrappers around the core lookup functions:
> 
> Patch #7 - __ip_route_output_key()
> Patches #8-#12 - ip_route_output_flow()
> 
> The next patchset will handle the callers of ip_route_output_ports() and
> ip_route_output_key().
> 
> No functional changes are expected as commit 1fa3314c14c6 ("ipv4:
> Centralize TOS matching") moved the masking of the upper DSCP bits to
> the core where 'flowi4_tos' is matched against the TOS selector.
> 
> Changes since v1 [1]:
> 
> * Remove IPTOS_RT_MASK in patch #7 instead of in patch #6
> 
> [1] https://lore.kernel.org/netdev/20240827111813.2115285-1-idosch@nvidia.com/
> 
> Ido Schimmel (12):
>   ipv4: Unmask upper DSCP bits in RTM_GETROUTE output route lookup
>   ipv4: Unmask upper DSCP bits in ip_route_output_key_hash()
>   ipv4: icmp: Unmask upper DSCP bits in icmp_route_lookup()
>   ipv4: Unmask upper DSCP bits in ip_sock_rt_tos()
>   ipv4: Unmask upper DSCP bits in get_rttos()
>   ipv4: Unmask upper DSCP bits when building flow key
>   xfrm: Unmask upper DSCP bits in xfrm_get_tos()
>   ipv4: Unmask upper DSCP bits in ip_send_unicast_reply()
>   ipv6: sit: Unmask upper DSCP bits in ipip6_tunnel_xmit()
>   ipvlan: Unmask upper DSCP bits in ipvlan_process_v4_outbound()
>   vrf: Unmask upper DSCP bits in vrf_process_v4_outbound()
>   bpf: Unmask upper DSCP bits in __bpf_redirect_neigh_v4()
> 
>  drivers/net/ipvlan/ipvlan_core.c | 4 +++-
>  drivers/net/vrf.c                | 3 ++-
>  include/net/ip.h                 | 5 ++++-
>  include/net/route.h              | 5 ++---
>  net/core/filter.c                | 2 +-
>  net/ipv4/icmp.c                  | 3 ++-
>  net/ipv4/ip_output.c             | 3 ++-
>  net/ipv4/route.c                 | 8 ++++----
>  net/ipv6/sit.c                   | 5 +++--
>  net/xfrm/xfrm_policy.c           | 3 ++-
>  10 files changed, 25 insertions(+), 16 deletions(-)
> 

For the set:

Reviewed-by: David Ahern <dsahern@...nel.org>