netdev - Re: [PATCH net-next 0/6] net: fib_rules: Add DSCP selector support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ad17817c-5116-4877-83c3-fba41d1f1f53@kernel.org>
Date: Fri, 13 Sep 2024 08:31:06 -0600
From: David Ahern <dsahern@...nel.org>
To: Ido Schimmel <idosch@...dia.com>, netdev@...r.kernel.org
Cc: davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com,
 edumazet@...gle.com, gnault@...hat.com
Subject: Re: [PATCH net-next 0/6] net: fib_rules: Add DSCP selector support

On 9/11/24 3:37 AM, Ido Schimmel wrote:
> Currently, the kernel rejects IPv4 FIB rules that try to match on the
> upper three DSCP bits:
> 
>  # ip -4 rule add tos 0x1c table 100
>  # ip -4 rule add tos 0x3c table 100
>  Error: Invalid tos.
> 
> The reason for that is that historically users of the FIB lookup API
> only populated the lower three DSCP bits in the TOS field of the IPv4
> flow key ('flowi4_tos'), which fits the TOS definition from the initial
> IPv4 specification (RFC 791).
> 
> This is not very useful nowadays and instead some users want to be able
> to match on the six bits DSCP field, which replaced the TOS and IP
> precedence fields over 25 years ago (RFC 2474). In addition, the current
> behavior differs between IPv4 and IPv6 which does allow users to match
> on the entire DSCP field using the TOS selector.
> 
> Recent patchsets made sure that callers of the FIB lookup API now
> populate the entire DSCP field in the IPv4 flow key. Therefore, it is
> now possible to extend FIB rules to match on DSCP.
> 
> This is done by adding a new DSCP attribute which is implemented for
> both IPv4 and IPv6 to provide user space programs a consistent behavior
> between both address families.
> 
> The behavior of the old TOS selector is unchanged and IPv4 FIB rules
> using it will only match on the lower three DSCP bits. The kernel will
> reject rules that try to use both selectors.
> 
> Patch #1 adds the new DSCP attribute but rejects its usage.
> 
> Patches #2-#3 implement IPv4 and IPv6 support.
> 
> Patch #4 allows user space to use the new attribute.
> 
> Patches #5-#6 add selftests.
> 
> iproute2 changes can be found here [1].
> 
> [1] https://github.com/idosch/iproute2/tree/submit/dscp_rfc_v1
> 
> Ido Schimmel (6):
>   net: fib_rules: Add DSCP selector attribute
>   ipv4: fib_rules: Add DSCP selector support
>   ipv6: fib_rules: Add DSCP selector support
>   net: fib_rules: Enable DSCP selector usage
>   selftests: fib_rule_tests: Add DSCP selector match tests
>   selftests: fib_rule_tests: Add DSCP selector connect tests
> 
>  include/uapi/linux/fib_rules.h                |  1 +
>  net/core/fib_rules.c                          |  4 +-
>  net/ipv4/fib_rules.c                          | 54 ++++++++++-
>  net/ipv6/fib6_rules.c                         | 43 ++++++++-
>  tools/testing/selftests/net/fib_rule_tests.sh | 90 +++++++++++++++++++
>  5 files changed, 184 insertions(+), 8 deletions(-)
> 

For the set:
Reviewed-by: David Ahern <dsahern@...nel.org>