netdev - Re: [PATCH iproute2-next 5/5] iprule: Add DSCP mask support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87jz9fjt6o.fsf@nvidia.com>
Date: Mon, 24 Feb 2025 15:35:51 +0100
From: Petr Machata <petrm@...dia.com>
To: Ido Schimmel <idosch@...dia.com>
CC: <netdev@...r.kernel.org>, <stephen@...workplumber.org>,
	<dsahern@...il.com>, <gnault@...hat.com>, <petrm@...dia.com>
Subject: Re: [PATCH iproute2-next 5/5] iprule: Add DSCP mask support


Ido Schimmel <idosch@...dia.com> writes:

> Add DSCP mask support, allowing users to specify a DSCP value with an
> optional mask. Example:
>
>  # ip rule add dscp 1 table 100
>  # ip rule add dscp 0x02/0x3f table 200
>  # ip rule add dscp AF42/0x3f table 300
>  # ip rule add dscp 0x10/0x30 table 400
>
> In non-JSON output, the DSCP mask is not printed in case of exact match
> and the DSCP value is printed in hexadecimal format in case of inexact
> match:
>
>  $ ip rule show
>  0:      from all lookup local
>  32762:  from all lookup 400 dscp 0x10/0x30
>  32763:  from all lookup 300 dscp AF42
>  32764:  from all lookup 200 dscp 2
>  32765:  from all lookup 100 dscp 1
>  32766:  from all lookup main
>  32767:  from all lookup default
>
> Dump can be filtered by DSCP value and mask:
>
>  $ ip rule show dscp 1
>  32765:  from all lookup 100 dscp 1
>  $ ip rule show dscp AF42
>  32763:  from all lookup 300 dscp AF42
>  $ ip rule show dscp 0x10/0x30
>  32762:  from all lookup 400 dscp 0x10/0x30
>
> In JSON output, the DSCP mask is printed as an hexadecimal string to be
> consistent with other masks. The DSCP value is printed as an integer in
> order not to break existing scripts:
>
>  $ ip -j -p -N rule show dscp 0x10/0x30
>  [ {
>          "priority": 32762,
>          "src": "all",
>          "table": "400",
>          "dscp": "16",
>          "dscp_mask": "0x30"
>      } ]
>
> The mask attribute is only sent to the kernel in case of inexact match
> so that iproute2 will continue working with kernels that do not support
> the attribute.
>
> Signed-off-by: Ido Schimmel <idosch@...dia.com>

Reviewed-by: Petr Machata <petrm@...dia.com>

> @@ -552,8 +560,24 @@ int print_rule(struct nlmsghdr *n, void *arg)
>  	if (tb[FRA_DSCP]) {
>  		__u8 dscp = rta_getattr_u8(tb[FRA_DSCP]);
>  
> -		print_string(PRINT_ANY, "dscp", " dscp %s",
> -			     rtnl_dscp_n2a(dscp, b1, sizeof(b1)));

Hm, this should have been an integer under -N. Too late for that :-/

> +		if (tb[FRA_DSCP_MASK]) {
> +			__u8 mask = rta_getattr_u8(tb[FRA_DSCP_MASK]);
> +
> +			print_string(PRINT_JSON, "dscp", NULL,
> +				     rtnl_dscp_n2a(dscp, b1, sizeof(b1)));
> +			print_0xhex(PRINT_JSON, "dscp_mask", NULL, mask);
> +			if (mask == DSCP_MAX_MASK) {
> +				print_string(PRINT_FP, NULL, " dscp %s",
> +					     rtnl_dscp_n2a(dscp, b1,
> +							   sizeof(b1)));
> +			} else {
> +				print_0xhex(PRINT_FP, NULL, " dscp %#x", dscp);
> +				print_0xhex(PRINT_FP, NULL, "/%#x", mask);
> +			}
> +		} else {
> +			print_string(PRINT_ANY, "dscp", " dscp %s",
> +				     rtnl_dscp_n2a(dscp, b1, sizeof(b1)));
> +		}
>  	}
>  
>  	/* The kernel will either provide both attributes, or none */