netdev - Re: [PATCH iproute2-next 5/5] iprule: Add DSCP mask support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z7yeDXAK26NOEue4@shredder>
Date: Mon, 24 Feb 2025 18:27:57 +0200
From: Ido Schimmel <idosch@...dia.com>
To: Petr Machata <petrm@...dia.com>
Cc: netdev@...r.kernel.org, stephen@...workplumber.org, dsahern@...il.com,
	gnault@...hat.com
Subject: Re: [PATCH iproute2-next 5/5] iprule: Add DSCP mask support

On Mon, Feb 24, 2025 at 03:35:51PM +0100, Petr Machata wrote:
> 
> Ido Schimmel <idosch@...dia.com> writes:
> 
> > Add DSCP mask support, allowing users to specify a DSCP value with an
> > optional mask. Example:
> >
> >  # ip rule add dscp 1 table 100
> >  # ip rule add dscp 0x02/0x3f table 200
> >  # ip rule add dscp AF42/0x3f table 300
> >  # ip rule add dscp 0x10/0x30 table 400
> >
> > In non-JSON output, the DSCP mask is not printed in case of exact match
> > and the DSCP value is printed in hexadecimal format in case of inexact
> > match:
> >
> >  $ ip rule show
> >  0:      from all lookup local
> >  32762:  from all lookup 400 dscp 0x10/0x30
> >  32763:  from all lookup 300 dscp AF42
> >  32764:  from all lookup 200 dscp 2
> >  32765:  from all lookup 100 dscp 1
> >  32766:  from all lookup main
> >  32767:  from all lookup default
> >
> > Dump can be filtered by DSCP value and mask:
> >
> >  $ ip rule show dscp 1
> >  32765:  from all lookup 100 dscp 1
> >  $ ip rule show dscp AF42
> >  32763:  from all lookup 300 dscp AF42
> >  $ ip rule show dscp 0x10/0x30
> >  32762:  from all lookup 400 dscp 0x10/0x30
> >
> > In JSON output, the DSCP mask is printed as an hexadecimal string to be
> > consistent with other masks. The DSCP value is printed as an integer in
> > order not to break existing scripts:
> >
> >  $ ip -j -p -N rule show dscp 0x10/0x30
> >  [ {
> >          "priority": 32762,
> >          "src": "all",
> >          "table": "400",
> >          "dscp": "16",
> >          "dscp_mask": "0x30"
> >      } ]
> >
> > The mask attribute is only sent to the kernel in case of inexact match
> > so that iproute2 will continue working with kernels that do not support
> > the attribute.
> >
> > Signed-off-by: Ido Schimmel <idosch@...dia.com>
> 
> Reviewed-by: Petr Machata <petrm@...dia.com>
> 
> > @@ -552,8 +560,24 @@ int print_rule(struct nlmsghdr *n, void *arg)
> >  	if (tb[FRA_DSCP]) {
> >  		__u8 dscp = rta_getattr_u8(tb[FRA_DSCP]);
> >  
> > -		print_string(PRINT_ANY, "dscp", " dscp %s",
> > -			     rtnl_dscp_n2a(dscp, b1, sizeof(b1)));
> 
> Hm, this should have been an integer under -N. Too late for that :-/

I assume you mean 16 vs "16" in the last example? It is a deliberate
decision:

https://lore.kernel.org/netdev/d3cd276a-b3b0-4ccc-9b51-dbedd841d7af@kernel.org/