netdev - Re: [PATCH iproute2-next 5/5] iprule: Add DSCP mask support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <877c5ejt69.fsf@nvidia.com>
Date: Tue, 25 Feb 2025 09:58:19 +0100
From: Petr Machata <petrm@...dia.com>
To: Ido Schimmel <idosch@...dia.com>
CC: Petr Machata <petrm@...dia.com>, <netdev@...r.kernel.org>,
	<stephen@...workplumber.org>, <dsahern@...il.com>, <gnault@...hat.com>
Subject: Re: [PATCH iproute2-next 5/5] iprule: Add DSCP mask support


Ido Schimmel <idosch@...dia.com> writes:

> On Mon, Feb 24, 2025 at 03:35:51PM +0100, Petr Machata wrote:
>> 
>> Ido Schimmel <idosch@...dia.com> writes:
>> 
>> > Add DSCP mask support, allowing users to specify a DSCP value with an
>> > optional mask. Example:
>> >
>> >  # ip rule add dscp 1 table 100
>> >  # ip rule add dscp 0x02/0x3f table 200
>> >  # ip rule add dscp AF42/0x3f table 300
>> >  # ip rule add dscp 0x10/0x30 table 400
>> >
>> > In non-JSON output, the DSCP mask is not printed in case of exact match
>> > and the DSCP value is printed in hexadecimal format in case of inexact
>> > match:
>> >
>> >  $ ip rule show
>> >  0:      from all lookup local
>> >  32762:  from all lookup 400 dscp 0x10/0x30
>> >  32763:  from all lookup 300 dscp AF42
>> >  32764:  from all lookup 200 dscp 2
>> >  32765:  from all lookup 100 dscp 1
>> >  32766:  from all lookup main
>> >  32767:  from all lookup default
>> >
>> > Dump can be filtered by DSCP value and mask:
>> >
>> >  $ ip rule show dscp 1
>> >  32765:  from all lookup 100 dscp 1
>> >  $ ip rule show dscp AF42
>> >  32763:  from all lookup 300 dscp AF42
>> >  $ ip rule show dscp 0x10/0x30
>> >  32762:  from all lookup 400 dscp 0x10/0x30
>> >
>> > In JSON output, the DSCP mask is printed as an hexadecimal string to be
>> > consistent with other masks. The DSCP value is printed as an integer in
>> > order not to break existing scripts:
>> >
>> >  $ ip -j -p -N rule show dscp 0x10/0x30
>> >  [ {
>> >          "priority": 32762,
>> >          "src": "all",
>> >          "table": "400",
>> >          "dscp": "16",
>> >          "dscp_mask": "0x30"
>> >      } ]
>> >
>> > The mask attribute is only sent to the kernel in case of inexact match
>> > so that iproute2 will continue working with kernels that do not support
>> > the attribute.
>> >
>> > Signed-off-by: Ido Schimmel <idosch@...dia.com>
>> 
>> Reviewed-by: Petr Machata <petrm@...dia.com>
>> 
>> > @@ -552,8 +560,24 @@ int print_rule(struct nlmsghdr *n, void *arg)
>> >  	if (tb[FRA_DSCP]) {
>> >  		__u8 dscp = rta_getattr_u8(tb[FRA_DSCP]);
>> >  
>> > -		print_string(PRINT_ANY, "dscp", " dscp %s",
>> > -			     rtnl_dscp_n2a(dscp, b1, sizeof(b1)));
>> 
>> Hm, this should have been an integer under -N. Too late for that :-/
>
> I assume you mean 16 vs "16" in the last example? It is a deliberate
> decision:
>
> https://lore.kernel.org/netdev/d3cd276a-b3b0-4ccc-9b51-dbedd841d7af@kernel.org/

Yeah, that's what I meant. I agree that if `ip` has it like that
throughout, it's better to respect it.