netdev - Re: [PATCH net-next] ipv4: Convert ->flowi4_tos to dscp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aKcoAbPXff_IT7MN@debian>
Date: Thu, 21 Aug 2025 16:06:57 +0200
From: Guillaume Nault <gnault@...hat.com>
To: Ido Schimmel <idosch@...dia.com>
Cc: David Miller <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>, Eric Dumazet <edumazet@...gle.com>,
	netdev@...r.kernel.org, Simon Horman <horms@...nel.org>,
	Taehee Yoo <ap420073@...il.com>,
	Andrew Lunn <andrew+netdev@...n.ch>,
	Saeed Mahameed <saeedm@...dia.com>,
	Leon Romanovsky <leon@...nel.org>, Tariq Toukan <tariqt@...dia.com>,
	Mark Bloch <mbloch@...dia.com>,
	Edward Cree <ecree.xilinx@...il.com>,
	Pablo Neira Ayuso <pablo@...filter.org>,
	Harald Welte <laforge@...monks.org>,
	David Ahern <dsahern@...nel.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Masami Hiramatsu <mhiramat@...nel.org>,
	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
	Martin KaFai Lau <martin.lau@...ux.dev>,
	Daniel Borkmann <daniel@...earbox.net>,
	John Fastabend <john.fastabend@...il.com>,
	Stanislav Fomichev <sdf@...ichev.me>,
	Alexei Starovoitov <ast@...nel.org>,
	Andrii Nakryiko <andrii@...nel.org>,
	Eduard Zingerman <eddyz87@...il.com>, Song Liu <song@...nel.org>,
	Yonghong Song <yonghong.song@...ux.dev>,
	KP Singh <kpsingh@...nel.org>, Hao Luo <haoluo@...gle.com>,
	Jiri Olsa <jolsa@...nel.org>,
	Jozsef Kadlecsik <kadlec@...filter.org>,
	Florian Westphal <fw@...len.de>,
	Steffen Klassert <steffen.klassert@...unet.com>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	Marcelo Ricardo Leitner <marcelo.leitner@...il.com>,
	Xin Long <lucien.xin@...il.com>
Subject: Re: [PATCH net-next] ipv4: Convert ->flowi4_tos to dscp_t.

On Thu, Aug 21, 2025 at 09:56:08AM +0300, Ido Schimmel wrote:
> On Thu, Aug 21, 2025 at 01:32:03AM +0200, Guillaume Nault wrote:
> > Convert the ->flowic_tos field of struct flowi_common from __u8 to
> > dscp_t, rename it ->flowic_dscp and propagate these changes to struct
> > flowi and struct flowi4.
> > 
> > We've had several bugs in the past where ECN bits could interfere with
> > IPv4 routing, because these bits were not properly cleared when setting
> > ->flowi4_tos. These bugs should be fixed now and the dscp_t type has
> > been introduced to ensure that variables carrying DSCP values don't
> > accidentally have any ECN bits set. Several variables and structure
> > fields have been converted to dscp_t already, but the main IPv4 routing
> > structure, struct flowi4, is still using a __u8. To avoid any future
> > regression, this patch converts it to dscp_t.
> > 
> > There are many users to convert at once. Fortunately, around half of
> > ->flowi4_tos users already have a dscp_t value at hand, which they
> > currently convert to __u8 using inet_dscp_to_dsfield(). For all of
> > these users, we just need to drop that conversion.
> > 
> > But, although we try to do the __u8 <-> dscp_t conversions at the
> > boundaries of the network or of user space, some places still store
> > TOS/DSCP variables as __u8 in core networking code. Some structure
> > fields, like struct ip_tunnel_key::tos could be converted to dscp_t,
> > but that would require a lot of work, so this is left for later. Other
> > places can't be converted, for example because the data structure is
> > part of UAPI or because the same variable or field is also used for
> > handling ECN in other parts of the code. In all of these cases where we
> > don't have a dscp_t variable at hand, we need to use
> > inet_dsfield_to_dscp() when interacting with ->flowi4_dscp.
> > 
> > Signed-off-by: Guillaume Nault <gnault@...hat.com>
> 
> Reviewed-by: Ido Schimmel <idosch@...dia.com>
> 
> Thanks! One nit below
> 
> [...]
> 
> > diff --git a/net/core/filter.c b/net/core/filter.c
> > index da391e2b0788..c75f95c60af3 100644
> > --- a/net/core/filter.c
> > +++ b/net/core/filter.c
> > @@ -2373,7 +2373,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev,
> >  		struct flowi4 fl4 = {
> >  			.flowi4_flags = FLOWI_FLAG_ANYSRC,
> >  			.flowi4_mark  = skb->mark,
> > -			.flowi4_tos   = inet_dscp_to_dsfield(ip4h_dscp(ip4h)),
> > +			.flowi4_dscp   = ip4h_dscp(ip4h),
> 
> Nit: alignment is off

Thanks. I thought I had carefully reviewed my patch before posting...

By the way, do you have an opinion about converting struct
ip_tunnel_key::tos? Do you think it'd be worth it, or just code churn?

> >  			.flowi4_oif   = dev->ifindex,
> >  			.flowi4_proto = ip4h->protocol,
> >  			.daddr	      = ip4h->daddr,
>