git/linux-cryptodev-2.6
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git synced 2026-04-21 04:53:46 -04:00
Code Issues Packages Projects Releases Wiki Activity

ipv4: Stop taking ECN bits into account in fib4-rules

Browse Source 
Use the new dscp_t type to replace the tos field of struct fib4_rule,
so that fib4-rules consistently ignore ECN bits.

Before this patch, fib4-rules did accept rules with the high order ECN
bit set (but not the low order one). Also, it relied on its callers
masking the ECN bits of ->flowi4_tos to prevent those from influencing
the result. This was brittle and a few call paths still do the lookup
without masking the ECN bits first.

After this patch fib4-rules only compare the DSCP bits. ECN can't
influence the result anymore, even if the caller didn't mask these
bits. Also, fib4-rules now must have both ECN bits cleared or they will
be rejected.

Signed-off-by: Guillaume Nault <gnault@redhat.com>
Acked-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Guillaume Nault
2022-02-04 14:58:14 +01:00
committed by Jakub Kicinski
parent a410a0cf98
commit 563f8e97e0
2 changed files with 39 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
tools/testing/selftests/net/fib_rule_tests.sh
View File

@@ -215,10 +215,25 @@ fib_rule4_test_match_n_redirect()
log_test $? 0 "rule4 del by pref: $description"
}
fib_rule4_test_reject()
{
local match="$1"
local rc
$IP rule add $match table $RTABLE 2>/dev/null
rc=$?
log_test $rc 2 "rule4 check: $match"
if [ $rc -eq 0 ]; then
$IP rule del $match table $RTABLE
fi
}
fib_rule4_test()
{
local getmatch
local match
local cnt
# setup the fib rule redirect route
$IP route add table $RTABLE default via $GW_IP4 dev $DEV onlink
@@ -234,8 +249,21 @@ fib_rule4_test()
fib_rule4_test_match_n_redirect "$match" "$match" "iif redirect to table"
ip netns exec testns sysctl -qw net.ipv4.ip_forward=0
# Reject dsfield (tos) options which have ECN bits set
for cnt in $(seq 1 3); do
match="dsfield $cnt"
fib_rule4_test_reject "$match"
done
# Don't take ECN bits into account when matching on dsfield
match="tos 0x10"
fib_rule4_test_match_n_redirect "$match" "$match" "tos redirect to table"
for cnt in "0x10" "0x11" "0x12" "0x13"; do
# Using option 'tos' instead of 'dsfield' as old iproute2
# versions don't support 'dsfield' in ip rule show.
getmatch="tos $cnt"
fib_rule4_test_match_n_redirect "$match" "$getmatch" \
"$getmatch redirect to table"
done
match="fwmark 0x64"
getmatch="mark 0x64"