Re: [PATCH] Change xt_TOS v1 target to zero-out semantic

[Patrick McHardy <kaber@trash.net>]

Jan Engelhardt wrote:
> This patch changes the behavior of xt_TOS v1 so that the mask value
> one supplies means "zero out these bits" rather than "keep these
> bits". This is more easy on the user, as (I would assume) people
> keep more bits than zeroing, so, an example:
> 
> 	Action: Set bit 0x01.
> 	before: iptables -j TOS --set-tos 0x01/0xFE
> 	after:  iptables -j TOS --set-tos 0x01/0x01
> 
> This is not too "tragic" with xt_TOS, but where larger fields are
> used (e.g. proposed xt_MARK v2), `--set-xmark 0x01/0xFFFFFFFE` vs.
> `--set-xmark 0x01/0x01` is really a worthy difference.
> Other modules, such as xt_TPROXY also use &~ rather than &, so
> let's find a common ground.

I'm going to apply this, but only if we're going to have
an easier to use userspace extension for this.

I'd prefer:

--set-tos: set exact value, no mask
--or-tos: set single bits
--xor-tos: flip single bits
--and-tos: mask single bits