[PATCH net-next 00/12] Unmask upper DSCP bits - part 4 (last)

[PATCH net-next 00/12] Unmask upper DSCP bits - part 4 (last)

[Ido Schimmel]

tl;dr - This patchset finishes to unmask the upper DSCP bits in the IPv4
flow key in preparation for allowing IPv4 FIB rules to match on DSCP. No
functional changes are expected.

The TOS field in the IPv4 flow key ('flowi4_tos') is used during FIB
lookup to match against the TOS selector in FIB rules and routes.

It is currently impossible for user space to configure FIB rules that
match on the DSCP value as the upper DSCP bits are either masked in the
various call sites that initialize the IPv4 flow key or along the path
to the FIB core.

In preparation for adding a DSCP selector to IPv4 and IPv6 FIB rules, we
need to make sure the entire DSCP value is present in the IPv4 flow key.
This patchset finishes to unmask the upper DSCP bits by adjusting all
the callers of ip_route_output_key() to properly initialize the full
DSCP value in the IPv4 flow key.

No functional changes are expected as commit 1fa3314c14c6 ("ipv4:
Centralize TOS matching") moved the masking of the upper DSCP bits to
the core where 'flowi4_tos' is matched against the TOS selector.

Ido Schimmel (12):
  netfilter: br_netfilter: Unmask upper DSCP bits in
    br_nf_pre_routing_finish()
  ipv4: ip_gre: Unmask upper DSCP bits in ipgre_open()
  bpf: lwtunnel: Unmask upper DSCP bits in bpf_lwt_xmit_reroute()
  ipv4: icmp: Unmask upper DSCP bits in icmp_reply()
  ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev()
  ipv4: ip_tunnel: Unmask upper DSCP bits in ip_md_tunnel_xmit()
  ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_xmit()
  ipv4: netfilter: Unmask upper DSCP bits in ip_route_me_harder()
  netfilter: nft_flow_offload: Unmask upper DSCP bits in
    nft_flow_route()
  netfilter: nf_dup4: Unmask upper DSCP bits in nf_dup_ipv4_route()
  ipv4: udp_tunnel: Unmask upper DSCP bits in udp_tunnel_dst_lookup()
  sctp: Unmask upper DSCP bits in sctp_v4_get_dst()

 net/bridge/br_netfilter_hooks.c  |  3 ++-
 net/core/lwt_bpf.c               |  3 ++-
 net/ipv4/icmp.c                  |  2 +-
 net/ipv4/ip_gre.c                |  3 ++-
 net/ipv4/ip_tunnel.c             | 11 ++++++-----
 net/ipv4/netfilter.c             |  3 ++-
 net/ipv4/netfilter/nf_dup_ipv4.c |  3 ++-
 net/ipv4/udp_tunnel_core.c       |  3 ++-
 net/netfilter/nft_flow_offload.c |  3 ++-
 net/sctp/protocol.c              |  3 ++-
 10 files changed, 23 insertions(+), 14 deletions(-)

-- 
2.46.0

[PATCH net-next 01/12] netfilter: br_netfilter: Unmask upper DSCP bits in br_nf_pre_routing_finish()

[Ido Schimmel]

Unmask upper DSCP bits when calling ip_route_output() so that in the
future it could perform the FIB lookup according to the full DSCP value.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/bridge/br_netfilter_hooks.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 8f9c19d992ac..0e8bc0ea6175 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -36,6 +36,7 @@
 #include <net/route.h>
 #include <net/netfilter/br_netfilter.h>
 #include <net/netns/generic.h>
+#include <net/inet_dscp.h>
 
 #include <linux/uaccess.h>
 #include "br_private.h"
@@ -402,7 +403,7 @@ static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_
 				goto free_skb;
 
 			rt = ip_route_output(net, iph->daddr, 0,
-					     RT_TOS(iph->tos), 0,
+					     iph->tos & INET_DSCP_MASK, 0,
 					     RT_SCOPE_UNIVERSE);
 			if (!IS_ERR(rt)) {
 				/* - Bridged-and-DNAT'ed traffic doesn't
-- 
2.46.0

Re: [PATCH net-next 01/12] netfilter: br_netfilter: Unmask upper DSCP bits in br_nf_pre_routing_finish()

[Guillaume Nault]

On Thu, Sep 05, 2024 at 07:51:29PM +0300, Ido Schimmel wrote:
> Unmask upper DSCP bits when calling ip_route_output() so that in the
> future it could perform the FIB lookup according to the full DSCP value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 02/12] ipv4: ip_gre: Unmask upper DSCP bits in ipgre_open()

[Ido Schimmel]

Unmask the upper DSCP bits when calling ip_route_output_gre() so that in
the future it could perform the FIB lookup according to the full DSCP
value.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/ip_gre.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index b54c41f3ae3c..5f6fd382af38 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -44,6 +44,7 @@
 #include <net/gre.h>
 #include <net/dst_metadata.h>
 #include <net/erspan.h>
+#include <net/inet_dscp.h>
 
 /*
    Problems & solutions
@@ -930,7 +931,7 @@ static int ipgre_open(struct net_device *dev)
 					 t->parms.iph.daddr,
 					 t->parms.iph.saddr,
 					 t->parms.o_key,
-					 RT_TOS(t->parms.iph.tos),
+					 t->parms.iph.tos & INET_DSCP_MASK,
 					 t->parms.link);
 		if (IS_ERR(rt))
 			return -EADDRNOTAVAIL;
-- 
2.46.0

Re: [PATCH net-next 02/12] ipv4: ip_gre: Unmask upper DSCP bits in ipgre_open()

[Guillaume Nault]

On Thu, Sep 05, 2024 at 07:51:30PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when calling ip_route_output_gre() so that in
> the future it could perform the FIB lookup according to the full DSCP
> value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 03/12] bpf: lwtunnel: Unmask upper DSCP bits in bpf_lwt_xmit_reroute()

[Ido Schimmel]

Unmask the upper DSCP bits when calling ip_route_output_key() so that in
the future it could perform the FIB lookup according to the full DSCP
value.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/core/lwt_bpf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index afb05f58b64c..1a14f915b7a4 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -12,6 +12,7 @@
 #include <net/gre.h>
 #include <net/ip6_route.h>
 #include <net/ipv6_stubs.h>
+#include <net/inet_dscp.h>
 
 struct bpf_lwt_prog {
 	struct bpf_prog *prog;
@@ -205,7 +206,7 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)
 		fl4.flowi4_oif = oif;
 		fl4.flowi4_mark = skb->mark;
 		fl4.flowi4_uid = sock_net_uid(net, sk);
-		fl4.flowi4_tos = RT_TOS(iph->tos);
+		fl4.flowi4_tos = iph->tos & INET_DSCP_MASK;
 		fl4.flowi4_flags = FLOWI_FLAG_ANYSRC;
 		fl4.flowi4_proto = iph->protocol;
 		fl4.daddr = iph->daddr;
-- 
2.46.0

Re: [PATCH net-next 03/12] bpf: lwtunnel: Unmask upper DSCP bits in bpf_lwt_xmit_reroute()

[Guillaume Nault]

On Thu, Sep 05, 2024 at 07:51:31PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when calling ip_route_output_key() so that in
> the future it could perform the FIB lookup according to the full DSCP
> value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 04/12] ipv4: icmp: Unmask upper DSCP bits in icmp_reply()

[Ido Schimmel]

Unmask the upper DSCP bits when calling ip_route_output_key() so that in
the future it could perform the FIB lookup according to the full DSCP
value.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/icmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index d2463b6e390e..e1384e7331d8 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -445,7 +445,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
 	fl4.saddr = saddr;
 	fl4.flowi4_mark = mark;
 	fl4.flowi4_uid = sock_net_uid(net, NULL);
-	fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos);
+	fl4.flowi4_tos = ip_hdr(skb)->tos & INET_DSCP_MASK;
 	fl4.flowi4_proto = IPPROTO_ICMP;
 	fl4.flowi4_oif = l3mdev_master_ifindex(skb->dev);
 	security_skb_classify_flow(skb, flowi4_to_flowi_common(&fl4));
-- 
2.46.0

Re: [PATCH net-next 04/12] ipv4: icmp: Unmask upper DSCP bits in icmp_reply()

[Guillaume Nault]

On Thu, Sep 05, 2024 at 07:51:32PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when calling ip_route_output_key() so that in
> the future it could perform the FIB lookup according to the full DSCP
> value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 05/12] ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev()

[Ido Schimmel]

Unmask the upper DSCP bits when initializing an IPv4 flow key via
ip_tunnel_init_flow() before passing it to ip_route_output_key() so that
in the future we could perform the FIB lookup according to the full DSCP
value.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/ip_tunnel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 18964394d6bd..b632c128ecb7 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -293,7 +293,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
 
 		ip_tunnel_init_flow(&fl4, iph->protocol, iph->daddr,
 				    iph->saddr, tunnel->parms.o_key,
-				    RT_TOS(iph->tos), dev_net(dev),
+				    iph->tos & INET_DSCP_MASK, dev_net(dev),
 				    tunnel->parms.link, tunnel->fwmark, 0, 0);
 		rt = ip_route_output_key(tunnel->net, &fl4);
 
-- 
2.46.0

Re: [PATCH net-next 05/12] ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev()

[Guillaume Nault]

On Thu, Sep 05, 2024 at 07:51:33PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when initializing an IPv4 flow key via
> ip_tunnel_init_flow() before passing it to ip_route_output_key() so that
> in the future we could perform the FIB lookup according to the full DSCP
> value.
> 
> Signed-off-by: Ido Schimmel <idosch@nvidia.com>
> ---
>  net/ipv4/ip_tunnel.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
> index 18964394d6bd..b632c128ecb7 100644
> --- a/net/ipv4/ip_tunnel.c
> +++ b/net/ipv4/ip_tunnel.c
> @@ -293,7 +293,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
>  
>  		ip_tunnel_init_flow(&fl4, iph->protocol, iph->daddr,
>  				    iph->saddr, tunnel->parms.o_key,
> -				    RT_TOS(iph->tos), dev_net(dev),
> +				    iph->tos & INET_DSCP_MASK, dev_net(dev),

The net/inet_dscp.h header file is only included in patch 6, while it's
needed here in patch 5.

>  				    tunnel->parms.link, tunnel->fwmark, 0, 0);
>  		rt = ip_route_output_key(tunnel->net, &fl4);
>  
> -- 
> 2.46.0
> 

Re: [PATCH net-next 05/12] ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev()

[Ido Schimmel]

On Fri, Sep 06, 2024 at 01:36:35PM +0200, Guillaume Nault wrote:
> On Thu, Sep 05, 2024 at 07:51:33PM +0300, Ido Schimmel wrote:
> > Unmask the upper DSCP bits when initializing an IPv4 flow key via
> > ip_tunnel_init_flow() before passing it to ip_route_output_key() so that
> > in the future we could perform the FIB lookup according to the full DSCP
> > value.
> > 
> > Signed-off-by: Ido Schimmel <idosch@nvidia.com>
> > ---
> >  net/ipv4/ip_tunnel.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
> > index 18964394d6bd..b632c128ecb7 100644
> > --- a/net/ipv4/ip_tunnel.c
> > +++ b/net/ipv4/ip_tunnel.c
> > @@ -293,7 +293,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
> >  
> >  		ip_tunnel_init_flow(&fl4, iph->protocol, iph->daddr,
> >  				    iph->saddr, tunnel->parms.o_key,
> > -				    RT_TOS(iph->tos), dev_net(dev),
> > +				    iph->tos & INET_DSCP_MASK, dev_net(dev),
> 
> The net/inet_dscp.h header file is only included in patch 6, while it's
> needed here in patch 5.

Thanks. Probably happened when I reordered the patches. However, it
doesn't affect bisectability since the header is included via include/net/ip.h

> 
> >  				    tunnel->parms.link, tunnel->fwmark, 0, 0);
> >  		rt = ip_route_output_key(tunnel->net, &fl4);
> >  
> > -- 
> > 2.46.0
> > 
> 

Re: [PATCH net-next 05/12] ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev()

[Guillaume Nault]

On Fri, Sep 06, 2024 at 04:45:35PM +0300, Ido Schimmel wrote:
> On Fri, Sep 06, 2024 at 01:36:35PM +0200, Guillaume Nault wrote:
> > On Thu, Sep 05, 2024 at 07:51:33PM +0300, Ido Schimmel wrote:
> > > Unmask the upper DSCP bits when initializing an IPv4 flow key via
> > > ip_tunnel_init_flow() before passing it to ip_route_output_key() so that
> > > in the future we could perform the FIB lookup according to the full DSCP
> > > value.
> > > 
> > > Signed-off-by: Ido Schimmel <idosch@nvidia.com>
> > > ---
> > >  net/ipv4/ip_tunnel.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
> > > index 18964394d6bd..b632c128ecb7 100644
> > > --- a/net/ipv4/ip_tunnel.c
> > > +++ b/net/ipv4/ip_tunnel.c
> > > @@ -293,7 +293,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
> > >  
> > >  		ip_tunnel_init_flow(&fl4, iph->protocol, iph->daddr,
> > >  				    iph->saddr, tunnel->parms.o_key,
> > > -				    RT_TOS(iph->tos), dev_net(dev),
> > > +				    iph->tos & INET_DSCP_MASK, dev_net(dev),
> > 
> > The net/inet_dscp.h header file is only included in patch 6, while it's
> > needed here in patch 5.
> 
> Thanks. Probably happened when I reordered the patches. However, it
> doesn't affect bisectability since the header is included via include/net/ip.h

Okay, no need for a v2 then.
I'll ack the remaining patches.

And thanks again for your work!


> > >  				    tunnel->parms.link, tunnel->fwmark, 0, 0);
> > >  		rt = ip_route_output_key(tunnel->net, &fl4);
> > >  
> > > -- 
> > > 2.46.0
> > > 
> > 
> 

Re: [PATCH net-next 05/12] ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev()

[Guillaume Nault]

On Thu, Sep 05, 2024 at 07:51:33PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when initializing an IPv4 flow key via
> ip_tunnel_init_flow() before passing it to ip_route_output_key() so that
> in the future we could perform the FIB lookup according to the full DSCP
> value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 06/12] ipv4: ip_tunnel: Unmask upper DSCP bits in ip_md_tunnel_xmit()

[Ido Schimmel]

Unmask the upper DSCP bits when initializing an IPv4 flow key via
ip_tunnel_init_flow() before passing it to ip_route_output_key() so that
in the future we could perform the FIB lookup according to the full DSCP
value.

Note that the 'tos' variable includes the full DS field. Either the one
specified via the tunnel key or the one inherited from the inner packet.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/ip_tunnel.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index b632c128ecb7..09e0effcd034 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -43,6 +43,7 @@
 #include <net/rtnetlink.h>
 #include <net/udp.h>
 #include <net/dst_metadata.h>
+#include <net/inet_dscp.h>
 
 #if IS_ENABLED(CONFIG_IPV6)
 #include <net/ipv6.h>
@@ -609,9 +610,9 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
 			tos = ipv6_get_dsfield((const struct ipv6hdr *)inner_iph);
 	}
 	ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src,
-			    tunnel_id_to_key32(key->tun_id), RT_TOS(tos),
-			    dev_net(dev), 0, skb->mark, skb_get_hash(skb),
-			    key->flow_flags);
+			    tunnel_id_to_key32(key->tun_id),
+			    tos & INET_DSCP_MASK, dev_net(dev), 0, skb->mark,
+			    skb_get_hash(skb), key->flow_flags);
 
 	if (!tunnel_hlen)
 		tunnel_hlen = ip_encap_hlen(&tun_info->encap);
-- 
2.46.0

Re: [PATCH net-next 06/12] ipv4: ip_tunnel: Unmask upper DSCP bits in ip_md_tunnel_xmit()

[Guillaume Nault]

On Thu, Sep 05, 2024 at 07:51:34PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when initializing an IPv4 flow key via
> ip_tunnel_init_flow() before passing it to ip_route_output_key() so that
> in the future we could perform the FIB lookup according to the full DSCP
> value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 07/12] ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_xmit()

[Ido Schimmel]

Unmask the upper DSCP bits when initializing an IPv4 flow key via
ip_tunnel_init_flow() before passing it to ip_route_output_key() so that
in the future we could perform the FIB lookup according to the full DSCP
value.

Note that the 'tos' variable includes the full DS field. Either the one
specified as part of the tunnel parameters or the one inherited from the
inner packet.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/ip_tunnel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 09e0effcd034..d591c73e2c0e 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -773,7 +773,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
 	}
 
 	ip_tunnel_init_flow(&fl4, protocol, dst, tnl_params->saddr,
-			    tunnel->parms.o_key, RT_TOS(tos),
+			    tunnel->parms.o_key, tos & INET_DSCP_MASK,
 			    dev_net(dev), READ_ONCE(tunnel->parms.link),
 			    tunnel->fwmark, skb_get_hash(skb), 0);
 
-- 
2.46.0

Re: [PATCH net-next 07/12] ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_xmit()

[Guillaume Nault]

On Thu, Sep 05, 2024 at 07:51:35PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when initializing an IPv4 flow key via
> ip_tunnel_init_flow() before passing it to ip_route_output_key() so that
> in the future we could perform the FIB lookup according to the full DSCP
> value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 08/12] ipv4: netfilter: Unmask upper DSCP bits in ip_route_me_harder()

[Ido Schimmel]

Unmask the upper DSCP bits when calling ip_route_output_key() so that in
the future it could perform the FIB lookup according to the full DSCP
value.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/netfilter.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 591a2737808e..e0aab66cd925 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -14,6 +14,7 @@
 #include <net/route.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
+#include <net/inet_dscp.h>
 #include <net/netfilter/nf_queue.h>
 
 /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
@@ -43,7 +44,7 @@ int ip_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb, un
 	 */
 	fl4.daddr = iph->daddr;
 	fl4.saddr = saddr;
-	fl4.flowi4_tos = RT_TOS(iph->tos);
+	fl4.flowi4_tos = iph->tos & INET_DSCP_MASK;
 	fl4.flowi4_oif = sk ? sk->sk_bound_dev_if : 0;
 	fl4.flowi4_l3mdev = l3mdev_master_ifindex(dev);
 	fl4.flowi4_mark = skb->mark;
-- 
2.46.0

Re: [PATCH net-next 08/12] ipv4: netfilter: Unmask upper DSCP bits in ip_route_me_harder()

[Guillaume Nault]

On Thu, Sep 05, 2024 at 07:51:36PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when calling ip_route_output_key() so that in
> the future it could perform the FIB lookup according to the full DSCP
> value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 09/12] netfilter: nft_flow_offload: Unmask upper DSCP bits in nft_flow_route()

[Ido Schimmel]

Unmask the upper DSCP bits when calling nf_route() which eventually
calls ip_route_output_key() so that in the future it could perform the
FIB lookup according to the full DSCP value.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/netfilter/nft_flow_offload.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index ab9576098701..8e7234107ae0 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -9,6 +9,7 @@
 #include <linux/netfilter/nf_conntrack_common.h>
 #include <linux/netfilter/nf_tables.h>
 #include <net/ip.h> /* for ipv4 options. */
+#include <net/inet_dscp.h>
 #include <net/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables_core.h>
 #include <net/netfilter/nf_conntrack_core.h>
@@ -235,7 +236,7 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
 		fl.u.ip4.saddr = ct->tuplehash[!dir].tuple.src.u3.ip;
 		fl.u.ip4.flowi4_oif = nft_in(pkt)->ifindex;
 		fl.u.ip4.flowi4_iif = this_dst->dev->ifindex;
-		fl.u.ip4.flowi4_tos = RT_TOS(ip_hdr(pkt->skb)->tos);
+		fl.u.ip4.flowi4_tos = ip_hdr(pkt->skb)->tos & INET_DSCP_MASK;
 		fl.u.ip4.flowi4_mark = pkt->skb->mark;
 		fl.u.ip4.flowi4_flags = FLOWI_FLAG_ANYSRC;
 		break;
-- 
2.46.0

Re: [PATCH net-next 09/12] netfilter: nft_flow_offload: Unmask upper DSCP bits in nft_flow_route()

[Guillaume Nault]

On Thu, Sep 05, 2024 at 07:51:37PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when calling nf_route() which eventually
> calls ip_route_output_key() so that in the future it could perform the
> FIB lookup according to the full DSCP value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 10/12] netfilter: nf_dup4: Unmask upper DSCP bits in nf_dup_ipv4_route()

[Ido Schimmel]

Unmask the upper DSCP bits when calling ip_route_output_key() so that in
the future it could perform the FIB lookup according to the full DSCP
value.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/netfilter/nf_dup_ipv4.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/netfilter/nf_dup_ipv4.c b/net/ipv4/netfilter/nf_dup_ipv4.c
index 6cc5743c553a..f4aed0789d69 100644
--- a/net/ipv4/netfilter/nf_dup_ipv4.c
+++ b/net/ipv4/netfilter/nf_dup_ipv4.c
@@ -15,6 +15,7 @@
 #include <net/icmp.h>
 #include <net/ip.h>
 #include <net/route.h>
+#include <net/inet_dscp.h>
 #include <net/netfilter/ipv4/nf_dup_ipv4.h>
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
 #include <net/netfilter/nf_conntrack.h>
@@ -32,7 +33,7 @@ static bool nf_dup_ipv4_route(struct net *net, struct sk_buff *skb,
 		fl4.flowi4_oif = oif;
 
 	fl4.daddr = gw->s_addr;
-	fl4.flowi4_tos = RT_TOS(iph->tos);
+	fl4.flowi4_tos = iph->tos & INET_DSCP_MASK;
 	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
 	fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH;
 	rt = ip_route_output_key(net, &fl4);
-- 
2.46.0

Re: [PATCH net-next 10/12] netfilter: nf_dup4: Unmask upper DSCP bits in nf_dup_ipv4_route()

[Guillaume Nault]

On Thu, Sep 05, 2024 at 07:51:38PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when calling ip_route_output_key() so that in
> the future it could perform the FIB lookup according to the full DSCP
> value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 11/12] ipv4: udp_tunnel: Unmask upper DSCP bits in udp_tunnel_dst_lookup()

[Ido Schimmel]

Unmask the upper DSCP bits when calling ip_route_output_key() so that in
the future it could perform the FIB lookup according to the full DSCP
value.

Note that callers of udp_tunnel_dst_lookup() pass the entire DS field in
the 'tos' argument.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/udp_tunnel_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/udp_tunnel_core.c b/net/ipv4/udp_tunnel_core.c
index e4e0fa869fa4..619a53eb672d 100644
--- a/net/ipv4/udp_tunnel_core.c
+++ b/net/ipv4/udp_tunnel_core.c
@@ -6,6 +6,7 @@
 #include <net/dst_metadata.h>
 #include <net/udp.h>
 #include <net/udp_tunnel.h>
+#include <net/inet_dscp.h>
 
 int udp_sock_create4(struct net *net, struct udp_port_cfg *cfg,
 		     struct socket **sockp)
@@ -232,7 +233,7 @@ struct rtable *udp_tunnel_dst_lookup(struct sk_buff *skb,
 	fl4.saddr = key->u.ipv4.src;
 	fl4.fl4_dport = dport;
 	fl4.fl4_sport = sport;
-	fl4.flowi4_tos = RT_TOS(tos);
+	fl4.flowi4_tos = tos & INET_DSCP_MASK;
 	fl4.flowi4_flags = key->flow_flags;
 
 	rt = ip_route_output_key(net, &fl4);
-- 
2.46.0

Re: [PATCH net-next 11/12] ipv4: udp_tunnel: Unmask upper DSCP bits in udp_tunnel_dst_lookup()

[Guillaume Nault]

On Thu, Sep 05, 2024 at 07:51:39PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when calling ip_route_output_key() so that in
> the future it could perform the FIB lookup according to the full DSCP
> value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 12/12] sctp: Unmask upper DSCP bits in sctp_v4_get_dst()

[Ido Schimmel]

Unmask the upper DSCP bits when calling ip_route_output_key() so that in
the future it could perform the FIB lookup according to the full DSCP
value.

Note that the 'tos' variable holds the full DS field.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/sctp/protocol.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 5a7436a13b74..39ca5403d4d7 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -44,6 +44,7 @@
 #include <net/inet_common.h>
 #include <net/inet_ecn.h>
 #include <net/udp_tunnel.h>
+#include <net/inet_dscp.h>
 
 #define MAX_SCTP_PORT_HASH_ENTRIES (64 * 1024)
 
@@ -435,7 +436,7 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
 	fl4->fl4_dport = daddr->v4.sin_port;
 	fl4->flowi4_proto = IPPROTO_SCTP;
 	if (asoc) {
-		fl4->flowi4_tos = RT_TOS(tos);
+		fl4->flowi4_tos = tos & INET_DSCP_MASK;
 		fl4->flowi4_scope = ip_sock_rt_scope(asoc->base.sk);
 		fl4->flowi4_oif = asoc->base.sk->sk_bound_dev_if;
 		fl4->fl4_sport = htons(asoc->base.bind_addr.port);
-- 
2.46.0

Re: [PATCH net-next 12/12] sctp: Unmask upper DSCP bits in sctp_v4_get_dst()

[Guillaume Nault]

On Thu, Sep 05, 2024 at 07:51:40PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when calling ip_route_output_key() so that in
> the future it could perform the FIB lookup according to the full DSCP
> value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

Re: [PATCH net-next 12/12] sctp: Unmask upper DSCP bits in sctp_v4_get_dst()

[Xin Long]

On Thu, Sep 5, 2024 at 12:54 PM Ido Schimmel <idosch@nvidia.com> wrote:
>
> Unmask the upper DSCP bits when calling ip_route_output_key() so that in
> the future it could perform the FIB lookup according to the full DSCP
> value.
>
> Note that the 'tos' variable holds the full DS field.
>
> Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>

Re: [PATCH net-next 00/12] Unmask upper DSCP bits - part 4 (last)

[David Ahern]

On 9/5/24 10:51 AM, Ido Schimmel wrote:
> tl;dr - This patchset finishes to unmask the upper DSCP bits in the IPv4
> flow key in preparation for allowing IPv4 FIB rules to match on DSCP. No
> functional changes are expected.
> 
> The TOS field in the IPv4 flow key ('flowi4_tos') is used during FIB
> lookup to match against the TOS selector in FIB rules and routes.
> 
> It is currently impossible for user space to configure FIB rules that
> match on the DSCP value as the upper DSCP bits are either masked in the
> various call sites that initialize the IPv4 flow key or along the path
> to the FIB core.
> 
> In preparation for adding a DSCP selector to IPv4 and IPv6 FIB rules, we
> need to make sure the entire DSCP value is present in the IPv4 flow key.
> This patchset finishes to unmask the upper DSCP bits by adjusting all
> the callers of ip_route_output_key() to properly initialize the full
> DSCP value in the IPv4 flow key.
> 
> No functional changes are expected as commit 1fa3314c14c6 ("ipv4:
> Centralize TOS matching") moved the masking of the upper DSCP bits to
> the core where 'flowi4_tos' is matched against the TOS selector.
> 
> Ido Schimmel (12):
>   netfilter: br_netfilter: Unmask upper DSCP bits in
>     br_nf_pre_routing_finish()
>   ipv4: ip_gre: Unmask upper DSCP bits in ipgre_open()
>   bpf: lwtunnel: Unmask upper DSCP bits in bpf_lwt_xmit_reroute()
>   ipv4: icmp: Unmask upper DSCP bits in icmp_reply()
>   ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev()
>   ipv4: ip_tunnel: Unmask upper DSCP bits in ip_md_tunnel_xmit()
>   ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_xmit()
>   ipv4: netfilter: Unmask upper DSCP bits in ip_route_me_harder()
>   netfilter: nft_flow_offload: Unmask upper DSCP bits in
>     nft_flow_route()
>   netfilter: nf_dup4: Unmask upper DSCP bits in nf_dup_ipv4_route()
>   ipv4: udp_tunnel: Unmask upper DSCP bits in udp_tunnel_dst_lookup()
>   sctp: Unmask upper DSCP bits in sctp_v4_get_dst()
> 
>  net/bridge/br_netfilter_hooks.c  |  3 ++-
>  net/core/lwt_bpf.c               |  3 ++-
>  net/ipv4/icmp.c                  |  2 +-
>  net/ipv4/ip_gre.c                |  3 ++-
>  net/ipv4/ip_tunnel.c             | 11 ++++++-----
>  net/ipv4/netfilter.c             |  3 ++-
>  net/ipv4/netfilter/nf_dup_ipv4.c |  3 ++-
>  net/ipv4/udp_tunnel_core.c       |  3 ++-
>  net/netfilter/nft_flow_offload.c |  3 ++-
>  net/sctp/protocol.c              |  3 ++-
>  10 files changed, 23 insertions(+), 14 deletions(-)
> 

For the set:
Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net-next 00/12] Unmask upper DSCP bits - part 4 (last)

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by David S. Miller <davem@davemloft.net>:

On Thu, 5 Sep 2024 19:51:28 +0300 you wrote:
> tl;dr - This patchset finishes to unmask the upper DSCP bits in the IPv4
> flow key in preparation for allowing IPv4 FIB rules to match on DSCP. No
> functional changes are expected.
> 
> The TOS field in the IPv4 flow key ('flowi4_tos') is used during FIB
> lookup to match against the TOS selector in FIB rules and routes.
> 
> [...]

Here is the summary with links:
  - [net-next,01/12] netfilter: br_netfilter: Unmask upper DSCP bits in br_nf_pre_routing_finish()
    https://git.kernel.org/netdev/net-next/c/1f23a1909d7f
  - [net-next,02/12] ipv4: ip_gre: Unmask upper DSCP bits in ipgre_open()
    https://git.kernel.org/netdev/net-next/c/25376a890119
  - [net-next,03/12] bpf: lwtunnel: Unmask upper DSCP bits in bpf_lwt_xmit_reroute()
    https://git.kernel.org/netdev/net-next/c/b3899830aa47
  - [net-next,04/12] ipv4: icmp: Unmask upper DSCP bits in icmp_reply()
    https://git.kernel.org/netdev/net-next/c/848789d552bb
  - [net-next,05/12] ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev()
    https://git.kernel.org/netdev/net-next/c/e7191e517a03
  - [net-next,06/12] ipv4: ip_tunnel: Unmask upper DSCP bits in ip_md_tunnel_xmit()
    https://git.kernel.org/netdev/net-next/c/c34cfe72bb26
  - [net-next,07/12] ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_xmit()
    https://git.kernel.org/netdev/net-next/c/c2b639f9f3b7
  - [net-next,08/12] ipv4: netfilter: Unmask upper DSCP bits in ip_route_me_harder()
    https://git.kernel.org/netdev/net-next/c/4f0880766a97
  - [net-next,09/12] netfilter: nft_flow_offload: Unmask upper DSCP bits in nft_flow_route()
    https://git.kernel.org/netdev/net-next/c/b7172768abfd
  - [net-next,10/12] netfilter: nf_dup4: Unmask upper DSCP bits in nf_dup_ipv4_route()
    https://git.kernel.org/netdev/net-next/c/345663e6a727
  - [net-next,11/12] ipv4: udp_tunnel: Unmask upper DSCP bits in udp_tunnel_dst_lookup()
    https://git.kernel.org/netdev/net-next/c/2c60fc9ca216
  - [net-next,12/12] sctp: Unmask upper DSCP bits in sctp_v4_get_dst()
    https://git.kernel.org/netdev/net-next/c/8b6d13cc8b38

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html