From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Ahern Subject: Re: BUG REPORT: iproute2 seems to have bug with dsfield/tos in ip-rule and ip-route Date: Wed, 13 Dec 2017 16:05:57 -0700 Message-ID: <5c1e7fce-0030-0bf7-4eb1-917d40ab7120@gmail.com> References: <9e606c3b-915c-2608-c8aa-aa3167f51f8d@street-artists.org> <20171213101259.65652da6@xeon-e3> <4f4e5fc5-2141-9e38-2f5f-da5f7558d505@street-artists.org> <224860aa-17a8-37a1-cbfe-66899c1bba94@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit Cc: netdev@vger.kernel.org To: Daniel Lakeland , Stephen Hemminger Return-path: Received: from mail-pg0-f46.google.com ([74.125.83.46]:44749 "EHLO mail-pg0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750749AbdLMXGA (ORCPT ); Wed, 13 Dec 2017 18:06:00 -0500 Received: by mail-pg0-f46.google.com with SMTP id j9so2092123pgc.11 for ; Wed, 13 Dec 2017 15:05:59 -0800 (PST) In-Reply-To: Content-Language: en-US Sender: netdev-owner@vger.kernel.org List-ID: On 12/13/17 3:52 PM, Daniel Lakeland wrote: > On 12/13/2017 02:40 PM, David Ahern wrote: >> >> In fib4_rule_configure, this the check that is failing: >> >>      if (frh->tos & ~IPTOS_TOS_MASK) >>          goto errout; >> >> and EINVAL is returned. >> >> IPv4 routes has not checking on tos -- it is passed from user and >> rtm_tos to fc_tos to fib alias tos. > > it seems to me that this IPTOS_TOS_MASK check should be either gotten > rid of, or equal to 0x03 in modern usage. The bottom 2 bits are ECN and > I suppose someone might want to route based on congestion... and hence > maybe the mask should be dropped entirely, but if you refuse to allow > routes on ECN then you'd want 0x03 as the mask > > it seems to me this is left over from before DSCP. > > apparently most people don't route on DSCP or work around this with > firewall marks, and so this doesn't cause trouble enough to have been > reported before? > > I think the follow up question is does anyone have any idea why someone > who set up routes with dsfield settings is not seeing packets routed? > The kernel may not handle ip rule with DSCP, but it takes > > ip route add default dsfield CS6 dev veth0 > > just fine... and shows up in the route table, but for example the person > is not seeing CS6 marked packets going to veth2 and instead is seeing > them routed to veth0 the default route... > > If you are running a modern kernel (>= ~4.5) there are fib tracepoints you can use to try to answer that: perf record -e fib:fib_table_lookup -a -g perf script [-G] I've had some doubts about tos handling in the output path but have not had the time (or motivation) to dig into it. Specifically, the tos adjustments in ip_route_output_key_hash look weird to me.