[PATCH net-next 00/12] Unmask upper DSCP bits - part 1

[PATCH net-next 00/12] Unmask upper DSCP bits - part 1

[Ido Schimmel]

tl;dr - This patchset starts to unmask the upper DSCP bits in the IPv4
flow key in preparation for allowing IPv4 FIB rules to match on DSCP. No
functional changes are expected.

The TOS field in the IPv4 flow key ('flowi4_tos') is used during FIB
lookup to match against the TOS selector in FIB rules and routes.

It is currently impossible for user space to configure FIB rules that
match on the DSCP value as the upper DSCP bits are either masked in the
various call sites that initialize the IPv4 flow key or along the path
to the FIB core.

In preparation for adding a DSCP selector to IPv4 and IPv6 FIB rules, we
need to make sure the entire DSCP value is present in the IPv4 flow key.
This patchset starts to unmask the upper DSCP bits in the various places
that invoke the core FIB lookup functions directly (patches #1-#7) and
in the input route path (patches #8-#12). Future patchsets will do the
same in the output route path.

No functional changes are expected as commit 1fa3314c14c6 ("ipv4:
Centralize TOS matching") moved the masking of the upper DSCP bits to
the core where 'flowi4_tos' is matched against the TOS selector.

Ido Schimmel (12):
  bpf: Unmask upper DSCP bits in bpf_fib_lookup() helper
  ipv4: Unmask upper DSCP bits in NETLINK_FIB_LOOKUP family
  ipv4: Unmask upper DSCP bits when constructing the Record Route option
  netfilter: rpfilter: Unmask upper DSCP bits
  netfilter: nft_fib: Unmask upper DSCP bits
  ipv4: ipmr: Unmask upper DSCP bits in ipmr_rt_fib_lookup()
  ipv4: Unmask upper DSCP bits in fib_compute_spec_dst()
  ipv4: Unmask upper DSCP bits in input route lookup
  ipv4: Unmask upper DSCP bits in RTM_GETROUTE input route lookup
  ipv4: icmp: Pass full DS field to ip_route_input()
  ipv4: udp: Unmask upper DSCP bits during early demux
  ipv4: Unmask upper DSCP bits when using hints

 net/core/filter.c                 | 3 ++-
 net/ipv4/fib_frontend.c           | 4 ++--
 net/ipv4/icmp.c                   | 2 +-
 net/ipv4/ipmr.c                   | 3 ++-
 net/ipv4/netfilter/ipt_rpfilter.c | 3 ++-
 net/ipv4/netfilter/nft_fib_ipv4.c | 3 ++-
 net/ipv4/route.c                  | 8 ++++----
 net/ipv4/udp.c                    | 3 ++-
 8 files changed, 17 insertions(+), 12 deletions(-)

-- 
2.46.0

[PATCH net-next 01/12] bpf: Unmask upper DSCP bits in bpf_fib_lookup() helper

[Ido Schimmel]

The helper performs a FIB lookup according to the parameters in the
'params' argument, one of which is 'tos'. According to the test in
test_tc_neigh_fib.c, it seems that BPF programs are expected to
initialize the 'tos' field to the full 8 bit DS field from the IPv4
header.

Unmask the upper DSCP bits before invoking the IPv4 FIB lookup APIs so
that in the future the lookup could be performed according to the full
DSCP value.

No functional changes intended since the upper DSCP bits are masked when
comparing against the TOS selectors in FIB rules and routes.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/core/filter.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index f3c72cf86099..89f56fac48fb 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -84,6 +84,7 @@
 #include <net/netkit.h>
 #include <linux/un.h>
 #include <net/xdp_sock_drv.h>
+#include <net/inet_dscp.h>
 
 #include "dev.h"
 
@@ -5899,7 +5900,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
 		fl4.flowi4_iif = params->ifindex;
 		fl4.flowi4_oif = 0;
 	}
-	fl4.flowi4_tos = params->tos & IPTOS_RT_MASK;
+	fl4.flowi4_tos = params->tos & INET_DSCP_MASK;
 	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
 	fl4.flowi4_flags = 0;
 
-- 
2.46.0

Re: [PATCH net-next 01/12] bpf: Unmask upper DSCP bits in bpf_fib_lookup() helper

[Guillaume Nault]

On Wed, Aug 21, 2024 at 03:52:40PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits before invoking the IPv4 FIB lookup APIs so
> that in the future the lookup could be performed according to the full
> DSCP value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 02/12] ipv4: Unmask upper DSCP bits in NETLINK_FIB_LOOKUP family

[Ido Schimmel]

The NETLINK_FIB_LOOKUP netlink family can be used to perform a FIB
lookup according to user provided parameters and communicate the result
back to user space.

Unmask the upper DSCP bits of the user-provided DS field before invoking
the IPv4 FIB lookup API so that in the future the lookup could be
performed according to the full DSCP value.

No functional changes intended since the upper DSCP bits are masked when
comparing against the TOS selectors in FIB rules and routes.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/fib_frontend.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index da540ddb7af6..8b740f575da1 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1343,7 +1343,7 @@ static void nl_fib_lookup(struct net *net, struct fib_result_nl *frn)
 	struct flowi4           fl4 = {
 		.flowi4_mark = frn->fl_mark,
 		.daddr = frn->fl_addr,
-		.flowi4_tos = frn->fl_tos & IPTOS_RT_MASK,
+		.flowi4_tos = frn->fl_tos & INET_DSCP_MASK,
 		.flowi4_scope = frn->fl_scope,
 	};
 	struct fib_table *tb;
-- 
2.46.0

Re: [PATCH net-next 02/12] ipv4: Unmask upper DSCP bits in NETLINK_FIB_LOOKUP family

[Guillaume Nault]

On Wed, Aug 21, 2024 at 03:52:41PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits of the user-provided DS field before invoking
> the IPv4 FIB lookup API so that in the future the lookup could be
> performed according to the full DSCP value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 03/12] ipv4: Unmask upper DSCP bits when constructing the Record Route option

[Ido Schimmel]

The Record Route IP option records the addresses of the routers that
routed the packet. In the case of forwarded packets, the kernel performs
a route lookup via fib_lookup() and fills in the preferred source
address of the matched route.

Unmask the upper DSCP bits when performing the lookup so that in the
future the lookup could be performed according to the full DSCP value.

No functional changes intended since the upper DSCP bits are masked when
comparing against the TOS selectors in FIB rules and routes.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/route.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 13c0f1d455f3..9b6528b7b562 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1263,7 +1263,7 @@ void ip_rt_get_source(u8 *addr, struct sk_buff *skb, struct rtable *rt)
 		struct flowi4 fl4 = {
 			.daddr = iph->daddr,
 			.saddr = iph->saddr,
-			.flowi4_tos = iph->tos & IPTOS_RT_MASK,
+			.flowi4_tos = iph->tos & INET_DSCP_MASK,
 			.flowi4_oif = rt->dst.dev->ifindex,
 			.flowi4_iif = skb->dev->ifindex,
 			.flowi4_mark = skb->mark,
-- 
2.46.0

Re: [PATCH net-next 03/12] ipv4: Unmask upper DSCP bits when constructing the Record Route option

[Guillaume Nault]

On Wed, Aug 21, 2024 at 03:52:42PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when performing the lookup so that in the
> future the lookup could be performed according to the full DSCP value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 04/12] netfilter: rpfilter: Unmask upper DSCP bits

[Ido Schimmel]

The rpfilter match performs a reverse path filter test on a packet by
performing a FIB lookup with the source and destination addresses
swapped.

Unmask the upper DSCP bits of the DS field of the tested packet so that
in the future the FIB lookup could be performed according to the full
DSCP value.

No functional changes intended since the upper DSCP bits are masked when
comparing against the TOS selectors in FIB rules and routes.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/netfilter/ipt_rpfilter.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
index ded5bef02f77..1ce7a1655b97 100644
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -8,6 +8,7 @@
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
+#include <net/inet_dscp.h>
 #include <linux/ip.h>
 #include <net/ip.h>
 #include <net/ip_fib.h>
@@ -75,7 +76,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	flow.daddr = iph->saddr;
 	flow.saddr = rpfilter_get_saddr(iph->daddr);
 	flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
-	flow.flowi4_tos = iph->tos & IPTOS_RT_MASK;
+	flow.flowi4_tos = iph->tos & INET_DSCP_MASK;
 	flow.flowi4_scope = RT_SCOPE_UNIVERSE;
 	flow.flowi4_l3mdev = l3mdev_master_ifindex_rcu(xt_in(par));
 	flow.flowi4_uid = sock_net_uid(xt_net(par), NULL);
-- 
2.46.0

Re: [PATCH net-next 04/12] netfilter: rpfilter: Unmask upper DSCP bits

[Guillaume Nault]

On Wed, Aug 21, 2024 at 03:52:43PM +0300, Ido Schimmel wrote:
> The rpfilter match performs a reverse path filter test on a packet by
> performing a FIB lookup with the source and destination addresses
> swapped.
> 
> Unmask the upper DSCP bits of the DS field of the tested packet so that
> in the future the FIB lookup could be performed according to the full
> DSCP value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 05/12] netfilter: nft_fib: Unmask upper DSCP bits

[Ido Schimmel]

In a similar fashion to the iptables rpfilter match, unmask the upper
DSCP bits of the DS field of the currently tested packet so that in the
future the FIB lookup could be performed according to the full DSCP
value.

No functional changes intended since the upper DSCP bits are masked when
comparing against the TOS selectors in FIB rules and routes.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/netfilter/nft_fib_ipv4.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c
index df94bc28c3d7..00da1332bbf1 100644
--- a/net/ipv4/netfilter/nft_fib_ipv4.c
+++ b/net/ipv4/netfilter/nft_fib_ipv4.c
@@ -10,6 +10,7 @@
 #include <net/netfilter/nf_tables.h>
 #include <net/netfilter/nft_fib.h>
 
+#include <net/inet_dscp.h>
 #include <net/ip_fib.h>
 #include <net/route.h>
 
@@ -108,7 +109,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
 	if (priv->flags & NFTA_FIB_F_MARK)
 		fl4.flowi4_mark = pkt->skb->mark;
 
-	fl4.flowi4_tos = iph->tos & IPTOS_RT_MASK;
+	fl4.flowi4_tos = iph->tos & INET_DSCP_MASK;
 
 	if (priv->flags & NFTA_FIB_F_DADDR) {
 		fl4.daddr = iph->daddr;
-- 
2.46.0

Re: [PATCH net-next 05/12] netfilter: nft_fib: Unmask upper DSCP bits

[Guillaume Nault]

On Wed, Aug 21, 2024 at 03:52:44PM +0300, Ido Schimmel wrote:
> In a similar fashion to the iptables rpfilter match, unmask the upper
> DSCP bits of the DS field of the currently tested packet so that in the
> future the FIB lookup could be performed according to the full DSCP
> value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 06/12] ipv4: ipmr: Unmask upper DSCP bits in ipmr_rt_fib_lookup()

[Ido Schimmel]

Unmask the upper DSCP bits when calling ipmr_fib_lookup() so that in the
future it could perform the FIB lookup according to the full DSCP value.

Note that ipmr_fib_lookup() performs a FIB rule lookup (returning the
relevant routing table) and that IPv4 multicast FIB rules do not support
matching on TOS / DSCP. However, it is still worth unmasking the upper
DSCP bits in case support for DSCP matching is ever added.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/ipmr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 6c750bd13dd8..d5295b69bc0a 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -62,6 +62,7 @@
 #include <net/fib_rules.h>
 #include <linux/netconf.h>
 #include <net/rtnh.h>
+#include <net/inet_dscp.h>
 
 #include <linux/nospec.h>
 
@@ -2080,7 +2081,7 @@ static struct mr_table *ipmr_rt_fib_lookup(struct net *net, struct sk_buff *skb)
 	struct flowi4 fl4 = {
 		.daddr = iph->daddr,
 		.saddr = iph->saddr,
-		.flowi4_tos = RT_TOS(iph->tos),
+		.flowi4_tos = iph->tos & INET_DSCP_MASK,
 		.flowi4_oif = (rt_is_output_route(rt) ?
 			       skb->dev->ifindex : 0),
 		.flowi4_iif = (rt_is_output_route(rt) ?
-- 
2.46.0

Re: [PATCH net-next 06/12] ipv4: ipmr: Unmask upper DSCP bits in ipmr_rt_fib_lookup()

[Guillaume Nault]

On Wed, Aug 21, 2024 at 03:52:45PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when calling ipmr_fib_lookup() so that in the
> future it could perform the FIB lookup according to the full DSCP value.
> 
> Note that ipmr_fib_lookup() performs a FIB rule lookup (returning the
> relevant routing table) and that IPv4 multicast FIB rules do not support
> matching on TOS / DSCP. However, it is still worth unmasking the upper
> DSCP bits in case support for DSCP matching is ever added.

Indeed,

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 07/12] ipv4: Unmask upper DSCP bits in fib_compute_spec_dst()

[Ido Schimmel]

As explained in commit 35ebf65e851c ("ipv4: Create and use
fib_compute_spec_dst() helper."), the function is used - for example -
to determine the source address for an ICMP reply. If we are responding
to a multicast or broadcast packet, the source address is set to the
source address that we would use if we were to send a packet to the
unicast source of the original packet. This address is determined by
performing a FIB lookup and using the preferred source address of the
resulting route.

Unmask the upper DSCP bits of the DS field of the packet that triggered
the reply so that in the future the FIB lookup could be performed
according to the full DSCP value.

No functional changes intended since the upper DSCP bits are masked when
comparing against the TOS selectors in FIB rules and routes.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/fib_frontend.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 8b740f575da1..793e6781399a 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -293,7 +293,7 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
 			.flowi4_iif = LOOPBACK_IFINDEX,
 			.flowi4_l3mdev = l3mdev_master_ifindex_rcu(dev),
 			.daddr = ip_hdr(skb)->saddr,
-			.flowi4_tos = ip_hdr(skb)->tos & IPTOS_RT_MASK,
+			.flowi4_tos = ip_hdr(skb)->tos & INET_DSCP_MASK,
 			.flowi4_scope = scope,
 			.flowi4_mark = vmark ? skb->mark : 0,
 		};
-- 
2.46.0

Re: [PATCH net-next 07/12] ipv4: Unmask upper DSCP bits in fib_compute_spec_dst()

[Guillaume Nault]

On Wed, Aug 21, 2024 at 03:52:46PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits of the DS field of the packet that triggered
> the reply so that in the future the FIB lookup could be performed
> according to the full DSCP value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 08/12] ipv4: Unmask upper DSCP bits in input route lookup

[Ido Schimmel]

Unmask the upper DSCP bits in input route lookup so that in the future
the lookup could be performed according to the full DSCP value.

No functional changes intended since the upper DSCP bits are masked when
comparing against the TOS selectors in FIB rules and routes.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/route.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 9b6528b7b562..73bb61162445 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2470,7 +2470,7 @@ int ip_route_input_noref(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 	struct fib_result res;
 	int err;
 
-	tos &= IPTOS_RT_MASK;
+	tos &= INET_DSCP_MASK;
 	rcu_read_lock();
 	err = ip_route_input_rcu(skb, daddr, saddr, tos, dev, &res);
 	rcu_read_unlock();
-- 
2.46.0

Re: [PATCH net-next 08/12] ipv4: Unmask upper DSCP bits in input route lookup

[Guillaume Nault]

On Wed, Aug 21, 2024 at 03:52:47PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits in input route lookup so that in the future
> the lookup could be performed according to the full DSCP value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 09/12] ipv4: Unmask upper DSCP bits in RTM_GETROUTE input route lookup

[Ido Schimmel]

Unmask the upper DSCP bits when looking up an input route via the
RTM_GETROUTE netlink message so that in the future the lookup could be
performed according to the full DSCP value.

No functional changes intended since the upper DSCP bits are masked when
comparing against the TOS selectors in FIB rules and routes.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/route.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 73bb61162445..524b70ab77a0 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -3286,7 +3286,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
 		skb->dev	= dev;
 		skb->mark	= mark;
 		err = ip_route_input_rcu(skb, dst, src,
-					 rtm->rtm_tos & IPTOS_RT_MASK, dev,
+					 rtm->rtm_tos & INET_DSCP_MASK, dev,
 					 &res);
 
 		rt = skb_rtable(skb);
-- 
2.46.0

Re: [PATCH net-next 09/12] ipv4: Unmask upper DSCP bits in RTM_GETROUTE input route lookup

[Guillaume Nault]

On Wed, Aug 21, 2024 at 03:52:48PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when looking up an input route via the
> RTM_GETROUTE netlink message so that in the future the lookup could be
> performed according to the full DSCP value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 10/12] ipv4: icmp: Pass full DS field to ip_route_input()

[Ido Schimmel]

Align the ICMP code to other callers of ip_route_input() and pass the
full DS field. In the future this will allow us to perform a route
lookup according to the full DSCP value.

No functional changes intended since the upper DSCP bits are masked when
comparing against the TOS selectors in FIB rules and routes.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/icmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index ab6d0d98dbc3..b8f56d03fcbb 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -545,7 +545,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
 		orefdst = skb_in->_skb_refdst; /* save old refdst */
 		skb_dst_set(skb_in, NULL);
 		err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr,
-				     RT_TOS(tos), rt2->dst.dev);
+				     tos, rt2->dst.dev);
 
 		dst_release(&rt2->dst);
 		rt2 = skb_rtable(skb_in);
-- 
2.46.0

Re: [PATCH net-next 10/12] ipv4: icmp: Pass full DS field to ip_route_input()

[Guillaume Nault]

On Wed, Aug 21, 2024 at 03:52:49PM +0300, Ido Schimmel wrote:
> Align the ICMP code to other callers of ip_route_input() and pass the
> full DS field. In the future this will allow us to perform a route
> lookup according to the full DSCP value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 11/12] ipv4: udp: Unmask upper DSCP bits during early demux

[Ido Schimmel]

Unmask the upper DSCP bits when performing source validation for
multicast packets during early demux. In the future, this will allow us
to perform the FIB lookup which is performed as part of source
validation according to the full DSCP value.

No functional changes intended since the upper DSCP bits are masked when
comparing against the TOS selectors in FIB rules and routes.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/udp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ddb86baaea6c..8accbf4cb295 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -115,6 +115,7 @@
 #include <net/addrconf.h>
 #include <net/udp_tunnel.h>
 #include <net/gro.h>
+#include <net/inet_dscp.h>
 #if IS_ENABLED(CONFIG_IPV6)
 #include <net/ipv6_stubs.h>
 #endif
@@ -2618,7 +2619,7 @@ int udp_v4_early_demux(struct sk_buff *skb)
 		if (!inet_sk(sk)->inet_daddr && in_dev)
 			return ip_mc_validate_source(skb, iph->daddr,
 						     iph->saddr,
-						     iph->tos & IPTOS_RT_MASK,
+						     iph->tos & INET_DSCP_MASK,
 						     skb->dev, in_dev, &itag);
 	}
 	return 0;
-- 
2.46.0

Re: [PATCH net-next 11/12] ipv4: udp: Unmask upper DSCP bits during early demux

[Guillaume Nault]

On Wed, Aug 21, 2024 at 03:52:50PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when performing source validation for
> multicast packets during early demux. In the future, this will allow us
> to perform the FIB lookup which is performed as part of source
> validation according to the full DSCP value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

[PATCH net-next 12/12] ipv4: Unmask upper DSCP bits when using hints

[Ido Schimmel]

Unmask the upper DSCP bits when performing source validation and routing
a packet using the same route from a previously processed packet (hint).
In the future, this will allow us to perform the FIB lookup that is
performed as part of source validation according to the full DSCP value.

No functional changes intended since the upper DSCP bits are masked when
comparing against the TOS selectors in FIB rules and routes.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv4/route.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 524b70ab77a0..f6972b24664a 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2160,7 +2160,7 @@ int ip_route_use_hint(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 	if (rt->rt_type != RTN_LOCAL)
 		goto skip_validate_source;
 
-	tos &= IPTOS_RT_MASK;
+	tos &= INET_DSCP_MASK;
 	err = fib_validate_source(skb, saddr, daddr, tos, 0, dev, in_dev, &tag);
 	if (err < 0)
 		goto martian_source;
-- 
2.46.0

Re: [PATCH net-next 12/12] ipv4: Unmask upper DSCP bits when using hints

[Guillaume Nault]

On Wed, Aug 21, 2024 at 03:52:51PM +0300, Ido Schimmel wrote:
> Unmask the upper DSCP bits when performing source validation and routing
> a packet using the same route from a previously processed packet (hint).
> In the future, this will allow us to perform the FIB lookup that is
> performed as part of source validation according to the full DSCP value.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

Re: [PATCH net-next 00/12] Unmask upper DSCP bits - part 1

[Florian Westphal]

Ido Schimmel <idosch@nvidia.com> wrote:
> tl;dr - This patchset starts to unmask the upper DSCP bits in the IPv4
> flow key in preparation for allowing IPv4 FIB rules to match on DSCP. No
> functional changes are expected.

Thanks Ido.

For netfilter bits:
Acked-by: Florian Westphal <fw@strlen.de>

Re: [PATCH net-next 00/12] Unmask upper DSCP bits - part 1

[David Ahern]

On 8/21/24 6:52 AM, Ido Schimmel wrote:
> tl;dr - This patchset starts to unmask the upper DSCP bits in the IPv4
> flow key in preparation for allowing IPv4 FIB rules to match on DSCP. No
> functional changes are expected.
> 
> The TOS field in the IPv4 flow key ('flowi4_tos') is used during FIB
> lookup to match against the TOS selector in FIB rules and routes.
> 
> It is currently impossible for user space to configure FIB rules that
> match on the DSCP value as the upper DSCP bits are either masked in the
> various call sites that initialize the IPv4 flow key or along the path
> to the FIB core.
> 
> In preparation for adding a DSCP selector to IPv4 and IPv6 FIB rules, we
> need to make sure the entire DSCP value is present in the IPv4 flow key.
> This patchset starts to unmask the upper DSCP bits in the various places
> that invoke the core FIB lookup functions directly (patches #1-#7) and
> in the input route path (patches #8-#12). Future patchsets will do the
> same in the output route path.
> 
> No functional changes are expected as commit 1fa3314c14c6 ("ipv4:
> Centralize TOS matching") moved the masking of the upper DSCP bits to
> the core where 'flowi4_tos' is matched against the TOS selector.
> 

for the set:
Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net-next 00/12] Unmask upper DSCP bits - part 1

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 21 Aug 2024 15:52:39 +0300 you wrote:
> tl;dr - This patchset starts to unmask the upper DSCP bits in the IPv4
> flow key in preparation for allowing IPv4 FIB rules to match on DSCP. No
> functional changes are expected.
> 
> The TOS field in the IPv4 flow key ('flowi4_tos') is used during FIB
> lookup to match against the TOS selector in FIB rules and routes.
> 
> [...]

Here is the summary with links:
  - [net-next,01/12] bpf: Unmask upper DSCP bits in bpf_fib_lookup() helper
    https://git.kernel.org/netdev/net-next/c/ef434fae7228
  - [net-next,02/12] ipv4: Unmask upper DSCP bits in NETLINK_FIB_LOOKUP family
    https://git.kernel.org/netdev/net-next/c/bc52a4eecefd
  - [net-next,03/12] ipv4: Unmask upper DSCP bits when constructing the Record Route option
    https://git.kernel.org/netdev/net-next/c/be2e9089cb34
  - [net-next,04/12] netfilter: rpfilter: Unmask upper DSCP bits
    https://git.kernel.org/netdev/net-next/c/c1ae5ca69b69
  - [net-next,05/12] netfilter: nft_fib: Unmask upper DSCP bits
    https://git.kernel.org/netdev/net-next/c/338385e059c5
  - [net-next,06/12] ipv4: ipmr: Unmask upper DSCP bits in ipmr_rt_fib_lookup()
    https://git.kernel.org/netdev/net-next/c/2bc9778b6696
  - [net-next,07/12] ipv4: Unmask upper DSCP bits in fib_compute_spec_dst()
    https://git.kernel.org/netdev/net-next/c/39d3628f7cea
  - [net-next,08/12] ipv4: Unmask upper DSCP bits in input route lookup
    https://git.kernel.org/netdev/net-next/c/df9131c7fafd
  - [net-next,09/12] ipv4: Unmask upper DSCP bits in RTM_GETROUTE input route lookup
    https://git.kernel.org/netdev/net-next/c/b1251a6f1a9b
  - [net-next,10/12] ipv4: icmp: Pass full DS field to ip_route_input()
    https://git.kernel.org/netdev/net-next/c/1c6f50b37f71
  - [net-next,11/12] ipv4: udp: Unmask upper DSCP bits during early demux
    https://git.kernel.org/netdev/net-next/c/b6791ac5ea49
  - [net-next,12/12] ipv4: Unmask upper DSCP bits when using hints
    https://git.kernel.org/netdev/net-next/c/be8b8ded7799

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html