Re: [PATCH net] fib_rules: don't break ECN with TOS rules

On Sun, Jun 12, 2016, at 02:36, Hannes Frederic Sowa wrote:

On Sun, Jun 12, 2016, at 02:09, Julian Anastasov wrote:

quoted

	Hello,

On Sat, 11 Jun 2016, Hannes Frederic Sowa wrote:

quoted

Users of ToS rules could accidentally break ECN, this patch tries to
fix this in a way so we don't break shell scripts depending on the old
behavior while still being transparent to ECN. This quietly fixes ECN
behavior for old setups.

For IPv6 we have no check if we check for ECN bits, in IPv4 we only
check for the last bit, which is specified to be '0' from pre-DSCP times
(because of implementation confusion).

This patch changes fib rules in a way that matches only for ecn bits
will never match from now on (I consider them illegal), as we simply
ignore those rules (it was easier to explain in a pr_warn). Opinions?

	Well, may be the confusion comes from commit 89aef8921bfb
("ipv4: Delete routing cache.") where the 'tos &= IPTOS_RT_MASK;'
line is lost from ip_route_input_common. I think, we should
add it back, so that we can properly match input routes with rules
that specify tos value. Old kernels didn't stored ECN bits in
flowi4_tos in the input path, so we should do the same.

I would love to have done that but was fearing problems with user space
compatibility. Also IPTOS_RT_MASK is not enough for filtering, we need
to check for the whole INET_ECN_MASK.

Correction: IPTOS_RT_MASK would be fine, but fib4_rule_configure uses
IPTOS_TOS_MASK.

Bye,
Hannes