ipv6: Define dscp_t and stop taking ECN bits into account in fib6-rules

Define a dscp_t type and its appropriate helpers that ensure ECN bits
are not taken into account when handling DSCP.

Use this new type to replace the tclass field of struct fib6_rule, so
that fib6-rules don't get influenced by ECN bits anymore.

Before this patch, fib6-rules didn't make any distinction between the
DSCP and ECN bits. Therefore, rules specifying a DSCP (tos or dsfield
options in iproute2) stopped working as soon a packets had at least one
of its ECN bits set (as a work around one could create four rules for
each DSCP value to match, one for each possible ECN value).

After this patch fib6-rules only compare the DSCP bits. ECN doesn't
influence the result anymore. Also, fib6-rules now must have the ECN
bits cleared or they will be rejected.

Signed-off-by: Guillaume Nault <gnault@redhat.com>
Acked-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/include/net/inet_dscp.h b/include/net/inet_dscp.h
new file mode 100644 (file)
index 0000000..72f250d
--- /dev/null
+++ b/include/net/inet_dscp.h
@@ -0,0 +1,57 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * inet_dscp.h: helpers for handling differentiated services codepoints (DSCP)
+ *
+ * DSCP is defined in RFC 2474:
+ *
+ *        0   1   2   3   4   5   6   7
+ *      +---+---+---+---+---+---+---+---+
+ *      |         DSCP          |  CU   |
+ *      +---+---+---+---+---+---+---+---+
+ *
+ *        DSCP: differentiated services codepoint
+ *        CU:   currently unused
+ *
+ * The whole DSCP + CU bits form the DS field.
+ * The DS field is also commonly called TOS or Traffic Class (for IPv6).
+ *
+ * Note: the CU bits are now used for Explicit Congestion Notification
+ *       (RFC 3168).
+ */
+
+#ifndef _INET_DSCP_H
+#define _INET_DSCP_H
+
+#include <linux/types.h>
+
+/* Special type for storing DSCP values.
+ *
+ * A dscp_t variable stores a DS field with the CU (ECN) bits cleared.
+ * Using dscp_t allows to strictly separate DSCP and ECN bits, thus avoiding
+ * bugs where ECN bits are erroneously taken into account during FIB lookups
+ * or policy routing.
+ *
+ * Note: to get the real DSCP value contained in a dscp_t variable one would
+ * have to do a bit shift after calling inet_dscp_to_dsfield(). We could have
+ * a helper for that, but there's currently no users.
+ */
+typedef u8 __bitwise dscp_t;
+
+#define INET_DSCP_MASK 0xfc
+
+static inline dscp_t inet_dsfield_to_dscp(__u8 dsfield)
+{
+       return (__force dscp_t)(dsfield & INET_DSCP_MASK);
+}
+
+static inline __u8 inet_dscp_to_dsfield(dscp_t dscp)
+{
+       return (__force __u8)dscp;
+}
+
+static inline bool inet_validate_dscp(__u8 val)
+{
+       return !(val & ~INET_DSCP_MASK);
+}
+
+#endif /* _INET_DSCP_H */

diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index cda1f205f3914cf3d371ae94d482d1c50e0e9121..f693784e14198607610b9cc2abc879e6faef7952 100644 (file)
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -17,6 +17,7 @@
 #include <net/if_inet6.h>
 #include <net/flow.h>
 #include <net/flow_dissector.h>
+#include <net/inet_dscp.h>
 #include <net/snmp.h>
 #include <net/netns/hash.h>
 
@@ -974,6 +975,11 @@ static inline u8 ip6_tclass(__be32 flowinfo)
        return ntohl(flowinfo & IPV6_TCLASS_MASK) >> IPV6_TCLASS_SHIFT;
 }
 
+static inline dscp_t ip6_dscp(__be32 flowinfo)
+{
+       return inet_dsfield_to_dscp(ip6_tclass(flowinfo));
+}
+
 static inline __be32 ip6_make_flowinfo(unsigned int tclass, __be32 flowlabel)
 {
        return htonl(tclass << IPV6_TCLASS_SHIFT) | flowlabel;

diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index ec029c86ae06828c1cfe886ad0f401318b114310..e2a7b00596694d678642f2736be731edb129de53 100644 (file)
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -16,6 +16,7 @@
 #include <linux/indirect_call_wrapper.h>
 
 #include <net/fib_rules.h>
+#include <net/inet_dscp.h>
 #include <net/ipv6.h>
 #include <net/addrconf.h>
 #include <net/ip6_route.h>
@@ -25,14 +26,14 @@ struct fib6_rule {
        struct fib_rule         common;
        struct rt6key           src;
        struct rt6key           dst;
-       u8                      tclass;
+       dscp_t                  dscp;
 };
 
 static bool fib6_rule_matchall(const struct fib_rule *rule)
 {
        struct fib6_rule *r = container_of(rule, struct fib6_rule, common);
 
-       if (r->dst.plen || r->src.plen || r->tclass)
+       if (r->dst.plen || r->src.plen || r->dscp)
                return false;
        return fib_rule_matchall(rule);
 }
@@ -323,7 +324,7 @@ INDIRECT_CALLABLE_SCOPE int fib6_rule_match(struct fib_rule *rule,
                        return 0;
        }
 
-       if (r->tclass && r->tclass != ip6_tclass(fl6->flowlabel))
+       if (r->dscp && r->dscp != ip6_dscp(fl6->flowlabel))
                return 0;
 
        if (rule->ip_proto && (rule->ip_proto != fl6->flowi6_proto))
@@ -349,6 +350,13 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
        struct net *net = sock_net(skb->sk);
        struct fib6_rule *rule6 = (struct fib6_rule *) rule;
 
+       if (!inet_validate_dscp(frh->tos)) {
+               NL_SET_ERR_MSG(extack,
+                              "Invalid dsfield (tos): ECN bits must be 0");
+               goto errout;
+       }
+       rule6->dscp = inet_dsfield_to_dscp(frh->tos);
+
        if (rule->action == FR_ACT_TO_TBL && !rule->l3mdev) {
                if (rule->table == RT6_TABLE_UNSPEC) {
                        NL_SET_ERR_MSG(extack, "Invalid table");
@@ -369,7 +377,6 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
 
        rule6->src.plen = frh->src_len;
        rule6->dst.plen = frh->dst_len;
-       rule6->tclass = frh->tos;
 
        if (fib_rule_requires_fldissect(rule))
                net->ipv6.fib6_rules_require_fldissect++;
@@ -402,7 +409,7 @@ static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
        if (frh->dst_len && (rule6->dst.plen != frh->dst_len))
                return 0;
 
-       if (frh->tos && (rule6->tclass != frh->tos))
+       if (frh->tos && inet_dscp_to_dsfield(rule6->dscp) != frh->tos)
                return 0;
 
        if (frh->src_len &&
@@ -423,7 +430,7 @@ static int fib6_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
 
        frh->dst_len = rule6->dst.plen;
        frh->src_len = rule6->src.plen;
-       frh->tos = rule6->tclass;
+       frh->tos = inet_dscp_to_dsfield(rule6->dscp);
 
        if ((rule6->dst.plen &&
             nla_put_in6_addr(skb, FRA_DST, &rule6->dst.addr)) ||

diff --git a/tools/testing/selftests/net/fib_rule_tests.sh b/tools/testing/selftests/net/fib_rule_tests.sh
index 3b0489910422d2216f6046ba1f92114135b6883c..d7a9ab3be1d31c70a8f36c0be86a5802988110b7 100755 (executable)
--- a/tools/testing/selftests/net/fib_rule_tests.sh
+++ b/tools/testing/selftests/net/fib_rule_tests.sh
@@ -114,10 +114,25 @@ fib_rule6_test_match_n_redirect()
        log_test $? 0 "rule6 del by pref: $description"
 }
 
+fib_rule6_test_reject()
+{
+       local match="$1"
+       local rc
+
+       $IP -6 rule add $match table $RTABLE 2>/dev/null
+       rc=$?
+       log_test $rc 2 "rule6 check: $match"
+
+       if [ $rc -eq 0 ]; then
+               $IP -6 rule del $match table $RTABLE
+       fi
+}
+
 fib_rule6_test()
 {
        local getmatch
        local match
+       local cnt
 
        # setup the fib rule redirect route
        $IP -6 route add table $RTABLE default via $GW_IP6 dev $DEV onlink
@@ -128,8 +143,21 @@ fib_rule6_test()
        match="from $SRC_IP6 iif $DEV"
        fib_rule6_test_match_n_redirect "$match" "$match" "iif redirect to table"
 
+       # Reject dsfield (tos) options which have ECN bits set
+       for cnt in $(seq 1 3); do
+               match="dsfield $cnt"
+               fib_rule6_test_reject "$match"
+       done
+
+       # Don't take ECN bits into account when matching on dsfield
        match="tos 0x10"
-       fib_rule6_test_match_n_redirect "$match" "$match" "tos redirect to table"
+       for cnt in "0x10" "0x11" "0x12" "0x13"; do
+               # Using option 'tos' instead of 'dsfield' as old iproute2
+               # versions don't support 'dsfield' in ip rule show.
+               getmatch="tos $cnt"
+               fib_rule6_test_match_n_redirect "$match" "$getmatch" \
+                                               "$getmatch redirect to table"
+       done
 
        match="fwmark 0x64"
        getmatch="mark 0x64"