| Message ID | 20240821125251.1571445-5-idosch@nvidia.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | c1ae5ca69b691a7403e85047382fc4fd6a69ee9f |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | Unmask upper DSCP bits - part 1 | expand |
On Wed, Aug 21, 2024 at 03:52:43PM +0300, Ido Schimmel wrote: > The rpfilter match performs a reverse path filter test on a packet by > performing a FIB lookup with the source and destination addresses > swapped. > > Unmask the upper DSCP bits of the DS field of the tested packet so that > in the future the FIB lookup could be performed according to the full > DSCP value. Reviewed-by: Guillaume Nault <gnault@redhat.com>
diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c index ded5bef02f77..1ce7a1655b97 100644 --- a/net/ipv4/netfilter/ipt_rpfilter.c +++ b/net/ipv4/netfilter/ipt_rpfilter.c @@ -8,6 +8,7 @@ #include <linux/module.h> #include <linux/skbuff.h> #include <linux/netdevice.h> +#include <net/inet_dscp.h> #include <linux/ip.h> #include <net/ip.h> #include <net/ip_fib.h> @@ -75,7 +76,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par) flow.daddr = iph->saddr; flow.saddr = rpfilter_get_saddr(iph->daddr); flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; - flow.flowi4_tos = iph->tos & IPTOS_RT_MASK; + flow.flowi4_tos = iph->tos & INET_DSCP_MASK; flow.flowi4_scope = RT_SCOPE_UNIVERSE; flow.flowi4_l3mdev = l3mdev_master_ifindex_rcu(xt_in(par)); flow.flowi4_uid = sock_net_uid(xt_net(par), NULL);
The rpfilter match performs a reverse path filter test on a packet by performing a FIB lookup with the source and destination addresses swapped. Unmask the upper DSCP bits of the DS field of the tested packet so that in the future the FIB lookup could be performed according to the full DSCP value. No functional changes intended since the upper DSCP bits are masked when comparing against the TOS selectors in FIB rules and routes. Signed-off-by: Ido Schimmel <idosch@nvidia.com> --- net/ipv4/netfilter/ipt_rpfilter.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)