[net-next,5/6] xfrm: Convert the ->dst_lookup() callback to dscp_t.

Commit Message

Guillaume Nault Oct. 15, 2024, 9:11 a.m. UTC

Pass a dscp_t variable to ->dst_lookup() callbacks (struct
xfrm_policy_afinfo), instead of an int, to prevent accidental setting
of ECN bits in ->flowi4_tos.

This callback is only called by __xfrm_dst_lookup(), which already has
a dscp_t variable to pass as parameter. We just need to remove the
inet_dscp_to_dsfield() conversion.

There are two implementations of this callback: xfrm6_dst_lookup(),
which doesn't use the modified parameter, and xfrm4_dst_lookup() which
needs to convert it again before calling __xfrm4_dst_lookup().

Signed-off-by: Guillaume Nault <[e-mail]>
---
 include/net/xfrm.h      | 4 ++--
 net/ipv4/xfrm4_policy.c | 8 +++++---
 net/ipv6/xfrm6_policy.c | 5 +++--
 net/xfrm/xfrm_policy.c  | 3 +--
 4 files changed, 11 insertions(+), 9 deletions(-)

Patch

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 18c0a6077ae9..46c82d75679a 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -355,8 +355,8 @@  struct xfrm_type;
 struct xfrm_dst;
 struct xfrm_policy_afinfo {
 	struct dst_ops		*dst_ops;
-	struct dst_entry	*(*dst_lookup)(struct net *net,
-					       int tos, int oif,
+	struct dst_entry	*(*dst_lookup)(struct net *net, dscp_t dscp,
+					       int oif,
 					       const xfrm_address_t *saddr,
 					       const xfrm_address_t *daddr,
 					       u32 mark);
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 0294fef577fa..342a0158da91 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -11,6 +11,7 @@ 
 
 #include <linux/err.h>
 #include <linux/kernel.h>
+#include <net/inet_dscp.h>
 #include <linux/inetdevice.h>
 #include <net/dst.h>
 #include <net/xfrm.h>
@@ -40,14 +41,15 @@  static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4,
 	return ERR_CAST(rt);
 }
 
-static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos, int oif,
-					  const xfrm_address_t *saddr,
+static struct dst_entry *xfrm4_dst_lookup(struct net *net, dscp_t dscp,
+					  int oif, const xfrm_address_t *saddr,
 					  const xfrm_address_t *daddr,
 					  u32 mark)
 {
 	struct flowi4 fl4;
 
-	return __xfrm4_dst_lookup(net, &fl4, tos, oif, saddr, daddr, mark);
+	return __xfrm4_dst_lookup(net, &fl4, inet_dscp_to_dsfield(dscp), oif,
+				  saddr, daddr, mark);
 }
 
 static int xfrm4_get_saddr(struct net *net, int oif,
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index b1d81c4270ab..0c28b22ae3c1 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -18,13 +18,14 @@ 
 #include <net/addrconf.h>
 #include <net/dst.h>
 #include <net/xfrm.h>
+#include <net/inet_dscp.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
 #include <net/l3mdev.h>
 
-static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif,
-					  const xfrm_address_t *saddr,
+static struct dst_entry *xfrm6_dst_lookup(struct net *net, dscp_t dscp,
+					  int oif, const xfrm_address_t *saddr,
 					  const xfrm_address_t *daddr,
 					  u32 mark)
 {
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index a1b499cc840c..db2e602971fd 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -282,8 +282,7 @@  struct dst_entry *__xfrm_dst_lookup(struct net *net, dscp_t dscp, int oif,
 	if (unlikely(afinfo == NULL))
 		return ERR_PTR(-EAFNOSUPPORT);
 
-	dst = afinfo->dst_lookup(net, inet_dscp_to_dsfield(dscp), oif, saddr,
-				 daddr, mark);
+	dst = afinfo->dst_lookup(net, dscp, oif, saddr, daddr, mark);
 
 	rcu_read_unlock();