pf: Retrieve DSCP value from the IPv6 header
ClosedPublic
Actions

Authored by kp on Mar 3 2021, 8:39 PM.

Details

Reviewers

Group Reviewers

Commits

Summary

Teach pf to read the DSCP value from the IPv6 header so that we can
match on them.

MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")

Repository

rS FreeBSD src repository - subversion

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 37548
Build 34437: arc lint + arc unit

kp created this revision.Mar 3 2021, 8:39 PM

kp requested review of this revision.Mar 3 2021, 8:39 PM

donner added a subscriber: donner.

donner added inline comments.

sys/netpfil/pf/pf.c
6433	So you are extracting "DSCP" and "Currently unused" but you mask out the unused bits without shifting them away? If the CU bits are kept, but masked, that is fine. It might be more easily readable by pd.tos = (ntohl(h->ip6_flow) >> 20) & 0xfc;

This revision is now accepted and ready to land.Mar 4 2021, 7:46 AM

kp added inline comments.Mar 4 2021, 8:51 AM

sys/netpfil/pf/pf.c
6433	Grabbing the DSCP bits and ignoring the ECN bits, yes. I think I agree that your way is more readable. so I'll update that.

ae added inline comments.

sys/netpfil/pf/pf.c
6433	This variant of
6433	We have several places in the code where the same expression are used, probably it would be good to add some macros to get and set this value.