<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">From the OpenWrt-devel mailing list...</div><div class=""><br class=""></div>Dunno if a) you're aware of this, or b) if this is actually relevant...<div class=""><br class=""></div><div class="">Rich<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">Begin forwarded message:</div><br class="Apple-interchange-newline"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">From: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">Philip Prindeville <<a href="mailto:philipp_subx@redfish-solutions.com" class="">philipp_subx@redfish-solutions.com</a>><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Subject: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><b class="">Re: [PATCH firewall3 v1 0/2] fix DSCP/MARK target implementation</b><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Date: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">March 21, 2021 at 11:23:04 PM EDT<br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">To: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">Tony Ambardar <<a href="mailto:itugrok@yahoo.com" class="">itugrok@yahoo.com</a>><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Cc: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><a href="mailto:openwrt-devel@lists.openwrt.org" class="">openwrt-devel@lists.openwrt.org</a><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Sender: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">"openwrt-devel" <<a href="mailto:openwrt-devel-bounces@lists.openwrt.org" class="">openwrt-devel-bounces@lists.openwrt.org</a>><br class=""></span></div><br class=""><div class=""><div class="">Are you aware that many open source apps already do DSCP marking?<br class=""><br class="">I submitted the changes to Firefox, Thunderbird, Cyrus, Proftpd, Sendmail, Postfix, Curl, Wget, Apache... and this was more than 15 years ago.<br class=""><br class="">Why would you want to overwrite marking if it's already present?<br class=""><br class=""><br class=""><blockquote type="cite" class="">On Mar 21, 2021, at 7:06 PM, Tony Ambardar via openwrt-devel <<a href="mailto:openwrt-devel@lists.openwrt.org" class="">openwrt-devel@lists.openwrt.org</a>> wrote:<br class=""><br class="">The sender domain has a DMARC Reject/Quarantine policy which disallows<br class="">sending mailing list messages using the original "From" header.<br class=""><br class="">To mitigate this problem, the original message has been wrapped<br class="">automatically by the mailing list software.<br class="">From: Tony Ambardar <<a href="mailto:itugrok@yahoo.com" class="">itugrok@yahoo.com</a>><br class="">Subject: [PATCH firewall3 v1 0/2] fix DSCP/MARK target implementation<br class="">Date: March 21, 2021 at 7:06:17 PM MDT<br class="">To: <a href="mailto:openwrt-devel@lists.openwrt.org" class="">openwrt-devel@lists.openwrt.org</a><br class="">Cc: Jo-Philipp Wich <<a href="mailto:jo@mein.io" class="">jo@mein.io</a>>, Tony Ambardar <<a href="mailto:itugrok@yahoo.com" class="">itugrok@yahoo.com</a>><br class=""><br class=""><br class="">Currently, fw3 places all DSCP/MARK target rules into the PREROUTING chain,<br class="">and accepts but ignores a src device. This behaviour is impractical for<br class="">most common applications (e.g. QOS setup), since rules are applied to all<br class="">devices and in all directions. Fix this generally by honouring src/dest<br class="">device selection and placing the rules into the appropriate chain of the<br class="">mangle table. <br class=""><br class="">These changes revealed the process of resolving zones to devices can add<br class="">duplicates due to the presence of aliased interfaces. Fix this by filtering<br class="">the fw3_zone->devices list during creation.<br class=""><br class="">Thanks go to Jo-Philipp Wich <<a href="mailto:jo@mein.io" class="">jo@mein.io</a>> for sharing proof of concept code<br class="">on IRC and providing additional review afterwards.<br class=""><br class="">Tony Ambardar (2):<br class=""> zone: avoid duplicates in devices list<br class=""> rules: fix device and chain usage for DSCP/MARK targets<br class=""><br class="">rules.c | 68 ++++++++++++++++++++++++++++++++++++---------------------<br class="">zones.c | 9 +++++++-<br class="">2 files changed, 51 insertions(+), 26 deletions(-)<br class=""><br class="">Testing<br class="">=======<br class=""><br class="">Regression testing was done to confirm the default OpenWrt firewall rules<br class="">are unchanged before and after this patch.<br class=""><br class="">Functional testing was carried out using the UCI firewall rules below. This<br class="">set of test cases would normally yield the following incorrect iptables<br class="">rules (from iptables-save, sorted by test):<br class=""><br class="">-A PREROUTING -p udp -m udp --dport 1945 -m comment --comment "!fw3: Test-1-Zone-Any-PRE" -j DSCP --set-dscp 0x00<br class="">-A PREROUTING -p tcp -m tcp --dport 1960 -m comment --comment "!fw3: Test-4-Any-Any-FORW" -j MARK --set-xmark 0x7/0xff<br class="">-A PREROUTING -p udp -m udp --dport 1965 -m comment --comment "!fw3: Test-5-Zone-Dev-IN" -j DSCP --set-dscp 0x2e<br class="">-A OUTPUT -p udp -m udp --dport 1975 -m comment --comment "!fw3: Test-7-Dev-Dev-OUT" -j DSCP --set-dscp 0x30<br class=""><br class="">After this change, the resulting iptables rules use the expected devices<br class="">and chains:<br class=""><br class="">-A PREROUTING -i br-lan -p udp -m udp --dport 1945 -m comment --comment "!fw3: Test-1-Zone-Any-PRE" -j DSCP --set-dscp 0x00<br class="">-A FORWARD -i br-lan -o eth0 -p udp -m udp --dport 1950 -m comment --comment "!fw3: Test-2-Zone-Zone-FORW" -j DSCP --set-dscp 0x08<br class="">-A POSTROUTING -o eth0 -p tcp -m tcp --dport 1955 -m comment --comment "!fw3: Test-3-Any-Zone-POST" -j MARK --set-xmark 0x3/0xff<br class="">-A FORWARD -p tcp -m tcp --dport 1960 -m comment --comment "!fw3: Test-4-Any-Any-FORW" -j MARK --set-xmark 0x7/0xff<br class="">-A INPUT -i br-lan -p udp -m udp --dport 1965 -m comment --comment "!fw3: Test-5-Zone-Dev-IN" -j DSCP --set-dscp 0x2e<br class="">-A OUTPUT -o eth0 -p tcp -m tcp --dport 1970 -m comment --comment "!fw3: Test-6-Dev-Zone-OUT" -j MARK --set-xmark 0xf/0xff<br class="">-A OUTPUT -p udp -m udp --dport 1975 -m comment --comment "!fw3: Test-7-Dev-Dev-OUT" -j DSCP --set-dscp 0x30<br class=""><br class="">UCI FW Rules<br class="">------------<br class=""><br class="">config rule<br class=""> option enabled '1'<br class=""> option target 'DSCP'<br class=""> option set_dscp 'BE'<br class=""> option proto 'udp'<br class=""> option dest_port '1945'<br class=""> option name 'Test-1-Zone-Any-PRE'<br class=""> option src 'lan'<br class=""> option dest '*'<br class=""><br class="">config rule<br class=""> option enabled '1'<br class=""> option target 'DSCP'<br class=""> option set_dscp 'CS1'<br class=""> option proto 'udp'<br class=""> option dest_port '1950'<br class=""> option name 'Test-2-Zone-Zone-FORW'<br class=""> option src 'lan'<br class=""> option dest 'wan'<br class=""><br class="">config rule<br class=""> option enabled '1'<br class=""> option target 'MARK'<br class=""> option set_mark '0x03/0xff'<br class=""> option proto 'tcp'<br class=""> option dest_port '1955'<br class=""> option name 'Test-3-Any-Zone-POST'<br class=""> option src '*'<br class=""> option dest 'wan'<br class=""><br class="">config rule<br class=""> option enabled '1'<br class=""> option target 'MARK'<br class=""> option set_mark '0x07/0xff'<br class=""> option proto 'tcp'<br class=""> option dest_port '1960'<br class=""> option name 'Test-4-Any-Any-FORW'<br class=""> option src '*'<br class=""> option dest '*'<br class=""><br class="">config rule<br class=""> option enabled '1'<br class=""> option target 'DSCP'<br class=""> option set_dscp 'EF'<br class=""> option proto 'udp'<br class=""> option dest_port '1965'<br class=""> option name 'Test-5-Zone-Dev-IN'<br class=""> option src 'lan'<br class=""><br class="">config rule<br class=""> option enabled '1'<br class=""> option target 'MARK'<br class=""> option set_mark '0x0f/0xff'<br class=""> option proto 'tcp'<br class=""> option dest_port '1970'<br class=""> option name 'Test-6-Dev-Zone-OUT'<br class=""> option dest 'wan'<br class=""><br class="">config rule<br class=""> option enabled '1'<br class=""> option target 'DSCP'<br class=""> option set_dscp 'CS6'<br class=""> option proto 'udp'<br class=""> option dest_port '1975'<br class=""> option name 'Test-7-Dev-Dev-OUT'<br class=""><br class="">-- <br class="">2.25.1<br class=""><br class=""><br class=""><br class=""><br class="">_______________________________________________<br class="">openwrt-devel mailing list<br class=""><a href="mailto:openwrt-devel@lists.openwrt.org" class="">openwrt-devel@lists.openwrt.org</a><br class="">https://lists.openwrt.org/mailman/listinfo/openwrt-devel<br class=""></blockquote><br class=""><br class="">_______________________________________________<br class="">openwrt-devel mailing list<br class=""><a href="mailto:openwrt-devel@lists.openwrt.org" class="">openwrt-devel@lists.openwrt.org</a><br class="">https://lists.openwrt.org/mailman/listinfo/openwrt-devel<br class=""></div></div></blockquote></div><br class=""></div></body></html>