From 3b7a22b44d74b9b05d5e4b0529ebf72c49dcbff5 Mon Sep 17 00:00:00 2001 From: Fernando Luis Vazquez Cao Date: Fri, 17 Jun 2011 05:46:22 +0200 Subject: doc: document IPv6 TOS mangling bug in old Linux kernels In Linux kernels up to and including 2.6.38, with the exception of longterm releases 2.6.32.42 (or later) and 2.6.33.15 (or later), there is a bug (*) whereby IPv6 TOS mangling does not behave as documented and differs from the IPv4 version. The TOS mask indicates the bits one wants to zero out, so it needs to be inverted before applying it to the original TOS field. However, the aformentioned kernels forgo the inversion which breaks --set-tos and its mnemonics. (*) Fixed by upstream commit: 1ed2f73d90fb49bcf5704aee7e9084adb882bfc5 (netfilter: IPv6: fix DSCP mangle code) Signed-off-by: Fernando Luis Vazquez Cao Signed-off-by: Patrick McHardy --- extensions/libxt_TOS.man | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) (limited to 'extensions/libxt_TOS.man') diff --git a/extensions/libxt_TOS.man b/extensions/libxt_TOS.man index 46f67379..f9896740 100644 --- a/extensions/libxt_TOS.man +++ b/extensions/libxt_TOS.man @@ -4,24 +4,33 @@ shares the same bits as DSCP and ECN. The TOS target is only valid in the \fBmangle\fP table. .TP \fB\-\-set\-tos\fP \fIvalue\fP[\fB/\fP\fImask\fP] -Zeroes out the bits given by \fImask\fP and XORs \fIvalue\fP into the -TOS/Priority field. If \fImask\fP is omitted, 0xFF is assumed. +Zeroes out the bits given by \fImask\fP (see NOTE below) and XORs \fIvalue\fP +into the TOS/Priority field. If \fImask\fP is omitted, 0xFF is assumed. .TP \fB\-\-set\-tos\fP \fIsymbol\fP You can specify a symbolic name when using the TOS target for IPv4. It implies -a mask of 0xFF. The list of recognized TOS names can be obtained by calling -iptables with \fB\-j TOS \-h\fP. +a mask of 0xFF (see NOTE below). The list of recognized TOS names can be +obtained by calling iptables with \fB\-j TOS \-h\fP. .PP The following mnemonics are available: .TP \fB\-\-and\-tos\fP \fIbits\fP Binary AND the TOS value with \fIbits\fP. (Mnemonic for \fB\-\-set\-tos -0/\fP\fIinvbits\fP, where \fIinvbits\fP is the binary negation of \fIbits\fP.) +0/\fP\fIinvbits\fP, where \fIinvbits\fP is the binary negation of \fIbits\fP. +See NOTE below.) .TP \fB\-\-or\-tos\fP \fIbits\fP Binary OR the TOS value with \fIbits\fP. (Mnemonic for \fB\-\-set\-tos\fP -\fIbits\fP\fB/\fP\fIbits\fP.) +\fIbits\fP\fB/\fP\fIbits\fP. See NOTE below.) .TP \fB\-\-xor\-tos\fP \fIbits\fP Binary XOR the TOS value with \fIbits\fP. (Mnemonic for \fB\-\-set\-tos\fP -\fIbits\fP\fB/0\fP.) +\fIbits\fP\fB/0\fP. See NOTE below.) +.PP +NOTE: In Linux kernels up to and including 2.6.38, with the exception of +longterm releases 2.6.32.42 (or later) and 2.6.33.15 (or later), there is a bug +whereby IPv6 TOS mangling does not behave as documented and differs from the +IPv4 version. The TOS mask indicates the bits one wants to zero out, so it needs +to be inverted before applying it to the original TOS field. However, the +aformentioned kernels forgo the inversion which breaks --set-tos and its +mnemonics. -- cgit v1.2.3