Re: [Cake] Putting cake under dsmark on ingress ifb

[Andy Furniss <adf.lists@gmail.com>]

Andy Furniss wrote:

> TODO see if it's possible with actions to set dscp when using connmark to
> choose the flow.

So I had a go at this and got a working solution - with some
interesting fails on the way.

My ISP doesn't do ipv6 so that is untested and wouldn't work for anyone
using any examples I post here in the sense that I use protocol ip.

So a working test = use iptables to set a connmark 1 for this test on 
something then -

tc qdisc add dev ppp0 ingress
tc filter add dev ppp0 parent ffff: prio 1 protocol ip u32 match u32 0 0 
action connmark continue
tc filter add dev ppp0 parent ffff: prio 2 protocol ip handle 1 fw 
action xt -j DSCP --set-dscp-class cs1 action mirred egress redirect dev 
ifb0
tc filter add dev ppp0 parent ffff: prio 3 protocol ip u32 match u32 0 0 
  action mirred egress redirect dev ifb0

Minor nit with this method = directly matching unmarked like

.... handle 0 fw .... doesn't work, so you need to allow for that or
test ematch which IIRC can do nfmark - untested by me.


The fail = try to use something like

tc filter add dev ppp0 parent ffff: prio 1 protocol ip u32 match u32 0 0 
action xt -j CONNMARK --restore-mark action continue

Testing on my router box with old iptables this was accepted OK but
didn't actually work.

I updated iptables and rebuilt cake-iproute against the new version
to see if it made any difference - tc segfaulted.

Moving testing to my desktop which has a newer kernel I got the same
result.

Next test = use vanilla git iproute2, even worse = Oops. So may be
best to avoid that one for now :-).