From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-qt0-x243.google.com (mail-qt0-x243.google.com [IPv6:2607:f8b0:400d:c0d::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.bufferbloat.net (Postfix) with ESMTPS id AFA063BA8E for ; Mon, 21 May 2018 19:34:11 -0400 (EDT) Received: by mail-qt0-x243.google.com with SMTP id j42-v6so21116834qtj.12 for ; Mon, 21 May 2018 16:34:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to :user-agent; bh=bPdd9FDxOvyN1SbqJK1Rgyv/OKujpGrNG1oenQKEdXc=; b=avFWrikUzIVtPNAbMxbpnsUcUpmXVnJ3M1OPo76075daaP4Vq0Gek98KRRsCUSnpFk h+dPupFzEDuvF2Rbcsr8P5LUCwr7g4d1M+rSqUygVD5H186x11fLGwxqSnuFm71Fkzt7 TIKJ33eXaKBIqAyvXwRRP2mEJ/Qj+MvdCMEaOvWBhEVStEWQrppgqO09L8NgSuiWNnb6 wlSmPn+aAqaeRiG4liVKOjC6rDWGcw/9irE0Z+sfND7VbJJUrxELYsSXX1I14YigmWvi ejn0oRV54kpMlrArQuLM90V/uCeIieOia6wGHdf6//vIIuYoKIbo8kIc3K2n4bbHoAQH 5YJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to:user-agent; bh=bPdd9FDxOvyN1SbqJK1Rgyv/OKujpGrNG1oenQKEdXc=; b=WZFV/Dfd0V7IdJGpuPtK10HuD67Gf21qrM3dMriCVqr4RBR7S/7SXOPm3ZxY7osbvS W9vVgyJrsuhpIW0h5ozLFU9Xoa5kNCviepGuinLZOytMuq85KGZOlClNlw4KK3MKn81G VOCp6F+pyyZcktdStJItM39Ft6X5yTek3T299kf/aUnQaZIoqUTYnrRNyRw7jr8VgqVr Whgr/YutuIX9ZfVYOVSDag1JkITKLWbKv69wVq3twFklAvn4ocxRQ+BOpfECx3z7/3te oX1gUDMfJ7PWsNiA2TM36FPAimCcF6/XuwDxDQA7WP1BGjmFeRTgtp2+1K3J9C4k7fbJ 2mSQ== X-Gm-Message-State: ALKqPwfiETYZGqdd8LUMtgInUWkYcig0Ptk9yVU5a88A09NEvSgxNdh1 3XsI/SZ2quJzxmzH7EwOSKqbC3AHRgo= X-Google-Smtp-Source: AB8JxZrbtM784FMUl8yEmgSBSC9RyLui9DIq1va/2lM+xm+UEJ58Vtk7xvr65YH8ZqpMtmF1uGH4cQ== X-Received: by 2002:a0c:8ab8:: with SMTP id 53-v6mr19356507qvv.216.1526945650858; Mon, 21 May 2018 16:34:10 -0700 (PDT) Received: from localhost.localdomain ([45.4.239.227]) by smtp.gmail.com with ESMTPSA id j25-v6sm10524808qtn.29.2018.05.21.16.34.09 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 21 May 2018 16:34:09 -0700 (PDT) Received: by localhost.localdomain (Postfix, from userid 1000) id 309DB181111; Mon, 21 May 2018 20:34:06 -0300 (-03) Date: Mon, 21 May 2018 20:34:06 -0300 From: Marcelo Ricardo Leitner To: Toke =?iso-8859-1?Q?H=F8iland-J=F8rgensen?= Cc: netdev@vger.kernel.org, cake@lists.bufferbloat.net, netfilter-devel@vger.kernel.org Message-ID: <20180521233406.GG26212@localhost.localdomain> References: <152693459693.32668.4272129427997495747.stgit@alrua-kau> <152693495866.32668.5164616056948127124.stgit@alrua-kau> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <152693495866.32668.5164616056948127124.stgit@alrua-kau> User-Agent: Mutt/1.9.2 (2017-12-15) Subject: Re: [Cake] [PATCH net-next v14 4/7] sch_cake: Add NAT awareness to packet classifier X-BeenThere: cake@lists.bufferbloat.net X-Mailman-Version: 2.1.20 Precedence: list List-Id: Cake - FQ_codel the next generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 May 2018 23:34:11 -0000 [Cc'ing netfilter-devel@ for awareness] On Mon, May 21, 2018 at 10:35:58PM +0200, Toke Høiland-Jørgensen wrote: > When CAKE is deployed on a gateway that also performs NAT (which is a > common deployment mode), the host fairness mechanism cannot distinguish > internal hosts from each other, and so fails to work correctly. > > To fix this, we add an optional NAT awareness mode, which will query the > kernel conntrack mechanism to obtain the pre-NAT addresses for each packet > and use that in the flow and host hashing. > > When the shaper is enabled and the host is already performing NAT, the cost > of this lookup is negligible. However, in unlimited mode with no NAT being > performed, there is a significant CPU cost at higher bandwidths. For this > reason, the feature is turned off by default. > > Signed-off-by: Toke Høiland-Jørgensen > --- > net/sched/sch_cake.c | 79 ++++++++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 79 insertions(+) > > diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c > index 92623160d43e..04364993ce19 100644 > --- a/net/sched/sch_cake.c > +++ b/net/sched/sch_cake.c > @@ -71,6 +71,12 @@ > #include > #include > > +#if IS_REACHABLE(CONFIG_NF_CONNTRACK) > +#include > +#include > +#include > +#endif > + > #define CAKE_SET_WAYS (8) > #define CAKE_MAX_TINS (8) > #define CAKE_QUEUES (1024) > @@ -516,6 +522,60 @@ static bool cobalt_should_drop(struct cobalt_vars *vars, > return drop; > } > > +#if IS_REACHABLE(CONFIG_NF_CONNTRACK) > + > +static void cake_update_flowkeys(struct flow_keys *keys, > + const struct sk_buff *skb) > +{ > + const struct nf_conntrack_tuple *tuple; > + enum ip_conntrack_info ctinfo; > + struct nf_conn *ct; > + bool rev = false; > + > + if (tc_skb_protocol(skb) != htons(ETH_P_IP)) > + return; > + > + ct = nf_ct_get(skb, &ctinfo); > + if (ct) { > + tuple = nf_ct_tuple(ct, CTINFO2DIR(ctinfo)); > + } else { > + const struct nf_conntrack_tuple_hash *hash; > + struct nf_conntrack_tuple srctuple; > + > + if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), > + NFPROTO_IPV4, dev_net(skb->dev), > + &srctuple)) > + return; > + > + hash = nf_conntrack_find_get(dev_net(skb->dev), > + &nf_ct_zone_dflt, > + &srctuple); > + if (!hash) > + return; > + > + rev = true; > + ct = nf_ct_tuplehash_to_ctrack(hash); > + tuple = nf_ct_tuple(ct, !hash->tuple.dst.dir); > + } > + > + keys->addrs.v4addrs.src = rev ? tuple->dst.u3.ip : tuple->src.u3.ip; > + keys->addrs.v4addrs.dst = rev ? tuple->src.u3.ip : tuple->dst.u3.ip; > + > + if (keys->ports.ports) { > + keys->ports.src = rev ? tuple->dst.u.all : tuple->src.u.all; > + keys->ports.dst = rev ? tuple->src.u.all : tuple->dst.u.all; > + } > + if (rev) > + nf_ct_put(ct); > +} > +#else > +static void cake_update_flowkeys(struct flow_keys *keys, > + const struct sk_buff *skb) > +{ > + /* There is nothing we can do here without CONNTRACK */ > +} > +#endif > + > /* Cake has several subtle multiple bit settings. In these cases you > * would be matching triple isolate mode as well. > */ > @@ -543,6 +603,9 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, > skb_flow_dissect_flow_keys(skb, &keys, > FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL); > > + if (flow_mode & CAKE_FLOW_NAT_FLAG) > + cake_update_flowkeys(&keys, skb); > + > /* flow_hash_from_keys() sorts the addresses by value, so we have > * to preserve their order in a separate data structure to treat > * src and dst host addresses as independently selectable. > @@ -1894,6 +1957,18 @@ static int cake_change(struct Qdisc *sch, struct nlattr *opt, > if (err < 0) > return err; > > + if (tb[TCA_CAKE_NAT]) { > +#if IS_REACHABLE(CONFIG_NF_CONNTRACK) > + q->flow_mode &= ~CAKE_FLOW_NAT_FLAG; > + q->flow_mode |= CAKE_FLOW_NAT_FLAG * > + !!nla_get_u32(tb[TCA_CAKE_NAT]); > +#else > + NL_SET_ERR_MSG_ATTR(extack, "No conntrack support in kernel", > + tb[TCA_CAKE_NAT]); > + return -EOPNOTSUPP; > +#endif > + } > + > if (tb[TCA_CAKE_BASE_RATE64]) > q->rate_bps = nla_get_u64(tb[TCA_CAKE_BASE_RATE64]); > > @@ -2066,6 +2141,10 @@ static int cake_dump(struct Qdisc *sch, struct sk_buff *skb) > if (nla_put_u32(skb, TCA_CAKE_ACK_FILTER, q->ack_filter)) > goto nla_put_failure; > > + if (nla_put_u32(skb, TCA_CAKE_NAT, > + !!(q->flow_mode & CAKE_FLOW_NAT_FLAG))) > + goto nla_put_failure; > + > return nla_nest_end(skb, opts); > > nla_put_failure: > > _______________________________________________ > Cake mailing list > Cake@lists.bufferbloat.net > https://lists.bufferbloat.net/listinfo/cake