From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ed1-f67.google.com (mail-ed1-f67.google.com [209.85.208.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.bufferbloat.net (Postfix) with ESMTPS id 714073CB35 for ; Wed, 6 Mar 2019 10:21:58 -0500 (EST) Received: by mail-ed1-f67.google.com with SMTP id h58so10674175edb.5 for ; Wed, 06 Mar 2019 07:21:58 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:in-reply-to:references:date :message-id:mime-version:content-transfer-encoding; bh=tbUDJBkK404XhTsaPGJdieluszPxB+eW+RynWgWnvdI=; b=cOWBoFeDMaPKdd3pudAsC2+PyEJ0Q4ms9eByI3Y84JaI0tHcpsHWINzFNSwIQZVI6t mC9SZPMW06YaQLmhaR2qL4pkYCmNfUS0QSzjdUSh8iCYbmzF/lMng0m4Afv7/cGwTcMv g2hgF4z62xhZFlHTnLJ2SPA0rAYjQWLbT3nt62be/4bMzf/hI6diIFRPegNhbcLul9We WkCQB/u1YOCkIUIcVbdqS0I/cLfHe1Dj2CFyuK2GOcedooT+7XP/fO3uXsXEJM0nvauM HjiNP5jruR4G67xWIzWCITuaVCnlYl2kwMSkXDmAm6jYl0z4JOsOnEXqU5JSC+Po7S5X HzAQ== X-Gm-Message-State: APjAAAX0yCrRelAlI8ZTgBsaosoxgbFr8mCkBpx1BUcfl3XqZA7VY/4E XPQ1GMvzdOngXEWdw2ZdESaRXA== X-Google-Smtp-Source: APXvYqx92YZI8S5oONjxyiJ3+ockdE3RVyom5L4bEe6iwZbk5VgJMvGv4rLYufD7iJAAPjqASLK3Jw== X-Received: by 2002:a50:b786:: with SMTP id h6mr24005852ede.85.1551885717514; Wed, 06 Mar 2019 07:21:57 -0800 (PST) Received: from alrua-x1.borgediget.toke.dk (alrua-x1.vpn.toke.dk. [2a00:7660:6da:10::2]) by smtp.gmail.com with ESMTPSA id y24sm522618eds.35.2019.03.06.07.21.56 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 06 Mar 2019 07:21:56 -0800 (PST) Received: by alrua-x1.borgediget.toke.dk (Postfix, from userid 1000) id 97B93182F5B; Wed, 6 Mar 2019 16:21:56 +0100 (CET) From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= To: Kevin Darbyshire-Bryant , "cake\@lists.bufferbloat.net" In-Reply-To: References: X-Clacks-Overhead: GNU Terry Pratchett Date: Wed, 06 Mar 2019 16:21:56 +0100 Message-ID: <875zsw110r.fsf@toke.dk> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Subject: Re: [Cake] act_connmark + dscp X-BeenThere: cake@lists.bufferbloat.net X-Mailman-Version: 2.1.20 Precedence: list List-Id: Cake - FQ_codel the next generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Mar 2019 15:21:58 -0000 Kevin Darbyshire-Bryant writes: > Before I go too far down this road (and to avoid the horror of > actually trying to code it) here=E2=80=99s what I=E2=80=99m trying to ach= ieve. > > > act_connmark + dscp is designed to copy a DSCP code to/from conntrack mar= k. It uses 8 bits of the mark field, currently the most significant byte. > > Bits 31-26: DSCP > Bit 25: Spare/Future > Bit 24: Valid DSCP set > > The valid bit is set when the =E2=80=98getdscp=E2=80=99 function has writ= ten a DSCP > value into the conntrack (& hence skb) mark. This allows us & other > skb->mark/ct->mark applications (eg iptables, cake qdisc) to know that > a DSCP value has been placed in the field. We cannot simply use a > non-zero DSCP because zero is a valid DSCP. If someone installs the action, the field is supposedly always copied; so why do we need another flag? Instead, I'd suggest adding user options with mask and shift to make it possible to configure where in the mark field the values are stored... > =E2=80=99setdscp=E2=80=99 restores the DSCP field from the stored DSCP if= valid bit is set. > > > Modes: > > getdscp - If ct->mark doesn=E2=80=99t contain a valid DSCP, copy the DSCP > field from the current skb (if valid for that skb ie. ip4/ip6) and set > the valid bit. > > bleach/aka wash - As part of the getdscp routine, optionally null out > the DSCP bits. We need a bleach routine because we need to see the > DSCP bits intact so we can copy them to the mark. If cake washes them > then we don=E2=80=99t get to see them, defeating the entire point. > > setdscp - if skb->mark valid bit set, copy the skb->mark stored DSCP > to the diffserv bits of the current skb (if appropriate) TC actions are executed before the qdisc, so I don't think bleach/wash is really needed? Also, it can already be achieved with the pedit action. So I think 'get' and 'set' are enough. > I=E2=80=99ve attached a *VERY* rough starting point for how far I=E2=80= =99ve got - not > even compiled yet=E2=80=A6 I doubt it does. Not a natural (kernel) progra= mmer > so everything is a struggle. > > Two things I=E2=80=99m falling over: > > 1) Really not sure how to get parameters in to set the > =E2=80=98getdscp/setdscp/wash=E2=80=99 options. You'll need to add new netlink parameter values and parse them like we do in cake (after the existing struct-copy-based option passing). I think a single option that can be set to *either* "get" *or* "set" will be simpler, then you don't have to worry about what happens if someone enables both. > 2) Is it possible to have different tc actions on an interface and a > mirred fed ifb interface? That could be a real killer actually. We > need to do different things on egress vs ingress. Yes, you can chain actions, and they are per-interface. > 3) (Spanish Inquisition moment) The original connmark code goes and > does a nf_ct_get_tuplepr if the nf_ct_get fails. Why would the > nf_ct_get fail? Presumably because nf_ct_get just reads a field in the skb; which may not have been set yet in some cases, necessitating a full lookup. -Toke