[Cake] act_connmark + dscp

[Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>]

[-- Attachment #1: Type: text/plain, Size: 2059 bytes --]

Before I go too far down this road (and to avoid the horror of actually trying to code it) here’s what I’m trying to achieve.


act_connmark + dscp is designed to copy a DSCP code to/from conntrack mark.  It uses 8 bits of the mark field, currently the most significant byte.

Bits 31-26: DSCP
Bit 25: Spare/Future
Bit 24: Valid DSCP set

The valid bit is set when the ‘getdscp’ function has written a DSCP value into the conntrack (& hence skb) mark.  This allows us & other skb->mark/ct->mark applications (eg iptables, cake qdisc) to know that a DSCP value has been placed in the field.  We cannot simply use a non-zero DSCP because zero is a valid DSCP.

’setdscp’ restores the DSCP field from the stored DSCP if valid bit is set.


Modes:

getdscp - If ct->mark doesn’t contain a valid DSCP, copy the DSCP field from the current skb (if valid for that skb ie. ip4/ip6) and set the valid bit.

bleach/aka wash - As part of the getdscp routine, optionally null out the DSCP bits.  We need a bleach routine because we need to see the DSCP bits intact so we can copy them to the mark.  If cake washes them then we don’t get to see them, defeating the entire point.

setdscp - if skb->mark valid bit set, copy the skb->mark stored DSCP to the diffserv bits of the current skb (if appropriate) 

I’ve attached a *VERY* rough starting point for how far I’ve got - not even compiled yet… I doubt it does.  Not a natural (kernel) programmer so everything is a struggle.

Two things I’m falling over:

1) Really not sure how to get parameters in to set the ‘getdscp/setdscp/wash’ options.

2) Is it possible to have different tc actions on an interface and a mirred fed ifb interface?  That could be a real killer actually.  We need to do different things on egress vs ingress.

3) (Spanish Inquisition moment) The original connmark code goes and does a nf_ct_get_tuplepr if the nf_ct_get fails.  Why would the nf_ct_get fail?

Cheers,

Kevin D-B

012C ACB2 28C6 C53E 9775  9123 B3A2 389B 9DE2 334A

[-- Attachment #2: act_connmark_hack.patch --]
[-- Type: application/octet-stream, Size: 1880 bytes --]

diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index 8475913f2070..d2acb63d1e5d 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -62,6 +62,52 @@ static int tcf_connmark_act(struct sk_buff *skb, const struct tc_action *a,
 
 	c = nf_ct_get(skb, &ctinfo);
 	if (c) {
+		if (getdscp & proto) {
+			if (!(c->mark & 0x01000000)) {
+			/* store the DSCP bits into c->mark */
+				switch (proto) {
+				case NFPROTO_IPV4:
+					dscp = ipv4_get_dsfield(ip_hdr(skb));
+					break;
+				case NFPROTO_IPV6:
+					dscp = ipv6_get_dsfield(ip_hdr(skb));
+					break;
+				default:
+					dscp = 0;
+					break;
+				}
+				c->mark &= 0x00ffffff;
+				c->mark |= (0x01 | dscp) << 24;
+			}
+			if (bleach) {
+				switch (proto) {
+				case NFPROTO_IPV4:
+					if (ipv4_get_dsfield(ip_hdr(skb) & ~INET_ECN_MASK)
+						ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, 0);
+					break;
+				case NFPROTO_IPV6:
+					if (ipv6_get_dsfield(ip_hdr(skb) & ~INET_ECN_MASK)
+						ipv6_change_dsfield(ip_hdr(skb), INET_ECN_MASK, 0);
+					break;
+				default:
+					break;
+				}
+			}
+		} else if (setdscp & proto && (c->mark & 0x01000000)) {
+			/* restore the DSCP bits from c->mark into diffserv */
+			switch (proto) {
+			case NFPROTO_IPV4:
+				if (ipv4_get_dsfield(ip_hdr(skb) & ~INET_ECN_MASK) != c->mark >> 24 & ~INET_ECN_MASK)
+					ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, c->mark >> 24 & ~INET_ECN_MASK);
+				break;
+			case NFPROTO_IPV6:
+				if (ipv6_get_dsfield(ip_hdr(skb) & ~INET_ECN_MASK) != c->mark >> 24 & ~INET_ECN_MASK)
+					ipv6_change_dsfield(ip_hdr(skb), INET_ECN_MASK, c->mark >> 24 & ~INET_ECN_MASK);
+				break;
+			default:
+				break;
+			}
+		}
 		skb->mark = c->mark;
 		/* using overlimits stats to count how many packets marked */
 		ca->tcf_qstats.overlimits++;