[Cake] issue with Cake and bpf filter

[Toke Høiland-Jørgensen]

Pete Heist <pete at heistp.net> writes:

>> On Aug 21, 2018, at 11:17 PM, Toke Høiland-Jørgensen <toke at toke.dk> wrote:
>>> 
>>> Well that’s good timing for me as I’m wrapping up a small utility/eBPF
>>> to classify an arbitrary username to either MAC or IP. Here’s the work
>>> in progress, which is not done yet as flow fairness is still under
>>> construction, and I haven’t gotten my IPv6 support to pass the rather
>>> stubborn eBPF verifier: https://github.com/heistp/tc-users
>>> <https://github.com/heistp/tc-users <https://github.com/heistp/tc-users>>
>> 
>> Did you see my classifier? Does subnet-to-flow mapping.
>> https://github.com/tohojo/tc-classifier
>> <https://github.com/tohojo/tc-classifier>
>
> Yes I did, that helped a lot with the eBPF code! I’ll consult it for
> LPM trie usage, which will have to be ifdef’d out though for pre-4.11
> kernels.

Cool! Just wanted to make sure you were reinventing wheels on purpose,
not from lack of a prior stack of wheels to pick from ;)

(I very much consider my classifier a quick solution for a specific use
case; can totally understand you want more features :))

> tc-users is similar really but I desired a few things (for FreeNet):
> - MAC and IPv6 support

Might be useful to add rudimentary encapsulation support as well? I.e.,
at least ip{4,6}-ip{4,6} and vlan tags? Only a few lines of BPF code and
makes it useful in a few more scenarios...

>>> - With the new major/minor ID distinction, I’d probably use major for
>>> the user and minor for the flow hash?
>> 
>> Yes. See the latest commit in the tc-adv repo for a man page update
>> explaining it. You can also just set the major ID and let cake do the
>> flow hashing…
>
> Aha, that’s terribly convenient but also means I don’t really need to
> solve the hashing problem (rats), and will be ripping out some of what
> I started. :)

Yeah, I think keeping the flow hashing but being able to specify the
host mapping could turn out to be quite the killer feature, actually.
Unfortunately there are not enough bits in the class ID to specify both
source and destination host IDs, so triple-isolate is not going to work
too well with this. But then I figure that anyone who is deploying this
with their own filtering probably has enough control over the network to
deploy separate CAKE instances in each direction...

-Toke