target/linux/generic/backport-4.19/391-v5.1-sch_cake-Permit-use-of-connmarks-as-tin-classifiers.patch

   1 From 0b5c7efdfc6e389ec6840579fe90bdb6f42b08dc Mon Sep 17 00:00:00 2001
   2 From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
   3 Date: Fri, 1 Mar 2019 16:04:05 +0100
   4 Subject: [PATCH] sch_cake: Permit use of connmarks as tin classifiers
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 Add flag 'FWMARK' to enable use of firewall connmarks as tin selector.
  10 The connmark (skbuff->mark) needs to be in the range 1->tin_cnt ie.
  11 for diffserv3 the mark needs to be 1->3.
  12
  13 Background
  14
  15 Typically CAKE uses DSCP as the basis for tin selection.  DSCP values
  16 are relatively easily changed as part of the egress path, usually with
  17 iptables & the mangle table, ingress is more challenging.  CAKE is often
  18 used on the WAN interface of a residential gateway where passthrough of
  19 DSCP from the ISP is either missing or set to unhelpful values thus use
  20 of ingress DSCP values for tin selection isn't helpful in that
  21 environment.
  22
  23 An approach to solving the ingress tin selection problem is to use
  24 CAKE's understanding of tc filters.  Naive tc filters could match on
  25 source/destination port numbers and force tin selection that way, but
  26 multiple filters don't scale particularly well as each filter must be
  27 traversed whether it matches or not. e.g. a simple example to map 3
  28 firewall marks to tins:
  29
  30 MAJOR=$( tc qdisc show dev $DEV | head -1 | awk '{print $3}' )
  31 tc filter add dev $DEV parent $MAJOR protocol all handle 0x01 fw action skbedit priority ${MAJOR}1
  32 tc filter add dev $DEV parent $MAJOR protocol all handle 0x02 fw action skbedit priority ${MAJOR}2
  33 tc filter add dev $DEV parent $MAJOR protocol all handle 0x03 fw action skbedit priority ${MAJOR}3
  34
  35 Another option is to use eBPF cls_act with tc filters e.g.
  36
  37 MAJOR=$( tc qdisc show dev $DEV | head -1 | awk '{print $3}' )
  38 tc filter add dev $DEV parent $MAJOR bpf da obj my-bpf-fwmark-to-class.o
  39
  40 This has the disadvantages of a) needing someone to write & maintain
  41 the bpf program, b) a bpf toolchain to compile it and c) needing to
  42 hardcode the major number in the bpf program so it matches the cake
  43 instance (or forcing the cake instance to a particular major number)
  44 since the major number cannot be passed to the bpf program via tc
  45 command line.
  46
  47 As already hinted at by the previous examples, it would be helpful
  48 to associate tins with something that survives the Internet path and
  49 ideally allows tin selection on both egress and ingress.  Netfilter's
  50 conntrack permits setting an identifying mark on a connection which
  51 can also be restored to an ingress packet with tc action connmark e.g.
  52
  53 tc filter add dev eth0 parent ffff: protocol all prio 10 u32 \
  54         match u32 0 0 flowid 1:1 action connmark action mirred egress redirect dev ifb1
  55
  56 Since tc's connmark action has restored any connmark into skb->mark,
  57 any of the previous solutions are based upon it and in one form or
  58 another copy that mark to the skb->priority field where again CAKE
  59 picks this up.
  60
  61 This change cuts out at least one of the (less intuitive &
  62 non-scalable) middlemen and permit direct access to skb->mark.
  63
  64 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
  65 Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
  66 Signed-off-by: David S. Miller <davem@davemloft.net>
  67 ---
  68  include/uapi/linux/pkt_sched.h |  1 +
  69  net/sched/sch_cake.c           | 34 +++++++++++++++++++++++++++-------
  70  2 files changed, 28 insertions(+), 7 deletions(-)
  71
  72 --- a/include/uapi/linux/pkt_sched.h
  73 +++ b/include/uapi/linux/pkt_sched.h
  74 @@ -991,6 +991,7 @@ enum {
  75         TCA_CAKE_INGRESS,
  76         TCA_CAKE_ACK_FILTER,
  77         TCA_CAKE_SPLIT_GSO,
  78 +       TCA_CAKE_FWMARK,
  79         __TCA_CAKE_MAX
  80  };
  81  #define TCA_CAKE_MAX   (__TCA_CAKE_MAX - 1)
  82 --- a/net/sched/sch_cake.c
  83 +++ b/net/sched/sch_cake.c
  84 @@ -258,7 +258,8 @@ enum {
  85         CAKE_FLAG_AUTORATE_INGRESS = BIT(1),
  86         CAKE_FLAG_INGRESS          = BIT(2),
  87         CAKE_FLAG_WASH             = BIT(3),
  88 -       CAKE_FLAG_SPLIT_GSO        = BIT(4)
  89 +       CAKE_FLAG_SPLIT_GSO        = BIT(4),
  90 +       CAKE_FLAG_FWMARK           = BIT(5)
  91  };
  92
  93  /* COBALT operates the Codel and BLUE algorithms in parallel, in order to
  94 @@ -2623,6 +2624,13 @@ static int cake_change(struct Qdisc *sch
  95                         q->rate_flags &= ~CAKE_FLAG_SPLIT_GSO;
  96         }
  97
  98 +       if (tb[TCA_CAKE_FWMARK]) {
  99 +               if (!!nla_get_u32(tb[TCA_CAKE_FWMARK]))
 100 +                       q->rate_flags |= CAKE_FLAG_FWMARK;
 101 +               else
 102 +                       q->rate_flags &= ~CAKE_FLAG_FWMARK;
 103 +       }
 104 +
 105         if (q->tins) {
 106                 sch_tree_lock(sch);
 107                 cake_reconfigure(sch);
 108 @@ -2782,6 +2790,10 @@ static int cake_dump(struct Qdisc *sch,
 109                         !!(q->rate_flags & CAKE_FLAG_SPLIT_GSO)))
 110                 goto nla_put_failure;
 111
 112 +       if (nla_put_u32(skb, TCA_CAKE_FWMARK,
 113 +                       !!(q->rate_flags & CAKE_FLAG_FWMARK)))
 114 +               goto nla_put_failure;
 115 +
 116         return nla_nest_end(skb, opts);
 117
 118  nla_put_failure: