netdev - Re: Problem with queuing vlan tagged packets after migration from 3.16.0 to 4.9.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 4 Jan 2019 19:11:14 +0100
From:   Bartek Kois <bartek.kois@...il.com>
To:     Cong Wang <xiyou.wangcong@...il.com>
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>
Subject: Re: Problem with queuing vlan tagged packets after migration from
 3.16.0 to 4.9.0

Hi

W dniu 03.01.2019 o 21:44, Cong Wang pisze:
> On Thu, Jan 3, 2019 at 7:25 AM Bartek Kois <bartek.kois@...il.com> wrote:
>> Hi
>> 1. What exactly caused this change in the kernel?
>
> I don't follow VLAN changes, I guess it must be some change which
> inserts the VLAN tag before this ->ndo_start_xmit().
>
>
>> 2. I don`t understand why adding VLAN tag, which is just 4  additional
>> bytes to the passing packet make it impossible to classify.
> It is possible, you just have to specify the offset manually, as the
> iproute2 can't detect the offset of IP header in this case. So it is just
> inconvenient.
>
>> 3. This whole thing makes the QoS under Linux routers hard to configure
>> in scenarios with more than one VLAN which is pretty much every slightly
>> bigger router nowadays especially if we use IFB and hashing filters. Is
>> there any walkaround for that problem?
>>
> Just move these filters from physical device to the VLAN device instead?
>

Basically my current scenario looks like this:
- router with eth0 as WAN and eth1 as LAN with 10-20 vlans,
- around 1000-2000 ip addresses in differnets subnets behind router (on 
the LAN side),
- QoS made with tc + ifb (for upload queuing) + hasing filters (for 
performance reasons)

Moving this to two queuing trees (one on vlan and one on ifbx) per each 
vlan makes this really hard to configure, but not impossible as long as 
I can redirect single VLAN to ifb (don`t know if that is possible).
Anton suggested to use iptables+ipset but I don`t think that would be a 
good idea to do that in scenario with so many queues.

Best reagrds
Bartek Kois