linux-kernel - Re: [PATCH net] openvswitch: meter: remove rate from the bucket size calculation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 27 Apr 2021 23:45:53 -0700
From:   Jean Tourrilhes <jean.tourrilhes@....com>
To:     Tonghao Zhang <xiangxia.m.yue@...il.com>
Cc:     Ilya Maximets <i.maximets@....org>,
        Pravin B Shelar <pshelar@....org>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, Andy Zhou <azhou@....org>,
        Linux Kernel Network Developers <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        ovs dev <dev@...nvswitch.org>, William Tu <u9012063@...il.com>
Subject: Re: [PATCH net] openvswitch: meter: remove rate from the bucket size
 calculation

On Wed, Apr 28, 2021 at 02:24:10PM +0800, Tonghao Zhang wrote:
> Hi Ilya
> If we set the burst size too small, the meters of ovs don't work.

	Most likely, you need to set the burst size larger.
	A quick Google on finding a good burst size :
https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/concept/policer-mx-m120-m320-burstsize-determining.html

	Now, the interesting question, is the behaviour of OVS
different from a standard token bucket, such as a kernel policer ?
	Here is how to set up a kernel policer :
----------------------------------------------------------
# Create a dummy classful discipline to attach filter
tc qdisc del dev eth6 root
tc qdisc add dev eth6 root handle 1: prio bands 2 priomap  0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
tc qdisc add dev eth6 parent 1:1 handle 10: pfifo limit 1000
tc qdisc add dev eth6 parent 1:2 handle 20: pfifo limit 1000
tc -s qdisc show dev eth6
tc -s class show dev eth6

# Filter to do hard rate limiting
tc filter del dev eth6 parent 1: protocol all prio 1 handle 800::100 u32 
tc filter add dev eth6 parent 1: protocol all prio 1 handle 800::100 u32 match u32 0 0 police rate 200mbit burst 20K mtu 10000 drop
tc -s filter show dev eth6
tc filter change dev eth6 parent 1: protocol all prio 1 handle 800::100 u32 match u32 0 0 police rate 200mbit burst 50K mtu 10000 drop
----------------------------------------------------------

	Regards,

	Jean