netdev - Re: tc ingress filters not applied

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <loom.20150706T190215-28@post.gmane.org>
Date:	Mon, 6 Jul 2015 17:24:34 +0000 (UTC)
From:	Huan Le <huan@...era.com>
To:	netdev@...r.kernel.org
Subject: Re: tc ingress filters not applied

Erik Hugne <erik.hugne <at> ericsson.com> writes:

> 
> I'm having troubles with TC policing, the ingress filters does not seem to be
> applied.
> 
> 
> Kernel: net-next/latest 
> iproute2: shemminger/master
> 
> //E
> 

I observed similar behavior when configuring a filter on ingress qdisc.
Test shows that traffic was rate-limited to the configured value. 
However, "tc filter show" does not show any filtering rule.

(1) add ingress qdisc on eth1
# tc qdisc add dev eth1 ingress
# tc qdisc show dev eth1 ingress
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap \
 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc ingress ffff: parent ffff:fff1 ---------------- 

(2) add filter under ingress qdisc
# tc filter add dev eth1 parent ffff: protocol all \
 u32 match ip src 0.0.0.0/0 \
 police rate 256kbit burst 10k drop flowid :1
# tc filter show dev eth1

(3) verified sch_ingress kernel module is installed
# lsmod  | grep sch_ingress
sch_ingress            12866  1

(4) uname -a (if needed for debugging)
Linux huan-lnx 3.16.0-30-generic #40~14.04.1-Ubuntu SMP 
Thu Jan 15 17:43:14 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

I am testing this using ubuntu 14.04 on a virtualbox VM
(eth1 is a host-only adapter).

Thanks,
Huan

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html