netdev - Re: Problem with queuing vlan tagged packets after migration from 3.16.0 to 4.9.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM_iQpV-X+vT9vaY29wC8tme1FzEL1OWqhYbtSB1_ZWjrC3Fvw@mail.gmail.com>
Date:   Fri, 4 Jan 2019 21:03:53 -0800
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Bartek Kois <bartek.kois@...il.com>
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>,
        Jamal Hadi Salim <jhs@...atatu.com>
Subject: Re: Problem with queuing vlan tagged packets after migration from
 3.16.0 to 4.9.0

(Cc'ing Jamal)

On Fri, Jan 4, 2019 at 10:11 AM Bartek Kois <bartek.kois@...il.com> wrote:
>
> Basically my current scenario looks like this:
> - router with eth0 as WAN and eth1 as LAN with 10-20 vlans,
> - around 1000-2000 ip addresses in differnets subnets behind router (on
> the LAN side),
> - QoS made with tc + ifb (for upload queuing) + hasing filters (for
> performance reasons)
>
> Moving this to two queuing trees (one on vlan and one on ifbx) per each
> vlan makes this really hard to configure, but not impossible as long as
> I can redirect single VLAN to ifb (don`t know if that is possible).
> Anton suggested to use iptables+ipset but I don`t think that would be a
> good idea to do that in scenario with so many queues.

Yeah, understood.

Perhaps we should just export this offset via a u32 filter dump,
so that user-space could at least know the offset of IP header.
However, for transport header, we still can't do anything here, as
we can't predict whether an IP packet contains IP options.

On the other hand, you can try other filters, for example, flower
filter should work well with VLAN too, although it is probably not as
fast as u32.

Thanks.