netdev - Re: tc - mirred ingress not supported at the moment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAM_iQpXNVgpi0+4BHw6zDN3z=dRpERqr6+ohjytf=zKoLd+CLg@mail.gmail.com>
Date:   Wed, 14 Aug 2019 13:51:27 -0700
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Martin Olsson <martin.olsson+netdev@...torsecurity.com>
Cc:     netdev <netdev@...r.kernel.org>
Subject: Re: tc - mirred ingress not supported at the moment

On Wed, Aug 14, 2019 at 2:02 AM Martin Olsson
<martin.olsson+netdev@...torsecurity.com> wrote:
>
> Hi Cong!
>
> Ah sorry.
> Already implemented. Great!
>
> Hmmm. Then why don't the manual at https://www.linux.org/docs/man8/tc-mirred.html to reflect the changes?
> That was the place I checked to see if ingress was still not implemented.
> In the commit you point at, the sentence "Currently only egress is implemented" has been removed.


This means that website is out-of-date, not sync'ed with latest man pages.


>
>
> Question:
> Is there any form of performance penalty if I send the mirrored traffic to the ingress queue of the destination interface rather than to the egress queue?
> I mean, in the kernel there is the possibility to perform far more actions on the ingress queue than on the egress, but if I leave both queues at their defaults, will mirrored packets to ingress use more CPU cycles than to the egress destination, or are they more or less identical?
>

Hard to say without measurement. There is no queue on ingress
side, by the way, so it could be faster than egress, regarding to
lock contentions on queues.

>
> Question 2:
> Given the commit https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=5eca0a3701223619a513c7209f7d9335ca1b4cfa, how can I see in what kernel version it was added?
>

The kernel commit is:

commit 53592b3640019f2834701093e38272fdfd367ad8
Author: Shmulik Ladkani <shmulik.ladkani@...il.com>
Date:   Thu Oct 13 09:06:44 2016 +0300

    net/sched: act_mirred: Implement ingress actions

which is merged in 4.10.

Thanks.