netdev - Re: [PATCH iproute2-next v3] tc/skbmod: Introduce SKBMOD_F

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 8 Aug 2021 11:59:34 -0600
From:   David Ahern <dsahern@...il.com>
To:     Peilin Ye <yepeilin.cs@...il.com>, netdev@...r.kernel.org
Cc:     Stephen Hemminger <stephen@...workplumber.org>,
        Jamal Hadi Salim <jhs@...atatu.com>,
        Cong Wang <xiyou.wangcong@...il.com>,
        Jiri Pirko <jiri@...nulli.us>,
        Cong Wang <cong.wang@...edance.com>,
        Peilin Ye <peilin.ye@...edance.com>
Subject: Re: [PATCH iproute2-next v3] tc/skbmod: Introduce SKBMOD_F_ECN option

On 8/4/21 12:15 PM, Peilin Ye wrote:
> From: Peilin Ye <peilin.ye@...edance.com>
> 
> Recently we added SKBMOD_F_ECN option support to the kernel; support it in
> the tc-skbmod(8) front end, and update its man page accordingly.
> 
> The 2 least significant bits of the Traffic Class field in IPv4 and IPv6
> headers are used to represent different ECN states [1]:
> 
> 	0b00: "Non ECN-Capable Transport", Non-ECT
> 	0b10: "ECN Capable Transport", ECT(0)
> 	0b01: "ECN Capable Transport", ECT(1)
> 	0b11: "Congestion Encountered", CE
> 
> This new option, "ecn", marks ECT(0) and ECT(1) IPv{4,6} packets as CE,
> which is useful for ECN-based rate limiting.  For example:
> 
> 	$ tc filter add dev eth0 parent 1: protocol ip prio 10 \
> 		u32 match ip protocol 1 0xff flowid 1:2 \
> 		action skbmod \
> 		ecn
> 
> The updated tc-skbmod SYNOPSIS looks like the following:
> 
> 	tc ... action skbmod { set SETTABLE | swap SWAPPABLE | ecn } ...
> 
> Only one of "set", "swap" or "ecn" shall be used in a single tc-skbmod
> command.  Trying to use more than one of them at a time is considered
> undefined behavior; pipe multiple tc-skbmod commands together instead.
> "set" and "swap" only affect Ethernet packets, while "ecn" only affects
> IP packets.
> 
> Depends on kernel patch "net/sched: act_skbmod: Add SKBMOD_F_ECN option
> support", as well as iproute2 patch "tc/skbmod: Remove misinformation
> about the swap action".
> 
> [1] https://en.wikipedia.org/wiki/Explicit_Congestion_Notification
> 
> Reviewed-by: Cong Wang <cong.wang@...edance.com>
> Signed-off-by: Peilin Ye <peilin.ye@...edance.com>
> ---
> Hi David,
> 
>> I just merged main into next. Please fix up this patch and re-send. In
>> the future, just ask for a merge in cases like this.
> 
> Ah, I see; thanks!
> Peilin Ye
> 
> Change since v2:
>     - re-rebased on iproute2-next (David)
> 
>  man/man8/tc-skbmod.8 | 38 +++++++++++++++++++++++++++++---------
>  tc/m_skbmod.c        |  8 +++++++-
>  2 files changed, 36 insertions(+), 10 deletions(-)
> 

applied to iproute2-next.