Ingress qdisc via fwmark

Ingress qdisc via fwmark

[Chris Elston]

Hello,

I'm having a little trouble getting ingress policing working, filtering
based on an iptables fwmark. The iptables fwmark is being set with a new
L2TP packet classifier:

# iptables -A INPUT -t mangle -s 192.168.101.20 -m l2tp --tidR380 --sid4787 --typeÚta -j MARK --set-mark 1

(Note that I have also tried adding to the PREROUTING mangle table
too...)

I have confirmed that the classifier is marking packets:

# iptables -L INPUT -t mangle -v
Chain INPUT (policy ACCEPT 59641 packets, 44M bytes)
 pkts bytes target     prot opt in     out     source               destination         
  172  7912 MARK       all  --  any    any     lns                  anywhere             l2tp tid 52380 sid 34787 type data MARK set 0x1

I have set up an ingress qdisc with:

# tc qdisc add dev eth1 handle ffff: ingress

And a filter to police the marked packets:

# tc filter add dev eth1 protocol ip parent ffff: prio 1 handle 1 fw police rate 32768 burst 10k drop flowid :1

But none are getting dropped:

# tc -s qdisc show dev eth1
<snip>
qdisc ingress ffff: parent ffff:fff1 ---------------- 
 Sent 15712712 bytes 186225 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 

I believe from the HOWTO:
(http://www.linuxdocs.org/HOWTOs/Adv-Routing-HOWTO-14.html section 14.2)
that this should be possible, but I've also found mention
(http://www.spinics.net/lists/lartc/msg18021.html) that the new-style
policer happens before PREROUTING.

Also, this diagram suggests that queueing to the ingress qdisc happens
before classification takes place:
http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg

I'm using kernel 3.2.x, with CONFIG_NET_ACT_POLICE=m. 

A previous scheme I had DID manage to drop ingress L2TP packets matching
the specification using the tc u32 filter - but the tc commands were
becoming very complicated and would be difficult to manage dynamically,
hence the switch to an iptables classifier.

I'm hoping that someone on the list can let me know whether this is
actually possible with contemporary kernels, and if so, where I'm going
wrong.

Thanks,

Chris.

Re: Ingress qdisc via fwmark

[Chris Elston]

Hi Remy,

Thanks for the suggestion. I think I've implemented it as per your
recommendation:

# iptables -L PREROUTING -t mangle -v
Chain PREROUTING (policy ACCEPT 455K packets, 33M bytes)
 pkts bytes target     prot opt in     out     source               destination         
 227K   21M MARK       all  --  any    any     lns                  anywhere             l2tp tid 54356 sid 62245 type data MARK set 0x1
 227K   21M CONNMARK   all  --  any    any     lns                  anywhere             mark match 0x1 CONNMARK save

But nothing's hitting the tc filter:

# tc -s filter show dev eth1 parent ffff:
filter protocol ip pref 1 fw 
filter protocol ip pref 1 fw handle 0x1 classid :1  police 0x7 rate 32768bit burst 10Kb mtu 2Kb action drop overhead 0b 
ref 1 bind 1

 Sent 0 bytes 0 pkts (dropped 0, overlimits 0)

# tc -s qdisc show dev eth1
<snip>
qdisc ingress ffff: parent ffff:fff1 ---------------- 
 Sent 21410620 bytes 236564 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 

Anything jump out at you as obviously incorrect?

Thanks,

Chris.

On Tue, 2013-11-12 at 16:37 +0100, Remy Mudingay wrote:
> Opps I forgot to iclude the link.
> 
> 
> https://hydra.geht.net/tino/howto/linux/net/netfilter/
> 
> 
> 
> On 12 November 2013 16:35, Remy Mudingay <remy.mudingay@gmail.com>
> wrote:
>         Hi Chris,
>         
>         
>         
>         
>         What you are trying to achieve can only work on the PREROUTING
>         table. Take a look at the following diagram to get a clearer
>         picture of how a packet flows through Linux (Netfilter/Qos).
>         
>         
>         The PREROUTING table is the only netfilter table which is
>         processed before the ingress qdisc.
>         You also need to apply the connmark target as in " -j CONNMARK
>         --save-mark" following you iptables command as follows ;
>         
>         
>         Example:
>         
>         
>          iptables -A PREROUTING -t mangle -s 192.168.101.20 -m l2tp
>         --tidR380 --sid4787 --typeÚta -j MARK --set-mark 1
>         
>          iptables -A PREROUTING -t mangle -s 192.168.101.20  -m mark
>         --mark 1 -j CONNMARK --save-mark
>         
>         
>         
>         I hope that helps.
>         
>         
>         Remy
>         
>         
>         
>         
>         
>         
>         On 12 November 2013 15:29, Chris Elston <celston@katalix.com>
>         wrote:
>                 Hello,
>                 
>                 I'm having a little trouble getting ingress policing
>                 working, filtering
>                 based on an iptables fwmark. The iptables fwmark is
>                 being set with a new
>                 L2TP packet classifier:
>                 
>                 # iptables -A INPUT -t mangle -s 192.168.101.20 -m
>                 l2tp --tidR380 --sid4787 --typeÚta -j MARK
>                 --set-mark 1
>                 
>                 (Note that I have also tried adding to the PREROUTING
>                 mangle table
>                 too...)
>                 
>                 I have confirmed that the classifier is marking
>                 packets:
>                 
>                 # iptables -L INPUT -t mangle -v
>                 Chain INPUT (policy ACCEPT 59641 packets, 44M bytes)
>                  pkts bytes target     prot opt in     out     source
>                 destination
>                   172  7912 MARK       all  --  any    any     lns
>                                anywhere             l2tp tid 52380 sid
>                 34787 type data MARK set 0x1
>                 
>                 I have set up an ingress qdisc with:
>                 
>                 # tc qdisc add dev eth1 handle ffff: ingress
>                 
>                 And a filter to police the marked packets:
>                 
>                 # tc filter add dev eth1 protocol ip parent ffff: prio
>                 1 handle 1 fw police rate 32768 burst 10k drop
>                 flowid :1
>                 
>                 But none are getting dropped:
>                 
>                 # tc -s qdisc show dev eth1
>                 <snip>
>                 qdisc ingress ffff: parent ffff:fff1 ----------------
>                  Sent 15712712 bytes 186225 pkt (dropped 0, overlimits
>                 0 requeues 0)
>                  backlog 0b 0p requeues 0
>                 
>                 I believe from the HOWTO:
>                 (http://www.linuxdocs.org/HOWTOs/Adv-Routing-HOWTO-14.html section 14.2)
>                 that this should be possible, but I've also found
>                 mention
>                 (http://www.spinics.net/lists/lartc/msg18021.html)
>                 that the new-style
>                 policer happens before PREROUTING.
>                 
>                 Also, this diagram suggests that queueing to the
>                 ingress qdisc happens
>                 before classification takes place:
>                 http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg
>                 
>                 I'm using kernel 3.2.x, with CONFIG_NET_ACT_POLICE=m.
>                 
>                 A previous scheme I had DID manage to drop ingress
>                 L2TP packets matching
>                 the specification using the tc u32 filter - but the tc
>                 commands were
>                 becoming very complicated and would be difficult to
>                 manage dynamically,
>                 hence the switch to an iptables classifier.
>                 
>                 I'm hoping that someone on the list can let me know
>                 whether this is
>                 actually possible with contemporary kernels, and if
>                 so, where I'm going
>                 wrong.
>                 
>                 Thanks,
>                 
>                 Chris.
>                 
>                 --
>                 To unsubscribe from this list: send the line
>                 "unsubscribe lartc" in
>                 the body of a message to majordomo@vger.kernel.org
>                 More majordomo info at
>                  http://vger.kernel.org/majordomo-info.html
>         
>         
> 
> 

Re: Ingress qdisc via fwmark

[Andrew Beverley]

On Tue, 2013-11-12 at 14:29 +0000, Chris Elston wrote:
> Hello,
> 
> I'm having a little trouble getting ingress policing working, filtering
> based on an iptables fwmark.

As you allude to, this is not possible with a vanilla kernel (unless
it's changed recently).

> Also, this diagram suggests that queueing to the ingress qdisc happens
> before classification takes place:
> http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg

Yes, the ingress qdisc will see the packets before they have hit
netfilter.

> I'm hoping that someone on the list can let me know whether this is
> actually possible with contemporary kernels, and if so, where I'm going
> wrong.

The only options I know of are:

1. Use IMQ (not in the vanilla kernel).

2. If you're forwarding packets, then use an egress qdisc on the output
interface.

3. If you want to DROP packets, then you might be able to do so once the
client sends reply packets, and therefore catch them using egress on
their way back out.

4. Use a U32 filter on ingress. You may find the discussion here useful:

http://www.spinics.net/lists/lartc/msg22354.html

Andy

Re: Ingress qdisc via fwmark

[Chris Elston]

Hi Andy,

Sorry for the much delayed reply. I just wanted to say thanks for the
summary. 

I finally managed to get things working using option 4. I found that
using U32 to do anything but quite simple packet inspection quickly
becomes pretty difficult to manage :(

Cheers,

Chris.

On Tue, 2013-11-12 at 18:31 +0000, Andrew Beverley wrote:
> On Tue, 2013-11-12 at 14:29 +0000, Chris Elston wrote:
> > Hello,
> > 
> > I'm having a little trouble getting ingress policing working, filtering
> > based on an iptables fwmark.
> 
> As you allude to, this is not possible with a vanilla kernel (unless
> it's changed recently).
> 
> > Also, this diagram suggests that queueing to the ingress qdisc happens
> > before classification takes place:
> > http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg
> 
> Yes, the ingress qdisc will see the packets before they have hit
> netfilter.
> 
> > I'm hoping that someone on the list can let me know whether this is
> > actually possible with contemporary kernels, and if so, where I'm going
> > wrong.
> 
> The only options I know of are:
> 
> 1. Use IMQ (not in the vanilla kernel).
> 
> 2. If you're forwarding packets, then use an egress qdisc on the output
> interface.
> 
> 3. If you want to DROP packets, then you might be able to do so once the
> client sends reply packets, and therefore catch them using egress on
> their way back out.
> 
> 4. Use a U32 filter on ingress. You may find the discussion here useful:
> 
> http://www.spinics.net/lists/lartc/msg22354.html
> 
> Andy
> 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe lartc" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Ingress qdisc via fwmark

[Andrew Beverley]

On Wed, 2013-11-27 at 17:31 +0000, Chris Elston wrote:
> Hi Andy,
> 
> Sorry for the much delayed reply. I just wanted to say thanks for the
> summary. 

You're welcome.

> I finally managed to get things working using option 4. I found that
> using U32 to do anything but quite simple packet inspection quickly
> becomes pretty difficult to manage :(

Erm, yes. Well if you ever get a chance to write something up, then I
think the user community would appreciate it. Even if it's just an email
to this list!

Andy