[LARTC] Trying to do some very simple ingress limiting, no success

[LARTC] Trying to do some very simple ingress limiting, no success

[Erik Slagter]

[-- Attachment #1.1: Type: text/plain, Size: 1994 bytes --]

Hi,

I am trying to do some simple ingress limiting based on fwmark. I know
the ability and sense to do INGRESS limiting is ehm... limited ;-) but
still I want to try it.

I tried several things.

=== 1 ===

tcq ingress handle ffff: 
tcf parent ffff: protocol ip prio 1 handle 1 fw police rate 12mbit burst 10k drop
tcf parent ffff: protocol ip prio 1 handle 2 fw police rate 10mbit burst 10k drop
tcf parent ffff: protocol ip prio 1 handle 3 fw police rate 1mbit  burst 10k drop

This installs OK, but the filters are never called. The netfilter stats
show the marks are set though. To make sure it's not just the tc stats
output that's borked, I changed the bw limits to a rediculous low value,
and indeed, no effect at all.

=== 2 ===

tcq ingress handle ffff: 
tcq parent ffff: handle 10 htb 
tcc parent ffff: htb rate 12mbit
tcc parent ffff: htb rate 10mbit
tcc parent ffff: htb rate 1mbit
tcf parent ffff: protocol ip prio 1 fw 

I tricked tc into attaching a htb to the root qdisc. This gives no errors
but also doesn't seem to do anything. If you use tc show qdisc|filter|class
the qdisc,filters and classes are not even shown, so I guess it's borked
(tc should have given an error that it won't work).

========

IMHO it isn't that complex I want to achieve... The example of the synflood
protector also doesn't work, btw.

I am using linux 2.6.16.1 and these rules to mark:

iptables -t mangle -N classify-high
iptables -t mangle -A classify-high -j MARK --set-mark 1
iptables -t mangle -A classify-high -j ACCEPT

iptables -t mangle -N classify-medium
iptables -t mangle -A classify-medium -j MARK --set-mark 2
iptables -t mangle -A classify-medium -j ACCEPT

iptables -t mangle -N classify-low
iptables -t mangle -A classify-low -j MARK --set-mark 3
iptables -t mangle -A classify-low -j ACCEPT

The "ACCEPT"s are necessary, otherwise the classification will
overflow and all packets are marked with "3".

Thanks in advance.

[-- Attachment #1.2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 2771 bytes --]

[-- Attachment #2: Type: text/plain, Size: 143 bytes --]

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] Trying to do some very simple ingress limiting, no success

[Andy Furniss]

Erik Slagter wrote:
> Hi,
> 
> I am trying to do some simple ingress limiting based on fwmark. I know
> the ability and sense to do INGRESS limiting is ehm... limited ;-) but
> still I want to try it.
> 
> I tried several things.
> 
> == 1 => 
> tcq ingress handle ffff: 
> tcf parent ffff: protocol ip prio 1 handle 1 fw police rate 12mbit burst 10k drop
> tcf parent ffff: protocol ip prio 1 handle 2 fw police rate 10mbit burst 10k drop
> tcf parent ffff: protocol ip prio 1 handle 3 fw police rate 1mbit  burst 10k drop
> 
> This installs OK, but the filters are never called. The netfilter stats
> show the marks are set though. To make sure it's not just the tc stats
> output that's borked, I changed the bw limits to a rediculous low value,
> and indeed, no effect at all.
> 

There are two policers now the old one will work as you want but you 
need to change your kernel config. Unselect packet action and you should 
be able to choose a different policer.

Or you could try using tc filters instead of netfilter - I don't know if 
it will be possible for what you want as I can't see the rules that mark.


> == 2 => 
> tcq ingress handle ffff: 
> tcq parent ffff: handle 10 htb 
> tcc parent ffff: htb rate 12mbit
> tcc parent ffff: htb rate 10mbit
> tcc parent ffff: htb rate 1mbit
> tcf parent ffff: protocol ip prio 1 fw 
> 
> I tricked tc into attaching a htb to the root qdisc. This gives no errors
> but also doesn't seem to do anything. If you use tc show qdisc|filter|class
> the qdisc,filters and classes are not even shown, so I guess it's borked
> (tc should have given an error that it won't work).
> 
> ====

This has never worked if you want a queue on ingress you need to use IMQ 
(in the case that you need netfilter PREROUTING marks) or IFB (kernel >= 
2.6.16) but this will hook before netfilter - so no marks.

Andy.
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] Trying to do some very simple ingress limiting, no success

[Erik Slagter]

[-- Attachment #1.1: Type: text/plain, Size: 2230 bytes --]

On Sun, 2006-04-09 at 14:00 +0100, Andy Furniss wrote:
> Erik Slagter wrote:
> > Hi,
> > 
> > I am trying to do some simple ingress limiting based on fwmark. I know
> > the ability and sense to do INGRESS limiting is ehm... limited ;-) but
> > still I want to try it.
> > 
> > I tried several things.
> > 
> > === 1 ===
> > 
> > tcq ingress handle ffff: 
> > tcf parent ffff: protocol ip prio 1 handle 1 fw police rate 12mbit burst 10k drop
> > tcf parent ffff: protocol ip prio 1 handle 2 fw police rate 10mbit burst 10k drop
> > tcf parent ffff: protocol ip prio 1 handle 3 fw police rate 1mbit  burst 10k drop
> > 
> > This installs OK, but the filters are never called. The netfilter stats
> > show the marks are set though. To make sure it's not just the tc stats
> > output that's borked, I changed the bw limits to a rediculous low value,
> > and indeed, no effect at all.
> > 
> There are two policers now the old one will work as you want but you 
> need to change your kernel config. Unselect packet action and you should 
> be able to choose a different policer.

Found it and deselected it. Now making new kernel...

The "old" policer is marked as "obsolete", so I guess it will go away.

What am I supposed to replace it with, then?

> Or you could try using tc filters instead of netfilter - I don't know if 
> it will be possible for what you want as I can't see the rules that mark.

It's probably possible, but I already have quite a large set of
netfilter rules. I don't want to make the whole thing even more
complicated by also adding lots of tc stuff, I'd rather have the
tc/iproute things as simple as possible.
 
> This has never worked if you want a queue on ingress you need to use IMQ 
> (in the case that you need netfilter PREROUTING marks) or IFB (kernel >= 
> 2.6.16) but this will hook before netfilter - so no marks.

For IMQ I need to patch the kernel (feasible) and the netfilter tools
(not feasible :-() I just learned.

And you're just telling me I cannot use IFB. Bummer. Anyway, if there is
any simple (!) way to implement what I am searching for, I am happy.

I will try your "old policer version" suggestion asap.

Thanks for your help.

[-- Attachment #1.2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 2771 bytes --]

[-- Attachment #2: Type: text/plain, Size: 143 bytes --]

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] Trying to do some very simple ingress limiting, no success

[Andy Furniss]

Erik Slagter wrote:
> 
> Found it and deselected it. Now making new kernel...
> 
> The "old" policer is marked as "obsolete", so I guess it will go away.
> 
> What am I supposed to replace it with, then?

There may be a way in the future to get netfilter state with an 
ematch/meta data (I don't know the detail Thomas Graf has mentioned it).

> For IMQ I need to patch the kernel (feasible) and the netfilter tools
> (not feasible :-() I just learned.

I didn't know there is a problrm with IMQ + netfilter.

Andy.
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] Trying to do some very simple ingress limiting, no success

[Erik Slagter]

[-- Attachment #1.1: Type: text/plain, Size: 391 bytes --]

On Sun, 2006-04-09 at 14:00 +0100, Andy Furniss wrote:

> There are two policers now the old one will work as you want but you 
> need to change your kernel config. Unselect packet action and you should 
> be able to choose a different policer.

This indeed did the trick! Thanks!

Stupid that tc & kernel allow all of this, don't give any sort of error
but simply refuse to work.

[-- Attachment #1.2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 2771 bytes --]

[-- Attachment #2: Type: text/plain, Size: 143 bytes --]

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] Trying to do some very simple ingress limiting, no success

[Erik Slagter]

[-- Attachment #1.1: Type: text/plain, Size: 660 bytes --]

On Sun, 2006-04-09 at 14:42 +0100, Andy Furniss wrote:

> > The "old" policer is marked as "obsolete", so I guess it will go away. 
> > What am I supposed to replace it with, then?
> 
> There may be a way in the future to get netfilter state with an 
> ematch/meta data (I don't know the detail Thomas Graf has mentioned it).

Is there already a tc man page that reveals all of this :-(

> > For IMQ I need to patch the kernel (feasible) and the netfilter tools
> > (not feasible :-() I just learned.
> 
> I didn't know there is a problrm with IMQ + netfilter.

You just told me ;-)

The IMQ handling is done before the netfilter handling...

[-- Attachment #1.2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 2771 bytes --]

[-- Attachment #2: Type: text/plain, Size: 143 bytes --]

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc