filter on prio qdisc fails

filter on prio qdisc fails

[Anand Raj Manickam]

Hi  ,
I m attaching a the prio qdisc  and filter to veth device , but the
packet does not hit the filter , but hits the qdisc and class .

Following is my config :

tc qdisc add dev veth0 root handle 1: prio

tc qdisc add dev veth0 parent 1:2 sfq perturb 16 ( NOT sure if this is needed)

tc filter add dev veth0 parent 1: protocol ip prio 2 u32 match ip
dport 80 0xffff flowid 1:2


I m generating a packet for dport 80 ,

#tc -s -r qdisc show dev veth0
qdisc prio 1: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 648 bytes 5 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0

qdisc sfq 8002: parent 1:2 limit 127p quantum 1514b perturb 16sec
 Sent 270 bytes 5 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0

#tc -s -r class show dev veth0
class prio 1:1 parent 1:
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0
class prio 1:2 parent 1: leaf 8002:
 Sent 270 bytes 5 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0
class prio 1:3 parent 1:
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0

#tc -s -r filter show dev veth0
filter parent 1: protocol ip pref 2 u32
filter parent 1: protocol ip pref 2 u32 fh 800:[80000000]  ht divisor 1
filter parent 1: protocol ip pref 2 u32 fh 800::800[80000800]  order
2048 key ht 800 bkt 0 flowid 1:2  (rule hit 0 success 0)
  match 00000050/0000ffff at 20 (success 0 )


Is there something missing in the config which disallows the packet to
hit the Filter ? I did try this without the sfq class , but directly
attaching the filter to qdisc.

Thanks,
Anand

Re: filter on prio qdisc fails

[Nicolas Sebrecht]

The 03/07/13, Anand Raj Manickam wrote:
> Hi  ,
> I m attaching a the prio qdisc  and filter to veth device , but the
> packet does not hit the filter , but hits the qdisc and class .

<...>

> Is there something missing in the config which disallows the packet to
> hit the Filter ? I did try this without the sfq class , but directly
> attaching the filter to qdisc.

Here is a side note about queueing disciplines and traffic control in
general: when a packet is ready to be sent on the network, it doesn't
means that it has to reach all queues of the trees before beeing sent.

AFAIK, it's wrong to assume that the whole traffic control system is a
flow of queueing to pass through. The reason is that if the NIC is ready
to send the next packet, tc will try to satisfy the NIC as soon as
possible. As such, it can and will pick the next packet to send from
anywhere of the tree of the queueing disciplines.

I don't know if you have a configuration problem or if you had that in
mind while testing your configuration but I hope this might help to
understand why the filter was not reached in your tests.

Regards,

-- 
Nicolas Sebrecht

Re: filter on prio qdisc fails

[Anand Raj Manickam]

On Wed, Jul 3, 2013 at 5:52 PM, Nicolas Sebrecht <nsebrecht@piing.fr> wrote:
> The 03/07/13, Anand Raj Manickam wrote:
>> Hi  ,
>> I m attaching a the prio qdisc  and filter to veth device , but the
>> packet does not hit the filter , but hits the qdisc and class .
>
> <...>
>
>> Is there something missing in the config which disallows the packet to
>> hit the Filter ? I did try this without the sfq class , but directly
>> attaching the filter to qdisc.
>
> Here is a side note about queueing disciplines and traffic control in
> general: when a packet is ready to be sent on the network, it doesn't
> means that it has to reach all queues of the trees before beeing sent.
>
> AFAIK, it's wrong to assume that the whole traffic control system is a
> flow of queueing to pass through. The reason is that if the NIC is ready
> to send the next packet, tc will try to satisfy the NIC as soon as
> possible. As such, it can and will pick the next packet to send from
> anywhere of the tree of the queueing disciplines.
>
> I don't know if you have a configuration problem or if you had that in
> mind while testing your configuration but I hope this might help to
> understand why the filter was not reached in your tests.

The prime reason for me to add a filter there was to use the mirred action .

tc filter add dev veth0 parent 1: protocol ip prio 10 u32 match u32 0
0 flowid 1:2
action mirred egress mirror dev eth0 .

But unfortunately , it did not hit the filter , which  i simplified by
adding the above rule



> Regards,
>
> --
> Nicolas Sebrecht

Re: filter on prio qdisc fails

[Andy Furniss]

Anand Raj Manickam wrote:
> Hi  ,
> I m attaching a the prio qdisc  and filter to veth device , but the
> packet does not hit the filter , but hits the qdisc and class .
>
> Following is my config :
>
> tc qdisc add dev veth0 root handle 1: prio
>
> tc qdisc add dev veth0 parent 1:2 sfq perturb 16 ( NOT sure if this is needed)
>
> tc filter add dev veth0 parent 1: protocol ip prio 2 u32 match ip
> dport 80 0xffff flowid 1:2
>
>
> I m generating a packet for dport 80 ,
>
> #tc -s -r qdisc show dev veth0
> qdisc prio 1: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
>   Sent 648 bytes 5 pkt (dropped 0, overlimits 0 requeues 0)
>   backlog 0b 0p requeues 0
>
> qdisc sfq 8002: parent 1:2 limit 127p quantum 1514b perturb 16sec
>   Sent 270 bytes 5 pkt (dropped 0, overlimits 0 requeues 0)
>   backlog 0b 0p requeues 0
>
> #tc -s -r class show dev veth0
> class prio 1:1 parent 1:
>   Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
>   backlog 0b 0p requeues 0
> class prio 1:2 parent 1: leaf 8002:
>   Sent 270 bytes 5 pkt (dropped 0, overlimits 0 requeues 0)
>   backlog 0b 0p requeues 0
> class prio 1:3 parent 1:
>   Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
>   backlog 0b 0p requeues 0
>
> #tc -s -r filter show dev veth0
> filter parent 1: protocol ip pref 2 u32
> filter parent 1: protocol ip pref 2 u32 fh 800:[80000000]  ht divisor 1
> filter parent 1: protocol ip pref 2 u32 fh 800::800[80000800]  order
> 2048 key ht 800 bkt 0 flowid 1:2  (rule hit 0 success 0)
>    match 00000050/0000ffff at 20 (success 0 )
>
>
> Is there something missing in the config which disallows the packet to
> hit the Filter ? I did try this without the sfq class , but directly
> attaching the filter to qdisc.

I guess something strange is happening because of veth - using exactly 
your commands work for me on eth.

I suppose you could also test on a real nic just to see if that works - 
I know nothing about veths.

Re: filter on prio qdisc fails

[Anand Raj Manickam]

On Thu, Jul 4, 2013 at 4:12 AM, Andy Furniss <adf.lists@gmail.com> wrote:
> Anand Raj Manickam wrote:
>>
>> Hi  ,
>> I m attaching a the prio qdisc  and filter to veth device , but the
>> packet does not hit the filter , but hits the qdisc and class .
>>
>> Following is my config :
>>
>> tc qdisc add dev veth0 root handle 1: prio
>>
>> tc qdisc add dev veth0 parent 1:2 sfq perturb 16 ( NOT sure if this is
>> needed)
>>
>> tc filter add dev veth0 parent 1: protocol ip prio 2 u32 match ip
>> dport 80 0xffff flowid 1:2
>>
>>
>> I m generating a packet for dport 80 ,
>>
>> #tc -s -r qdisc show dev veth0
>> qdisc prio 1: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1
>> 1
>>   Sent 648 bytes 5 pkt (dropped 0, overlimits 0 requeues 0)
>>   backlog 0b 0p requeues 0
>>
>> qdisc sfq 8002: parent 1:2 limit 127p quantum 1514b perturb 16sec
>>   Sent 270 bytes 5 pkt (dropped 0, overlimits 0 requeues 0)
>>   backlog 0b 0p requeues 0
>>
>> #tc -s -r class show dev veth0
>> class prio 1:1 parent 1:
>>   Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
>>   backlog 0b 0p requeues 0
>> class prio 1:2 parent 1: leaf 8002:
>>   Sent 270 bytes 5 pkt (dropped 0, overlimits 0 requeues 0)
>>   backlog 0b 0p requeues 0
>> class prio 1:3 parent 1:
>>   Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
>>   backlog 0b 0p requeues 0
>>
>> #tc -s -r filter show dev veth0
>> filter parent 1: protocol ip pref 2 u32
>> filter parent 1: protocol ip pref 2 u32 fh 800:[80000000]  ht divisor 1
>> filter parent 1: protocol ip pref 2 u32 fh 800::800[80000800]  order
>> 2048 key ht 800 bkt 0 flowid 1:2  (rule hit 0 success 0)
>>    match 00000050/0000ffff at 20 (success 0 )
>>
>>
>> Is there something missing in the config which disallows the packet to
>> hit the Filter ? I did try this without the sfq class , but directly
>> attaching the filter to qdisc.
>
>
> I guess something strange is happening because of veth - using exactly your
> commands work for me on eth.
>
> I suppose you could also test on a real nic just to see if that works - I
> know nothing about veths.
 You are right , they work fine on physical nic .
 Any idea on how to fix this on veth or whom should i write on this ?


>
>
>