tc ingress filters not applied

tc ingress filters not applied

[Erik Hugne]

I'm having troubles with TC policing, the ingress filters does not seem to be
applied.

node1 ~ # tc qdisc add dev eth0 ingress
node1 ~ # tc qdisc ls
qdisc pfifo_fast 0: dev eth0 root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc ingress ffff: dev eth0 parent ffff:fff1 ---------------- 
//Test 1: Limit TIPC low importance traffic to 100mbit
node1 ~ # tc filter add dev eth0 parent ffff: protocol tipc u32 match u8 0 1E at
 0 police rate 100mbit buffer 10k drop flowid :1
node1 ~ # tc filter show dev eth0
node1 ~ # 

//Test 2: Limit ICMP to 20kbit
node1 ~ # tc filter add dev eth0 parent ffff: protocol ip prio 20 u32 match ip p
rotocol 1 0xff police rate 20kbit buffer 10k drop flowid :2
node1 ~ # tc filter show dev eth0
node1 ~ # 

There are no errors in dmesg, just silence.
Are my filter rules wrong, or is ingress filtering broken?

Kernel: net-next/latest 
iproute2: shemminger/master

//E

Re: tc ingress filters not applied

[Cong Wang]

On Mon, Mar 30, 2015 at 7:15 AM, Erik Hugne <erik.hugne@ericsson.com> wrote:
> I'm having troubles with TC policing, the ingress filters does not seem to be
> applied.
>
> node1 ~ # tc qdisc add dev eth0 ingress
> node1 ~ # tc qdisc ls
> qdisc pfifo_fast 0: dev eth0 root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
> qdisc ingress ffff: dev eth0 parent ffff:fff1 ----------------
> //Test 1: Limit TIPC low importance traffic to 100mbit
> node1 ~ # tc filter add dev eth0 parent ffff: protocol tipc u32 match u8 0 1E at
>  0 police rate 100mbit buffer 10k drop flowid :1
> node1 ~ # tc filter show dev eth0
> node1 ~ #
>
> //Test 2: Limit ICMP to 20kbit
> node1 ~ # tc filter add dev eth0 parent ffff: protocol ip prio 20 u32 match ip p
> rotocol 1 0xff police rate 20kbit buffer 10k drop flowid :2
> node1 ~ # tc filter show dev eth0


tc filter show dev eth0 parent ffff:

Re: tc ingress filters not applied

[Erik Hugne]

On Mon, Mar 30, 2015 at 10:00:58AM -0700, Cong Wang wrote:
> tc filter show dev eth0 parent ffff:

Of course, thanks Cong.

//E

Re: tc ingress filters not applied

[Huan Le]

Erik Hugne <erik.hugne <at> ericsson.com> writes:

> 
> I'm having troubles with TC policing, the ingress filters does not seem to be
> applied.
> 
> 
> Kernel: net-next/latest 
> iproute2: shemminger/master
> 
> //E
> 

I observed similar behavior when configuring a filter on ingress qdisc.
Test shows that traffic was rate-limited to the configured value. 
However, "tc filter show" does not show any filtering rule.

(1) add ingress qdisc on eth1
# tc qdisc add dev eth1 ingress
# tc qdisc show dev eth1 ingress
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap \
 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc ingress ffff: parent ffff:fff1 ---------------- 

(2) add filter under ingress qdisc
# tc filter add dev eth1 parent ffff: protocol all \
 u32 match ip src 0.0.0.0/0 \
 police rate 256kbit burst 10k drop flowid :1
# tc filter show dev eth1

(3) verified sch_ingress kernel module is installed
# lsmod  | grep sch_ingress
sch_ingress            12866  1

(4) uname -a (if needed for debugging)
Linux huan-lnx 3.16.0-30-generic #40~14.04.1-Ubuntu SMP 
Thu Jan 15 17:43:14 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

I am testing this using ubuntu 14.04 on a virtualbox VM
(eth1 is a host-only adapter).

Thanks,
Huan

Re: tc ingress filters not applied

[Daniel Borkmann]

On 07/06/2015 07:24 PM, Huan Le wrote:
> Erik Hugne <erik.hugne <at> ericsson.com> writes:
>
>>
>> I'm having troubles with TC policing, the ingress filters does not seem to be
>> applied.
>>
>>
>> Kernel: net-next/latest
>> iproute2: shemminger/master
>>
>> //E
>>
>
> I observed similar behavior when configuring a filter on ingress qdisc.
> Test shows that traffic was rate-limited to the configured value.
> However, "tc filter show" does not show any filtering rule.
>
> (1) add ingress qdisc on eth1
> # tc qdisc add dev eth1 ingress
> # tc qdisc show dev eth1 ingress
> qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap \
>   1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
> qdisc ingress ffff: parent ffff:fff1 ----------------
>
> (2) add filter under ingress qdisc
> # tc filter add dev eth1 parent ffff: protocol all \
>   u32 match ip src 0.0.0.0/0 \
>   police rate 256kbit burst 10k drop flowid :1
> # tc filter show dev eth1

You have to add the handle/parent here, otherwise this shows egress filters.

> (3) verified sch_ingress kernel module is installed
> # lsmod  | grep sch_ingress
> sch_ingress            12866  1
>
> (4) uname -a (if needed for debugging)
> Linux huan-lnx 3.16.0-30-generic #40~14.04.1-Ubuntu SMP
> Thu Jan 15 17:43:14 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
>
> I am testing this using ubuntu 14.04 on a virtualbox VM
> (eth1 is a host-only adapter).
>
> Thanks,
> Huan
>
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>