LARTC - Feb 2011 - Re: iproute 2010-2011 - tree problem (udp, quid, action police + action mirred)

On Tue, 22 Feb 2011 11:15:39 +0100
"PIOTREK H." <komarekmz@tlen.pl> wrote:
> Welcome
> 
> I have a problem with the new iproute "iproute2-2.6.37.tar.bz2
07-Jan-2011 9:18 (the problem from version 2010 to 2011).
> Three problems:
> a) with filters for UDP traffic
> problem affects only the queuing traffic to the machine on which you work
qos
> In the case of UDP traffic filter does not detect movement.
> The filter works for udp traffic through the router.
> Example:
> qos router has the IP 20.0.0.1
> $ TC filter add dev $ dev parent 1:0 protocol ip prio 5 u32 \
> match ip protocol 0x11 0xff \
> match u32 0 0 flowid 1: A4f
> or
> $ TC filter add dev $ dev parent 1:0 protocol ip prio 5 u32 \
> match ip sport 67 0xffff \
> match u32 0 0 flowid 1: a1 \
> action mirred egress redirect dev ifb4
>
> $ TC filter add dev $ dev parent 1:0 protocol ip prio 5 u32 \
> match ip dport 68 0xffff \
> match u32 0 0 flowid 1: a1 \
> action mirred egress redirect dev ifb4
> 
> or
> $ TC filter add dev $ dev parent 1:0 protocol ip prio 5 u32 \
> match ip protocol 0x11 0xff \
> match ip src 20.0.0.1/32 flowid 1: A4f
> 
>  These filters do not work for traffic to or from the router.
> In the old versions of these filters work iproute
> 
> 
> b) squid (only egrees)
> In the case of traffic from squid filter captures traffic diversion, but
the interface is killed ifb movement (2-6kbit)
> 
> Traffic is routed to squid with iptables. After downloading the redirect to
squid qos works well.
> I noticed that this problem occurs on the cards gigabyte (for Intel 100Pro
is ok)
> 
> c) the police action + action mirror
> This problem was resolved for the 2010 version of the patch.
> 
> action police rate 1024 kbit burst conform-exceed 90kB drop / pipe \
> action mirred egress redirect dev $ qdev2
> 
> such action is working ok in iproute iproute2-ss100224 with the patch. Does
not work in the new iproute (without the patch, the patch does not have).
> How should this action? I need to trim one filter and redirect traffic to
the interface.
> At the ingress use police action + action mirred, I use the egress flowid +
action mirred
> 
> My router:
> tc utility, iproute2-ss110107
> Linux shaper 2.6.26-2
> problem on several routers (in different versions kernel and iproute)
> 
> Work ok:
> tc -V
> tc utility, iproute2-ss070710
> Linux traktor 2.6.23.17-imq #1 SMP Fri Oct 10 00:12:20 CEST 2008 i686
GNU/Linux
> 
> Linux rtr-58.core 2.6.17.13 #1 Mon Mar 10 09:48:28 CET 2008 i686 GNU/Linux
> tc utility, iproute2-ss061214
> 
> with the new iproute have a problem. 
> I will be grateful for any hint or help.
> Thank you for your time.
> 
> If the message sent in breach of procedures sorry.
> 
> 
> Piotr Homa (Poland) 
Could you post these to netdev@vger.kernel.org
--