CAKE w/ DSCPs - cake-qos-simple

[Lynx]

@fta many thanks for this. Are you sure about the goto's though? Because classify-dscp is itself within the context of a jump:

	chain classify-and-store-dscp {

		jump classify-dscp
		jump store-dscp-in-conntrack
	}

jump classify-dscp will return and process store-dscp-in-conntrack, right? The goto within classify-dscp doesn't prevent the jump classify-dscp from returning and processing store-dscp-in-conntrack?

After all, I'm seeing correct restorations on e.g. DNS over TLS on ingress:

19:03:25.639634 IP (tos 0x80, ttl 54, id 55644, offset 0, flags [DF], proto TCP (6), length 1360)
    1.0.0.3.853 > 192.168.0.2.56038: Flags [P.], cksum 0xc6ef (incorrect -> 0xbdaa), seq 1309:2617, ack 292, win 8, opti

---

@fta

Adding on to this, the ct mark bit is unnecessary. You could do this instead:

oifname wan ct state new,untracked goto classify-and-store-dscp

This eliminates the ct mark set ct mark or 128 rule making it slightly more efficient. Note that the ct mark bit needs to be removed from the tc action as well, like this:

action ctinfo dscp 63 128

becomes

action ctinfo dscp 63

I'd argue this is also better because it's explicitly stated in the rule that you're only classifying when you see a new connection.

This seems super cool and only classifying and setting once, per new connection seems a great idea. @fta, @moeller0 or @dave14305 if I'm honest I forget why the conditional check was even there in the first place. Can either of you remind me?

This post from @ldir is relevant:

NFtables and QoS in 2021

Copying the current set DSCP in a packet to the conntrack mark using nftables isn't that horrendous (with the caveat that I've not actually tried this recently) eg: to copy the set dscp as a 'raw' number into connmark mark meta nfproto ipv4 ct mark set (@nh,8,8 & 252) >> 2 meta nfproto ipv6 ct mark set (@nh,0,16 & 4032) >> 6 Assuming you're doing this for act_ctinfo's benefit then you'll also need to set another bit used as a flag to tell act_ctinfo that a dscp has been stored, even if…

But now that I think about it, why was the conditional restore necessary? Why not just always restore?

  statemask
          A mask of at least 1 bit indicating where a conditional
          restore flag is located in the 32 bit conntrack mark
          field.  The statemask bit/s must NOT overlap the mask
          bits.  The DSCP will be restored if the conntrack mark
          logically ANDed with the statemask yields a non-zero
          result.  statemask is an optional unsigned 32 bit value.

https://man7.org/linux/man-pages/man8/tc-ctinfo.8.html