CAKE w/ DSCPs - cake-qos-simple

Lynx · June 11, 2024, 7:16pm

@dave14305 I believe nftables now has both an ingress hook and an egress hook. And it also supports 'fwd to' to mirror packets to an IFB interface (see e.g. my post here).

At the moment I set DSCPs to conntrack using nftables:

github.com

lynxthecat/cake-qos-simple/blob/3e22ba6f8c7fd2da94f66bef37af3438f0b37116/cake-qos-simple#L212


      
          	                ip6 dscp set cs2
          	        }
          	
          	        # designate packet for cake tin: voice
          	        chain dscp_set_voice {
          	                ip dscp set cs4
          	                ip6 dscp set cs4
          	        }
          	
          	        chain store-dscp-in-conntrack {
          	                ct mark set ip dscp or 128
          	                ct mark set ip6 dscp or 128
          	                # For older versions of nftables (OpenWrt versions prior to 23.05), replace the two lines above with:
          	                # meta nfproto ipv4 ct mark set (@nh,8,8 & 252) >> 2
          	                # meta nfproto ipv6 ct mark set (@nh,0,16 & 4032) >> 6
          			# ct mark set ct mark or 128
          	        }
          	}
          	EOT
          
          	if [[ -f "${PREFIX}/nft.rules" ]]

and use tc's ctinfo to restore DSCPs from conntrack:

github.com

lynxthecat/cake-qos-simple/blob/3e22ba6f8c7fd2da94f66bef37af3438f0b37116/cake-qos-simple#L258


      
          	then
          
          		printf "\nNo dl_if specified, so setting up appropriate IFB.\n"
          		dl_if="ifb-${ul_if}"
          		printf "\nCreating IFB device: '${dl_if}'.\n"
          		ip link add name ${dl_if} type ifb
          		printf "\nSetting interface: '${dl_if}' up.\n"
          		ip link set "${dl_if}" up
          		# For each upload interface ingress packet conditionally restore DSCP from conntrack if available and redirect to IFB
          		printf "\nSetting up tc filter to restore DSCPs from conntrack on ingress packets on interface: '${ul_if}' and redirecting to IFB interface: '${dl_if}'.\n"
          		tc filter add dev "${ul_if}" parent ffff: protocol all matchall action ctinfo dscp 63 128 mirred egress redirect dev "${dl_if}"
          
          	# if $dl_if specified, then skip IFB creation
          	else
          		# for each upload interface ingress packet conditionally restore DSCP from conntrack if available
          		printf "\nSetting up tc filter to restore DSCPs from conntrack on ingress packets on interface '${ul_if}'.\n"
          		tc filter add dev "${ul_if}" parent ffff: protocol all matchall action ctinfo dscp 63 128
          	fi
          
          	printf "\nSetting up CAKE on interface: '${ul_if}' with bandwidth: '${cake_ul_rate_Mbps}Mbit/s' and options: '${cake_ul_options}'.\n"
          	tc qdisc add dev "${ul_if}" root handle 1: cake bandwidth "${cake_ul_rate_Mbps}Mbit" ${cake_ul_options}

Has an equivalent ctinfo functionaltiy for restoration of DSCPs from conntrack now been added to nftables such that I could actually now replace the tc calls with the equivalent nftables calls? That is, have nftables restore DSCPs from conntrack and then mirror the packets to an IFB interface (rather than use tc for this).