There’s definitely an issue using the map with ip6. I just don’t know if it’s due to the rules I’m using or a flaw in nftables. I even split the map into 2 different ones for ip dscp and ip6 dscp in case it made a difference (it didn’t). I can see the correct TC (ipv6 dscp) value when logging the packets, so that rule works fine, but looking up the ip6 dscp in the map always puts zero in the ct mark and then that gets shifted and OR’d to 33554432 (which is expected if the original mark was still zero).
If anyone else can reproduce this behavior that would be appreciated. Or maybe @dlakelan can test this on his Debian install to see if it’s specific to our version of nftables.
table inet cttags {
map dscpct4 {
typeof ip dscp : ct mark
elements = {
cs0 : 0x00,
cs1 : 0x08,
cs2 : 0x10,
cs3 : 0x18,
cs4 : 0x20,
cs5 : 0x28,
cs6 : 0x30,
cs7 : 0x38,
be : 0x00,
af11 : 0x0a,
af12 : 0x0c,
af13 : 0x0e,
af21 : 0x12,
af22 : 0x14,
af23 : 0x16,
af31 : 0x1a,
af32 : 0x1c,
af33 : 0x1e,
af41 : 0x22,
af42 : 0x24,
af43 : 0x26,
ef : 0x2e
}
}
map dscpct6 {
typeof ip6 dscp : ct mark
elements = {
cs0 : 0x00,
cs1 : 0x08,
cs2 : 0x10,
cs3 : 0x18,
cs4 : 0x20,
cs5 : 0x28,
cs6 : 0x30,
cs7 : 0x38,
be : 0x00,
af11 : 0x0a,
af12 : 0x0c,
af13 : 0x0e,
af21 : 0x12,
af22 : 0x14,
af23 : 0x16,
af31 : 0x1a,
af32 : 0x1c,
af33 : 0x1e,
af41 : 0x22,
af42 : 0x24,
af43 : 0x26,
ef : 0x2e
}
}
set bulk4 {
type ipv4_addr
counter
comment "Bulk IPv4"
}
set bulk6 {
type ipv6_addr
counter
comment "Bulk IPv6"
}
set besteffort4 {
type ipv4_addr
counter
comment "BE IPv4"
}
set besteffort6 {
type ipv6_addr
counter
comment "BE IPv6"
}
set video4 {
type ipv4_addr
counter
comment "Video IPv4"
}
set video6 {
type ipv6_addr
counter
comment "Video IPv6"
}
set voice4 {
type ipv4_addr
counter
comment "Voice IPv4"
}
set voice6 {
type ipv6_addr
counter
comment "Voice IPv6"
}
define facetime_ports = { 3478-3497, 16384-16387, 16393-16402 }
define zoom_ports = { 8801-8810 }
chain in_dscp {
type filter hook postrouting priority 0; policy accept;
oifname $wan ct mark and 0x1c00000 == 0 jump qos_sqm
}
chain qos_sqm {
ct mark and 0x2000000 == 0 counter goto cttags
}
chain qos_sqm_remap {
# Add rules to modify non-zero DSCP incoming from LAN
# Convert the current DSCP value to an equivalent conntrack mark using the map
# Then save it in the high bits of the mark for restoration with act_ctinfo
ct mark set ip dscp map @dscpct4 counter
ct mark set ip6 dscp map @dscpct6 counter
ct mark set ct mark lshift 26 or 0x3000000
}
chain cttags {
# meta nftrace set 1
ip dscp != 0 counter goto qos_sqm_remap
ip6 dscp != 0 counter goto qos_sqm_remap
# match sets (populated externally by dnsmasq, et al)
ip daddr @bulk4 ip dscp set cs1 comment "bulk4 to CS1"
ip6 daddr @bulk6 ip6 dscp set cs1 comment "bulk6 to CS1"
#ip daddr @besteffort4 ct mark set 0x1000000 comment "besteffort4 to CS0"
#ip6 daddr @besteffort6 ct mark set 0x1000000 comment "besteffort6 to CS0"
ip daddr @video4 ip dscp set af41 comment "video4 to AF41"
ip6 daddr @video6 ip6 dscp set af41 comment "video6 to AF41"
ip daddr @voice4 ip dscp set cs6 comment "voice4 to CS6"
ip6 daddr @voice6 ip6 dscp set cs6 comment "voice6 to CS6"
# individual IP or port rules
ip daddr 17.0.0.0/8 tcp dport { 993, 5223 } ip dscp set cs0 counter comment "Apple Mail and APNS CS0"
udp sport $facetime_ports udp dport $facetime_ports ip dscp set af41 counter comment "Facetime AF41"
udp sport $facetime_ports udp dport $facetime_ports ip6 dscp set af41 counter comment "Facetime AF41"
udp dport $zoom_ports ip dscp set cs3 counter comment "Zoom CS3"
udp dport $zoom_ports ip6 dscp set cs3 counter comment "Zoom CS3"
udp sport 4500 udp dport 4500 ip dscp set cs6 counter comment "WiFi Calling CS6"
udp sport 4500 udp dport 4500 ip6 dscp set cs6 counter comment "WiFi Calling CS6"
tcp dport { 6020-6030 } ip dscp set cs1 counter comment "Comcast Speedtest CS1"
tcp dport { 6020-6030 } ip6 dscp set cs1 comment "Comcast Speedtest CS1"
# Convert the current DSCP value to an equivalent conntrack mark using the map
# Then save it in the high bits of the mark for restoration with act_ctinfo
ct mark set ip dscp map @dscpct4 counter
ct mark set ip6 dscp map @dscpct6 counter
ct mark set ct mark lshift 26 or 0x2000000
}
}
