From patchwork Tue May 1 18:32:41 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dave Taht X-Patchwork-Id: 907162 X-Patchwork-Delegate: dsahern@gmail.com Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="LQpBBmGs"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40b94z6xNGz9s1d for ; Wed, 2 May 2018 04:32:51 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756432AbeEAScu (ORCPT ); Tue, 1 May 2018 14:32:50 -0400 Received: from mail-pg0-f41.google.com ([74.125.83.41]:46384 "EHLO mail-pg0-f41.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756249AbeEAScs (ORCPT ); Tue, 1 May 2018 14:32:48 -0400 Received: by mail-pg0-f41.google.com with SMTP id z4-v6so8809164pgu.13 for ; Tue, 01 May 2018 11:32:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=6s986yypjTWhJ7luM6Yd2yvhXezzJk26mUQ+j1MT8+c=; b=LQpBBmGs51EgkAyOedZky3dyIZWvUSsAuMlzTR+fry11GNgjVvBJTGAJ4xxjQIudoE EZP7uYAaPKCXiVK8QIhq6JXjWw4ddFX0DI3y7XpzgrIldadH2doRF/LNbx8XLgpJMDyH JoEC5SP+Gn18sT2B4PWhR4jmO7FkHuKNb0JL5MFzl5JDtOd6QVSx+voxvVmz3a7a9sNp dKwQJ7JM08mgi/ddnqXaSpO+yH/agvDTlNGL0KB+vsdBH9nPya6hZXPSTSzbxWcbWpos XvGm9PxDtnyt1scLfddONzxmVy7DPlkuYxW7zNXDzIcQ0gxS30Yd4ibuernqUP3BqGAh Sm5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=6s986yypjTWhJ7luM6Yd2yvhXezzJk26mUQ+j1MT8+c=; b=r6PCNzhqt9LctxwpUoZKH1UmTgqg523m2G78bHQvGiqusGqrmEv4Y53s8rWAJkPaEd wG7NOHbWPiL4bSQqMEA1sNkjoCWB9hPWgKVWuQrJXcKt7vdDTQYXM4G+8zbBN68eMuGS 3BoH+2I21mVSDQoq7HFLEaSaWT1Uyh7YFjJRhATv/11J6lLhUnDwxsK0W9/k6p6JNdqt kAWxSyJvvFlUre4MXwL7Sw8nBvTqpmD5j83eJk+sjkkNfYACc+GQZ9Y/XY4xTLwXuTVc M44v4Yj4gghdTIQMmc1TTNm05xe9abnDvIk4V0w5Hj/8Iyq2NuLVSCVqoFaX4F9Hnqt3 /rqg== X-Gm-Message-State: ALQs6tCTOjMwBVsAYIu9RQOdJGaplm2j1d2aM74+hAd/iDCOc9AlrYf5 8S3xAtLB9p0pgsEgiGlMOYaChg== X-Google-Smtp-Source: AB8JxZrO1reH5BzqEuGbdcQ7nHHw/9Q0gWroOMtXF21G+vIaiOWCbbrnaOeeCaVJVvp1i0idTrW4iA== X-Received: by 2002:a63:894a:: with SMTP id v71-v6mr14170569pgd.423.1525199567449; Tue, 01 May 2018 11:32:47 -0700 (PDT) Received: from nemesis.lab.teklibre.com (c-24-6-113-161.hsd1.ca.comcast.net. [24.6.113.161]) by smtp.gmail.com with ESMTPSA id u85sm20811950pfi.32.2018.05.01.11.32.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 01 May 2018 11:32:46 -0700 (PDT) From: Dave Taht To: netdev@vger.kernel.org Cc: Dave Taht Subject: [PATCH iproute2-next] Add tc-BPF example for a TCP pure ack recognizer Date: Tue, 1 May 2018 11:32:41 -0700 Message-Id: <1525199561-9302-1-git-send-email-dave.taht@gmail.com> X-Mailer: git-send-email 2.7.4 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org ack_recognize can shift pure tcp acks into another flowid. --- examples/bpf/ack_recognize.c | 98 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 98 insertions(+) create mode 100644 examples/bpf/ack_recognize.c diff --git a/examples/bpf/ack_recognize.c b/examples/bpf/ack_recognize.c new file mode 100644 index 0000000..5da620c --- /dev/null +++ b/examples/bpf/ack_recognize.c @@ -0,0 +1,98 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright 2017 Google Inc. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/* + * Author: dave.taht@gmail.com (Dave Taht) + * + * ack_recognizer: An eBPF program that correctly recognizes modern TCP ACKs, + * with tcp option fields like SACK and timestamps, and no additional data. + * + * ack_match call: Recognize "pure acks" with no data payload + * + */ + +#include "bpf_api.h" +#include "linux/if_ether.h" +#include "linux/ip.h" +#include "linux/in.h" +#include "linux/ipv6.h" +#include "linux/tcp.h" + +/* + * A pure ack contains the ip header, the tcp header + options, flags with the + * ack field set, and no additional payload. That last bit is what every prior + * ack filter gets wrong, they typically assume an obsolete 64 bytes, and don't + * calculate the options (like sack or timestamps) to subtract from the payload. + */ + +__section_cls_entry +int ack_match(struct __sk_buff *skb) +{ + void *data = (void *)(long)skb->data; + void *data_end = (void *)(long)skb->data_end; + struct ethhdr *eth = data; + struct iphdr *iph = data + sizeof(*eth); + struct tcphdr *tcp; + + if (data + sizeof(*eth) + sizeof(*iph) + sizeof(*tcp) > data_end) + return 0; + + if (eth->h_proto == htons(ETH_P_IP) && + iph->version == 4) { + if(iph->protocol == IPPROTO_TCP && + iph->ihl == 5 && + data + sizeof(*eth) + 20 + sizeof(*tcp) <= data_end) { + tcp = data + sizeof(*eth) + 20; + if (tcp->ack && + htons(iph->tot_len) == 20 + tcp->doff*4) + return -1; + } + } else if (eth->h_proto == htons(ETH_P_IPV6) && + iph->version == 6) { + struct ipv6hdr *iph6 = (struct ipv6hdr *) iph; + if(iph6->nexthdr == IPPROTO_TCP && + data + sizeof(*eth) + 40 + sizeof(*tcp) <= data_end ) { + tcp = data + sizeof(*eth) + 40; + if (tcp->ack && + tcp->doff*4 == htons(iph6->payload_len)) + return -1; + } + } + + return 0; +} + +/* Example: Move acks into a priority queue: + +IFACE=eth0 +tc qdisc del dev $IFACE root 2> /dev/null +tc qdisc add dev $IFACE root handle 1: prio bands 3 \ + priomap 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 +tc qdisc add dev $IFACE parent 1:1 handle 10:1 sfq headdrop # acks only +tc qdisc add dev $IFACE parent 1:2 handle 20:1 fq_codel # all other traffic +tc qdisc add dev $IFACE parent 1:3 handle 30:1 fq_codel # unused +tc filter add dev $IFACE parent 1: prio 1 bpf \ + object-file ack_recognize.o flowid 1:1 + +Please note that a strict priority queue is not a good idea (drr would be +better), nor is doing any level of prioritization on acks at all.... +*/ + +BPF_LICENSE("GPL");