TC-CTINFO(8)

Hiii bestie 🎀 this is the ctinfo action in tc(8) page, and it's giving connmark processing realness 💅✨

✨ NAME ✨

ctinfo, the tc connmark processing action 🦋

✨ SYNOPSIS ✨

tc ... action ctinfo [ dscp MASK [STATEMASK] ] [ cpmark [MASK] ] [ zone
ZONE ] [ CONTROL ] [ index <INDEX> ]

✨ DESCRIPTION ✨

okay so CTINFO (Conntrack Information) is a tc action that grabs data out of conntrack marks and drops it into different fields 🧚 right now it has two independent processing modes, basically two little sub-functions that do their own thing 💖

DSCP mode copies a DSCP stored in conntrack's connmark into the IPv4/v6 diffserv field 🌸 the copy can happen conditionally, based on a flag that's also stored in the connmark 👀 DSCP mode was built to help restore packet classifications on ingress, and those classifications can then be used by qdiscs like CAKE 💅 it's super useful any time ingress classification needs to survive across links that would otherwise bleach or remap stuff using their own policies 🫶

CPMARK (copymark) mode copies the conntrack connmark into the packet's mark field ✨ without any extra parameters it's functionally completely equivalent to the existing connmark action, so no cap it's the same energy 💜 you can add an optional mask to choose which bits of the connmark get restored 🎯 this can be really handy when DSCP and CPMARK modes are combined 🔥

Simple statistics are kept for tc -s on DSCP restores and CPMARK copies 📊 the values shown for set are a count of packets altered by that mode 😭 DSCP also has an error count for when the destination packet's diffserv field was unwriteable 💀

✨ PARAMETERS ✨

DSCP mode parameters 🌈

• mask — a mask of 6 contiguous bits showing where the DSCP value lives in the 32 bit conntrack mark field 🎀 a mask must be provided for this mode 🚨 mask is a 32 bit unsigned value
• statemask — a mask of at least 1 bit showing where the conditional restore flag lives in the 32 bit conntrack mark field 🦋 the statemask bit/s must NOT overlap the mask bits, bestie 🙅‍♀️ the DSCP gets restored if the conntrack mark logically ANDed with the statemask gives a non-zero result 🍓 statemask is an optional unsigned 32 bit value

CPMARK mode parameters 🍓

• mask — stores the logically ANDed result of the conntrack mark and mask into the packet's mark field ✨ the default is 0xffffffff, i.e. the whole mark field 💖 mask is an optional unsigned 32 bit value

Overall action parameters 👑

• zone — picks the conntrack zone used when doing conntrack lookups for packets 🌸 zone is a 16bit unsigned decimal value, and the default is 0 💅
• CONTROL — these keywords control how the tree of qdisc, classes, filters and actions gets traversed after this action 🧚 the options are:
  • reclassify — restarts with the first filter in the current list 🔁
  • pipe — continues with the next action attached to the same filter 🫶
  • drop — drops the packet 💀
  • shot — synonym for drop 🙈
  • continue — continues classification with the next filter in line ⭐
  • pass — finishes the classification process and returns to the calling qdisc for further packet processing 🌈 this is the default, bestie ✨
• index — gives this action an index so you can identify it in later commands 🔖 index is a 32bit unsigned decimal value

✨ EXAMPLES ✨

Example showing conditional restoration of DSCP on ingress via an IFB 🦋

#Set up the IFB interface
tc qdisc add dev ifb4eth0 handle ffff: ingress

#Put CAKE qdisc on it
tc qdisc add dev ifb4eth0 root cake bandwidth 40mbit

#Set interface UP
ip link set dev ifb4eth0 up

#Add 2 actions, ctinfo to restore dscp & mirred to redirect the packets to IFB
tc filter add dev eth0 parent ffff: protocol all prio 10 u32 \
    match u32 0 0 flowid 1:1 action    \
    ctinfo dscp 0xfc000000 0x01000000  \
    mirred egress redirect dev ifb4eth0

tc -s qdisc show dev eth0 ingress

 filter parent ffff: protocol all pref 10 u32 chain 0
 filter parent ffff: protocol all pref 10 u32 chain 0 fh 800: ht divisor 1
 filter parent ffff: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:1 not_in_hw
  match 00000000/00000000 at 0
    action order 1: ctinfo zone 0 pipe
    index 2 ref 1 bind 1 dscp 0xfc000000 0x01000000 installed 72 sec used 0 sec DSCP set 1333 error 0 CPMARK set 0
    Action statistics:
    Sent 658484 bytes 1833 pkt (dropped 0, overlimits 0 requeues 0)
    backlog 0b 0p requeues 0

    action order 2: mirred (Egress Redirect to device ifb4eth0) stolen
    index 1 ref 1 bind 1 installed 72 sec used 0 sec
    Action statistics:
    Sent 658484 bytes 1833 pkt (dropped 0, overlimits 0 requeues 0)
    backlog 0b 0p requeues 0

Example showing conditional restoration of DSCP on egress 🌷

This may look a little nonsensical, since marking egress packets with iptables is easy to do 🙃 however iptables flow classification rules can get extensive, so some sort of set once and forget it can be useful, especially on CPU constrained devices 🫠

# Send unmarked connections to a marking chain which needs to store a DSCP
and set statemask bit in the connmark
iptables -t mangle -A POSTROUTING -o eth0 -m connmark \
    --mark 0x00000000/0x01000000 -g CLASS_MARKING_CHAIN

# Apply marked DSCP to the packets
tc filter add dev eth0 protocol all prio 10 u32 \
    match u32 0 0 flowid 1:1 action \
    ctinfo dscp 0xfc000000 0x01000000

tc -s filter show dev eth0
 filter parent 800e: protocol all pref 10 u32 chain 0
 filter parent 800e: protocol all pref 10 u32 chain 0 fh 800: ht divisor 1
 filter parent 800e: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:1 not_in_hw
  match 00000000/00000000 at 0
    action order 1: ctinfo zone 0 pipe
    index 1 ref 1 bind 1 dscp 0xfc000000 0x01000000 installed 7414 sec used 0 sec DSCP set 53404 error 0 CPMARK set 0
    Action statistics:
    Sent 32890260 bytes 120441 pkt (dropped 0, overlimits 0 requeues 0)
    backlog 0b 0p requeues 0

✨ SEE ALSO ✨

tc(8), tc-cake(8), tc-connmark(8), tc-mirred(8) 💜

✨ AUTHORS ✨

ctinfo was written by Kevin Darbyshire-Bryant 👑

Bestie, that's the whole tea ☕🌸 this page is from iproute2, last updated 4 Jun 2019, so go slay your ingress classification 💖🧚✨