sqm: Replace iptables marking with nftables

[dhrm1k]

Replace the iptables-based marking setup with native nftables rules.

This keeps the existing tc fw filter model, but uses nftables to install packet marks.

[tohojo]

Thank you for the patch. Did you test these changes, and if so, how? On OpenWrt, I presume? :)

[dhrm1k]

Yes, on openwrt.

I tested simple.qos with start-sqm/stop-sqm on a dummy if. nft rules, egress filters and IFB redirect installed on start, and cleaned up on stop.

[yhaenggi]

this would break things for everyone who uses iptables.

[brada4]

use iif ipo iifname, tc interface is totally fixed, no need to strlen() + strcmp() for each packet.
probably pre-pend meta nfproto ipv[4|6] , not visible in read-back but entered in kernel to skip unnecessary "heavy lifting" before ipX dscp for "other" protocol....

[brada4]

skip payload expression by using conntrack meta 16-bits
meta nfproto ipv4 meta l4proto udp ct original proto-dst { 123 , 53 } ip dscp ...

[dhrm1k]

Thanks. I’ll update the fixed interface matches to use iif/oif, keep iifname only for the wildcard case, and add the explicit nfproto guards around the DSCP rules.

I’ll also the conntrack form for the udp output rule and retest it.

[brada4]

Proposed

family 1 __set%d t 0
        element 00007b00  : 0 [end]     element 00003500  : 0 [end]
inet t c
  [ meta load nfproto => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]
  [ meta load l4proto => reg 1 ]
  [ cmp eq reg 1 0x00000011 ]
  [ ct load proto_dst => reg 1 , dir original ]
  [ lookup reg 1 set __set%d ]
  [ payload load 1b @ network header + 1 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ]
  [ cmp eq reg 1 0x00000000 ]

Current

family 1 __set%d t 0
        element 00007b00  : 0 [end]     element 00003500  : 0 [end]
inet t c
  [ meta load l4proto => reg 1 ]
  [ cmp eq reg 1 0x00000011 ]
  [ payload load 2b @ transport header + 2 => reg 1 ]
  [ lookup reg 1 set __set%d ]
  [ meta load nfproto => reg 1 ] ^^^ till here unnecessary payload expression
  [ cmp eq reg 1 0x00000002 ]
  [ payload load 1b @ network header + 1 => reg 1 ]
  [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ]
  [ cmp eq reg 1 0x00000000 ]

[brada4]

Thats nft -c -d netlink -f sqm.nft ....

[dhrm1k]

Oh nice, I didn’t know about nft -c -d netlink -f. Thanks for pointing that out.

I checked the generated form and updated the output rules so meta nfproto comes before the UDP/ct match.

[dhrm1k]

this would break things for everyone who uses iptables.

@yhaenggi Fair point. I originally leaned toward adding nftables while keeping iptables as fallback.

I made this version nft-only based on the earlier discussion here: openwrt/packages#29830 (comment)

[brada4]

@yhaenggi addressing undefined ordering (set priority after default mangle hoks) nftables script can coexist with legacy tables, hope adding of nftables requirement is not a huge weight to carry.

[brada4]

@tohojo question about porting tos 4 - should it be 8 ranges or X known dscp codepoints falling in them?

[brada4]

@dhrm1k ill check back later when you get around my first sweep

[dhrm1k]

@yhaenggi addressing undefined ordering (set priority after default mangle hoks) nftables script can coexist with legacy tables, hope adding of nftables requirement is not a huge weight to carry.

wait, your comment makes me think, you are under the impression we have kept legacy iptables intact in the code. is that the case? no, i ported it entirely to nft.

[brada4]

@dhrm1k

entirely to nft

You still want to evade unpredictable ordering vs fw4 hooks, which in turn saves both iptables-legacy installations (ie mine for testing and @yhaenggi 's one)

[dhrm1k]

Got it, I misunderstood your point. You mean even with the script fully nft-based, the hook priority should be explicit so it does not race fw4 or legacy hooks.

[brada4]

Got it, I misunderstood your point. You mean even with the script fully nft-based, the hook priority should be explicit so it does not race fw4 or legacy hooks.

Yes, exactly. There is no problem under normal usage, but 2 days into uptime some hotplug event reloads one or other firewall table and packets start running into matrix unexplainably.

[brada4]

As much as fixed so far - perfect.

• delete->destoy - also prepend one to table creation, there are users who dont stay in line and break stuff
• dscp -> prio transforms , tos 4 - correct to wait until "final decision
• jump tos_mark -> goto - I think I am right ;-)

[dhrm1k]

@tohojo what’s your take?

[dhrm1k]

this is still pending.

dscp -> prio transforms , tos 4 - correct to wait until "final decision