2

My linux home router sits between my ISP (Orange) and my home network. On the WAN side, Orange provide internet in a VLAN tagged 832.

Some control messages (ARP, DHCP, ICMPv6 "router discovery" types, DHCPv6) need to be replied to Orange with: - VLAN priority = 6 - IPv4 or IPv6 DSCP = "CS6" (6 bits 0x30, or 48 in decimal notation)

First problem, for the boot sequence DHCP v4 messages, isc-dhclient needs to use a raw ethernet packet socket, which bypass the linux kernel IP stack by design. So one cannot use netfilter to assign IPv4 DSCP or Meta Class, but let's leave that aside for now.

Here's a dump of my nftables configuration, relevant to the alteration of IP DSCP and Meta Priority: me@debox:~$ sudo /usr/sbin/nft list ruleset

table inet fltr46 {
    chain assign-orange-prio {
        ip version 4 udp sport { bootps, bootpc} ip dscp set cs6 meta priority set 0:6 counter packets 0 bytes 0 comment "isc-dhclient LPF socket bypass netfilter"
        icmpv6 type { nd-neighbor-solicit, nd-router-solicit} ip6 dscp set cs6 meta priority set 0:6 counter packets 8 bytes 480
        udp sport { dhcpv6-client, dhcpv6-server} ip6 dscp set cs6 meta priority set 0:6 counter packets 4 bytes 1180
    }

    chain postrouting {
        type filter hook postrouting priority 0; policy accept;
        oifname vmap { "enp1s0.832" : goto assign-orange-prio}
    }

    chain output {
        type filter hook output priority 0; policy accept;
        oifname vmap { "enp1s0.832" : goto assign-orange-prio }
    }
}
table arp arp4 {
    chain output {
        type filter hook output priority 0; policy accept;
        oifname ! "enp1s0.832" accept
        meta priority set 0:6 counter packets 851 bytes 35742
    }
}

My vlan 832 configuration is as follows:

me@debox:~$ sudo cat /proc/net/vlan/enp1s0.832 
enp1s0.832  VID: 832     REORDER_HDR: 1  dev->priv_flags: 1001
Device: enp1s0
INGRESS priority mappings: 0:0  1:0  2:0  3:0  4:0  5:0  6:0 7:0
 EGRESS priority mappings: 6:6

Which means, for egress, class 6 packets -> VLAN prio 6.

The nftables counters for DHCPv6, ICMPv6 "router", and ARP are incremented, as expected. However, I notice problems in my wire shark capture (done by swich port mirroring):

  • DHCPv6: OK. DSCP = CS6 and VLAN prio = 6
  • ICMPv6: not OK. DSCP = CS6 but VLAN prio = 0
  • ARP: not OK. VLAN prio = 0
  • IPv4 DHCP lease renewal packets, sent through a regular UDP socket, are also OK (DSCP+VLAN prio).

VLAN priority is not applied correctly to ARP and ICMPv6 packets. Is there a way to debug further why the meta class does not translate correctly to VLAN prio, for ARP and ICMPv6 messages generated by the linux kernel?

0

The source issue was a simple sequencing problem regarding the vlan interface. My network interface persistence file was initially misconfigured:

# WAN vlan 832 internet
auto enp1s0.832
iface enp1s0.832 inet dhcp
  up ip link set enp1s0.832 type vlan egress 0:0 1:0 2:0 3:0 4:0 5:0 6:6 7:0
iface enp1s0.832 inet6 dhcp
  up ip link set enp1s0.832 type vlan egress 0:0 1:0 2:0 3:0 4:0 5:0 6:6 7:0
  request_prefix 1
  accept_ra 2

The bad part it the "up" instruction. The egress mapping is done too late, when initial ARP / DHCP / NDP has already happened. The fix is really simple, it suffices to use pre-up instead:

# WAN vlan 832 internet
auto enp1s0.832
iface enp1s0.832 inet dhcp
  pre-up ip link set enp1s0.832 type vlan egress 0:0 1:0 2:0 3:0 4:0 5:0 6:6 7:0
iface enp1s0.832 inet6 dhcp
  pre-up ip link set enp1s0.832 type vlan egress 0:0 1:0 2:0 3:0 4:0 5:0 6:6 7:0
  request_prefix 1
  accept_ra 2

With that, the initial ARP/DHCP/NDP handshake is done with right QoS priority.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.