Provided by: iproute2_6.1.0-1ubuntu2_amd64 bug

NAME

       ctinfo - tc connmark processing action

SYNOPSIS

       tc ... action ctinfo [ dscp MASK [STATEMASK] ] [ cpmark [MASK] ] [ zone ZONE ] [ CONTROL ]
       [ index <INDEX> ]

DESCRIPTION

       CTINFO (Conntrack Information) is a tc action for retrieving  data  from  conntrack  marks
       into  various  fields.   At  present  it has two independent processing modes which may be
       viewed as sub-functions.

       DSCP mode copies a DSCP stored in conntrack's connmark into the  IPv4/v6  diffserv  field.
       The  copying  may  conditionally  occur based on a flag also stored in the connmark.  DSCP
       mode  was  designed  to  assist  in   restoring   packet   classifications   on   ingress,
       classifications  which  may  then  be  used by qdiscs such as CAKE.  It may be used in any
       circumstance where ingress  classification  needs  to  be  maintained  across  links  that
       otherwise bleach or remap according to their own policies.

       CPMARK  (copymark)  mode  copies  the  conntrack  connmark  into  the packet's mark field.
       Without additional parameters it is functionally completely  equivalent  to  the  existing
       connmark action.  An optional mask may be specified to mask which bits of the connmark are
       restored.  This may be useful when DSCP and CPMARK modes are combined.

       Simple statistics (tc -s) on DSCP restores and CPMARK copies are maintained  where  values
       for  set  indicate a count of packets altered for that mode.  DSCP includes an error count
       where the destination packet's diffserv field was unwriteable.

PARAMETERS

   DSCP mode parameters:
       mask   A mask of 6 contiguous bits indicating where the DSCP value is located  in  the  32
              bit conntrack mark field.  A mask must be provided for this mode.  mask is a 32 bit
              unsigned value.

       statemask
              A mask of at least 1 bit indicating where a conditional restore flag is located  in
              the  32  bit  conntrack  mark field.  The statemask bit/s must NOT overlap the mask
              bits.  The DSCP will be restored if the conntrack mark  logically  ANDed  with  the
              statemask  yields  a  non-zero  result.   statemask  is an optional unsigned 32 bit
              value.

   CPMARK mode parameters:
       mask   Store the logically ANDed result of conntrack mark and mask into the packet's  mark
              field.   Default  is  0xffffffff  i.e.  the  whole mark field.  mask is an optional
              unsigned 32 bit value

   Overall action parameters:
       zone   Specify the conntrack zone when doing conntrack lookups for  packets.   zone  is  a
              16bit unsigned decimal value.  Default is 0.

       CONTROL
              The following keywords allow one to control how the tree of qdisc, classes, filters
              and actions is further traversed after this action.

              reclassify
                     Restart with the first filter in the current list.

              pipe   Continue with the next action attached to the same filter.

              drop   Drop the packet.

              shot   synonym for drop

              continue
                     Continue classification with the next filter in line.

              pass   Finish classification process and return to calling qdisc for further packet
                     processing. This is the default.

       index  Specify  an  index  for  this action in order to being able to identify it in later
              commands. index is a 32bit unsigned decimal value.

EXAMPLES

       Example showing conditional restoration of DSCP on ingress via an IFB

              #Set up the IFB interface
              tc qdisc add dev ifb4eth0 handle ffff: ingress

              #Put CAKE qdisc on it
              tc qdisc add dev ifb4eth0 root cake bandwidth 40mbit

              #Set interface UP
              ip link set dev ifb4eth0 up

              #Add 2 actions, ctinfo to restore dscp & mirred to redirect the packets to IFB
              tc filter add dev eth0 parent ffff: protocol all prio 10 u32 \
                  match u32 0 0 flowid 1:1 action    \
                  ctinfo dscp 0xfc000000 0x01000000  \
                  mirred egress redirect dev ifb4eth0

              tc -s qdisc show dev eth0 ingress

               filter parent ffff: protocol all pref 10 u32 chain 0
               filter parent ffff: protocol all pref 10 u32 chain 0 fh 800: ht divisor 1
               filter parent ffff: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:1 not_in_hw
                match 00000000/00000000 at 0
                  action order 1: ctinfo zone 0 pipe
                  index 2 ref 1 bind 1 dscp 0xfc000000 0x01000000 installed 72 sec used 0 sec DSCP set 1333 error 0 CPMARK set 0
                  Action statistics:
                  Sent 658484 bytes 1833 pkt (dropped 0, overlimits 0 requeues 0)
                  backlog 0b 0p requeues 0

                  action order 2: mirred (Egress Redirect to device ifb4eth0) stolen
                  index 1 ref 1 bind 1 installed 72 sec used 0 sec
                  Action statistics:
                  Sent 658484 bytes 1833 pkt (dropped 0, overlimits 0 requeues 0)
                  backlog 0b 0p requeues 0

       Example showing conditional restoration of DSCP on egress

       This may appear nonsensical since iptables marking of egress packets is easy  to  achieve,
       however  the  iptables  flow classification rules may be extensive and so some sort of set
       once and forget may be useful especially on cpu constrained devices.

              # Send unmarked connections to a marking chain which needs to store a DSCP
              and set statemask bit in the connmark
              iptables -t mangle -A POSTROUTING -o eth0 -m connmark \
                  --mark 0x00000000/0x01000000 -g CLASS_MARKING_CHAIN

              # Apply marked DSCP to the packets
              tc filter add dev eth0 protocol all prio 10 u32 \
                  match u32 0 0 flowid 1:1 action \
                  ctinfo dscp 0xfc000000 0x01000000

              tc -s filter show dev eth0
               filter parent 800e: protocol all pref 10 u32 chain 0
               filter parent 800e: protocol all pref 10 u32 chain 0 fh 800: ht divisor 1
               filter parent 800e: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:1 not_in_hw
                match 00000000/00000000 at 0
                  action order 1: ctinfo zone 0 pipe
                  index 1 ref 1 bind 1 dscp 0xfc000000 0x01000000 installed 7414 sec used 0 sec DSCP set 53404 error 0 CPMARK set 0
                  Action statistics:
                  Sent 32890260 bytes 120441 pkt (dropped 0, overlimits 0 requeues 0)
                  backlog 0b 0p requeues 0

SEE ALSO

       tc(8), tc-cake(8) tc-connmark(8) tc-mirred(8)

AUTHORS

       ctinfo was written by Kevin Darbyshire-Bryant.