[RESEND PATCH iproute2-next 0/2] Implement filter terse dump mode support

[RESEND PATCH iproute2-next 0/2] Implement filter terse dump mode support

[Vlad Buslov]

Implement support for terse dump mode which provides only essential
classifier/action info (handle, stats, cookie, etc.). Use new
TCA_DUMP_FLAGS_TERSE flag to prevent copying of unnecessary data from
kernel.

Vlad Buslov (2):
  tc: skip actions that don't have options attribute when printing
  tc: implement support for terse dump

 tc/m_bpf.c        |  2 +-
 tc/m_connmark.c   |  2 +-
 tc/m_csum.c       |  2 +-
 tc/m_ct.c         |  2 +-
 tc/m_ctinfo.c     |  2 +-
 tc/m_gact.c       |  2 +-
 tc/m_ife.c        |  2 +-
 tc/m_ipt.c        |  2 +-
 tc/m_mirred.c     |  2 +-
 tc/m_mpls.c       |  2 +-
 tc/m_nat.c        |  2 +-
 tc/m_pedit.c      |  2 +-
 tc/m_sample.c     |  2 +-
 tc/m_simple.c     |  2 +-
 tc/m_skbedit.c    |  2 +-
 tc/m_skbmod.c     |  2 +-
 tc/m_tunnel_key.c |  2 +-
 tc/m_vlan.c       |  2 +-
 tc/m_xt.c         |  2 +-
 tc/m_xt_old.c     |  2 +-
 tc/tc_filter.c    | 12 ++++++++++++
 21 files changed, 32 insertions(+), 20 deletions(-)

-- 
2.21.0

[RESEND PATCH iproute2-next 1/2] tc: skip actions that don't have options attribute when printing

[Vlad Buslov]

From: Vlad Buslov <vladbu@mellanox.com>

Modify implementations that return error from action_until->print_aopt()
callback to silently skip actions that don't have their corresponding
TCA_ACT_OPTIONS attribute set (some actions already behave like this). This
is necessary to support terse dump mode in following patch in the series.

Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
---
 tc/m_bpf.c        | 2 +-
 tc/m_connmark.c   | 2 +-
 tc/m_csum.c       | 2 +-
 tc/m_ct.c         | 2 +-
 tc/m_ctinfo.c     | 2 +-
 tc/m_gact.c       | 2 +-
 tc/m_ife.c        | 2 +-
 tc/m_ipt.c        | 2 +-
 tc/m_mirred.c     | 2 +-
 tc/m_mpls.c       | 2 +-
 tc/m_nat.c        | 2 +-
 tc/m_pedit.c      | 2 +-
 tc/m_sample.c     | 2 +-
 tc/m_simple.c     | 2 +-
 tc/m_skbedit.c    | 2 +-
 tc/m_skbmod.c     | 2 +-
 tc/m_tunnel_key.c | 2 +-
 tc/m_vlan.c       | 2 +-
 tc/m_xt.c         | 2 +-
 tc/m_xt_old.c     | 2 +-
 20 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/tc/m_bpf.c b/tc/m_bpf.c
index e8d704b557f9..6b231cb3d7b0 100644
--- a/tc/m_bpf.c
+++ b/tc/m_bpf.c
@@ -162,7 +162,7 @@ static int bpf_print_opt(struct action_util *au, FILE *f, struct rtattr *arg)
 	int d_ok = 0;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_ACT_BPF_MAX, arg);
 
diff --git a/tc/m_connmark.c b/tc/m_connmark.c
index 4b2dc4e25ef8..38546c75b30c 100644
--- a/tc/m_connmark.c
+++ b/tc/m_connmark.c
@@ -111,7 +111,7 @@ static int print_connmark(struct action_util *au, FILE *f, struct rtattr *arg)
 	struct tc_connmark *ci;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_CONNMARK_MAX, arg);
 	if (tb[TCA_CONNMARK_PARMS] == NULL) {
diff --git a/tc/m_csum.c b/tc/m_csum.c
index afbee9c8de0f..347e5e90e967 100644
--- a/tc/m_csum.c
+++ b/tc/m_csum.c
@@ -167,7 +167,7 @@ print_csum(struct action_util *au, FILE *f, struct rtattr *arg)
 	int uflag_count = 0;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_CSUM_MAX, arg);
 
diff --git a/tc/m_ct.c b/tc/m_ct.c
index 70d186e859f4..20cc9c8a3102 100644
--- a/tc/m_ct.c
+++ b/tc/m_ct.c
@@ -444,7 +444,7 @@ static int print_ct(struct action_util *au, FILE *f, struct rtattr *arg)
 	int ct_action = 0;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_CT_MAX, arg);
 	if (tb[TCA_CT_PARMS] == NULL) {
diff --git a/tc/m_ctinfo.c b/tc/m_ctinfo.c
index e5c1b43642a7..5475fe4d43da 100644
--- a/tc/m_ctinfo.c
+++ b/tc/m_ctinfo.c
@@ -189,7 +189,7 @@ static int print_ctinfo(struct action_util *au, FILE *f, struct rtattr *arg)
 	struct tc_ctinfo *ci;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_CTINFO_MAX, arg);
 	if (!tb[TCA_CTINFO_ACT]) {
diff --git a/tc/m_gact.c b/tc/m_gact.c
index 33f326f823d1..2722e9b805f7 100644
--- a/tc/m_gact.c
+++ b/tc/m_gact.c
@@ -172,7 +172,7 @@ print_gact(struct action_util *au, FILE *f, struct rtattr *arg)
 	struct rtattr *tb[TCA_GACT_MAX + 1];
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_GACT_MAX, arg);
 
diff --git a/tc/m_ife.c b/tc/m_ife.c
index 6a85e087ede1..2491ddb861c2 100644
--- a/tc/m_ife.c
+++ b/tc/m_ife.c
@@ -228,7 +228,7 @@ static int print_ife(struct action_util *au, FILE *f, struct rtattr *arg)
 	SPRINT_BUF(b2);
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_IFE_MAX, arg);
 
diff --git a/tc/m_ipt.c b/tc/m_ipt.c
index cc95eab7fefb..046b310e64ab 100644
--- a/tc/m_ipt.c
+++ b/tc/m_ipt.c
@@ -433,7 +433,7 @@ print_ipt(struct action_util *au, FILE * f, struct rtattr *arg)
 	__u32 hook;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	lib_dir = getenv("IPTABLES_LIB_DIR");
 	if (!lib_dir)
diff --git a/tc/m_mirred.c b/tc/m_mirred.c
index d2bdf4074a73..7c6351865788 100644
--- a/tc/m_mirred.c
+++ b/tc/m_mirred.c
@@ -282,7 +282,7 @@ print_mirred(struct action_util *au, FILE *f, struct rtattr *arg)
 	const char *dev;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_MIRRED_MAX, arg);
 
diff --git a/tc/m_mpls.c b/tc/m_mpls.c
index 3d5d9b25fbf6..1a3bfdda104b 100644
--- a/tc/m_mpls.c
+++ b/tc/m_mpls.c
@@ -198,7 +198,7 @@ static int print_mpls(struct action_util *au, FILE *f, struct rtattr *arg)
 	__u32 val;
 
 	if (!arg)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_MPLS_MAX, arg);
 
diff --git a/tc/m_nat.c b/tc/m_nat.c
index 56e8f47cdefd..63de71014efd 100644
--- a/tc/m_nat.c
+++ b/tc/m_nat.c
@@ -147,7 +147,7 @@ print_nat(struct action_util *au, FILE * f, struct rtattr *arg)
 	int len;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_NAT_MAX, arg);
 
diff --git a/tc/m_pedit.c b/tc/m_pedit.c
index 51dcf10930e8..ec71fcf9922e 100644
--- a/tc/m_pedit.c
+++ b/tc/m_pedit.c
@@ -746,7 +746,7 @@ static int print_pedit(struct action_util *au, FILE *f, struct rtattr *arg)
 	int err;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_PEDIT_MAX, arg);
 
diff --git a/tc/m_sample.c b/tc/m_sample.c
index 4a30513a6247..e2467a93444a 100644
--- a/tc/m_sample.c
+++ b/tc/m_sample.c
@@ -144,7 +144,7 @@ static int print_sample(struct action_util *au, FILE *f, struct rtattr *arg)
 	struct tc_sample *p;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_SAMPLE_MAX, arg);
 
diff --git a/tc/m_simple.c b/tc/m_simple.c
index 70897d6b7c13..bc86be27cbcc 100644
--- a/tc/m_simple.c
+++ b/tc/m_simple.c
@@ -166,7 +166,7 @@ static int print_simple(struct action_util *au, FILE *f, struct rtattr *arg)
 	char *simpdata;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_DEF_MAX, arg);
 
diff --git a/tc/m_skbedit.c b/tc/m_skbedit.c
index 9afe2f0c049d..37625c5ab067 100644
--- a/tc/m_skbedit.c
+++ b/tc/m_skbedit.c
@@ -199,7 +199,7 @@ static int print_skbedit(struct action_util *au, FILE *f, struct rtattr *arg)
 	struct tc_skbedit *p;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_SKBEDIT_MAX, arg);
 
diff --git a/tc/m_skbmod.c b/tc/m_skbmod.c
index d38a5c1921e7..e13d3f16bfcb 100644
--- a/tc/m_skbmod.c
+++ b/tc/m_skbmod.c
@@ -169,7 +169,7 @@ static int print_skbmod(struct action_util *au, FILE *f, struct rtattr *arg)
 	SPRINT_BUF(b2);
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_SKBMOD_MAX, arg);
 
diff --git a/tc/m_tunnel_key.c b/tc/m_tunnel_key.c
index bfec90724d72..f700f6d86c82 100644
--- a/tc/m_tunnel_key.c
+++ b/tc/m_tunnel_key.c
@@ -671,7 +671,7 @@ static int print_tunnel_key(struct action_util *au, FILE *f, struct rtattr *arg)
 	struct tc_tunnel_key *parm;
 
 	if (!arg)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_TUNNEL_KEY_MAX, arg);
 
diff --git a/tc/m_vlan.c b/tc/m_vlan.c
index 1096ba0fbf12..afc9b475ae0a 100644
--- a/tc/m_vlan.c
+++ b/tc/m_vlan.c
@@ -183,7 +183,7 @@ static int print_vlan(struct action_util *au, FILE *f, struct rtattr *arg)
 	struct tc_vlan *parm;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	parse_rtattr_nested(tb, TCA_VLAN_MAX, arg);
 
diff --git a/tc/m_xt.c b/tc/m_xt.c
index 487ba25ad391..deaf96a26f75 100644
--- a/tc/m_xt.c
+++ b/tc/m_xt.c
@@ -320,7 +320,7 @@ print_ipt(struct action_util *au, FILE *f, struct rtattr *arg)
 	__u32 hook;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	/* copy tcipt_globals because .opts will be modified by iptables */
 	struct xtables_globals tmp_tcipt_globals = tcipt_globals;
diff --git a/tc/m_xt_old.c b/tc/m_xt_old.c
index 6a4509a9982f..db014898590d 100644
--- a/tc/m_xt_old.c
+++ b/tc/m_xt_old.c
@@ -358,7 +358,7 @@ print_ipt(struct action_util *au, FILE * f, struct rtattr *arg)
 	__u32 hook;
 
 	if (arg == NULL)
-		return -1;
+		return 0;
 
 	set_lib_dir();
 
-- 
2.21.0

[RESEND PATCH iproute2-next 2/2] tc: implement support for terse dump

[Vlad Buslov]

From: Vlad Buslov <vladbu@mellanox.com>

Implement support for classifier/action terse dump using new TCA_DUMP_FLAGS
tlv with only available flag value TCA_DUMP_FLAGS_TERSE. Set the flag when
user requested it with following example CLI:

> tc -s filter show terse dev ens1f0 ingress

In terse mode dump only outputs essential data needed to identify the
filter and action (handle, cookie, etc.) and stats, if requested by the
user. The intention is to significantly improve rule dump rate by omitting
all static data that do not change after rule is created.

Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
---
 tc/tc_filter.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tc/tc_filter.c b/tc/tc_filter.c
index c591a19f3123..6a82f9bb42fb 100644
--- a/tc/tc_filter.c
+++ b/tc/tc_filter.c
@@ -595,6 +595,7 @@ static int tc_filter_list(int cmd, int argc, char **argv)
 		.t.tcm_parent = TC_H_UNSPEC,
 		.t.tcm_family = AF_UNSPEC,
 	};
+	bool terse_dump = false;
 	char d[IFNAMSIZ] = {};
 	__u32 prio = 0;
 	__u32 protocol = 0;
@@ -687,6 +688,8 @@ static int tc_filter_list(int cmd, int argc, char **argv)
 				invarg("invalid chain index value", *argv);
 			filter_chain_index_set = 1;
 			filter_chain_index = chain_index;
+		} else if (matches(*argv, "terse") == 0) {
+			terse_dump = true;
 		} else if (matches(*argv, "help") == 0) {
 			usage();
 		} else {
@@ -721,6 +724,15 @@ static int tc_filter_list(int cmd, int argc, char **argv)
 	if (filter_chain_index_set)
 		addattr32(&req.n, sizeof(req), TCA_CHAIN, chain_index);
 
+	if (terse_dump) {
+		struct nla_bitfield32 flags = {
+			.value = TCA_DUMP_FLAGS_TERSE,
+			.selector = TCA_DUMP_FLAGS_TERSE
+		};
+
+		addattr_l(&req.n, MAX_MSG, TCA_DUMP_FLAGS, &flags, sizeof(flags));
+	}
+
 	if (rtnl_dump_request_n(&rth, &req.n) < 0) {
 		perror("Cannot send dump request");
 		return 1;
-- 
2.21.0

Re: [RESEND PATCH iproute2-next 2/2] tc: implement support for terse dump

[David Ahern]

On 9/30/20 12:36 AM, Vlad Buslov wrote:
> From: Vlad Buslov <vladbu@mellanox.com>
> 
> Implement support for classifier/action terse dump using new TCA_DUMP_FLAGS
> tlv with only available flag value TCA_DUMP_FLAGS_TERSE. Set the flag when
> user requested it with following example CLI:
> 
>> tc -s filter show terse dev ens1f0 ingress

this should be consistent with ip command which has -br for 'brief'
output. so this should be

   tc -s -br filter show dev ens1f0 ingress

Other tc maintainers should weigh in on what data should be presented
for this mode.


> 
> In terse mode dump only outputs essential data needed to identify the
> filter and action (handle, cookie, etc.) and stats, if requested by the
> user. The intention is to significantly improve rule dump rate by omitting
> all static data that do not change after rule is created.
> 
> Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
> Reviewed-by: Jiri Pirko <jiri@mellanox.com>
> ---
>  tc/tc_filter.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/tc/tc_filter.c b/tc/tc_filter.c
> index c591a19f3123..6a82f9bb42fb 100644
> --- a/tc/tc_filter.c
> +++ b/tc/tc_filter.c
> @@ -595,6 +595,7 @@ static int tc_filter_list(int cmd, int argc, char **argv)
>  		.t.tcm_parent = TC_H_UNSPEC,
>  		.t.tcm_family = AF_UNSPEC,
>  	};
> +	bool terse_dump = false;
>  	char d[IFNAMSIZ] = {};
>  	__u32 prio = 0;
>  	__u32 protocol = 0;
> @@ -687,6 +688,8 @@ static int tc_filter_list(int cmd, int argc, char **argv)
>  				invarg("invalid chain index value", *argv);
>  			filter_chain_index_set = 1;
>  			filter_chain_index = chain_index;
> +		} else if (matches(*argv, "terse") == 0) {
> +			terse_dump = true;
>  		} else if (matches(*argv, "help") == 0) {
>  			usage();
>  		} else {
> @@ -721,6 +724,15 @@ static int tc_filter_list(int cmd, int argc, char **argv)
>  	if (filter_chain_index_set)
>  		addattr32(&req.n, sizeof(req), TCA_CHAIN, chain_index);
>  
> +	if (terse_dump) {
> +		struct nla_bitfield32 flags = {
> +			.value = TCA_DUMP_FLAGS_TERSE,
> +			.selector = TCA_DUMP_FLAGS_TERSE
> +		};
> +
> +		addattr_l(&req.n, MAX_MSG, TCA_DUMP_FLAGS, &flags, sizeof(flags));
> +	}
> +
>  	if (rtnl_dump_request_n(&rth, &req.n) < 0) {
>  		perror("Cannot send dump request");
>  		return 1;
> 

Re: [RESEND PATCH iproute2-next 2/2] tc: implement support for terse dump

[Vlad Buslov]

On Wed 30 Sep 2020 at 18:57, David Ahern <dsahern@gmail.com> wrote:
> On 9/30/20 12:36 AM, Vlad Buslov wrote:
>> From: Vlad Buslov <vladbu@mellanox.com>
>> 
>> Implement support for classifier/action terse dump using new TCA_DUMP_FLAGS
>> tlv with only available flag value TCA_DUMP_FLAGS_TERSE. Set the flag when
>> user requested it with following example CLI:
>> 
>>> tc -s filter show terse dev ens1f0 ingress
>
> this should be consistent with ip command which has -br for 'brief'
> output. so this should be
>
>    tc -s -br filter show dev ens1f0 ingress
>
> Other tc maintainers should weigh in on what data should be presented
> for this mode.

Thanks for the feedback, David! I've just sent V2 with -br option.

[...]

Re: [RESEND PATCH iproute2-next 2/2] tc: implement support for terse dump

[Stephen Hemminger]

On Wed, 30 Sep 2020 08:57:20 -0700
David Ahern <dsahern@gmail.com> wrote:

> On 9/30/20 12:36 AM, Vlad Buslov wrote:
> > From: Vlad Buslov <vladbu@mellanox.com>
> > 
> > Implement support for classifier/action terse dump using new TCA_DUMP_FLAGS
> > tlv with only available flag value TCA_DUMP_FLAGS_TERSE. Set the flag when
> > user requested it with following example CLI:
> >   
> >> tc -s filter show terse dev ens1f0 ingress  
> 
> this should be consistent with ip command which has -br for 'brief'
> output. so this should be
> 
>    tc -s -br filter show dev ens1f0 ingress
> 
> Other tc maintainers should weigh in on what data should be presented
> for this mode.

Current ip brief mode is good, one line per interface. Something similar with tc
would be best.

Re: [RESEND PATCH iproute2-next 2/2] tc: implement support for terse dump

[Vlad Buslov]

On Wed 30 Sep 2020 at 20:33, Stephen Hemminger <stephen@networkplumber.org> wrote:
> On Wed, 30 Sep 2020 08:57:20 -0700
> David Ahern <dsahern@gmail.com> wrote:
>
>> On 9/30/20 12:36 AM, Vlad Buslov wrote:
>> > From: Vlad Buslov <vladbu@mellanox.com>
>> > 
>> > Implement support for classifier/action terse dump using new TCA_DUMP_FLAGS
>> > tlv with only available flag value TCA_DUMP_FLAGS_TERSE. Set the flag when
>> > user requested it with following example CLI:
>> >   
>> >> tc -s filter show terse dev ens1f0 ingress  
>> 
>> this should be consistent with ip command which has -br for 'brief'
>> output. so this should be
>> 
>>    tc -s -br filter show dev ens1f0 ingress
>> 
>> Other tc maintainers should weigh in on what data should be presented
>> for this mode.
>
> Current ip brief mode is good, one line per interface. Something similar with tc
> would be best.

Hi Stephen,

My proposed implementation is very simple because it relies on existing
infrastructure that omits printing data that is not included in the
netlink packet. Making terse/brief dump output one line per filter would
require extending every single classifier with either standalone
callback for such print or dedicated block in existing print_op().
Moreover, it would be complicated for me to decide what should be
included in such output for many classifiers that I don't have
experience using.

Do you think complicating implementation like that is worth it?

Regards,
Vlad

Re: [RESEND PATCH iproute2-next 0/2] Implement filter terse dump mode support

[Ivan Vecera]

On Wed, 30 Sep 2020 10:36:49 +0300
Vlad Buslov <vladbu@nvidia.com> wrote:

> Implement support for terse dump mode which provides only essential
> classifier/action info (handle, stats, cookie, etc.). Use new
> TCA_DUMP_FLAGS_TERSE flag to prevent copying of unnecessary data from
> kernel.
> 
> Vlad Buslov (2):
>   tc: skip actions that don't have options attribute when printing
>   tc: implement support for terse dump
> 
>  tc/m_bpf.c        |  2 +-
>  tc/m_connmark.c   |  2 +-
>  tc/m_csum.c       |  2 +-
>  tc/m_ct.c         |  2 +-
>  tc/m_ctinfo.c     |  2 +-
>  tc/m_gact.c       |  2 +-
>  tc/m_ife.c        |  2 +-
>  tc/m_ipt.c        |  2 +-
>  tc/m_mirred.c     |  2 +-
>  tc/m_mpls.c       |  2 +-
>  tc/m_nat.c        |  2 +-
>  tc/m_pedit.c      |  2 +-
>  tc/m_sample.c     |  2 +-
>  tc/m_simple.c     |  2 +-
>  tc/m_skbedit.c    |  2 +-
>  tc/m_skbmod.c     |  2 +-
>  tc/m_tunnel_key.c |  2 +-
>  tc/m_vlan.c       |  2 +-
>  tc/m_xt.c         |  2 +-
>  tc/m_xt_old.c     |  2 +-
>  tc/tc_filter.c    | 12 ++++++++++++
>  21 files changed, 32 insertions(+), 20 deletions(-)
> 

Tested-by: Ivan Vecera <ivecera@redhat.com>