[Bug 2125448] Please test proposed package

[Nick Rosbrook]

Hello Jorge, or anyone else affected,

Accepted iproute2 into questing-proposed. The package will build now and
be available at
https://launchpad.net/ubuntu/+source/iproute2/6.16.0-1ubuntu2.1 in a few
hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, what testing has been
performed on the package and change the tag from verification-needed-
questing to verification-done-questing. If it does not fix the bug for
you, please add a comment stating that, and change the tag to
verification-failed-questing. In either case, without details of your
testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/2125448

Title:
  Burst parameter of tc police only allows 4GB while the kernel can
  support much more

Status in iproute2 package in Ubuntu:
  Fix Committed
Status in iproute2 source package in Jammy:
  In Progress
Status in iproute2 source package in Noble:
  In Progress
Status in iproute2 source package in Plucky:
  In Progress
Status in iproute2 source package in Questing:
  Fix Committed
Status in iproute2 source package in Resolute:
  Fix Committed

Bug description:
  [Impact]
  The tc police burst option limits the size of the burst up to 4 GiB, i.e., UINT_MAX for a 32 bit unsigned int. However, the underlying implementation of burst is computed as "time at the specified rate", and for higher rates, a burst size exceeding 4 GiB is feasible without modification to the kernel.
  Conversely, there can be bursts smaller that 4 GiB that overflow the burst time calculation and that was not detected.

  [Test Plan]
  All the following commands must be run as root. We are assuming the tested interface is eth0.

  Add fq_codel queuing discipline

  # tc qdisc add dev eth0 root fq_codel

  Check the assigned discipline number

  # tc -s qdisc show dev eth0
  qdisc fq_codel nnnn: root refcnt 13 limit ...

  Note the 4 digits nnnn number. It should be substituted for the nnnn
  number in the rest of the following commands.

  1) Tests before the patch is applied

  Try to set a filter with a burst of exactly 4Gb at 10Gbit rate and see
  that it fails:

  # tc filter add dev eth0 protocol ip prio 1 parent nnnn: handle 1 fw police rate 10Gbit peakrate 10Gbit burst 4294967296 mtu 64Kb conform-exceed reclassify
  Error: argument "4294967296" is wrong: buffer

  Try to set a filter with a burst that is greater than the maximum
  time:

  # tc filter add dev eth0 protocol ip prio 1 parent nnnn: handle 1 fw
  police rate 1Mbit peakrate 10Gbit burst 34375000 mtu 64Kb conform-
  exceed reclassify

  Check if it was set correctly:

  # tc -raw filter get dev eth0 protocol ip prio 1 parent nnnn: handle 1 fw
  filter parent nnnn: protocol ip pref 1 fw chain 0 handle 0x1  police 0x1 rate 1Mbit burst 15261b mtu 64Kb [001d1bf8] peakrate 10Gbit action reclassify overhead 0b

  We can see a result with the overflowed buffer (burst is 15261b)

  2) Tests after the patch is applied:

  Try to set a filter with a burst of exactly 4Gb at 10Gbit rate:

  # tc filter add dev eth0 protocol ip prio 1 parent nnnn: handle 1 fw
  police rate 10Gbit peakrate 10Gbit burst 4294967296 mtu 64Kb conform-
  exceed reclassify

  We can check that it was set correctly (burst is 4Gb):

  # tc -raw filter get dev eth0 protocol ip prio 1 parent nnnn: handle 1 fw
  filter parent nnnn: protocol ip pref 1 fw chain 0 handle 0x1  police 0x1 rate 10Gbit burst 4Gb mtu 64Kb [03333334] peakrate 10Gbit action reclassify overhead 0b

  Remove the filter:

  # tc filter del dev eth0 protocol ip prio 1 parent nnnn:

  Try to set a filter with a burst that is greater than the maximum
  time:

  # tc filter add dev eth0 protocol ip prio 1 parent nnnn: handle 1 fw police rate 1Mbit peakrate 10Gbit burst 34375000 mtu 64Kb conform-exceed reclassify
  POLICE: burst out of range

  We see that it is out of range

  [Where problems could occur]
  Externally the only difference with the installed patch is that some commands that will previously overflow without errors will now fail. That might break some scripts but it can be argued that they were already broken before.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/iproute2/+bug/2125448/+subscriptions