Linux tc 过滤器 u32 与数据包数据有效负载匹配不一致 - 有人可以解释一下吗？

Question 1

找到答案了。启用 TCP 时间戳会引入 12 字节的额外标头信息，从而导致偏移差异。

您可以通过以下步骤在 Linux 中打开/关闭它们：

echo 0 > /proc/sys/net/ipv4/tcp_timestamps
echo 1 > /proc/sys/net/ipv4/tcp_timestamps

还可以通过执行以下操作查看它们是否打开/关闭：

cat /proc/sys/net/ipv4/tcp_timestamps

Answer

找到答案了。启用 TCP 时间戳会引入 12 字节的额外标头信息，从而导致偏移差异。

您可以通过以下步骤在 Linux 中打开/关闭它们：

echo 0 > /proc/sys/net/ipv4/tcp_timestamps
echo 1 > /proc/sys/net/ipv4/tcp_timestamps

还可以通过执行以下操作查看它们是否打开/关闭：

cat /proc/sys/net/ipv4/tcp_timestamps

Question 2

我发现这也许能解决问题。

http://linux-tc-notes.sourceforge.net/tc/doc/cls_u32.txt

标题偏移

IP 标头（和其他标头）的长度是可变的。如果您尝试使用“match”查看后面标头中的值，就会出现问题 - 您不知道它在哪里。这并非不可能解决的问题，因为 IP 数据包中的每个标头都包含一个长度字段。u32 的“标头偏移”功能允许您从数据包中提取该长度，然后将其添加到“match”选项中指定的偏移量。

它的工作原理如下。回想一下，匹配选项如下所示：

match u32 VALUE MASK at OFFSET

我之前说过，OFFSET 告诉内核要将数据包中的哪个字与 VALUE 进行比较。该语句是一种简化。可以将另外两个值添加到 OFFSET 以确定要使用哪个字。这两个值都从 0 开始，但当“链接”选项调用另一个筛选器列表时，它们可以被修改。所做的任何修改仅适用于执行被调用的筛选器列表时，因为如果被调用的筛选器列表无法对数据包进行分类，则会恢复旧值。以下是两个值以及我给它们起的名字：

permoff     This value is unconditionally added to every OFFSET
        that is done in the destination link, ie that one
    that is called.  This includes calculations of new
    permoff's and tempoff's.  Permoff's are cumulative
    in that if the destination link calls another link
    and calculates a new permoff, the result is added to
    this one.

tempoff A "match" option in the destination link can
        optionally add this value its OFFSET.  Tempoff's are
    temporary, in that it does not apply to any links the
    destination link calls.  It also does not effect the
    calculation of OFFSET's for new permoff's and
    tempoff's.

举个例子。考虑这个命令：

# tc filter add dev eth0 parent 999:0 protocol ip prio 99 u32 \
    link 1: offset at 0 mask 0f00 shift 6 plus 0 eat \
match ip protocol 6 ff

match 表达式选择 tcp 数据包（即 IP 协议 6）。如果我们有协议 6，我们将执行过滤器 1:0。现在来看看其余部分：

offset  This signals that we want to modify permoff or tempoff
        if the link is executed.  If this is not present,
    neither permoff nor tempoff are effected - in other
    words the target of the link inherits the current
    permoff and tempoff.

at 0    This says the 16 bit word that contains the value we
        are going to use to calculate permoff or tempoff lives
    offset 0 the IP packet - ie at the start of the packet.
    This offset must be even.  If not specified 0 is used.

mask 0f00   This mask (which is in hex) is bit-wise anded with the
        16 bit word extracted from the packet header.  It
    isolates the header length from the rest of the
    information in the word.  If not specified 0 is used
    for the extracted value.

shift 6 This says the word extracted is to be divided by 64
        after being masked.  If not present the value is not
    shifted.

plus 0  After extracting the word, masking it and dividing it by
        64, this value is now added to it.  If not present is
    assumed to be 0.

eat     If this is present we are calculating permoff, and the
        result of the calculation above is added to it.  Tempoff
    is set to 0 in this case.  If this is not present we are
    calculating tempoff, and the result of the calculation
    becomes tempoff's new value.  Permoff is not altered in
    this case.

Answer