Feature: tc qdisc / filter support? #63

marekm72 commented 2024年10月22日 01:25:36 +02:00

I'm not sure how feasible this is (tc has so many features), for example it would be nice to be able to declare some tc ingress filters (L2 packet filtering) like these I currently set up with the shell script below:

#! /bin/sh
set -e
# block ipv6cp from broken phicomm routers (MAC prefix: d8c8e9, fc7c02)
PPPOE_IFACES="eth2 eth4"
for i in $PPPOE_IFACES ; do
 tc qdisc del dev $i ingress || true
 tc qdisc add dev $i ingress
 tc filter add dev $i parent ffff: u32 match u32 0xd8c8e900 0xffffff00 at -8 match u16 0x8864 0xffff at -2 match u16 0x8057 0xffff at 6 action drop
 tc filter add dev $i parent ffff: u32 match u32 0xfc7c0200 0xffffff00 at -8 match u16 0x8864 0xffff at -2 match u16 0x8057 0xffff at 6 action drop
done

I use this on my PPPoE servers to work around cheap buggy Phicomm KE2M routers that worked for IPv4 but unexpectedly broke when I enabled IPv6 - nowhere on the box or in the web GUI do they advertise any IPv6 support at all, but try to negotiate it anyway and then fail, this combined with a bug in accel-ppp where closing IPV6CP terminates the whole session, so they were disconnecting all the time.

I'm not sure how feasible this is (tc has so many features), for example it would be nice to be able to declare some tc ingress filters (L2 packet filtering) like these I currently set up with the shell script below: ``` #! /bin/sh set -e # block ipv6cp from broken phicomm routers (MAC prefix: d8c8e9, fc7c02) PPPOE_IFACES="eth2 eth4" for i in $PPPOE_IFACES ; do tc qdisc del dev $i ingress || true tc qdisc add dev $i ingress tc filter add dev $i parent ffff: u32 match u32 0xd8c8e900 0xffffff00 at -8 match u16 0x8864 0xffff at -2 match u16 0x8057 0xffff at 6 action drop tc filter add dev $i parent ffff: u32 match u32 0xfc7c0200 0xffffff00 at -8 match u16 0x8864 0xffff at -2 match u16 0x8057 0xffff at 6 action drop done ``` I use this on my PPPoE servers to work around cheap buggy Phicomm KE2M routers that worked for IPv4 but unexpectedly broke when I enabled IPv6 - nowhere on the box or in the web GUI do they advertise any IPv6 support at all, but try to negotiate it anyway and then fail, this combined with a bug in accel-ppp where closing IPV6CP terminates the whole session, so they were disconnecting all the time.

liske commented 2024年10月26日 23:49:37 +02:00

It might be possible to extend the existing tc schema, but yes it doesn't look like ifstate can handle any arbitrary valid filter config.

It might be possible to extend the existing [tc schema](https://ifstate.net/schema/1.13/#interfaces_items_tc_filter_items), but yes it doesn't look like ifstate can handle any arbitrary valid filter config.