On Thu, Mar 3, 2016 at 11:31 AM, Daniel Borkmann <daniel@...>
wrote:

On 03/03/2016 08:19 PM, Brenden Blanco via iovisor-dev wrote:
[...]

On Thu, Mar 3, 2016 at 5:52 AM, O Mahony, Billy <billy.o.mahony@...

[...]

#add a filter to accept all eth frame. Attach the bpf action? functions

to the filter?

#I have no idea what the classid, target and keys parameters mean!

ip.tc("add-filter", "u32", ifindex_eth1, ":1", parent="ffff:",

action=[action_eth1],

protocol=protocols.ETH_P_ALL, classid=1,

target=0x10002, keys=['0x0/0x0+0'])

ip.tc("add-filter", "u32", ifindex_eth3, ":1", parent="ffff:",

action=[action_eth3],

protocol=protocols.ETH_P_ALL, classid=1,

target=0x10002, keys=['0x0/0x0+0'])

Yeah, it's a bit of black magic. it's basically creating a match-all rule
(match 0 bytes and offset 0 == true), with the matching action being the
bpf program. The classid and target aren't really meaningful with just one
action and filter, so it's ok to ignore for now.

The clsact qdisc added in 4.5 by Daniel Borkmann is a much better
abstraction for this, and I'll try to upstream some pyroute2 code to
support this.

Plus you may also want to try out cls_bpf with da (direct-action) mode.
That will save you the u32 match all classifier config and is faster.

Speaking of which, I just opened
https://github.com/svinota/pyroute2/pull/223 to add support in pyroute2
upstream. The docstring in that pull request shows an example usage, which
I'll also add to a testcase in bcc once it merges upstream.

I've done similar additions for go in
https://github.com/vishvananda/netlink/pull/94, if go is your thing.