How to use u32 filters with clsact qdisc

[tsv1991]

I'd like to use u32 filters with clsact qdisc.
If I use the tc utility, this like:

$ tc qdisc add dev  br0 clsact
$ tc filter add dev br0 ingress protocol ip pref 2 u32 match ip dst 192.168.2.0/24 action pass

$ tc filter show dev br0 ingress
filter protocol ip pref 2 u32 chain 0
filter protocol ip pref 2 u32 chain 0 fh 800: ht divisor 1
filter protocol ip pref 2 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 terminal flowid not_in_hw
  match c0a80200/ffffff00 at 16
        action order 1: gact action pass
         random type none pass val 0
         index 1 ref 1 bind 1

But when I try to do it use pyroute2, I get error:

  return tuple(self._genlm_get(*argv, **kwarg))
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 File "/usr/local/lib/python3.11/dist-packages/pyroute2/netlink/nlsocket.py", line 555, in get
   raise msg['header']['error']
pyroute2.netlink.exceptions.NetlinkError: (2, 'No such file or directory')

Of course the interface exists.

from pyroute2 import IPRoute, protocols

dev = "br0"

dst_ip_hex = "0xc0a80200"  # 192.168.2.0
dst_mask_hex = "0xffffff00"  # 255.255.255.0
offset = 16

ip = IPRoute()

dev_index = ip.link_lookup(ifname=dev)[0]
print(f"br0 index: {dev_index}")

ip.tc("add", "clsact", dev_index)

ip.tc("add-filter", "u32", dev_index,
    parent=0xfffffff1,
    prio=2,
    protocol=protocols.ETH_P_IP,
    target=0x800,
    keys=[f"{dst_ip_hex}/{dst_mask_hex}+{offset}"],
    action=dict(kind="gact", action="ok")
)

ip.close()

I'd appreciate it if you could help me find my mistake.

[svinota]

There was a wrong parent; the kernel expects there 0xfffffff2 in this case.

ip.tc("add-filter", "u32", dev_index,
    parent=0xfffffff2,  # <--- here was a wrong parent
    prio=2,
    protocol=protocols.ETH_P_IP,
    target=0x800,
    keys=[f"{dst_ip_hex}/{dst_mask_hex}+{offset}"],
    action=dict(kind="gact", action="ok")
)

Just for reference: https://github.com/iproute2/iproute2/blob/41710ace5e8fadff354f3dba67bf27ed3a3c5ae7/include/uapi/linux/pkt_sched.h#L80

There is a significant lack of user-friendliness in pyroute2 when it comes to traffic control management, so any contributions in this area are highly welcome.

[tsv1991]

Thank you!
You're really helpful. I don't know how can I contribute to pyroute2, because my programming skills not so good. But I can share user experiences to improve the library.

[tsv1991]

@svinota I think I should to ask you the same thread. I have a misunderstanding how to delete u32 filter use pyroute2.
I get all filters use the get_filter function and have this result: https://pastebin.com/wy0jiaB8

the same by tc CLI output looks like:

# tc filter show dev br100 ingress
filter protocol ip pref 1001 u32 chain 0
filter protocol ip pref 1001 u32 chain 0 fh 808: ht divisor 1
filter protocol ip pref 1001 u32 chain 0 fh 808::800 order 2048 key ht 808 bkt 0 *flowid :800 not_in_hw
  match 06000000/ff000000 at 9
  match 00190000/ffff0000 at 22
	action order 1: gact action drop
	 random type none pass val 0
	 index 9 ref 1 bind 1

filter protocol ipv6 pref 1002 u32 chain 0
filter protocol ipv6 pref 1002 u32 chain 0 fh 809: ht divisor 1
filter protocol ipv6 pref 1002 u32 chain 0 fh 809::800 order 2048 key ht 809 bkt 0 *flowid :800 not_in_hw
  match 06000000/ff000000 at 6
  match 00190000/ffff0000 at 42
	action order 1: gact action drop
	 random type none pass val 0
	 index 10 ref 1 bind 1

filter protocol ip pref 10001 u32 chain 0
filter protocol ip pref 10001 u32 chain 0 fh 800: ht divisor 1
filter protocol ip pref 10001 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 *flowid :800 not_in_hw
  match 2d8b1800/fffffc00 at 16
	action order 1: gact action pass
	 random type none pass val 0
	 index 1 ref 1 bind 1

filter protocol ip pref 10003 u32 chain 0
filter protocol ip pref 10003 u32 chain 0 fh 801: ht divisor 1
filter protocol ip pref 10003 u32 chain 0 fh 801::800 order 2048 key ht 801 bkt 0 *flowid :800 not_in_hw
  match c237ea00/fffffe00 at 16
	action order 1: gact action pass
	 random type none pass val 0
	 index 2 ref 1 bind 1

filter protocol ip pref 10005 u32 chain 0
filter protocol ip pref 10005 u32 chain 0 fh 802: ht divisor 1
filter protocol ip pref 10005 u32 chain 0 fh 802::800 order 2048 key ht 802 bkt 0 *flowid :800 not_in_hw
  match c237f400/fffffe00 at 16
	action order 1: gact action pass
	 random type none pass val 0
	 index 3 ref 1 bind 1

filter protocol ipv6 pref 10007 u32 chain 0
filter protocol ipv6 pref 10007 u32 chain 0 fh 803: ht divisor 1
filter protocol ipv6 pref 10007 u32 chain 0 fh 803::800 order 2048 key ht 803 bkt 0 *flowid :800 not_in_hw
  match 2a0f1140/ffffffff at 24
	action order 1: gact action pass
	 random type none pass val 0
	 index 4 ref 1 bind 1

filter protocol all pref 10999 matchall chain 0
filter protocol all pref 10999 matchall chain 0 handle 0x1
  not_in_hw
	action order 1:  police 0x1 rate 55Mbit burst 275000b mtu 2Kb action drop overhead 0b
	ref 1 bind 1

How can I delete the pref 1001 rule for example? I can't to get required parameter keys. My function looks like:

kind = None
keys = []
for flt in filters:
    for attr in flt.get("attrs", []):
        if attr[0] == "TCA_KIND":
            kind = attr[1]
    for attr in flt['attrs']:
        if attr[0] == 'TCA_OPTIONS':
            for sub in attr[1].get('attrs', []):
                if sub[0] == 'TCA_U32_SEL':
                    keys = sub[1]['keys']
    pref = flt.get("info", 0) >> 16
    print(str(keys))
    if pref == 1001:
        try:
            ipr.tc("del-filter",
                   kind=kind,
                   ifindex=ifindex,
                   parent=0xfffffff2,
                   target=0x800,
                   keys=keys,
                   info=flt.get("info", 0)
            )
            print(f"Deleted filter: kind={kind}, pref={pref}")
        except Exception as e:
            print(f"Failed to delete filter pref={pref}: {e}")

[svinota]

The easiest way is to use the definition you fetch from the RTNL with ipr.get_filters() e.g.

# sync
with IPRoute() as ipr:
    filters = list(ipr.get_filters(index=idx))

# async
async with AsyncIPRoute() as ipr:
    filters = [ x async for x in await ipr.get_filters(index=idx) ]

Then, having a list with messages you received, you can just use the message in del-filter as keyword arguments. Say, you calculated somehow that you want to delete the first filter from the list:

…
# sync
ipr.tc('del-filter', **filters[0])

# async
await ipr.tc('del-filter', **filters[0])

Beside of that, you can use parent & info fields to identify the filter:

>>> [ print(x.get('parent'), x.get('info')) async for x in await ipr.get_filters(index=2) ]
65536 65601544
65536 65601544
65536 65601544
65536 72089608
65536 72089608
65536 72089608
…
>>> await ipr.tc('del-filter', index=2, parent=65536, info=65601544)
…

[tsv1991]

Thank you very much for the quick and detailed explanation, it all worked out.