How to use negative offset for pyroute.tc u32 filter

[reshmasreekumar]

Hello,

pyroute2.tc offers support for u32 filter. However, is there a way I can provide negative offset value (eg: for destination MAC address matching) ? Providing negative offset in the following syntax value installs wrong filter configuration:

>>> ip.tc('add-filter', 'u32', idx, parent=0x10000, protocol=socket.AF_INET, target=0x10011, opt='u16', keys=['0x0203/0xffff+-14',])

filter parent 1: protocol ax25 pref 49152 u32 chain 0 
filter parent 1: protocol ax25 pref 49152 u32 chain 0 fh 800: ht divisor 1 
filter parent 1: protocol ax25 pref 49152 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:11 not_in_hw 
  match 02030000/ffff0000 at 242

However, configuring the same using linux iproute seems to work fine as seen below:

sudo tc filter add dev dummy0 protocol ip parent 1:0 prio 1 u32 match u32 0x00000203 0x0000ffff at -16 classid 1:11

sudo  tc -s -d filter show dev dummy0:

filter parent 1: protocol ip pref 1 u32 chain 0 
filter parent 1: protocol ip pref 1 u32 chain 0 fh 800: ht divisor 1 
filter parent 1: protocol ip pref 1 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:11 not_in_hw 
  match 00000203/0000ffff at -16

Basically, when -14 is given, pyroute2.tc seems to install a filter match at (256 - 14) offset, where 256 is the length of the array used in the code.

Is there another syntax that works for negative offset value? Thanks in advance for any guidance with respect to this!

[ffourcot]

Hello,

There is a merge request here for this feature : #656

But never finalized. One reason is the lack of feedback on this feature, since nobody replied to this issue : #646

[reshmasreekumar]

@ffourcot Thanks for pointing to #656. I tried the fix provided by @Vic063 and it might need a small update which I have mentioned as comment in the commit.

However, even with the fix, the config that I am trying to install wouldn't work i.e.

Executing ip.tc('add-filter', 'u32', idx, parent=0x10000, protocol=socket.AF_INET, target=0x10011, keys=['0x00000303/0x0000ffff-16',]) would result in a match match 03030000/ffff0000 at -16 (success 0 )

whereas executing sudo tc filter add dev $ifname protocol all parent 1:0 prio 1 u32 match u32 0x00000303 0x0000ffff at -16 classid 1:11 results in match 00000303/0000ffff at -16 (success 0 )

[svinota]

Thanks for bringing this up, let me play a bit with that.