Can the PCP field be set in the netdev table?
Kevin Vigouroux <[email protected]> Wed, 16 Apr 2025 18:22:11 +0200
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <[email protected]> |
Hi!
I tried in vain to modify the PCP field with many rules. Nothing worked.
#+begin_src
table netdev t {
chain in_update_vlan {
vlan type arp counter
ip saddr 192.168.60.5 icmp type echo-request counter
}
chain in {
type filter hook ingress device "end0" priority filter; policy accept;
ether saddr 96:3f:66:77:df:88 vlan id 5 jump in_update_vlan
}
chain out_update_vlan {
vlan type arp meta priority set 0:6 counter
ip daddr 192.168.60.5 icmp type echo-reply meta priority set 0:6 counter
}
chain out {
type filter hook egress device "end0" priority filter; policy accept;
ether daddr 96:3f:66:77:df:88 vlan id 5 jump out_update_vlan
}
}
#+end_src
#+begin_src
table netdev t {
chain out {
type filter hook egress device "end0" priority filter; policy accept;
ether saddr 1f:9b:96:c7:14:d3 vlan pcp 0 vlan pcp set 2 counter
}
}
#+end_src
#+begin_src
table netdev t {
chain out {
type filter hook egress device "end0" priority filter; policy accept;
ip daddr 192.168.60.5 icmp type echo-reply meta priority set 0:6 meta nftrace set 1
}
}
#+end_src
#+begin_src
$ sudo nft --debug=netlink add rule netdev t out vlan pcp set 1 counter
netdev filter t
[ meta load iiftype => reg 1 ]
[ cmp eq reg 1 0x00000001 ]
[ payload load 2b @ link header + 12 => reg 1 ]
[ cmp eq reg 1 0x00000081 ]
[ payload load 1b @ link header + 14 => reg 1 ]
[ bitwise reg 1 = ( reg 1 & 0x0000001f ) ^ 0x00000020 ]
[ payload write reg 1 => 1b @ link header + 14 csum_type 0 csum_off 0 csum_flags 0x0 ]
[ counter pkts 0 bytes 0 ]
$ sudo nft --debug=netlink add rule netdev t out vlan pcp set 6 counter
netdev filter t
[ meta load iiftype => reg 1 ]
[ cmp eq reg 1 0x00000001 ]
[ payload load 2b @ link header + 12 => reg 1 ]
[ cmp eq reg 1 0x00000081 ]
[ payload load 1b @ link header + 14 => reg 1 ]
[ bitwise reg 1 = ( reg 1 & 0x0000001f ) ^ 0x000000c0 ]
[ payload write reg 1 => 1b @ link header + 14 csum_type 0 csum_off 0 csum_flags 0x0 ]
[ counter pkts 0 bytes 0 ]
#+end_src
I don't have enough knowledge to understand this issue. My device is a 802.1Q
VLAN whose master device is an Ethernet NIC (this is not a switch or software
bridge). Is it a “driver” issue?
Any help?
--
Best regards,
Kevin Vigouroux