删除单个BPF滤波器

Question

我附加了三个不同的BPF程序作为入口过滤器，如下所示：

tc filter add dev eth0 parent ffff: bpf direct-action obj bpf1.o sec classifier flowid ffff:1

tc filter add dev eth0 parent ffff: bpf direct-action obj bpf2.o sec classifier flowid ffff:2

tc filter add dev eth0 parent ffff: bpf direct-action obj bpf3.o sec classifier flowid ffff:3

我正在尝试使用tc filter remove命令来删除特定的筛选器，但是我无法这样做。作为一个例子，我想用flowid ffff:3删除过滤器。

有什么建议吗？

谢谢。

Answer 1

我不认为您可以在flowid或目标文件的名称上进行匹配。我发现最好的方法是您可以传递一个preference，它似乎用于对过滤器进行排序。

# tc filter show dev eth0 ingress
filter protocol all pref 49150 bpf chain 0 
filter protocol all pref 49150 bpf chain 0 handle 0x1 flowid ffff:3 sample_ret0.o...
filter protocol all pref 49151 bpf chain 0 
filter protocol all pref 49151 bpf chain 0 handle 0x1 flowid ffff:2 sample_ret0.o...
filter protocol all pref 49152 bpf chain 0 
filter protocol all pref 49152 bpf chain 0 handle 0x1 flowid ffff:1 sample_ret0.o...

# tc filter del dev eth0 ingress pref 49151

# tc filter show dev eth0 ingress
filter protocol all pref 49150 bpf chain 0 
filter protocol all pref 49150 bpf chain 0 handle 0x1 flowid ffff:3 sample_ret0.o...
filter protocol all pref 49152 bpf chain 0 
filter protocol all pref 49152 bpf chain 0 handle 0x1 flowid ffff:1 sample_ret0.o...

您可以通过调用tc filter show获取首选项，例如：

# tc -j filter show dev eth0 ingress | jq '.[]|select(.options.flowid == "ffff:2").pref'
49151

不起作用:你可以在创建过滤器时设置一个自定义的handle整数，但显然不可能在之后删除它：

# tc filter del dev eth0 ingress protocol all handle 42 bpf
Error: Cannot flush filters with protocol, handle or kind set.
We have an error talking to the kernel