Removing individual BPF filter

Question

I'm attaching three different BPF programs as ingress filters as follows:

tc filter add dev eth0 parent ffff: bpf direct-action obj bpf1.o sec classifier flowid ffff:1

tc filter add dev eth0 parent ffff: bpf direct-action obj bpf2.o sec classifier flowid ffff:2

tc filter add dev eth0 parent ffff: bpf direct-action obj bpf3.o sec classifier flowid ffff:3

I'm trying to find a way to remove specitic filters with the tc filter remove command, but I'm unable to do so. As an example, I would like to remove the filter with flowid ffff:3.

Any tips on that please?

Thanks.

Qeole Qeole · Accepted Answer · 2021-02-01T11:34:06

I do not think you can match on the flowid, or on the name of the object file. Best I found is that you can pass a preference, which seems to be used to order the filters.

# tc filter show dev eth0 ingress
filter protocol all pref 49150 bpf chain 0 
filter protocol all pref 49150 bpf chain 0 handle 0x1 flowid ffff:3 sample_ret0.o...
filter protocol all pref 49151 bpf chain 0 
filter protocol all pref 49151 bpf chain 0 handle 0x1 flowid ffff:2 sample_ret0.o...
filter protocol all pref 49152 bpf chain 0 
filter protocol all pref 49152 bpf chain 0 handle 0x1 flowid ffff:1 sample_ret0.o...

# tc filter del dev eth0 ingress pref 49151

# tc filter show dev eth0 ingress
filter protocol all pref 49150 bpf chain 0 
filter protocol all pref 49150 bpf chain 0 handle 0x1 flowid ffff:3 sample_ret0.o...
filter protocol all pref 49152 bpf chain 0 
filter protocol all pref 49152 bpf chain 0 handle 0x1 flowid ffff:1 sample_ret0.o...

You could get the preference from a call to tc filter show, for example:

# tc -j filter show dev eth0 ingress | jq '.[]|select(.options.flowid == "ffff:2").pref'
49151

Not working: You can set a custom handle integer to your filter when creating it, but it is apparently impossible to delete it afterwards:

# tc filter del dev eth0 ingress protocol all handle 42 bpf
Error: Cannot flush filters with protocol, handle or kind set.
We have an error talking to the kernel

Removing individual BPF filter

1 Answers