netdev - Re: [EXT] tc-mirred : Redirect Broadcast (like ARP) pkts rcvd on eth1 towards eth0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <9c6213b3-961f-4a74-a22f-143da42daf32@mojatatu.com>
Date: Sat, 20 Jan 2024 11:39:46 -0300
From: Pedro Tammela <pctammela@...atatu.com>
To: Vikas Aggarwal <vik.reck@...il.com>
Cc: "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [EXT] tc-mirred : Redirect Broadcast (like ARP) pkts rcvd on eth1
 towards eth0

On 20/01/2024 02:03, Vikas Aggarwal wrote:
> Thanks so much  Pedro Tammela & Suman.
> Getting bit greedy here with tc filter :)  -  Can i also use some
> boolean  for example dst_mac != aa:bb:cc:dd:ee:ff
> 

I don't think you can explicitly like you describe.

You could do something like:

tc qdisc add dev $ETH clsact
tc filter add dev $ETH egress .. dst_mac aa:bb:cc:dd:ee:ff .. action ...
tc filter add dev $ETH egress .. action ...

The last filter is a fallback in case the dst_mac doesn't match.
As long as you don't specify the dst_mac in the flower filter, the last 
filter will match everything != aa:bb:cc:dd:ee:ff.

If the == case is a noop, then just say `action ok`.