mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-24 10:37:52 +04:00
Gennaro Cimmino
8bd2d79d7d
The PIE path never looks at the chain of a flower rule: a rule in chain 1 goes into hardware as if it were in chain 0. No goto chain is offloaded, so in software such a rule only runs after a goto chain action jumps there, while in hardware it sees every frame of its port. Refuse rules outside chain 0 on the PIE path. The port policer already takes only rules of chain 0, in otto_tc_flower_matches_all(). Families without pie_cls_flower never reach the check. On an HPE 1920-48G (RTL8393), a dst_ip drop rule in chain 1 went into hardware on main and dropped 8 of 8 echo requests, with skip_sw and without. With this change tc refuses it with skip_sw, keeps it in software (not_in_hw) without, and the 8 pass in both cases. Not tested on RTL930x hardware, which shares this path. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Gennaro Cimmino <gcimmino@rayonra.net> Link: https://github.com/openwrt/openwrt/pull/25906 Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>