The PIE path never looks at the chain of a flower rule: a rule in
chain 1 goes into hardware as if it were in chain 0. No goto chain is
offloaded, so in software such a rule only runs after a goto chain
action jumps there, while in hardware it sees every frame of its port.
Refuse rules outside chain 0 on the PIE path. The port policer already
takes only rules of chain 0, in otto_tc_flower_matches_all(). Families
without pie_cls_flower never reach the check.
On an HPE 1920-48G (RTL8393), a dst_ip drop rule in chain 1 went into
hardware on main and dropped 8 of 8 echo requests, with skip_sw and
without. With this change tc refuses it with skip_sw, keeps it in
software (not_in_hw) without, and the 8 pass in both cases. Not tested
on RTL930x hardware, which shares this path.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Gennaro Cimmino <gcimmino@rayonra.net>
Link: https://github.com/openwrt/openwrt/pull/25906
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Gennaro Cimmino
8bd2d79d7d