From: Ido Schimmel <idosch@nvidia.com>
Date: Tue, 14 Jun 2022 14:26:57 +0000 (+0300)
Subject: man: tc-fw: Document masked handle usage
X-Git-Tag: v6.0.0~36
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bfffaf1360916a5acc80c96008cb70b038476e00;p=thirdparty%2Fiproute2.git

man: tc-fw: Document masked handle usage

The tc-fw filter can be used to match on the packet's fwmark by adding a
filter with a matching handle. It also supports matching on specific
bits of the fwmark by specifying the handle together with a mask. This
is documented in the usage message below, but not in the man page.

Document it in the man page together with an example.

 $ tc filter add fw help
 Usage: ... fw [ classid CLASSID ] [ indev DEV ] [ action ACTION_SPEC ]
         CLASSID := Push matching packets to the class identified by CLASSID with format X:Y
                 CLASSID is parsed as hexadecimal input.
         DEV := specify device for incoming device classification.
         ACTION_SPEC := Apply an action on matching packets.
         NOTE: handle is represented as HANDLE[/FWMASK].
                 FWMASK is 0xffffffff by default.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
---

diff --git a/man/man8/tc-fw.8 b/man/man8/tc-fw.8
index 711e128f1..589505aef 100644
--- a/man/man8/tc-fw.8
+++ b/man/man8/tc-fw.8
@@ -14,9 +14,15 @@ the
 .B fw
 filter allows one to classify packets based on a previously set
 .BR fwmark " by " iptables .
-If it is identical to the filter's
+If the masked value of the
+.B fwmark
+matches the filter's masked
 .BR handle ,
-the filter matches.
+the filter matches. By default, all 32 bits of the
+.B handle
+and the
+.B fwmark
+are masked.
 .B iptables
 allows one to mark single packets with the
 .B MARK
@@ -60,7 +66,39 @@ statement marking packets coming in on eth0:
 iptables -t mangle -A PREROUTING -i eth0 -j MARK --set-mark 6
 .EE
 .RE
+
+Specific bits of the packet's
+.B fwmark
+can be set using the
+.B skbedit
+action. For example, to only set one bit of the
+.B fwmark
+without changing any other bit:
+
+.RS
+.EX
+tc filter add ... action skbedit mark 0x8/0x8
+.EE
+.RE
+
+The
+.B fw
+filter can then be used to match on this bit by masking the
+.B handle:
+
+.RS
+.EX
+tc filter add ... handle 0x8/0x8 fw action drop
+.EE
+.RE
+
+This is useful when different bits of the
+.B fwmark
+are assigned different meanings.
+.EE
+.RE
 .SH SEE ALSO
 .BR tc (8),
 .BR iptables (8),
-.BR iptables-extensions (8)
+.BR iptables-extensions (8),
+.BR tc-skbedit (8)