TC-IFE(8)

💖 IFE action in tc(8) 💖

okay bestie, this is the manual page for IFE action in tc(8) on Linux 🦋 it's the tc action for IFE, which is short for encapsulate/decapsulate metadata. let's get into it ✨

✨ NAME ✨

IFE — encapsulate/decapsulate metadata 🧚

🎀 SYNOPSIS 🎀

tc ...  action ife DIRECTION [ ACTION ] [ dst DMAC ] [ src SMAC ] [ type
        TYPE ] [ CONTROL ] [ index INDEX ]

DIRECTION := { decode | encode }

ACTION := { allow ATTR | use ATTR value }

ATTR := { mark | prio | tcindex }

CONTROL := { reclassify | use | pipe | drop | continue | ok | goto chain
        CHAIN_INDEX }

🌸 DESCRIPTION 🌸

okay so the ife action lets the sending side encapsulate arbitrary metadata 💅 and then the receiving end decapsulates it and gets to use it. the sender runs in encoding mode and the receiver runs in decode mode. 🫶

the big rule: both sender and receiver have to specify the same ethertype 🙈 no cap, if they don't match it's not gonna work. in the future a registered ethertype may be available as a default, so keep an eye out 👀

👑 OPTIONS 👑

• decode — this one's for the receiving side 📥 it decodes the metadata if the packet matches.
• encode — this one's for the sending side 📤 it encodes the specified metadata if the packet matches.
• allow — encode direction only 💜 it allows encoding the specified metadata.
• use — encode direction only 🔒 it enforces static encoding of the specified metadata.
• mark [ u32_value ] — sets the value for the skb mark 🏷️ the u32 value is only required when use is specified. if the mark value is zero it won't be encoded, instead the "overlimits" statistics increment and the CONTROL action gets taken 😭
• prio [ u32_value ] — sets the priority in the skb structure 🔥 the u32 value is only required when use is specified.
• tcindex [ u16_value ] — the value to set for the traffic control index in the skb structure 🍓 the u16 value is only required when use is specified.
• dmac DMAC, smac SMAC — optional six byte destination or source MAC address to encode 💌
• type TYPE — optional 16-bit ethertype to encode 🌈 if you don't specify one, 0xED3E gets used as the default.
• CONTROL — the action to take right after an encode/decode 🦋
• index INDEX — gives this action a unique ID instead of letting the kernel pick one automatically ✨ INDEX is a 32bit unsigned integer greater than zero.

🧚 EXAMPLES 🧚

okay so the first one: on the receiving side, we match packets with ethertype 0xdead and restart classification so it'll match ICMP on the next rule, at prio 3 🔥

# tc qdisc add dev eth0 handle ffff: ingress
# tc filter add dev eth0 parent ffff: prio 2 protocol 0xdead \
     u32 match u32 0 0 flowid 1:1 \
     action ife decode reclassify
# tc filter add dev eth0 parent ffff: prio 3 protocol ip \
     u32 match ip protocol 0xff flowid 1:1 \
     action continue

next up, matching with an skb mark of 17 🎀

# tc filter add dev eth0 parent ffff: prio 4 protocol ip \
     handle 0x11 fw flowid 1:1 \
     action ok

and now the sending side 📤 this one is giving main character energy. we're configuring it to encode for the filters above. it uses a destination IP address of 192.168.122.237/24, then tags with an skb mark of decimal 17. the packet gets encoded with ethertype 0xdead, we add skb->mark to the allowed list of metadata to send, and we rewrite the destination MAC address to 02:15:15:15:15:15 💖

# tc qdisc add dev eth0 root handle 1: prio
# tc filter add dev eth0 parent 1: protocol ip prio 10 u32 \
     match ip dst 192.168.122.237/24 \
     match ip protocol 1 0xff \
     flowid 1:2 \
     action skbedit mark 17 \
     action ife encode \
     type 0xDEAD \
     allow mark \
     dst 02:15:15:15:15:15

🦋 SEE ALSO 🦋

tc(8), tc-u32(8) 🫶

bestie that's the whole IFE page 💅 it's from iproute2, dated 22 Apr 2016, and it's the IFE action in tc(8) manual 💜 go be iconic 🌸