lib: matcher: add ip6.traffic_class matcher #369

JonSnow1807 · 2026-01-15T04:01:19Z

Summary

Add new ip6.traffic_class matcher to filter packets by IPv6 Traffic Class field
Supports eq and not operators
Accepts decimal (0-255) or hexadecimal (0x00-0xff) values
Uses byte loads for endianness-safe BPF code generation

Example usage

rule ip6.traffic_class eq 16 ACCEPT
rule ip6.traffic_class not 0 DROP

Changes

matcher.h: Added BF_MATCHER_IP6_TRAFFIC_CLASS enum
matcher.c: Added parse/print functions and metadata
ip6.c: Added BPF code generation (byte loads for portability)
program.c: Added switch case routing
lexer.l: Added CLI parsing support
tests/: Added unit tests

Closes #361

qdeslandes

Thanks for working on this task! Overall, it looks good, except for a few changes.

Some more comments:

Rename the matcher to ip6.dscp, so we align with nftables
Format the code properly (make fixstyle)
Add end-to-end tests for the matcher (tests/e2e/matchers)

qdeslandes · 2026-01-15T20:37:27Z

src/bfcli/lexer.l

 %s STATE_MATCHER_ICMP_TYPE
 %s STATE_MATCHER_ICMP_CODE
 %s STATE_MATCHER_TCP_FLAGS
+%s STATE_MATCHER_IP6_TRAFFIC_CLASS


Move this to after STATE_MATCHER_IP6_NET.

qdeslandes · 2026-01-15T20:44:41Z

src/bpfilter/cgen/matcher/ip6.c

+static int _bf_matcher_generate_ip6_traffic_class(struct bf_program *program,
+                                                  const struct bf_matcher *matcher)
+{
+    bf_assert(program && matcher);


assert(program); assert(matcher);

qdeslandes · 2026-01-15T20:45:14Z

src/bpfilter/cgen/matcher/ip6.c

+{
+    bf_assert(program && matcher);
+
+    uint8_t tc = *(uint8_t *)bf_matcher_payload(matcher);


Define this variable before assert().

qdeslandes · 2026-01-15T20:49:24Z

src/bpfilter/cgen/matcher/ip6.c

+    /* Load byte 0 and extract traffic class high nibble */
+    EMIT(program, BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_6, 0));
+    EMIT(program, BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x0F));
+    EMIT(program, BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 4));
+
+    /* Load byte 1 and extract traffic class low nibble */
+    EMIT(program, BPF_LDX_MEM(BPF_B, BPF_REG_2, BPF_REG_6, 1));
+    EMIT(program, BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 4));
+
+    /* Combine: tc = tc_high << 4 | tc_low */
+    EMIT(program, BPF_ALU64_REG(BPF_OR, BPF_REG_1, BPF_REG_2));
+
+    EMIT_FIXUP_JMP_NEXT_RULE(
+        program,
+        BPF_JMP_IMM(bf_matcher_get_op(matcher) == BF_MATCHER_EQ ? BPF_JNE :
+                                                                  BPF_JEQ,
+                    BPF_REG_1, tc, 0));


This can be improved:

Load 2 bytes from index 0

Mask out irrelevant bits & 0xff0

Compare against tc << 4

qdeslandes · 2026-01-15T20:52:52Z

src/libbpfilter/matcher.c

+static int _bf_parse_traffic_class(enum bf_matcher_type type,
+                                   enum bf_matcher_op op, void *payload,
+                                   const char *raw_payload)
+{
+    bf_assert(payload && raw_payload);
+
+    unsigned long tc;
+    char *endptr;
+
+    tc = strtoul(raw_payload, &endptr, BF_BASE_10);
+    if (*endptr == '\0' && tc <= UINT8_MAX) {
+        *(uint8_t *)payload = (uint8_t)tc;
+        return 0;
+    }
+
+    tc = strtoul(raw_payload, &endptr, BF_BASE_16);
+    if (*endptr == '\0' && tc <= UINT8_MAX) {
+        *(uint8_t *)payload = (uint8_t)tc;
+        return 0;
+    }
+
+    bf_err(
+        "\"%s %s\" expects a decimal or hexadecimal traffic class value (0-255), not '%s'",
+        bf_matcher_type_to_str(type), bf_matcher_op_to_str(op), raw_payload);
+
+    return -EINVAL;
+}
+
+static void _bf_print_traffic_class(const void *payload)
+{
+    bf_assert(payload);
+
+    (void)fprintf(stdout, "0x%02" PRIx8, *(uint8_t *)payload);
+}
+


It would be worth creating more generic parsing/printing functions (i.e. _bf_parse_u8) that we could reuse later on (e.g. instead of _bf_parse_icmp_code).

qdeslandes · 2026-01-15T20:58:20Z

tests/unit/libbpfilter/matcher.c

    bf_matcher_dump(matcher, &prefix);
 }

+static void ip6_traffic_class(void **state)


Test for unsupported values, extreme values, and add a test for the print function.

Address review feedback for PR facebook#369: - Rename BF_MATCHER_IP6_TRAFFIC_CLASS to BF_MATCHER_IP6_DSCP - Rename ip6.traffic_class to ip6.dscp in lexer and strings - Move lexer state after STATE_MATCHER_IP6_NET - Simplify BPF code: load 2 bytes from offset 0, mask with 0x0ff0, compare against dscp << 4 - Split bf_assert(program && matcher) into separate assert() calls - Use generic _bf_parse_u8/_bf_print_u8 functions - Add comprehensive unit tests (hex input, error cases, extreme values) - Add e2e test file tests/e2e/matchers/ip6_dscp.sh

JonSnow1807 · 2026-01-16T04:50:10Z

Thanks for the review! I've addressed all the feedback:

Renamed matcher to ip6.dscp to align with nftables
Moved lexer state after STATE_MATCHER_IP6_NET
Split assertions into separate assert() calls
Moved variable declaration before assertions
Simplified BPF code: load 2 bytes, mask with 0x0ff0, compare against dscp << 4
Created generic _bf_parse_u8 and _bf_print_u8 functions
Added e2e tests (tests/e2e/matchers/ip6_dscp.sh)
Added comprehensive unit tests (error cases, extreme values, print function)

Ready for re-review!

src/libbpfilter/matcher.c

qdeslandes · 2026-01-16T08:26:37Z

src/bpfilter/cgen/program.c

        case BF_MATCHER_IP6_DADDR:
        case BF_MATCHER_IP6_DNET:
        case BF_MATCHER_IP6_NEXTHDR:
+        case BF_MATCHER_IP6_TRAFFIC_CLASS:


You need to rename this.

qdeslandes · 2026-01-16T08:28:18Z

Similarly to #364 all these changes should be in a single commit.

JonSnow1807 · 2026-01-16T23:21:25Z

Updated:

Renamed enum to BF_MATCHER_IP6_DSCP in program.c
Squashed all changes into a single commit

Ready for re-review!

qdeslandes

LGTM, except for this last change. You will also need to rebase on main.

qdeslandes · 2026-01-22T13:26:34Z

tests/e2e/matchers/ip6_dscp.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash


This file must be added to tests/e2e/CMakeLists.txt.

JonSnow1807 · 2026-01-23T07:28:14Z

Rebased on main and added ip6_dscp.sh to CMakeLists.txt.

qdeslandes

Last change, otherwise LGTM!

qdeslandes · 2026-01-23T09:12:17Z

src/libbpfilter/matcher.c

    assert(payload);
    assert(raw_payload);

+


Remove the extra line.

Add new ip6.dscp matcher to filter packets by IPv6 DSCP field. Supports eq and not operators with decimal (0-255) or hex (0x00-0xff) values. Changes: - Add BF_MATCHER_IP6_DSCP enum in matcher.h - Add generic _bf_parse_u8/_bf_print_u8 functions in matcher.c - Add simplified BPF code in ip6.c (load 2 bytes, mask 0x0ff0, compare dscp<<4) - Add switch case in program.c - Add CLI parsing in lexer.l (state after IP6_NET) - Add e2e tests (tests/e2e/matchers/ip6_dscp.sh) - Add comprehensive unit tests Example: rule ip6.dscp eq 46 ACCEPT Closes facebook#361

qdeslandes

LGTM, thanks!

JonSnow1807 requested a review from qdeslandes as a code owner January 15, 2026 04:01

meta-cla bot added the cla signed label Jan 15, 2026

qdeslandes requested changes Jan 15, 2026

View reviewed changes

qdeslandes mentioned this pull request Jan 15, 2026

lib: matcher: add ip4.tos matcher #364

Merged

qdeslandes requested changes Jan 16, 2026

View reviewed changes

JonSnow1807 force-pushed the add-ip6-traffic-class-matcher branch from d50339d to bd23ec8 Compare January 16, 2026 23:00

qdeslandes mentioned this pull request Jan 21, 2026

Support keyword-based DSCP values #383

Open

qdeslandes requested changes Jan 22, 2026

View reviewed changes

tests/e2e/matchers/ip6_dscp.sh

@@ -0,0 +1,40 @@

#!/usr/bin/env bash

Copy link

Contributor

qdeslandes Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file must be added to tests/e2e/CMakeLists.txt.

JonSnow1807 force-pushed the add-ip6-traffic-class-matcher branch from bd23ec8 to 629c9b3 Compare January 23, 2026 07:09

qdeslandes requested changes Jan 23, 2026

View reviewed changes

src/libbpfilter/matcher.c Outdated

assert(payload);

assert(raw_payload);

Copy link

Contributor

qdeslandes Jan 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove the extra line.

JonSnow1807 force-pushed the add-ip6-traffic-class-matcher branch from 629c9b3 to 864f807 Compare January 23, 2026 16:25

qdeslandes approved these changes Jan 23, 2026

View reviewed changes

qdeslandes merged commit 4fbd786 into facebook:main Jan 23, 2026
29 checks passed

lib: matcher: add ip6.traffic_class matcher #369

lib: matcher: add ip6.traffic_class matcher #369

Conversation

JonSnow1807 commented Jan 15, 2026

Summary

Example usage

Changes

Uh oh!

qdeslandes left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qdeslandes Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JonSnow1807 commented Jan 16, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qdeslandes commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JonSnow1807 commented Jan 16, 2026

Uh oh!

qdeslandes left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JonSnow1807 commented Jan 23, 2026

Uh oh!

qdeslandes left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qdeslandes left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

qdeslandes left a comment •

edited

Loading

qdeslandes Jan 15, 2026 •

edited

Loading

qdeslandes commented Jan 16, 2026 •

edited

Loading