luci-app-tcfilter: add tc ingress filter management - #9004
Open
mab-wien wants to merge 1 commit into
Open
Conversation
jow-
reviewed
Sep 4, 2026
mab-wien
force-pushed
the
luci-app-tcfilter
branch
from
September 4, 2026 11:07
5b36799 to
da896fc
Compare
Author
|
@jow- following up on the ACL scoping fix — let me know if there's anything else, or if you have a moment to finalize the review. |
openwrt-ai
reviewed
Sep 4, 2026
mab-wien
force-pushed
the
luci-app-tcfilter
branch
from
September 4, 2026 16:23
da896fc to
7dfde07
Compare
openwrt-ai
reviewed
Sep 5, 2026
openwrt-ai
left a comment
openwrt-ai
left a comment
Collaborator
There was a problem hiding this comment.
Commit checks
- 7dfde07 "luci-app-tcfilter: add tc ingress filter management" — the last two paragraphs describe review-round deltas ("uses
widgets.DeviceSelectinstead of a hand-rolledfs.list", "are now passed as single-element arrays", "the German .po is dropped") against code that never existed in the tree. For a single new-package commit, describe the end state instead.
Generated by Claude Code
mab-wien
force-pushed
the
luci-app-tcfilter
branch
from
September 6, 2026 06:10
7dfde07 to
3b15c65
Compare
Author
|
Addressed the remaining review notes:
Only the one-line @jow- ready for another look. |
mab-wien
added a commit
to mab-wien/openwrt
that referenced
this pull request
Sep 6, 2026
Pull in the fixes made on openwrt/packages#30447 and openwrt/luci#9004 since this branch was last built: - tcfilter: Routing and Redirection submenu, SPDX header - tcfilter.config: corrected HomePlug/MediaXtream prefs (49152/49153), mDNS at 49154/49155 - hotplug-iface / hotplug-net: gate on /var/run/tcfilter.state - tcfilter.init: never truncate the state file; drop the no-op restart() - luci view: noaliases on the DeviceSelect, trailing newline luci-app-tcfilter/Makefile keeps the $(TOPDIR)/feeds/luci/luci.mk include - the package lives in package/ here, not in the luci feed. Assisted-by: Claude Code (Anthropic Claude Sonnet 5) Signed-off-by: Mark Abe <github@mab.wien>
mab-wien
force-pushed
the
luci-app-tcfilter
branch
from
September 6, 2026 07:55
3b15c65 to
1e5d406
Compare
mab-wien
added a commit
to mab-wien/openwrt
that referenced
this pull request
Sep 6, 2026
Stop keeping copies of net/tcfilter and applications/luci-app-tcfilter in this branch. The workflow now checks out a fresh openwrt/openwrt buildroot and rewrites feeds.conf to pull: packages -> mab-wien/packages;tcfilter luci -> mab-wien/luci;luci-app-tcfilter so every run builds exactly what is on the open PRs (openwrt/packages#30447, openwrt/luci#9004) - no copy to keep in sync, no drift. Adds a guard that fails if the packages don't come in from the forks, a weekly schedule and workflow_dispatch inputs for the three refs, and records all three source SHAs in the release notes. Assisted-by: Claude Code (Anthropic Claude Sonnet 5) Signed-off-by: Mark Abe <github@mab.wien>
openwrt-ai
reviewed
Sep 6, 2026
mab-wien
force-pushed
the
luci-app-tcfilter
branch
2 times, most recently
from
September 6, 2026 23:10
fd631f2 to
9243beb
Compare
openwrt-ai
reviewed
Sep 7, 2026
mab-wien
force-pushed
the
luci-app-tcfilter
branch
from
September 8, 2026 15:21
9243beb to
2fecf1c
Compare
openwrt-ai
reviewed
Sep 8, 2026
A form.Map over /etc/config/tcfilter (the tcfilter package's config) plus a live status table that polls "tc -s -j filter show dev <dev> ingress" for every device that has a rule and shows, per filter, the match, the skip_sw / skip_hw flag, whether it sits in hardware and the packet count. The device picker is widgets.DeviceSelect with noaliases set, so only real netdev names reach the tc command line. The rpcd ACL whitelists exactly one read-only call, "tc -s -j filter show dev * ingress", in the read scope; rule changes go through UCI, so nothing tc-related is granted for write. Status cells that carry live tc output or UCI values are passed to E() as single-element arrays, so they render as text nodes rather than through innerHTML. Only po/templates/tcfilter.pot is shipped; translations come in through Weblate per CONTRIBUTING.md. Assisted-by: Claude Code (Anthropic Claude Sonnet 5) Signed-off-by: Mark Abe <github@mab.wien>
mab-wien
force-pushed
the
luci-app-tcfilter
branch
from
September 8, 2026 18:12
2fecf1c to
2628325
Compare
openwrt-ai
reviewed
Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on openwrt/packages#30447 (
tcfilter).Description
form.Mapover/etc/config/tcfilter(global enable + a grid ofdevice / pref / spec / label / enabled rules) plus a live Hardware
status table that polls
tc -s -j filter show dev <dev> ingressevery5 s and shows, per rule: protocol, match summary, the
skip_sw/skip_hwflag,
in_hw, action and packet count. Save & Apply re-applies the rulesvia the
tcfilterservice's procd reload trigger.Device list from
/sys/class/net;tcis exec'd from/sbin/tc. ACL isscoped to
uci tcfilter(r/w),file liston/sys/class/netandfile execon/sbin/tc. i18n:po/with a German translation,.potgenerated by
i18n-sync.sh.Tested on realtek/rtl930x (Zyxel XGS1210-12).
Discussion / testing feedback: https://forum.openwrt.org/t/tcfilter-luci-app-tcfilter-persistent-tc-ingress-filters-with-hardware-offload-on-realtek-switches/253331