rt: introduce routing expression

Introduce rt expression for routing related data with support for nexthop
(i.e. the directly connected IP address that an outgoing packet is sent
to), which can be used either for matching or accounting, eg.

 # nft add rule filter postrouting \
	ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop

This will drop any traffic to 192.168.1.0/24 that is not routed via
192.168.0.1.

 # nft add rule filter postrouting \
	flow table acct { rt nexthop timeout 600s counter }
 # nft add rule ip6 filter postrouting \
	flow table acct { rt nexthop timeout 600s counter }

These rules count outgoing traffic per nexthop. Note that the timeout
releases an entry if no traffic is seen for this nexthop within 10 minutes.

 # nft add rule inet filter postrouting \
	ether type ip \
	flow table acct { rt nexthop timeout 600s counter }
 # nft add rule inet filter postrouting \
	ether type ip6 \
	flow table acct { rt nexthop timeout 600s counter }

Same as above, but via the inet family, where the ether type must be
specified explicitly.

"rt classid" is also implemented identical to "meta rtclassid", since it
is more logical to have this match in the routing expression going forward.

Signed-off-by: Anders K. Pedersen <akp@cohaesio.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 33 insertions, 0 deletions

diff --git a/include/rt.h b/include/rt.h
new file mode 100644
index 00000000..728cf5f0
--- /dev/null
+++ b/include/rt.h
@@ -0,0 +1,33 @@
+#ifndef NFTABLES_RT_H
+#define NFTABLES_RT_H
+
+/**
+ * struct rt_template - template for routing expressions
+ *
+ * @token:	parser token for the expression
+ * @dtype:	data type of the expression
+ * @len:	length of the expression
+ * @byteorder:	byteorder
+ * @invalid:	invalidate datatype on allocation from parser
+ */
+struct rt_template {
+	const char		*token;
+	const struct datatype	*dtype;
+	unsigned int		len;
+	enum byteorder		byteorder;
+	bool			invalid;
+};
+
+#define RT_TEMPLATE(__token, __dtype, __len, __byteorder, __invalid) {	\
+	.token		= (__token),					\
+	.dtype		= (__dtype),					\
+	.len		= (__len),					\
+	.byteorder	= (__byteorder),				\
+	.invalid	= (__invalid),					\
+}
+
+extern struct expr *rt_expr_alloc(const struct location *loc,
+				  enum nft_rt_keys key, bool invalid);
+extern void rt_expr_update_type(struct proto_ctx *ctx, struct expr *expr);
+
+#endif /* NFTABLES_RT_H */