src: add ct timeout support

This patch adds support for adding, listing and deleting ct timeout
objects which can be assigned via rule to assign connection tracking
timeout policies via objref infrastructure.

 % nft add table filter
 % nft add chain filter output
 % nft add ct timeout filter test-tcp { protocol tcp \; policy = { established: 132, close: 13, close_wait: 17 } \; }
 % nft add rule filter output ct timeout set test-tcp
 % nft list ruleset

 table ip filter {
	ct timeout test-tcp {
		protocol tcp;
		l3proto ip
		policy = {established: 132, close_wait: 17, close: 13}
	}

	chain output {
		ct timeout set "test-tcp"
	}
 }

 % nft delete rule filter output handle <handle>
 % nft delete ct timeout filter test-tcp

Note: Original patch has been rework to use fixed size array for
timeouts and to validate timeout policy from the evaluation phase, once
we have access to the layer 4 protocol number. --pablo

Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 28 insertions, 0 deletions

diff --git a/include/rule.h b/include/rule.h
index cfbbcf1f..88478aa6 100644
--- a/include/rule.h
+++ b/include/rule.h
@@ -4,6 +4,8 @@
 #include <stdint.h>
 #include <nftables.h>
 #include <list.h>
+#include <netinet/in.h>
+#include <libnftnl/object.h>	/* For NFTNL_CTTIMEOUT_ARRAY_MAX. */
 
 /**
  * struct handle_spec - handle ID
@@ -324,6 +326,21 @@ struct ct_helper {
 	uint8_t l4proto;
 };
 
+struct timeout_state {
+	struct list_head head;
+	struct location location;
+	uint8_t timeout_index;
+	const char *timeout_str;
+	unsigned int timeout_value;
+};
+
+struct ct_timeout {
+	uint16_t l3proto;
+	uint8_t l4proto;
+	uint32_t timeout[NFTNL_CTTIMEOUT_ARRAY_MAX];
+	struct list_head timeout_list;
+};
+
 struct limit {
 	uint64_t	rate;
 	uint64_t	unit;
@@ -352,6 +369,7 @@ struct obj {
 		struct quota		quota;
 		struct ct_helper	ct_helper;
 		struct limit		limit;
+		struct ct_timeout	ct_timeout;
 	};
 };
 
@@ -478,6 +496,7 @@ enum cmd_obj {
 	CMD_OBJ_LIMITS,
 	CMD_OBJ_FLOWTABLE,
 	CMD_OBJ_FLOWTABLES,
+	CMD_OBJ_CT_TIMEOUT,
 };
 
 struct markup {
@@ -633,4 +652,13 @@ enum udata_set_elem_flags {
 	SET_ELEM_F_INTERVAL_OPEN	= 0x1,
 };
 
+struct timeout_protocol {
+	uint32_t array_size;
+	const char *const *state_to_name;
+	uint32_t *dflt_timeout;
+};
+
+extern struct timeout_protocol timeout_protocol[IPPROTO_MAX];
+extern int timeout_str2num(uint16_t l4proto, struct timeout_state *ts);
+
 #endif /* NFTABLES_RULE_H */