summaryrefslogtreecommitdiffstats
path: root/tests
diff options
context:
space:
mode:
authorAnders K. Pedersen <akp@cohaesio.com>2016-10-28 05:56:32 +0000
committerPablo Neira Ayuso <pablo@netfilter.org>2016-10-28 11:05:11 +0200
commitdfd92948a0a88a9f245e71c1cfb63ae670e6e7c1 (patch)
tree2e7f4e7232562499a9eb77de1e40990e0e6f6c02 /tests
parent93d44351bbe2b4cf6b567e3b356ff797866cdc04 (diff)
rt: introduce routing expression
Introduce rt expression for routing related data with support for nexthop (i.e. the directly connected IP address that an outgoing packet is sent to), which can be used either for matching or accounting, eg. # nft add rule filter postrouting \ ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop This will drop any traffic to 192.168.1.0/24 that is not routed via 192.168.0.1. # nft add rule filter postrouting \ flow table acct { rt nexthop timeout 600s counter } # nft add rule ip6 filter postrouting \ flow table acct { rt nexthop timeout 600s counter } These rules count outgoing traffic per nexthop. Note that the timeout releases an entry if no traffic is seen for this nexthop within 10 minutes. # nft add rule inet filter postrouting \ ether type ip \ flow table acct { rt nexthop timeout 600s counter } # nft add rule inet filter postrouting \ ether type ip6 \ flow table acct { rt nexthop timeout 600s counter } Same as above, but via the inet family, where the ether type must be specified explicitly. "rt classid" is also implemented identical to "meta rtclassid", since it is more logical to have this match in the routing expression going forward. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests')
-rw-r--r--tests/files/expr-rt21
-rwxr-xr-xtests/shell/run-tests.sh2
2 files changed, 22 insertions, 1 deletions
diff --git a/tests/files/expr-rt b/tests/files/expr-rt
new file mode 100644
index 00000000..4c154091
--- /dev/null
+++ b/tests/files/expr-rt
@@ -0,0 +1,21 @@
+#! nft -f
+
+add table ip filter
+add chain ip filter output { type filter hook output priority 0 ; }
+
+add table ip6 filter
+add chain ip6 filter output { type filter hook output priority 0 ; }
+
+add table inet filter
+add chain inet filter output { type filter hook output priority 0 ; }
+
+# rt: classid (see /etc/iproute2/rt_realms)
+add rule ip filter output rt classid cosmos counter
+add rule ip6 filter output rt classid cosmos counter
+add rule inet filter output rt classid cosmos counter
+
+# rt: nexthop
+add rule ip filter output rt nexthop 192.168.0.1 counter
+add rule ip6 filter output rt nexthop fd00::1 counter
+add rule inet filter output ether type ip rt nexthop 192.168.0.1 counter
+add rule inet filter output ether type ip6 rt nexthop fd00::1 counter
diff --git a/tests/shell/run-tests.sh b/tests/shell/run-tests.sh
index ff243444..d9c44c80 100755
--- a/tests/shell/run-tests.sh
+++ b/tests/shell/run-tests.sh
@@ -57,7 +57,7 @@ kernel_cleanup() {
nft_exthdr nft_payload nft_cmp nft_range \
nft_quota nft_queue nft_numgen \
nft_meta nft_meta_bridge nft_counter nft_log nft_limit \
- nft_hash nft_ct nft_compat \
+ nft_hash nft_ct nft_compat nft_rt \
nft_set_hash nft_set_rbtree \
nft_chain_nat_ipv4 nft_chain_nat_ipv6 \
nf_tables_inet nf_tables_bridge nf_tables_arp \