From dfd92948a0a88a9f245e71c1cfb63ae670e6e7c1 Mon Sep 17 00:00:00 2001
From: "Anders K. Pedersen" <akp@cohaesio.com>
Date: Fri, 28 Oct 2016 05:56:32 +0000
Subject: rt: introduce routing expression

Introduce rt expression for routing related data with support for nexthop
(i.e. the directly connected IP address that an outgoing packet is sent
to), which can be used either for matching or accounting, eg.

 # nft add rule filter postrouting \
	ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop

This will drop any traffic to 192.168.1.0/24 that is not routed via
192.168.0.1.

 # nft add rule filter postrouting \
	flow table acct { rt nexthop timeout 600s counter }
 # nft add rule ip6 filter postrouting \
	flow table acct { rt nexthop timeout 600s counter }

These rules count outgoing traffic per nexthop. Note that the timeout
releases an entry if no traffic is seen for this nexthop within 10 minutes.

 # nft add rule inet filter postrouting \
	ether type ip \
	flow table acct { rt nexthop timeout 600s counter }
 # nft add rule inet filter postrouting \
	ether type ip6 \
	flow table acct { rt nexthop timeout 600s counter }

Same as above, but via the inet family, where the ether type must be
specified explicitly.

"rt classid" is also implemented identical to "meta rtclassid", since it
is more logical to have this match in the routing expression going forward.

Signed-off-by: Anders K. Pedersen <akp@cohaesio.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 doc/nft.xml | 84 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 84 insertions(+)

(limited to 'doc')

diff --git a/doc/nft.xml b/doc/nft.xml
index 3b215f8c..e6b98ae7 100644
--- a/doc/nft.xml
+++ b/doc/nft.xml
@@ -1222,6 +1222,90 @@ filter output oif eth0
 				</example>
 			</para>
 		</refsect2>
+
+		<refsect2>
+			<title>Routing expressions</title>
+			<para>
+				<cmdsynopsis>
+					<command>rt</command>
+					<group choice="req">
+						<arg>classid</arg>
+						<arg>nexthop</arg>
+					</group>
+				</cmdsynopsis>
+			</para>
+			<para>
+				A routing expression refers to routing data associated with a packet.
+			</para>
+			<para>
+				<table frame="all">
+					<title>Routing expression types</title>
+					<tgroup cols='4' align='left' colsep='1' rowsep='1'>
+						<colspec colname='c1'/>
+						<colspec colname='c2'/>
+						<colspec colname='c3'/>
+						<thead>
+							<row>
+								<entry>Keyword</entry>
+								<entry>Description</entry>
+								<entry>Type</entry>
+							</row>
+						</thead>
+						<tbody>
+							<row>
+								<entry>classid</entry>
+								<entry>Routing realm</entry>
+								<entry>realm</entry>
+							</row>
+							<row>
+								<entry>nexthop</entry>
+								<entry>Routing nexthop</entry>
+								<entry>ipv4_addr/ipv6_addr</entry>
+							</row>
+						</tbody>
+					</tgroup>
+				</table>
+			</para>
+			<para>
+				<table frame="all">
+					<title>Routing expression specific types</title>
+					<tgroup cols='2' align='left' colsep='1' rowsep='1'>
+						<colspec colname='c1'/>
+						<colspec colname='c2'/>
+						<thead>
+							<row>
+								<entry>Type</entry>
+								<entry>Description</entry>
+							</row>
+						</thead>
+						<tbody>
+							<row>
+								<entry>realm</entry>
+								<entry>
+									Routing Realm (32 bit number). Can be specified numerically
+									or as symbolic name defined in /etc/iproute2/rt_realms.
+								</entry>
+							</row>
+						</tbody>
+					</tgroup>
+				</table>
+			</para>
+			<para>
+				<example>
+					<title>Using routing expressions</title>
+					<programlisting>
+# IP family independent rt expression
+filter output rt classid 10
+
+# IP family dependent rt expressions
+ip filter output rt nexthop 192.168.0.1
+ip6 filter output rt nexthop fd00::1
+inet filter ether type ip output rt nexthop 192.168.0.1
+inet filter ether type ip6 output rt nexthop fd00::1
+					</programlisting>
+				</example>
+			</para>
+		</refsect2>
 	</refsect1>
 
 	<refsect1>
-- 
cgit v1.2.3