From dfd92948a0a88a9f245e71c1cfb63ae670e6e7c1 Mon Sep 17 00:00:00 2001 From: "Anders K. Pedersen" Date: Fri, 28 Oct 2016 05:56:32 +0000 Subject: rt: introduce routing expression Introduce rt expression for routing related data with support for nexthop (i.e. the directly connected IP address that an outgoing packet is sent to), which can be used either for matching or accounting, eg. # nft add rule filter postrouting \ ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop This will drop any traffic to 192.168.1.0/24 that is not routed via 192.168.0.1. # nft add rule filter postrouting \ flow table acct { rt nexthop timeout 600s counter } # nft add rule ip6 filter postrouting \ flow table acct { rt nexthop timeout 600s counter } These rules count outgoing traffic per nexthop. Note that the timeout releases an entry if no traffic is seen for this nexthop within 10 minutes. # nft add rule inet filter postrouting \ ether type ip \ flow table acct { rt nexthop timeout 600s counter } # nft add rule inet filter postrouting \ ether type ip6 \ flow table acct { rt nexthop timeout 600s counter } Same as above, but via the inet family, where the ether type must be specified explicitly. "rt classid" is also implemented identical to "meta rtclassid", since it is more logical to have this match in the routing expression going forward. Signed-off-by: Anders K. Pedersen Signed-off-by: Pablo Neira Ayuso --- include/expression.h | 7 +++++++ include/linux/netfilter/nf_tables.h | 27 +++++++++++++++++++++++++++ include/rt.h | 33 +++++++++++++++++++++++++++++++++ 3 files changed, 67 insertions(+) create mode 100644 include/rt.h (limited to 'include') diff --git a/include/expression.h b/include/expression.h index eda3d98f..3ae4e804 100644 --- a/include/expression.h +++ b/include/expression.h @@ -35,6 +35,7 @@ * @EXPR_RELATIONAL: equality and relational expressions * @EXPR_NUMGEN: number generation expression * @EXPR_HASH: hash expression + * @EXPR_RT: routing expression */ enum expr_types { EXPR_INVALID, @@ -59,6 +60,7 @@ enum expr_types { EXPR_RELATIONAL, EXPR_NUMGEN, EXPR_HASH, + EXPR_RT, }; enum ops { @@ -180,6 +182,7 @@ enum expr_flags { #include #include #include +#include #include #include @@ -282,6 +285,10 @@ struct expr { enum nft_meta_keys key; enum proto_bases base; } meta; + struct { + /* EXPR_RT */ + enum nft_rt_keys key; + } rt; struct { /* EXPR_CT */ enum nft_ct_keys key; diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h index e84a9f5b..2d477847 100644 --- a/include/linux/netfilter/nf_tables.h +++ b/include/linux/netfilter/nf_tables.h @@ -752,6 +752,19 @@ enum nft_meta_keys { NFT_META_PRANDOM, }; +/** + * enum nft_rt_keys - nf_tables routing expression keys + * + * @NFT_RT_CLASSID: realm value of packet's route (skb->dst->tclassid) + * @NFT_RT_NEXTHOP4: routing nexthop for IPv4 + * @NFT_RT_NEXTHOP6: routing nexthop for IPv6 + */ +enum nft_rt_keys { + NFT_RT_CLASSID, + NFT_RT_NEXTHOP4, + NFT_RT_NEXTHOP6, +}; + /** * enum nft_hash_attributes - nf_tables hash expression netlink attributes * @@ -788,6 +801,20 @@ enum nft_meta_attributes { }; #define NFTA_META_MAX (__NFTA_META_MAX - 1) +/** + * enum nft_rt_attributes - nf_tables routing expression netlink attributes + * + * @NFTA_RT_DREG: destination register (NLA_U32) + * @NFTA_RT_KEY: routing data item to load (NLA_U32: nft_rt_keys) + */ +enum nft_rt_attributes { + NFTA_RT_UNSPEC, + NFTA_RT_DREG, + NFTA_RT_KEY, + __NFTA_RT_MAX +}; +#define NFTA_RT_MAX (__NFTA_RT_MAX - 1) + /** * enum nft_ct_keys - nf_tables ct expression keys * diff --git a/include/rt.h b/include/rt.h new file mode 100644 index 00000000..728cf5f0 --- /dev/null +++ b/include/rt.h @@ -0,0 +1,33 @@ +#ifndef NFTABLES_RT_H +#define NFTABLES_RT_H + +/** + * struct rt_template - template for routing expressions + * + * @token: parser token for the expression + * @dtype: data type of the expression + * @len: length of the expression + * @byteorder: byteorder + * @invalid: invalidate datatype on allocation from parser + */ +struct rt_template { + const char *token; + const struct datatype *dtype; + unsigned int len; + enum byteorder byteorder; + bool invalid; +}; + +#define RT_TEMPLATE(__token, __dtype, __len, __byteorder, __invalid) { \ + .token = (__token), \ + .dtype = (__dtype), \ + .len = (__len), \ + .byteorder = (__byteorder), \ + .invalid = (__invalid), \ +} + +extern struct expr *rt_expr_alloc(const struct location *loc, + enum nft_rt_keys key, bool invalid); +extern void rt_expr_update_type(struct proto_ctx *ctx, struct expr *expr); + +#endif /* NFTABLES_RT_H */ -- cgit v1.2.3