From dfd92948a0a88a9f245e71c1cfb63ae670e6e7c1 Mon Sep 17 00:00:00 2001 From: "Anders K. Pedersen" Date: Fri, 28 Oct 2016 05:56:32 +0000 Subject: rt: introduce routing expression Introduce rt expression for routing related data with support for nexthop (i.e. the directly connected IP address that an outgoing packet is sent to), which can be used either for matching or accounting, eg. # nft add rule filter postrouting \ ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop This will drop any traffic to 192.168.1.0/24 that is not routed via 192.168.0.1. # nft add rule filter postrouting \ flow table acct { rt nexthop timeout 600s counter } # nft add rule ip6 filter postrouting \ flow table acct { rt nexthop timeout 600s counter } These rules count outgoing traffic per nexthop. Note that the timeout releases an entry if no traffic is seen for this nexthop within 10 minutes. # nft add rule inet filter postrouting \ ether type ip \ flow table acct { rt nexthop timeout 600s counter } # nft add rule inet filter postrouting \ ether type ip6 \ flow table acct { rt nexthop timeout 600s counter } Same as above, but via the inet family, where the ether type must be specified explicitly. "rt classid" is also implemented identical to "meta rtclassid", since it is more logical to have this match in the routing expression going forward. Signed-off-by: Anders K. Pedersen Signed-off-by: Pablo Neira Ayuso --- src/parser_bison.y | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'src/parser_bison.y') diff --git a/src/parser_bison.y b/src/parser_bison.y index ec9052af..dc02fd23 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -338,6 +338,9 @@ static void location_update(struct location *loc, struct location *rhs, int n) %token OIFGROUP "oifgroup" %token CGROUP "cgroup" +%token CLASSID "classid" +%token NEXTHOP "nexthop" + %token CT "ct" %token DIRECTION "direction" %token STATE "state" @@ -590,6 +593,10 @@ static void location_update(struct location *loc, struct location *rhs, int n) %destructor { expr_free($$); } meta_expr %type meta_key meta_key_qualified meta_key_unqualified numgen_type +%type rt_expr +%destructor { expr_free($$); } rt_expr +%type rt_key + %type ct_expr %destructor { expr_free($$); } ct_expr %type ct_key ct_key_dir ct_key_counters @@ -1995,6 +2002,7 @@ primary_expr : symbol_expr { $$ = $1; } | payload_expr { $$ = $1; } | exthdr_expr { $$ = $1; } | meta_expr { $$ = $1; } + | rt_expr { $$ = $1; } | ct_expr { $$ = $1; } | numgen_expr { $$ = $1; } | hash_expr { $$ = $1; } @@ -2529,6 +2537,16 @@ hash_expr : JHASH expr MOD NUM SEED NUM } ; +rt_expr : RT rt_key + { + $$ = rt_expr_alloc(&@$, $2, true); + } + ; + +rt_key : CLASSID { $$ = NFT_RT_CLASSID; } + | NEXTHOP { $$ = NFT_RT_NEXTHOP4; } + ; + ct_expr : CT ct_key { $$ = ct_expr_alloc(&@$, $2, -1); -- cgit v1.2.3