kybaaz/linux-xiaomi-chiron
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

netfilter: nf_tables: introduce routing expression

Browse source 
Introduces an nftables rt expression for routing related data with support
for nexthop (i.e. the directly connected IP address that an outgoing packet
is sent to), which can be used either for matching or accounting, eg.

 # nft add rule filter postrouting \
	ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop

This will drop any traffic to 192.168.1.0/24 that is not routed via
192.168.0.1.

 # nft add rule filter postrouting \
	flow table acct { rt nexthop timeout 600s counter }
 # nft add rule ip6 filter postrouting \
	flow table acct { rt nexthop timeout 600s counter }

These rules count outgoing traffic per nexthop. Note that the timeout
releases an entry if no traffic is seen for this nexthop within 10 minutes.

 # nft add rule inet filter postrouting \
	ether type ip \
	flow table acct { rt nexthop timeout 600s counter }
 # nft add rule inet filter postrouting \
	ether type ip6 \
	flow table acct { rt nexthop timeout 600s counter }

Same as above, but via the inet family, where the ether type must be
specified explicitly.

"rt classid" is also implemented identical to "meta rtclassid", since it
is more logical to have this match in the routing expression going forward.

Signed-off-by: Anders K. Pedersen <akp@cohaesio.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Anders K. Pedersen 2016-10-28 05:54:15 +00:00 • committed by Pablo Neira Ayuso
parent 8db4c5be88
commit 2fa841938c
4 changed files with 187 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

27
include/uapi/linux/netfilter/nf_tables.h
View file

@ -758,6 +758,19 @@ enum nft_meta_keys {
NFT_META_PRANDOM,
};
/**
* enum nft_rt_keys - nf_tables routing expression keys
*
* @NFT_RT_CLASSID: realm value of packet's route (skb->dst->tclassid)
* @NFT_RT_NEXTHOP4: routing nexthop for IPv4
* @NFT_RT_NEXTHOP6: routing nexthop for IPv6
*/
enum nft_rt_keys {
NFT_RT_CLASSID,
NFT_RT_NEXTHOP4,
NFT_RT_NEXTHOP6,
};
/**
* enum nft_hash_attributes - nf_tables hash expression netlink attributes
*
@ -796,6 +809,20 @@ enum nft_meta_attributes {
};
#define NFTA_META_MAX (__NFTA_META_MAX - 1)
/**
* enum nft_rt_attributes - nf_tables routing expression netlink attributes
*
* @NFTA_RT_DREG: destination register (NLA_U32)
* @NFTA_RT_KEY: routing data item to load (NLA_U32: nft_rt_keys)
*/
enum nft_rt_attributes {
NFTA_RT_UNSPEC,
NFTA_RT_DREG,
NFTA_RT_KEY,
__NFTA_RT_MAX
};
#define NFTA_RT_MAX (__NFTA_RT_MAX - 1)
/**
* enum nft_ct_keys - nf_tables ct expression keys
*