From: Anders K. Pedersen <akp@xxxxxxxxxxxx>
Add nftables IPv4 family support for an "rt ip nexthop" expression
allowing usage of the routing nexthop (i.e. the directly connected IP
address that an outgoing packet is sent to) for matching or accounting, eg.
# nft add rule filter postrouting \
ip daddr 192.168.1.0/24 rt ip nexthop != 192.168.0.1 drop
This will drop any traffic to 192.168.1.0/24 that is not routed via
192.168.0.1.
# nft add rule filter postrouting \
flow table acct { rt ip nexthop timeout 600s counter }
This rule counts outgoing traffic per nexthop. Note that the timeout
releases an entry if no traffic is seen for this nexthop within 10 minutes.
Signed-off-by: Anders K. Pedersen <akp@xxxxxxxxxxxx>
---
net/ipv4/netfilter/Kconfig | 4 +
net/ipv4/netfilter/Makefile | 1 +
net/ipv4/netfilter/nft_rt_ipv4.c | 117 ++++++++++++++++++++++++
3 files changed, 122 insertions(+)
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -42,6 +42,10 @@ config NFT_CHAIN_ROUTE_IPV4
fields such as the source, destination, type of service and
the packet mark.
+config NFT_RT_IPV4
+ default NFT_RT
+ tristate
+
config NFT_REJECT_IPV4
select NF_REJECT_IPV4
default NFT_REJECT
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -33,6 +33,7 @@ obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o
obj-$(CONFIG_NF_TABLES_IPV4) += nf_tables_ipv4.o
obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o
obj-$(CONFIG_NFT_CHAIN_NAT_IPV4) += nft_chain_nat_ipv4.o
+obj-$(CONFIG_NFT_RT_IPV4) += nft_rt_ipv4.o
obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o
obj-$(CONFIG_NFT_MASQ_IPV4) += nft_masq_ipv4.o
obj-$(CONFIG_NFT_REDIR_IPV4) += nft_redir_ipv4.o
diff --git a/net/ipv4/netfilter/nft_rt_ipv4.c b/net/ipv4/netfilter/nft_rt_ipv4.c
--- /dev/null
+++ b/net/ipv4/netfilter/nft_rt_ipv4.c
@@ -0,0 +1,117 @@
+/*
+ * Copyright (c) 2016 Anders K. Pedersen <akp@xxxxxxxxxxxx>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/route.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nft_rt.h>
+
+static void nft_rt_ipv4_get_eval(const struct nft_expr *expr,
+ struct nft_regs *regs,
+ const struct nft_pktinfo *pkt)
+{
+ const struct nft_rt *priv = nft_expr_priv(expr);
+ const struct sk_buff *skb = pkt->skb;
+ u32 *dest = ®s->data[priv->dreg];
+
+ switch (priv->key) {
+ case NFT_RT_NEXTHOP: {
+ const struct rtable *rt = skb_rtable(skb);
+
+ if (!rt)
+ goto err;
+ *dest = rt_nexthop(rt, ip_hdr(skb)->daddr);
+ break;
+ }
+ default:
+ return nft_rt_get_eval(expr, regs, pkt);
+ }
+
+ return;
+err:
+ regs->verdict.code = NFT_BREAK;
+}
+
+static int nft_rt_ipv4_get_init(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nlattr * const tb[])
+{
+ struct nft_rt *priv = nft_expr_priv(expr);
+ unsigned int len;
+
+ priv->key = ntohl(nla_get_be32(tb[NFTA_RT_KEY]));
+ switch (priv->key) {
+ case NFT_RT_NEXTHOP:
+ len = sizeof(u32);
+ break;
+ default:
+ return nft_rt_get_init(ctx, expr, tb);
+ }
+
+ priv->family = ntohl(nla_get_be32(tb[NFTA_RT_FAMILY]));
+ if (priv->family != NFPROTO_IPV4)
+ return -EINVAL;
+
+ priv->dreg = nft_parse_register(tb[NFTA_RT_DREG]);
+ return nft_validate_register_store(ctx, priv->dreg, NULL,
+ NFT_DATA_VALUE, len);
+}
+
+static struct nft_expr_type nft_rt_ipv4_type;
+static const struct nft_expr_ops nft_rt_ipv4_get_ops = {
+ .type = &nft_rt_ipv4_type,
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_rt)),
+ .eval = nft_rt_ipv4_get_eval,
+ .init = nft_rt_ipv4_get_init,
+ .dump = nft_rt_get_dump,
+};
+
+static const struct nft_expr_ops *
+nft_rt_ipv4_select_ops(const struct nft_ctx *ctx,
+ const struct nlattr * const tb[])
+{
+ if (tb[NFTA_RT_KEY] == NULL)
+ return ERR_PTR(-EINVAL);
+
+ if (tb[NFTA_RT_DREG])
+ return &nft_rt_ipv4_get_ops;
+
+ return ERR_PTR(-EINVAL);
+}
+
+static struct nft_expr_type nft_rt_ipv4_type __read_mostly = {
+ .family = NFPROTO_IPV4,
+ .name = "rt",
+ .select_ops = &nft_rt_ipv4_select_ops,
+ .policy = nft_rt_policy,
+ .maxattr = NFTA_RT_MAX,
+ .owner = THIS_MODULE,
+};
+
+static int __init nft_rt_ipv4_module_init(void)
+{
+ return nft_register_expr(&nft_rt_ipv4_type);
+}
+
+static void __exit nft_rt_ipv4_module_exit(void)
+{
+ nft_unregister_expr(&nft_rt_ipv4_type);
+}
+
+module_init(nft_rt_ipv4_module_init);
+module_exit(nft_rt_ipv4_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Anders K. Pedersen <akp@xxxxxxxxxxxx>");
+MODULE_ALIAS_NFT_AF_EXPR(AF_INET, "rt");
��.n��������+%������w��{.n����z�����n�r������&��z�ޗ�zf���h���~����������_��+v���)ߣ�
