From: Anders K. Pedersen <akp@xxxxxxxxxxxx>
Add nftables inet family support for an rt nexthop expression allowing
usage of the routing nexthop (i.e. the directly connected IP address that
an outgoing packet is sent to) for matching or accounting, eg.
# nft add rule inet filter postrouting \
ether type ip6 \
ip6 daddr fd01::/16 rt ip6 nexthop != fd00::1 drop
This will drop any traffic to fd01::/16 that is not routed via fd00::1.
Note that "ether type" must be specified explicitly, when rt nexthop is
used from inet family tables.
# nft add rule inet filter postrouting \
ether type ip \
flow table acct { rt ip nexthop timeout 600s counter }
# nft add rule inet filter postrouting \
ether type ip6 \
flow table acct { rt ip6 nexthop6 timeout 600s counter }
These rules count outgoing traffic per nexthop. Note that the timeout
releases an entry if no traffic is seen for this nexthop within 10 minutes.
Signed-off-by: Anders K. Pedersen <akp@xxxxxxxxxxxx>
---
v3
- use init and eval functions from nft_rt_ipv4 and nft_rt_ipv6
v2
- remove nft_rt_inet_select_ops
net/netfilter/Kconfig | 7 ++
net/netfilter/Makefile | 1 +
net/netfilter/nft_rt_inet.c | 99 ++++++++++++++++++++++
3 files changed, 107 insertions(+)
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index e8d56d9..9ef642e 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -480,6 +480,13 @@ config NFT_META
This option adds the "rt" expression that you can use to match
packet routing information such as the packet nexthop.
+config NFT_RT_INET
+ depends on NF_TABLES_INET
+ default NFT_RT
+ select NFT_RT_IPV4
+ select NFT_RT_IPV6
+ tristate
+
config NFT_NUMGEN
tristate "Netfilter nf_tables number generator module"
help
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index c23c3c8..f3a0c59 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -82,6 +82,7 @@ obj-$(CONFIG_NF_TABLES_NETDEV) += nf_tables_netdev.o
obj-$(CONFIG_NFT_EXTHDR) += nft_exthdr.o
obj-$(CONFIG_NFT_META) += nft_meta.o
obj-$(CONFIG_NFT_RT) += nft_rt.o
+obj-$(CONFIG_NFT_RT_INET) += nft_rt_inet.o
obj-$(CONFIG_NFT_NUMGEN) += nft_numgen.o
obj-$(CONFIG_NFT_CT) += nft_ct.o
obj-$(CONFIG_NFT_LIMIT) += nft_limit.o
diff --git a/net/netfilter/nft_rt_inet.c b/net/netfilter/nft_rt_inet.c
new file mode 100644
index 0000000..ba9f51f
--- /dev/null
+++ b/net/netfilter/nft_rt_inet.c
@@ -0,0 +1,99 @@
+/*
+ * Copyright (c) 2016 Anders K. Pedersen <akp@xxxxxxxxxxxx>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nft_rt.h>
+#include <net/netfilter/ipv4/nft_rt.h>
+#include <net/netfilter/ipv6/nft_rt.h>
+
+static void nft_rt_inet_get_eval(const struct nft_expr *expr,
+ struct nft_regs *regs,
+ const struct nft_pktinfo *pkt)
+{
+ const struct nft_rt *priv = nft_expr_priv(expr);
+
+ if (unlikely(priv->family != NFPROTO_UNSPEC &&
+ pkt->pf != priv->family)) {
+ printk_once(KERN_WARNING KBUILD_MODNAME
+ " address families do not match\n");
+ goto err;
+ }
+
+ switch (priv->family) {
+ case NFPROTO_IPV4:
+ return nft_rt_ipv4_get_eval(expr, regs, pkt);
+ case NFPROTO_IPV6:
+ return nft_rt_ipv6_get_eval(expr, regs, pkt);
+ default:
+ return nft_rt_get_eval(expr, regs, pkt);
+ }
+err:
+ regs->verdict.code = NFT_BREAK;
+}
+
+static int nft_rt_inet_get_init(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nlattr * const tb[])
+{
+ struct nft_rt *priv = nft_expr_priv(expr);
+
+ if (tb[NFTA_RT_FAMILY] == NULL)
+ return -EINVAL;
+
+ priv->family = ntohl(nla_get_be32(tb[NFTA_RT_FAMILY]));
+ switch (priv->family) {
+ case NFPROTO_IPV4:
+ return nft_rt_ipv4_get_init(ctx, expr, tb);
+ case NFPROTO_IPV6:
+ return nft_rt_ipv6_get_init(ctx, expr, tb);
+ default:
+ return nft_rt_get_init(ctx, expr, tb);
+ }
+}
+
+static struct nft_expr_type nft_rt_inet_type;
+static const struct nft_expr_ops nft_rt_inet_get_ops = {
+ .type = &nft_rt_inet_type,
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_rt)),
+ .eval = nft_rt_inet_get_eval,
+ .init = nft_rt_inet_get_init,
+ .dump = nft_rt_get_dump,
+};
+
+static struct nft_expr_type nft_rt_inet_type __read_mostly = {
+ .family = NFPROTO_INET,
+ .name = "rt",
+ .ops = &nft_rt_inet_get_ops,
+ .policy = nft_rt_policy,
+ .maxattr = NFTA_RT_MAX,
+ .owner = THIS_MODULE,
+};
+
+static int __init nft_rt_inet_module_init(void)
+{
+ return nft_register_expr(&nft_rt_inet_type);
+}
+
+static void __exit nft_rt_inet_module_exit(void)
+{
+ nft_unregister_expr(&nft_rt_inet_type);
+}
+
+module_init(nft_rt_inet_module_init);
+module_exit(nft_rt_inet_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Anders K. Pedersen <akp@xxxxxxxxxxxx>");
+MODULE_ALIAS_NFT_AF_EXPR(1, "rt");
��.n��������+%������w��{.n����z�����n�r������&��z�ޗ�zf���h���~����������_��+v���)ߣ�
