with meta nfproto, which generates a bit fewer instructions.
Signed-off-by: Anders K. Pedersen <akp@cohaesio.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
<para>
<table frame="all">
<title>Routing expression types</title>
- <tgroup cols='4' align='left' colsep='1' rowsep='1'>
+ <tgroup cols='3' align='left' colsep='1' rowsep='1'>
<colspec colname='c1'/>
<colspec colname='c2'/>
<colspec colname='c3'/>
# IP family dependent rt expressions
ip filter output rt nexthop 192.168.0.1
ip6 filter output rt nexthop fd00::1
-inet filter ether type ip output rt nexthop 192.168.0.1
-inet filter ether type ip6 output rt nexthop fd00::1
+inet filter meta nfproto ipv4 output rt nexthop 192.168.0.1
+inet filter meta nfproto ipv6 output rt nexthop fd00::1
</programlisting>
</example>
</para>
err:
return expr_error(ctx->msgs, rt,
- "ether type ip or ip6 must be specified before "
- "routing expression");
+ "meta nfproto ipv4 or ipv6 must be specified "
+ "before routing expression");
}
/*
+++ /dev/null
-#! nft -f
-
-add table ip filter
-add chain ip filter output { type filter hook output priority 0 ; }
-
-add table ip6 filter
-add chain ip6 filter output { type filter hook output priority 0 ; }
-
-add table inet filter
-add chain inet filter output { type filter hook output priority 0 ; }
-
-# rt: classid (see /etc/iproute2/rt_realms)
-add rule ip filter output rt classid cosmos counter
-add rule ip6 filter output rt classid cosmos counter
-add rule inet filter output rt classid cosmos counter
-
-# rt: nexthop
-add rule ip filter output rt nexthop 192.168.0.1 counter
-add rule ip6 filter output rt nexthop fd00::1 counter
-add rule inet filter output ether type ip rt nexthop 192.168.0.1 counter
-add rule inet filter output ether type ip6 rt nexthop fd00::1 counter
--- /dev/null
+:output;type filter hook input priority 0
+
+*ip;test-ip4;output
+*ip6;test-ip6;output
+*inet;test-inet;output
+
+rt classid "cosmos";ok
--- /dev/null
+# rt classid "cosmos"
+ip test-ip4 input
+ [ rt load classid => reg 1 ]
+ [ cmp eq reg 1 0x00000000 ]
+
--- /dev/null
+:output;type filter hook input priority 0
+
+*inet;test-inet;output
+
+rt nexthop 192.168.0.1;fail
+rt nexthop fd00::1;fail
+meta nfproto ipv4 rt nexthop 192.168.0.1;ok
+meta nfproto ipv6 rt nexthop fd00::1;ok
--- /dev/null
+# meta nfproto ipv4 rt nexthop 192.168.0.1
+inet test-inet output
+ [ meta load nfproto => reg 1 ]
+ [ cmp eq reg 1 0x00000002 ]
+ [ rt load nexthop4 => reg 1 ]
+ [ cmp eq reg 1 0x0100a8c0 ]
+
+# meta nfproto ipv6 rt nexthop fd00::1
+inet test-inet output
+ [ meta load nfproto => reg 1 ]
+ [ cmp eq reg 1 0x0000000a ]
+ [ rt load nexthop6 => reg 1 ]
+ [ cmp eq reg 1 0x000000fd 0x00000000 0x00000000 0x01000000 ]
+
--- /dev/null
+:output;type filter hook input priority 0
+
+*ip;test-ip4;output
+
+rt nexthop 192.168.0.1;ok
+rt nexthop fd00::1;fail
--- /dev/null
+# rt nexthop 192.168.0.1
+ip test-ip4 output
+ [ rt load nexthop4 => reg 1 ]
+ [ cmp eq reg 1 0x0100a8c0 ]
+
--- /dev/null
+:output;type filter hook input priority 0
+
+*ip6;test-ip6;output
+
+rt nexthop 192.168.0.1;fail
+rt nexthop fd00::1;ok
--- /dev/null
+# rt nexthop fd00::1
+ip6 test-ip6 output
+ [ rt load nexthop6 => reg 1 ]
+ [ cmp eq reg 1 0x000000fd 0x00000000 0x00000000 0x01000000 ]
+