</example>
</para>
</refsect2>
+
+ <refsect2>
+ <title>Routing expressions</title>
+ <para>
+ <cmdsynopsis>
+ <command>rt</command>
+ <group choice="req">
+ <arg>classid</arg>
+ <arg>nexthop</arg>
+ </group>
+ </cmdsynopsis>
+ </para>
+ <para>
+ A routing expression refers to routing data associated with a packet.
+ </para>
+ <para>
+ <table frame="all">
+ <title>Routing expression types</title>
+ <tgroup cols='4' align='left' colsep='1' rowsep='1'>
+ <colspec colname='c1'/>
+ <colspec colname='c2'/>
+ <colspec colname='c3'/>
+ <thead>
+ <row>
+ <entry>Keyword</entry>
+ <entry>Description</entry>
+ <entry>Type</entry>
+ </row>
+ </thead>
+ <tbody>
+ <row>
+ <entry>classid</entry>
+ <entry>Routing realm</entry>
+ <entry>realm</entry>
+ </row>
+ <row>
+ <entry>nexthop</entry>
+ <entry>Routing nexthop</entry>
+ <entry>ipv4_addr/ipv6_addr</entry>
+ </row>
+ </tbody>
+ </tgroup>
+ </table>
+ </para>
+ <para>
+ <table frame="all">
+ <title>Routing expression specific types</title>
+ <tgroup cols='2' align='left' colsep='1' rowsep='1'>
+ <colspec colname='c1'/>
+ <colspec colname='c2'/>
+ <thead>
+ <row>
+ <entry>Type</entry>
+ <entry>Description</entry>
+ </row>
+ </thead>
+ <tbody>
+ <row>
+ <entry>realm</entry>
+ <entry>
+ Routing Realm (32 bit number). Can be specified numerically
+ or as symbolic name defined in /etc/iproute2/rt_realms.
+ </entry>
+ </row>
+ </tbody>
+ </tgroup>
+ </table>
+ </para>
+ <para>
+ <example>
+ <title>Using routing expressions</title>
+ <programlisting>
+# IP family independent rt expression
+filter output rt classid 10
+
+# IP family dependent rt expressions
+ip filter output rt nexthop 192.168.0.1
+ip6 filter output rt nexthop fd00::1
+inet filter ether type ip output rt nexthop 192.168.0.1
+inet filter ether type ip6 output rt nexthop fd00::1
+ </programlisting>
+ </example>
+ </para>
+ </refsect2>
</refsect1>
<refsect1>
* @EXPR_RELATIONAL: equality and relational expressions
* @EXPR_NUMGEN: number generation expression
* @EXPR_HASH: hash expression
+ * @EXPR_RT: routing expression
*/
enum expr_types {
EXPR_INVALID,
EXPR_RELATIONAL,
EXPR_NUMGEN,
EXPR_HASH,
+ EXPR_RT,
};
enum ops {
#include <exthdr.h>
#include <numgen.h>
#include <meta.h>
+#include <rt.h>
#include <hash.h>
#include <ct.h>
enum nft_meta_keys key;
enum proto_bases base;
} meta;
+ struct {
+ /* EXPR_RT */
+ enum nft_rt_keys key;
+ } rt;
struct {
/* EXPR_CT */
enum nft_ct_keys key;
NFT_META_PRANDOM,
};
+/**
+ * enum nft_rt_keys - nf_tables routing expression keys
+ *
+ * @NFT_RT_CLASSID: realm value of packet's route (skb->dst->tclassid)
+ * @NFT_RT_NEXTHOP4: routing nexthop for IPv4
+ * @NFT_RT_NEXTHOP6: routing nexthop for IPv6
+ */
+enum nft_rt_keys {
+ NFT_RT_CLASSID,
+ NFT_RT_NEXTHOP4,
+ NFT_RT_NEXTHOP6,
+};
+
/**
* enum nft_hash_attributes - nf_tables hash expression netlink attributes
*
};
#define NFTA_META_MAX (__NFTA_META_MAX - 1)
+/**
+ * enum nft_rt_attributes - nf_tables routing expression netlink attributes
+ *
+ * @NFTA_RT_DREG: destination register (NLA_U32)
+ * @NFTA_RT_KEY: routing data item to load (NLA_U32: nft_rt_keys)
+ */
+enum nft_rt_attributes {
+ NFTA_RT_UNSPEC,
+ NFTA_RT_DREG,
+ NFTA_RT_KEY,
+ __NFTA_RT_MAX
+};
+#define NFTA_RT_MAX (__NFTA_RT_MAX - 1)
+
/**
* enum nft_ct_keys - nf_tables ct expression keys
*
--- /dev/null
+#ifndef NFTABLES_RT_H
+#define NFTABLES_RT_H
+
+/**
+ * struct rt_template - template for routing expressions
+ *
+ * @token: parser token for the expression
+ * @dtype: data type of the expression
+ * @len: length of the expression
+ * @byteorder: byteorder
+ * @invalid: invalidate datatype on allocation from parser
+ */
+struct rt_template {
+ const char *token;
+ const struct datatype *dtype;
+ unsigned int len;
+ enum byteorder byteorder;
+ bool invalid;
+};
+
+#define RT_TEMPLATE(__token, __dtype, __len, __byteorder, __invalid) { \
+ .token = (__token), \
+ .dtype = (__dtype), \
+ .len = (__len), \
+ .byteorder = (__byteorder), \
+ .invalid = (__invalid), \
+}
+
+extern struct expr *rt_expr_alloc(const struct location *loc,
+ enum nft_rt_keys key, bool invalid);
+extern void rt_expr_update_type(struct proto_ctx *ctx, struct expr *expr);
+
+#endif /* NFTABLES_RT_H */
exthdr.c \
hash.c \
meta.c \
+ rt.c \
numgen.c \
ct.c \
netlink.c \
return 0;
}
+/*
+ * RT expression: validate protocol dependencies.
+ */
+static int expr_evaluate_rt(struct eval_ctx *ctx, struct expr **expr)
+{
+ const struct proto_desc *base;
+ struct expr *rt = *expr;
+
+ rt_expr_update_type(&ctx->pctx, rt);
+
+ base = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc;
+ switch (rt->rt.key) {
+ case NFT_RT_NEXTHOP4:
+ if (base != &proto_ip)
+ goto err;
+ break;
+ case NFT_RT_NEXTHOP6:
+ if (base != &proto_ip6)
+ goto err;
+ break;
+ default:
+ break;
+ }
+
+ return expr_evaluate_primary(ctx, expr);
+
+err:
+ return expr_error(ctx->msgs, rt,
+ "ether type ip or ip6 must be specified before "
+ "routing expression");
+}
+
/*
* CT expression: update the protocol dependant types bases on the protocol
* context.
return expr_evaluate_primary(ctx, expr);
case EXPR_PAYLOAD:
return expr_evaluate_payload(ctx, expr);
+ case EXPR_RT:
+ return expr_evaluate_rt(ctx, expr);
case EXPR_CT:
return expr_evaluate_ct(ctx, expr);
case EXPR_PREFIX:
netlink_parse_meta_stmt(ctx, loc, nle);
}
+static void netlink_parse_rt(struct netlink_parse_ctx *ctx,
+ const struct location *loc,
+ const struct nftnl_expr *nle)
+{
+ enum nft_registers dreg;
+ uint32_t key;
+ struct expr *expr;
+
+ key = nftnl_expr_get_u32(nle, NFTNL_EXPR_RT_KEY);
+ expr = rt_expr_alloc(loc, key, false);
+
+ dreg = netlink_parse_register(nle, NFTNL_EXPR_RT_DREG);
+ netlink_set_register(ctx, dreg, expr);
+}
+
static void netlink_parse_numgen(struct netlink_parse_ctx *ctx,
const struct location *loc,
const struct nftnl_expr *nle)
{ .name = "payload", .parse = netlink_parse_payload },
{ .name = "exthdr", .parse = netlink_parse_exthdr },
{ .name = "meta", .parse = netlink_parse_meta },
+ { .name = "rt", .parse = netlink_parse_rt },
{ .name = "ct", .parse = netlink_parse_ct },
{ .name = "counter", .parse = netlink_parse_counter },
{ .name = "log", .parse = netlink_parse_log },
break;
case EXPR_SET_REF:
case EXPR_META:
+ case EXPR_RT:
case EXPR_VERDICT:
case EXPR_NUMGEN:
break;
nftnl_rule_add_expr(ctx->nlr, nle);
}
+static void netlink_gen_rt(struct netlink_linearize_ctx *ctx,
+ const struct expr *expr,
+ enum nft_registers dreg)
+{
+ struct nftnl_expr *nle;
+
+ nle = alloc_nft_expr("rt");
+ netlink_put_register(nle, NFTNL_EXPR_RT_DREG, dreg);
+ nftnl_expr_set_u32(nle, NFTNL_EXPR_RT_KEY, expr->rt.key);
+ nftnl_rule_add_expr(ctx->nlr, nle);
+}
+
static void netlink_gen_numgen(struct netlink_linearize_ctx *ctx,
const struct expr *expr,
enum nft_registers dreg)
return netlink_gen_exthdr(ctx, expr, dreg);
case EXPR_META:
return netlink_gen_meta(ctx, expr, dreg);
+ case EXPR_RT:
+ return netlink_gen_rt(ctx, expr, dreg);
case EXPR_CT:
return netlink_gen_ct(ctx, expr, dreg);
case EXPR_SET_ELEM:
%token OIFGROUP "oifgroup"
%token CGROUP "cgroup"
+%token CLASSID "classid"
+%token NEXTHOP "nexthop"
+
%token CT "ct"
%token DIRECTION "direction"
%token STATE "state"
%destructor { expr_free($$); } meta_expr
%type <val> meta_key meta_key_qualified meta_key_unqualified numgen_type
+%type <expr> rt_expr
+%destructor { expr_free($$); } rt_expr
+%type <val> rt_key
+
%type <expr> ct_expr
%destructor { expr_free($$); } ct_expr
%type <val> ct_key ct_key_dir ct_key_counters
| payload_expr { $$ = $1; }
| exthdr_expr { $$ = $1; }
| meta_expr { $$ = $1; }
+ | rt_expr { $$ = $1; }
| ct_expr { $$ = $1; }
| numgen_expr { $$ = $1; }
| hash_expr { $$ = $1; }
}
;
+rt_expr : RT rt_key
+ {
+ $$ = rt_expr_alloc(&@$, $2, true);
+ }
+ ;
+
+rt_key : CLASSID { $$ = NFT_RT_CLASSID; }
+ | NEXTHOP { $$ = NFT_RT_NEXTHOP4; }
+ ;
+
ct_expr : CT ct_key
{
$$ = ct_expr_alloc(&@$, $2, -1);
--- /dev/null
+/*
+ * Routing expression related definition and types.
+ *
+ * Copyright (c) 2016 Anders K. Pedersen <akp@cohaesio.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <errno.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <linux/netfilter.h>
+
+#include <nftables.h>
+#include <expression.h>
+#include <datatype.h>
+#include <rt.h>
+#include <rule.h>
+
+static struct symbol_table *realm_tbl;
+static void __init realm_table_init(void)
+{
+ realm_tbl = rt_symbol_table_init("/etc/iproute2/rt_realms");
+}
+
+static void __exit realm_table_exit(void)
+{
+ rt_symbol_table_free(realm_tbl);
+}
+
+static void realm_type_print(const struct expr *expr)
+{
+ return symbolic_constant_print(realm_tbl, expr, true);
+}
+
+static struct error_record *realm_type_parse(const struct expr *sym,
+ struct expr **res)
+{
+ return symbolic_constant_parse(sym, realm_tbl, res);
+}
+
+static const struct datatype realm_type = {
+ .type = TYPE_REALM,
+ .name = "realm",
+ .desc = "routing realm",
+ .byteorder = BYTEORDER_HOST_ENDIAN,
+ .size = 4 * BITS_PER_BYTE,
+ .basetype = &integer_type,
+ .print = realm_type_print,
+ .parse = realm_type_parse,
+ .flags = DTYPE_F_PREFIX,
+};
+
+static const struct rt_template rt_templates[] = {
+ [NFT_RT_CLASSID] = RT_TEMPLATE("classid",
+ &realm_type,
+ 4 * BITS_PER_BYTE,
+ BYTEORDER_HOST_ENDIAN,
+ false),
+ [NFT_RT_NEXTHOP4] = RT_TEMPLATE("nexthop",
+ &ipaddr_type,
+ 4 * BITS_PER_BYTE,
+ BYTEORDER_BIG_ENDIAN,
+ true),
+ [NFT_RT_NEXTHOP6] = RT_TEMPLATE("nexthop",
+ &ip6addr_type,
+ 16 * BITS_PER_BYTE,
+ BYTEORDER_BIG_ENDIAN,
+ true),
+};
+
+static void rt_expr_print(const struct expr *expr)
+{
+ printf("rt %s", rt_templates[expr->rt.key].token);
+}
+
+static bool rt_expr_cmp(const struct expr *e1, const struct expr *e2)
+{
+ return e1->rt.key == e2->rt.key;
+}
+
+static void rt_expr_clone(struct expr *new, const struct expr *expr)
+{
+ new->rt.key = expr->rt.key;
+}
+
+static const struct expr_ops rt_expr_ops = {
+ .type = EXPR_RT,
+ .name = "rt",
+ .print = rt_expr_print,
+ .cmp = rt_expr_cmp,
+ .clone = rt_expr_clone,
+};
+
+struct expr *rt_expr_alloc(const struct location *loc, enum nft_rt_keys key,
+ bool invalid)
+{
+ const struct rt_template *tmpl = &rt_templates[key];
+ struct expr *expr;
+
+ if (invalid && tmpl->invalid)
+ expr = expr_alloc(loc, &rt_expr_ops, &invalid_type,
+ tmpl->byteorder, 0);
+ else
+ expr = expr_alloc(loc, &rt_expr_ops, tmpl->dtype,
+ tmpl->byteorder, tmpl->len);
+ expr->rt.key = key;
+
+ return expr;
+}
+
+void rt_expr_update_type(struct proto_ctx *ctx, struct expr *expr)
+{
+ const struct proto_desc *desc;
+
+ switch (expr->rt.key) {
+ case NFT_RT_NEXTHOP4:
+ desc = ctx->protocol[PROTO_BASE_NETWORK_HDR].desc;
+ if (desc == &proto_ip)
+ expr->dtype = &ipaddr_type;
+ else if (desc == &proto_ip6) {
+ expr->rt.key++;
+ expr->dtype = &ip6addr_type;
+ }
+ expr->len = expr->dtype->size;
+ break;
+ default:
+ break;
+ }
+}
+
+static void __init rt_init(void)
+{
+ datatype_register(&realm_type);
+}
"oifgroup" { return OIFGROUP; }
"cgroup" { return CGROUP; }
+"classid" { return CLASSID; }
+"nexthop" { return NEXTHOP; }
+
"ct" { return CT; }
"l3proto" { return L3PROTOCOL; }
"proto-src" { return PROTO_SRC; }
--- /dev/null
+#! nft -f
+
+add table ip filter
+add chain ip filter output { type filter hook output priority 0 ; }
+
+add table ip6 filter
+add chain ip6 filter output { type filter hook output priority 0 ; }
+
+add table inet filter
+add chain inet filter output { type filter hook output priority 0 ; }
+
+# rt: classid (see /etc/iproute2/rt_realms)
+add rule ip filter output rt classid cosmos counter
+add rule ip6 filter output rt classid cosmos counter
+add rule inet filter output rt classid cosmos counter
+
+# rt: nexthop
+add rule ip filter output rt nexthop 192.168.0.1 counter
+add rule ip6 filter output rt nexthop fd00::1 counter
+add rule inet filter output ether type ip rt nexthop 192.168.0.1 counter
+add rule inet filter output ether type ip6 rt nexthop fd00::1 counter
nft_exthdr nft_payload nft_cmp nft_range \
nft_quota nft_queue nft_numgen \
nft_meta nft_meta_bridge nft_counter nft_log nft_limit \
- nft_hash nft_ct nft_compat \
+ nft_hash nft_ct nft_compat nft_rt \
nft_set_hash nft_set_rbtree \
nft_chain_nat_ipv4 nft_chain_nat_ipv6 \
nf_tables_inet nf_tables_bridge nf_tables_arp \
projects / thirdparty / nftables.git / commitdiff
