Re: [RFC] nftables: reverse path filtering for nft

[Florian Westphal <fw@strlen.de>]

Florian Westphal <fw@strlen.de> wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Mon, Sep 12, 2016 at 09:00:25PM +0200, Florian Westphal wrote:
> > > Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > >         fib lookup ip daddr . oif
> > > > 
> > > > As you are basically looking for the route based on IPv4 address and
> > > > the output interface, so this boils down to:
> > > > 
> > > >         fib lookup $expr $flags
> > > 
> > > How would the kernel disentangle the register data?
> > 
> > What I'm proposing is to represent this as a concatenation, since this
> > represents the tuple that you use to look up for route.
> > 
> > > (i.e., how do i know where in the sreg e.g. the daddr is
> > >  that i need to stuff in the flowi struct?)
> > 
> > You can iterate over the concatenation compound from the
> > netlink_linearize path, it is just a list of expressions. Then, you
> > can set the NFTA_FIB_* netlink attribute using them.
> 
> Ah, ok.  Interesting idea, I'll give this a shot.

Seems it might be better to handle this from the evaluation step
since it allows earlier error detection (e.g. use of
fib .. ip6 flowlabel from an ipv4 base for instance).