[PATCH nf-next 0/5] netfilter: nft: introduce routing expression

[PATCH nf-next 0/5] netfilter: nft: introduce routing expression

[Anders K. Pedersen | Cohaesio]

This patch series introduces an nftables rt expression for routing related
data with support for nexthop (i.e. the directly connected IP address that
an outgoing packet is sent to), which can be used either for matching or
accounting, eg.

 # nft add rule filter postrouting \
        ip daddr 192.168.1.0/24 rt ip nexthop != 192.168.0.1 drop

This will drop any traffic to 192.168.1.0/24 that is not routed via
192.168.0.1.

 # nft add rule filter postrouting \
        flow table acct { rt ip nexthop timeout 600s counter }
 # nft add rule ip6 filter postrouting \
        flow table acct { rt ip6 nexthop6 timeout 600s counter }

These rules count outgoing traffic per nexthop. Note that the timeout
releases an entry if no traffic is seen for this nexthop within 10 minutes.

 # nft add rule inet filter postrouting \
        ether type ip \
        flow table acct { rt ip nexthop timeout 600s counter }
 # nft add rule inet filter postrouting \
        ether type ip6 \
        flow table acct { rt ip6 nexthop6 timeout 600s counter }

Same as above, but via the inet family, where the ether type must be
specified explicitly.

"rt classid" is also implemented identical to "meta rtclassid", since it
is more logical to have this match in the routing expression going forward.

Regards,
Anders K. Pedersen
---
 include/net/netfilter/nft_rt.h           |  23 +++++
 include/uapi/linux/netfilter/nf_tables.h |  26 ++++++
 net/ipv4/netfilter/Kconfig               |   4 +
 net/ipv4/netfilter/Makefile              |   1 +
 net/ipv4/netfilter/nft_rt_ipv4.c         | 117 ++++++++++++++++++++++++
 net/ipv6/netfilter/Kconfig               |   4 +
 net/ipv6/netfilter/Makefile              |   1 +
 net/ipv6/netfilter/nft_rt_ipv6.c         | 118 ++++++++++++++++++++++++
 net/netfilter/Kconfig                    |  11 +++
 net/netfilter/Makefile                   |   2 +
 net/netfilter/nft_rt.c                   | 145 ++++++++++++++++++++++++++++++
 net/netfilter/nft_rt_inet.c              | 150 +++++++++++++++++++++++++++++++
 12 files changed, 602 insertions(+)

[PATCH nf-next 1/5] netfilter: nft: UAPI headers for routing expression

[Anders K. Pedersen | Cohaesio]

From: Anders K. Pedersen <akp@cohaesio.com>

Add new UAPI header definitions for nftables "rt" expression, which will
enable usage of routing related data.

Signed-off-by: Anders K. Pedersen <akp@cohaesio.com>
---
 include/uapi/linux/netfilter/nf_tables.h |  26 ++++++
 1 files changed, 26 insertions(+)

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -759,6 +759,16 @@ enum nft_meta_keys {
 };
 
 /**
+ * enum nft_rt_keys - nf_tables routing expression keys
+ *
+ * @NFT_META_NEXTHOP: routing nexthop
+ */
+enum nft_rt_keys {
+	NFT_RT_CLASSID,
+	NFT_RT_NEXTHOP,
+};
+
+/**
  * enum nft_hash_attributes - nf_tables hash expression netlink attributes
  *
  * @NFTA_HASH_SREG: source register (NLA_U32)
@@ -797,6 +807,22 @@ enum nft_meta_attributes {
 #define NFTA_META_MAX		(__NFTA_META_MAX - 1)
 
 /**
+ * enum nft_rt_attributes - nf_tables routing expression netlink attributes
+ *
+ * @NFTA_RT_DREG: destination register (NLA_U32)
+ * @NFTA_RT_KEY: meta data item to load (NLA_U32: nft_rt_keys)
+ * @NFTA_RT_FAMILY: Address family (NLA_U32)
+ */
+enum nft_rt_attributes {
+	NFTA_RT_UNSPEC,
+	NFTA_RT_DREG,
+	NFTA_RT_KEY,
+	NFTA_RT_FAMILY,
+	__NFTA_RT_MAX
+};
+#define NFTA_RT_MAX		(__NFTA_RT_MAX - 1)
+
+/**
  * enum nft_ct_keys - nf_tables ct expression keys
  *
  * @NFT_CT_STATE: conntrack state (bitmask of enum ip_conntrack_info)

Re: [PATCH nf-next 1/5] netfilter: nft: UAPI headers for routing expression

[Arturo Borrero Gonzalez]

On 16 October 2016 at 15:41, Anders K. Pedersen | Cohaesio
<akp@cohaesio.com> wrote:
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -759,6 +759,16 @@ enum nft_meta_keys {
>  };
>
>  /**
> + * enum nft_rt_keys - nf_tables routing expression keys
> + *
> + * @NFT_META_NEXTHOP: routing nexthop
> + */
> +enum nft_rt_keys {
> +       NFT_RT_CLASSID,
> +       NFT_RT_NEXTHOP,
> +};
> +

The comment section looks like it requires a fix.

[PATCH nf-next 2/5] netfilter: nft: basic routing expression

[Anders K. Pedersen | Cohaesio]

From: Anders K. Pedersen <akp@cohaesio.com>

Introduce basic infrastructure for nftables rt expression for routing
related data. Initially "rt classid" is implemented identical to "meta
rtclassid", since it is more logical to have this match in the routing
expression going forward.

Signed-off-by: Anders K. Pedersen <akp@cohaesio.com>
---
 include/net/netfilter/nft_rt.h           |  23 +++++
 net/netfilter/Kconfig                    |   6 ++
 net/netfilter/Makefile                   |   1 +
 net/netfilter/nft_rt.c                   | 145 ++++++++++++++++++++++++++++++
 4 files changed, 175 insertions(+)

diff --git a/include/net/netfilter/nft_rt.h b/include/net/netfilter/nft_rt.h
--- /dev/null
+++ b/include/net/netfilter/nft_rt.h
@@ -0,0 +1,23 @@
+#ifndef _NFT_RT_H_
+#define _NFT_RT_H_
+
+struct nft_rt {
+	enum nft_rt_keys	key:8;
+	enum nft_registers	dreg:8;
+	u8			family;
+};
+
+extern const struct nla_policy nft_rt_policy[];
+
+int nft_rt_get_init(const struct nft_ctx *ctx,
+		    const struct nft_expr *expr,
+		    const struct nlattr * const tb[]);
+
+int nft_rt_get_dump(struct sk_buff *skb,
+		    const struct nft_expr *expr);
+
+void nft_rt_get_eval(const struct nft_expr *expr,
+		     struct nft_regs *regs,
+		     const struct nft_pktinfo *pkt);
+
+#endif
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -474,6 +474,12 @@ config NFT_META
 	  This option adds the "meta" expression that you can use to match and
 	  to set packet metainformation such as the packet mark.
 
+config NFT_RT
+	tristate "Netfilter nf_tables routing module"
+	help
+	  This option adds the "rt" expression that you can use to match
+	  packet routing information such as the packet nexthop.
+
 config NFT_NUMGEN
 	tristate "Netfilter nf_tables number generator module"
 	help
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -81,6 +81,7 @@ obj-$(CONFIG_NF_TABLES_NETDEV)	+= nf_tables_netdev.o
 obj-$(CONFIG_NFT_COMPAT)	+= nft_compat.o
 obj-$(CONFIG_NFT_EXTHDR)	+= nft_exthdr.o
 obj-$(CONFIG_NFT_META)		+= nft_meta.o
+obj-$(CONFIG_NFT_RT)		+= nft_rt.o
 obj-$(CONFIG_NFT_NUMGEN)	+= nft_numgen.o
 obj-$(CONFIG_NFT_CT)		+= nft_ct.o
 obj-$(CONFIG_NFT_LIMIT)		+= nft_limit.o
diff --git a/net/netfilter/nft_rt.c b/net/netfilter/nft_rt.c
--- /dev/null
+++ b/net/netfilter/nft_rt.c
@@ -0,0 +1,145 @@
+/*
+ * Copyright (c) 2016 Anders K. Pedersen <akp@cohaesio.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/dst.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables_core.h>
+#include <net/netfilter/nft_rt.h>
+
+void nft_rt_get_eval(const struct nft_expr *expr,
+		     struct nft_regs *regs,
+		     const struct nft_pktinfo *pkt)
+{
+	const struct nft_rt *priv = nft_expr_priv(expr);
+	const struct sk_buff *skb = pkt->skb;
+	u32 *dest = &regs->data[priv->dreg];
+
+	switch (priv->key) {
+#ifdef CONFIG_IP_ROUTE_CLASSID
+	case NFT_RT_CLASSID: {
+		const struct dst_entry *dst = skb_dst(skb);
+
+		if (dst == NULL)
+			goto err;
+		*dest = dst->tclassid;
+		break;
+	}
+#endif
+	default:
+		WARN_ON(1);
+		goto err;
+	}
+	return;
+
+err:
+	regs->verdict.code = NFT_BREAK;
+}
+EXPORT_SYMBOL_GPL(nft_rt_get_eval);
+
+const struct nla_policy nft_rt_policy[NFTA_RT_MAX + 1] = {
+	[NFTA_RT_DREG]		= { .type = NLA_U32 },
+	[NFTA_RT_KEY]		= { .type = NLA_U32 },
+	[NFTA_RT_FAMILY]	= { .type = NLA_U32 },
+};
+EXPORT_SYMBOL_GPL(nft_rt_policy);
+
+int nft_rt_get_init(const struct nft_ctx *ctx,
+		    const struct nft_expr *expr,
+		    const struct nlattr * const tb[])
+{
+	struct nft_rt *priv = nft_expr_priv(expr);
+	unsigned int len;
+
+	priv->key = ntohl(nla_get_be32(tb[NFTA_RT_KEY]));
+	switch (priv->key) {
+#ifdef CONFIG_IP_ROUTE_CLASSID
+	case NFT_RT_CLASSID:
+		len = sizeof(u32);
+		break;
+#endif
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	priv->family = ntohl(nla_get_be32(tb[NFTA_RT_FAMILY]));
+	priv->dreg = nft_parse_register(tb[NFTA_RT_DREG]);
+	return nft_validate_register_store(ctx, priv->dreg, NULL,
+					   NFT_DATA_VALUE, len);
+}
+EXPORT_SYMBOL_GPL(nft_rt_get_init);
+
+int nft_rt_get_dump(struct sk_buff *skb,
+		    const struct nft_expr *expr)
+{
+	const struct nft_rt *priv = nft_expr_priv(expr);
+
+	if (nla_put_be32(skb, NFTA_RT_KEY, htonl(priv->key)))
+		goto nla_put_failure;
+	if (nft_dump_register(skb, NFTA_RT_DREG, priv->dreg))
+		goto nla_put_failure;
+	if (nla_put_be32(skb, NFTA_RT_FAMILY, htonl(priv->family)))
+		goto nla_put_failure;
+	return 0;
+
+nla_put_failure:
+	return -1;
+}
+EXPORT_SYMBOL_GPL(nft_rt_get_dump);
+
+static struct nft_expr_type nft_rt_type;
+static const struct nft_expr_ops nft_rt_get_ops = {
+	.type		= &nft_rt_type,
+	.size		= NFT_EXPR_SIZE(sizeof(struct nft_rt)),
+	.eval		= nft_rt_get_eval,
+	.init		= nft_rt_get_init,
+	.dump		= nft_rt_get_dump,
+};
+
+static const struct nft_expr_ops *
+nft_rt_select_ops(const struct nft_ctx *ctx,
+		  const struct nlattr * const tb[])
+{
+	if (tb[NFTA_RT_KEY] == NULL)
+		return ERR_PTR(-EINVAL);
+
+	if (tb[NFTA_RT_DREG])
+		return &nft_rt_get_ops;
+
+	return ERR_PTR(-EINVAL);
+}
+
+static struct nft_expr_type nft_rt_type __read_mostly = {
+	.name		= "rt",
+	.select_ops	= &nft_rt_select_ops,
+	.policy		= nft_rt_policy,
+	.maxattr	= NFTA_RT_MAX,
+	.owner		= THIS_MODULE,
+};
+
+static int __init nft_rt_module_init(void)
+{
+	return nft_register_expr(&nft_rt_type);
+}
+
+static void __exit nft_rt_module_exit(void)
+{
+	nft_unregister_expr(&nft_rt_type);
+}
+
+module_init(nft_rt_module_init);
+module_exit(nft_rt_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Anders K. Pedersen <akp@cohaesio.com>");
+MODULE_ALIAS_NFT_EXPR("rt");

Re: [PATCH nf-next 2/5] netfilter: nft: basic routing expression

[Arturo Borrero Gonzalez]

On 16 October 2016 at 15:42, Anders K. Pedersen | Cohaesio
<akp@cohaesio.com> wrote:
> From: Anders K. Pedersen <akp@cohaesio.com>
>
> Introduce basic infrastructure for nftables rt expression for routing
> related data. Initially "rt classid" is implemented identical to "meta
> rtclassid", since it is more logical to have this match in the routing
> expression going forward.
>
> Signed-off-by: Anders K. Pedersen <akp@cohaesio.com>
> ---
>  include/net/netfilter/nft_rt.h           |  23 +++++
>  net/netfilter/Kconfig                    |   6 ++
>  net/netfilter/Makefile                   |   1 +
>  net/netfilter/nft_rt.c                   | 145 ++++++++++++++++++++++++++++++
>  4 files changed, 175 insertions(+)
>
> diff --git a/include/net/netfilter/nft_rt.h b/include/net/netfilter/nft_rt.h
> --- /dev/null
> +++ b/include/net/netfilter/nft_rt.h
> @@ -0,0 +1,23 @@
> +#ifndef _NFT_RT_H_
> +#define _NFT_RT_H_
> +
> +struct nft_rt {
> +       enum nft_rt_keys        key:8;
> +       enum nft_registers      dreg:8;
> +       u8                      family;
> +};
> +
> +extern const struct nla_policy nft_rt_policy[];
> +
> +int nft_rt_get_init(const struct nft_ctx *ctx,
> +                   const struct nft_expr *expr,
> +                   const struct nlattr * const tb[]);
> +
> +int nft_rt_get_dump(struct sk_buff *skb,
> +                   const struct nft_expr *expr);
> +
> +void nft_rt_get_eval(const struct nft_expr *expr,
> +                    struct nft_regs *regs,
> +                    const struct nft_pktinfo *pkt);
> +
> +#endif
> diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
> --- a/net/netfilter/Kconfig
> +++ b/net/netfilter/Kconfig
> @@ -474,6 +474,12 @@ config NFT_META
>           This option adds the "meta" expression that you can use to match and
>           to set packet metainformation such as the packet mark.
>
> +config NFT_RT
> +       tristate "Netfilter nf_tables routing module"
> +       help
> +         This option adds the "rt" expression that you can use to match
> +         packet routing information such as the packet nexthop.
> +
>  config NFT_NUMGEN
>         tristate "Netfilter nf_tables number generator module"
>         help
> diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
> --- a/net/netfilter/Makefile
> +++ b/net/netfilter/Makefile
> @@ -81,6 +81,7 @@ obj-$(CONFIG_NF_TABLES_NETDEV)        += nf_tables_netdev.o
>  obj-$(CONFIG_NFT_COMPAT)       += nft_compat.o
>  obj-$(CONFIG_NFT_EXTHDR)       += nft_exthdr.o
>  obj-$(CONFIG_NFT_META)         += nft_meta.o
> +obj-$(CONFIG_NFT_RT)           += nft_rt.o
>  obj-$(CONFIG_NFT_NUMGEN)       += nft_numgen.o
>  obj-$(CONFIG_NFT_CT)           += nft_ct.o
>  obj-$(CONFIG_NFT_LIMIT)                += nft_limit.o
> diff --git a/net/netfilter/nft_rt.c b/net/netfilter/nft_rt.c
> --- /dev/null
> +++ b/net/netfilter/nft_rt.c
> @@ -0,0 +1,145 @@
> +/*
> + * Copyright (c) 2016 Anders K. Pedersen <akp@cohaesio.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + */
> +
> +#include <linux/kernel.h>
> +#include <linux/init.h>
> +#include <linux/module.h>
> +#include <linux/netlink.h>
> +#include <linux/netfilter.h>
> +#include <linux/netfilter/nf_tables.h>
> +#include <net/dst.h>
> +#include <net/netfilter/nf_tables.h>
> +#include <net/netfilter/nf_tables_core.h>
> +#include <net/netfilter/nft_rt.h>
> +
> +void nft_rt_get_eval(const struct nft_expr *expr,
> +                    struct nft_regs *regs,
> +                    const struct nft_pktinfo *pkt)
> +{
> +       const struct nft_rt *priv = nft_expr_priv(expr);
> +       const struct sk_buff *skb = pkt->skb;
> +       u32 *dest = &regs->data[priv->dreg];
> +
> +       switch (priv->key) {
> +#ifdef CONFIG_IP_ROUTE_CLASSID
> +       case NFT_RT_CLASSID: {
> +               const struct dst_entry *dst = skb_dst(skb);
> +
> +               if (dst == NULL)
> +                       goto err;
> +               *dest = dst->tclassid;
> +               break;
> +       }
> +#endif
> +       default:
> +               WARN_ON(1);
> +               goto err;
> +       }
> +       return;
> +
> +err:
> +       regs->verdict.code = NFT_BREAK;
> +}
> +EXPORT_SYMBOL_GPL(nft_rt_get_eval);
> +
> +const struct nla_policy nft_rt_policy[NFTA_RT_MAX + 1] = {
> +       [NFTA_RT_DREG]          = { .type = NLA_U32 },
> +       [NFTA_RT_KEY]           = { .type = NLA_U32 },
> +       [NFTA_RT_FAMILY]        = { .type = NLA_U32 },
> +};
> +EXPORT_SYMBOL_GPL(nft_rt_policy);
> +
> +int nft_rt_get_init(const struct nft_ctx *ctx,
> +                   const struct nft_expr *expr,
> +                   const struct nlattr * const tb[])
> +{
> +       struct nft_rt *priv = nft_expr_priv(expr);
> +       unsigned int len;
> +
> +       priv->key = ntohl(nla_get_be32(tb[NFTA_RT_KEY]));
> +       switch (priv->key) {
> +#ifdef CONFIG_IP_ROUTE_CLASSID
> +       case NFT_RT_CLASSID:
> +               len = sizeof(u32);
> +               break;
> +#endif
> +       default:
> +               return -EOPNOTSUPP;
> +       }
> +
> +       priv->family = ntohl(nla_get_be32(tb[NFTA_RT_FAMILY]));
> +       priv->dreg = nft_parse_register(tb[NFTA_RT_DREG]);
> +       return nft_validate_register_store(ctx, priv->dreg, NULL,
> +                                          NFT_DATA_VALUE, len);
> +}
> +EXPORT_SYMBOL_GPL(nft_rt_get_init);
> +
> +int nft_rt_get_dump(struct sk_buff *skb,
> +                   const struct nft_expr *expr)
> +{
> +       const struct nft_rt *priv = nft_expr_priv(expr);
> +
> +       if (nla_put_be32(skb, NFTA_RT_KEY, htonl(priv->key)))
> +               goto nla_put_failure;
> +       if (nft_dump_register(skb, NFTA_RT_DREG, priv->dreg))
> +               goto nla_put_failure;
> +       if (nla_put_be32(skb, NFTA_RT_FAMILY, htonl(priv->family)))
> +               goto nla_put_failure;
> +       return 0;
> +
> +nla_put_failure:
> +       return -1;
> +}
> +EXPORT_SYMBOL_GPL(nft_rt_get_dump);
> +
> +static struct nft_expr_type nft_rt_type;
> +static const struct nft_expr_ops nft_rt_get_ops = {
> +       .type           = &nft_rt_type,
> +       .size           = NFT_EXPR_SIZE(sizeof(struct nft_rt)),
> +       .eval           = nft_rt_get_eval,
> +       .init           = nft_rt_get_init,
> +       .dump           = nft_rt_get_dump,
> +};
> +
> +static const struct nft_expr_ops *
> +nft_rt_select_ops(const struct nft_ctx *ctx,
> +                 const struct nlattr * const tb[])
> +{
> +       if (tb[NFTA_RT_KEY] == NULL)
> +               return ERR_PTR(-EINVAL);
> +
> +       if (tb[NFTA_RT_DREG])
> +               return &nft_rt_get_ops;
> +
> +       return ERR_PTR(-EINVAL);
> +}

I don't understand why you use select_ops.

Do you plan to extend this expr behaviour in the near future?

Re: [PATCH nf-next 2/5] netfilter: nft: basic routing expression

[Anders K. Pedersen | Cohaesio]

Hi Arturo,

On man, 2016-10-17 at 09:41 +0200, Arturo Borrero Gonzalez wrote:
> On 16 October 2016 at 15:42, Anders K. Pedersen | Cohaesio
> <akp@cohaesio.com> wrote:
> > 
> > From: Anders K. Pedersen <akp@cohaesio.com>
> > 
> > Introduce basic infrastructure for nftables rt expression for
> > routing
> > related data. Initially "rt classid" is implemented identical to
> > "meta
> > rtclassid", since it is more logical to have this match in the
> > routing
> > expression going forward.
> > 

> > +static const struct nft_expr_ops *
> > +nft_rt_select_ops(const struct nft_ctx *ctx,
> > +                 const struct nlattr * const tb[])
> > +{
> > +       if (tb[NFTA_RT_KEY] == NULL)
> > +               return ERR_PTR(-EINVAL);
> > +
> > +       if (tb[NFTA_RT_DREG])
> > +               return &nft_rt_get_ops;
> > +
> > +       return ERR_PTR(-EINVAL);
> > +}
> 
> I don't understand why you use select_ops.
> 
> Do you plan to extend this expr behaviour in the near future?

No, I have changed this to use ".ops = &nft_rt_get_ops" for patch 2-5.
I have also fixed the comment for enum nft_rt_keys in patch 1 and the
patches for libnftnl and nftables.

I'll hold on to them for a few days to see, if there are other
comments, and then post version 2.

Thanks for reviewing.

Regards,
Anders K. Pedersen

[PATCH nf-next 3/5] netfilter: nft: rt nexthop for IPv4 family

[Anders K. Pedersen | Cohaesio]

From: Anders K. Pedersen <akp@cohaesio.com>

Add nftables IPv4 family support for an "rt ip nexthop" expression
allowing usage of the routing nexthop (i.e. the directly connected IP
address that an outgoing packet is sent to) for matching or accounting, eg.

 # nft add rule filter postrouting \
	ip daddr 192.168.1.0/24 rt ip nexthop != 192.168.0.1 drop

This will drop any traffic to 192.168.1.0/24 that is not routed via
192.168.0.1.

 # nft add rule filter postrouting \
	flow table acct { rt ip nexthop timeout 600s counter }

This rule counts outgoing traffic per nexthop. Note that the timeout
releases an entry if no traffic is seen for this nexthop within 10 minutes.

Signed-off-by: Anders K. Pedersen <akp@cohaesio.com>
---
 net/ipv4/netfilter/Kconfig               |   4 +
 net/ipv4/netfilter/Makefile              |   1 +
 net/ipv4/netfilter/nft_rt_ipv4.c         | 117 ++++++++++++++++++++++++
 3 files changed, 122 insertions(+)

diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -42,6 +42,10 @@ config NFT_CHAIN_ROUTE_IPV4
 	  fields such as the source, destination, type of service and
 	  the packet mark.
 
+config NFT_RT_IPV4
+	default NFT_RT
+	tristate
+
 config NFT_REJECT_IPV4
 	select NF_REJECT_IPV4
 	default NFT_REJECT
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -33,6 +33,7 @@ obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o
 obj-$(CONFIG_NF_TABLES_IPV4) += nf_tables_ipv4.o
 obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o
 obj-$(CONFIG_NFT_CHAIN_NAT_IPV4) += nft_chain_nat_ipv4.o
+obj-$(CONFIG_NFT_RT_IPV4) += nft_rt_ipv4.o
 obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o
 obj-$(CONFIG_NFT_MASQ_IPV4) += nft_masq_ipv4.o
 obj-$(CONFIG_NFT_REDIR_IPV4) += nft_redir_ipv4.o
diff --git a/net/ipv4/netfilter/nft_rt_ipv4.c b/net/ipv4/netfilter/nft_rt_ipv4.c
--- /dev/null
+++ b/net/ipv4/netfilter/nft_rt_ipv4.c
@@ -0,0 +1,117 @@
+/*
+ * Copyright (c) 2016 Anders K. Pedersen <akp@cohaesio.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/route.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nft_rt.h>
+
+static void nft_rt_ipv4_get_eval(const struct nft_expr *expr,
+				 struct nft_regs *regs,
+				 const struct nft_pktinfo *pkt)
+{
+	const struct nft_rt *priv = nft_expr_priv(expr);
+	const struct sk_buff *skb = pkt->skb;
+	u32 *dest = &regs->data[priv->dreg];
+
+	switch (priv->key) {
+	case NFT_RT_NEXTHOP: {
+		const struct rtable *rt = skb_rtable(skb);
+
+		if (!rt)
+			goto err;
+		*dest = rt_nexthop(rt, ip_hdr(skb)->daddr);
+		break;
+	}
+	default:
+		return nft_rt_get_eval(expr, regs, pkt);
+	}
+
+	return;
+err:
+	regs->verdict.code = NFT_BREAK;
+}
+
+static int nft_rt_ipv4_get_init(const struct nft_ctx *ctx,
+				const struct nft_expr *expr,
+				const struct nlattr * const tb[])
+{
+	struct nft_rt *priv = nft_expr_priv(expr);
+	unsigned int len;
+
+	priv->key = ntohl(nla_get_be32(tb[NFTA_RT_KEY]));
+	switch (priv->key) {
+	case NFT_RT_NEXTHOP:
+		len = sizeof(u32);
+		break;
+	default:
+		return nft_rt_get_init(ctx, expr, tb);
+	}
+
+	priv->family = ntohl(nla_get_be32(tb[NFTA_RT_FAMILY]));
+	if (priv->family != NFPROTO_IPV4)
+		return -EINVAL;
+
+	priv->dreg = nft_parse_register(tb[NFTA_RT_DREG]);
+	return nft_validate_register_store(ctx, priv->dreg, NULL,
+					   NFT_DATA_VALUE, len);
+}
+
+static struct nft_expr_type nft_rt_ipv4_type;
+static const struct nft_expr_ops nft_rt_ipv4_get_ops = {
+	.type		= &nft_rt_ipv4_type,
+	.size		= NFT_EXPR_SIZE(sizeof(struct nft_rt)),
+	.eval		= nft_rt_ipv4_get_eval,
+	.init		= nft_rt_ipv4_get_init,
+	.dump		= nft_rt_get_dump,
+};
+
+static const struct nft_expr_ops *
+nft_rt_ipv4_select_ops(const struct nft_ctx *ctx,
+		       const struct nlattr * const tb[])
+{
+	if (tb[NFTA_RT_KEY] == NULL)
+		return ERR_PTR(-EINVAL);
+
+	if (tb[NFTA_RT_DREG])
+		return &nft_rt_ipv4_get_ops;
+
+	return ERR_PTR(-EINVAL);
+}
+
+static struct nft_expr_type nft_rt_ipv4_type __read_mostly = {
+	.family         = NFPROTO_IPV4,
+	.name           = "rt",
+	.select_ops     = &nft_rt_ipv4_select_ops,
+	.policy         = nft_rt_policy,
+	.maxattr        = NFTA_RT_MAX,
+	.owner          = THIS_MODULE,
+};
+
+static int __init nft_rt_ipv4_module_init(void)
+{
+	return nft_register_expr(&nft_rt_ipv4_type);
+}
+
+static void __exit nft_rt_ipv4_module_exit(void)
+{
+	nft_unregister_expr(&nft_rt_ipv4_type);
+}
+
+module_init(nft_rt_ipv4_module_init);
+module_exit(nft_rt_ipv4_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Anders K. Pedersen <akp@cohaesio.com>");
+MODULE_ALIAS_NFT_AF_EXPR(AF_INET, "rt");

[PATCH nf-next 4/5] netfilter: nft: rt nexthop for IPv6 family

[Anders K. Pedersen | Cohaesio]

From: Anders K. Pedersen <akp@cohaesio.com>

Add nftables IPv6 family support for an "rt ip6 nexthop" expression
allowing usage of the routing nexthop (i.e. the directly connected IP
address that an outgoing packet is sent to) for matching or accounting, eg.

 # nft add rule ip6 filter postrouting \
	ip6 daddr fd01::/16 rt ip6 nexthop != fd00::1 drop

This will drop any traffic to fd01::/16 that is not routed via fd00::1.

 # nft add rule ip6 filter postrouting \
	flow table acct { rt ip6 nexthop timeout 600s counter }

This rule counts outgoing traffic per nexthop. Note that the timeout
releases an entry if no traffic is seen for this nexthop within 10 minutes.

Signed-off-by: Anders K. Pedersen <akp@cohaesio.com>
---
 net/ipv6/netfilter/Kconfig               |   4 +
 net/ipv6/netfilter/Makefile              |   1 +
 net/ipv6/netfilter/nft_rt_ipv6.c         | 118 ++++++++++++++++++++++++
 3 files changed, 123 insertions(+)

diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -42,6 +42,10 @@ config NFT_CHAIN_ROUTE_IPV6
 	  fields such as the source, destination, flowlabel, hop-limit and
 	  the packet mark.
 
+config NFT_RT_IPV6
+	default NFT_RT
+	tristate
+
 config NFT_REJECT_IPV6
 	select NF_REJECT_IPV6
 	default NFT_REJECT
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -36,6 +36,7 @@ obj-$(CONFIG_NF_DUP_IPV6) += nf_dup_ipv6.o
 obj-$(CONFIG_NF_TABLES_IPV6) += nf_tables_ipv6.o
 obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV6) += nft_chain_route_ipv6.o
 obj-$(CONFIG_NFT_CHAIN_NAT_IPV6) += nft_chain_nat_ipv6.o
+obj-$(CONFIG_NFT_RT_IPV6) += nft_rt_ipv6.o
 obj-$(CONFIG_NFT_REJECT_IPV6) += nft_reject_ipv6.o
 obj-$(CONFIG_NFT_MASQ_IPV6) += nft_masq_ipv6.o
 obj-$(CONFIG_NFT_REDIR_IPV6) += nft_redir_ipv6.o
diff --git a/net/ipv6/netfilter/nft_rt_ipv6.c b/net/ipv6/netfilter/nft_rt_ipv6.c
--- /dev/null
+++ b/net/ipv6/netfilter/nft_rt_ipv6.c
@@ -0,0 +1,118 @@
+/*
+ * Copyright (c) 2016 Anders K. Pedersen <akp@cohaesio.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/ip6_route.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nft_rt.h>
+
+static void nft_rt_ipv6_get_eval(const struct nft_expr *expr,
+				 struct nft_regs *regs,
+				 const struct nft_pktinfo *pkt)
+{
+	const struct nft_rt *priv = nft_expr_priv(expr);
+	const struct sk_buff *skb = pkt->skb;
+	u32 *dest = &regs->data[priv->dreg];
+
+	switch (priv->key) {
+	case NFT_RT_NEXTHOP: {
+		struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
+
+		if (!rt)
+			goto err;
+		memcpy(dest, rt6_nexthop(rt, &ipv6_hdr(skb)->daddr),
+		       sizeof(struct in6_addr));
+		break;
+	}
+	default:
+		return nft_rt_get_eval(expr, regs, pkt);
+	}
+
+	return;
+err:
+	regs->verdict.code = NFT_BREAK;
+}
+
+static int nft_rt_ipv6_get_init(const struct nft_ctx *ctx,
+				const struct nft_expr *expr,
+				const struct nlattr * const tb[])
+{
+	struct nft_rt *priv = nft_expr_priv(expr);
+	unsigned int len;
+
+	priv->key = ntohl(nla_get_be32(tb[NFTA_RT_KEY]));
+	switch (priv->key) {
+	case NFT_RT_NEXTHOP:
+		len = sizeof(struct in6_addr);
+		break;
+	default:
+		return nft_rt_get_init(ctx, expr, tb);
+	}
+
+	priv->family = ntohl(nla_get_be32(tb[NFTA_RT_FAMILY]));
+	if (priv->family != NFPROTO_IPV6)
+		return -EINVAL;
+
+	priv->dreg = nft_parse_register(tb[NFTA_RT_DREG]);
+	return nft_validate_register_store(ctx, priv->dreg, NULL,
+					   NFT_DATA_VALUE, len);
+}
+
+static struct nft_expr_type nft_rt_ipv6_type;
+static const struct nft_expr_ops nft_rt_ipv6_get_ops = {
+	.type		= &nft_rt_ipv6_type,
+	.size		= NFT_EXPR_SIZE(sizeof(struct nft_rt)),
+	.eval		= nft_rt_ipv6_get_eval,
+	.init		= nft_rt_ipv6_get_init,
+	.dump		= nft_rt_get_dump,
+};
+
+static const struct nft_expr_ops *
+nft_rt_ipv6_select_ops(const struct nft_ctx *ctx,
+		       const struct nlattr * const tb[])
+{
+	if (tb[NFTA_RT_KEY] == NULL)
+		return ERR_PTR(-EINVAL);
+
+	if (tb[NFTA_RT_DREG])
+		return &nft_rt_ipv6_get_ops;
+
+	return ERR_PTR(-EINVAL);
+}
+
+static struct nft_expr_type nft_rt_ipv6_type __read_mostly = {
+	.family         = NFPROTO_IPV6,
+	.name           = "rt",
+	.select_ops     = &nft_rt_ipv6_select_ops,
+	.policy         = nft_rt_policy,
+	.maxattr        = NFTA_RT_MAX,
+	.owner          = THIS_MODULE,
+};
+
+static int __init nft_rt_ipv6_module_init(void)
+{
+	return nft_register_expr(&nft_rt_ipv6_type);
+}
+
+static void __exit nft_rt_ipv6_module_exit(void)
+{
+	nft_unregister_expr(&nft_rt_ipv6_type);
+}
+
+module_init(nft_rt_ipv6_module_init);
+module_exit(nft_rt_ipv6_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Anders K. Pedersen <akp@cohaesio.com>");
+MODULE_ALIAS_NFT_AF_EXPR(AF_INET6, "rt");

[PATCH nf-next 5/5] netfilter: nft: rt nexthop for inet family

[Anders K. Pedersen | Cohaesio]

From: Anders K. Pedersen <akp@cohaesio.com>

Add nftables inet family support for an rt nexthop expression allowing
usage of the routing nexthop (i.e. the directly connected IP address that
an outgoing packet is sent to) for matching or accounting, eg.

 # nft add rule inet filter postrouting \
	ether type ip6 \
	ip6 daddr fd01::/16 rt ip6 nexthop != fd00::1 drop

This will drop any traffic to fd01::/16 that is not routed via fd00::1.
Note that "ether type" must be specified explicitly, when rt nexthop is
used from inet family tables.

 # nft add rule inet filter postrouting \
	ether type ip \
	flow table acct { rt ip nexthop timeout 600s counter }
 # nft add rule inet filter postrouting \
	ether type ip6 \
	flow table acct { rt ip6 nexthop6 timeout 600s counter }

These rules count outgoing traffic per nexthop. Note that the timeout
releases an entry if no traffic is seen for this nexthop within 10 minutes.

Signed-off-by: Anders K. Pedersen <akp@cohaesio.com>
---
 net/netfilter/Kconfig                    |   5 ++
 net/netfilter/Makefile                   |   1 +
 net/netfilter/nft_rt_inet.c              | 150 +++++++++++++++++++++++++++++++
 3 files changed, 156 insertions(+)

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -480,6 +480,11 @@ config NFT_META
	  This option adds the "rt" expression that you can use to match
	  packet routing information such as the packet nexthop.

+config NFT_RT_INET
+	depends on NF_TABLES_INET
+	default NFT_RT
+	tristate
+
 config NFT_NUMGEN
 	tristate "Netfilter nf_tables number generator module"
 	help
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -82,6 +82,7 @@ obj-$(CONFIG_NF_TABLES_NETDEV)	+= nf_tables_netdev.o
 obj-$(CONFIG_NFT_EXTHDR)	+= nft_exthdr.o
 obj-$(CONFIG_NFT_META)		+= nft_meta.o
 obj-$(CONFIG_NFT_RT)		+= nft_rt.o
+obj-$(CONFIG_NFT_RT_INET)	+= nft_rt_inet.o
 obj-$(CONFIG_NFT_NUMGEN)	+= nft_numgen.o
 obj-$(CONFIG_NFT_CT)		+= nft_ct.o
 obj-$(CONFIG_NFT_LIMIT)		+= nft_limit.o
diff --git a/net/netfilter/nft_rt_inet.c b/net/netfilter/nft_rt_inet.c
--- /dev/null
+++ b/net/netfilter/nft_rt_inet.c
@@ -0,0 +1,150 @@
+/*
+ * Copyright (c) 2016 Anders K. Pedersen <akp@cohaesio.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/ip6_route.h>
+#include <net/route.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nft_rt.h>
+
+static void nft_rt_inet_get_eval(const struct nft_expr *expr,
+				 struct nft_regs *regs,
+				 const struct nft_pktinfo *pkt)
+{
+	const struct nft_rt *priv = nft_expr_priv(expr);
+	const struct sk_buff *skb = pkt->skb;
+	u32 *dest = &regs->data[priv->dreg];
+
+	if (unlikely(pkt->pf != priv->family)) {
+		WARN_ONCE(1, "Address families do not match\n");
+		goto err;
+	}
+
+	switch (pkt->pf) {
+	case NFPROTO_IPV4:
+		switch (priv->key) {
+		case NFT_RT_NEXTHOP: {
+			const struct rtable *rt = skb_rtable(skb);
+
+			if (!rt)
+				goto err;
+			*dest = rt_nexthop(rt, ip_hdr(skb)->daddr);
+			break;
+		}
+		default:
+			goto out;
+		}
+		break;
+	case NFPROTO_IPV6:
+		switch (priv->key) {
+		case NFT_RT_NEXTHOP: {
+			struct rt6_info *rt =
+					(struct rt6_info *)skb_dst(skb);
+
+			if (!rt)
+				goto err;
+			memcpy(dest, rt6_nexthop(rt, &ipv6_hdr(skb)->daddr),
+			       sizeof(struct in6_addr));
+			break;
+		}
+		default:
+			goto out;
+		}
+		break;
+	}
+
+	return;
+out:
+	return nft_rt_get_eval(expr, regs, pkt);
+err:
+	regs->verdict.code = NFT_BREAK;
+}
+
+static int nft_rt_inet_get_init(const struct nft_ctx *ctx,
+				const struct nft_expr *expr,
+				const struct nlattr * const tb[])
+{
+	struct nft_rt *priv = nft_expr_priv(expr);
+	unsigned int len;
+
+	priv->key = ntohl(nla_get_be32(tb[NFTA_RT_KEY]));
+	priv->family = ntohl(nla_get_be32(tb[NFTA_RT_FAMILY]));
+	switch (priv->key) {
+	case NFT_RT_NEXTHOP:
+		switch (priv->family) {
+		case NFPROTO_IPV4:
+			len = sizeof(u32);
+			break;
+		case NFPROTO_IPV6:
+			len = sizeof(struct in6_addr);
+			break;
+		}
+		len = sizeof(u32);
+		break;
+	default:
+		return nft_rt_get_init(ctx, expr, tb);
+	}
+
+	priv->dreg = nft_parse_register(tb[NFTA_RT_DREG]);
+	return nft_validate_register_store(ctx, priv->dreg, NULL,
+					   NFT_DATA_VALUE, len);
+}
+
+static struct nft_expr_type nft_rt_inet_type;
+static const struct nft_expr_ops nft_rt_inet_get_ops = {
+	.type		= &nft_rt_inet_type,
+	.size		= NFT_EXPR_SIZE(sizeof(struct nft_rt)),
+	.eval		= nft_rt_inet_get_eval,
+	.init		= nft_rt_inet_get_init,
+	.dump		= nft_rt_get_dump,
+};
+
+static const struct nft_expr_ops *
+nft_rt_inet_select_ops(const struct nft_ctx *ctx,
+		       const struct nlattr * const tb[])
+{
+	if (tb[NFTA_RT_KEY] == NULL)
+		return ERR_PTR(-EINVAL);
+
+	if (tb[NFTA_RT_DREG])
+		return &nft_rt_inet_get_ops;
+
+	return ERR_PTR(-EINVAL);
+}
+
+static struct nft_expr_type nft_rt_inet_type __read_mostly = {
+	.family         = NFPROTO_INET,
+	.name           = "rt",
+	.select_ops     = &nft_rt_inet_select_ops,
+	.policy         = nft_rt_policy,
+	.maxattr        = NFTA_RT_MAX,
+	.owner          = THIS_MODULE,
+};
+
+static int __init nft_rt_inet_module_init(void)
+{
+	return nft_register_expr(&nft_rt_inet_type);
+}
+
+static void __exit nft_rt_inet_module_exit(void)
+{
+	nft_unregister_expr(&nft_rt_inet_type);
+}
+
+module_init(nft_rt_inet_module_init);
+module_exit(nft_rt_inet_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Anders K. Pedersen <akp@cohaesio.com>");
+MODULE_ALIAS_NFT_AF_EXPR(1, "rt");