[RFC] l2tp for nftables

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi James,

I'm looking what is missing to add l2tp for nftables, after a quick
glance this is what I found.

The L2TPv3 over IP (after quick reading of the RFC) seems easy to add.
I'm attaching a patch for the header layout definition (still parser
side is missing, so this patch is incomplete).

For L2TP over UDP, we need more infrastructure to match based the
content of UDP tunnels. I think the port should be one of the key to
look up for the possible protocol there, I can see 1701 is the L2TP
port. Then, we can add a definition to match the L2TP_HDR_T_BIT and
the version. On top of that, the sid and tid fields depend on the
version number, so we need to have a way to register different
interpretations based on the type, that should be possible from the
evaluation phase (just after the parsing). Thus, the design changes
with regards to xt_l2tp since in nft, the user will explicitly specify
what L2TP over UDP protocol version whats to match (in xt_l2tp this
occurs transparently to the user, in runtime from the packet path).

Does this assesment look correct to you?

Thanks!