xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: nf_tables: add xfrm expression

Browse Source 
supports fetching saddr/daddr of tunnel mode states, request id and spi.
If direction is 'in', use inbound skb secpath, else dst->xfrm.

Joint work with Máté Eckl.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal
2018-09-03 18:09:40 +02:00
committed by Pablo Neira Ayuso
parent 2953d80ff0
commit 6c47260250
4 changed files with 330 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
include/uapi/linux/netfilter/nf_tables.h
View File

@@ -1514,6 +1514,35 @@ enum nft_devices_attributes {
};
#define NFTA_DEVICE_MAX (__NFTA_DEVICE_MAX - 1)
/*
* enum nft_xfrm_attributes - nf_tables xfrm expr netlink attributes
*
* @NFTA_XFRM_DREG: destination register (NLA_U32)
* @NFTA_XFRM_KEY: enum nft_xfrm_keys (NLA_U32)
* @NFTA_XFRM_DIR: direction (NLA_U8)
* @NFTA_XFRM_SPNUM: index in secpath array (NLA_U32)
*/
enum nft_xfrm_attributes {
NFTA_XFRM_UNSPEC,
NFTA_XFRM_DREG,
NFTA_XFRM_KEY,
NFTA_XFRM_DIR,
NFTA_XFRM_SPNUM,
__NFTA_XFRM_MAX
};
#define NFTA_XFRM_MAX (__NFTA_XFRM_MAX - 1)
enum nft_xfrm_keys {
NFT_XFRM_KEY_UNSPEC,
NFT_XFRM_KEY_DADDR_IP4,
NFT_XFRM_KEY_DADDR_IP6,
NFT_XFRM_KEY_SADDR_IP4,
NFT_XFRM_KEY_SADDR_IP6,
NFT_XFRM_KEY_REQID,
NFT_XFRM_KEY_SPI,
__NFT_XFRM_KEY_MAX,
};
#define NFT_XFRM_KEY_MAX (__NFT_XFRM_KEY_MAX - 1)
/**
* enum nft_trace_attributes - nf_tables trace netlink attributes