xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: nf_tables: add tunnel support

Browse Source 
This patch implements the tunnel object type that can be used to
configure tunnels via metadata template through the existing lightweight
API from the ingress path.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso
2018-08-02 20:51:39 +02:00
parent 033eab53ff
commit af308b94a2
5 changed files with 534 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

69
include/uapi/linux/netfilter/nf_tables.h
View File

@@ -1416,7 +1416,8 @@ enum nft_ct_helper_attributes {
#define NFT_OBJECT_CT_HELPER 3
#define NFT_OBJECT_LIMIT 4
#define NFT_OBJECT_CONNLIMIT 5
#define __NFT_OBJECT_MAX 6
#define NFT_OBJECT_TUNNEL 6
#define __NFT_OBJECT_MAX 7
#define NFT_OBJECT_MAX (__NFT_OBJECT_MAX - 1)
/**
@@ -1580,4 +1581,70 @@ enum nft_ng_types {
};
#define NFT_NG_MAX (__NFT_NG_MAX - 1)
enum nft_tunnel_key_ip_attributes {
NFTA_TUNNEL_KEY_IP_UNSPEC,
NFTA_TUNNEL_KEY_IP_SRC,
NFTA_TUNNEL_KEY_IP_DST,
__NFTA_TUNNEL_KEY_IP_MAX
};
#define NFTA_TUNNEL_KEY_IP_MAX (__NFTA_TUNNEL_KEY_IP_MAX - 1)
enum nft_tunnel_ip6_attributes {
NFTA_TUNNEL_KEY_IP6_UNSPEC,
NFTA_TUNNEL_KEY_IP6_SRC,
NFTA_TUNNEL_KEY_IP6_DST,
NFTA_TUNNEL_KEY_IP6_FLOWLABEL,
__NFTA_TUNNEL_KEY_IP6_MAX
};
#define NFTA_TUNNEL_KEY_IP6_MAX (__NFTA_TUNNEL_KEY_IP6_MAX - 1)
enum nft_tunnel_opts_attributes {
NFTA_TUNNEL_KEY_OPTS_UNSPEC,
NFTA_TUNNEL_KEY_OPTS_VXLAN,
NFTA_TUNNEL_KEY_OPTS_ERSPAN,
__NFTA_TUNNEL_KEY_OPTS_MAX
};
#define NFTA_TUNNEL_KEY_OPTS_MAX (__NFTA_TUNNEL_KEY_OPTS_MAX - 1)
enum nft_tunnel_opts_vxlan_attributes {
NFTA_TUNNEL_KEY_VXLAN_UNSPEC,
NFTA_TUNNEL_KEY_VXLAN_GBP,
__NFTA_TUNNEL_KEY_VXLAN_MAX
};
#define NFTA_TUNNEL_KEY_VXLAN_MAX (__NFTA_TUNNEL_KEY_VXLAN_MAX - 1)
enum nft_tunnel_opts_erspan_attributes {
NFTA_TUNNEL_KEY_ERSPAN_UNSPEC,
NFTA_TUNNEL_KEY_ERSPAN_VERSION,
NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX,
NFTA_TUNNEL_KEY_ERSPAN_V2_HWID,
NFTA_TUNNEL_KEY_ERSPAN_V2_DIR,
__NFTA_TUNNEL_KEY_ERSPAN_MAX
};
#define NFTA_TUNNEL_KEY_ERSPAN_MAX (__NFTA_TUNNEL_KEY_ERSPAN_MAX - 1)
enum nft_tunnel_flags {
NFT_TUNNEL_F_ZERO_CSUM_TX = (1 << 0),
NFT_TUNNEL_F_DONT_FRAGMENT = (1 << 1),
NFT_TUNNEL_F_SEQ_NUMBER = (1 << 2),
};
#define NFT_TUNNEL_F_MASK (NFT_TUNNEL_F_ZERO_CSUM_TX | \
NFT_TUNNEL_F_DONT_FRAGMENT | \
NFT_TUNNEL_F_SEQ_NUMBER)
enum nft_tunnel_key_attributes {
NFTA_TUNNEL_KEY_UNSPEC,
NFTA_TUNNEL_KEY_ID,
NFTA_TUNNEL_KEY_IP,
NFTA_TUNNEL_KEY_IP6,
NFTA_TUNNEL_KEY_FLAGS,
NFTA_TUNNEL_KEY_TOS,
NFTA_TUNNEL_KEY_TTL,
NFTA_TUNNEL_KEY_SPORT,
NFTA_TUNNEL_KEY_DPORT,
NFTA_TUNNEL_KEY_OPTS,
__NFTA_TUNNEL_KEY_MAX
};
#define NFTA_TUNNEL_KEY_MAX (__NFTA_TUNNEL_KEY_MAX - 1)
#endif /* _LINUX_NF_TABLES_H */