Skip to contentSkip to conversation

netfilter: meta: secpath support

PATCH New Florian Westphal 1 participant 1 message Dec 6, 2017

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Florian Westphal

author maintainer
#0 lore raw

PATCH v2 1/1 netfilter: meta: secpath support

replacement for iptables "-m policy --dir in --policy {ipsec,none}".

Signed-off-by Florian Westphal <[email protected]>

---
Changes since v1:
- add ifdef CONFIG_XFRM in nft_meta_get_validate, no need for any check if we don't support xfrm.

 include/uapi/linux/netfilter/nf_tables.h |  2 ++
 net/netfilter/nft_meta.c                 | 43 ++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+)
include/uapi/linux/netfilter/nf_tables.h +2 -0
index a3ee277b17a1..2efbf9744c2a 100644
@@ -777,6 +777,7 @@ enum nft_exthdr_attributes {
  * @NFT_META_OIFGROUP: packet output interface group
  * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
  * @NFT_META_PRANDOM: a 32bit pseudo-random number
+ * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
  */
 enum nft_meta_keys {
 	NFT_META_LEN,

@@ -804,6 +805,7 @@ enum nft_meta_keys {
 	NFT_META_OIFGROUP,
 	NFT_META_CGROUP,
 	NFT_META_PRANDOM,
+	NFT_META_SECPATH,
 };
 
 /**
net/netfilter/nft_meta.c +43 -0

67 lines not on this page · raw message

Signature · 1 line
2.13.6