History

netfilter: nf_tables: rt: allow checking if dst has xfrm attached

Useful e.g. to avoid NATting inner headers of to-be-encrypted packets.

Florian Westphal committed 8 years ago

Commit 02b408f1 parent a82738a2 files · +13 −0Browse files

Showing the changes to include/uapi/linux (1 of 2 files). Show all

Unified · Split

include/uapi/linux/netfilter/nf_tables.h+2−0
@@ -826,12 +826,14 @@ enum nft_meta_keys { · 825 unmodified lines
826 * @NFT_RT_NEXTHOP4: routing nexthop for IPv4826 * @NFT_RT_NEXTHOP4: routing nexthop for IPv4
827 * @NFT_RT_NEXTHOP6: routing nexthop for IPv6827 * @NFT_RT_NEXTHOP6: routing nexthop for IPv6
828 * @NFT_RT_TCPMSS: fetch current path tcp mss828 * @NFT_RT_TCPMSS: fetch current path tcp mss
829 * @NFT_RT_XFRM: boolean, skb->dst->xfrm != NULL
829 */830 */
830enum nft_rt_keys {831enum nft_rt_keys {
831 NFT_RT_CLASSID,832 NFT_RT_CLASSID,
832 NFT_RT_NEXTHOP4,833 NFT_RT_NEXTHOP4,
833 NFT_RT_NEXTHOP6,834 NFT_RT_NEXTHOP6,
834 NFT_RT_TCPMSS,835 NFT_RT_TCPMSS,
836 NFT_RT_XFRM,
835 __NFT_RT_MAX837 __NFT_RT_MAX
836};838};
837#define NFT_RT_MAX (__NFT_RT_MAX - 1)839#define NFT_RT_MAX (__NFT_RT_MAX - 1)