History

netfilter: nf_tables: rt: allow checking if dst has xfrm attached

Useful e.g. to avoid NATting inner headers of to-be-encrypted packets.

Florian Westphal committed 8 years ago

Commit 02b408f1 parent a82738a2 files · +13 −0Browse files

Showing the changes to include/uapi/linux (1 of 2 files). Show all

Unified · Split

include/uapi/linux/netfilter/nf_tables.h+2−0
@@ -826,12 +826,14 @@ enum nft_meta_keys { · 825 unmodified lines
826826 * @NFT_RT_NEXTHOP4: routing nexthop for IPv4
827827 * @NFT_RT_NEXTHOP6: routing nexthop for IPv6
828828 * @NFT_RT_TCPMSS: fetch current path tcp mss
829+ * @NFT_RT_XFRM: boolean, skb->dst->xfrm != NULL
829830 */
830831 enum nft_rt_keys {
831832 NFT_RT_CLASSID,
832833 NFT_RT_NEXTHOP4,
833834 NFT_RT_NEXTHOP6,
834835 NFT_RT_TCPMSS,
836+ NFT_RT_XFRM,
835837 __NFT_RT_MAX
836838 };
837839 #define NFT_RT_MAX (__NFT_RT_MAX - 1)