History

netfilter: nf_tables: add support for native socket matching

Now it can only match the transparent flag of an ip/ipv6 socket.

Máté Eckl committed 8 years ago

Commit 554ced01 parent 78499584 files · +178 −0Browse files

Showing the changes to include/uapi/linux (1 of 4 files). Show all

Unified · Split

include/uapi/linux/netfilter/nf_tables.h+25−0
@@ -904,6 +904,31 @@ enum nft_rt_attributes { · 903 unmodified lines
904904 };
905905 #define NFTA_RT_MAX (__NFTA_RT_MAX - 1)
906906
907+/**
908+ * enum nft_socket_attributes - nf_tables socket expression netlink attributes
909+ *
910+ * @NFTA_SOCKET_KEY: socket key to match
911+ * @NFTA_SOCKET_DREG: destination register
912+ */
913+enum nft_socket_attributes {
914+ NFTA_SOCKET_UNSPEC,
915+ NFTA_SOCKET_KEY,
916+ NFTA_SOCKET_DREG,
917+ __NFTA_SOCKET_MAX
918+};
919+#define NFTA_SOCKET_MAX (__NFTA_SOCKET_MAX - 1)
920+
921+/*
922+ * enum nft_socket_keys - nf_tables socket expression keys
923+ *
924+ * @NFT_SOCKET_TRANSPARENT: Value of the IP(V6)_TRANSPARENT socket option_
925+ */
926+enum nft_socket_keys {
927+ NFT_SOCKET_TRANSPARENT,
928+ __NFT_SOCKET_MAX
929+};
930+#define NFT_SOCKET_MAX (__NFT_SOCKET_MAX - 1)
931+
907932 /**
908933 * enum nft_ct_keys - nf_tables ct expression keys
909934 *