History

netfilter: nft_meta: add support for slave device ifindex matching

Allow to match on vrf slave ifindex or name. In case there was no slave interface involved, store 0 in the destination register just like existing iif/oif matching. sdif(name) is restricted to the ipv4/ipv6 input and forward hooks, as it depends on ip(6) stack parsing/storing info in skb->cb[].

Florian Westphal committed 6 years ago

Commit c14ceb01 parent 01a0fc82 files · +73 −7Browse files

Showing the changes to include/uapi/linux (1 of 2 files). Show all

Unified · Split

include/uapi/linux/netfilter/nf_tables.h+4−0
@@ -805,6 +805,8 @@ enum nft_exthdr_attributes { · 804 unmodified lines
805 * @NFT_META_TIME_NS: time since epoch (in nanoseconds)805 * @NFT_META_TIME_NS: time since epoch (in nanoseconds)
806 * @NFT_META_TIME_DAY: day of week (from 0 = Sunday to 6 = Saturday)806 * @NFT_META_TIME_DAY: day of week (from 0 = Sunday to 6 = Saturday)
807 * @NFT_META_TIME_HOUR: hour of day (in seconds)807 * @NFT_META_TIME_HOUR: hour of day (in seconds)
808 * @NFT_META_SDIF: slave device interface index
809 * @NFT_META_SDIFNAME: slave device interface name
808 */810 */
809enum nft_meta_keys {811enum nft_meta_keys {
810 NFT_META_LEN,812 NFT_META_LEN,
@@ -840,6 +842,8 @@ enum nft_meta_keys { · 29 unmodified lines
840 NFT_META_TIME_NS,842 NFT_META_TIME_NS,
841 NFT_META_TIME_DAY,843 NFT_META_TIME_DAY,
842 NFT_META_TIME_HOUR,844 NFT_META_TIME_HOUR,
845 NFT_META_SDIF,
846 NFT_META_SDIFNAME,
843};847};
844 848
845/**849/**