History

netfilter: nft_payload: support for inner header matching / mangling

Allow to match and mangle on inner headers / payload data after the transport header. There is a new field in the pktinfo structure that stores the inner header offset which is calculated only when requested. Only TCP and UDP supported at this stage.

Pablo Neira Ayuso committed 5 years ago

Commit c46b38d1 parent b5bdc6f3 files · +58 −2Browse files

Showing the changes to include/uapi (1 of 3 files). Show all

Unified · Split

include/uapi/linux/netfilter/nf_tables.h+2−0
@@ -753,11 +753,13 @@ enum nft_dynset_attributes { · 752 unmodified lines
753 * @NFT_PAYLOAD_LL_HEADER: link layer header753 * @NFT_PAYLOAD_LL_HEADER: link layer header
754 * @NFT_PAYLOAD_NETWORK_HEADER: network header754 * @NFT_PAYLOAD_NETWORK_HEADER: network header
755 * @NFT_PAYLOAD_TRANSPORT_HEADER: transport header755 * @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
756 * @NFT_PAYLOAD_INNER_HEADER: inner header / payload
756 */757 */
757enum nft_payload_bases {758enum nft_payload_bases {
758 NFT_PAYLOAD_LL_HEADER,759 NFT_PAYLOAD_LL_HEADER,
759 NFT_PAYLOAD_NETWORK_HEADER,760 NFT_PAYLOAD_NETWORK_HEADER,
760 NFT_PAYLOAD_TRANSPORT_HEADER,761 NFT_PAYLOAD_TRANSPORT_HEADER,
762 NFT_PAYLOAD_INNER_HEADER,
761};763};
762 764
763/**765/**