net: sched: add em_ipt ematch for calling xtables matches

The commit a new tc ematch for using netfilter xtable matches. This allows early classification as well as mirroning/redirecting traffic based on logic implemented in netfilter extensions. Current supported use case is classification based on the incoming IPSec state used during decpsulation using the 'policy' iptables extension (xt_policy). The module dynamically fetches the netfilter match module and calls it using a fake xt_action_param structure based on validated userspace provided parameters. As the xt_policy match does not access skb->data, no skb modifications are needed on match.

Eyal Birger committed 8 years ago

Commit ccc007e1 parent 022ddbc5 files · +292 −1Browse files

Showing the changes to include/uapi/linux (2 of 5 files). Show all

Unified · Split

2 files

include/uapi/linux/pkt_cls.h +2 −1
include/uapi/linux/tc_ematch/tc_em_ipt.h +20 −0

include/uapi/linux/pkt_cls.h+2−1

@@ -555,7 +555,8 @@ enum { · 554 unmodified lines
555	#define TCF_EM_VLAN 6	555	#define TCF_EM_VLAN 6
556	#define TCF_EM_CANID 7	556	#define TCF_EM_CANID 7
557	#define TCF_EM_IPSET 8	557	#define TCF_EM_IPSET 8
558	#define TCF_EM_MAX 8	558	#define TCF_EM_IPT 9
		559	#define TCF_EM_MAX 9
559		560
560	enum {	561	enum {
561	TCF_EM_PROG_TC	562	TCF_EM_PROG_TC

include/uapi/linux/tc_ematch/tc_em_ipt.h+20−0

@@ -0,0 +1,20 @@
	1	/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
	2	#ifndef __LINUX_TC_EM_IPT_H
	3	#define __LINUX_TC_EM_IPT_H
	4
	5	#include <linux/types.h>
	6	#include <linux/pkt_cls.h>
	7
	8	enum {
	9	TCA_EM_IPT_UNSPEC,
	10	TCA_EM_IPT_HOOK,
	11	TCA_EM_IPT_MATCH_NAME,
	12	TCA_EM_IPT_MATCH_REVISION,
	13	TCA_EM_IPT_NFPROTO,
	14	TCA_EM_IPT_MATCH_DATA,
	15	__TCA_EM_IPT_MAX
	16	};
	17
	18	#define TCA_EM_IPT_MAX (__TCA_EM_IPT_MAX - 1)
	19
	20	#endif