The commit a new tc ematch for using netfilter xtable matches. This allows early classification as well as mirroning/redirecting traffic based on logic implemented in netfilter extensions. Current supported use case is classification based on the incoming IPSec state used during decpsulation using the 'policy' iptables extension (xt_policy). The module dynamically fetches the netfilter match module and calls it using a fake xt_action_param structure based on validated userspace provided parameters. As the xt_policy match does not access skb->data, no skb modifications are needed on match.
Showing the changes to include/uapi/linux (2 of 5 files). Show all
Unified · Split
| @@ -555,7 +555,8 @@ enum { · 554 unmodified lines | ||
| 555 | 555 | #define TCF_EM_VLAN 6 |
| 556 | 556 | #define TCF_EM_CANID 7 |
| 557 | 557 | #define TCF_EM_IPSET 8 |
| 558 | −#define TCF_EM_MAX 8 | |
| 558 | +#define TCF_EM_IPT 9 | |
| 559 | +#define TCF_EM_MAX 9 | |
| 559 | 560 | |
| 560 | 561 | enum { |
| 561 | 562 | TCF_EM_PROG_TC |
| @@ -0,0 +1,20 @@ | ||
| 1 | +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ | |
| 2 | +#ifndef __LINUX_TC_EM_IPT_H | |
| 3 | +#define __LINUX_TC_EM_IPT_H | |
| 4 | + | |
| 5 | +#include <linux/types.h> | |
| 6 | +#include <linux/pkt_cls.h> | |
| 7 | + | |
| 8 | +enum { | |
| 9 | + TCA_EM_IPT_UNSPEC, | |
| 10 | + TCA_EM_IPT_HOOK, | |
| 11 | + TCA_EM_IPT_MATCH_NAME, | |
| 12 | + TCA_EM_IPT_MATCH_REVISION, | |
| 13 | + TCA_EM_IPT_NFPROTO, | |
| 14 | + TCA_EM_IPT_MATCH_DATA, | |
| 15 | + __TCA_EM_IPT_MAX | |
| 16 | +}; | |
| 17 | + | |
| 18 | +#define TCA_EM_IPT_MAX (__TCA_EM_IPT_MAX - 1) | |
| 19 | + | |
| 20 | +#endif | |