History

netfilter: nft_socket: add support for cgroupsv2

Allow to match on the cgroupsv2 id from ancestor level.

Pablo Neira Ayuso committed 5 years ago

Commit e0bb96d1 parent 885e8c62 files · +51 −1Browse files

Showing the changes to include/uapi (1 of 2 files). Show all

Unified · Split

include/uapi/linux/netfilter/nf_tables.h+4−0
@@ -1014,11 +1014,13 @@ enum nft_rt_attributes { · 1013 unmodified lines
1014 *1014 *
1015 * @NFTA_SOCKET_KEY: socket key to match1015 * @NFTA_SOCKET_KEY: socket key to match
1016 * @NFTA_SOCKET_DREG: destination register1016 * @NFTA_SOCKET_DREG: destination register
1017 * @NFTA_SOCKET_LEVEL: cgroups2 ancestor level (only for cgroupsv2)
1017 */1018 */
1018enum nft_socket_attributes {1019enum nft_socket_attributes {
1019 NFTA_SOCKET_UNSPEC,1020 NFTA_SOCKET_UNSPEC,
1020 NFTA_SOCKET_KEY,1021 NFTA_SOCKET_KEY,
1021 NFTA_SOCKET_DREG,1022 NFTA_SOCKET_DREG,
1023 NFTA_SOCKET_LEVEL,
1022 __NFTA_SOCKET_MAX1024 __NFTA_SOCKET_MAX
1023};1025};
1024#define NFTA_SOCKET_MAX (__NFTA_SOCKET_MAX - 1)1026#define NFTA_SOCKET_MAX (__NFTA_SOCKET_MAX - 1)
@@ -1029,11 +1031,13 @@ enum nft_socket_attributes { · 4 unmodified lines
1029 * @NFT_SOCKET_TRANSPARENT: Value of the IP(V6)_TRANSPARENT socket option1031 * @NFT_SOCKET_TRANSPARENT: Value of the IP(V6)_TRANSPARENT socket option
1030 * @NFT_SOCKET_MARK: Value of the socket mark1032 * @NFT_SOCKET_MARK: Value of the socket mark
1031 * @NFT_SOCKET_WILDCARD: Whether the socket is zero-bound (e.g. 0.0.0.0 or ::0)1033 * @NFT_SOCKET_WILDCARD: Whether the socket is zero-bound (e.g. 0.0.0.0 or ::0)
1034 * @NFT_SOCKET_CGROUPV2: Match on cgroups version 2
1032 */1035 */
1033enum nft_socket_keys {1036enum nft_socket_keys {
1034 NFT_SOCKET_TRANSPARENT,1037 NFT_SOCKET_TRANSPARENT,
1035 NFT_SOCKET_MARK,1038 NFT_SOCKET_MARK,
1036 NFT_SOCKET_WILDCARD,1039 NFT_SOCKET_WILDCARD,
1040 NFT_SOCKET_CGROUPV2,
1037 __NFT_SOCKET_MAX1041 __NFT_SOCKET_MAX
1038};1042};
1039#define NFT_SOCKET_MAX (__NFT_SOCKET_MAX - 1)1043#define NFT_SOCKET_MAX (__NFT_SOCKET_MAX - 1)