Add the ability to set the security context of packets within the nf_tables framework. Add a nft_object for holding security contexts in the kernel and manipulating packets on the wire. Convert the security context strings at rule addition time to security identifiers. This is the same behavior like in xt_SECMARK and offers better performance than computing it per packet. Set the maximum security context length to 256.
Showing the changes to include/uapi/linux (1 of 4 files). Show all
Unified · Split
| @@ -1176,6 +1176,21 @@ enum nft_quota_attributes { · 1175 unmodified lines | ||
| 1176 | 1176 | }; |
| 1177 | 1177 | #define NFTA_QUOTA_MAX (__NFTA_QUOTA_MAX - 1) |
| 1178 | 1178 | |
| 1179 | +/** | |
| 1180 | + * enum nft_secmark_attributes - nf_tables secmark object netlink attributes | |
| 1181 | + * | |
| 1182 | + * @NFTA_SECMARK_CTX: security context (NLA_STRING) | |
| 1183 | + */ | |
| 1184 | +enum nft_secmark_attributes { | |
| 1185 | + NFTA_SECMARK_UNSPEC, | |
| 1186 | + NFTA_SECMARK_CTX, | |
| 1187 | + __NFTA_SECMARK_MAX, | |
| 1188 | +}; | |
| 1189 | +#define NFTA_SECMARK_MAX (__NFTA_SECMARK_MAX - 1) | |
| 1190 | + | |
| 1191 | +/* Max security context length */ | |
| 1192 | +#define NFT_SECMARK_CTX_MAXLEN 256 | |
| 1193 | + | |
| 1179 | 1194 | /** |
| 1180 | 1195 | * enum nft_reject_types - nf_tables reject expression reject types |
| 1181 | 1196 | * |
| @@ -1432,7 +1447,8 @@ enum nft_ct_timeout_timeout_attributes { · 250 unmodified lines | ||
| 1432 | 1447 | #define NFT_OBJECT_CONNLIMIT 5 |
| 1433 | 1448 | #define NFT_OBJECT_TUNNEL 6 |
| 1434 | 1449 | #define NFT_OBJECT_CT_TIMEOUT 7 |
| 1435 | −#define __NFT_OBJECT_MAX 8 | |
| 1450 | +#define NFT_OBJECT_SECMARK 8 | |
| 1451 | +#define __NFT_OBJECT_MAX 9 | |
| 1436 | 1452 | #define NFT_OBJECT_MAX (__NFT_OBJECT_MAX - 1) |
| 1437 | 1453 | |
| 1438 | 1454 | /** |