diff options
| author | Máté Eckl <ecklm94@gmail.com> | 2018-09-05 11:16:44 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2018-09-21 12:06:27 +0200 |
| commit | 57c2b152c5f0866be5bf1acda2f341ba26ba9448 (patch) | |
| tree | 091cabd5ef590d0d0edf0dc972d3cf53ae0008cb /src/netlink_linearize.c | |
| parent | 8f55ed41d007061bd8aae94fee2bda172c0e8996 (diff) | |
src: add ipsec (xfrm) expression
This allows matching on ipsec tunnel/beet addresses in xfrm state
associated with a packet, ipsec request id and the SPI.
Examples:
ipsec in ip saddr 192.168.1.0/24
ipsec out ip6 daddr @endpoints
ipsec in spi 1-65536
Joint work with Florian Westphal.
Cc: Máté Eckl <ecklm94@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'src/netlink_linearize.c')
| -rw-r--r-- | src/netlink_linearize.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index 0bd946a1..0ac51bd0 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -679,6 +679,20 @@ static void netlink_gen_immediate(struct netlink_linearize_ctx *ctx, nftnl_rule_add_expr(ctx->nlr, nle); } +static void netlink_gen_xfrm(struct netlink_linearize_ctx *ctx, + const struct expr *expr, + enum nft_registers dreg) +{ + struct nftnl_expr *nle; + + nle = alloc_nft_expr("xfrm"); + netlink_put_register(nle, NFTNL_EXPR_XFRM_DREG, dreg); + nftnl_expr_set_u32(nle, NFTNL_EXPR_XFRM_KEY, expr->xfrm.key); + nftnl_expr_set_u8(nle, NFTNL_EXPR_XFRM_DIR, expr->xfrm.direction); + nftnl_expr_set_u32(nle, NFTNL_EXPR_XFRM_SPNUM, expr->xfrm.spnum); + nftnl_rule_add_expr(ctx->nlr, nle); +} + static void netlink_gen_expr(struct netlink_linearize_ctx *ctx, const struct expr *expr, enum nft_registers dreg) @@ -721,6 +735,8 @@ static void netlink_gen_expr(struct netlink_linearize_ctx *ctx, return netlink_gen_socket(ctx, expr, dreg); case EXPR_OSF: return netlink_gen_osf(ctx, expr, dreg); + case EXPR_XFRM: + return netlink_gen_xfrm(ctx, expr, dreg); default: BUG("unknown expression type %s\n", expr->ops->name); } |