From 57c2b152c5f0866be5bf1acda2f341ba26ba9448 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1t=C3=A9=20Eckl?= Date: Wed, 5 Sep 2018 11:16:44 +0200 Subject: src: add ipsec (xfrm) expression MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This allows matching on ipsec tunnel/beet addresses in xfrm state associated with a packet, ipsec request id and the SPI. Examples: ipsec in ip saddr 192.168.1.0/24 ipsec out ip6 daddr @endpoints ipsec in spi 1-65536 Joint work with Florian Westphal. Cc: Máté Eckl Signed-off-by: Florian Westphal --- include/xfrm.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 include/xfrm.h (limited to 'include/xfrm.h') diff --git a/include/xfrm.h b/include/xfrm.h new file mode 100644 index 00000000..ea7d322c --- /dev/null +++ b/include/xfrm.h @@ -0,0 +1,16 @@ +#ifndef NFTABLES_XFRM_H +#define NFTABLES_XFRM_H + +struct xfrm_template { + const char *token; + const struct datatype *dtype; + unsigned int len; + enum byteorder byteorder; +}; + +extern const struct xfrm_template xfrm_templates[__NFT_XFRM_KEY_MAX]; + +extern struct expr *xfrm_expr_alloc(const struct location *loc, + uint8_t direction, uint8_t spnum, + enum nft_xfrm_keys key); +#endif -- cgit v1.2.3