# ipsec in reqid 1 [ { "match": { "left": { "ipsec": { "dir": "in", "key": "reqid", "spnum": 0 } }, "op": "==", "right": 1 } } ] # ipsec in spnum 0 reqid 1 [ { "match": { "left": { "ipsec": { "dir": "in", "key": "reqid", "spnum": 0 } }, "op": "==", "right": 1 } } ] # ipsec out reqid 0xffffffff [ { "match": { "left": { "ipsec": { "dir": "out", "key": "reqid", "spnum": 0 } }, "op": "==", "right": 4294967295 } } ] # ipsec out spi 1-561 [ { "match": { "left": { "ipsec": { "dir": "out", "key": "spi", "spnum": 0 } }, "op": "==", "right": { "range": [ 1, 561 ] } } } ] # ipsec in spnum 2 ip saddr { 1.2.3.4, 10.6.0.0/16 } [ { "match": { "left": { "ipsec": { "dir": "in", "family": "ip", "key": "saddr", "spnum": 2 } }, "op": "==", "right": { "set": [ "1.2.3.4", { "prefix": { "addr": "10.6.0.0", "len": 16 } } ] } } } ] # ipsec in ip6 daddr dead::beef [ { "match": { "left": { "ipsec": { "dir": "in", "family": "ip6", "key": "daddr", "spnum": 0 } }, "op": "==", "right": "dead::beef" } } ] # ipsec out ip6 saddr dead::feed [ { "match": { "left": { "ipsec": { "dir": "out", "family": "ip6", "key": "saddr", "spnum": 0 } }, "op": "==", "right": "dead::feed" } } ]