src: add support for setting secmark

Add support for new nft object secmark holding security context strings.

The following should demonstrate its usage (based on SELinux context):

    # define a tag containing a context string
    nft add secmark inet filter sshtag \"system_u:object_r:ssh_server_packet_t:s0\"
    nft list secmarks

    # set the secmark
    nft add rule inet filter input tcp dport 22 meta secmark set sshtag

    # map usage
    nft add map inet filter secmapping { type inet_service : secmark \; }
    nft add element inet filter secmapping { 22 : sshtag }
    nft list maps
    nft list map inet filter secmapping
    nft add rule inet filter input meta secmark set tcp dport map @secmapping

[ Original patch based on v0.9.0. Rebase on top on git HEAD. --pablo ]

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 3 insertions, 0 deletions

diff --git a/src/scanner.l b/src/scanner.l
index 4a143b1e..f96944e9 100644
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -564,6 +564,9 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
 "in"			{ return IN; }
 "out"			{ return OUT; }
 
+"secmark"		{ return SECMARK; }
+"secmarks"		{ return SECMARKS; }
+
 {addrstring}		{
 				yylval->string = xstrdup(yytext);
 				return STRING;