From 57c2b152c5f0866be5bf1acda2f341ba26ba9448 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1t=C3=A9=20Eckl?= <ecklm94@gmail.com>
Date: Wed, 5 Sep 2018 11:16:44 +0200
Subject: src: add ipsec (xfrm) expression
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This allows matching on ipsec tunnel/beet addresses in xfrm state
associated with a packet, ipsec request id and the SPI.

Examples:

 ipsec in ip saddr 192.168.1.0/24
 ipsec out ip6 daddr @endpoints
 ipsec in spi 1-65536

Joint work with Florian Westphal.

Cc: Máté Eckl <ecklm94@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 include/expression.h | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'include/expression.h')

diff --git a/include/expression.h b/include/expression.h
index f2c5c1ad..fb52abfe 100644
--- a/include/expression.h
+++ b/include/expression.h
@@ -69,6 +69,7 @@ enum expr_types {
 	EXPR_HASH,
 	EXPR_RT,
 	EXPR_FIB,
+	EXPR_XFRM,
 };
 
 enum ops {
@@ -194,6 +195,7 @@ enum expr_flags {
 #include <ct.h>
 #include <socket.h>
 #include <osf.h>
+#include <xfrm.h>
 
 /**
  * struct expr
@@ -337,6 +339,12 @@ struct expr {
 			uint32_t		flags;
 			uint32_t		result;
 		} fib;
+		struct {
+			/* EXPR_XFRM */
+			enum nft_xfrm_keys	key;
+			uint8_t		direction;
+			uint8_t		spnum;
+		} xfrm;
 	};
 };
 
-- 
cgit v1.2.3