mirror of
https://gitee.com/bianbu-linux/linux-6.6
synced 2025-07-12 00:43:36 -04:00
ccc007e4a7
The commit a new tc ematch for using netfilter xtable matches. This allows early classification as well as mirroning/redirecting traffic based on logic implemented in netfilter extensions. Current supported use case is classification based on the incoming IPSec state used during decpsulation using the 'policy' iptables extension (xt_policy). The module dynamically fetches the netfilter match module and calls it using a fake xt_action_param structure based on validated userspace provided parameters. As the xt_policy match does not access skb->data, no skb modifications are needed on match. Signed-off-by: Eyal Birger <eyal.birger@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
20 lines
391 B
C
20 lines
391 B
C
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
|
|
#ifndef __LINUX_TC_EM_IPT_H
|
|
#define __LINUX_TC_EM_IPT_H
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/pkt_cls.h>
|
|
|
|
enum {
|
|
TCA_EM_IPT_UNSPEC,
|
|
TCA_EM_IPT_HOOK,
|
|
TCA_EM_IPT_MATCH_NAME,
|
|
TCA_EM_IPT_MATCH_REVISION,
|
|
TCA_EM_IPT_NFPROTO,
|
|
TCA_EM_IPT_MATCH_DATA,
|
|
__TCA_EM_IPT_MAX
|
|
};
|
|
|
|
#define TCA_EM_IPT_MAX (__TCA_EM_IPT_MAX - 1)
|
|
|
|
#endif
|