netfilter: nft_meta: add inner match support

Browse source

Add support for inner meta matching on:

- NFT_META_PROTOCOL: to match on the ethertype, this can be used
  regardless tunnel protocol provides no link layer header, in that case
  nft_inner sets on the ethertype based on the IP header version field.
- NFT_META_L4PROTO: to match on the layer 4 protocol.

These meta expression are usually autogenerated as dependencies by
userspace nftables.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Pablo Neira Ayuso 2022-10-17 13:03:33 +02:00

parent 0e795b37ba

commit a150d122b6

3 changed files with 76 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

include/net/netfilter/nft_meta.h

View file

8

net/netfilter/nft_inner.c

View file

62

net/netfilter/nft_meta.c

View file