diff options
| author | Florian Westphal <fw@strlen.de> | 2018-09-03 18:09:40 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-09-17 11:40:08 +0200 |
| commit | 6c47260250fc6114ce2012db13e1cd3938a27b73 (patch) | |
| tree | d74409b815de73b670c981d1450501531beee1a2 /net/netfilter/Kconfig | |
| parent | 2953d80ff04862b26a2e628fb3948868f54d753d (diff) | |
| download | linux-6c47260250fc6114ce2012db13e1cd3938a27b73.tar.gz | |
netfilter: nf_tables: add xfrm expression
supports fetching saddr/daddr of tunnel mode states, request id and spi.
If direction is 'in', use inbound skb secpath, else dst->xfrm.
Joint work with Máté Eckl.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/Kconfig')
| -rw-r--r-- | net/netfilter/Kconfig | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig index f61c306de1d08..2ab870ef233a8 100644 --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig @@ -625,6 +625,13 @@ config NFT_FIB_INET The lookup will be delegated to the IPv4 or IPv6 FIB depending on the protocol of the packet. +config NFT_XFRM + tristate "Netfilter nf_tables xfrm/IPSec security association matching" + depends on XFRM + help + This option adds an expression that you can use to extract properties + of a packets security association. + config NFT_SOCKET tristate "Netfilter nf_tables socket match support" depends on IPV6 || IPV6=n |