net: sched: add em_ipt ematch for calling xtables matches
authorEyal Birger <eyal.birger@gmail.com>
Thu, 15 Feb 2018 17:42:43 +0000 (19:42 +0200)
committerDavid S. Miller <davem@davemloft.net>
Wed, 21 Feb 2018 18:15:33 +0000 (13:15 -0500)
commitccc007e4a746bb592d3e72106f00241f81d51410
tree986ff019562403f85554be3c7eb2f8ed9a635e83
parent022ddbca86ce692518bc1809e2dfe27add669608
net: sched: add em_ipt ematch for calling xtables matches

The commit a new tc ematch for using netfilter xtable matches.

This allows early classification as well as mirroning/redirecting traffic
based on logic implemented in netfilter extensions.

Current supported use case is classification based on the incoming IPSec
state used during decpsulation using the 'policy' iptables extension
(xt_policy).

The module dynamically fetches the netfilter match module and calls
it using a fake xt_action_param structure based on validated userspace
provided parameters.

As the xt_policy match does not access skb->data, no skb modifications
are needed on match.

Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/uapi/linux/pkt_cls.h
include/uapi/linux/tc_ematch/tc_em_ipt.h [new file with mode: 0644]
net/sched/Kconfig
net/sched/Makefile
net/sched/em_ipt.c [new file with mode: 0644]