This series is the userspace part of ipsec matching: rt ipsec meta ipsec rename ipsec (xfrm) expression. rt ipsec matches if outgoing route has a xfrm object attached to it (i.e., skb will be transformed). meta ipsec is same as meta secpath, it matches if skb has a secpath associated, i.e. incoming skb was handled via ipsec/xfrm. ipsec expression can be used to extract tunnel enpoint addresses, spi and request id from the xfrm state attached to an skb.
