Hi,
This is version 3 for this patchset.
The inner expression provides a packet parser for the tunneled packet
which uses a userspace description of the expected inner headers. Then,
the inner expression (only payload and meta supported at this stage) is
used to match on the inner header protocol fields, using the new link,
network and transport offsets as well as inner metadata.
This patchset adds support for VxLAN, Geneve, GRE and IPIP. More tunnel
protocol can be supported via userspace updates only.
Changes in this v3:
Patch #1 handle GREv0 and GREv1 (PPTP) and variable size header depending
on flags.
Patch #2 no changes
Patch #3 no changes
Patch #4 update existing percpu tunnel context only if header parser fully
succeeds, to not leave tunnel context in inconsistent state.
Patch #5 no changes.
Patch #6 no changes.
Pablo Neira Ayuso (6):
netfilter: nft_payload: access GRE payload via inner offset
netfilter: nft_payload: access ipip payload for inner offset
netfilter: nft_inner: support for inner tunnel header matching
netfilter: nft_inner: add percpu inner context
netfilter: nft_meta: add inner match support
netfilter: nft_inner: add geneve support
include/net/netfilter/nf_tables.h | 6 +
include/net/netfilter/nf_tables_core.h | 25 ++
include/net/netfilter/nft_meta.h | 6 +
include/uapi/linux/netfilter/nf_tables.h | 27 ++
net/netfilter/Makefile | 3 +-
net/netfilter/nf_tables_api.c | 37 +++
net/netfilter/nf_tables_core.c | 1 +
net/netfilter/nft_inner.c | 368 +++++++++++++++++++++++
net/netfilter/nft_meta.c | 62 ++++
net/netfilter/nft_payload.c | 130 +++++++-
10 files changed, 663 insertions(+), 2 deletions(-)
create mode 100644 net/netfilter/nft_inner.c
--
2.30.2
