netfilter: nf_tables: add tunnel support

This patch implements the tunnel object type that can be used to
configure tunnels via metadata template through the existing lightweight
API from the ingress path.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 68 insertions, 1 deletions

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index f112ea52dc1a..3ee1198eeac1 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -1416,7 +1416,8 @@ enum nft_ct_helper_attributes {
 #define NFT_OBJECT_CT_HELPER    3
 #define NFT_OBJECT_LIMIT        4
 #define NFT_OBJECT_CONNLIMIT    5
-#define __NFT_OBJECT_MAX        6
+#define NFT_OBJECT_TUNNEL       6
+#define __NFT_OBJECT_MAX        7
 #define NFT_OBJECT_MAX          (__NFT_OBJECT_MAX - 1)
 
 /**
@@ -1580,4 +1581,70 @@ enum nft_ng_types {
 };
 #define NFT_NG_MAX      (__NFT_NG_MAX - 1)
 
+enum nft_tunnel_key_ip_attributes {
+        NFTA_TUNNEL_KEY_IP_UNSPEC,
+        NFTA_TUNNEL_KEY_IP_SRC,
+        NFTA_TUNNEL_KEY_IP_DST,
+        __NFTA_TUNNEL_KEY_IP_MAX
+};
+#define NFTA_TUNNEL_KEY_IP_MAX  (__NFTA_TUNNEL_KEY_IP_MAX - 1)
+
+enum nft_tunnel_ip6_attributes {
+        NFTA_TUNNEL_KEY_IP6_UNSPEC,
+        NFTA_TUNNEL_KEY_IP6_SRC,
+        NFTA_TUNNEL_KEY_IP6_DST,
+        NFTA_TUNNEL_KEY_IP6_FLOWLABEL,
+        __NFTA_TUNNEL_KEY_IP6_MAX
+};
+#define NFTA_TUNNEL_KEY_IP6_MAX (__NFTA_TUNNEL_KEY_IP6_MAX - 1)
+
+enum nft_tunnel_opts_attributes {
+        NFTA_TUNNEL_KEY_OPTS_UNSPEC,
+        NFTA_TUNNEL_KEY_OPTS_VXLAN,
+        NFTA_TUNNEL_KEY_OPTS_ERSPAN,
+        __NFTA_TUNNEL_KEY_OPTS_MAX
+};
+#define NFTA_TUNNEL_KEY_OPTS_MAX        (__NFTA_TUNNEL_KEY_OPTS_MAX - 1)
+
+enum nft_tunnel_opts_vxlan_attributes {
+        NFTA_TUNNEL_KEY_VXLAN_UNSPEC,
+        NFTA_TUNNEL_KEY_VXLAN_GBP,
+        __NFTA_TUNNEL_KEY_VXLAN_MAX
+};
+#define NFTA_TUNNEL_KEY_VXLAN_MAX       (__NFTA_TUNNEL_KEY_VXLAN_MAX - 1)
+
+enum nft_tunnel_opts_erspan_attributes {
+        NFTA_TUNNEL_KEY_ERSPAN_UNSPEC,
+        NFTA_TUNNEL_KEY_ERSPAN_VERSION,
+        NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX,
+        NFTA_TUNNEL_KEY_ERSPAN_V2_HWID,
+        NFTA_TUNNEL_KEY_ERSPAN_V2_DIR,
+        __NFTA_TUNNEL_KEY_ERSPAN_MAX
+};
+#define NFTA_TUNNEL_KEY_ERSPAN_MAX      (__NFTA_TUNNEL_KEY_ERSPAN_MAX - 1)
+
+enum nft_tunnel_flags {
+        NFT_TUNNEL_F_ZERO_CSUM_TX       = (1 << 0),
+        NFT_TUNNEL_F_DONT_FRAGMENT      = (1 << 1),
+        NFT_TUNNEL_F_SEQ_NUMBER         = (1 << 2),
+};
+#define NFT_TUNNEL_F_MASK       (NFT_TUNNEL_F_ZERO_CSUM_TX | \
+                                 NFT_TUNNEL_F_DONT_FRAGMENT | \
+                                 NFT_TUNNEL_F_SEQ_NUMBER)
+
+enum nft_tunnel_key_attributes {
+        NFTA_TUNNEL_KEY_UNSPEC,
+        NFTA_TUNNEL_KEY_ID,
+        NFTA_TUNNEL_KEY_IP,
+        NFTA_TUNNEL_KEY_IP6,
+        NFTA_TUNNEL_KEY_FLAGS,
+        NFTA_TUNNEL_KEY_TOS,
+        NFTA_TUNNEL_KEY_TTL,
+        NFTA_TUNNEL_KEY_SPORT,
+        NFTA_TUNNEL_KEY_DPORT,
+        NFTA_TUNNEL_KEY_OPTS,
+        __NFTA_TUNNEL_KEY_MAX
+};
+#define NFTA_TUNNEL_KEY_MAX     (__NFTA_TUNNEL_KEY_MAX - 1)
+
 #endif /* _LINUX_NF_TABLES_H */