net: sched: add ipset ematch

Can be used to match packets against netfilter ip sets created via ipset(8).
skb->sk_iif is used as 'incoming interface', skb->dev is 'outgoing interface'.

Since ipset is usually called from netfilter, the ematch
initializes a fake xt_action_param, pulls the ip header into the
linear area and also sets skb->data to the IP header (otherwise
matching Layer 4 set types doesn't work).

Tested-by: Mr Dash Four <mr.dash.four@googlemail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 2 insertions, 1 deletions

diff --git a/include/linux/pkt_cls.h b/include/linux/pkt_cls.h
index 38fbd4bc20ab..082eafaf026b 100644
--- a/include/linux/pkt_cls.h
+++ b/include/linux/pkt_cls.h
@@ -453,7 +453,8 @@ enum {
 #define TCF_EM_TEXT             5
 #define TCF_EM_VLAN             6
 #define TCF_EM_CANID            7
-#define TCF_EM_MAX              7
+#define TCF_EM_IPSET            8
+#define TCF_EM_MAX              8
 
 enum {
         TCF_EM_PROG_TC