[NETFILTER]: Add ipt_policy/ip6t_policy matches

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 104 insertions, 0 deletions

diff --git a/include/linux/netfilter_ipv4/ipt_policy.h b/include/linux/netfilter_ipv4/ipt_policy.h
new file mode 100644
index 000000000000..7fd1bec453f1
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ipt_policy.h
@@ -0,0 +1,52 @@
+#ifndef _IPT_POLICY_H
+#define _IPT_POLICY_H
+
+#define IPT_POLICY_MAX_ELEM     4
+
+enum ipt_policy_flags
+{
+        IPT_POLICY_MATCH_IN     = 0x1,
+        IPT_POLICY_MATCH_OUT    = 0x2,
+        IPT_POLICY_MATCH_NONE   = 0x4,
+        IPT_POLICY_MATCH_STRICT = 0x8,
+};
+
+enum ipt_policy_modes
+{
+        IPT_POLICY_MODE_TRANSPORT,
+        IPT_POLICY_MODE_TUNNEL
+};
+
+struct ipt_policy_spec
+{
+        u_int8_t        saddr:1,
+                        daddr:1,
+                        proto:1,
+                        mode:1,
+                        spi:1,
+                        reqid:1;
+};
+
+struct ipt_policy_elem
+{
+        u_int32_t       saddr;
+        u_int32_t       smask;
+        u_int32_t       daddr;
+        u_int32_t       dmask;
+        u_int32_t       spi;
+        u_int32_t       reqid;
+        u_int8_t        proto;
+        u_int8_t        mode;
+
+        struct ipt_policy_spec  match;
+        struct ipt_policy_spec  invert;
+};
+
+struct ipt_policy_info
+{
+        struct ipt_policy_elem pol[IPT_POLICY_MAX_ELEM];
+        u_int16_t flags;
+        u_int16_t len;
+};
+
+#endif /* _IPT_POLICY_H */
diff --git a/include/linux/netfilter_ipv6/ip6t_policy.h b/include/linux/netfilter_ipv6/ip6t_policy.h
new file mode 100644
index 000000000000..5a93afcd2ff1
--- /dev/null
+++ b/include/linux/netfilter_ipv6/ip6t_policy.h
@@ -0,0 +1,52 @@
+#ifndef _IP6T_POLICY_H
+#define _IP6T_POLICY_H
+
+#define IP6T_POLICY_MAX_ELEM    4
+
+enum ip6t_policy_flags
+{
+        IP6T_POLICY_MATCH_IN            = 0x1,
+        IP6T_POLICY_MATCH_OUT           = 0x2,
+        IP6T_POLICY_MATCH_NONE          = 0x4,
+        IP6T_POLICY_MATCH_STRICT        = 0x8,
+};
+
+enum ip6t_policy_modes
+{
+        IP6T_POLICY_MODE_TRANSPORT,
+        IP6T_POLICY_MODE_TUNNEL
+};
+
+struct ip6t_policy_spec
+{
+        u_int8_t        saddr:1,
+                        daddr:1,
+                        proto:1,
+                        mode:1,
+                        spi:1,
+                        reqid:1;
+};
+
+struct ip6t_policy_elem
+{
+        struct in6_addr saddr;
+        struct in6_addr smask;
+        struct in6_addr daddr;
+        struct in6_addr dmask;
+        u_int32_t       spi;
+        u_int32_t       reqid;
+        u_int8_t        proto;
+        u_int8_t        mode;
+
+        struct ip6t_policy_spec match;
+        struct ip6t_policy_spec invert;
+};
+
+struct ip6t_policy_info
+{
+        struct ip6t_policy_elem pol[IP6T_POLICY_MAX_ELEM];
+        u_int16_t flags;
+        u_int16_t len;
+};
+
+#endif /* _IP6T_POLICY_H */