[PATCH nf-next v4 06/12] netfilter: nft_tunnel: support NFT_TUNNEL_IP_SRC/DST match

[wenxu]

From: wenxu <we...@ucloud.cn>

Add new two NFT_TUNNEL_IP_SRC/DST match in nft_tunnel

Signed-off-by: wenxu <we...@ucloud.cn>
---
v4: don't convert ipaddr to host

 include/uapi/linux/netfilter/nf_tables.h |  2 ++
 net/netfilter/nft_tunnel.c               | 22 ++++++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/include/uapi/linux/netfilter/nf_tables.h 
b/include/uapi/linux/netfilter/nf_tables.h
index 82abaa1..4f1e5ef 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -1765,6 +1765,8 @@ enum nft_tunnel_key_attributes {
 enum nft_tunnel_keys {
        NFT_TUNNEL_PATH,
        NFT_TUNNEL_ID,
+       NFT_TUNNEL_IP_SRC,
+       NFT_TUNNEL_IP_DST,
        __NFT_TUNNEL_MAX
 };
 #define NFT_TUNNEL_MAX (__NFT_TUNNEL_MAX - 1)
diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
index d374466..fe544bf 100644
--- a/net/netfilter/nft_tunnel.c
+++ b/net/netfilter/nft_tunnel.c
@@ -61,6 +61,26 @@ static void nft_tunnel_get_eval(const struct nft_expr *expr,
                else
                        regs->verdict.code = NFT_BREAK;
                break;
+       case NFT_TUNNEL_IP_SRC:
+               if (!tun_info) {
+                       regs->verdict.code = NFT_BREAK;
+                       return;
+               }
+               if (nft_tunnel_mode_validate(priv->mode, tun_info->mode))
+                       *dest = tun_info->key.u.ipv4.src;
+               else
+                       regs->verdict.code = NFT_BREAK;
+               break;
+       case NFT_TUNNEL_IP_DST:
+               if (!tun_info) {
+                       regs->verdict.code = NFT_BREAK;
+                       return;
+               }
+               if (nft_tunnel_mode_validate(priv->mode, tun_info->mode))
+                       *dest = tun_info->key.u.ipv4.dst;
+               else
+                       regs->verdict.code = NFT_BREAK;
+               break;
        default:
                WARN_ON(1);
                regs->verdict.code = NFT_BREAK;
@@ -90,6 +110,8 @@ static int nft_tunnel_get_init(const struct nft_ctx *ctx,
                len = sizeof(u8);
                break;
        case NFT_TUNNEL_ID:
+       case NFT_TUNNEL_IP_SRC:
+       case NFT_TUNNEL_IP_DST:
                len = sizeof(u32);
                break;
        default:
-- 
1.8.3.1