Re: [PATCH nf] netfilter: nft_meta: improve the validity check of pkttype set expr

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Aug 22, 2016 at 10:57:56PM +0800, Liping Zhang wrote:
> From: Liping Zhang <liping.zhang@spreadtrum.com>
> 
> "meta pkttype set" is only supported on prerouting chain with bridge
> family and ingress chain with netdev family.
> 
> But the validate check is incomplete, and the user can add the nft
> rules on input chain with bridge family, for example:
>   # nft add table bridge filter
>   # nft add chain bridge filter input {type filter hook input \
>     priority 0 \;}
>   # nft add chain bridge filter test
>   # nft add rule bridge filter test meta pkttype set unicast
>   # nft add rule bridge filter input jump test
> 
> This patch fixes the problem.

Good catch, applied, thanks!

Actually, it would be good to allow mangling this pkttype from
prerouting ip and ip6 too, so we can emulate the 'cluster match' very
easily.

Now we have a hash expression in place, which is what was missing to
support this.

So, once your fix shows up in the nf-next tree, I'd appreciate if you
can follow up with a patch to allow the use of this from there.
Thanks!