Re: [PATCH v3] netfilter: nft_meta: support for time matching

[Ander Juaristi <a@juaristi.eus>]

On 2/8/19 9:12, Ander Juaristi wrote:
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> index 82abaa183fc3..6d9dd120b466 100644
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -799,6 +799,9 @@ enum nft_exthdr_attributes {
>    * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
>    * @NFT_META_BRI_IIFPVID: packet input bridge port pvid
>    * @NFT_META_BRI_IIFVPROTO: packet input bridge vlan proto
> + * @NFT_META_TIME: a UNIX timestamp
> + * @NFT_META_TIME_DAY: day of week
> + * @NFT_META_TIME_HOUR: hour of day
>    */
>   enum nft_meta_keys {
>   	NFT_META_LEN,
> @@ -829,8 +832,9 @@ enum nft_meta_keys {
>   	NFT_META_SECPATH,
>   	NFT_META_IIFKIND,
>   	NFT_META_OIFKIND,
> -	NFT_META_BRI_IIFPVID,
> -	NFT_META_BRI_IIFVPROTO,

I needed to remove these two so that the next three constants take the 
correct values (otherwise it won't work because the meta keys sent by 
userspace and those expected by the kernel don't match).

Those two constants NFT_META_BRI_IIFPVID and NFT_META_BRI_IIFVPROTO 
aren't defined in nftables, I don't know why.

I leave up to you to decide how to merge this: either manually give 
NFT_META_TIME the correct value, or replicate NFT_META_BRI_IIFPVID and
NFT_META_BRI_IIFVPROTO in nftables.

> +	NFT_META_TIME,
> +	NFT_META_TIME_DAY,
> +	NFT_META_TIME_HOUR,
>   };
>   
>   /**