Re: [netfilter-core] [PATCH nft v4] src: Support netdev egress hook

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Jan 25, 2021 at 02:44:32PM +0100, Phil Sutter wrote:
> Hi,
> 
> On Mon, Jan 25, 2021 at 02:34:05PM +0100, Florian Westphal wrote:
> > Phil Sutter <phil@nwl.cc> wrote:
> > > > diff --git a/tests/py/inet/ip.t.payload.netdev b/tests/py/inet/ip.t.payload.netdev
> > > > index 95be919..38ed0ad 100644
> > > > --- a/tests/py/inet/ip.t.payload.netdev
> > > > +++ b/tests/py/inet/ip.t.payload.netdev
> > > > @@ -12,3 +12,17 @@ netdev test-netdev ingress
> > > >    [ payload load 6b @ link header + 6 => reg 10 ]
> > > >    [ lookup reg 1 set __set%d ]
> > > >  
> > > > +# meta protocol ip ip saddr . ip daddr . ether saddr { 1.1.1.1 . 2.2.2.2 . ca:fe:ca:fe:ca:fe }
> > > > +__set%d test-netdev 3
> > > > +__set%d test-netdev 0
> > > > +	element 01010101 02020202 fecafeca 0000feca  : 0 [end]
> > > > +netdev test-netdev egress 
> > > > +  [ meta load protocol => reg 1 ]
> > > > +  [ cmp eq reg 1 0x00000008 ]
> > > > +  [ meta load iiftype => reg 1 ]
> >                    ~~~~~~~
> > 
> > shouldn't nft add oiftype for egress?
> 
> Oh, you're right. So I "take everything back and claim the opposite". ;)
> To cover for the different dependency expressions, we need to introduce
> hook-specific payload files. :/

I'm planning to generalize iftype to check for iiftype from the
ingress path and oiftype from the egress path. This check is there to
make sure this is an ethernet device. This can be done once this hook
hits net-next.