Re: [PATCH nf-next] netfilter: bridge: introduce broute meta statement

[Florian Westphal <fw@strlen.de>]

Sriram Yagnaraman <sriram.yagnaraman@est.tech> wrote:
> +void nft_meta_bridge_set_eval(const struct nft_expr *expr,
> +			      struct nft_regs *regs,
> +			      const struct nft_pktinfo *pkt)

static?

> +{
> +		dest = eth_hdr(skb)->h_dest;
> +		if (skb->pkt_type == PACKET_HOST &&
> +		    !ether_addr_equal(skb->dev->dev_addr, dest) &&
> +		    ether_addr_equal(p->br->dev->dev_addr, dest))
> +			skb->pkt_type = PACKET_OTHERHOST;

We already support override of skb->pkt_type, I would prefer
if users to this explicitly from their ruleset if they need it.

> +	priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));

I think you need to check for !tb[NFTA_META_KEY] and bail out
before this line.

> +	switch (priv->key) {
> +	case NFT_META_BRI_BROUTE:
> +		len = sizeof(u8);
> +		break;

Can you bail out if this is called from something else
than PREROUTING hook?

You can look at nft_tproxy.c or similar on how to do this.