[ebtables-compat-experimental3 PATCH 1/2] nft-bridge: fix inversion of matches

[Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>]

The inversion in bridge specific matches is failing because before this
patch NFT_CMP_EQ is used unconditionally.

No need to change the invesion in family-agnostic functions, given
ebt inv flags are translated to ipt inv flags and inversion is properly
calculated there.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
---
NOTE: I think the previous patch to fix this isse was wrong in several aspects.
      This is a new approach. Compile-tested only. Please comment.

 iptables/nft-bridge.c |   25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
index 0e21b46..66bbefd 100644
--- a/iptables/nft-bridge.c
+++ b/iptables/nft-bridge.c
@@ -165,6 +165,7 @@ static int nft_bridge_add(struct nft_rule *r, void *data)
 	struct ebtables_command_state *cs = data;
 	struct ebt_entry *fw = &cs->fw;
 	uint8_t flags = ebt_to_ipt_flags(fw->invflags);
+	uint32_t op = NFT_CMP_EQ;
 	char *addr;
 
 	if (fw->in[0] != '\0')
@@ -182,18 +183,36 @@ static int nft_bridge_add(struct nft_rule *r, void *data)
 	addr = ether_ntoa((struct ether_addr *) fw->sourcemac);
 	if (strcmp(addr, "0:0:0:0:0:0") != 0) {
 		add_payload(r, offsetof(struct ethhdr, h_source), 6);
-		add_cmp_ptr(r, NFT_CMP_EQ, fw->sourcemac, 6);
+
+		if (fw->invflags & EBT_ISOURCE)
+			op = NFT_CMP_NEQ;
+		else
+			op = NFT_CMP_EQ;
+
+		add_cmp_ptr(r, op, fw->sourcemac, 6);
 	}
 
 	addr = ether_ntoa((struct ether_addr *) fw->destmac);
 	if (strcmp(addr, "0:0:0:0:0:0") != 0) {
 		add_payload(r, offsetof(struct ethhdr, h_dest), 6);
-		add_cmp_ptr(r, NFT_CMP_EQ, fw->destmac, 6);
+
+		if (fw->invflags & EBT_IDEST)
+			op = NFT_CMP_NEQ;
+		else
+			op = NFT_CMP_EQ;
+
+		add_cmp_ptr(r, op, fw->destmac, 6);
 	}
 
 	if (fw->ethproto != 0) {
 		add_payload(r, offsetof(struct ethhdr, h_proto), 2);
-		add_cmp_u16(r, fw->ethproto, NFT_CMP_EQ);
+
+		if (fw->invflags & EBT_IPROTO)
+			op = NFT_CMP_NEQ;
+		else
+			op = NFT_CMP_EQ;
+
+		add_cmp_u16(r, fw->ethproto, op);
 	}
 
 	return _add_action(r, cs);