Re: [PATCH -next] netfilter: meta: add support for setting skb->pkttype

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Dec 03, 2015 at 04:56:41PM +0100, Florian Westphal wrote:
> This allows to redirect bridged packets to local machine.
> 
> ether type ip ether daddr set aa:53:08:12:34:56 meta pkttype set unicast
> 
> Without 'set unicast', ip stack discards PACKET_OTHERHOST skbs.
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  Hi Patrick,
> 
>  as discussed this adds meta set support for pkttype.
> 
>  I'm not sure how restricted it should be; this only allows
>  changing PACKET_OTHERHOST to something else, but I'm not sure
>  if this should do more checks on value (e.g. only allow
>  PACKET_HOST?) or even less (e.g. also allow mangling
>  mcast and the like?).
>
>  It only allows NETDEV and BRIDGE families but thats mainly
>  because the other ones make no sense (PACKET_OTHERHOST
>  cannot happen w. IPV4, 6, INET since stack already drops them earlier).

With a 'hash' expression and this mangling, we can emulate the cluster
match (hence its CLUSTERIP target predecesor too).

If mangling doesn't crash the kernel, ie. nonsense configuration just
results in a drop, then I would make no restrictions.