[PATCH iptables 1/2] include: update nf_tables uapi header

[PATCH iptables 1/2] include: update nf_tables uapi header

[Florian Westphal]

Taken from nf-next.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 include/linux/netfilter/nf_tables.h | 59 ++++++++++++++++++++++++++---
 1 file changed, 54 insertions(+), 5 deletions(-)

diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index e94d1fa554cb..c4d4d8e42dc8 100644
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -97,6 +97,14 @@ enum nft_verdicts {
  * @NFT_MSG_NEWFLOWTABLE: add new flow table (enum nft_flowtable_attributes)
  * @NFT_MSG_GETFLOWTABLE: get flow table (enum nft_flowtable_attributes)
  * @NFT_MSG_DELFLOWTABLE: delete flow table (enum nft_flowtable_attributes)
+ * @NFT_MSG_GETRULE_RESET: get rules and reset stateful expressions (enum nft_obj_attributes)
+ * @NFT_MSG_DESTROYTABLE: destroy a table (enum nft_table_attributes)
+ * @NFT_MSG_DESTROYCHAIN: destroy a chain (enum nft_chain_attributes)
+ * @NFT_MSG_DESTROYRULE: destroy a rule (enum nft_rule_attributes)
+ * @NFT_MSG_DESTROYSET: destroy a set (enum nft_set_attributes)
+ * @NFT_MSG_DESTROYSETELEM: destroy a set element (enum nft_set_elem_attributes)
+ * @NFT_MSG_DESTROYOBJ: destroy a stateful object (enum nft_object_attributes)
+ * @NFT_MSG_DESTROYFLOWTABLE: destroy flow table (enum nft_flowtable_attributes)
  */
 enum nf_tables_msg_types {
 	NFT_MSG_NEWTABLE,
@@ -124,6 +132,14 @@ enum nf_tables_msg_types {
 	NFT_MSG_NEWFLOWTABLE,
 	NFT_MSG_GETFLOWTABLE,
 	NFT_MSG_DELFLOWTABLE,
+	NFT_MSG_GETRULE_RESET,
+	NFT_MSG_DESTROYTABLE,
+	NFT_MSG_DESTROYCHAIN,
+	NFT_MSG_DESTROYRULE,
+	NFT_MSG_DESTROYSET,
+	NFT_MSG_DESTROYSETELEM,
+	NFT_MSG_DESTROYOBJ,
+	NFT_MSG_DESTROYFLOWTABLE,
 	NFT_MSG_MAX,
 };
 
@@ -669,7 +685,7 @@ enum nft_range_ops {
  * enum nft_range_attributes - nf_tables range expression netlink attributes
  *
  * @NFTA_RANGE_SREG: source register of data to compare (NLA_U32: nft_registers)
- * @NFTA_RANGE_OP: cmp operation (NLA_U32: nft_cmp_ops)
+ * @NFTA_RANGE_OP: cmp operation (NLA_U32: nft_range_ops)
  * @NFTA_RANGE_FROM_DATA: data range from (NLA_NESTED: nft_data_attributes)
  * @NFTA_RANGE_TO_DATA: data range to (NLA_NESTED: nft_data_attributes)
  */
@@ -753,11 +769,14 @@ enum nft_dynset_attributes {
  * @NFT_PAYLOAD_LL_HEADER: link layer header
  * @NFT_PAYLOAD_NETWORK_HEADER: network header
  * @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
+ * @NFT_PAYLOAD_INNER_HEADER: inner header / payload
  */
 enum nft_payload_bases {
 	NFT_PAYLOAD_LL_HEADER,
 	NFT_PAYLOAD_NETWORK_HEADER,
 	NFT_PAYLOAD_TRANSPORT_HEADER,
+	NFT_PAYLOAD_INNER_HEADER,
+	NFT_PAYLOAD_TUN_HEADER,
 };
 
 /**
@@ -777,6 +796,32 @@ enum nft_payload_csum_flags {
 	NFT_PAYLOAD_L4CSUM_PSEUDOHDR = (1 << 0),
 };
 
+enum nft_inner_type {
+	NFT_INNER_UNSPEC	= 0,
+	NFT_INNER_VXLAN,
+	NFT_INNER_GENEVE,
+};
+
+enum nft_inner_flags {
+	NFT_INNER_HDRSIZE	= (1 << 0),
+	NFT_INNER_LL		= (1 << 1),
+	NFT_INNER_NH		= (1 << 2),
+	NFT_INNER_TH		= (1 << 3),
+};
+#define NFT_INNER_MASK		(NFT_INNER_HDRSIZE | NFT_INNER_LL | \
+				 NFT_INNER_NH | NFT_INNER_TH)
+
+enum nft_inner_attributes {
+	NFTA_INNER_UNSPEC,
+	NFTA_INNER_NUM,
+	NFTA_INNER_TYPE,
+	NFTA_INNER_FLAGS,
+	NFTA_INNER_HDRSIZE,
+	NFTA_INNER_EXPR,
+	__NFTA_INNER_MAX
+};
+#define NFTA_INNER_MAX	(__NFTA_INNER_MAX - 1)
+
 /**
  * enum nft_payload_attributes - nf_tables payload expression netlink attributes
  *
@@ -833,7 +878,7 @@ enum nft_exthdr_op {
  * @NFTA_EXTHDR_LEN: extension header length (NLA_U32)
  * @NFTA_EXTHDR_FLAGS: extension header flags (NLA_U32)
  * @NFTA_EXTHDR_OP: option match type (NLA_U32)
- * @NFTA_EXTHDR_SREG: option match type (NLA_U32)
+ * @NFTA_EXTHDR_SREG: source register (NLA_U32: nft_registers)
  */
 enum nft_exthdr_attributes {
 	NFTA_EXTHDR_UNSPEC,
@@ -886,6 +931,7 @@ enum nft_exthdr_attributes {
  * @NFT_META_TIME_HOUR: hour of day (in seconds)
  * @NFT_META_SDIF: slave device interface index
  * @NFT_META_SDIFNAME: slave device interface name
+ * @NFT_META_BRI_BROUTE: packet br_netfilter_broute bit
  */
 enum nft_meta_keys {
 	NFT_META_LEN,
@@ -896,7 +942,8 @@ enum nft_meta_keys {
 	NFT_META_OIF,
 	NFT_META_IIFNAME,
 	NFT_META_OIFNAME,
-	NFT_META_IIFTYPE,
+	NFT_META_IFTYPE,
+#define NFT_META_IIFTYPE	NFT_META_IFTYPE
 	NFT_META_OIFTYPE,
 	NFT_META_SKUID,
 	NFT_META_SKGID,
@@ -923,6 +970,8 @@ enum nft_meta_keys {
 	NFT_META_TIME_HOUR,
 	NFT_META_SDIF,
 	NFT_META_SDIFNAME,
+	NFT_META_BRI_BROUTE,
+	__NFT_META_IIFTYPE,
 };
 
 /**
@@ -1213,10 +1262,10 @@ enum nft_last_attributes {
 /**
  * enum nft_log_attributes - nf_tables log expression netlink attributes
  *
- * @NFTA_LOG_GROUP: netlink group to send messages to (NLA_U32)
+ * @NFTA_LOG_GROUP: netlink group to send messages to (NLA_U16)
  * @NFTA_LOG_PREFIX: prefix to prepend to log messages (NLA_STRING)
  * @NFTA_LOG_SNAPLEN: length of payload to include in netlink message (NLA_U32)
- * @NFTA_LOG_QTHRESHOLD: queue threshold (NLA_U32)
+ * @NFTA_LOG_QTHRESHOLD: queue threshold (NLA_U16)
  * @NFTA_LOG_LEVEL: log level (NLA_U32)
  * @NFTA_LOG_FLAGS: logging flags (NLA_U32)
  */
-- 
2.39.2

[PATCH iptables 2/2] ebtables-nft: add broute table emulation

[Florian Westphal]

Use new 'meta broute set 1' to emulate -t broute.  If '-t broute' is given,
automatically translate -j DROP to 'meta broute set 1 accept' internally.

Reverse translation zaps the broute and pretends verdict was DROP.

Note that BROUTING is internally handled via PREROUTING, i.e. 'redirect'
and 'nat' targets are not available, they will need to be emulated via
nft expressions.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 iptables/ebtables-nft.8 | 42 +++++++++++++++++++++++++++--------------
 iptables/nft-bridge.c   | 36 +++++++++++++++++++++++++++++++++++
 iptables/nft-shared.c   | 39 +++++++++++++++++++++++++++-----------
 iptables/nft-shared.h   |  3 +++
 iptables/nft.c          | 13 +++++++++++++
 iptables/nft.h          |  3 ++-
 6 files changed, 110 insertions(+), 26 deletions(-)

diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8
index d75aae240bc0..d639bdf5e292 100644
--- a/iptables/ebtables-nft.8
+++ b/iptables/ebtables-nft.8
@@ -55,7 +55,7 @@ It is analogous to the
 application, but less complicated, due to the fact that the Ethernet protocol
 is much simpler than the IP protocol.
 .SS CHAINS
-There are two ebtables tables with built-in chains in the
+There are three ebtables tables with built-in chains in the
 Linux kernel. These tables are used to divide functionality into
 different sets of rules. Each set of rules is called a chain.
 Each chain is an ordered list of rules that can match Ethernet frames. If a
@@ -81,7 +81,10 @@ an 'extension' (see below) or a jump to a user-defined chain.
 .B ACCEPT
 means to let the frame through.
 .B DROP
-means the frame has to be dropped.
+means the frame has to be dropped. In the
+.BR BROUTING " chain however, the " ACCEPT " and " DROP " target have different"
+meanings (see the info provided for the
+.BR -t " option)."
 .B CONTINUE
 means the next rule has to be checked. This can be handy, f.e., to know how many
 frames pass a certain point in the chain, to log those frames or to apply multiple
@@ -93,17 +96,13 @@ For the extension targets please refer to the
 .B "TARGET EXTENSIONS"
 section of this man page.
 .SS TABLES
-As stated earlier, there are two ebtables tables in the Linux
-kernel.  The table names are
-.BR filter " and " nat .
-Of these two tables,
+As stated earlier, the table names are
+.BR filter ", " nat " and " broute .
+Of these tables,
 the filter table is the default table that the command operates on.
-If you are working with the filter table, then you can drop the '-t filter'
-argument to the ebtables command.  However, you will need to provide
-the -t argument for
-.B nat
-table.  Moreover, the -t argument must be the
-first argument on the ebtables command line, if used. 
+If you are working with the a table other than filter, you will need to provide
+the -t argument.  Moreover, the -t argument must be the
+first argument on the ebtables command line, if used.
 .TP
 .B "-t, --table"
 .br
@@ -131,6 +130,23 @@ iptables world to ebtables it is easier to have the same names. Note that you
 can change the name
 .BR "" ( -E )
 if you don't like the default.
+.br
+.br
+.B broute
+is used to make a brouter, it has one built-in chain:
+.BR BROUTING .
+The targets
+.BR DROP " and " ACCEPT
+have a special meaning in the broute table (these names are used for
+compatibility reasons with ebtables-legacy).
+.B DROP
+actually means the frame has to be routed, while
+.B ACCEPT
+means the frame has to be bridged. The
+.B BROUTING
+chain is traversed very early.
+Normally those frames
+would be bridged, but you can decide otherwise here.
 .SH EBTABLES COMMAND LINE ARGUMENTS
 After the initial ebtables '-t table' command line argument, the remaining
 arguments can be divided into several groups.  These groups
@@ -1059,8 +1075,6 @@ arp message and the hardware address length in the arp header is 6 bytes.
 .BR "" "See " http://netfilter.org/mailinglists.html
 .SH BUGS
 The version of ebtables this man page ships with does not support the
-.B broute
-table. Also there is no support for
 .B string
 match. Further, support for atomic-options
 .RB ( --atomic-file ", " --atomic-init ", " --atomic-save ", " --atomic-commit )
diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
index b9983b203f6d..22860d6b91a6 100644
--- a/iptables/nft-bridge.c
+++ b/iptables/nft-bridge.c
@@ -95,8 +95,44 @@ static void add_logical_outiface(struct nft_handle *h, struct nftnl_rule *r,
 		add_cmp_ptr(r, op, iface, iface_len + 1, reg);
 }
 
+static int add_meta_broute(struct nftnl_rule *r)
+{
+	struct nftnl_expr *expr;
+
+	expr = nftnl_expr_alloc("immediate");
+	if (expr == NULL)
+		return -1;
+
+	nftnl_expr_set_u32(expr, NFTNL_EXPR_IMM_DREG, NFT_REG32_01);
+	nftnl_expr_set_u8(expr, NFTNL_EXPR_IMM_DATA, 1);
+	nftnl_rule_add_expr(r, expr);
+
+	expr = nftnl_expr_alloc("meta");
+	if (expr == NULL)
+		return -1;
+	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_KEY, NFT_META_BRI_BROUTE);
+	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_SREG, NFT_REG32_01);
+
+	nftnl_rule_add_expr(r, expr);
+	return 0;
+}
+
 static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs)
 {
+	const char *table = nftnl_rule_get_str(r, NFTNL_RULE_TABLE);
+
+	if (cs->target &&
+	    table && strcmp(table, "broute") == 0) {
+		if (strcmp(cs->jumpto, XTC_LABEL_DROP) == 0) {
+			int ret = add_meta_broute(r);
+
+			if (ret)
+				return ret;
+
+			cs->jumpto = "ACCEPT";
+		}
+	}
+
 	return add_action(r, cs, false);
 }
 
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 1b22eb7afd30..c19d78e46972 100644
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -511,8 +511,24 @@ void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv)
 	*inv = (op == NFT_CMP_NEQ);
 }
 
-static void nft_meta_set_to_target(struct nft_xt_ctx *ctx,
-				   struct nftnl_expr *e)
+static bool nft_parse_meta_set_common(struct nft_xt_ctx* ctx,
+				      struct nft_xt_ctx_reg *sreg)
+{
+	if ((sreg->type != NFT_XT_REG_IMMEDIATE)) {
+		ctx->errmsg = "meta sreg is not an immediate";
+		return false;
+	}
+
+	if (sreg->immediate.data[0] == 0) {
+		ctx->errmsg = "meta sreg immediate is 0";
+		return false;
+	}
+
+	return true;
+}
+
+static void nft_parse_meta_set(struct nft_xt_ctx *ctx,
+			       struct nftnl_expr *e)
 {
 	struct xtables_target *target;
 	struct nft_xt_ctx_reg *sreg;
@@ -528,18 +544,17 @@ static void nft_meta_set_to_target(struct nft_xt_ctx *ctx,
 
 	switch (nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY)) {
 	case NFT_META_NFTRACE:
-		if ((sreg->type != NFT_XT_REG_IMMEDIATE)) {
-			ctx->errmsg = "meta nftrace but reg not immediate";
+		if (!nft_parse_meta_set_common(ctx, sreg))
 			return;
-		}
-
-		if (sreg->immediate.data[0] == 0) {
-			ctx->errmsg = "trace is cleared";
-			return;
-		}
 
 		targname = "TRACE";
 		break;
+	case NFT_META_BRI_BROUTE:
+		if (!nft_parse_meta_set_common(ctx, sreg))
+			return;
+
+		ctx->cs->jumpto = "DROP";
+		return;
 	default:
 		ctx->errmsg = "meta sreg key not supported";
 		return;
@@ -568,7 +583,7 @@ static void nft_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
         struct nft_xt_ctx_reg *reg;
 
 	if (nftnl_expr_is_set(e, NFTNL_EXPR_META_SREG)) {
-		nft_meta_set_to_target(ctx, e);
+		nft_parse_meta_set(ctx, e);
 		return;
 	}
 
@@ -1145,6 +1160,8 @@ static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
 	/* Standard target? */
 	switch(verdict) {
 	case NF_ACCEPT:
+		if (cs->jumpto && strcmp(ctx->table, "broute") == 0)
+			break;
 		cs->jumpto = "ACCEPT";
 		break;
 	case NF_DROP:
diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
index b8bc1a6ce2e9..2c4c0d90cd07 100644
--- a/iptables/nft-shared.h
+++ b/iptables/nft-shared.h
@@ -61,6 +61,9 @@ struct nft_xt_ctx_reg {
 		struct {
 			uint32_t key;
 		} meta_dreg;
+		struct {
+			uint32_t key;
+		} meta_sreg;
 	};
 
 	struct {
diff --git a/iptables/nft.c b/iptables/nft.c
index 5ef5335a24c1..1cb104e75ccc 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -643,6 +643,19 @@ static const struct builtin_table xtables_bridge[NFT_TABLE_MAX] = {
 			},
 		},
 	},
+	[NFT_TABLE_BROUTE] = {
+		.name = "broute",
+		.type	= NFT_TABLE_BROUTE,
+		.chains = {
+			{
+				.name   = "BROUTING",
+				.type   = "filter",
+				.prio   = NF_BR_PRI_FIRST,
+				.hook   = NF_BR_PRE_ROUTING,
+			},
+		},
+	},
+
 };
 
 static int nft_table_builtin_add(struct nft_handle *h,
diff --git a/iptables/nft.h b/iptables/nft.h
index 56005863ed4c..1d18982dc8cf 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -14,8 +14,9 @@ enum nft_table_type {
 	NFT_TABLE_RAW,
 	NFT_TABLE_FILTER,
 	NFT_TABLE_NAT,
+	NFT_TABLE_BROUTE,
 };
-#define NFT_TABLE_MAX	(NFT_TABLE_NAT + 1)
+#define NFT_TABLE_MAX	(NFT_TABLE_BROUTE + 1)
 
 struct builtin_chain {
 	const char *name;
-- 
2.39.2

RE: [PATCH iptables 2/2] ebtables-nft: add broute table emulation

[Sriram Yagnaraman]

> -----Original Message-----
> From: Florian Westphal <fw@strlen.de>
> Sent: Tuesday, 4 April 2023 11:46
> To: netfilter-devel@vger.kernel.org
> Cc: Florian Westphal <fw@strlen.de>
> Subject: [PATCH iptables 2/2] ebtables-nft: add broute table emulation
> 
> Use new 'meta broute set 1' to emulate -t broute.  If '-t broute' is given,
> automatically translate -j DROP to 'meta broute set 1 accept' internally.
> 
> Reverse translation zaps the broute and pretends verdict was DROP.
> 
> Note that BROUTING is internally handled via PREROUTING, i.e. 'redirect'
> and 'nat' targets are not available, they will need to be emulated via nft
> expressions.

Thank you so much for fixing this, I attempted to update ebtables-nft for broute support but couldn’t understand all the details.
Does this close https://bugzilla.netfilter.org/show_bug.cgi?id=1316?

> 
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  iptables/ebtables-nft.8 | 42 +++++++++++++++++++++++++++--------------
>  iptables/nft-bridge.c   | 36 +++++++++++++++++++++++++++++++++++
>  iptables/nft-shared.c   | 39 +++++++++++++++++++++++++++-----------
>  iptables/nft-shared.h   |  3 +++
>  iptables/nft.c          | 13 +++++++++++++
>  iptables/nft.h          |  3 ++-
>  6 files changed, 110 insertions(+), 26 deletions(-)
> 
> diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8 index
> d75aae240bc0..d639bdf5e292 100644
> --- a/iptables/ebtables-nft.8
> +++ b/iptables/ebtables-nft.8
> @@ -55,7 +55,7 @@ It is analogous to the  application, but less complicated,
> due to the fact that the Ethernet protocol  is much simpler than the IP protocol.
>  .SS CHAINS
> -There are two ebtables tables with built-in chains in the
> +There are three ebtables tables with built-in chains in the
>  Linux kernel. These tables are used to divide functionality into  different sets of
> rules. Each set of rules is called a chain.
>  Each chain is an ordered list of rules that can match Ethernet frames. If a @@ -
> 81,7 +81,10 @@ an 'extension' (see below) or a jump to a user-defined chain.
>  .B ACCEPT
>  means to let the frame through.
>  .B DROP
> -means the frame has to be dropped.
> +means the frame has to be dropped. In the .BR BROUTING " chain however,
> +the " ACCEPT " and " DROP " target have different"
> +meanings (see the info provided for the .BR -t " option)."
>  .B CONTINUE
>  means the next rule has to be checked. This can be handy, f.e., to know how
> many  frames pass a certain point in the chain, to log those frames or to apply
> multiple @@ -93,17 +96,13 @@ For the extension targets please refer to the
> .B "TARGET EXTENSIONS"
>  section of this man page.
>  .SS TABLES
> -As stated earlier, there are two ebtables tables in the Linux -kernel.  The table
> names are -.BR filter " and " nat .
> -Of these two tables,
> +As stated earlier, the table names are
> +.BR filter ", " nat " and " broute .
> +Of these tables,
>  the filter table is the default table that the command operates on.
> -If you are working with the filter table, then you can drop the '-t filter'
> -argument to the ebtables command.  However, you will need to provide -the -t
> argument for -.B nat -table.  Moreover, the -t argument must be the -first
> argument on the ebtables command line, if used.
> +If you are working with the a table other than filter, you will need to
> +provide the -t argument.  Moreover, the -t argument must be the first
> +argument on the ebtables command line, if used.
>  .TP
>  .B "-t, --table"
>  .br
> @@ -131,6 +130,23 @@ iptables world to ebtables it is easier to have the
> same names. Note that you  can change the name  .BR "" ( -E )  if you don't like
> the default.
> +.br
> +.br
> +.B broute
> +is used to make a brouter, it has one built-in chain:
> +.BR BROUTING .
> +The targets
> +.BR DROP " and " ACCEPT
> +have a special meaning in the broute table (these names are used for
> +compatibility reasons with ebtables-legacy).
> +.B DROP
> +actually means the frame has to be routed, while .B ACCEPT means the
> +frame has to be bridged. The .B BROUTING chain is traversed very early.
> +Normally those frames
> +would be bridged, but you can decide otherwise here.
>  .SH EBTABLES COMMAND LINE ARGUMENTS
>  After the initial ebtables '-t table' command line argument, the remaining
> arguments can be divided into several groups.  These groups @@ -1059,8
> +1075,6 @@ arp message and the hardware address length in the arp header
> is 6 bytes.
>  .BR "" "See " http://netfilter.org/mailinglists.html
>  .SH BUGS
>  The version of ebtables this man page ships with does not support the -.B
> broute -table. Also there is no support for  .B string  match. Further, support for
> atomic-options  .RB ( --atomic-file ", " --atomic-init ", " --atomic-save ", " --
> atomic-commit ) diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c index
> b9983b203f6d..22860d6b91a6 100644
> --- a/iptables/nft-bridge.c
> +++ b/iptables/nft-bridge.c
> @@ -95,8 +95,44 @@ static void add_logical_outiface(struct nft_handle *h,
> struct nftnl_rule *r,
>  		add_cmp_ptr(r, op, iface, iface_len + 1, reg);  }
> 
> +static int add_meta_broute(struct nftnl_rule *r) {
> +	struct nftnl_expr *expr;
> +
> +	expr = nftnl_expr_alloc("immediate");
> +	if (expr == NULL)
> +		return -1;
> +
> +	nftnl_expr_set_u32(expr, NFTNL_EXPR_IMM_DREG, NFT_REG32_01);
> +	nftnl_expr_set_u8(expr, NFTNL_EXPR_IMM_DATA, 1);
> +	nftnl_rule_add_expr(r, expr);
> +
> +	expr = nftnl_expr_alloc("meta");
> +	if (expr == NULL)
> +		return -1;
> +	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_KEY,
> NFT_META_BRI_BROUTE);
> +	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_SREG, NFT_REG32_01);
> +
> +	nftnl_rule_add_expr(r, expr);
> +	return 0;
> +}
> +
>  static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs)
> {
> +	const char *table = nftnl_rule_get_str(r, NFTNL_RULE_TABLE);
> +
> +	if (cs->target &&
> +	    table && strcmp(table, "broute") == 0) {
> +		if (strcmp(cs->jumpto, XTC_LABEL_DROP) == 0) {
> +			int ret = add_meta_broute(r);
> +
> +			if (ret)
> +				return ret;
> +
> +			cs->jumpto = "ACCEPT";
> +		}
> +	}
> +
>  	return add_action(r, cs, false);
>  }
> 
> diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c index
> 1b22eb7afd30..c19d78e46972 100644
> --- a/iptables/nft-shared.c
> +++ b/iptables/nft-shared.c
> @@ -511,8 +511,24 @@ void get_cmp_data(struct nftnl_expr *e, void *data,
> size_t dlen, bool *inv)
>  	*inv = (op == NFT_CMP_NEQ);
>  }
> 
> -static void nft_meta_set_to_target(struct nft_xt_ctx *ctx,
> -				   struct nftnl_expr *e)
> +static bool nft_parse_meta_set_common(struct nft_xt_ctx* ctx,
> +				      struct nft_xt_ctx_reg *sreg)
> +{
> +	if ((sreg->type != NFT_XT_REG_IMMEDIATE)) {
> +		ctx->errmsg = "meta sreg is not an immediate";
> +		return false;
> +	}
> +
> +	if (sreg->immediate.data[0] == 0) {
> +		ctx->errmsg = "meta sreg immediate is 0";
> +		return false;
> +	}
> +
> +	return true;
> +}
> +
> +static void nft_parse_meta_set(struct nft_xt_ctx *ctx,
> +			       struct nftnl_expr *e)
>  {
>  	struct xtables_target *target;
>  	struct nft_xt_ctx_reg *sreg;
> @@ -528,18 +544,17 @@ static void nft_meta_set_to_target(struct nft_xt_ctx
> *ctx,
> 
>  	switch (nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY)) {
>  	case NFT_META_NFTRACE:
> -		if ((sreg->type != NFT_XT_REG_IMMEDIATE)) {
> -			ctx->errmsg = "meta nftrace but reg not immediate";
> +		if (!nft_parse_meta_set_common(ctx, sreg))
>  			return;
> -		}
> -
> -		if (sreg->immediate.data[0] == 0) {
> -			ctx->errmsg = "trace is cleared";
> -			return;
> -		}
> 
>  		targname = "TRACE";
>  		break;
> +	case NFT_META_BRI_BROUTE:
> +		if (!nft_parse_meta_set_common(ctx, sreg))
> +			return;
> +
> +		ctx->cs->jumpto = "DROP";
> +		return;
>  	default:
>  		ctx->errmsg = "meta sreg key not supported";
>  		return;
> @@ -568,7 +583,7 @@ static void nft_parse_meta(struct nft_xt_ctx *ctx,
> struct nftnl_expr *e)
>          struct nft_xt_ctx_reg *reg;
> 
>  	if (nftnl_expr_is_set(e, NFTNL_EXPR_META_SREG)) {
> -		nft_meta_set_to_target(ctx, e);
> +		nft_parse_meta_set(ctx, e);
>  		return;
>  	}
> 
> @@ -1145,6 +1160,8 @@ static void nft_parse_immediate(struct nft_xt_ctx
> *ctx, struct nftnl_expr *e)
>  	/* Standard target? */
>  	switch(verdict) {
>  	case NF_ACCEPT:
> +		if (cs->jumpto && strcmp(ctx->table, "broute") == 0)
> +			break;
>  		cs->jumpto = "ACCEPT";
>  		break;
>  	case NF_DROP:
> diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h index
> b8bc1a6ce2e9..2c4c0d90cd07 100644
> --- a/iptables/nft-shared.h
> +++ b/iptables/nft-shared.h
> @@ -61,6 +61,9 @@ struct nft_xt_ctx_reg {
>  		struct {
>  			uint32_t key;
>  		} meta_dreg;
> +		struct {
> +			uint32_t key;
> +		} meta_sreg;
>  	};
> 
>  	struct {
> diff --git a/iptables/nft.c b/iptables/nft.c index 5ef5335a24c1..1cb104e75ccc
> 100644
> --- a/iptables/nft.c
> +++ b/iptables/nft.c
> @@ -643,6 +643,19 @@ static const struct builtin_table
> xtables_bridge[NFT_TABLE_MAX] = {
>  			},
>  		},
>  	},
> +	[NFT_TABLE_BROUTE] = {
> +		.name = "broute",
> +		.type	= NFT_TABLE_BROUTE,
> +		.chains = {
> +			{
> +				.name   = "BROUTING",
> +				.type   = "filter",
> +				.prio   = NF_BR_PRI_FIRST,
> +				.hook   = NF_BR_PRE_ROUTING,
> +			},
> +		},
> +	},
> +
>  };
> 
>  static int nft_table_builtin_add(struct nft_handle *h, diff --git a/iptables/nft.h
> b/iptables/nft.h index 56005863ed4c..1d18982dc8cf 100644
> --- a/iptables/nft.h
> +++ b/iptables/nft.h
> @@ -14,8 +14,9 @@ enum nft_table_type {
>  	NFT_TABLE_RAW,
>  	NFT_TABLE_FILTER,
>  	NFT_TABLE_NAT,
> +	NFT_TABLE_BROUTE,
>  };
> -#define NFT_TABLE_MAX	(NFT_TABLE_NAT + 1)
> +#define NFT_TABLE_MAX	(NFT_TABLE_BROUTE + 1)
> 
>  struct builtin_chain {
>  	const char *name;
> --
> 2.39.2

Re: [PATCH iptables 2/2] ebtables-nft: add broute table emulation

[Florian Westphal]

Sriram Yagnaraman <sriram.yagnaraman@est.tech> wrote:
> Thank you so much for fixing this, I attempted to update ebtables-nft for broute support but couldn’t understand all the details.
> Does this close https://bugzilla.netfilter.org/show_bug.cgi?id=1316?

Yes, simple -t broute -DROP will work with this patch.

Re: [PATCH iptables 2/2] ebtables-nft: add broute table emulation

[Phil Sutter]

On Tue, Apr 04, 2023 at 11:45:44AM +0200, Florian Westphal wrote:
[...]
> --- a/iptables/ebtables-nft.8
> +++ b/iptables/ebtables-nft.8
[...]
> @@ -93,17 +96,13 @@ For the extension targets please refer to the
>  .B "TARGET EXTENSIONS"
>  section of this man page.
>  .SS TABLES
> -As stated earlier, there are two ebtables tables in the Linux
> -kernel.  The table names are
> -.BR filter " and " nat .
> -Of these two tables,
> +As stated earlier, the table names are
> +.BR filter ", " nat " and " broute .
> +Of these tables,
>  the filter table is the default table that the command operates on.
> -If you are working with the filter table, then you can drop the '-t filter'
> -argument to the ebtables command.  However, you will need to provide
> -the -t argument for
> -.B nat
> -table.  Moreover, the -t argument must be the
> -first argument on the ebtables command line, if used. 
> +If you are working with the a table other than filter, you will need to provide

Typo here ("the a" -> "a").

Also this patch broke
iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
("broute" table name did not fail anymore, so nothing serious).

Folded both fixes into this commit, then applied the series.

Thanks for working on it!