On Thu, Dec 03, 2015 at 04:56:41PM +0100, Florian Westphal wrote: > This allows to redirect bridged packets to local machine. > > ether type ip ether daddr set aa:53:08:12:34:56 meta pkttype set unicast > > Without 'set unicast', ip stack discards PACKET_OTHERHOST skbs. > > Signed-off-by: Florian Westphal <fw@xxxxxxxxx> > --- > Hi Patrick, > > as discussed this adds meta set support for pkttype. > > I'm not sure how restricted it should be; this only allows > changing PACKET_OTHERHOST to something else, but I'm not sure > if this should do more checks on value (e.g. only allow > PACKET_HOST?) or even less (e.g. also allow mangling > mcast and the like?). > > It only allows NETDEV and BRIDGE families but thats mainly > because the other ones make no sense (PACKET_OTHERHOST > cannot happen w. IPV4, 6, INET since stack already drops them earlier). With a 'hash' expression and this mangling, we can emulate the cluster match (hence its CLUSTERIP target predecesor too). If mangling doesn't crash the kernel, ie. nonsense configuration just results in a drop, then I would make no restrictions. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
