Sriram Yagnaraman <sriram.yagnaraman@xxxxxxxx> wrote: > +void nft_meta_bridge_set_eval(const struct nft_expr *expr, > + struct nft_regs *regs, > + const struct nft_pktinfo *pkt) static? > +{ > + dest = eth_hdr(skb)->h_dest; > + if (skb->pkt_type == PACKET_HOST && > + !ether_addr_equal(skb->dev->dev_addr, dest) && > + ether_addr_equal(p->br->dev->dev_addr, dest)) > + skb->pkt_type = PACKET_OTHERHOST; We already support override of skb->pkt_type, I would prefer if users to this explicitly from their ruleset if they need it. > + priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY])); I think you need to check for !tb[NFTA_META_KEY] and bail out before this line. > + switch (priv->key) { > + case NFT_META_BRI_BROUTE: > + len = sizeof(u8); > + break; Can you bail out if this is called from something else than PREROUTING hook? You can look at nft_tproxy.c or similar on how to do this.