Commit f87b9464 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_fwd_netdev: Support egress hook 



Allow packet redirection to another interface upon egress.

[lukas: set skb_iif, add commit message, original patch from Pablo. ]
Signed-off-by: default avatarLukas Wunner <lukas@wunner.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 632cb151

net/netfilter/nft_fwd_netdev.c

+5 −2
Original line number Diff line number Diff line
@@ -27,9 +27,11 @@ static void nft_fwd_netdev_eval(const struct nft_expr *expr, 
{

	struct nft_fwd_netdev *priv = nft_expr_priv(expr);

	int oif = regs->data[priv->sreg_dev];

	struct sk_buff *skb = pkt->skb;



	/* This is used by ifb only. */

	skb_set_redirected(pkt->skb, true);

	skb->skb_iif = skb->dev->ifindex;

	skb_set_redirected(skb, nft_hook(pkt) == NF_NETDEV_INGRESS);



	nf_fwd_netdev_egress(pkt, oif);

	regs->verdict.code = NF_STOLEN;
@@ -198,7 +200,8 @@ static int nft_fwd_validate(const struct nft_ctx *ctx, 
			    const struct nft_expr *expr,

			    const struct nft_data **data)

{

	return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS));

	return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS) |

						    (1 << NF_NETDEV_EGRESS));

}



static struct nft_expr_type nft_fwd_netdev_type;