From 73611d5582e72367a698faf1b5301c836e981465 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Tue, 4 Apr 2023 11:45:44 +0200 Subject: ebtables-nft: add broute table emulation Use new 'meta broute set 1' to emulate -t broute. If '-t broute' is given, automatically translate -j DROP to 'meta broute set 1 accept' internally. Reverse translation zaps the broute and pretends verdict was DROP. Note that BROUTING is internally handled via PREROUTING, i.e. 'redirect' and 'nat' targets are not available, they will need to be emulated via nft expressions. Signed-off-by: Florian Westphal Signed-off-by: Phil Sutter --- iptables/nft.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'iptables/nft.c') diff --git a/iptables/nft.c b/iptables/nft.c index 5ef5335a..1cb104e7 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -643,6 +643,19 @@ static const struct builtin_table xtables_bridge[NFT_TABLE_MAX] = { }, }, }, + [NFT_TABLE_BROUTE] = { + .name = "broute", + .type = NFT_TABLE_BROUTE, + .chains = { + { + .name = "BROUTING", + .type = "filter", + .prio = NF_BR_PRI_FIRST, + .hook = NF_BR_PRE_ROUTING, + }, + }, + }, + }; static int nft_table_builtin_add(struct nft_handle *h, -- cgit v1.2.3