netfilter: nft_meta: permit pkttype mangling in ip/ip6 prerouting

After supporting this, we can combine it with hash expression to emulate
the 'cluster match'.

Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 6c1e0246706e06b492dbdb2ed068acf1fa2879da..64994023bf812a17cfba5840a54b32f9bba2adc1 100644 (file)
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -310,6 +310,11 @@ int nft_meta_set_validate(const struct nft_ctx *ctx,
        case NFPROTO_NETDEV:
                hooks = 1 << NF_NETDEV_INGRESS;
                break;
+       case NFPROTO_IPV4:
+       case NFPROTO_IPV6:
+       case NFPROTO_INET:
+               hooks = 1 << NF_INET_PRE_ROUTING;
+               break;
        default:
                return -EOPNOTSUPP;
        }