nf_tables: numgen, hash and more meta keys, as nft_numgen.c, nft_hash.c and nft_meta.c of Linux

CHANGELOG.md

@@ -9,6 +9,7 @@ This file records each release. The format follows [Keep a Changelog](https://ke
 - The `AF_ALG` sockets with the type `skcipher`, as crypto/algif_skcipher.c of Linux, for `ecb(aes)`, `cbc(aes)`, `ctr(aes)` and `xts(aes)` of `rk-crypto`. A `sendmsg` gives the operation with `ALG_SET_OP` and the IV with `ALG_SET_IV` in control messages, and adds the data to the queue. A `recv` encrypts or decrypts the data of the queue in blocks. With `MSG_MORE`, the operation continues in the next `send`, and the IV goes from one `recv` to the next. libcryptsetup uses these sockets to open a LUKS2 key slot without dm-crypt (#541).
 - The `getdents` call of x86_64, with the records of the old format `linux_dirent`, as `filldir` of Linux. The `readdir` test of the AppArmor regression tests uses it (#540).
 - AppArmor checks the path operations, as the path hooks of lsm.c of Linux: a create, a `mkdir`, a `mknod`, a symbolic link, a hard link, a rename, an `unlink`, an `rmdir`, a truncate, a `chmod`, a `chown` and a `stat`. The VFS has the hooks `path_*`, `inode_getattr` and `file_truncate` of Linux, at the places where Linux calls them (#540).
+- The expressions `numgen` and `hash` of nf_tables, as nft_numgen.c and nft_hash.c of Linux, and more keys of `meta`, as nft_meta.c: `priority`, `pkttype`, `cpu`, `iifgroup`, `oifgroup`, `random`, `iifkind`, `oifkind`, `time`, `day`, `hour`, `sdif` and `sdifname`. A rule sets `meta priority` and `meta pkttype` too. A packet now has a priority and a type, as `skb->priority` and `skb->pkt_type`. `meta iif` and `meta iifname` of a packet with no device give 0 and "", as in Linux (#542).
 
 ## [0.5.24] - 2026-11-12
 

net/rk-net-inet/src/stack.rs

@@ -865,6 +865,14 @@ pub fn receive(dev: &NetDevice, mut frame: NetBuf) {
         return;
     }
     frame.protocol = eth.ethertype;
+    // The type of the frame, as `eth_type_trans` of Linux.
+    frame.pkt_type = if eth.dst.is_broadcast() {
+        rk_net::packet::PACKET_BROADCAST
+    } else if eth.dst.is_multicast() {
+        rk_net::packet::PACKET_MULTICAST
+    } else {
+        rk_net::packet::PACKET_HOST
+    };
     match u32::from(eth.ethertype) {
         ETH_P_ARP => arp_input(dev, frame.data()),
         // A frame to a link multicast or broadcast address is not `PACKET_HOST`, and the stack

net/rk-net/src/buf.rs

@@ -40,6 +40,12 @@ pub struct NetBuf {
     /// The mark of the packet, as `skb->mark` of Linux. A rule of nf_tables sets it with
     /// `meta mark set` and reads it with `meta mark`.
     pub mark: u32,
+    /// The priority of the packet, as `skb->priority` of Linux. A rule of nf_tables sets it
+    /// with `meta priority set` and reads it with `meta priority`.
+    pub priority: u32,
+    /// The type of the link address that the frame came to, `PACKET_HOST`,
+    /// `PACKET_BROADCAST` or `PACKET_MULTICAST`, as `skb->pkt_type` of Linux.
+    pub pkt_type: u8,
 }
 
 impl NetBuf {
@@ -58,6 +64,8 @@ impl NetBuf {
             csum_ok: false,
             nfct: NfCt::default(),
             mark: 0,
+            priority: 0,
+            pkt_type: 0,
         }
     }
 
@@ -73,6 +81,8 @@ impl NetBuf {
             csum_ok: false,
             nfct: NfCt::default(),
             mark: 0,
+            priority: 0,
+            pkt_type: 0,
         }
     }
 
@@ -88,6 +98,8 @@ impl NetBuf {
             csum_ok: false,
             nfct: NfCt::default(),
             mark: 0,
+            priority: 0,
+            pkt_type: 0,
         }
     }