On Mon, Jun 23, 2014 at 01:18:17PM +0200, Alvaro Neira Ayuso wrote: > If we try to add a rule with icmp or icmpv6 in a inet table like this: > > nft add rule inet filter input icmp type echo-request counter > or > nft add rule inet filter input icmpv6 type echo-request counter > > we have this error: > > <cmdline>:1:28-38: Error: conflicting protocols specified: inet-service vs. icmpv6 > add rule inet filter input icmpv6 type echo-request counter accept > ^^^^^^^^^^^ > > This patch solve it adding icmp and icmpv6 in the inet protocols that we can use. > Also, I have added a statement meta for restricting that the rules for icmp is only > for ipv4 traffic and the rules for icmpv6 is for ipv6 traffic. These a rather complex changes and I'd like to see the protocol context parts split and explained in more detail. I'm also not convinced by the special handling for this case. The same problem affects f.i. the bridge family. Stated generically, the problem is finding dependency expressions when one or more element in the chain is missing. My feeling is that we should walk all possible paths to the base protocol and, if only a single path exists (for now), use that for dependencies. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
