On Fri, Jan 20, 2017 at 01:20:11PM +0100, Arturo Borrero Gonzalez wrote:
> In the inet family, we can add rules like these:
>
> % nft add rule inet t c ip protocol icmp icmp type echo-request
> % nft add rule inet t c ip6 nexthdr icmpv6 icmpv6 type echo-request
>
> However, when we print the ruleset:
>
> % nft list ruleset
> table inet t {
> chain c {
> icmpv6 type echo-request
> icmp type echo-request
> }
> }
>
> These rules we obtain can't be added again:
>
> % nft add rule inet t c icmp type echo-request
> <cmdline>:1:19-27: Error: conflicting protocols specified: inet-service vs. icmp
> add rule inet t c icmp type echo-request
> ^^^^^^^^^
>
> % nft add rule inet t c icmpv6 type echo-request
> <cmdline>:1:19-29: Error: conflicting protocols specified: inet-service vs. icmpv6
> add rule inet t c icmpv6 type echo-request
> ^^^^^^^^^^^
>
> Since I wouldn't expect an IP packet carrying ICMPv6, or IPv6 packet
> carrying ICMP, if the link layer is inet, the network layer protocol context
> can be safely update to 'ip' or 'ip6'.
>
> Moreover, nft currently generates a 'meta nfproto ipvX' depedency when
> using icmp or icmp6 in the inet family.
Applied, thanks Arturo.
BTW, it would be great if you can cook a patch with new tests/py lines
covering this case.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
