[PATCH nft] src: allow update of net base w. meta l4proto icmpv6

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



nft add rule ip6 f i meta l4proto ipv6-icmp icmpv6 type nd-router-advert
<cmdline>:1:50-60: Error: conflicting protocols specified: unknown vs. icmpv6

add icmpv6 to nexthdr list so base gets updated correctly.

Reported-by: Thomas Woerner <twoerner@xxxxxxxxxx>
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
---
 NB: This is STILL not correct.
 nft add rule ip6 f i meta l4proto ipv6-icmp icmpv6 type nd-router-advert
 gets listed as
  icmpv6 type nd-router-advert

because post processing removes the l3 dependency.

However, "icmpv6 type nd-router-advert" uses dependency
ip6 nexthdr icmpv6
which isn't the same as meta l4proto icmpv6.

I suspect nft should always generate implicit l4 dependencies
via meta in the ipv6 case, what do others think
(and not autoremove 'nexthdr' check)?

diff --git a/src/proto.c b/src/proto.c
index 79e9dbf2b33e..fcdfbe73c735 100644
--- a/src/proto.c
+++ b/src/proto.c
@@ -779,6 +779,7 @@ const struct proto_desc proto_inet_service = {
 		PROTO_LINK(IPPROTO_TCP,		&proto_tcp),
 		PROTO_LINK(IPPROTO_DCCP,	&proto_dccp),
 		PROTO_LINK(IPPROTO_SCTP,	&proto_sctp),
+		PROTO_LINK(IPPROTO_ICMPV6,	&proto_icmp6),
 	},
 	.templates	= {
 		[0]	= PROTO_META_TEMPLATE("l4proto", &inet_protocol_type, NFT_META_L4PROTO, 8),
-- 
2.10.2

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux