Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> On Tue, Mar 21, 2017 at 07:54:37PM +0100, Florian Westphal wrote:
> > nft add rule ip6 f i meta l4proto ipv6-icmp icmpv6 type nd-router-advert
> > <cmdline>:1:50-60: Error: conflicting protocols specified: unknown vs. icmpv6
> >
> > add icmpv6 to nexthdr list so base gets updated correctly.
> >
> > Reported-by: Thomas Woerner <twoerner@xxxxxxxxxx>
> > Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
> > ---
> > NB: This is STILL not correct.
> > nft add rule ip6 f i meta l4proto ipv6-icmp icmpv6 type nd-router-advert
> > gets listed as
> > icmpv6 type nd-router-advert
> >
> > because post processing removes the l3 dependency.
> >
> > However, "icmpv6 type nd-router-advert" uses dependency
> > ip6 nexthdr icmpv6
> > which isn't the same as meta l4proto icmpv6.
> >
> > I suspect nft should always generate implicit l4 dependencies
> > via meta in the ipv6 case, what do others think
> > (and not autoremove 'nexthdr' check)?
>
> I think we should use meta l4proto, ip6 nexthdr may point to some of
> the extension headers in the packet actually.
Yes.
Alright, I'll work on this change towards l4 meta.
> > diff --git a/src/proto.c b/src/proto.c
> > index 79e9dbf2b33e..fcdfbe73c735 100644
> > --- a/src/proto.c
> > +++ b/src/proto.c
> > @@ -779,6 +779,7 @@ const struct proto_desc proto_inet_service = {
> > PROTO_LINK(IPPROTO_TCP, &proto_tcp),
> > PROTO_LINK(IPPROTO_DCCP, &proto_dccp),
> > PROTO_LINK(IPPROTO_SCTP, &proto_sctp),
> > + PROTO_LINK(IPPROTO_ICMPV6, &proto_icmp6),
>
> This also allows icmp6 from IPv4, right? I remember I mentioned this
> in a patch that I attached to bugzilla at some point so I didn't apply
> this.
Yes, whats the concern with that?
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
