On Tue, May 09, 2017 at 05:51:15PM +0200, Florian Westphal wrote: > ip6 nexthdr tcp tcp dport 22 > will now inject a (useless) meta l4 dependency as ip6 nexthdr is no > longer flagged as EXPR_F_PROTOCOL. > > Avoid this if user really specified a test for ip6hdr->nexthdr. But ipv6_find_hdr() is actually fetching the layer 4 protocol number from the fragment. Shouldn't we do the same with ip4h->protocol to keep things consistent? I mean, no meta l4 dependency but just real check for this header field if specified. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
