This series resolves a few shortcomings with the current dependency removal. Problem is that the current approach sometimes can remove dependencies that are required, i.e. where the removal does change the rule. Examples: inet t .. meta nfproto ipv6 tcp dport 22 or inet t .. ip protocol tcp tcp dport 22 are reduced to 'tcp dport 22'. ip6 nexthdr icmpv6 icmpv6 type echo-request becomes 'ipv6 type echo-request' (which is not exactly the same, the implicit dependency nft adds is 'meta l4proto', which skips most extension headers). I already pushed a couple of test cases to increase coverage. These patches aim to fix those by making dependency removal more strict. The additional checks are only done in families other than ip and ipv6, as those are already restricted to a particular l3 protocol. include/payload.h | 14 +- include/utils.h | 1 src/netlink.c | 11 -- src/netlink_delinearize.c | 27 +---- src/payload.c | 224 +++++++++++++++++++++++++++++++++++++++++----- tests/py/bridge/icmpX.t | 4 tests/py/inet/icmpX.t | 4 tests/py/inet/ip_tcp.t | 4 8 files changed, 224 insertions(+), 65 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
