Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > What I don't still is why patch 1/8 is expanding icmp type > echo-request to show explicit "ether type ip icmp type echo-request" > when listing the ruleset. > > I mean: > > -icmp type echo-request;ok > +icmp type echo-request;ok;ether type ip icmp type echo-request Correct, this is redundant, the 'ether type ip' could be removed here. But it would need more work to achive this, f.e. by tracking not the last but all seen dependencies per-base and doing the removal only after seeing all consecutive expression statements. At the moment, when 'remove ether type ip' decision is made, we only know that the next expression is 'meta l4proto'. But that is not enough to know if the dependency is implicit or not. Another soltution would be to pass the relational expression, and then extract rhs too. That would allow to see the 'icmp' in 'meta l4proto icmp' (and then remove the dep because icmp implies ipv4). However, as icmp is the only case where we can do the removal I think its currently not super urgent to make these changes. Does that explanation help? I would re-word the commit message accordingly. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
