Re: [nft PATCH] payload: use explicit network ctx assignation for icmp/icmp6 in inet family

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Jan 24, 2017 at 08:48:54PM +0100, Pablo Neira Ayuso wrote:
> On Fri, Jan 20, 2017 at 01:20:11PM +0100, Arturo Borrero Gonzalez wrote:
> > In the inet family, we can add rules like these:
> > 
> > % nft add rule inet t c ip protocol icmp icmp type echo-request
> > % nft add rule inet t c ip6 nexthdr icmpv6 icmpv6 type echo-request
> > 
> > However, when we print the ruleset:
> > 
> > % nft list ruleset
> > table inet t {
> > 	chain c {
> > 		icmpv6 type echo-request
> > 		icmp type echo-request
> > 	}
> > }
> > 
> > These rules we obtain can't be added again:
> > 
> > % nft add rule inet t c icmp type echo-request
> > <cmdline>:1:19-27: Error: conflicting protocols specified: inet-service vs. icmp
> > add rule inet t c icmp type echo-request
> >                   ^^^^^^^^^
> > 
> > % nft add rule inet t c icmpv6 type echo-request
> > <cmdline>:1:19-29: Error: conflicting protocols specified: inet-service vs. icmpv6
> > add rule inet t c icmpv6 type echo-request
> >                   ^^^^^^^^^^^
> > 
> > Since I wouldn't expect an IP packet carrying ICMPv6, or IPv6 packet
> > carrying ICMP, if the link layer is inet, the network layer protocol context
> > can be safely update to 'ip' or 'ip6'.
> > 
> > Moreover, nft currently generates a 'meta nfproto ipvX' depedency when
> > using icmp or icmp6 in the inet family.
> 
> Applied, thanks Arturo.
> 
> BTW, it would be great if you can cook a patch with new tests/py lines
> covering this case.

Wait. This only solves the inet case. Bridge and netdev still remain
broken.