Re: [nft PATCH v2] payload: explicit network ctx assignation for icmp/icmp6 in special families

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Jan 25, 2017 at 12:51:08PM +0100, Arturo Borrero Gonzalez wrote:
> In the inet, bridge and netdev families, we can add rules like these:
> 
> % nft add rule inet t c ip protocol icmp icmp type echo-request
> % nft add rule inet t c ip6 nexthdr icmpv6 icmpv6 type echo-request
> 
> However, when we print the ruleset:
> 
> % nft list ruleset
> table inet t {
> 	chain c {
> 		icmpv6 type echo-request
> 		icmp type echo-request
> 	}
> }
> 
> These rules we obtain can't be added again:
> 
> % nft add rule inet t c icmp type echo-request
> <cmdline>:1:19-27: Error: conflicting protocols specified: inet-service vs. icmp
> add rule inet t c icmp type echo-request
>                   ^^^^^^^^^
> 
> % nft add rule inet t c icmpv6 type echo-request
> <cmdline>:1:19-29: Error: conflicting protocols specified: inet-service vs. icmpv6
> add rule inet t c icmpv6 type echo-request
>                   ^^^^^^^^^^^
> 
> Since I wouldn't expect an IP packet carrying ICMPv6, or IPv6 packet
> carrying ICMP, if the link layer is inet, the network layer protocol context
> can be safely update to 'ip' or 'ip6'.
> 
> Moreover, nft currently generates a 'meta nfproto ipvX' depedency when
> using icmp or icmp6 in the inet family, and similar in netdev and bridge
> families.
> 
> While at it, a bit of code factorization is introduced.

Applied, thanks Arturo!