From: Florian Westphal <fw@strlen.de>
To: <netfilter-devel@vger.kernel.org>
Subject: [PATCH nft v3 0/7] switch l4 dependency to meta l4proto
Date: Fri, 19 May 2017 22:11:04 +0200 [thread overview]
Message-ID: <20170519201111.7402-1-fw@strlen.de> (raw)
Currently nft inserts different types of dependencies for l4 protocols,
depending on the family.
For inet, nft inserts 'meta l4proto' to e.g. check for tcp, for
ip, nft uses 'ip protocol'. Both are fine. The ip6 family however
uses 'ip6 nexthdr', and thats a problem because e.g. tcp dport 22 will
not match packets that use ipv6 extension headers.
The series switches both ipv6 and ipv4 to use meta l4 instead
so ipv6 will always check the last transport header value.
We could ignore ip as only ipv6 uses extension headers.
However, switching ipv4 as well makes things a bit simpler because nft
then creates the same l4 dependency for all families.
next reply other threads:[~2017-05-19 20:10 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-19 20:11 Florian Westphal [this message]
2017-05-19 20:11 ` [PATCH nft 1/7] payload: split ll proto dependency into helper Florian Westphal
2017-05-19 20:11 ` [PATCH nft v3 2/7] src: allow update of net base w. meta l4proto icmpv6 Florian Westphal
2017-05-19 20:11 ` [PATCH nft v3 3/7] src: ipv6: switch implicit dependencies to meta l4proto Florian Westphal
2017-05-19 20:11 ` [PATCH nft 4/7] payload: enforce ip/ip6 protocol depending on icmp or icmpv6 Florian Westphal
2017-05-19 20:11 ` [PATCH nft v3 5/7] tests: fix up meta l4proto change for ip6 family Florian Westphal
2017-05-19 20:11 ` [PATCH nft v3 6/7] src: ip: switch implicit dependencies to meta l4proto too Florian Westphal
2017-05-19 20:11 ` [PATCH nft v3 7/7] tests: fix up meta l4proto change for ip family Florian Westphal
2017-05-23 21:21 ` [PATCH nft v3 0/7] switch l4 dependency to meta l4proto Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170519201111.7402-1-fw@strlen.de \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).