netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH nft v3 0/7] switch l4 dependency to meta l4proto
@ 2017-05-19 20:11 Florian Westphal
  2017-05-19 20:11 ` [PATCH nft 1/7] payload: split ll proto dependency into helper Florian Westphal
                   ` (7 more replies)
  0 siblings, 8 replies; 9+ messages in thread
From: Florian Westphal @ 2017-05-19 20:11 UTC (permalink / raw)
  To: netfilter-devel

Currently nft inserts different types of dependencies for l4 protocols,
depending on the family.

For inet, nft inserts 'meta l4proto' to e.g. check for tcp, for
ip, nft uses 'ip protocol'. Both are fine.  The ip6 family however
uses 'ip6 nexthdr', and thats a problem because e.g. tcp dport 22 will
not match packets that use ipv6 extension headers.

The series switches both ipv6 and ipv4 to use meta l4 instead
so ipv6 will always check the last transport header value.

We could ignore ip as only ipv6 uses extension headers.
However, switching ipv4 as well makes things a bit simpler because nft
then creates the same l4 dependency for all families.


^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2017-05-23 21:22 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-05-19 20:11 [PATCH nft v3 0/7] switch l4 dependency to meta l4proto Florian Westphal
2017-05-19 20:11 ` [PATCH nft 1/7] payload: split ll proto dependency into helper Florian Westphal
2017-05-19 20:11 ` [PATCH nft v3 2/7] src: allow update of net base w. meta l4proto icmpv6 Florian Westphal
2017-05-19 20:11 ` [PATCH nft v3 3/7] src: ipv6: switch implicit dependencies to meta l4proto Florian Westphal
2017-05-19 20:11 ` [PATCH nft 4/7] payload: enforce ip/ip6 protocol depending on icmp or icmpv6 Florian Westphal
2017-05-19 20:11 ` [PATCH nft v3 5/7] tests: fix up meta l4proto change for ip6 family Florian Westphal
2017-05-19 20:11 ` [PATCH nft v3 6/7] src: ip: switch implicit dependencies to meta l4proto too Florian Westphal
2017-05-19 20:11 ` [PATCH nft v3 7/7] tests: fix up meta l4proto change for ip family Florian Westphal
2017-05-23 21:21 ` [PATCH nft v3 0/7] switch l4 dependency to meta l4proto Pablo Neira Ayuso

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).