netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* RFC: Ideas about possible solutions for nfbz#949
@ 2017-05-10 15:34 Phil Sutter
  2017-05-29 17:52 ` Pablo Neira Ayuso
  0 siblings, 1 reply; 5+ messages in thread
From: Phil Sutter @ 2017-05-10 15:34 UTC (permalink / raw)
  To: netfilter-devel; +Cc: Pablo Neira Ayuso, Florian Westphal

Hi,

Netfilter Bugzilla #949[1] complains about broken output when trying to
match icmpv6 message fields. This is a problem in how payload match is
implemented in nft: The given match (e.g. 'icmp6 id 2') is broken down
to a simple match of header data at a specific offset. Sadly this does
not work with ICMP(v6) since header structure depends on the packet's
ICMP type and on return path there is no information about which type of
message the user wanted to match against.

My idea was to build something like the protocol dependencies we have
for e.g. TCP header fields but with ICMP, a given header field might be
present in multiple message types (e.g. icmp6_id is present in echo
request as well as reply).

I already considered inserting a match for icmp6 type against an
anonymous set (like 'icmp6 type { echo-request, echo-reply }'), but
having this as an implicit dependency and resolving with previous
matches, etc. becomes pretty complex.

Do you think I should try following a different approach (via userdata
e.g.)?

Thanks, Phil

[1] https://bugzilla.netfilter.org/show_bug.cgi?id=949

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2017-06-23 14:03 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-05-10 15:34 RFC: Ideas about possible solutions for nfbz#949 Phil Sutter
2017-05-29 17:52 ` Pablo Neira Ayuso
2017-05-30 11:04   ` Phil Sutter
2017-05-30 12:08     ` Pablo Neira Ayuso
2017-06-23 14:03       ` Phil Sutter

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).