diff mbox

[nft] payload: use explicit network ctx assignation for icmp/icmp6 in inet family

Message ID 148491374036.19729.8330093911442914131.stgit@nfdev2.cica.es
State Superseded
Delegated to: Pablo Neira
Headers show

Commit Message

Arturo Borrero Jan. 20, 2017, 12:02 p.m. UTC 
From: Arturo Borrero Gonzalez <arturo@debian.org>

In the inet family, we can add rules like these:

% nft add rule inet t c ip protocol icmp icmp type echo-request
% nft add rule inet t c ip6 nexthdr icmpv6 icmpv6 type echo-request

However, when we print the ruleset:

% nft list ruleset
table inet t {
	chain c {
		icmpv6 type echo-request
		icmp type echo-request
	}
}

These rules we obtain can't be added again:

% nft add rule inet t c icmp type echo-request
<cmdline>:1:19-27: Error: conflicting protocols specified: inet-service vs. icmp
add rule inet t c icmp type echo-request
                  ^^^^^^^^^

% nft add rule inet t c icmpv6 type echo-request
<cmdline>:1:19-29: Error: conflicting protocols specified: inet-service vs. icmpv6
add rule inet t c icmpv6 type echo-request
                  ^^^^^^^^^^^

Since I wouldn't expect an IP packet carrying ICMPv6, or IPv6 packet
carrying ICMP, if the link layer is inet, the network layer protocol context
can be safely update to 'ip' or 'ip6'.

Moreover, nft currently generates a 'meta nfproto ipvX' depedency when
using icmp or icmp6 in the inet family.

Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1073
Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org>
---
 src/payload.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)


--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Arturo Borrero Gonzalez Jan. 22, 2017, 7:59 p.m. UTC | #1 
On 20 January 2017 at 13:02, Arturo Borrero Gonzalez
<arturo.borrero.glez@gmail.com> wrote:
> From: Arturo Borrero Gonzalez <arturo@debian.org>
>

duplicated, sorry.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/src/payload.c b/src/payload.c
index af533b2..9cca838 100644
--- a/src/payload.c
+++ b/src/payload.c
@@ -284,7 +284,12 @@  int payload_gen_dependency(struct eval_ctx *ctx, const struct expr *expr,
 				desc = &proto_inet;
 				break;
 			case PROTO_BASE_TRANSPORT_HDR:
-				desc = &proto_inet_service;
+				if (expr->payload.desc == &proto_icmp)
+					desc = &proto_ip;
+				else if (expr->payload.desc == &proto_icmp6)
+					desc = &proto_ip6;
+				else
+					desc = &proto_inet_service;
 				break;
 			default:
 				break;