nftables remove use of meta nfproto
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest10 patches 1 replyIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/10 | src: add alternate syntax for ct saddrinclude/ include/ src/ +2 more | +21 | 0 replies | |
| 2/10 | src: ct: store proto base of ct key, if anyinclude/ src/ | +14 | 0 replies | |
| 3/10 | src: ct: add eval part to inject dependencies for ct saddr/daddrsrc/ src/ | +77 | 0 replies | |
| 4/10 | src: unifiy meta and ct postprocessingsrc/ | +22 | 0 replies | |
| 5/10 | tests: update inet/bridge icmp test casetests/ tests/ | +4 | 0 replies | |
| 6/10 | src: ct: print nfproto name for some header fieldssrc/ | +23 | 0 replies | |
| 7/10 | tests: ct: adjust test case commandstests/ tests/ tests/ +1 more | +24 | 0 replies | |
| 8/10 | src: rt: add keyword distinction for nexthop vs nexthop6src/ src/ src/ | +45 | 0 replies | |
| 9/10 | tests: rt: fix test casestests/ tests/ tests/ +1 more | +12 | 0 replies | |
| 10/10 | doc: update man pagedoc/ | +18 | 0 replies |
Reviews trailers per patch
None of the 10 patches has a Reviewed-by or Acked-by of their own; the series has one for all of them.
| Patch | Pablo Neira Ayuso |
|---|---|
| Series | A-b |
| 1/10 | |
| 2/10 | |
| 3/10 | |
| 4/10 | |
| 5/10 | |
| 6/10 | |
| 7/10 | |
| 8/10 | |
| 9/10 | |
| 10/10 |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH nft 0/10] nftables remove use of meta nfproto
inet family (and others, e.g. bridge) lack context to figure out the layer 3 address type.
examples:
ct original saddr $addr
rt nexthop $addr
We can't use $addr, because it might be a set reference, e.g.
ct original saddr @whitelist
currently implemented workaround is to use 'meta nfproto' to provide the l3 context, e.g.
meta nfproto ip rt nexthop 10.2.3.4
i.e. users need to fill dependency manually.
Pablo suggested to instead specify ip saddr, ip6 saddr:
ct original ip saddr $address
and then let nft handle the dependency injection.
This series does just that.
Old syntax is preserved.
doc/nft.xml | 23 ++++++++--- include/ct.h | 3 - include/expression.h | 2 src/ct.c | 70 ++++++++++++++++++++++++---------- src/evaluate.c | 92 +++++++++++++++++++++++++++++++++++---------- src/netlink_delinearize.c | 52 +++++++++++-------------- src/parser_bison.y | 42 ++++++++++++++++++-- src/rt.c | 14 ++++++ tests/py/bridge/icmpX.t | 4 - tests/py/inet/ct.t | 7 ++- tests/py/inet/ct.t.payload | 4 - tests/py/inet/icmpX.t | 4 - tests/py/inet/rt.t | 10 +++- tests/py/inet/rt.t.payload | 4 - tests/py/ip/ct.t | 18 ++++---- tests/py/ip/ct.t.payload | 16 +++---- tests/py/ip/rt.t | 3 - tests/py/ip6/rt0.t | 2 18 files changed, 260 insertions(+), 110 deletions(-)