payload: enforce ip/ip6 protocol depending on icmp or icmpv6

After some discussion with Pablo we agreed to treat icmp/icmpv6 specially.

in the case of a rule like 'tcp dport 22' the inet, bridge and netdev
families only care about the lower layer protocol.

In the icmpv6 case however we'd like to also enforce an ipv6 protocol check
(and ipv4 check in icmp case).

This extends payload_gen_special_dependency() to consider this.
With this patch:

add rule $pf filter input meta l4proto icmpv6
add rule $pf filter input meta l4proto icmpv6 icmpv6 type echo-request
add rule $pf filter input icmpv6 type echo-request

will work in all tables and all families.
For inet/bridge/netdev, an ipv6 protocol dependency is added; this will
not match ipv4 packets with ip->protocol == icmpv6, EXCEPT in the case
of the ip family.

Its still possible to match icmpv6-in-ipv4 in inet/bridge/netdev with an
explicit dependency:

add rule inet f i ip protocol ipv6-icmp meta l4proto ipv6-icmp icmpv6 type ...

Implicit dependencies won't get removed at the moment, so
  bridge ... icmp type echo-request
will be shown as
  ether type ip meta l4proto 1 icmp type echo-request

Signed-off-by: Florian Westphal <fw@strlen.de>

0 files changed, 0 insertions, 0 deletions