Merge branch 'meta_l4_dependency'

Currently nft inserts different types of dependencies for l4 protocols,
depending on the family.

For inet, nft inserts 'meta l4proto' to e.g. check for tcp, for
ip, nft uses 'ip protocol'. Both are fine.  The ip6 family however
uses 'ip6 nexthdr', and thats a problem because e.g. tcp dport 22 will
not match packets that use ipv6 extension headers.

The series switches both ipv6 and ipv4 to use meta l4 instead
so ipv6 will always check the last transport header value.

We could ignore ip as only ipv6 uses extension headers.
However, switching ipv4 as well makes things a bit simpler because nft
then creates the same l4 dependency for all families.

Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>

1 files changed, 0 insertions, 145 deletions

diff --git a/tests/py/inet/comp.t.payload.ip6 b/tests/py/inet/comp.t.payload.ip6
deleted file mode 100644
index a325d8cd..00000000
--- a/tests/py/inet/comp.t.payload.ip6
+++ /dev/null
@@ -1,145 +0,0 @@
-# comp nexthdr != esp
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 1b @ transport header + 0 => reg 1 ]
-  [ cmp neq reg 1 0x00000032 ]
-
-# comp flags 0x0
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 1b @ transport header + 1 => reg 1 ]
-  [ cmp eq reg 1 0x00000000 ]
-
-# comp flags != 0x23
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 1b @ transport header + 1 => reg 1 ]
-  [ cmp neq reg 1 0x00000023 ]
-
-# comp flags 0x33-0x45
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 1b @ transport header + 1 => reg 1 ]
-  [ cmp gte reg 1 0x00000033 ]
-  [ cmp lte reg 1 0x00000045 ]
-
-# comp flags != 0x33-0x45
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 1b @ transport header + 1 => reg 1 ]
-  [ range neq reg 1 0x00000033 0x00000045 ]
-
-# comp flags {0x33, 0x55, 0x67, 0x88}
-__set%d test-ip6 3
-__set%d test-ip6 0
-	element 00000033  : 0 [end]	element 00000055  : 0 [end]	element 00000067  : 0 [end]	element 00000088  : 0 [end]
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 1b @ transport header + 1 => reg 1 ]
-  [ lookup reg 1 set __set%d ]
-
-# comp flags != {0x33, 0x55, 0x67, 0x88}
-__set%d test-ip6 3
-__set%d test-ip6 0
-	element 00000033  : 0 [end]	element 00000055  : 0 [end]	element 00000067  : 0 [end]	element 00000088  : 0 [end]
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 1b @ transport header + 1 => reg 1 ]
-  [ lookup reg 1 set __set%d 0x1 ]
-
-# comp flags { 0x33-0x55}
-__set%d test-ip6 7
-__set%d test-ip6 0
-	element 00000000  : 1 [end]	element 00000033  : 0 [end]	element 00000056  : 1 [end]
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 1b @ transport header + 1 => reg 1 ]
-  [ lookup reg 1 set __set%d ]
-
-# comp flags != { 0x33-0x55}
-__set%d test-ip6 7
-__set%d test-ip6 0
-	element 00000000  : 1 [end]	element 00000033  : 0 [end]	element 00000056  : 1 [end]
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 1b @ transport header + 1 => reg 1 ]
-  [ lookup reg 1 set __set%d 0x1 ]
-
-# comp cpi 22
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 2b @ transport header + 2 => reg 1 ]
-  [ cmp eq reg 1 0x00001600 ]
-
-# comp cpi != 233
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 2b @ transport header + 2 => reg 1 ]
-  [ cmp neq reg 1 0x0000e900 ]
-
-# comp cpi 33-45
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 2b @ transport header + 2 => reg 1 ]
-  [ cmp gte reg 1 0x00002100 ]
-  [ cmp lte reg 1 0x00002d00 ]
-
-# comp cpi != 33-45
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 2b @ transport header + 2 => reg 1 ]
-  [ range neq reg 1 0x00002100 0x00002d00 ]
-
-# comp cpi {33, 55, 67, 88}
-__set%d test-ip6 3
-__set%d test-ip6 0
-	element 00002100  : 0 [end]	element 00003700  : 0 [end]	element 00004300  : 0 [end]	element 00005800  : 0 [end]
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 2b @ transport header + 2 => reg 1 ]
-  [ lookup reg 1 set __set%d ]
-
-# comp cpi != {33, 55, 67, 88}
-__set%d test-ip6 3
-__set%d test-ip6 0
-	element 00002100  : 0 [end]	element 00003700  : 0 [end]	element 00004300  : 0 [end]	element 00005800  : 0 [end]
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 2b @ transport header + 2 => reg 1 ]
-  [ lookup reg 1 set __set%d 0x1 ]
-
-# comp cpi { 33-55}
-__set%d test-ip6 7
-__set%d test-ip6 0
-	element 00000000  : 1 [end]	element 00002100  : 0 [end]	element 00003800  : 1 [end]
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 2b @ transport header + 2 => reg 1 ]
-  [ lookup reg 1 set __set%d ]
-
-# comp cpi != { 33-55}
-__set%d test-ip6 7
-__set%d test-ip6 0
-	element 00000000  : 1 [end]	element 00002100  : 0 [end]	element 00003800  : 1 [end]
-ip6 test-ip6 input
-  [ payload load 1b @ network header + 6 => reg 1 ]
-  [ cmp eq reg 1 0x0000006c ]
-  [ payload load 2b @ transport header + 2 => reg 1 ]
-  [ lookup reg 1 set __set%d 0x1 ]
-