From: Phil Sutter <phil@nwl.cc>
Date: Fri, 24 Aug 2018 11:35:37 +0000 (+0200)
Subject: doc: Document implicit dependency creation for icmp/icmpv6
X-Git-Tag: v0.9.1~295
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a187d26259c63df995f41e5920d5961c93e28bff;p=thirdparty%2Fnftables.git

doc: Document implicit dependency creation for icmp/icmpv6

As suggested at NFWS, the implicit nfproto dependencies generated by
icmp/icmpv6 header field matches should be documented along with how to
achieve matching on unusual packets.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
index 2a89b922..a2284ce8 100644
--- a/doc/payload-expression.txt
+++ b/doc/payload-expression.txt
@@ -119,6 +119,11 @@ ICMP HEADER EXPRESSION
 [verse]
 *icmp* ['ICMP' 'header' 'field']
 
+This expression refers to ICMP header fields. When using it in *inet*,
+*bridge* or *netdev* families, it will cause an implicit dependency on IPv4 to
+be created. To match on unusual cases like ICMP over IPv6, one has to add an
+explicit *meta nftproto ipv6* match to the rule.
+
 .ICMP header expression
 [options="header"]
 |==================
@@ -199,6 +204,11 @@ ICMPV6 HEADER EXPRESSION
 [verse]
 *icmpv6* ['ICMPv6' 'header' 'field']
 
+This expression refers to ICMPv6 header fields. When using it in *inet*,
+*bridge* or *netdev* families, it will cause an implicit dependency on IPv6 to
+be created. To match on unusual cases like ICMPv6 over IPv4, one has to add an
+explicit *meta nftproto ipv4* match to the rule.
+
 .ICMPv6 header expression
 [options="header"]
 |==================