Netfilter-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [iptables PATCH] extensions: libipt_icmp: Fix translation of type 'any'
@ 2020-10-06 17:13 Phil Sutter
  2020-10-06 18:52 ` Florian Westphal
  0 siblings, 1 reply; 2+ messages in thread
From: Phil Sutter @ 2020-10-06 17:13 UTC (permalink / raw)
  To: Pablo Neira Ayuso; +Cc: netfilter-devel, Laura Garcia Liebana

By itself, '-m icmp --icmp-type any' is a noop, it matches any icmp
types. Yet nft_ipv4_xlate() does not emit an 'ip protocol' match if
there's an extension with same name present in the rule. Luckily, legacy
iptables demands icmp match to be prepended by '-p icmp', so we can
assume this is present and just emit the 'ip protocol' match from icmp
xlate callback.

Fixes: aa158ca0fda65 ("extensions: libipt_icmp: Add translation to nft")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 extensions/libipt_icmp.c      | 5 +++++
 extensions/libipt_icmp.txlate | 3 +++
 2 files changed, 8 insertions(+)

diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
index e76257c54708c..e5e236613f39f 100644
--- a/extensions/libipt_icmp.c
+++ b/extensions/libipt_icmp.c
@@ -256,6 +256,11 @@ static int icmp_xlate(struct xt_xlate *xl,
 		if (!type_xlate_print(xl, info->type, info->code[0],
 				      info->code[1]))
 			return 0;
+	} else {
+		/* '-m icmp --icmp-type any' is a noop by itself,
+		 * but it eats a (mandatory) previous '-p icmp' so
+		 * emit it here */
+		xt_xlate_add(xl, "ip protocol icmp");
 	}
 	return 1;
 }
diff --git a/extensions/libipt_icmp.txlate b/extensions/libipt_icmp.txlate
index 434f8cc4eb1ae..a2aec8e26df75 100644
--- a/extensions/libipt_icmp.txlate
+++ b/extensions/libipt_icmp.txlate
@@ -6,3 +6,6 @@ nft add rule ip filter INPUT icmp type destination-unreachable counter accept
 
 iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j ACCEPT
 nft add rule ip filter INPUT icmp type != destination-unreachable counter accept
+
+iptables-translate -t filter -A INPUT -m icmp --icmp-type any -j ACCEPT
+nft add rule ip filter INPUT ip protocol icmp counter accept
-- 
2.28.0


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [iptables PATCH] extensions: libipt_icmp: Fix translation of type 'any'
  2020-10-06 17:13 [iptables PATCH] extensions: libipt_icmp: Fix translation of type 'any' Phil Sutter
@ 2020-10-06 18:52 ` Florian Westphal
  0 siblings, 0 replies; 2+ messages in thread
From: Florian Westphal @ 2020-10-06 18:52 UTC (permalink / raw)
  To: Phil Sutter; +Cc: Pablo Neira Ayuso, netfilter-devel, Laura Garcia Liebana

Phil Sutter <phil@nwl.cc> wrote:
> By itself, '-m icmp --icmp-type any' is a noop, it matches any icmp
> types. Yet nft_ipv4_xlate() does not emit an 'ip protocol' match if
> there's an extension with same name present in the rule. Luckily, legacy
> iptables demands icmp match to be prepended by '-p icmp', so we can
> assume this is present and just emit the 'ip protocol' match from icmp
> xlate callback.

Reviewed-by: Florian Westphal <fw@strlen.de>

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-06 17:13 [iptables PATCH] extensions: libipt_icmp: Fix translation of type 'any' Phil Sutter
2020-10-06 18:52 ` Florian Westphal

Netfilter-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netfilter-devel/0 netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ https://lore.kernel.org/netfilter-devel \
		netfilter-devel@vger.kernel.org
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netfilter-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git