Re: [PATCH 2/2] extensions: restore matching any SPI id by default

[Jan Engelhardt <jengelh@inai.de>]

On Wednesday 2015-07-15 19:30, Pablo Neira Ayuso wrote:
>> The printing via iptables -S was not the problem.
>> The patch is about that no AH/ESP packets were matched when using
>> just "-m esp" because of the implied --espspi 0:0.
>
>Without your patch:
>
>iptables -A INPUT -p ah
>
># iptables-save
>...
>-A INPUT -p ah -m ah --ahspi 0

That should not happen. -p implies -m only magically if one of the
options is used, i.e. "-p ah" alone should never imply "-m ah".

# XTABLES_LIBDIR=$PWD/extensions iptables/xtables-multi main4 -A z -p ah
# XTABLES_LIBDIR=$PWD/extensions iptables/xtables-multi main4 -S z
-N z
-A z -p ah


Second, without my patch:

# XTABLES_LIBDIR=$PWD/extensions iptables/xtables-multi main4 -A z -p ah -m ah
# XTABLES_LIBDIR=$PWD/extensions iptables/xtables-multi main4 -S z
-A z -p ah -m ah --ahspi 0

And that was the bug: --ahspi 0 is undesired behavior for when --ahspi
is never specified.


Printing it differently is a separate concern one can think about,
but with a separate patch. :-)