| Message ID | 20201006171301.6192-1-phil@nwl.cc |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | [iptables] extensions: libipt_icmp: Fix translation of type 'any' | expand |
Phil Sutter <phil@nwl.cc> wrote: > By itself, '-m icmp --icmp-type any' is a noop, it matches any icmp > types. Yet nft_ipv4_xlate() does not emit an 'ip protocol' match if > there's an extension with same name present in the rule. Luckily, legacy > iptables demands icmp match to be prepended by '-p icmp', so we can > assume this is present and just emit the 'ip protocol' match from icmp > xlate callback. Reviewed-by: Florian Westphal <fw@strlen.de>
diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c index e76257c54708c..e5e236613f39f 100644 --- a/extensions/libipt_icmp.c +++ b/extensions/libipt_icmp.c @@ -256,6 +256,11 @@ static int icmp_xlate(struct xt_xlate *xl, if (!type_xlate_print(xl, info->type, info->code[0], info->code[1])) return 0; + } else { + /* '-m icmp --icmp-type any' is a noop by itself, + * but it eats a (mandatory) previous '-p icmp' so + * emit it here */ + xt_xlate_add(xl, "ip protocol icmp"); } return 1; } diff --git a/extensions/libipt_icmp.txlate b/extensions/libipt_icmp.txlate index 434f8cc4eb1ae..a2aec8e26df75 100644 --- a/extensions/libipt_icmp.txlate +++ b/extensions/libipt_icmp.txlate @@ -6,3 +6,6 @@ nft add rule ip filter INPUT icmp type destination-unreachable counter accept iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j ACCEPT nft add rule ip filter INPUT icmp type != destination-unreachable counter accept + +iptables-translate -t filter -A INPUT -m icmp --icmp-type any -j ACCEPT +nft add rule ip filter INPUT ip protocol icmp counter accept
By itself, '-m icmp --icmp-type any' is a noop, it matches any icmp types. Yet nft_ipv4_xlate() does not emit an 'ip protocol' match if there's an extension with same name present in the rule. Luckily, legacy iptables demands icmp match to be prepended by '-p icmp', so we can assume this is present and just emit the 'ip protocol' match from icmp xlate callback. Fixes: aa158ca0fda65 ("extensions: libipt_icmp: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc> --- extensions/libipt_icmp.c | 5 +++++ extensions/libipt_icmp.txlate | 3 +++ 2 files changed, 8 insertions(+)