|
 |
7cc531 |
From 6adcdca2aaf8cba6ee452c88f41ad8695bebdcfc Mon Sep 17 00:00:00 2001
|
|
|
7cc531 |
From: Phil Sutter <phil@nwl.cc>
|
|
|
7cc531 |
Date: Tue, 6 Oct 2020 19:07:19 +0200
|
|
|
7cc531 |
Subject: [PATCH] extensions: libipt_icmp: Fix translation of type 'any'
|
|
|
7cc531 |
|
|
|
7cc531 |
By itself, '-m icmp --icmp-type any' is a noop, it matches any icmp
|
|
|
7cc531 |
types. Yet nft_ipv4_xlate() does not emit an 'ip protocol' match if
|
|
|
7cc531 |
there's an extension with same name present in the rule. Luckily, legacy
|
|
|
7cc531 |
iptables demands icmp match to be prepended by '-p icmp', so we can
|
|
|
7cc531 |
assume this is present and just emit the 'ip protocol' match from icmp
|
|
|
7cc531 |
xlate callback.
|
|
|
7cc531 |
|
|
|
7cc531 |
Fixes: aa158ca0fda65 ("extensions: libipt_icmp: Add translation to nft")
|
|
|
7cc531 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
7cc531 |
Reviewed-by: Florian Westphal <fw@strlen.de>
|
|
|
7cc531 |
(cherry picked from commit ad4b17b98bbedf93d2182a4dc9a37e9cf3adfe1b)
|
|
|
7cc531 |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
7cc531 |
---
|
|
|
7cc531 |
extensions/libipt_icmp.c | 5 +++++
|
|
|
7cc531 |
extensions/libipt_icmp.txlate | 3 +++
|
|
|
7cc531 |
2 files changed, 8 insertions(+)
|
|
|
7cc531 |
|
|
|
7cc531 |
diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
|
|
|
7cc531 |
index e76257c54708c..e5e236613f39f 100644
|
|
|
7cc531 |
--- a/extensions/libipt_icmp.c
|
|
|
7cc531 |
+++ b/extensions/libipt_icmp.c
|
|
|
7cc531 |
@@ -256,6 +256,11 @@ static int icmp_xlate(struct xt_xlate *xl,
|
|
|
7cc531 |
if (!type_xlate_print(xl, info->type, info->code[0],
|
|
|
7cc531 |
info->code[1]))
|
|
|
7cc531 |
return 0;
|
|
|
7cc531 |
+ } else {
|
|
|
7cc531 |
+ /* '-m icmp --icmp-type any' is a noop by itself,
|
|
|
7cc531 |
+ * but it eats a (mandatory) previous '-p icmp' so
|
|
|
7cc531 |
+ * emit it here */
|
|
|
7cc531 |
+ xt_xlate_add(xl, "ip protocol icmp");
|
|
|
7cc531 |
}
|
|
|
7cc531 |
return 1;
|
|
|
7cc531 |
}
|
|
|
7cc531 |
diff --git a/extensions/libipt_icmp.txlate b/extensions/libipt_icmp.txlate
|
|
|
7cc531 |
index 434f8cc4eb1ae..a2aec8e26df75 100644
|
|
|
7cc531 |
--- a/extensions/libipt_icmp.txlate
|
|
|
7cc531 |
+++ b/extensions/libipt_icmp.txlate
|
|
|
7cc531 |
@@ -6,3 +6,6 @@ nft add rule ip filter INPUT icmp type destination-unreachable counter accept
|
|
|
7cc531 |
|
|
|
7cc531 |
iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j ACCEPT
|
|
|
7cc531 |
nft add rule ip filter INPUT icmp type != destination-unreachable counter accept
|
|
|
7cc531 |
+
|
|
|
7cc531 |
+iptables-translate -t filter -A INPUT -m icmp --icmp-type any -j ACCEPT
|
|
|
7cc531 |
+nft add rule ip filter INPUT ip protocol icmp counter accept
|
|
|
7cc531 |
--
|
|
|
7cc531 |
2.28.0
|
|
|
7cc531 |
|