From ad4b17b98bbedf93d2182a4dc9a37e9cf3adfe1b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 6 Oct 2020 19:07:19 +0200 Subject: extensions: libipt_icmp: Fix translation of type 'any' By itself, '-m icmp --icmp-type any' is a noop, it matches any icmp types. Yet nft_ipv4_xlate() does not emit an 'ip protocol' match if there's an extension with same name present in the rule. Luckily, legacy iptables demands icmp match to be prepended by '-p icmp', so we can assume this is present and just emit the 'ip protocol' match from icmp xlate callback. Fixes: aa158ca0fda65 ("extensions: libipt_icmp: Add translation to nft") Signed-off-by: Phil Sutter Reviewed-by: Florian Westphal --- extensions/libipt_icmp.txlate | 3 +++ 1 file changed, 3 insertions(+) (limited to 'extensions/libipt_icmp.txlate') diff --git a/extensions/libipt_icmp.txlate b/extensions/libipt_icmp.txlate index 434f8cc4..a2aec8e2 100644 --- a/extensions/libipt_icmp.txlate +++ b/extensions/libipt_icmp.txlate @@ -6,3 +6,6 @@ nft add rule ip filter INPUT icmp type destination-unreachable counter accept iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j ACCEPT nft add rule ip filter INPUT icmp type != destination-unreachable counter accept + +iptables-translate -t filter -A INPUT -m icmp --icmp-type any -j ACCEPT +nft add rule ip filter INPUT ip protocol icmp counter accept -- cgit v1.2.3