From da13460f05eaee3b92c3b6d0ca2023c5377f4aca Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 1 Feb 2024 15:47:09 +0100 Subject: extensions: esp: Save/xlate inverted full ranges Also add a translation for plain '-m esp' match which depends on the address family: While ip6tables-translate may emit an exthdr exists match, iptables-translate must stick to meta l4proto. Fixes: 6cfa723a83d45 ("extensions: libxt_esp: Add translation to nft") Signed-off-by: Phil Sutter --- extensions/libxt_esp.txlate | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'extensions/libxt_esp.txlate') diff --git a/extensions/libxt_esp.txlate b/extensions/libxt_esp.txlate index 3b1d5718..5e8fb241 100644 --- a/extensions/libxt_esp.txlate +++ b/extensions/libxt_esp.txlate @@ -11,13 +11,13 @@ iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP nft 'add rule ip filter INPUT esp spi 500-600 counter drop' iptables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP -nft 'add rule ip filter INPUT counter drop' +nft 'add rule ip filter INPUT meta l4proto esp counter drop' iptables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP -nft 'add rule ip filter INPUT counter drop' +nft 'add rule ip filter INPUT esp spi != 0-4294967295 counter drop' ip6tables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP -nft 'add rule ip6 filter INPUT counter drop' +nft 'add rule ip6 filter INPUT exthdr esp exists counter drop' ip6tables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP -nft 'add rule ip6 filter INPUT counter drop' +nft 'add rule ip6 filter INPUT esp spi != 0-4294967295 counter drop' -- cgit v1.2.3