extensions: libipt_icmp: Fix translation of type 'any'

By itself, '-m icmp --icmp-type any' is a noop, it matches any icmp
types. Yet nft_ipv4_xlate() does not emit an 'ip protocol' match if
there's an extension with same name present in the rule. Luckily, legacy
iptables demands icmp match to be prepended by '-p icmp', so we can
assume this is present and just emit the 'ip protocol' match from icmp
xlate callback.

Fixes: aa158ca0fda65 ("extensions: libipt_icmp: Add translation to nft")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: Florian Westphal <fw@strlen.de>

diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
index e76257c54708c4cff5253f80ff688152c444df48..e5e236613f39f51ed39fa2d80f886589bc95c301 100644 (file)
--- a/extensions/libipt_icmp.c
+++ b/extensions/libipt_icmp.c
@@ -256,6 +256,11 @@ static int icmp_xlate(struct xt_xlate *xl,
                if (!type_xlate_print(xl, info->type, info->code[0],
                                      info->code[1]))
                        return 0;
+       } else {
+               /* '-m icmp --icmp-type any' is a noop by itself,
+                * but it eats a (mandatory) previous '-p icmp' so
+                * emit it here */
+               xt_xlate_add(xl, "ip protocol icmp");
        }
        return 1;
 }

diff --git a/extensions/libipt_icmp.txlate b/extensions/libipt_icmp.txlate
index 434f8cc4eb1ae18020fe9e85cce62c2adc3e72df..a2aec8e26df757931893e5e67645f63e92213ae6 100644 (file)
--- a/extensions/libipt_icmp.txlate
+++ b/extensions/libipt_icmp.txlate
@@ -6,3 +6,6 @@ nft add rule ip filter INPUT icmp type destination-unreachable counter accept
 
 iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j ACCEPT
 nft add rule ip filter INPUT icmp type != destination-unreachable counter accept
+
+iptables-translate -t filter -A INPUT -m icmp --icmp-type any -j ACCEPT
+nft add rule ip filter INPUT ip protocol icmp counter accept