Skip to contentSkip to conversation

Unspecified proto should print as "all" in iptables -L

PATCH In review Phil Oester 5 participants 14 messages Apr 28, 2007 – Jun 2, 2007 netfilter

lore
Share & tools
lore

Phil Oester

author
#0 lore raw

PATCH 1/1 Unspecified proto should print as "all" in iptables -L

In fixing bug #446 [1], the output for unspecified proto was changed from "all" to "0". This reverts to the original behaviour, and closes bugzilla #543.

Phil

[1] http://svn.netfilter.org/cgi-bin/viewcvs.cgi/trunk/iptables/ip6tables.c?r1=6465&r2=6466

iptables.c +1 -0
diff -ru ipt-orig/iptables.c ipt-new/iptables.c
@@ -232,6 +232,7 @@
 	{ "esp", IPPROTO_ESP },
 	{ "ah", IPPROTO_AH },
 	{ "sctp", IPPROTO_SCTP },
+	{ "all", 0 },
 };
 
 static char *
maintainer
#1 lore raw
Quoted 3 lines · Phil Oester

In fixing bug #446 [1], the output for unspecified proto was changed from "all" to "0". This reverts to the original behaviour, and closes bugzilla #543.

Applied a similar patch to ip6tables.c, thanks Phil. You're doing a nice work closing open bugs in bugzilla.

Signature · 2 lines
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris
#2 lore raw
Quoted 7 lines · Pablo Neira Ayuso
Quoted 3 lines · Phil Oester

In fixing bug #446 [1], the output for unspecified proto was changed from "all" to "0". This reverts to the original behaviour, and closes bugzilla #543.

Applied a similar patch to ip6tables.c, thanks Phil. You're doing a nice work closing open bugs in bugzilla.

Hey btw, how would you go about matching protocol 0 since 0 is unfortunately defined as "all" in iptables?

Jan

author
#3 lore raw
Quoted 2 lines · Jan Engelhardt

Hey btw, how would you go about matching protocol 0 since 0 is unfortunately defined as "all" in iptables?

I suppose you wouldn't, although AFAIK protocol 0 isn't actively used. Have you seen it used in the wild?

Phil

author
#5 lore raw
Quoted 11 lines · Jan Engelhardt
Quoted 6 lines · Phil Oester
Quoted 2 lines · Jan Engelhardt

Hey btw, how would you go about matching protocol 0 since 0 is unfortunately defined as "all" in iptables?

I suppose you wouldn't, although AFAIK protocol 0 isn't actively used. Have you seen it used in the wild?

/etc/protocols lists ipv6hopbyhop as 0.
But also see
http://lists.netfilter.org/pipermail/netfilter/2007-April/068496.html

That is indeed unfortunate, but at this point we can't change the meaning of this within iptables without potentially breaking compatibility with existing rulesets. Perhaps someone is using a rule such as this:

-p 0 -j DROP

to drop all traffic to a box. If we changed it, now it would only block protocol 0.

Sure, far-fetched, but I think our hands are tied to the current definition.

Phil

#6 lore raw

I was trying to apply a rule

iptables -p 0 -j DROP

to block only the protocol 0. I know now why that rule was not working.

I think that -p 0 must be a reference to the protocol 0 and not to all protocols.

Jorge.

Quoted 18 lines · On Mon, 30 Apr 2007 10:36:54 -0700 Phil Oester <[email protected]> wrote:
Quoted 4 lines · Jan Engelhardt
Quoted 2 lines · Phil Oester
Quoted 1 line · Jan Engelhardt

Hey btw, how would you go about matching protocol 0 since 0 is

unfortunately

Quoted 8 lines
Quoted 4 lines
Quoted 1 line

defined as "all" in iptables?

I suppose you wouldn't, although AFAIK protocol 0 isn't actively used. Have you seen it used in the wild?

/etc/protocols lists ipv6hopbyhop as 0.
But also see
http://lists.netfilter.org/pipermail/netfilter/2007-April/068496.html

That is indeed unfortunate, but at this point we can't change the meaning of this within iptables without potentially breaking compatibility with existing rulesets. Perhaps someone is using a rule such as this:

Quoted 10 lines

-p 0 -j DROP

to drop all traffic to a box. If we changed it, now it would only block protocol 0.

Sure, far-fetched, but I think our hands are tied to the current definition.

Phil

Jorge Isaac Davila Lopez
Nicaragua Open Source
[email protected]

author
#7 lore raw
Quoted 10 lines · Jorge Davila

I was trying to apply a rule

iptables -p 0 -j DROP

to block only the protocol 0. I know now why that rule was not working.

I think that -p 0 must be a reference to the protocol 0 and not to all protocols.

Jorge.

Which application uses protocol 0? Or is this a custom app you wrote?

Phil

#8 lore raw

Sorry for the delay in answering your question ...

Well, it's because some users inside the internal networks under my administration visit http://www.grc.com/ and run the Shields Up! to see the open ports in the gateways and they see the port 0 open. That was the reason to apply the rule.

Jorge.

Quoted 7 lines · On Mon, 30 Apr 2007 13:09:30 -0700 Phil Oester <[email protected]> wrote:
Quoted 6 lines · Jorge Davila

I was trying to apply a rule

iptables -p 0 -j DROP

to block only the protocol 0. I know now why that rule was not working.

Quoted 8 lines
Quoted 3 lines

I think that -p 0 must be a reference to the protocol 0 and not to all protocols.

Jorge.

Which application uses protocol 0? Or is this a custom app you wrote?

Phil

Jorge Isaac Davila Lopez
Nicaragua Open Source
[email protected]

#9 lore raw
Quoted 4 lines · Jorge Davila

Well, it's because some users inside the internal networks under my administration visit http://www.grc.com/ and run the Shields Up! to see the open ports in the gateways and they see the port 0 open. That was the reason to apply the rule.

Ah cool, that's another datapoint when trying to guess the firewall ruleset. Port 0 not filtered roughly means "default policy is ACCEPT". (Well, not quite. But close.)

Regards,
Carl-Daniel

author
#10 lore raw
Quoted 9 lines · Carl-Daniel Hailfinger
Quoted 4 lines · Jorge Davila

Well, it's because some users inside the internal networks under my administration visit http://www.grc.com/ and run the Shields Up! to see the open ports in the gateways and they see the port 0 open. That was the reason to apply the rule.

Ah cool, that's another datapoint when trying to guess the firewall ruleset. Port 0 not filtered roughly means "default policy is ACCEPT". (Well, not quite. But close.)

Let's be clear here...we aren't talking about _PORT_ zero. We're talking about _PROTOCOL_ zero. Can you please elaborate on the specific need to filter _PROTOCOL_ zero?

Phil

#11 lore raw
Quoted 6 lines · Phil Oester
Quoted 5 lines · Carl-Daniel Hailfinger
Quoted 4 lines · Jorge Davila

Well, it's because some users inside the internal networks under my administration visit http://www.grc.com/ and run the Shields Up! to see the open ports in the gateways and they see the port 0 open. That was the reason to apply the rule.

Quoted 7 lines
Quoted 3 lines

Ah cool, that's another datapoint when trying to guess the firewall ruleset. Port 0 not filtered roughly means "default policy is ACCEPT". (Well, not quite. But close.)

Let's be clear here...we aren't talking about _PORT_ zero. We're talking about _PROTOCOL_ zero. Can you please elaborate on the specific need to filter _PROTOCOL_ zero?

Sorry, my bad. There is no specific need on my side. It's just that some creative use of nmap enables me to learn more about target systems. I am entirely happy with the current situation.

Regards,
Carl-Daniel

#12 lore raw

Re: How to match protocol 0

In reply to Phil Oester

Hello all,

regarding your questions in
http://lists.netfilter.org/pipermail/netfilter/2007-April/068496.html
and the thread
http://lists.netfilter.org/pipermail/netfilter-devel/2007-April/027675.html

I think it's actually quite easy. How about:

	iptables -m u32 --u32 "8&0x0F00=0"

This takes bytes 8+4 of a packet (bytes 8,9,10,11), ANDs it with 0x0F00, so as to get only byte 9 (which is the IPv4 field for the Layer4 protocol) and see if it is 0.

(Yes, we would have to use a shift before comparing, but since comparing for protocol zero, it does not matter.)

Ok, everyone got that? :)

Jan

#13 lore raw

Re: How to match protocol 0

Quoted 11 lines · Jan Engelhardt

Hello all,

regarding your questions in
http://lists.netfilter.org/pipermail/netfilter/2007-April/068496.html
and the thread
http://lists.netfilter.org/pipermail/netfilter-devel/2007-April/027675.html

I think it's actually quite easy. How about:

	iptables -m u32 --u32 "8&0x0F00=0"

minor glitch, it should read:
for TCP (prot 6): iptables -m u32 --u32 "8 & 0x00FF0000 = 0x00060000" for UDP (prot 17): iptables -m u32 --u32 "8 & 0x00FF0000 = 0x00110000" for HBH (prot 0): iptables -m u32 --u32 "8 & 0x00FF0000 = 0x00000000"

(Leading zeroes can be omitted of course.)
And, for example completeness, have some shift,

TCP: iptables -m u32 --u32 "8 & 0xFF0000 >> 16 = 6"

Happy matching.

Jan