src: proto: Add missing packet type
PATCH 1/1 src: proto: Add missing packet type
Add missing packet type "invalid" for DCCP.
--- src/proto.c | 1 + 1 file changed, 1 insertion(+)
src/proto.c +1 -0
@@ -443,6 +443,7 @@ static const struct symbol_table dccp_pkttype_tbl = { SYMBOL("reset", DCCP_PKT_RESET), SYMBOL("sync", DCCP_PKT_SYNC), SYMBOL("syncack", DCCP_PKT_SYNCACK), + SYMBOL("invalid", DCCP_PKT_INVALID),SYMBOL_LIST_END }, };
Signature · 1 line
1.9.1
Florian Westphal
maintainerQuoted 12 lines · Shivani Bhardwaj
Add missing packet type "invalid" for DCCP.
Signed-off-by Shivani Bhardwaj <[email protected]>--- src/proto.c | 1 + 1 file changed, 1 insertion(+)src/proto.c +0
-0
src/proto.c static const struct symbol_table dccp_pkttype_tbl = { · line 446
Quoted 4 lines
src/proto.c +1
-0@@ -443,6 +443,7 @@ static const struct symbol_table dccp_pkttype_tbl = {SYMBOL ("reset" ,DCCP_PKT_RESET ),SYMBOL ("sync" ,DCCP_PKT_SYNC ),SYMBOL ("syncack" ,DCCP_PKT_SYNCACK ), + SYMBOL("invalid", DCCP_PKT_INVALID),
I don't think this is a good idea -- when user asks to match 'invalid' then this will check type == DCCP_PKT_INVALID; however the correct way would be to ask for type '> synack' (i.e., outside of the range of types specified).
Quoted 8 lines · Florian Westphal
Quoted 7 lines · Shivani Bhardwaj
Add missing packet type "invalid" for DCCP.
Signed-off-by Shivani Bhardwaj <[email protected]>--- src/proto.c | 1 + 1 file changed, 1 insertion(+)
Quoted 14 lines
src/proto.c static const struct symbol_table dccp_pkttype_tbl = { · line 446
Quoted 9 lines
src/proto.c +1
-0@@ -443,6 +443,7 @@ static const struct symbol_table dccp_pkttype_tbl = {SYMBOL ("reset" ,DCCP_PKT_RESET ),SYMBOL ("sync" ,DCCP_PKT_SYNC ),SYMBOL ("syncack" ,DCCP_PKT_SYNCACK ), + SYMBOL("invalid", DCCP_PKT_INVALID),I don't think this is a good idea -- when user asks to match 'invalid' then this will check type ==
DCCP_PKT_INVALID; however the correct way would be to ask for type '> synack' (i.e., outside of the range of types specified).
OK. So, should this be removed from the enum dccp_pkt_type as well?
And, if following iptables rules, one tries to get code corresponding to dccp type invalid using iptables-translate utility, then the corresponding nft rule should be "dccp type gt syncack". Please correct me if I'm wrong here.
Florian Westphal
maintainerQuoted 24 lines · Shivani Bhardwaj
Quoted 8 lines · Florian Westphal
Quoted 7 lines · Shivani Bhardwaj
Add missing packet type "invalid" for DCCP.
Signed-off-by Shivani Bhardwaj <[email protected]>--- src/proto.c | 1 + 1 file changed, 1 insertion(+)Quoted 14 lines
src/proto.c static const struct symbol_table dccp_pkttype_tbl = { · line 446
Quoted 9 lines
src/proto.c +1
-0@@ -443,6 +443,7 @@ static const struct symbol_table dccp_pkttype_tbl = {SYMBOL ("reset" ,DCCP_PKT_RESET ),SYMBOL ("sync" ,DCCP_PKT_SYNC ),SYMBOL ("syncack" ,DCCP_PKT_SYNCACK ), + SYMBOL("invalid", DCCP_PKT_INVALID),I don't think this is a good idea -- when user asks to match 'invalid' then this will check type ==
DCCP_PKT_INVALID; however the correct way would be to ask for type '> synack' (i.e., outside of the range of types specified).
Quoted 1 line
OK. So, should this be removed from the enum
dccp_pkt_typeas well?
Yes, but we cannot do this anymore for compatibility reasons :-(
Quoted 4 lines
And, if following iptables rules, one tries to get code corresponding to dccp type invalid using iptables-translate utility, then the corresponding nft rule should be "dccp type gt syncack". Please correct me if I'm wrong here.
Good question.
Pablo, I think -m dccp is buggy here, it should not have allowed INVALID match in the first place.
Looking at kernel part it doesn't seem to special-case this and will just check for type == INVALID. But such type isn't defined in dccp protocol, it just looks like implementation helper so DCCP stack can do simpler sanity tests.
So I suggest to not support translation of INVALID to nft and to document the INVALID shortoming in iptables-extensions manpage.
Any comments?
Pablo Neira Ayuso
maintainerQuoted 29 lines · Florian Westphal
Quoted 24 lines · Shivani Bhardwaj
Quoted 8 lines · Florian Westphal
Quoted 7 lines · Shivani Bhardwaj
Add missing packet type "invalid" for DCCP.
Signed-off-by Shivani Bhardwaj <[email protected]>--- src/proto.c | 1 + 1 file changed, 1 insertion(+)Quoted 14 lines
src/proto.c static const struct symbol_table dccp_pkttype_tbl = { · line 446
Quoted 9 lines
src/proto.c +1
-0@@ -443,6 +443,7 @@ static const struct symbol_table dccp_pkttype_tbl = {SYMBOL ("reset" ,DCCP_PKT_RESET ),SYMBOL ("sync" ,DCCP_PKT_SYNC ),SYMBOL ("syncack" ,DCCP_PKT_SYNCACK ), + SYMBOL("invalid", DCCP_PKT_INVALID),I don't think this is a good idea -- when user asks to match 'invalid' then this will check type ==
DCCP_PKT_INVALID; however the correct way would be to ask for type '> synack' (i.e., outside of the range of types specified).Quoted 1 line
OK. So, should this be removed from the enum
dccp_pkt_typeas well?Yes, but we cannot do this anymore for compatibility reasons :-(
Quoted 8 lines
Quoted 4 lines
And, if following iptables rules, one tries to get code corresponding to dccp type invalid using iptables-translate utility, then the corresponding nft rule should be "dccp type gt syncack". Please correct me if I'm wrong here.
Good question.
Pablo, I think -m dccp is buggy here, it should not have allowed INVALID match in the first place.
Right.
Quoted 9 lines
Looking at kernel part it doesn't seem to special-case this and will just check for type == INVALID. But such type isn't defined in dccp protocol, it just looks like implementation helper so DCCP stack can do simpler sanity tests.
So I suggest to not support translation of INVALID to nft and to document the INVALID shortoming in iptables-extensions manpage.
Any comments?
That's fine, we can return 0 (no translation available) in that case.