Repository navigation
v1.62.0: icmp-type-255-matches-any — IPv4 iptables reads ICMP type 255 as "any" - #91
Merged
Merged
Conversation
…5 as "any" The kernel's IPv4 icmp match passes a packet when the rule's type is 0xFF or type and code agree, so `--icmp-type 255` matches EVERY ICMP packet, whatever code follows it, and `! --icmp-type 255` matches none. Measured (iptables 1.8.11, nf_tables and legacy, 3 real pings through INPUT): `--icmp-type 8` and `0` matched 3 of 6 packets; 255, 255/0 and 255/255 matched 6 of 6; the negated form 0. iptables-save prints a bare 255 back as `any` but keeps `255/0` as written. ip6tables (--icmpv6-type 255: 0 of 6) and nft (icmp type 255: 0) read it literally - IPv4 iptables only. The linter's own ICMP analyses read 255 as one literal type: a `--icmp-type 255 -j DROP` now raises icmp-pmtud-blocked (before: nothing), `! --icmp-type any -j DROP` no longer does (before: a false alarm for a rule that drops no ICMP), and an `any`/255 ACCEPT counts as answering ping for unlimited-icmp-echo. The icmp-type-unknown comment that called 255 "a type with no name" is corrected. Sample iptables-icmp-255.txt (a "drop the oddballs" block with 255/0): 0 of 3 pings from another netns answered in both backends; without that line, 3 of 3. Tests 382 -> 388; against main's linter.js 7 fail. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Qué
Smell nuevo
icmp-type-255-matches-any(warning). En IPv4, el matchicmpdel kernel deja pasar un paquete si el tipo de la regla es0xFFo si tipo y código coinciden:--icmp-type 255casa todo el ICMP, lleve el código que lleve, y! --icmp-type 255no casa ninguno.Medido (iptables 1.8.11, nf_tables y legacy, 3 pings reales por INPUT)
--icmp-type 8/0--icmp-type 255,255/0,255/255! --icmp-type 255(se guarda como! --icmp-type any)--icmpv6-type 255icmp type 255iptables-saveimprime un255suelto comoany, pero mantiene255/0tal cual: un volcado no lo delata. Por encima de 255 no carga (rc 2 / nft rc 1), y eso ya lo cubreicmp-type-unknown.También corrige los análisis ICMP del propio linter
Leían el 255 como un tipo literal:
-p icmp --icmp-type 255 -j DROPahora daicmp-pmtud-blocked(se traga fragmentation-needed); antes, nada.! --icmp-type any -j DROPya no lo da: no tira ningún ICMP. Antes era una falsa alarma.--icmp-type anyo255cuenta como responder al ping enunlimited-icmp-echo, igual que un-p icmpa secas.icmp-type-unknownque llamaba al 255 «un tipo sin nombre».Muestra
samples/iptables-icmp-255.txt(botón ICMP type 255): un bloque de «tirar ICMP raros» con--icmp-type 255/0 -j DROP. Con pings desde otro netns (por un veth, porque-i loacepta antes): 0 de 3 contestados en los dos backends; sin esa línea, 3 de 3. Tiene unESTABLISHED,RELATEDdelante, así que lo que se pierde es el ping, no el PMTUD de las conexiones ya establecidas (así lo explica su comentario).Verificación
linter.jsdemainfallan 7: 4 de los 5 nuevos (el de «ip6tables/nft lo leen literal» pasa también enmain), la muestra y los dos guardianes.🤖 Generated with Claude Code