Re: [PATCH] Unspecified proto should print as "all" in iptables -L

[Phil Oester <kernel@linuxace.com>]

On Mon, Apr 30, 2007 at 07:25:17PM +0200, Jan Engelhardt wrote:
> On Apr 30 2007 10:13, Phil Oester wrote:
> >On Mon, Apr 30, 2007 at 10:38:38AM +0200, Jan Engelhardt wrote:
> >> Hey btw, how would you go about matching protocol 0 since 0 is unfortunately
> >> defined as "all" in iptables?
> >
> >I suppose you wouldn't, although AFAIK protocol 0 isn't actively
> >used.  Have you seen it used in the wild?
> 
> /etc/protocols lists ipv6hopbyhop as 0.
> But also see
> http://lists.netfilter.org/pipermail/netfilter/2007-April/068496.html

That is indeed unfortunate, but at this point we can't change the
meaning of this within iptables without potentially breaking compatibility
with existing rulesets.  Perhaps someone is using a rule such as this:

    -p 0 -j DROP

to drop all traffic to a box.  If we changed it, now it would only block
protocol 0.

Sure, far-fetched, but I think our hands are tied to the current definition.

Phil