Re: [PATCH] Unspecified proto should print as "all" in iptables -L

[Jorge Davila <davila@nicaraguaopensource.com>]

I was trying to apply a rule

iptables -p 0 -j DROP

to block only the protocol 0. I know now why that rule was not working.

I think that -p 0 must be a reference to the protocol 0 and not to all 
protocols.

Jorge.

On Mon, 30 Apr 2007 10:36:54 -0700
  Phil Oester <kernel@linuxace.com> wrote:
> On Mon, Apr 30, 2007 at 07:25:17PM +0200, Jan Engelhardt wrote:
>> On Apr 30 2007 10:13, Phil Oester wrote:
>> >On Mon, Apr 30, 2007 at 10:38:38AM +0200, Jan Engelhardt wrote:
>> >> Hey btw, how would you go about matching protocol 0 since 0 is 
>>unfortunately
>> >> defined as "all" in iptables?
>> >
>> >I suppose you wouldn't, although AFAIK protocol 0 isn't actively
>> >used.  Have you seen it used in the wild?
>> 
>> /etc/protocols lists ipv6hopbyhop as 0.
>> But also see
>> http://lists.netfilter.org/pipermail/netfilter/2007-April/068496.html
> 
> That is indeed unfortunate, but at this point we can't change the
> meaning of this within iptables without potentially breaking compatibility
> with existing rulesets.  Perhaps someone is using a rule such as this:
> 
>    -p 0 -j DROP
> 
> to drop all traffic to a box.  If we changed it, now it would only block
> protocol 0.
> 
> Sure, far-fetched, but I think our hands are tied to the current 
>definition.
> 
> Phil
> 
> 

Jorge Isaac Davila Lopez
Nicaragua Open Source
davila@nicaraguaopensource.com