Author: Jeremy Sowden <jeremy@azazel.net>
Last-Update: 2024-11-20
Forwarded: https://lore.kernel.org/netfilter-devel/20241108173443.4146022-1-jeremy@azazel.net/
Applied-Upstream: e6e232d0ae252b0b86278455b18d9475b95db8f0
Description: fix translation test failures
 Protocol number 141 is assigned to a real protocol: Wrapped Encapsulating
 Security Payload.  This is listed in Debian's /etc/protocols, which leads to
 test failures:
   .
   ./extensions/generic.txlate: Fail
   src: iptables-translate -A FORWARD -p 141
   exp: nft 'add rule ip filter FORWARD ip protocol 141 counter'
   res: nft 'add rule ip filter FORWARD ip protocol wesp counter'
   .
   ./extensions/generic.txlate: Fail
   src: ip6tables-translate -A FORWARD -p 141
   exp: nft 'add rule ip6 filter FORWARD meta l4proto 141 counter'
   res: nft 'add rule ip6 filter FORWARD meta l4proto wesp counter'
   .
   ./extensions/generic.txlate: Fail
   src: iptables-translate -A FORWARD ! -p 141
   exp: nft 'add rule ip filter FORWARD ip protocol != 141 counter'
   res: nft 'add rule ip filter FORWARD ip protocol != wesp counter'
   .
   ./extensions/generic.txlate: Fail
   src: ip6tables-translate -A FORWARD ! -p 141
   exp: nft 'add rule ip6 filter FORWARD meta l4proto != 141 counter'
   res: nft 'add rule ip6 filter FORWARD meta l4proto != wesp counter'
   .
 Replace it with 253, which IANA reserves for testing and experimentation.

--- a/extensions/generic.txlate
+++ b/extensions/generic.txlate
@@ -76,17 +76,17 @@
 ip6tables-translate -A FORWARD ! -p 132
 nft 'add rule ip6 filter FORWARD meta l4proto != sctp counter'
 
-iptables-translate -A FORWARD -p 141
-nft 'add rule ip filter FORWARD ip protocol 141 counter'
+iptables-translate -A FORWARD -p 253
+nft 'add rule ip filter FORWARD ip protocol 253 counter'
 
-ip6tables-translate -A FORWARD -p 141
-nft 'add rule ip6 filter FORWARD meta l4proto 141 counter'
+ip6tables-translate -A FORWARD -p 253
+nft 'add rule ip6 filter FORWARD meta l4proto 253 counter'
 
-iptables-translate -A FORWARD ! -p 141
-nft 'add rule ip filter FORWARD ip protocol != 141 counter'
+iptables-translate -A FORWARD ! -p 253
+nft 'add rule ip filter FORWARD ip protocol != 253 counter'
 
-ip6tables-translate -A FORWARD ! -p 141
-nft 'add rule ip6 filter FORWARD meta l4proto != 141 counter'
+ip6tables-translate -A FORWARD ! -p 253
+nft 'add rule ip6 filter FORWARD meta l4proto != 253 counter'
 
 iptables-translate -A FORWARD -m tcp --dport 22 -p tcp
 nft 'add rule ip filter FORWARD tcp dport 22 counter'