| commit 3412bd0bfb8b8bac9834cbfd3392b3d5487133bf |
| Author: Tom Eastep <teastep@shorewall.net> |
| Date: Thu Aug 18 15:11:16 2011 -0700 |
| |
| libxt_conntrack: improve error message on parsing violation |
| |
| Tom Eastep noted: |
| |
| $ iptables -A foo -m conntrack --ctorigdstport 22 |
| iptables v1.4.12: conntrack rev 2 does not support port ranges |
| Try `iptables -h' or 'iptables --help' for more information. |
| |
| Commit v1.4.12-41-g1ad6407 takes care of the actual cause of the bug, |
| but let's include Tom's patch nevertheless for the better error |
| message in case one actually does specify a range with rev 2. |
| |
| References: http://marc.info/?l=netfilter-devel&m=131370592105298&w=2 |
| Signed-off-by: Jan Engelhardt <jengelh@medozas.de> |
| |
| diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c |
| index 060b947..fff69f8 100644 |
| --- a/extensions/libxt_conntrack.c |
| +++ b/extensions/libxt_conntrack.c |
| @@ -129,13 +129,20 @@ static const struct xt_option_entry conntrack2_mt_opts[] = { |
| .flags = XTOPT_INVERT}, |
| {.name = "ctexpire", .id = O_CTEXPIRE, .type = XTTYPE_UINT32RC, |
| .flags = XTOPT_INVERT}, |
| - {.name = "ctorigsrcport", .id = O_CTORIGSRCPORT, .type = XTTYPE_PORT, |
| + /* |
| + * Rev 1 and 2 only store one port, and we would normally use |
| + * %XTTYPE_PORT (rather than %XTTYPE_PORTRC) for that. The resulting |
| + * error message - in case a user passed a range nevertheless - |
| + * "port 22:23 resolved to nothing" is not quite as useful as using |
| + * %XTTYPE_PORTC and libxt_conntrack's own range test. |
| + */ |
| + {.name = "ctorigsrcport", .id = O_CTORIGSRCPORT, .type = XTTYPE_PORTRC, |
| .flags = XTOPT_INVERT | XTOPT_NBO}, |
| - {.name = "ctorigdstport", .id = O_CTORIGDSTPORT, .type = XTTYPE_PORT, |
| + {.name = "ctorigdstport", .id = O_CTORIGDSTPORT, .type = XTTYPE_PORTRC, |
| .flags = XTOPT_INVERT | XTOPT_NBO}, |
| - {.name = "ctreplsrcport", .id = O_CTREPLSRCPORT, .type = XTTYPE_PORT, |
| + {.name = "ctreplsrcport", .id = O_CTREPLSRCPORT, .type = XTTYPE_PORTRC, |
| .flags = XTOPT_INVERT | XTOPT_NBO}, |
| - {.name = "ctrepldstport", .id = O_CTREPLDSTPORT, .type = XTTYPE_PORT, |
| + {.name = "ctrepldstport", .id = O_CTREPLDSTPORT, .type = XTTYPE_PORTRC, |
| .flags = XTOPT_INVERT | XTOPT_NBO}, |
| {.name = "ctdir", .id = O_CTDIR, .type = XTTYPE_STRING}, |
| XTOPT_TABLEEND, |
