From 1eada72b7da712bffb87e829b3b9deb3de6bca3c Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Wed, 13 Aug 2008 14:41:32 +0200 Subject: Warn about use of DROP in nat table Consensus is that we should warn for now. Signed-off-by: Jan Engelhardt Signed-off-by: Patrick McHardy --- iptables.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'iptables.c') diff --git a/iptables.c b/iptables.c index 41e18361..6a105f80 100644 --- a/iptables.c +++ b/iptables.c @@ -1917,6 +1917,14 @@ int do_command(int argc, char *argv[], char **table, iptc_handle_t *handle) invert = FALSE; } + if (strcmp(*table, "nat") == 0 && + ((policy != NULL && strcmp(policy, "DROP") == 0) || + (jumpto != NULL && strcmp(jumpto, "DROP") == 0))) + fprintf(stderr, "\nThe \"nat\" table is not intended for " + "filtering, hence the use of DROP is deprecated and " + "will permanently be disabled in the next iptables " + "release. Please adjust your scripts.\n\n"); + for (matchp = matches; matchp; matchp = matchp->next) if (matchp->match->final_check != NULL) matchp->match->final_check(matchp->match->mflags); -- cgit v1.2.3