summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPhil Oester <kernel@linuxace.com>2005-02-01 12:56:16 +0000
committerHarald Welte <laforge@gnumonks.org>2005-02-01 12:56:16 +0000
commit3fb61f3d4a194ba989fe8470f16064f20e59e3bc (patch)
tree8b96b759f0e3352eb00567e3446bd2106279266d
parent22a8c9365f62cf64141e93a574a7b41ba66a4dbe (diff)
John McCann points out via bugzilla that iptables happily accepts this
syntax on DNAT/SNAT: --to x.x.x.x:y:z but doesn't actually make use of the second port. Clear up the confusion by only accepting a dash between the ports. This closes bugzilla #265. Signed-off-by: Phil Oester <kernel@linuxace.com>
-rw-r--r--extensions/libipt_DNAT.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/extensions/libipt_DNAT.c b/extensions/libipt_DNAT.c
index d8efa586..96a6e6b5 100644
--- a/extensions/libipt_DNAT.c
+++ b/extensions/libipt_DNAT.c
@@ -65,7 +65,7 @@ static struct ipt_entry_target *
parse_to(char *arg, int portok, struct ipt_natinfo *info)
{
struct ip_nat_range range;
- char *colon, *dash;
+ char *colon, *dash, *error;
struct in_addr *ip;
memset(&range, 0, sizeof(range));
@@ -85,6 +85,11 @@ parse_to(char *arg, int portok, struct ipt_natinfo *info)
exit_error(PARAMETER_PROBLEM,
"Port `%s' not valid\n", colon+1);
+ error = strchr(colon+1, ':');
+ if (error)
+ exit_error(PARAMETER_PROBLEM,
+ "Invalid port:port syntax - use dash\n");
+
dash = strchr(colon, '-');
if (!dash) {
range.min.tcp.port