path: root/extensions/libip6t_DNAT.t
diff options
authorThierry Du Tre <>2018-01-16 13:44:37 +0100
committerPablo Neira Ayuso <>2018-01-16 16:17:30 +0100
commit88fa4543f8085e52606c776d47e4420896dd561b (patch)
treee6db0980042ed5ffbc26c1ef4d1abde7b5e93896 /extensions/libip6t_DNAT.t
parent64a0e09894e528d7920900028abee0afd601f9a1 (diff)
extensions: ip6t_{S,D}NAT: multiple to-dst/to-src arguments not reported
This patch is fixing the detection of multiple '--to-destination' in a DNAT rule and '--to-source' in SNAT rule for IPv6. Currently, when defining multiple values for these, only the last will be used and others ignored silently. The checks for (cb->xflags & F_X_TO_[DEST/SRC]) always fails because the flags are never set before. It seems to be a copy-paste artefact since introduction of the IPv6 DNAT/SNAT extensions based on IPv4 code. I also removed the kernel_version checks because they seem useless. Extensions for IPv6 DNAT/SNAT are using xt_target with revision 1. That seems only added since kernel version 3.7-rc1 and therefore the check for > v2.6.10 will always return true. The check is probably also coming from the IPv4 copy-paste. Add tests to cover this too, including the IPv4 side. Signed-off-by: Thierry Du Tre <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'extensions/libip6t_DNAT.t')
1 files changed, 2 insertions, 0 deletions
diff --git a/extensions/libip6t_DNAT.t b/extensions/libip6t_DNAT.t
index 3141c299..0ba96bfb 100644
--- a/extensions/libip6t_DNAT.t
+++ b/extensions/libip6t_DNAT.t
@@ -2,7 +2,9 @@
-j DNAT --to-destination dead::beef;=;OK
-j DNAT --to-destination dead::beef-dead::fee7;=;OK
+-j DNAT --to-destination [dead::beef]:1025-65535;;FAIL
-p tcp -j DNAT --to-destination [dead::beef]:1025-65535;=;OK
-p tcp -j DNAT --to-destination [dead::beef-dead::fee7]:1025-65535;=;OK
-p tcp -j DNAT --to-destination [dead::beef-dead::fee7]:1025-65536;;FAIL
+-p tcp -j DNAT --to-destination [dead::beef-dead::fee7]:1025-65535 --to-destination [dead::beef-dead::fee8]:1025-65535;;FAIL