summaryrefslogtreecommitdiffstats
path: root/extensions
diff options
context:
space:
mode:
authorTom Eastep <teastep@shorewall.net>2011-08-18 15:11:16 -0700
committerJan Engelhardt <jengelh@medozas.de>2011-08-27 18:36:19 +0200
commit3412bd0bfb8b8bac9834cbfd3392b3d5487133bf (patch)
tree8c95893d0b46454679727cf0d4f43a24c5663982 /extensions
parentfdb2a27825e558393fb715374c07873830d4d149 (diff)
libxt_conntrack: improve error message on parsing violation
Tom Eastep noted: $ iptables -A foo -m conntrack --ctorigdstport 22 iptables v1.4.12: conntrack rev 2 does not support port ranges Try `iptables -h' or 'iptables --help' for more information. Commit v1.4.12-41-g1ad6407 takes care of the actual cause of the bug, but let's include Tom's patch nevertheless for the better error message in case one actually does specify a range with rev 2. References: http://marc.info/?l=netfilter-devel&m=131370592105298&w=2 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Diffstat (limited to 'extensions')
-rw-r--r--extensions/libxt_conntrack.c15
1 files changed, 11 insertions, 4 deletions
diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
index 060b9477..fff69f8a 100644
--- a/extensions/libxt_conntrack.c
+++ b/extensions/libxt_conntrack.c
@@ -129,13 +129,20 @@ static const struct xt_option_entry conntrack2_mt_opts[] = {
.flags = XTOPT_INVERT},
{.name = "ctexpire", .id = O_CTEXPIRE, .type = XTTYPE_UINT32RC,
.flags = XTOPT_INVERT},
- {.name = "ctorigsrcport", .id = O_CTORIGSRCPORT, .type = XTTYPE_PORT,
+ /*
+ * Rev 1 and 2 only store one port, and we would normally use
+ * %XTTYPE_PORT (rather than %XTTYPE_PORTRC) for that. The resulting
+ * error message - in case a user passed a range nevertheless -
+ * "port 22:23 resolved to nothing" is not quite as useful as using
+ * %XTTYPE_PORTC and libxt_conntrack's own range test.
+ */
+ {.name = "ctorigsrcport", .id = O_CTORIGSRCPORT, .type = XTTYPE_PORTRC,
.flags = XTOPT_INVERT | XTOPT_NBO},
- {.name = "ctorigdstport", .id = O_CTORIGDSTPORT, .type = XTTYPE_PORT,
+ {.name = "ctorigdstport", .id = O_CTORIGDSTPORT, .type = XTTYPE_PORTRC,
.flags = XTOPT_INVERT | XTOPT_NBO},
- {.name = "ctreplsrcport", .id = O_CTREPLSRCPORT, .type = XTTYPE_PORT,
+ {.name = "ctreplsrcport", .id = O_CTREPLSRCPORT, .type = XTTYPE_PORTRC,
.flags = XTOPT_INVERT | XTOPT_NBO},
- {.name = "ctrepldstport", .id = O_CTREPLDSTPORT, .type = XTTYPE_PORT,
+ {.name = "ctrepldstport", .id = O_CTREPLDSTPORT, .type = XTTYPE_PORTRC,
.flags = XTOPT_INVERT | XTOPT_NBO},
{.name = "ctdir", .id = O_CTDIR, .type = XTTYPE_STRING},
XTOPT_TABLEEND,