From 88fa4543f8085e52606c776d47e4420896dd561b Mon Sep 17 00:00:00 2001 From: Thierry Du Tre Date: Tue, 16 Jan 2018 13:44:37 +0100 Subject: extensions: ip6t_{S,D}NAT: multiple to-dst/to-src arguments not reported This patch is fixing the detection of multiple '--to-destination' in a DNAT rule and '--to-source' in SNAT rule for IPv6. Currently, when defining multiple values for these, only the last will be used and others ignored silently. The checks for (cb->xflags & F_X_TO_[DEST/SRC]) always fails because the flags are never set before. It seems to be a copy-paste artefact since introduction of the IPv6 DNAT/SNAT extensions based on IPv4 code. I also removed the kernel_version checks because they seem useless. Extensions for IPv6 DNAT/SNAT are using xt_target with revision 1. That seems only added since kernel version 3.7-rc1 and therefore the check for > v2.6.10 will always return true. The check is probably also coming from the IPv4 copy-paste. Add tests to cover this too, including the IPv4 side. Signed-off-by: Thierry Du Tre Signed-off-by: Pablo Neira Ayuso --- extensions/libip6t_SNAT.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'extensions/libip6t_SNAT.c') diff --git a/extensions/libip6t_SNAT.c b/extensions/libip6t_SNAT.c index 671ac61a..7d74b3d7 100644 --- a/extensions/libip6t_SNAT.c +++ b/extensions/libip6t_SNAT.c @@ -166,13 +166,11 @@ static void SNAT_parse(struct xt_option_call *cb) switch (cb->entry->id) { case O_TO_SRC: if (cb->xflags & F_X_TO_SRC) { - if (!kernel_version) - get_kernel_version(); - if (kernel_version > LINUX_VERSION(2, 6, 10)) - xtables_error(PARAMETER_PROBLEM, - "SNAT: Multiple --to-source not supported"); + xtables_error(PARAMETER_PROBLEM, + "SNAT: Multiple --to-source not supported"); } parse_to(cb->arg, portok, range); + cb->xflags |= F_X_TO_SRC; break; case O_PERSISTENT: range->flags |= NF_NAT_RANGE_PERSISTENT; -- cgit v1.2.3