This just happened to be within my thoughts. Comments, declinations?
commit 344a4b52b8484460727ed605e042583dbc73ac83
Author: Jan Engelhardt <jengelh@xxxxxxxxxx>
Date: Thu Jul 3 19:06:22 2008 +0200
Reject use of DROP in nat table
Signed-off-by: Jan Engelhardt <jengelh@xxxxxxxxxx>
---
iptables.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/iptables.c b/iptables.c
index 41e1836..6e7242d 100644
--- a/iptables.c
+++ b/iptables.c
@@ -1917,6 +1917,12 @@ int do_command(int argc, char *argv[], char **table, iptc_handle_t *handle)
invert = FALSE;
}
+ if (strcmp(*table, "nat") == 0) {
+ if ((policy != NULL && strcmp(policy, "DROP") == 0) ||
+ (jumpto != NULL && strcmp(jumpto, "DROP") == 0))
+ exit_error(OTHER_PROBLEM, "The nat table is not for filtering");
+ }
+
for (matchp = matches; matchp; matchp = matchp->next)
if (matchp->match->final_check != NULL)
matchp->match->final_check(matchp->match->mflags);
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
