alex@xxxxxxxx wrote: > Hy i'm trying to add a rule in firewall but i receive this error: > > iptables v1.4.2: conntrack: Bad value for "--expires" option: "1:1000" > Try `iptables -h' or 'iptables --help' for more information. > iptables v1.4.2: conntrack: Bad value for "--expires" option: "1:1000" > Try `iptables -h' or 'iptables --help' for more information. > > The lines that i want to add are: > $IPTABLES -A RST_LOOP_OUT -d $IP_LOOP -p tcp --sport $PORT_LOOP > --tcp-flags ALL PSH,ACK -m conntrack --ctexpire 1:1000 -j REJECT > --reject-with tcp-reset > > $IPTABLES -A RST_LOOP_OUT -d $IP_LOOP -p tcp --sport $PORT_LOOP > --tcp-flags ALL FIN,PSH,ACK -j REJECT -m conntrack --ctexpire 1:1000 > --reject-with tcp-reset > > If i give a single value to --ctexpire it works (ex: --ctexpire 1 ) I've > searched on google a lot of days but without any result. could you help > me? Thank's Does this patch help?
diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c index d30871f..5ca734d 100644 --- a/extensions/libxt_conntrack.c +++ b/extensions/libxt_conntrack.c @@ -273,7 +273,7 @@ conntrack_ps_expires(struct xt_conntrack_mtinfo2 *info, const char *s) xtables_param_act(XTF_BAD_VALUE, "conntrack", "--expires", s); max = min; if (*end == ':') - if (!xtables_strtoui(s, &end, &max, 0, UINT32_MAX)) + if (!xtables_strtoui(end + 1, &end, &max, 0, UINT32_MAX)) xtables_param_act(XTF_BAD_VALUE, "conntrack", "--expires", s); if (*end != '\0') xtables_param_act(XTF_BAD_VALUE, "conntrack", "--expires", s);
