Op 16/01/2018 om 16:24 schreef Pablo Neira Ayuso: > On Tue, Jan 16, 2018 at 04:23:20PM +0100, Pablo Neira Ayuso wrote: >> On Tue, Jan 16, 2018 at 04:20:40PM +0100, Thierry Du Tre wrote: >>> Op 16/01/2018 om 16:06 schreef Thierry Du Tre: >>>> Op 16/01/2018 om 14:06 schreef Pablo Neira Ayuso: >>>>> Hi Thierry, >>>>> >>>>> On Tue, Jan 16, 2018 at 01:44:37PM +0100, Thierry Du Tre wrote: >>>>>> This patch is fixing the detection of multiple '--to-destination' in a DNAT rule and '--to-source' in SNAT rule for IPv6. >>>>>> Currently, when defining multiple values for these, only the last will be used and others ignored silently. >>>>>> >>>>>> The checks for (cb->xflags & F_X_TO_[DEST/SRC]) always fails because the flags are never set before. >>>>>> It seems to be a copy-paste artefact since introduction of the IPv6 DNAT/SNAT extensions based on IPv4 code. >>>>>> >>>>>> I also removed the kernel_version checks because they seem useless. Extensions for IPv6 DNAT/SNAT are using xt_target with revision 1. >>>>>> That seems only added since kernel version 3.7-rc1 and therefore the check for > v2.6.10 will always return true. >>>>>> The check is probably also coming from the IPv4 copy-paste. >>>>> >>>>> Thanks for fixing up this. >>>>> >>>>> Would you also send us a patch to add tests: >>>>> >>>>> extensions/libip6t_DNAT.t >>>>> >>>> >>>> The following should cover this patch. >>>> (without patch, libip6t_SNAT.t and libip6t_DNAT.t will fail) >>> >>> Added another test + fixed typo (too late) >> >> No problem, send a follow up patch with more tests. > > BTW, the new patch to add more tests needs to go on top of your > previous patch. I hope this works : --- extensions/libip6t_DNAT.t | 1 + extensions/libip6t_SNAT.t | 1 + extensions/libipt_DNAT.t | 1 + extensions/libipt_SNAT.t | 1 + 4 files changed, 4 insertions(+) diff --git a/extensions/libip6t_DNAT.t b/extensions/libip6t_DNAT.t index 0ba96bf..6d8f1da 100644 --- a/extensions/libip6t_DNAT.t +++ b/extensions/libip6t_DNAT.t @@ -3,6 +3,7 @@ -j DNAT --to-destination dead::beef;=;OK -j DNAT --to-destination dead::beef-dead::fee7;=;OK -j DNAT --to-destination [dead::beef]:1025-65535;;FAIL +-j DNAT --to-destination [dead::beef] --to-destination [dead::fee7];;FAIL -p tcp -j DNAT --to-destination [dead::beef]:1025-65535;=;OK -p tcp -j DNAT --to-destination [dead::beef-dead::fee7]:1025-65535;=;OK -p tcp -j DNAT --to-destination [dead::beef-dead::fee7]:1025-65536;;FAIL diff --git a/extensions/libip6t_SNAT.t b/extensions/libip6t_SNAT.t index 0f14894..d188a6b 100644 --- a/extensions/libip6t_SNAT.t +++ b/extensions/libip6t_SNAT.t @@ -3,6 +3,7 @@ -j SNAT --to-source dead::beef;=;OK -j SNAT --to-source dead::beef-dead::fee7;=;OK -j SNAT --to-source [dead::beef]:1025-65535;;FAIL +-j SNAT --to-source [dead::beef] --to-source [dead::fee7];;FAIL -p tcp -j SNAT --to-source [dead::beef]:1025-65535;=;OK -p tcp -j SNAT --to-source [dead::beef-dead::fee7]:1025-65535;=;OK -p tcp -j SNAT --to-source [dead::beef-dead::fee7]:1025-65536;;FAIL diff --git a/extensions/libipt_DNAT.t b/extensions/libipt_DNAT.t index a7a45e9..1959801 100644 --- a/extensions/libipt_DNAT.t +++ b/extensions/libipt_DNAT.t @@ -3,6 +3,7 @@ -j DNAT --to-destination 1.1.1.1;=;OK -j DNAT --to-destination 1.1.1.1-1.1.1.10;=;OK -j DNAT --to-destination 1.1.1.1:1025-65535;;FAIL +-j DNAT --to-destination 1.1.1.1 --to-destination 2.2.2.2;;FAIL -p tcp -j DNAT --to-destination 1.1.1.1:1025-65535;=;OK -p tcp -j DNAT --to-destination 1.1.1.1-1.1.1.10:1025-65535;=;OK -p tcp -j DNAT --to-destination 1.1.1.1-1.1.1.10:1025-65536;;FAIL diff --git a/extensions/libipt_SNAT.t b/extensions/libipt_SNAT.t index 34c5822..186e1cb 100644 --- a/extensions/libipt_SNAT.t +++ b/extensions/libipt_SNAT.t @@ -3,6 +3,7 @@ -j SNAT --to-source 1.1.1.1;=;OK -j SNAT --to-source 1.1.1.1-1.1.1.10;=;OK -j SNAT --to-source 1.1.1.1:1025-65535;;FAIL +-j SNAT --to-source 1.1.1.1 --to-source 2.2.2.2;;FAIL -p tcp -j SNAT --to-source 1.1.1.1:1025-65535;=;OK -p tcp -j SNAT --to-source 1.1.1.1-1.1.1.10:1025-65535;=;OK -p tcp -j SNAT --to-source 1.1.1.1-1.1.1.10:1025-65536;;FAIL -- 2.7.4 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
