On Tue, Jan 16, 2018 at 04:31:30PM +0100, Thierry Du Tre wrote: > Op 16/01/2018 om 16:24 schreef Pablo Neira Ayuso: > > On Tue, Jan 16, 2018 at 04:23:20PM +0100, Pablo Neira Ayuso wrote: > >> On Tue, Jan 16, 2018 at 04:20:40PM +0100, Thierry Du Tre wrote: > >>> Op 16/01/2018 om 16:06 schreef Thierry Du Tre: > >>>> Op 16/01/2018 om 14:06 schreef Pablo Neira Ayuso: > >>>>> Hi Thierry, > >>>>> > >>>>> On Tue, Jan 16, 2018 at 01:44:37PM +0100, Thierry Du Tre wrote: > >>>>>> This patch is fixing the detection of multiple '--to-destination' in a DNAT rule and '--to-source' in SNAT rule for IPv6. > >>>>>> Currently, when defining multiple values for these, only the last will be used and others ignored silently. > >>>>>> > >>>>>> The checks for (cb->xflags & F_X_TO_[DEST/SRC]) always fails because the flags are never set before. > >>>>>> It seems to be a copy-paste artefact since introduction of the IPv6 DNAT/SNAT extensions based on IPv4 code. > >>>>>> > >>>>>> I also removed the kernel_version checks because they seem useless. Extensions for IPv6 DNAT/SNAT are using xt_target with revision 1. > >>>>>> That seems only added since kernel version 3.7-rc1 and therefore the check for > v2.6.10 will always return true. > >>>>>> The check is probably also coming from the IPv4 copy-paste. > >>>>> > >>>>> Thanks for fixing up this. > >>>>> > >>>>> Would you also send us a patch to add tests: > >>>>> > >>>>> extensions/libip6t_DNAT.t > >>>>> > >>>> > >>>> The following should cover this patch. > >>>> (without patch, libip6t_SNAT.t and libip6t_DNAT.t will fail) > >>> > >>> Added another test + fixed typo (too late) > >> > >> No problem, send a follow up patch with more tests. > > > > BTW, the new patch to add more tests needs to go on top of your > > previous patch. > > I hope this works : > > --- > extensions/libip6t_DNAT.t | 1 + > extensions/libip6t_SNAT.t | 1 + > extensions/libipt_DNAT.t | 1 + > extensions/libipt_SNAT.t | 1 + > 4 files changed, 4 insertions(+) Applied, thanks. Please, always send me patches in git-format-patch next time, thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
