port offset may be differ based on which layer 4 protocol , you are
using . If u dont specify protocol ( layer 4 ) , netfilter dont know
this .
Please find below some code sinppet from xt_multiport.c .
113 pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports);
114 if (pptr == NULL) {
115 /* We've been asked to examine this packet, and we
116 * can't. Hence, no choice but to drop.
117 */
118 duprintf("xt_multiport: Dropping evil offset=0
tinygram.\n");
119 *hotdrop = 1;
120 return 0;
121 }
122
123 return ports_match(multiinfo->ports,
124 multiinfo->flags, multiinfo->count,
125 ntohs(pptr[0]), ntohs(pptr[1]));
thanks,
Ratheesh
On Sat, Feb 27, 2010 at 9:47 PM, U. George <netbeans@xxxxxxxxxxxx> wrote:
> U'll have to let me know why "-p udp" is needed when the chain can only have
> udp packets, and therefor can only process udp packets.
>
> I dont want to test over (( and over ) and over ) again when I know that the
> packet is already KNOWN to be from eth1 and of protocol UDP.
>
> adding "-p UDP" to multiport does make iptables happy, but appears to be a
> useless test.
>
> On 02/27/2010 10:06 AM, ratheesh k wrote:
>>
>> Port is in Layer 4 of protocol stack .
>>
>>
>> On Sat, Feb 27, 2010 at 8:33 PM, U. George<netbeans@xxxxxxxxxxxx> wrote:
>>>
>>> In order to get to the chain, the protocol, as well as the interface must
>>> match. PRE_UDP if already filtered for "-p udp" . So why does multiport
>>> require another check for -p udp? Does it really need to have that option
>>> in
>>> order for it to work?
>>>
>>>> + /sbin/iptables -t filter -N PRE_UDP
>>>> + /sbin/iptables -t filter -A INPUT -i eth1 -p udp -j PRE_UDP
>>>> + /sbin/iptables -t filter -A PRE_UDP -m multiport --dport
>>>> 137,138,139,512,514,515,1433,1434 -j DROP
>>>> iptables v1.4.5: multiport needs `-p tcp', `-p udp', `-p udplite', `-p
>>>> sctp' or `-p dccp'
>>>> Try `iptables -h' or 'iptables --help' for more information.
>>>
>>>
>>>
>>> --
>>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>>> the body of a message to majordomo@xxxxxxxxxxxxxxx
>>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>> the body of a message to majordomo@xxxxxxxxxxxxxxx
>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>>
>>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
