Skip to contentSkip to conversation

multiport does not support invert

PATCH In review Phil Oester 2 participants 2 messages Sep 17, 2004 – Sep 18, 2004 netfilter

lore
Share & tools
lore

Phil Oester

author
#0 lore raw

PATCH 1/1 multiport does not support invert

A few weeks back I submitted a patch to document the invert option of multiport, without noticing that it doesn't actually support invert. I've looked at it, and it is a compatibility nightmare to try to add support for it while still supporting old kernel/userspace.

So, here's a patch to throw an error on this:

    iptables -A FORWARD -m multiport -p tcp ! --dport 1,2,3 -j DROP

instead of silently accepting it and potentially causing issues.

Phil

extensions/libip6t_multiport.c +7 -0
diff -ru ipt-orig/extensions/libip6t_multiport.c ipt-new/extensions/libip6t_multiport.c
@@ -115,6 +115,7 @@
 		proto = check_proto(entry);
 		multiinfo->count = parse_multi_ports(argv[optind-1],
 						     multiinfo->ports, proto);
+		check_inverse(optarg, &invert, &optind, 0);
 		multiinfo->flags = IP6T_MULTIPORT_SOURCE;
 		*nfcache |= NFC_IP6_SRC_PT;
 		break;

@@ -123,6 +124,7 @@
 		proto = check_proto(entry);
 		multiinfo->count = parse_multi_ports(argv[optind-1],
 						     multiinfo->ports, proto);
+		check_inverse(optarg, &invert, &optind, 0);
 		multiinfo->flags = IP6T_MULTIPORT_DESTINATION;
 		*nfcache |= NFC_IP6_DST_PT;
 		break;

@@ -131,6 +133,7 @@
 		proto = check_proto(entry);
 		multiinfo->count = parse_multi_ports(argv[optind-1],
 						     multiinfo->ports, proto);
+		check_inverse(optarg, &invert, &optind, 0);
 		multiinfo->flags = IP6T_MULTIPORT_EITHER;
 		*nfcache |= NFC_IP6_SRC_PT | NFC_IP6_DST_PT;
 		break;

@@ -139,6 +142,10 @@
 		return 0;
 	}
 
+	if (invert)
+		exit_error(PARAMETER_PROBLEM,
+			   "multiport does not support invert");
+
 	if (*flags)
 		exit_error(PARAMETER_PROBLEM,
 			   "multiport can only have one option");
extensions/libipt_mport.c +7 -0
diff -ru ipt-orig/extensions/libipt_mport.c ipt-new/extensions/libipt_mport.c
@@ -139,6 +139,7 @@
 		proto = check_proto(entry);
 		parse_multi_ports(argv[optind-1], minfo, proto);
 		minfo->flags = IPT_MPORT_SOURCE;
+		check_inverse(optarg, &invert, &optind, 0);
 		*nfcache |= NFC_IP_SRC_PT;
 		break;
 

@@ -146,6 +147,7 @@
 		proto = check_proto(entry);
 		parse_multi_ports(argv[optind-1], minfo, proto);
 		minfo->flags = IPT_MPORT_DESTINATION;
+		check_inverse(optarg, &invert, &optind, 0);
 		*nfcache |= NFC_IP_DST_PT;
 		break;
 

@@ -153,6 +155,7 @@
 		proto = check_proto(entry);
 		parse_multi_ports(argv[optind-1], minfo, proto);
 		minfo->flags = IPT_MPORT_EITHER;
+		check_inverse(optarg, &invert, &optind, 0);
 		*nfcache |= NFC_IP_SRC_PT | NFC_IP_DST_PT;
 		break;
 

@@ -160,6 +163,10 @@
 		return 0;
 	}
 
+	if (invert)
+		exit_error(PARAMETER_PROBLEM,
+			   "multiport does not support invert");
+
 	if (*flags)
 		exit_error(PARAMETER_PROBLEM,
 			   "multiport can only have one option");
extensions/libipt_multiport.c +7 -0
diff -ru ipt-orig/extensions/libipt_multiport.c ipt-new/extensions/libipt_multiport.c
@@ -115,6 +115,7 @@
 		proto = check_proto(entry);
 		multiinfo->count = parse_multi_ports(argv[optind-1],
 						     multiinfo->ports, proto);
+		check_inverse(optarg, &invert, &optind, 0);
 		multiinfo->flags = IPT_MULTIPORT_SOURCE;
 		*nfcache |= NFC_IP_SRC_PT;
 		break;

@@ -123,6 +124,7 @@
 		proto = check_proto(entry);
 		multiinfo->count = parse_multi_ports(argv[optind-1],
 						     multiinfo->ports, proto);
+		check_inverse(optarg, &invert, &optind, 0);
 		multiinfo->flags = IPT_MULTIPORT_DESTINATION;
 		*nfcache |= NFC_IP_DST_PT;
 		break;

@@ -131,6 +133,7 @@
 		proto = check_proto(entry);
 		multiinfo->count = parse_multi_ports(argv[optind-1],
 						     multiinfo->ports, proto);
+		check_inverse(optarg, &invert, &optind, 0);
 		multiinfo->flags = IPT_MULTIPORT_EITHER;
 		*nfcache |= NFC_IP_SRC_PT | NFC_IP_DST_PT;
 		break;

@@ -139,6 +142,10 @@
 		return 0;
 	}
 
+	if (invert)
+		exit_error(PARAMETER_PROBLEM,
+			   "multiport does not support invert");
+
 	if (*flags)
 		exit_error(PARAMETER_PROBLEM,
 			   "multiport can only have one option");
#1 lore raw
Quoted 11 lines · Phil Oester

A few weeks back I submitted a patch to document the invert option of multiport, without noticing that it doesn't actually support invert. I've looked at it, and it is a compatibility nightmare to try to add support for it while still supporting old kernel/userspace.

So, here's a patch to throw an error on this:

   iptables -A FORWARD -m multiport -p tcp ! --dport 1,2,3 -j DROP

instead of silently accepting it and potentially causing issues.

Thanks, but your patch doesn't catch all cases:

# iptables -p tcp -m multiport ! --port 1
iptables v1.3.0: multiport does not support invert
Try `iptables -h' or 'iptables --help' for more information.
# iptables -p tcp -m multiport --port ! 1
iptables v1.3.0: invalid port/service `!' specified
Try `iptables -h' or 'iptables --help' for more information.

I've applied this patch, which gives:

# iptables -p tcp -m multiport ! --port 1
iptables v1.3.0: multiport does not support invert
Try `iptables -h' or 'iptables --help' for more information.
# iptables -p tcp -m multiport --port ! 1
iptables v1.3.0: multiport does not support invert
Try `iptables -h' or 'iptables --help' for more information.

Regards
Patrick

Index: extensions/libip6t_multiport.c
===================================================================
RCS file: /cvsroot/iptables/extensions/libip6t_multiport.c,v retrieving revision 1.5

libip6t_multiport.c +7 -0
diff -u -r1.5 libip6t_multiport.c
@@ -112,6 +112,7 @@
 
 	switch (c) {
 	case '1':
+		check_inverse(argv[optind-1], &invert, &optind, 0);
 		proto = check_proto(entry);
 		multiinfo->count = parse_multi_ports(argv[optind-1],
 						     multiinfo->ports, proto);

@@ -120,6 +121,7 @@
 		break;
 
 	case '2':
+		check_inverse(argv[optind-1], &invert, &optind, 0);
 		proto = check_proto(entry);
 		multiinfo->count = parse_multi_ports(argv[optind-1],
 						     multiinfo->ports, proto);

@@ -128,6 +130,7 @@
 		break;
 
 	case '3':
+		check_inverse(argv[optind-1], &invert, &optind, 0);
 		proto = check_proto(entry);
 		multiinfo->count = parse_multi_ports(argv[optind-1],
 						     multiinfo->ports, proto);

@@ -138,6 +141,10 @@
 	default:
 		return 0;
 	}
+
+	if (invert)
+		exit_error(PARAMETER_PROBLEM,
+			   "multiport does not support invert");
 
 	if (*flags)
 		exit_error(PARAMETER_PROBLEM,

Index: extensions/libipt_mport.c
===================================================================
RCS file: /cvsroot/iptables/extensions/libipt_mport.c,v retrieving revision 1.6

libipt_mport.c +7 -0
diff -u -r1.6 libipt_mport.c
@@ -136,6 +136,7 @@
 
 	switch (c) {
 	case '1':
+		check_inverse(argv[optind-1], &invert, &optind, 0);
 		proto = check_proto(entry);
 		parse_multi_ports(argv[optind-1], minfo, proto);
 		minfo->flags = IPT_MPORT_SOURCE;

@@ -143,6 +144,7 @@
 		break;
 
 	case '2':
+		check_inverse(argv[optind-1], &invert, &optind, 0);
 		proto = check_proto(entry);
 		parse_multi_ports(argv[optind-1], minfo, proto);
 		minfo->flags = IPT_MPORT_DESTINATION;

@@ -150,6 +152,7 @@
 		break;
 
 	case '3':
+		check_inverse(argv[optind-1], &invert, &optind, 0);
 		proto = check_proto(entry);
 		parse_multi_ports(argv[optind-1], minfo, proto);
 		minfo->flags = IPT_MPORT_EITHER;

@@ -159,6 +162,10 @@
 	default:
 		return 0;
 	}
+
+	if (invert)
+		exit_error(PARAMETER_PROBLEM,
+			   "multiport does not support invert");
 
 	if (*flags)
 		exit_error(PARAMETER_PROBLEM,

Index: extensions/libipt_multiport.c
===================================================================
RCS file: /cvsroot/iptables/extensions/libipt_multiport.c,v retrieving revision 1.7

libipt_multiport.c +7 -0
diff -u -r1.7 libipt_multiport.c
@@ -112,6 +112,7 @@
 
 	switch (c) {
 	case '1':
+		check_inverse(argv[optind-1], &invert, &optind, 0);
 		proto = check_proto(entry);
 		multiinfo->count = parse_multi_ports(argv[optind-1],
 						     multiinfo->ports, proto);

@@ -120,6 +121,7 @@
 		break;
 
 	case '2':
+		check_inverse(argv[optind-1], &invert, &optind, 0);
 		proto = check_proto(entry);
 		multiinfo->count = parse_multi_ports(argv[optind-1],
 						     multiinfo->ports, proto);

@@ -128,6 +130,7 @@
 		break;
 
 	case '3':
+		check_inverse(argv[optind-1], &invert, &optind, 0);
 		proto = check_proto(entry);
 		multiinfo->count = parse_multi_ports(argv[optind-1],
 						     multiinfo->ports, proto);

@@ -138,6 +141,10 @@
 	default:
 		return 0;
 	}
+
+	if (invert)
+		exit_error(PARAMETER_PROBLEM,
+			   "multiport does not support invert");
 
 	if (*flags)
 		exit_error(PARAMETER_PROBLEM,