Skip to contentSkip to conversation

DNAT/SNAT port range must use dash

PATCH Applied Phil Oester 2 participants 2 messages Jan 17, 2005 – Feb 1, 2005 netfilter

lore
Share & tools
lore

Phil Oester

author
#0 lore raw

PATCH 1/1 DNAT/SNAT port range must use dash

John McCann points out via bugzilla that iptables happily accepts this syntax on DNAT/SNAT:

	--to x.x.x.x:y:z

but doesn't actually make use of the second port. Clear up the confusion by only accepting a dash between the ports.

This closes bugzilla #265.

Phil

Signed-off-by Phil Oester <[email protected]>
extensions/libipt_DNAT.c +6 -1
diff -ru iptables-orig/extensions/libipt_DNAT.c iptables-new/extensions/libipt_DNAT.c
@@ -65,7 +65,7 @@
 parse_to(char *arg, int portok, struct ipt_natinfo *info)
 {
 	struct ip_nat_range range;
-	char *colon, *dash;
+	char *colon, *dash, *error;
 	struct in_addr *ip;
 
 	memset(&range, 0, sizeof(range));

@@ -85,6 +85,11 @@
 			exit_error(PARAMETER_PROBLEM,
 				   "Port `%s' not valid\n", colon+1);
 
+		error = strchr(colon+1, ':');
+		if (error)
+			exit_error(PARAMETER_PROBLEM,
+				   "Invalid port:port syntax - use dash\n");
+
 		dash = strchr(colon, '-');
 		if (!dash) {
 			range.min.tcp.port
extensions/libipt_SNAT.c +6 -1
diff -ru iptables-orig/extensions/libipt_SNAT.c iptables-new/extensions/libipt_SNAT.c
@@ -65,7 +65,7 @@
 parse_to(char *arg, int portok, struct ipt_natinfo *info)
 {
 	struct ip_nat_range range;
-	char *colon, *dash;
+	char *colon, *dash, *error;
 	struct in_addr *ip;
 
 	memset(&range, 0, sizeof(range));

@@ -85,6 +85,11 @@
 			exit_error(PARAMETER_PROBLEM,
 				   "Port `%s' not valid\n", colon+1);
 
+		error = strchr(colon+1, ':');
+		if (error)
+			exit_error(PARAMETER_PROBLEM,
+				   "Invalid port:port syntax - use dash\n");
+
 		dash = strchr(colon, '-');
 		if (!dash) {
 			range.min.tcp.port
Applied
#1 lore raw
Quoted 1 line · Phil Oester

This closes bugzilla #265.

thanks, applied.

Quoted 1 line

Phil

Signature · 5 lines
- Harald Welte <[email protected]>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie