* [PATCH] iptables: allow service names in [DS]NAT targets
@ 2013-06-27 15:54 Phil Oester
2013-07-08 3:16 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Phil Oester @ 2013-06-27 15:54 UTC (permalink / raw)
To: netfilter-devel; +Cc: pablo
[-- Attachment #1: Type: text/plain, Size: 342 bytes --]
As reported by Alexander Hoogerhuis, the [DS]NAT targets do not allow use of
service names in the --to argument. The same problem was fixed in the REDIRECT
target in commit 84d758b3 ("extensions: REDIRECT: fix --to-ports parser").
Use a similar fix here.
This closes bugzilla #514.
Phil
Signed-off-by: Phil Oester <kernel@linuxace.com>
[-- Attachment #2: patch-514 --]
[-- Type: text/plain, Size: 4584 bytes --]
diff --git a/extensions/libipt_DNAT.c b/extensions/libipt_DNAT.c
index ff18799..e452cfc 100644
--- a/extensions/libipt_DNAT.c
+++ b/extensions/libipt_DNAT.c
@@ -67,7 +67,7 @@ static struct xt_entry_target *
parse_to(const char *orig_arg, int portok, struct ipt_natinfo *info)
{
struct nf_nat_ipv4_range range;
- char *arg, *colon, *dash, *error;
+ char *arg, *colon, *dash;
const struct in_addr *ip;
arg = strdup(orig_arg);
@@ -77,7 +77,8 @@ parse_to(const char *orig_arg, int portok, struct ipt_natinfo *info)
colon = strchr(arg, ':');
if (colon) {
- int port;
+ char *end = "";
+ unsigned int port, maxport;
if (!portok)
xtables_error(PARAMETER_PROBLEM,
@@ -85,34 +86,29 @@ parse_to(const char *orig_arg, int portok, struct ipt_natinfo *info)
range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
- port = atoi(colon+1);
- if (port <= 0 || port > 65535)
- xtables_error(PARAMETER_PROBLEM,
- "Port `%s' not valid\n", colon+1);
-
- error = strchr(colon+1, ':');
- if (error)
- xtables_error(PARAMETER_PROBLEM,
- "Invalid port:port syntax - use dash\n");
+ if (!xtables_strtoui(colon + 1, &end, &port, 0, UINT16_MAX) &&
+ (port = xtables_service_to_port(colon + 1, NULL)) == (unsigned)-1)
+ xtables_param_act(XTF_BAD_VALUE, "DNAT", "--to", arg);
- dash = strchr(colon, '-');
- if (!dash) {
+ switch (*end) {
+ case '\0':
range.min.tcp.port
= range.max.tcp.port
= htons(port);
- } else {
- int maxport;
+ break;
+ case '-':
+ if (!xtables_strtoui(end + 1, NULL, &maxport, 0, UINT16_MAX) &&
+ (maxport = xtables_service_to_port(end + 1, NULL)) == (unsigned)-1)
+ xtables_param_act(XTF_BAD_VALUE, "DNAT", "--to", arg);
- maxport = atoi(dash + 1);
- if (maxport <= 0 || maxport > 65535)
- xtables_error(PARAMETER_PROBLEM,
- "Port `%s' not valid\n", dash+1);
if (maxport < port)
- /* People are stupid. */
- xtables_error(PARAMETER_PROBLEM,
- "Port range `%s' funky\n", colon+1);
+ xtables_param_act(XTF_BAD_VALUE, "DNAT", "--to", arg);
+
range.min.tcp.port = htons(port);
range.max.tcp.port = htons(maxport);
+ break;
+ default:
+ xtables_param_act(XTF_BAD_VALUE, "DNAT", "--to", arg);
}
/* Starts with a colon? No IP info...*/
if (colon == arg) {
diff --git a/extensions/libipt_SNAT.c b/extensions/libipt_SNAT.c
index 1a24f3d..01be677 100644
--- a/extensions/libipt_SNAT.c
+++ b/extensions/libipt_SNAT.c
@@ -67,7 +67,7 @@ static struct xt_entry_target *
parse_to(const char *orig_arg, int portok, struct ipt_natinfo *info)
{
struct nf_nat_ipv4_range range;
- char *arg, *colon, *dash, *error;
+ char *arg, *colon, *dash;
const struct in_addr *ip;
arg = strdup(orig_arg);
@@ -77,7 +77,8 @@ parse_to(const char *orig_arg, int portok, struct ipt_natinfo *info)
colon = strchr(arg, ':');
if (colon) {
- int port;
+ char *end = "";
+ unsigned int port, maxport;
if (!portok)
xtables_error(PARAMETER_PROBLEM,
@@ -85,34 +86,29 @@ parse_to(const char *orig_arg, int portok, struct ipt_natinfo *info)
range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
- port = atoi(colon+1);
- if (port <= 0 || port > 65535)
- xtables_error(PARAMETER_PROBLEM,
- "Port `%s' not valid\n", colon+1);
-
- error = strchr(colon+1, ':');
- if (error)
- xtables_error(PARAMETER_PROBLEM,
- "Invalid port:port syntax - use dash\n");
+ if (!xtables_strtoui(colon + 1, &end, &port, 0, UINT16_MAX) &&
+ (port = xtables_service_to_port(colon + 1, NULL)) == (unsigned)-1)
+ xtables_param_act(XTF_BAD_VALUE, "SNAT", "--to", arg);
- dash = strchr(colon, '-');
- if (!dash) {
+ switch (*end) {
+ case '\0':
range.min.tcp.port
= range.max.tcp.port
= htons(port);
- } else {
- int maxport;
+ break;
+ case '-':
+ if (!xtables_strtoui(end + 1, NULL, &maxport, 0, UINT16_MAX) &&
+ (maxport = xtables_service_to_port(end + 1, NULL)) == (unsigned)-1)
+ xtables_param_act(XTF_BAD_VALUE, "SNAT", "--to", arg);
- maxport = atoi(dash + 1);
- if (maxport <= 0 || maxport > 65535)
- xtables_error(PARAMETER_PROBLEM,
- "Port `%s' not valid\n", dash+1);
if (maxport < port)
- /* People are stupid. */
- xtables_error(PARAMETER_PROBLEM,
- "Port range `%s' funky\n", colon+1);
+ xtables_param_act(XTF_BAD_VALUE, "SNAT", "--to", arg);
+
range.min.tcp.port = htons(port);
range.max.tcp.port = htons(maxport);
+ break;
+ default:
+ xtables_param_act(XTF_BAD_VALUE, "SNAT", "--to", arg);
}
/* Starts with a colon? No IP info...*/
if (colon == arg) {
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] iptables: allow service names in [DS]NAT targets
2013-06-27 15:54 [PATCH] iptables: allow service names in [DS]NAT targets Phil Oester
@ 2013-07-08 3:16 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2013-07-08 3:16 UTC (permalink / raw)
To: Phil Oester; +Cc: netfilter-devel
On Thu, Jun 27, 2013 at 11:54:09AM -0400, Phil Oester wrote:
> As reported by Alexander Hoogerhuis, the [DS]NAT targets do not allow use of
> service names in the --to argument. The same problem was fixed in the REDIRECT
> target in commit 84d758b3 ("extensions: REDIRECT: fix --to-ports parser").
> Use a similar fix here.
We also have libip6t_SNAT and libip6t_DNAT these days. Can you rework
the patch to support that there as well? Thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-07-08 3:17 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-06-27 15:54 [PATCH] iptables: allow service names in [DS]NAT targets Phil Oester
2013-07-08 3:16 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.