[PATCH] ctproto printing in conntrack match (bug 398)

[PATCH] ctproto printing in conntrack match (bug 398)

[Phil Oester]

[-- Attachment #1: Type: text/plain, Size: 176 bytes --]

The conntrack match does not print any info for --ctproto, thus
breaking iptables-restore of any rules using this option.  Below
patch adds output and closes bug #398.

Phil



[-- Attachment #2: patch-ctproto --]
[-- Type: text/plain, Size: 618 bytes --]

diff -ru ipt-orig/extensions/libipt_conntrack.c ipt-new/extensions/libipt_conntrack.c
--- ipt-orig/extensions/libipt_conntrack.c	2005-10-31 11:03:50.000000000 -0800
+++ ipt-new/extensions/libipt_conntrack.c	2005-11-13 07:12:20.000000000 -0800
@@ -442,6 +442,13 @@
 		print_state(sinfo->statemask);
 	}
 
+	if(sinfo->flags & IPT_CONNTRACK_PROTO) {
+		printf("%sctproto ", optpfx);
+        	if (sinfo->invflags & IPT_CONNTRACK_PROTO)
+                	printf("! ");
+		printf("%u ", sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum);
+	}
+
 	if(sinfo->flags & IPT_CONNTRACK_ORIGSRC) {
 		printf("%sctorigsrc ", optpfx);
 

Re: [PATCH] ctproto printing in conntrack match (bug 398)

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 735 bytes --]

On Sun, Nov 13, 2005 at 07:18:58AM -0800, Phil Oester wrote:
> The conntrack match does not print any info for --ctproto, thus
> breaking iptables-restore of any rules using this option.  Below
> patch adds output and closes bug #398.

Thanks, Phil. Committed revision 4543.

Thanks also for your valuable work in hunting down bugzilla bugs in
general.

-- 
- Harald Welte <laforge@netfilter.org>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]