checking rule specifications in a match

checking rule specifications in a match

[Björn Lindström]

Hi.
I am writing an iptables match to match the IEC-60870-5-104 protocol.
I only want this match to be used on tcp packets and therefore I want 
iptables to reject rules if does not specify tcp as the protocol (-p 
tcp). I am currently doing this check in the checkentry function in the 
kernel module. This works but the error message only say "iptables: 
Unknown error 4294967295" if -p tcp is left out. Is it possible to do 
this check any other way to get a more comprehensible error message?
Thanks.
Björn Lindström

Re: checking rule specifications in a match

[Patrick McHardy]

Björn Lindström wrote:
> Hi.
> I am writing an iptables match to match the IEC-60870-5-104 protocol.
> I only want this match to be used on tcp packets and therefore I want
> iptables to reject rules if does not specify tcp as the protocol (-p
> tcp). I am currently doing this check in the checkentry function in the
> kernel module. This works but the error message only say "iptables:
> Unknown error 4294967295" if -p tcp is left out. Is it possible to do
> this check any other way to get a more comprehensible error message?

This is probably because you're using a broken version of iptables
userspace. Current kernels allow you to enforce a specific protocol
by setting the .proto field in struct xt_match, which will also handle
inversion correctly and logs a message to the ringbuffer on error.