* [PATCH] ip6tables: Warn about use of DROP in nat table
@ 2016-06-10 12:57 Thomas Woerner
2016-06-15 12:28 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Thomas Woerner @ 2016-06-10 12:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: Thomas Woerner
Clone of 1eada72b with 9bb76094 and e0390bee on top.
Signed-off-by: Thomas Woerner <twoerner@redhat.com>
---
:100644 100644 2731209... c48ddf9... M iptables/ip6tables.c
iptables/ip6tables.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
index 2731209..c48ddf9 100644
--- a/iptables/ip6tables.c
+++ b/iptables/ip6tables.c
@@ -1720,6 +1720,13 @@ int do_command6(int argc, char *argv[], char **table,
cs.invert = FALSE;
}
+ if (strcmp(*table, "nat") == 0 &&
+ ((policy != NULL && strcmp(policy, "DROP") == 0) ||
+ (cs.jumpto != NULL && strcmp(cs.jumpto, "DROP") == 0)))
+ xtables_error(PARAMETER_PROBLEM,
+ "\nThe \"nat\" table is not intended for filtering, "
+ "the use of DROP is therefore inhibited.\n\n");
+
for (matchp = cs.matches; matchp; matchp = matchp->next)
xtables_option_mfcall(matchp->match);
if (cs.target != NULL)
--
2.5.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-06-15 12:28 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-06-10 12:57 [PATCH] ip6tables: Warn about use of DROP in nat table Thomas Woerner
2016-06-15 12:28 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).