[Fwd: Re: [netfilter-core] Bug on conntrack?]

[Fwd: Re: [netfilter-core] Bug on conntrack?]

[alex]

 Hy i'm trying to add a rule in firewall but i receive this error:

 iptables v1.4.2: conntrack: Bad value for "--expires" option: "1:1000"
 Try `iptables -h' or 'iptables --help' for more information.
 iptables v1.4.2: conntrack: Bad value for "--expires" option: "1:1000"
 Try `iptables -h' or 'iptables --help' for more information.

 The lines that i want to add are:
 $IPTABLES -A RST_LOOP_OUT -d $IP_LOOP -p tcp --sport $PORT_LOOP
--tcp-flags ALL PSH,ACK -m conntrack --ctexpire 1:1000 -j REJECT
--reject-with tcp-reset

 $IPTABLES -A RST_LOOP_OUT -d $IP_LOOP -p tcp --sport $PORT_LOOP
--tcp-flags ALL FIN,PSH,ACK -j REJECT -m conntrack --ctexpire 1:1000
--reject-with tcp-reset

 If  i give a single value to --ctexpire it works (ex: --ctexpire 1 ) I've
searched on google a lot of days but without any result. could you help
me? Thank's

Re: [Fwd: Re: [netfilter-core] Bug on conntrack?]

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 928 bytes --]

alex@dhost.ro wrote:
>  Hy i'm trying to add a rule in firewall but i receive this error:
> 
>  iptables v1.4.2: conntrack: Bad value for "--expires" option: "1:1000"
>  Try `iptables -h' or 'iptables --help' for more information.
>  iptables v1.4.2: conntrack: Bad value for "--expires" option: "1:1000"
>  Try `iptables -h' or 'iptables --help' for more information.
> 
>  The lines that i want to add are:
>  $IPTABLES -A RST_LOOP_OUT -d $IP_LOOP -p tcp --sport $PORT_LOOP
> --tcp-flags ALL PSH,ACK -m conntrack --ctexpire 1:1000 -j REJECT
> --reject-with tcp-reset
> 
>  $IPTABLES -A RST_LOOP_OUT -d $IP_LOOP -p tcp --sport $PORT_LOOP
> --tcp-flags ALL FIN,PSH,ACK -j REJECT -m conntrack --ctexpire 1:1000
> --reject-with tcp-reset
> 
>  If  i give a single value to --ctexpire it works (ex: --ctexpire 1 ) I've
> searched on google a lot of days but without any result. could you help
> me? Thank's

Does this patch help?


[-- Attachment #2: x --]
[-- Type: text/plain, Size: 631 bytes --]

diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
index d30871f..5ca734d 100644
--- a/extensions/libxt_conntrack.c
+++ b/extensions/libxt_conntrack.c
@@ -273,7 +273,7 @@ conntrack_ps_expires(struct xt_conntrack_mtinfo2 *info, const char *s)
 		xtables_param_act(XTF_BAD_VALUE, "conntrack", "--expires", s);
 	max = min;
 	if (*end == ':')
-		if (!xtables_strtoui(s, &end, &max, 0, UINT32_MAX))
+		if (!xtables_strtoui(end + 1, &end, &max, 0, UINT32_MAX))
 			xtables_param_act(XTF_BAD_VALUE, "conntrack", "--expires", s);
 	if (*end != '\0')
 		xtables_param_act(XTF_BAD_VALUE, "conntrack", "--expires", s);