Re: [PATCH] extensions : multiple to-dst/to-src arguments for ip6t_DNAT/SNAT not reported

[Thierry Du Tre <thierry@dtsystems.be>]

Op 16/01/2018 om 16:24 schreef Pablo Neira Ayuso:
> On Tue, Jan 16, 2018 at 04:23:20PM +0100, Pablo Neira Ayuso wrote:
>> On Tue, Jan 16, 2018 at 04:20:40PM +0100, Thierry Du Tre wrote:
>>> Op 16/01/2018 om 16:06 schreef Thierry Du Tre:
>>>> Op 16/01/2018 om 14:06 schreef Pablo Neira Ayuso:
>>>>> Hi Thierry,
>>>>>
>>>>> On Tue, Jan 16, 2018 at 01:44:37PM +0100, Thierry Du Tre wrote:
>>>>>> This patch is fixing the detection of multiple '--to-destination' in a DNAT rule and '--to-source' in SNAT rule for IPv6.
>>>>>> Currently, when defining multiple values for these, only the last will be used and others ignored silently.
>>>>>>
>>>>>> The checks for (cb->xflags & F_X_TO_[DEST/SRC]) always fails because the flags are never set before.
>>>>>> It seems to be a copy-paste artefact since introduction of the IPv6 DNAT/SNAT extensions based on IPv4 code.
>>>>>>
>>>>>> I also removed the kernel_version checks because they seem useless. Extensions for IPv6 DNAT/SNAT are using xt_target with revision 1.
>>>>>> That seems only added since kernel version 3.7-rc1 and therefore the check for > v2.6.10 will always return true.
>>>>>> The check is probably also coming from the IPv4 copy-paste.
>>>>>
>>>>> Thanks for fixing up this.
>>>>>
>>>>> Would you also send us a patch to add tests:
>>>>>
>>>>>         extensions/libip6t_DNAT.t
>>>>>
>>>>
>>>> The following should cover this patch.
>>>> (without patch, libip6t_SNAT.t and libip6t_DNAT.t will fail)
>>>
>>> Added another test + fixed typo (too late)
>>
>> No problem, send a follow up patch with more tests.
> 
> BTW, the new patch to add more tests needs to go on top of your
> previous patch.

I hope this works :

---
 extensions/libip6t_DNAT.t | 1 +
 extensions/libip6t_SNAT.t | 1 +
 extensions/libipt_DNAT.t  | 1 +
 extensions/libipt_SNAT.t  | 1 +
 4 files changed, 4 insertions(+)

diff --git a/extensions/libip6t_DNAT.t b/extensions/libip6t_DNAT.t
index 0ba96bf..6d8f1da 100644
--- a/extensions/libip6t_DNAT.t
+++ b/extensions/libip6t_DNAT.t
@@ -3,6 +3,7 @@
 -j DNAT --to-destination dead::beef;=;OK
 -j DNAT --to-destination dead::beef-dead::fee7;=;OK
 -j DNAT --to-destination [dead::beef]:1025-65535;;FAIL
+-j DNAT --to-destination [dead::beef] --to-destination [dead::fee7];;FAIL
 -p tcp -j DNAT --to-destination [dead::beef]:1025-65535;=;OK
 -p tcp -j DNAT --to-destination [dead::beef-dead::fee7]:1025-65535;=;OK
 -p tcp -j DNAT --to-destination [dead::beef-dead::fee7]:1025-65536;;FAIL
diff --git a/extensions/libip6t_SNAT.t b/extensions/libip6t_SNAT.t
index 0f14894..d188a6b 100644
--- a/extensions/libip6t_SNAT.t
+++ b/extensions/libip6t_SNAT.t
@@ -3,6 +3,7 @@
 -j SNAT --to-source dead::beef;=;OK
 -j SNAT --to-source dead::beef-dead::fee7;=;OK
 -j SNAT --to-source [dead::beef]:1025-65535;;FAIL
+-j SNAT --to-source [dead::beef] --to-source [dead::fee7];;FAIL
 -p tcp -j SNAT --to-source [dead::beef]:1025-65535;=;OK
 -p tcp -j SNAT --to-source [dead::beef-dead::fee7]:1025-65535;=;OK
 -p tcp -j SNAT --to-source [dead::beef-dead::fee7]:1025-65536;;FAIL
diff --git a/extensions/libipt_DNAT.t b/extensions/libipt_DNAT.t
index a7a45e9..1959801 100644
--- a/extensions/libipt_DNAT.t
+++ b/extensions/libipt_DNAT.t
@@ -3,6 +3,7 @@
 -j DNAT --to-destination 1.1.1.1;=;OK
 -j DNAT --to-destination 1.1.1.1-1.1.1.10;=;OK
 -j DNAT --to-destination 1.1.1.1:1025-65535;;FAIL
+-j DNAT --to-destination 1.1.1.1 --to-destination 2.2.2.2;;FAIL
 -p tcp -j DNAT --to-destination 1.1.1.1:1025-65535;=;OK
 -p tcp -j DNAT --to-destination 1.1.1.1-1.1.1.10:1025-65535;=;OK
 -p tcp -j DNAT --to-destination 1.1.1.1-1.1.1.10:1025-65536;;FAIL
diff --git a/extensions/libipt_SNAT.t b/extensions/libipt_SNAT.t
index 34c5822..186e1cb 100644
--- a/extensions/libipt_SNAT.t
+++ b/extensions/libipt_SNAT.t
@@ -3,6 +3,7 @@
 -j SNAT --to-source 1.1.1.1;=;OK
 -j SNAT --to-source 1.1.1.1-1.1.1.10;=;OK
 -j SNAT --to-source 1.1.1.1:1025-65535;;FAIL
+-j SNAT --to-source 1.1.1.1 --to-source 2.2.2.2;;FAIL
 -p tcp -j SNAT --to-source 1.1.1.1:1025-65535;=;OK
 -p tcp -j SNAT --to-source 1.1.1.1-1.1.1.10:1025-65535;=;OK
 -p tcp -j SNAT --to-source 1.1.1.1-1.1.1.10:1025-65536;;FAIL
-- 
2.7.4