Displaying 1 result from an estimated 1 matches for "conntrack_mt_parse".
2013 Nov 23
1
[Bug 873] New: iptables -I CHAIN -m conntrack ! --ctproto 0 is intended to produce an error message, but it doesn't (usually)
...: quentin at armitage.org.uk
Estimated Hours: 0.0
Created attachment 426
--> https://bugzilla.netfilter.org/attachment.cgi?id=426
Patch to correct check for --ctproto 0
There are three issues in the code:
i) the check (sinfo->invflags & XT_INV_PROTO) is using the wrong mask
ii) in conntrack_mt_parse it is testing (info->invert_flags & XT_INV_PROTO)
before the invert bit has been set.
iii) the sense of the error message is the wrong way round
i) To get the error, ! -ctstatus XXX has to be specified, since XT_INV_PROTO ==
XT_CONNTRACK_STATUS
e.g. iptables -I CHAIN -m conntrack ! --ctst...