search for: invflag

https://bugzilla.netfilter.org/show_bug.cgi?id=1166 Bug ID: 1166 Summary: negated rule and rule with mistyped interface name looks identical in non-verbose iptables output Product: iptables Version: unspecified Hardware: x86_64 OS: All Status: NEW Severity: enhancement

...==================== RCS file: /cvspublic/netfilter/userspace/iptables.c,v retrieving revision 1.58 diff -u -r1.58 iptables.c --- netfilter//userspace/iptables.c 5 May 2003 19:33:40 -0000 1.58 +++ netfilter//userspace/iptables.c 29 May 2003 04:49:58 -0000 @@ -1254,14 +1254,14 @@ fputc(fw->ip.invflags & IPT_INV_DSTIP ? '!' : ' ', stdout); if (fw->ip.dmsk.s_addr == 0L && !(format & FMT_NUMERIC)) - printf(FMT("%-19s","-> %s"), "anywhere"); + printf(FMT("%-18s ","-> %s "), "anywhere"); else {...

...: netfilter-buglog at lists.netfilter.org ReportedBy: quentin at armitage.org.uk Estimated Hours: 0.0 Created attachment 426 --> https://bugzilla.netfilter.org/attachment.cgi?id=426 Patch to correct check for --ctproto 0 There are three issues in the code: i) the check (sinfo->invflags & XT_INV_PROTO) is using the wrong mask ii) in conntrack_mt_parse it is testing (info->invert_flags & XT_INV_PROTO) before the invert bit has been set. iii) the sense of the error message is the wrong way round i) To get the error, ! -ctstatus XXX has to be specified, since XT_INV_PROT...

...in ipv6header for protocols extensions: icmp6: added missing icmpv6 dest-unreach codes added missing icmpv6 codes in REJECT Anton Danilov (1): xtables: SET target: Add mapping of meta informations (skbinfo ipset extension) Arturo Borrero (38): iptables-compat: kill add_*() invflags parameter nft-compat: create a separated object update type to rename chains nft-bridge: fix printing of inverted protocols, addresses nft-bridge: fix inversion of builtin matches iptables: xtables-eb: delete extra 'policy' printf iptables: xtables-eb: user-de...