Commit 77cb270a authored by Jussi Laakkonen's avatar Jussi Laakkonen

[connman] Increase list of non-supported iptables mathces. JB#43926

This commit blacklists following iptables matches defined with -m:
 - IPv4: iprange, recent, owner
 - IPv6: iprange, recent, owner, ttl

These will cause crash or errors that are not recoverable. The match -m
owner can be supported but requires more checks. It requires at least
one of --uid-owner, --gid-owner or --socket-exists additional switches.
There may be more to investigate on that -m owner.

Re-enabled IPv6 multiport which seems to work ok.
parent 4b73036e
......@@ -1254,17 +1254,22 @@ static bool is_supported(int type, enum iptables_switch_type switch_type,
const char *not_supported_matches_ipv4[] = { "comment",
"state",
"iprange",
"recent",
"owner",
NULL
};
/*
* For yet unknown reason following work with IPv4 but not with IPv6:
-m conntrack
-m multiport
*/
const char *not_supported_matches_ipv6[] = { "comment",
"state",
"iprange",
"recent",
"owner",
"conntrack",
"multiport",
"ttl",
NULL
};
......
......@@ -1184,7 +1184,7 @@ static const char *invalid_general_output[] = {
};
static const char *invalid_general_forward[] = {
"-j ACCEPT -j DROP",
"-p udp -m udp -m multiport -m udp --dport 654 -j DROP",
"-p udp -m udp -m multiport --dport 654 -j DROP",
NULL
};
static const char *invalid_eth_input[] = {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment