John McCann points out via bugzilla that iptables happily accepts this

syntax on DNAT/SNAT:

      --to x.x.x.x:y:z

but doesn't actually make use of the second port.  Clear up the confusion
by only accepting a dash between the ports.

This closes bugzilla #265.

Signed-off-by: Phil Oester <kernel@linuxace.com>

diff --git a/extensions/libipt_DNAT.c b/extensions/libipt_DNAT.c
index d8efa586abe3e7b4b6c15179c59297ef6fd5b86d..96a6e6b522eb1c30e11961120c5f87f346c98a9e 100644 (file)
--- a/extensions/libipt_DNAT.c
+++ b/extensions/libipt_DNAT.c
@@ -65,7 +65,7 @@ static struct ipt_entry_target *
 parse_to(char *arg, int portok, struct ipt_natinfo *info)
 {
        struct ip_nat_range range;
-       char *colon, *dash;
+       char *colon, *dash, *error;
        struct in_addr *ip;
 
        memset(&range, 0, sizeof(range));
@@ -85,6 +85,11 @@ parse_to(char *arg, int portok, struct ipt_natinfo *info)
                        exit_error(PARAMETER_PROBLEM,
                                   "Port `%s' not valid\n", colon+1);
 
+               error = strchr(colon+1, ':');
+               if (error)
+                       exit_error(PARAMETER_PROBLEM,
+                                  "Invalid port:port syntax - use dash\n");
+
                dash = strchr(colon, '-');
                if (!dash) {
                        range.min.tcp.port