Skip to content

Fix incorrect addition of rule to PREROUTING mangle chain#1

Open
albertmichaelj wants to merge 1 commit intomasterfrom
albertmichaelj-patch-1
Open

Fix incorrect addition of rule to PREROUTING mangle chain#1
albertmichaelj wants to merge 1 commit intomasterfrom
albertmichaelj-patch-1

Conversation

@albertmichaelj
Copy link
Owner

In the current iptables init script, the mangle table has a rule added to jump to the MINIUPNPD chain in the mangle table added to PREROUTING. However, if you look at iptables_removeall.sh, it tries to remove the rule from the FORWARD chain instead (see the line here. This changes the init script to add the jump rule to the FORWARD chain instead of the PREROUTING chain.

When this is not done, the mangle table is not properly reset on calling the iptables_removeall.sh script. Specifically the rule jumping to MINIUPNPD and the MINIUPNPD chain itself remain (though rules are correctly flushed). Additionally, there is an error message in the logs as follows:

REDACTED iptables_removeall.sh[1850]: iptables: No chain/target/match by that name.
REDACTED iptables_removeall.sh[1851]: iptables: Too many links.

To be frank, I am not certain that the intended chain to add the jump rule to is the FORWARD chain. The mistake might be in iptables_removeall.sh in trying to remove the rule from the FORWARD chain. However, to the best I can understand, the mangle table is used to adjust the DSCP of incoming packets (though to be clear, I don't understand when and why this is done in the UPnP protocol), and by looking at other examples online, it seems like the FORWARD chain on the mangle table is the most common place to adjust DSCP values. Additionally, the git blame for the line in iptables_removeall.sh shows that the FORWARD chain was used first (iptables_removeall.sh was edited nine years ago to add the removal rule, while iptables_init.sh was added two years ago). All of this leads me to believe that the correct chain is the FORWARD chain.

In the current iptables init script, the mangle chain has a rule added to jump to the MINIUPNPD table in the mangle chain added to PREROUTING. However, if you look at `iptables_removeall.sh`, it tries to remove the rule from the `FORWARD` chain instead. This changes the init script to add the jump rule to the FORWARD table instead of the PREROUTING table.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant