Package: iptables
Version: 1.4.14-3
Severity: minor
Dear Maintainer,
The manual page for iptables (or iptables-extensions in the newest
version) does not correctly document the string extension.
The manual page states that a hex-string can be specified using
the option '--hex-string'. However, specifying a sequence of hex chars
just makes it a regular string instead:
# iptables -t filter --append INPUT -m string --algo bm --hex-string
"010203" --jump DROP
# iptables -S INPUT
-A INPUT -m string --string "010203" --algo bm --to 65535 -j DROP
It appears that --hex-string is just like --string, except that
it interprets (only) characters between '|'-characters as a hex string:
# iptables -t filter --append INPUT -m string --algo bm --hex-string
"$(printf "\1\2\3")" --jump DROP
# iptables -S INPUT
-A INPUT -m string --hex-string "|010203|" --algo bm --to 65535 -j DROP
# iptables -t filter -A INPUT -m string --hex-string "|040506|" --algo
bm --to 65535 -j DROP
# iptables -t filter -A INPUT -m string --hex-string "0|00|1|01|"
--algo bm --to 65535 -j DROP
-A INPUT -m string --hex-string "|010203|" --algo bm --to 65535 -j DROP
-A INPUT -m string --hex-string "|040506|" --algo bm --to 65535 -j DROP
-A INPUT -m string --hex-string "|30003101|" --algo bm --to 65535 -j
DROP
Regular '|' and '\' characters that are part of the --hex-string
pattern can be escaped using '\'.
Kind regards,
Rogier.
-- System Information:
Debian Release: wheezy/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: i386 (x86_64)
Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages iptables depends on:
ii libc6 2.13-37
ii libnfnetlink0 1.0.0-1
iptables recommends no packages.
iptables suggests no packages.
-- no debconf information
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
