Error parsing rules with tcp flag matches

[josh-cf]

I have iptables rules matching TCP SYN traffic. I can successfully add rules with SYN flag matches. But when I try and parse rules with TCP flag matches, I get a ValueError.

Code to replicate:

import iptc
rule = iptc.Rule()
rule.protocol = "tcp"
rule.dst = "1.1.1.1"
match = iptc.Match(rule, "tcp")
match.syn = "1"
rule.add_match(match)
rule.target = iptc.Target(rule, "ACCEPT")
chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), "iptc_test_chain")
iptc.Table(iptc.Table.FILTER).create_chain(chain)
chain.insert_rule(rule)
try:
    print chain.rules[0].matches[0].name
except:
    print "error parsing rule"

chain.delete_rule(rule)
iptc.Table(iptc.Table.FILTER).delete_chain(chain)

The error:

File "/usr/local/lib/python2.7/dist-packages/python_iptables-0.2.0_dev-py2.7-linux-x86_64.egg/iptc/ip4tc.py", line 1236, in _get_rules
return [self.table.create_rule(e, self) for e in entries]
File "/usr/local/lib/python2.7/dist-packages/python_iptables-0.2.0_dev-py2.7-linux-x86_64.egg/iptc/ip4tc.py", line 1525, in create_rule
return Rule(entry, chain)
File "/usr/local/lib/python2.7/dist-packages/python_iptables-0.2.0_dev-py2.7-linux-x86_64.egg/iptc/ip4tc.py", line 711, in init
self.rule = entry
File "/usr/local/lib/python2.7/dist-packages/python_iptables-0.2.0_dev-py2.7-linux-x86_64.egg/iptc/ip4tc.py", line 1090, in _set_rule
m = Match(self, match=match)
File "/usr/local/lib/python2.7/dist-packages/python_iptables-0.2.0_dev-py2.7-linux-x86_64.egg/iptc/ip4tc.py", line 428, in init
self._update_parameters()
File "/usr/local/lib/python2.7/dist-packages/python_iptables-0.2.0_dev-py2.7-linux-x86_64.egg/iptc/ip4tc.py", line 344, in update_parameters
self.setattr(k, v)
File "/usr/local/lib/python2.7/dist-packages/python_iptables-0.2.0_dev-py2.7-linux-x86_64.egg/iptc/ip4tc.py", line 348, in setattr
self.parse(name.replace("", "-"), value)
File "/usr/local/lib/python2.7/dist-packages/python_iptables-0.2.0_dev-py2.7-linux-x86_64.egg/iptc/ip4tc.py", line 267, in parse
self._parse(argv, inv, entry)
File "/usr/local/lib/python2.7/dist-packages/python_iptables-0.2.0_dev-py2.7-linux-x86_64.egg/iptc/ip4tc.py", line 450, in _parse
ct.cast(self._ptrptr, ct.POINTER(ct.c_void_p)))
File "/usr/local/lib/python2.7/dist-packages/python_iptables-0.2.0_dev-py2.7-linux-x86_64.egg/iptc/xtables.py", line 735, in new
ret = fn(*args)
File "/usr/local/lib/python2.7/dist-packages/python_iptables-0.2.0_dev-py2.7-linux-x86_64.egg/iptc/xtables.py", line 1024, in parse_match
self._parse(m, argv, invert, flags, fw, ptr)
File "/usr/local/lib/python2.7/dist-packages/python_iptables-0.2.0_dev-py2.7-linux-x86_64.egg/iptc/xtables.py", line 931, in _parse
raise ValueError("invalid value %s" % (argv[1]))
ValueError: invalid value FIN,SYN,RST,ACK SYN

[ldx]

Can you check the git hash version you use? I believe this one has been fixed recently.

[josh-cf]

I pulled and tcp flag matches have been fixed. Thank you for your work on this module.

>>> import iptc
>>> rule = iptc.Rule()
>>> match = iptc.Match(rule, 'tcp')
>>> match.tcp_flags = "FIN,SYN,RST,ACK ACK"
>>> print match.parameters
{'tcp_flags': 'FIN,SYN,RST,ACK ACK'}
>>> match.syn = "1"
>>> print match.parameters
{'tcp_flags': 'FIN,SYN,RST,ACK SYN'}

[ccrssaa]

regression ?

>>> print(iptc.version.__version__)
0.14.0-dev
>>> rule = iptc.Rule()
>>> match = iptc.Match(rule, 'tcp')
>>> match.tcp_flags = "FIN,SYN,RST,ACK ACK"
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/root/python-iptables/iptc/ip4tc.py", line 455, in __setattr__
    self.parse(name.replace("_", "-"), value)
  File "/root/python-iptables/iptc/ip4tc.py", line 332, in parse
    self._parse(argv, inv, entry)
  File "/root/python-iptables/iptc/ip4tc.py", line 600, in _parse
    self._orig_parse, self._orig_options)
  File "/root/python-iptables/iptc/xtables.py", line 869, in new
    return fn(*args)
  File "/root/python-iptables/iptc/xtables.py", line 1174, in parse_match
    self._parse(m, argv, invert, flags, fw, ptr)
  File "/root/python-iptables/iptc/xtables.py", line 1081, in _parse
    raise ValueError("invalid value %s" % (argv[1]))
ValueError: invalid value b'FIN,SYN,RST,ACK ACK'
>>>

[ccrssaa]

oops sorry looks like an undocumented feature:

>>> import iptc
>>> rule = iptc.Rule()
>>> match = iptc.Match(rule, 'tcp')
>>> match.tcp_flags = [ 'FIN,SYN,RST,ACK', 'ACK' ]
>>> print(match.tcp_flags)
FIN,SYN,RST,ACK ACK
>>>