diff options
| author | Phil Sutter <phil@nwl.cc> | 2022-03-16 17:14:07 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2022-03-17 09:55:48 +0100 |
| commit | b1aee6b2238794446feba41778f88703784560f7 (patch) | |
| tree | 13be8d334a7e9a2212e7a468124003fc485d23b1 | |
| parent | b555bfed542635259c489596630a75fce50aab1b (diff) | |
nft: Reject standard targets as chain names when restoring
Reuse parse_chain() called from do_parse() for '-N' and rename it for a
better description of what it does.
Note that by itself, this patch will likely kill iptables-restore
performance for big rulesets due to the extra extension lookup for chain
lines. A following patch announcing those chains to libxtables will
alleviate that.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: Florian Westphal <fw@strlen.de>
| -rw-r--r-- | iptables/xshared.c | 4 | ||||
| -rw-r--r-- | iptables/xshared.h | 2 | ||||
| -rw-r--r-- | iptables/xtables-restore.c | 5 |
3 files changed, 4 insertions, 7 deletions
diff --git a/iptables/xshared.c b/iptables/xshared.c index 43321d3b..00828c8a 100644 --- a/iptables/xshared.c +++ b/iptables/xshared.c @@ -1031,7 +1031,7 @@ set_option(unsigned int *options, unsigned int option, u_int16_t *invflg, } } -void parse_chain(const char *chainname) +void assert_valid_chain_name(const char *chainname) { const char *ptr; @@ -1412,7 +1412,7 @@ void do_parse(int argc, char *argv[], break; case 'N': - parse_chain(optarg); + assert_valid_chain_name(optarg); add_command(&p->command, CMD_NEW_CHAIN, CMD_NONE, invert); p->chain = optarg; diff --git a/iptables/xshared.h b/iptables/xshared.h index 0de0e12e..ca761ee7 100644 --- a/iptables/xshared.h +++ b/iptables/xshared.h @@ -244,7 +244,7 @@ char cmd2char(int option); void add_command(unsigned int *cmd, const int newcmd, const int othercmds, int invert); int parse_rulenumber(const char *rule); -void parse_chain(const char *chainname); +void assert_valid_chain_name(const char *chainname); void generic_opt_check(int command, int options); char opt2char(int option); diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c index b3cf4017..b70a3cb1 100644 --- a/iptables/xtables-restore.c +++ b/iptables/xtables-restore.c @@ -155,10 +155,7 @@ static void xtables_restore_parse_line(struct nft_handle *h, "%s: line %u chain name invalid\n", xt_params->program_name, line); - if (strlen(chain) >= XT_EXTENSION_MAXNAMELEN) - xtables_error(PARAMETER_PROBLEM, - "Invalid chain name `%s' (%u chars max)", - chain, XT_EXTENSION_MAXNAMELEN - 1); + assert_valid_chain_name(chain); policy = strtok(NULL, " \t\n"); DEBUGP("line %u, policy '%s'\n", line, policy); |