From 3dc433b55bbfaf9df3ee408aaa6282742f377864 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 20 Sep 2019 17:31:58 +0200 Subject: xtables-restore: Fix --table parameter check Xtables-restore tries to reject rule commands in input which contain a --table parameter (since it is adding this itself based on the previous table line). The manual check was not perfect though as it caught any parameter starting with a dash and containing a 't' somewhere, even in rule comments: | *filter | -A FORWARD -m comment --comment "- allow this one" -j ACCEPT | COMMIT Instead of error-prone manual checking, go a much simpler route: All do_command callbacks are passed a boolean indicating they're called from *tables-restore. React upon this when handling a table parameter and error out if it's not the first one. Fixes: f8e5ebc5986bf ("iptables: Fix crash on malformed iptables-restore") Signed-off-by: Phil Sutter Acked-by: Florian Westphal --- .../shell/testcases/ipt-restore/0009-table-name-comment_0 | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100755 iptables/tests/shell/testcases/ipt-restore/0009-table-name-comment_0 (limited to 'iptables/tests') diff --git a/iptables/tests/shell/testcases/ipt-restore/0009-table-name-comment_0 b/iptables/tests/shell/testcases/ipt-restore/0009-table-name-comment_0 new file mode 100755 index 00000000..4e2202df --- /dev/null +++ b/iptables/tests/shell/testcases/ipt-restore/0009-table-name-comment_0 @@ -0,0 +1,13 @@ +#!/bin/bash + +# when restoring a ruleset, *tables-restore prefixes each rule with +# '-t ' so standard rule parsing routines may be used. This means +# that it has to detect and reject rules which already contain a table option. + +$XT_MULTI iptables-restore <