Make '-p all' a special case that is handled before calling getprotoent() (Closes: #446)

1 files changed, 7 insertions, 1 deletions

diff --git a/iptables.c b/iptables.c
index b66e5e1..c8ab71e 100644
--- a/iptables.c
+++ b/iptables.c
@@ -229,7 +229,6 @@ static const struct pprot chain_protos[] = {
 	{ "esp", IPPROTO_ESP },
 	{ "ah", IPPROTO_AH },
 	{ "sctp", IPPROTO_SCTP },
-	{ "all", 0 },
 };
 
 static char *
@@ -756,6 +755,13 @@ parse_protocol(const char *s)
 	if (string_to_number(s, 0, 255, &proto) == -1) {
 		struct protoent *pent;
 
+		/* first deal with the special case of 'all' to prevent
+		 * people from being able to redefine 'all' in nsswitch
+		 * and/or provoke expensive [not working] ldap/nis/... 
+		 * lookups */
+		if (!strcmp(s, "all"))
+			return 0;
+
 		if ((pent = getprotobyname(s)))
 			proto = pent->p_proto;
 		else {