summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2011-12-16 18:34:06 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2011-12-23 14:55:39 +0100
commit08628f20f492a1f9178f6df2a276f9a108ac0022 (patch)
tree5f289b30073940a4d6a628f2920b8f1ecb64f0f4
parentb8c42eca0f224a00bf55b60ded81af14a1e07da1 (diff)
libxt_connbytes: fix handling of --connbytes FROM
quoting man page: match packets from a connection whose packets/bytes/average packet size is more than FROM and less than TO bytes/packets. if TO is omitted only FROM check is done. But, when TO was omitted, we did treat it like "x:x" which is not the same at all. Before commit 09631dc60ce41bc484a42fcf4d4ddf7036820bd1 (libxt_connbytes: use guided option parser), we failed to parse "--connbytes x" ('Bad range "x"'), but treated "x:" like "x:0xffffffff". Also, restore the "from must be smaller than to" check. Signed-off-by: Florian Westphal <fw@strlen.de>
-rw-r--r--extensions/libxt_connbytes.c42
1 files changed, 25 insertions, 17 deletions
diff --git a/extensions/libxt_connbytes.c b/extensions/libxt_connbytes.c
index 46a7e4b9..ed2ad25d 100644
--- a/extensions/libxt_connbytes.c
+++ b/extensions/libxt_connbytes.c
@@ -37,9 +37,14 @@ static void connbytes_parse(struct xt_option_call *cb)
switch (cb->entry->id) {
case O_CONNBYTES:
sinfo->count.from = cb->val.u64_range[0];
- sinfo->count.to = cb->val.u64_range[0];
+ sinfo->count.to = UINT64_MAX;
if (cb->nvals == 2)
sinfo->count.to = cb->val.u64_range[1];
+
+ if (sinfo->count.to < sinfo->count.from)
+ xtables_error(PARAMETER_PROBLEM, "%llu should be less than %llu",
+ (unsigned long long)sinfo->count.from,
+ (unsigned long long)sinfo->count.to);
if (cb->invert) {
i = sinfo->count.from;
sinfo->count.from = sinfo->count.to;
@@ -107,19 +112,29 @@ static void print_direction(const struct xt_connbytes_info *sinfo)
}
}
+static void print_from_to(const struct xt_connbytes_info *sinfo, const char *prefix)
+{
+ unsigned long long from, to;
+
+ if (sinfo->count.from > sinfo->count.to) {
+ fputs(" !", stdout);
+ from = sinfo->count.to;
+ to = sinfo->count.from;
+ } else {
+ to = sinfo->count.to;
+ from = sinfo->count.from;
+ }
+ printf(" %sconnbytes %llu", prefix, from);
+ if (to && to < UINT64_MAX)
+ printf(":%llu", to);
+}
+
static void
connbytes_print(const void *ip, const struct xt_entry_match *match, int numeric)
{
const struct xt_connbytes_info *sinfo = (const void *)match->data;
- if (sinfo->count.from > sinfo->count.to)
- printf(" connbytes ! %llu:%llu",
- (unsigned long long)sinfo->count.to,
- (unsigned long long)sinfo->count.from);
- else
- printf(" connbytes %llu:%llu",
- (unsigned long long)sinfo->count.from,
- (unsigned long long)sinfo->count.to);
+ print_from_to(sinfo, "");
fputs(" connbytes mode", stdout);
print_mode(sinfo);
@@ -132,14 +147,7 @@ static void connbytes_save(const void *ip, const struct xt_entry_match *match)
{
const struct xt_connbytes_info *sinfo = (const void *)match->data;
- if (sinfo->count.from > sinfo->count.to)
- printf(" ! --connbytes %llu:%llu",
- (unsigned long long)sinfo->count.to,
- (unsigned long long)sinfo->count.from);
- else
- printf(" --connbytes %llu:%llu",
- (unsigned long long)sinfo->count.from,
- (unsigned long long)sinfo->count.to);
+ print_from_to(sinfo, "--");
fputs(" --connbytes-mode", stdout);
print_mode(sinfo);