libxtables: Reject negative port ranges

Analogous to XTTYPE_UINT*RC value parsing, assert consecutive port
values are not lower than previous ones.

Signed-off-by: Phil Sutter <phil@nwl.cc>

4 files changed, 14 insertions, 9 deletions

diff --git a/extensions/libxt_conntrack.t b/extensions/libxt_conntrack.t
index 620e7b54..5e27ddce 100644
--- a/extensions/libxt_conntrack.t
+++ b/extensions/libxt_conntrack.t
@@ -34,22 +34,22 @@
 -m conntrack --ctorigsrcport 4:;-m conntrack --ctorigsrcport 4:65535;OK
 -m conntrack --ctorigsrcport 3:4;=;OK
 -m conntrack --ctorigsrcport 4:4;-m conntrack --ctorigsrcport 4;OK
--m conntrack --ctorigsrcport 4:3;=;OK
+-m conntrack --ctorigsrcport 4:3;;FAIL
 -m conntrack --ctreplsrcport :;-m conntrack --ctreplsrcport 0:65535;OK
 -m conntrack --ctreplsrcport :4;-m conntrack --ctreplsrcport 0:4;OK
 -m conntrack --ctreplsrcport 4:;-m conntrack --ctreplsrcport 4:65535;OK
 -m conntrack --ctreplsrcport 3:4;=;OK
 -m conntrack --ctreplsrcport 4:4;-m conntrack --ctreplsrcport 4;OK
--m conntrack --ctreplsrcport 4:3;=;OK
+-m conntrack --ctreplsrcport 4:3;;FAIL
 -m conntrack --ctorigdstport :;-m conntrack --ctorigdstport 0:65535;OK
 -m conntrack --ctorigdstport :4;-m conntrack --ctorigdstport 0:4;OK
 -m conntrack --ctorigdstport 4:;-m conntrack --ctorigdstport 4:65535;OK
 -m conntrack --ctorigdstport 3:4;=;OK
 -m conntrack --ctorigdstport 4:4;-m conntrack --ctorigdstport 4;OK
--m conntrack --ctorigdstport 4:3;=;OK
+-m conntrack --ctorigdstport 4:3;;FAIL
 -m conntrack --ctrepldstport :;-m conntrack --ctrepldstport 0:65535;OK
 -m conntrack --ctrepldstport :4;-m conntrack --ctrepldstport 0:4;OK
 -m conntrack --ctrepldstport 4:;-m conntrack --ctrepldstport 4:65535;OK
 -m conntrack --ctrepldstport 3:4;=;OK
 -m conntrack --ctrepldstport 4:4;-m conntrack --ctrepldstport 4;OK
--m conntrack --ctrepldstport 4:3;=;OK
+-m conntrack --ctrepldstport 4:3;;FAIL
diff --git a/extensions/libxt_dccp.t b/extensions/libxt_dccp.t
index 535891a5..3655ab6f 100644
--- a/extensions/libxt_dccp.t
+++ b/extensions/libxt_dccp.t
@@ -10,12 +10,12 @@
 -p dccp -m dccp --sport :4;-p dccp -m dccp --sport 0:4;OK
 -p dccp -m dccp --sport 4:;-p dccp -m dccp --sport 4:65535;OK
 -p dccp -m dccp --sport 4:4;-p dccp -m dccp --sport 4;OK
--p dccp -m dccp --sport 4:3;=;OK
+-p dccp -m dccp --sport 4:3;;FAIL
 -p dccp -m dccp --dport :;-p dccp -m dccp --dport 0:65535;OK
 -p dccp -m dccp --dport :4;-p dccp -m dccp --dport 0:4;OK
 -p dccp -m dccp --dport 4:;-p dccp -m dccp --dport 4:65535;OK
 -p dccp -m dccp --dport 4:4;-p dccp -m dccp --dport 4;OK
--p dccp -m dccp --dport 4:3;=;OK
+-p dccp -m dccp --dport 4:3;;FAIL
 -p dccp -m dccp ! --sport 1;=;OK
 -p dccp -m dccp ! --sport 65535;=;OK
 -p dccp -m dccp ! --dport 1;=;OK
diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t
index d62dd5e3..09dff363 100644
--- a/extensions/libxt_udp.t
+++ b/extensions/libxt_udp.t
@@ -11,13 +11,13 @@
 -p udp -m udp --sport :4;-p udp -m udp --sport 0:4;OK
 -p udp -m udp --sport 4:;-p udp -m udp --sport 4:65535;OK
 -p udp -m udp --sport 4:4;-p udp -m udp --sport 4;OK
--p udp -m udp --sport 4:3;=;OK
+-p udp -m udp --sport 4:3;;FAIL
 -p udp -m udp --dport :;-p udp -m udp;OK
 -p udp -m udp ! --dport :;-p udp -m udp;OK;LEGACY;-p udp
 -p udp -m udp --dport :4;-p udp -m udp --dport 0:4;OK
 -p udp -m udp --dport 4:;-p udp -m udp --dport 4:65535;OK
 -p udp -m udp --dport 4:4;-p udp -m udp --dport 4;OK
--p udp -m udp --dport 4:3;=;OK
+-p udp -m udp --dport 4:3;;FAIL
 -p udp -m udp ! --sport 1;=;OK
 -p udp -m udp ! --sport 65535;=;OK
 -p udp -m udp ! --dport 1;=;OK
diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c
index cecf7d35..0a995a63 100644
--- a/libxtables/xtoptions.c
+++ b/libxtables/xtoptions.c
@@ -604,7 +604,7 @@ static void xtopt_parse_mport(struct xt_option_call *cb)
 	const struct xt_option_entry *entry = cb->entry;
 	char *lo_arg, *wp_arg, *arg;
 	unsigned int maxiter;
-	int value;
+	int value, prev = 0;
 
 	wp_arg = lo_arg = xtables_strdup(cb->arg);
 
@@ -634,6 +634,11 @@ static void xtopt_parse_mport(struct xt_option_call *cb)
 			xt_params->exit_err(PARAMETER_PROBLEM,
 				"Port \"%s\" does not resolve to "
 				"anything.\n", arg);
+		if (value < prev)
+			xt_params->exit_err(PARAMETER_PROBLEM,
+				"Port range %d-%d is negative.\n",
+				prev, value);
+		prev = value;
 		if (entry->flags & XTOPT_NBO)
 			value = htons(value);
 		if (cb->nvals < ARRAY_SIZE(cb->val.port_range))