summaryrefslogtreecommitdiffstats
path: root/iptables/xshared.c
diff options
context:
space:
mode:
authorPhil Sutter <phil@nwl.cc>2019-09-20 17:31:58 +0200
committerPhil Sutter <phil@nwl.cc>2019-10-21 16:15:34 +0200
commit3dc433b55bbfaf9df3ee408aaa6282742f377864 (patch)
tree0e867ad01427cfc52b747064e54b7d10364666f1 /iptables/xshared.c
parent55a7558bb2c86e650809610e976e9d5192fe4e7e (diff)
xtables-restore: Fix --table parameter check
Xtables-restore tries to reject rule commands in input which contain a --table parameter (since it is adding this itself based on the previous table line). The manual check was not perfect though as it caught any parameter starting with a dash and containing a 't' somewhere, even in rule comments: | *filter | -A FORWARD -m comment --comment "- allow this one" -j ACCEPT | COMMIT Instead of error-prone manual checking, go a much simpler route: All do_command callbacks are passed a boolean indicating they're called from *tables-restore. React upon this when handling a table parameter and error out if it's not the first one. Fixes: f8e5ebc5986bf ("iptables: Fix crash on malformed iptables-restore") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'iptables/xshared.c')
-rw-r--r--iptables/xshared.c12
1 files changed, 0 insertions, 12 deletions
diff --git a/iptables/xshared.c b/iptables/xshared.c
index ba723f59..5211b647 100644
--- a/iptables/xshared.c
+++ b/iptables/xshared.c
@@ -533,18 +533,6 @@ void add_param_to_argv(char *parsestart, int line)
}
param.buffer[param.len] = '\0';
-
- /* check if table name specified */
- if ((param.buffer[0] == '-' &&
- param.buffer[1] != '-' &&
- strchr(param.buffer, 't')) ||
- (!strncmp(param.buffer, "--t", 3) &&
- !strncmp(param.buffer, "--table", strlen(param.buffer)))) {
- xtables_error(PARAMETER_PROBLEM,
- "The -t option (seen in line %u) cannot be used in %s.\n",
- line, xt_params->program_name);
- }
-
add_argv(param.buffer, 0);
param.len = 0;
}