summaryrefslogtreecommitdiffstats
path: root/extensions/libxt_string.c
Commit message (Collapse)AuthorAgeFilesLines
* libxt_string: Fix array out of bounds checkPhil Sutter2018-09-181-2/+4
| | | | | | | | | | | | | | | | | | Commit 56d7ab42f3782 ("libxt_string: Avoid potential array out of bounds access") tried to fix parse_hex_string() for overlong strings but the change still allowed for 'sindex' to become XT_STRING_MAX_PATTERN_SIZE which leads to access of first byte after info->pattern. This is not really a problem because it merely overwrites info->patlen before calling xtables_error() later, but covscan still detects it so it's still worth fixing. The crucial bit here is that 'sindex' has to be incremented at end of the last iteration since its value is used for info->patlen. Hence just move the overflow check to the beginning of the loop. Fixes: 56d7ab42f3782 ("libxt_string: Avoid potential array out of bounds access") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxt_string: Avoid potential array out of bounds accessPhil Sutter2018-09-131-2/+1
| | | | | | | | | | | The pattern index variable 'sindex' is bounds checked before incrementing it, which means in the next loop iteration it might already match the bounds check condition but is used anyway. Fix this by incrementing the index before performing the bounds check. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxt_string: escape the escaping char tooJan Engelhardt2011-08-261-1/+1
| | | | | References: http://bugzilla.netfilter.org/show_bug.cgi?id=740 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_string: replace hex codes by char equivalentsJan Engelhardt2011-08-251-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_string: simplify hex output routineJan Engelhardt2011-08-251-7/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_string: fix space around argumentsDwight Davis2011-08-201-2/+2
| | | | | | | Fix oversight from commit v1.4.11~80. References: http://bugs.debian.org/637499 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_string: define _GNU_SOURCE for strnlenJan Engelhardt2011-08-011-0/+1
| | | | | | | | | On RHEL-5.6 and clones with its gcc-4.1.2 and glibc-2.5: libxt_string.c: In function "parse_string": libxt_string.c:84: warning: implicit declaration of function "strnlen" Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_string: use guided option parserJan Engelhardt2011-04-131-91/+47
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: remove redundant init functionsJan Engelhardt2011-02-191-2/+1
| | | | | | The main program already zeroes the per-extension data block. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: do not print trailing whitespacesJan Engelhardt2011-01-311-14/+14
| | | | | | | | | | | | | | | | | Due to the use of printf("foobar "), iptables emits spaces at the end-of-line, which looks odd to some users because it causes the terminal to wrap even if there is seemingly nothing to print. It may also have other points of annoyance, such as mailers interpreting a trailing space as an indicator that the paragraph continues when format=flowed is also on. And git highlights trailing spaces in red, so let's avoid :) Preexisting inconsistencies in outputting spaces in the right spot are also addressed right away. References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=429579 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: remove no longer necessary default: casesJan Engelhardt2011-01-081-3/+0
| | | | | | | Match and target parse functions now only get option characters they have defined themselves. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* all: consistent syntax use in struct optionJan Engelhardt2010-07-231-7/+8
| | | | | | Try to inhibit copypasting old stuff. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables/extensions: make bundled options work againJan Engelhardt2009-11-031-2/+2
| | | | | | | | | | | | | When using a bundled option like "-ptcp", 'argv[optind-1]' would logically point to "-ptcp", but this is obviously not right. 'optarg' is needed instead, which if properly offset to "tcp". Not all places change optind-based access to optarg; where look-ahead is needed, such as for tcp's --tcp-flags option for example, optind is ok. References: http://bugzilla.netfilter.org/show_bug.cgi?id=611 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: hand argv to xtables_check_inverseJan Engelhardt2009-11-031-2/+2
| | | | | | | | | In going to fix NF bug #611, "argv" is needed in xtables_check_inverse to set "optarg" to the right spot in case of an intrapositional negation. References: http://bugzilla.netfilter.org/show_bug.cgi?id=611 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: collapse data variables to use multi-reg callsJan Engelhardt2009-06-261-32/+32
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: use NFPROTO_UNSPEC for .family fieldJan Engelhardt2009-06-011-2/+2
| | | | | | | | This constant would be the designated one for the .family field; it also, given recent changes, makes grep for NFPROTO_UNSPEC work to finally recollect all manpages. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* string: fix wrong pattern length calculationPablo Neira Ayuso2009-03-021-4/+4
| | | | | | | | This fixes a problem introduced in 37b4bde745698bf140d74e59a2561f34deeb8726 that leads to the wrong calculation of the pattern length in the string match. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: prefix exit_error to xtables_errorJan Engelhardt2009-02-211-19/+19
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxt_string: fix undefined behavior/incorrect patlen calculationJan Engelhardt2009-02-121-1/+3
| | | | | | | strlen ran over the end of the string. Use strnlen to bound it. Reference: http://bugs.debian.org/513516 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* libxtables: prefix/order - move check_inverse to xtables.cJan Engelhardt2009-01-301-2/+2
| | | | | | | This also adds a warning that intrapositional negation support is deprecated. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* extensions: use UINT_MAX constants over open-coded bits (1/2)Jan Engelhardt2009-01-271-1/+1
| | | | | | ~0 depends on the sizeof(int), so it is better to use UINT32_MAX. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables-save: output ! in position according to manpageJan Engelhardt2008-12-091-2/+2
| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: Update commentsJan Engelhardt2008-09-011-8/+0
| | | | | | | | A number of comments are redundant, some outdated and others outright wrong in their own way. Remove and fixup. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* xt_string: string extension case insensitive matchingJoonwoo Park2008-07-071-10/+60
| | | | | | | | | The string extension can search patterns case insensitively with --icase option. A new revision 1 was added, in the meantime invert of xt_string_info was moved into flags as a flag. Signed-off-by: Joonwoo Park <joonwpark81@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* manpage updatesJan Engelhardt2008-06-081-2/+2
| | | | | | | | | A number of options support negation, but the manpage did not reflect this ("[!]" was absent). Also fix a few [] (optional arguments) to {} (required arguments) in the option-BNF. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Remove old functions, constantsJan Engelhardt2008-04-151-4/+3
|
* Implement AF_UNSPEC as a wildcard for extensionsJan Engelhardt2008-04-141-18/+1
|
* fix gcc warningsMax Kellermann2008-01-291-1/+1
| | | | Max Kellermann <max@duempel.org>
* Unique symbols 1/6Jan Engelhardt2007-10-041-35/+28
| | | | | | | | | | | Give symbols of libxt matches unique names (1/3). Adds unique prefixes to all functions (most of them - especially the hook functions) so that debugging programs can unambiguously map a symbol to an address. Also unifies the names of the xtables_match/xtables_target structs, (based upon libxt_connmark.c/libip6t_*.c). Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
* Fix sparse warnings: non-ANSI function declarations, 0 used as pointerPatrick McHardy2007-09-081-6/+6
|
* Remove last vestiges of NFC (Peter Riley <Peter.Riley@hotpop.com>)Peter Riley2007-09-021-2/+1
|
* Make the option structures const.Jan Engelhardt2007-07-301-1/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
* Add IPv6 support to string matchYasuyuki KOZAKAI2007-07-241-0/+16
|
* Moves libipt_string.c to libxt_string.cYasuyuki KOZAKAI2007-07-241-0/+355