summaryrefslogtreecommitdiffstats
path: root/iptables/iptables-xml.c
Commit message (Collapse)AuthorAgeFilesLines
* xshared: Introduce struct argv_storePhil Sutter2019-10-241-14/+16
| | | | | | | | | | | | The use of global variables in code around add_argv() is error-prone and hard to follow. Replace them by a struct which functions will modify instead of causing side-effects. Given the lack of static variables, this effectively makes argv construction code reentrant. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* iptables-xml: Use add_param_to_argv()Phil Sutter2019-10-241-71/+7
| | | | | | | | | Extend the shared argv parser by storing whether a given argument was quoted or not, then use it in iptables-xml. One remaining extra bit is extraction of chain name in -A commands, do that afterwards in a loop. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* xtables-restore: Introduce rule counter tokenizer functionPhil Sutter2019-10-181-29/+2
| | | | | | | | | | | | | | The same piece of code appears three times, introduce a function to take care of tokenizing and error reporting. Pass buffer pointer via reference so it can be updated to point to after the counters (if found). While being at it, drop pointless casting when passing pcnt/bcnt to add_argv(). Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables_error() does not returnPhil Sutter2019-09-251-15/+7
| | | | | | | | | It's a define which resolves into a callback which in turn is declared with noreturn attribute. It will never return, therefore drop all explicit exit() calls or other dead code immediately following it. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* src: replace IPTABLES_VERSION by PACKAGE_VERSIONJan Engelhardt2019-05-301-3/+3
| | | | | | | | | | | | | The IPTABLES_VERSION C macro replicates the PACKAGE_VERSION C macro (both have the same definition, "@PACKAGE_VERSION@"). Since IPTABLES_VERSION, being located in internal.h, is not exposed to downstream users in any way, it can just be replaced by PACKAGE_VERSION, which saves a configure-time file substitution. This goes towards eliminating unnecessary rebuilds after rerunning ./configure. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* Fix a few cases of pointless assignmentsPhil Sutter2018-09-241-2/+2
| | | | | | | | This gets rid of a number of assignments which are either redundant or not used afterwards. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Consolidate argv construction routinesPhil Sutter2018-08-041-64/+0
| | | | | | | | | | | | | | | | | | | | | Implementations were equal in {ip,ip6,x}tables-restore.c. The one in iptables-xml.c differed slightly. For now, collect all features together. Maybe it would make sense to migrate iptables-xml.c to using add_param_to_argv() at some point and therefore extend the latter to store whether a given parameter was quoted or not. While being at it, a few improvements were done: * free_argv() now also resets 'newargc' variable, so users don't have to do that anymore. * Indenting level in add_param_to_argv() was reduced a bit. * That long error message is put into a single line to aid in grepping for it. * Explicit call to exit() after xtables_error() is removed since the latter does not return anyway. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Consolidate parse_counters()Phil Sutter2018-08-041-16/+0
| | | | | | | | | Move this helper function into xshared. While being at it, drop the need for temporary variables and take over null pointer tolerance from the implementation in iptables-xml.c. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Consolidate DEBUGP macrosPhil Sutter2018-08-041-6/+1
| | | | | | | | | | | | | | | | | | This debug printing macro was defined in various places, always identical. Move it into xshared.h and drop it from sources including that header. There are a few exceptions: * iptables-xml.c did not include xshared.h, which this patch changes. * Sources in extensions and libiptc mostly left alone since they don't include xshared.h (and maybe shouldn't). Only libxt_set.h does, so it's converted, too. This also converts DEBUG define use in libip6t_hbh.c to avoid a compiler warning. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: constify option structArushi Singhal2018-04-111-1/+1
| | | | | | | | The struct of type option is only used to initialise a field and is not modified anywhere. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-xml: Fix segfault on jump without a targetOliver Ford2017-06-191-6/+3
| | | | | | | | | | | | | | | | | As reported in Bugzilla #1152, a segfault occurs in iptables-xml if a jump or goto argument lacks a target argument. The following input will segfault: *filter :INPUT ACCEPT [0:0] -A INPUT -p tcp --dport 2200 -j Problem occurs in do_rule_part, where the existsChain() function is called with argv[arg + 1]. If the jump/goto argument is the last argument, then arg + 1 is out of the array bounds. The fix ensures that arg + 1 is within the array bounds before the call to existsChain() is made. Signed-off-by: Oliver Ford <ojford@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Fix crash on malformed iptables-restoreOliver Ford2017-05-291-3/+5
| | | | | | | | | | | | | | | | | | | | Fixes the crash reported in Bugzilla #1131 where a malformed parameter that specifies the table option during a restore can create an invalid pointer. It was discovered during fuzz testing that options like '-ftf' can cause a segfault. A parameter that includes a 't' is not currently filtered correctly. Improves the filtering to: Filter a beginning '-' followed by a character other than '-' and then a 't' anywhere in the parameter. This filters parameters like '-ftf'. Filter '--t'. Filter '--table', stopping when the parameter length is reached. Because the getopt_long function allows abbreviations, any unique abbreviation of '--table' will be treated as '--table'. This filters parameters like '--t', '--ta', but not '--ttl' or '--target'. Signed-off-by: Oliver Ford <ojford@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Remove explicit static variables initalization.Varsha Rao2017-04-061-5/+5
| | | | | | | | Static variables are initialized to zero by default, so remove explicit initalization. This patch fixes the checkpatch issue. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Spelling fixesVille Skyttä2015-09-071-8/+10
| | | | | | | While at it, update comment format for the respective blocks. Signed-off-by: Ville Skyttä <ville.skytta@iki.fi> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* consistently use <errno.h>Felix Janda2015-05-021-1/+1
| | | | | | | | | On glibc, <sys/errno.h> is a synomym for <errno.h>. <errno.h> is specified by POSIX, so use that. Fixes compilation error with musl libc Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-xml: fix segfault if missing space after -APhil Oester2014-01-291-0/+5
| | | | | | | | | | | | | | As pointed out by Bernhard Reutner-Fischer, a malformed line fed to iptables-xml such as the below with a missing space after the -A: -APOSTROUTING -d 1.1.1.1/32 -p tcp -j MASQUERADE causes a segfault. Patch attached. This closes netfilter bugzilla #886. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-xml: fix parameter parsing (similar to 2165f38)Pablo Neira Ayuso2013-07-261-1/+1
| | | | | | | | Similar to (2165f38 iptables-restore: fix parameter parsing (shows up with gcc-4.7)), make sure iptables-xml doesn't hit the same problem. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: iptables-xml: Fix various parsing bugsPhil Oester2013-07-261-6/+13
| | | | | | | | | | | | | There are two bugs in iptables-xml do_rule_part parsing corrected by this patch: 1) Ignore "-A <chain>" instead of just "-A" 2) When checking to see if we need a <match> tag, inversion needs to be taken into account This closes netfilter bugzilla #679. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: resolve old macro names that are indirectionsJan Engelhardt2011-09-111-18/+18
| | | | | | | | | | | Command used: git grep -f <(pcregrep -hior '(?<=#define\s)IP6?(T_\w+)(?=\s+X\1)' include/) and then fix all occurrences. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: remove unused IPTABLES_MULTI defineJan Engelhardt2011-08-261-9/+0
| | | | | | This dead code has been lingering around since commit v1.4.5~7. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* iptables: Coverity: REVERSE_INULLJiri Popelka2011-06-221-2/+1
| | | | | | | | | | | | | | ip6tables-restore.c:186: deref_ptr_in_call: Dereferencing pointer "in". ip6tables-restore.c:463: check_after_deref: Dereferencing "in" before a null check. iptables-restore.c:192: deref_ptr_in_call: Dereferencing pointer "in". iptables-restore.c:468: check_after_deref: Dereferencing "in" before a null check. iptables-xml.c:671: deref_ptr_in_call: Dereferencing pointer "in". iptables-xml.c:873: check_after_deref: Dereferencing "in" before a null check. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* src: move all iptables pieces into a separate directoryJan Engelhardt2011-06-071-0/+874
(Unclutter top-level dir) Signed-off-by: Jan Engelhardt <jengelh@medozas.de>